@weavetab/mcp 2.5.0-beta.1 → 2.5.0-beta.4

package/dist/cdp/connector.js

@@ -7,9 +7,9 @@ import { logDebug } from "../audit/logger.js";
  */
 import CDP from "chrome-remote-interface";
 import { blockStorageAccess } from "../security/guard.js";
-import { launchWithBridge, injectStealthScript } from "./bridge.js";
+import { launchWithBridge, launchElectronApp, injectStealthScript } from "./bridge.js";
 import { setupOverlay, ensureVisualLayer } from "../overlay/injector.js";
-import { onConfigChange, saveConfig, loadConfigSync, getCachedConfig, getConfigAgentId, getConfigCookies, getConfigProfileDir, getConfigMode } from "../config/loader.js";
+import { onConfigChange, saveConfig, loadConfigSync, getCachedConfig, getConfigAgentId, getConfigCookies, getConfigProfileDir, getConfigMode, getElectronAppConfig, getConfigExtension } from "../config/loader.js";
 import { sessionRegistry } from "../state/session.js";
 import { initConsoleBuffering } from "../tools/console.js";
 import { registerMutationListener, clearTabCache } from "../state/cache.js";
@@ -17,6 +17,7 @@ import { recordTabActivity } from "../tools/tabs.js";
 import { initDialogHandler } from "../tools/dialog.js";
 import { WT_REGISTRY_INIT_EXPR } from "./walker.js";
 import { urcInvalidate } from "./ref_cache.js";
+import { marksInvalidate } from "../intelligence/marks.js";
 import { readLock, clearLock, isLockValid, isLockPending, acquireMutex } from "./lock.js";
 import { getSessionProfile } from "./profiles.js";
 import { safelyKillWeavetabProcesses, verifyProfileIsolation, verifyBrowserFingerprint, clearProfileVerificationCache } from "./security.js";
@@ -95,12 +96,20 @@ async function waitForPageReady(session) {
     });
 }
 // ─── Session init (overlay + re-injection) ───────────────────────────────────
-async function initSession(session, targetId, port, config) {
+async function initSession(session, targetId, port, config, isElectron) {
     initDialogHandler(session);
-    // Initialize Omni-Context Broker for iframes
     const { initOmniBroker } = await import("./omni_broker.js");
     await initOmniBroker(session, targetId, port);
-    if (activeEngine === "chromium") {
+    if (isElectron) {
+        // Electron desktop app initialization
+        try {
+            await session.Page.addScriptToEvaluateOnNewDocument({ source: WT_REGISTRY_INIT_EXPR });
+        }
+        catch { /* non-fatal */ }
+        // Direct DOM minimal overlay injection without Chrome Extension
+        await ensureVisualLayer(session, config);
+    }
+    else if (activeEngine === "chromium") {
         // Only block cookies/storage when cookies mode is disabled
         if (!getConfigCookies(config)) {
             await blockStorageAccess(session);
@@ -142,7 +151,8 @@ async function initSession(session, targetId, port, config) {
         clearTabCache(targetId);
         // Invalidate URC on navigation — elements from the old page are stale
         urcInvalidate(targetId);
-        if (activeEngine === "chromium") {
+        marksInvalidate(targetId);
+        if (isElectron || activeEngine === "chromium") {
             try {
                 await waitForPageReady(session);
                 const cfg = getCachedConfig();
@@ -154,8 +164,8 @@ async function initSession(session, targetId, port, config) {
             catch { /* ignore */ }
         }
     });
-    // Diagnostic: verify extension content script loaded
-    if (activeEngine === "chromium") {
+    // Diagnostic: verify extension content script loaded (Standard browser only)
+    if (!isElectron && activeEngine === "chromium" && getConfigExtension(config) !== false) {
         try {
             // Check for multiple indicators that extension is loaded
             const { result: extCheck } = await session.Runtime.evaluate({
@@ -174,29 +184,12 @@ async function initSession(session, targetId, port, config) {
             else {
                 logDebug(`[Weavetab] [!] Extension content script NOT detected — HUD/overlay may not work`);
                 logDebug(`[Weavetab] [!] Try reloading page or check if extension loaded in browser://extensions`);
-                // Try to inject a basic error indicator into the page
-                try {
-                    await session.Runtime.evaluate({
-                        expression: `
-              (function() {
-                const div = document.createElement('div');
-                div.style.cssText = 'position:fixed;top:10px;right:10px;background:red;color:white;padding:10px;z-index:999999;font-family:sans-serif;font-size:14px;';
-                div.textContent = 'WeaveTab Extension Not Loaded';
-                document.body.appendChild(div);
-                setTimeout(() => div.remove(), 5000);
-              })()
-            `
-                    });
-                }
-                catch { /* ignore */ }
             }
         }
         catch (checkErr) {
             logDebug(`[Weavetab] [!] Extension health check failed: ${checkErr}`);
         }
-    }
-    // Push config + initial idle state to extension right away (Chrome only)
-    if (activeEngine === "chromium") {
+        // Push config + initial idle state to extension right away (Chrome only)
         const { sendToExtension } = await import("../cdp/helpers.js");
         sendToExtension(session, {
             type: 'Weavetab_CONFIG',
@@ -207,8 +200,7 @@ async function initSession(session, targetId, port, config) {
             state: 'idle',
         }).catch(() => { });
     }
-    // Analytics ping every 5s — stored per-tab so each interval can be
-    // independently cancelled when the tab closes or cleanupAll() is called.
+    // Analytics ping every 30s
     const sessionStartTime = Date.now();
     const analyticsInterval = setInterval(async () => {
         try {
@@ -225,34 +217,138 @@ async function initSession(session, targetId, port, config) {
             }).catch(() => { });
         }
         catch { /* ignore */ }
-    }, 30_000); // 30s interval — reduced from 5s to cut idle CDP overhead (6 round-trips/min → 1)
-    // Register in the per-tab map so cleanupAll() and the session-close handler can
-    // cancel it without relying on a single overwriteable global slot.
+    }, 30_000);
     analyticsIntervals.set(targetId, analyticsInterval);
-    // unref() so this polling interval does not pin the Node.js event loop.
-    // An orphaned MCP process (IDE disconnected, browser closed) would otherwise
-    // stay alive indefinitely due to this 30s interval firing forever.
     analyticsInterval.unref();
 }
 // ─── Main connection entry point ──────────────────────────────────────────────
-export async function getOrConnect(config) {
-    if (getConfigMode(config) === "attach") {
-        throw new Error("[!] Attach mode (connect to your real browser) coming soon. Use session mode for now.");
+export async function getOrConnect(config, targetApp) {
+    if (getConfigMode(config) === "attach" && !targetApp) {
+        // track as limitation - use session mode
+        const err = new Error("[!] Attach mode is not yet supported. Use session mode (default) instead.");
+        err.code = "NOT_IMPLEMENTED";
+        throw err;
     }
-    const activeClient = sessionRegistry.getActive(getConfigAgentId(config));
+    // 1. Check existing active session for this agent & app
+    const activeClient = sessionRegistry.getActive(getConfigAgentId(config), targetApp);
     if (activeClient) {
         try {
             await activeClient.session.Browser.getVersion();
             return activeClient;
         }
         catch {
-            logDebug("[Weavetab CDP] Connection lost. Reconnecting...");
+            logDebug(`[Weavetab CDP] Connection lost for ${targetApp || "browser"}. Reconnecting...`);
             clearProfileVerificationCache(activeClient.targetId);
             sessionRegistry.unregister(activeClient.targetId);
         }
     }
-    const releaseMutex = await acquireMutex();
+    const releaseMutex = await acquireMutex(targetApp);
     try {
+        if (targetApp) {
+            // ──────────────── ELECTRON APP CONNECTION FLOW ────────────────
+            const appCfg = getElectronAppConfig(targetApp, config);
+            if (!appCfg) {
+                throw new Error(`[Weavetab] ✗ Electron app "${targetApp}" is not configured in config.json.\n` +
+                    `  Please add an entry under "electron": { "${targetApp}": "C:\\\\path\\\\to\\\\app.exe" } in your config.`);
+            }
+            let port = null;
+            const sessionLock = readLock(targetApp);
+            if (sessionLock && sessionLock.mode === "session") {
+                if (isLockPending(sessionLock)) {
+                    logDebug(`[Weavetab] Launch in progress for ${targetApp} by PID ${sessionLock.pid}. Waiting up to 5s...`);
+                    for (let i = 0; i < 5; i++) {
+                        await new Promise(r => setTimeout(r, 1000));
+                        const updatedLock = readLock(targetApp);
+                        if (!updatedLock || !isLockPending(updatedLock))
+                            break;
+                    }
+                }
+                const freshLock = readLock(targetApp);
+                if (freshLock && (await isLockValid(freshLock))) {
+                    port = freshLock.port;
+                }
+                else {
+                    clearLock(targetApp);
+                }
+            }
+            let targets = [];
+            if (port) {
+                try {
+                    targets = await withCDPTimeout(CDP.List({ host: "127.0.0.1", port }), 3000, "CDP.List existing Electron");
+                }
+                catch {
+                    port = null;
+                }
+            }
+            if (!port || targets.length === 0) {
+                logDebug(`[Weavetab CDP] Launching Electron app ${targetApp}...`);
+                const launchResult = await launchElectronApp(targetApp, config);
+                port = launchResult.port;
+                // Poll for target window availability (Electron may take up to 2-3s to render initial window)
+                for (let retry = 0; retry < 10; retry++) {
+                    try {
+                        targets = await withCDPTimeout(CDP.List({ host: "127.0.0.1", port }), 2000, "CDP.List Electron retry");
+                        if (targets.length > 0)
+                            break;
+                    }
+                    catch { /* wait */ }
+                    await new Promise(r => setTimeout(r, 500));
+                }
+            }
+            let pageTarget = targets.find(t => t.type === "page" || t.type === "webview" || t.type === "app") ?? targets[0];
+            if (!pageTarget) {
+                throw new Error(`[Weavetab] ✗ No window or webview target found in Electron app "${targetApp}".`);
+            }
+            const targetId = pageTarget.id || pageTarget.targetId;
+            const session = await withCDPTimeout(CDP({ host: "127.0.0.1", port, target: targetId }), 5000, "CDP connect Electron target");
+            session.on("close", () => {
+                logDebug(`[Weavetab CDP] Electron session WebSocket closed (${targetApp}) — unregistering.`);
+                const iv = analyticsIntervals.get(targetId);
+                if (iv) {
+                    clearInterval(iv);
+                    analyticsIntervals.delete(targetId);
+                }
+                clearProfileVerificationCache(targetId);
+                import("./omni_broker.js").then(m => m.cleanupOmniBroker(targetId)).catch(() => { });
+                import("../tools/network_intercept.js").then(m => m.cleanupNetworkIntercept(session)).catch(() => { });
+                sessionRegistry.unregister(targetId);
+            });
+            session.on("error", (err) => {
+                logDebug(`[Weavetab CDP] Electron session WebSocket error (${targetApp}):`, err?.message ?? err);
+            });
+            // Validate connection health
+            try {
+                await session.Browser.getVersion();
+            }
+            catch {
+                throw new Error("Failed health check: CDP session connected to Electron app but getVersion failed.");
+            }
+            await Promise.all([
+                session.Accessibility.enable(),
+                session.DOM.enable(),
+                session.Page.enable(),
+                session.Runtime.enable(),
+                session.Network.enable().catch(() => { }),
+                session.Performance.enable().catch(() => { })
+            ]);
+            await wireUiConfigBinding(session);
+            await initSession(session, targetId, port, config, true);
+            await session.Target.setDiscoverTargets({ discover: true }).catch(() => { });
+            logDebug(`[Weavetab CDP] [OK] Active Electron target: ${pageTarget.title || pageTarget.url || targetApp}`);
+            const client = {
+                session,
+                targetId,
+                url: pageTarget.url || "",
+                title: pageTarget.title || targetApp,
+                overlayInstalled: false,
+                agentId: getConfigAgentId(config),
+                appName: targetApp,
+                isElectron: true,
+            };
+            sessionRegistry.register(targetId, client);
+            return client;
+        }
+        // ──────────────── STANDARD WEB BROWSER FLOW ────────────────
         const sessionLock = readLock();
         if (sessionLock && sessionLock.mode === "session") {
             if (isLockPending(sessionLock)) {
@@ -413,7 +509,7 @@ export async function getOrConnect(config) {
                 // Continue anyway for now - in production this should be a hard failure
             }
             else {
-                logDebug(`[Weavetab Security] Browser fingerprint verified successfully`);
+                logDebug(`[Weavetab Security] Browser fingerprint verified`);
             }
         }
         // NOTE: initSession() already installs the frameNavigated handler (overlay
@@ -429,7 +525,7 @@ export async function getOrConnect(config) {
             // Continue anyway for now - in production this should be a hard failure
         }
         else {
-            logDebug(`[Weavetab Security] Profile isolation verified successfully`);
+            logDebug(`[Weavetab Security] Profile isolation`);
         }
         await session.Target.setDiscoverTargets({ discover: true });
         session.on("Target.targetActivated", (event) => {
@@ -437,7 +533,7 @@ export async function getOrConnect(config) {
             if (activatedId) {
                 const client = sessionRegistry.getAll().find(c => c.targetId === activatedId);
                 if (client) {
-                    sessionRegistry.setActive(activatedId, client.agentId);
+                    sessionRegistry.setActive(activatedId, client.agentId, client.appName);
                 }
             }
         });
@@ -491,28 +587,34 @@ export async function getOrConnect(config) {
         await releaseMutex();
     }
 }
-export async function getTabList(agentId) {
+export async function getTabList(agentId, targetApp) {
     const config = getCachedConfig();
-    // Validate the lock before blindly connecting (same two-factor check that
-    // getOrConnect() performs). A stale lock after a server restart would otherwise
-    // produce raw ECONNREFUSED.
-    let port = actualPort;
-    if (!port) {
-        const lock = readLock();
-        if (lock && lock.mode === "session") {
-            const valid = await isLockValid(lock);
-            if (valid) {
-                port = lock.port;
-            }
-            else {
-                logDebug("[Weavetab CDP] getTabList: stale lock detected — clearing.");
-                clearLock();
-                port = null;
+    let port = null;
+    if (targetApp) {
+        const lock = readLock(targetApp);
+        if (lock && (await isLockValid(lock))) {
+            port = lock.port;
+        }
+    }
+    else {
+        port = actualPort;
+        if (!port) {
+            const lock = readLock();
+            if (lock && lock.mode === "session") {
+                const valid = await isLockValid(lock);
+                if (valid) {
+                    port = lock.port;
+                }
+                else {
+                    logDebug("[Weavetab CDP] getTabList: stale lock detected — clearing.");
+                    clearLock();
+                    port = null;
+                }
             }
         }
     }
     if (!port)
-        throw new Error("[!] No active browser session. Run browser_go first.");
+        throw new Error(`[!] No active ${targetApp ? targetApp : "browser"} session. Run browser_go or launch app first.`);
     try {
         const metaSession = await withCDPTimeout(CDP({ host: "127.0.0.1", port }), 5000, "getTabList CDP");
         const { targetInfos } = await withCDPTimeout(metaSession.Target.getTargets(), 5000, "getTabList getTargets");
@@ -520,21 +622,21 @@ export async function getTabList(agentId) {
         const aid = agentId || getConfigAgentId(config);
         const bctxId = sessionRegistry.getBrowserContextIdForAgent(aid);
         return targetInfos
-            .filter(t => t.type === "page" && (!bctxId || t.browserContextId === bctxId))
+            .filter(t => (t.type === "page" || t.type === "webview" || t.type === "app" || t.type === "other" || t.type === "iframe") && (!bctxId || t.browserContextId === bctxId))
             .map(t => ({
             id: t.targetId,
-            title: t.title,
+            title: t.title || t.url || t.type,
             url: t.url,
             type: t.type,
         }));
     }
     catch {
-        throw new Error(`[!] Weavetab cannot reach browser on port ${port}.`);
+        throw new Error(`[!] Weavetab cannot reach ${targetApp ? targetApp : "browser"} on port ${port}.`);
     }
 }
 // Only allow the UI to update cosmetic/dev settings via the binding.
 // Never allow overwriting security-critical fields (role, browserPath, block, allow, profileDir, etc.).
-const UI_ALLOWED_FIELDS = new Set(["devMode", "visuals", "darkMode"]);
+const UI_ALLOWED_FIELDS = new Set(["devMode", "extension"]);
 async function wireUiConfigBinding(session) {
     try {
         await session.Runtime.addBinding({ name: "__wt_save_ui_config" });
@@ -562,21 +664,38 @@ async function wireUiConfigBinding(session) {
     }
     catch { /* already bound */ }
 }
-export async function connectToTab(targetId, port, agentId, browserContextId) {
+export async function connectToTab(targetId, port, agentId, browserContextId, appName) {
     const existing = sessionRegistry.getAll().find(c => c.targetId === targetId);
     if (existing)
         return existing;
-    const lock = readLock();
-    const p = port || actualPort || lock?.port;
+    const lock = readLock(appName);
+    const p = port || (appName ? lock?.port : (actualPort || lock?.port));
     if (!p)
-        throw new Error("[!] No active browser session. Run browser_go first.");
-    const targets = await withCDPTimeout(CDP.List({ host: "127.0.0.1", port: p }), 5000, "connectToTab CDP.List");
-    const t = targets.find(t => t.id === targetId);
-    if (!t)
-        throw new Error("Tab not found");
+        throw new Error(`[!] No active ${appName || "browser"} session. Run browser_go first.`);
+    let t = null;
+    try {
+        const targets = await withCDPTimeout(CDP.List({ host: "127.0.0.1", port: p }), 3000, "connectToTab CDP.List");
+        t = targets.find((item) => (item.id || item.targetId) === targetId);
+    }
+    catch { }
+    if (!t) {
+        try {
+            const metaSession = await withCDPTimeout(CDP({ host: "127.0.0.1", port: p }), 3000, "connectToTab meta CDP");
+            const { targetInfos } = await withCDPTimeout(metaSession.Target.getTargets(), 3000, "connectToTab meta getTargets");
+            await metaSession.close();
+            const ti = targetInfos.find(item => item.targetId === targetId);
+            if (ti) {
+                t = { id: ti.targetId, targetId: ti.targetId, url: ti.url, title: ti.title, type: ti.type };
+            }
+        }
+        catch { }
+    }
+    if (!t) {
+        t = { id: targetId, targetId, url: "", title: appName || "Tab", type: "page" };
+    }
     const session = await withCDPTimeout(CDP({ host: "127.0.0.1", port: p, target: targetId }), 5000, "connectToTab CDP");
     session.on("close", () => {
-        logDebug("[Weavetab CDP] connectToTab session closed — unregistering.");
+        logDebug(`[Weavetab CDP] connectToTab session closed (${appName || "browser"}) — unregistering.`);
         // Cancel this tab's analytics interval so it doesn't outlive the session
         const iv = analyticsIntervals.get(targetId);
         if (iv) {
@@ -589,7 +708,7 @@ export async function connectToTab(targetId, port, agentId, browserContextId) {
         sessionRegistry.unregister(targetId);
     });
     session.on("error", (err) => {
-        logDebug("[Weavetab CDP] connectToTab session error:", err?.message ?? err);
+        logDebug(`[Weavetab CDP] connectToTab session error (${appName || "browser"}):`, err?.message ?? err);
     });
     await Promise.all([
         session.Accessibility.enable(),
@@ -601,7 +720,7 @@ export async function connectToTab(targetId, port, agentId, browserContextId) {
     ]);
     await wireUiConfigBinding(session);
     const currentConfig = getCachedConfig();
-    await initSession(session, targetId, p, currentConfig);
+    await initSession(session, targetId, p, currentConfig, !!appName);
     // NOTE: initSession() already installs a frameNavigated handler that handles
     // clearSnapshot, clearViewportCache, and ensureVisualLayer. Do NOT add a second
     // one here — it would double the CDP work on every navigation.
@@ -614,6 +733,8 @@ export async function connectToTab(targetId, port, agentId, browserContextId) {
         overlayInstalled: false,
         agentId: actualAgentId,
         browserContextId,
+        appName,
+        isElectron: !!appName,
     };
     sessionRegistry.register(targetId, client);
     return client;

package/dist/cdp/helpers.d.ts

@@ -9,3 +9,7 @@ export declare function sendToExtension(session: CDP.Client, message: object): P
 export declare function getFromExtension<T = any>(session: CDP.Client, message: object, retries?: number): Promise<T | null>;
 export declare function hideWeaveTabOverlay(session: CDP.Client): Promise<void>;
 export declare function restoreWeaveTabOverlay(session: CDP.Client): Promise<void>;
+export declare function applySecretHardening(session: CDP.Client, objectId?: string, selector?: string): Promise<void>;
+export declare function registerAndHardenSecretField(session: CDP.Client, targetId: string, selector: string, secretValue?: string, objectId?: string): Promise<void>;
+export declare function maskSecretFieldsForCapture(session: CDP.Client): Promise<void>;
+export declare function restoreSecretFieldsAfterCapture(session: CDP.Client): Promise<void>;

package/dist/cdp/helpers.js

@@ -1,4 +1,5 @@
 import { logDebug } from "../audit/logger.js";
+import { SessionSecretTracker } from "../security/secrets.js";
 const MAX_QUEUE_SIZE = 50;
 const BATCH_INTERVAL_MS = 10; // Reduced from 20ms for faster message delivery
 const messageQueues = new Map();
@@ -191,3 +192,183 @@ export async function restoreWeaveTabOverlay(session) {
         returnByValue: false,
     }).catch(() => { });
 }
+// ─── Secret Hardening & Containment Helpers ──────────────────────────────────
+export async function applySecretHardening(session, objectId, selector) {
+    const hardeningScript = `function() {
+    try {
+      const el = this;
+      if (!el) return;
+      // Mark as secret
+      try { el.setAttribute('data-wt-secret', 'true'); } catch (_) {}
+      
+      // 1. Redact direct .value access via instance-level property override
+      const proto = Object.getPrototypeOf(el);
+      const origDesc = proto ? Object.getOwnPropertyDescriptor(proto, 'value') : null;
+      if (origDesc) {
+        Object.defineProperty(el, 'value', {
+          get: function() { return '[REDACTED]'; },
+          set: origDesc.set,
+          configurable: true,
+          enumerable: true
+        });
+      }
+      
+      // 2. Defeat array spread, iteration, and coercion
+      try {
+        Object.defineProperty(el, Symbol.iterator, {
+          value: function* () { yield '[REDACTED]'; },
+          configurable: true
+        });
+        Object.defineProperty(el, Symbol.toPrimitive, {
+          value: function() { return '[REDACTED]'; },
+          configurable: true
+        });
+        // Defeat JSON.stringify / structuredClone leaks
+        Object.defineProperty(el, 'toJSON', {
+          value: function() { return '[REDACTED]'; },
+          configurable: true
+        });
+      } catch(_) {}
+    } catch (e) {
+      // fail silently so as not to disrupt the page execution
+    }
+  }`;
+    if (objectId) {
+        await session.Runtime.callFunctionOn({
+            functionDeclaration: hardeningScript,
+            objectId,
+            silent: true
+        }).catch(() => { });
+    }
+    else if (selector) {
+        await session.Runtime.evaluate({
+            expression: `(function(sel) {
+        const el = document.querySelector(sel) || (window.__Weavetab_shadowQuery ? window.__Weavetab_shadowQuery(sel) : null);
+        if (el) {
+          (${hardeningScript}).call(el);
+        }
+      })(${JSON.stringify(selector)})`,
+            returnByValue: false
+        }).catch(() => { });
+    }
+}
+export async function registerAndHardenSecretField(session, targetId, selector, secretValue, objectId) {
+    try {
+        if (secretValue) {
+            SessionSecretTracker.registerSecretValue(targetId, secretValue);
+        }
+        let resolvedObjectId = objectId;
+        if (!resolvedObjectId && selector) {
+            const nodeInfo = await session.Runtime.evaluate({
+                expression: `(function(sel) {
+          return document.querySelector(sel) || (window.__Weavetab_shadowQuery ? window.__Weavetab_shadowQuery(sel) : null);
+        })(${JSON.stringify(selector)})`,
+                returnByValue: false
+            }).catch(() => null);
+            resolvedObjectId = nodeInfo?.result?.objectId;
+        }
+        if (resolvedObjectId) {
+            try {
+                const nodeDetails = await session.DOM.requestNode({ objectId: resolvedObjectId });
+                if (nodeDetails?.nodeId) {
+                    const desc = await session.DOM.describeNode({ nodeId: nodeDetails.nodeId });
+                    if (desc?.node?.backendNodeId) {
+                        SessionSecretTracker.markNodeAsSecret(targetId, desc.node.backendNodeId);
+                    }
+                }
+            }
+            catch { /* DOM lookup best-effort */ }
+        }
+        await applySecretHardening(session, resolvedObjectId, selector);
+    }
+    catch (err) {
+        logDebug(`[Weavetab] registerAndHardenSecretField failed: ${err}`);
+    }
+}
+export async function maskSecretFieldsForCapture(session) {
+    await session.Runtime.evaluate({
+        expression: `(function() {
+      var secretRegex = /password|passcode|pin|passphrase|secret|token|auth.?key|access.?code|mot.?de.?passe|contrase[nñ]a|kennwort|senha/i;
+      
+      function queryAllDeep(root, matchFn) {
+        var matched = [];
+        var elements = root.querySelectorAll('*');
+        for (var i = 0; i < elements.length; i++) {
+          var el = elements[i];
+          if (matchFn(el)) matched.push(el);
+          if (el.shadowRoot) {
+            matched = matched.concat(queryAllDeep(el.shadowRoot, matchFn));
+          }
+        }
+        return matched;
+      }
+
+      function isSecretNode(el) {
+        if (!el || !el.tagName) return false;
+        if (el.hasAttribute && el.hasAttribute('data-wt-secret')) return true;
+        var tag = el.tagName.toLowerCase();
+        if (tag === 'input' || tag === 'textarea') {
+          var t = (el.getAttribute('type') || '').toLowerCase();
+          var ac = (el.getAttribute('autocomplete') || '').toLowerCase();
+          var name = (el.getAttribute('name') || '').toLowerCase();
+          var id = (el.getAttribute('id') || '').toLowerCase();
+          var aria = (el.getAttribute('aria-label') || '').toLowerCase();
+          return t === 'password' || ac.includes('password') || secretRegex.test(name) || secretRegex.test(id) || secretRegex.test(aria);
+        }
+        return false;
+      }
+
+      var els = queryAllDeep(document, isSecretNode);
+      for (var i = 0; i < els.length; i++) {
+        var el = els[i];
+        el.__wt_cap_val_backup = el.value;
+        try { el.value = ''; } catch(e) {}
+        if (el.isContentEditable) {
+          el.__wt_cap_txt_backup = el.textContent;
+          try { el.textContent = ''; } catch(e) {}
+        }
+        el.__wt_cap_sec_backup = el.style.webkitTextSecurity;
+        try { el.style.webkitTextSecurity = 'disc'; } catch(e) {}
+      }
+    })()`,
+        returnByValue: false,
+    }).catch(() => { });
+}
+export async function restoreSecretFieldsAfterCapture(session) {
+    await session.Runtime.evaluate({
+        expression: `(function() {
+      function queryAllDeep(root) {
+        var matched = [];
+        var elements = root.querySelectorAll('*');
+        for (var i = 0; i < elements.length; i++) {
+          var el = elements[i];
+          if (el.__wt_cap_val_backup !== undefined || el.__wt_cap_txt_backup !== undefined || el.__wt_cap_sec_backup !== undefined) {
+            matched.push(el);
+          }
+          if (el.shadowRoot) {
+            matched = matched.concat(queryAllDeep(el.shadowRoot));
+          }
+        }
+        return matched;
+      }
+
+      var els = queryAllDeep(document);
+      for (var i = 0; i < els.length; i++) {
+        var el = els[i];
+        if (el.__wt_cap_val_backup !== undefined) {
+          try { el.value = el.__wt_cap_val_backup; } catch(e) {}
+          delete el.__wt_cap_val_backup;
+        }
+        if (el.__wt_cap_txt_backup !== undefined) {
+          try { el.textContent = el.__wt_cap_txt_backup; } catch(e) {}
+          delete el.__wt_cap_txt_backup;
+        }
+        if (el.__wt_cap_sec_backup !== undefined) {
+          try { el.style.webkitTextSecurity = el.__wt_cap_sec_backup; } catch(e) {}
+          delete el.__wt_cap_sec_backup;
+        }
+      }
+    })()`,
+        returnByValue: false,
+    }).catch(() => { });
+}

package/dist/cdp/lock.d.ts

@@ -4,6 +4,7 @@ export interface LockData {
     profileDir: string;
     browserPath: string;
     mode: "session" | "attach";
+    appName?: string;
     pending?: boolean;
     timestamp?: number;
     fingerprint?: {
@@ -12,17 +13,19 @@ export interface LockData {
         cdpVersion?: string;
     };
 }
-declare function acquireMutex(): Promise<() => Promise<void>>;
-export declare function writeLockSafe(data: LockData): Promise<void>;
-export declare function writeLock(data: LockData): Promise<void>;
-export declare function readLock(): LockData | null;
-export declare function clearLock(): void;
+export declare function getLockFilePath(appName?: string): string;
+export declare function getMutexFilePath(appName?: string): string;
+declare function acquireMutex(appName?: string): Promise<() => Promise<void>>;
+export declare function writeLockSafe(data: LockData, appName?: string): Promise<void>;
+export declare function writeLock(data: LockData, appName?: string): Promise<void>;
+export declare function readLock(appName?: string): LockData | null;
+export declare function clearLock(appName?: string): void;
 /**
  * Safe variant: only clears the lock if it was written by THIS process (process.pid).
  * Prevents a second MCP server instance from wiping the first instance's browser lock
  * during its retry loop, which would allow a race condition where two browsers spawn.
  */
-export declare function clearLockIfOwned(): void;
+export declare function clearLockIfOwned(appName?: string): void;
 export declare function isProcessRunning(pid: number): boolean;
 /**
  * Two-factor lock validation: PID alive AND port accepting TCP connections.