@weavetab/mcp 2.5.0-beta.2 → 2.5.0-beta.4

package/dist/tools/scrape.js

@@ -1,3 +1,6 @@
+import { getConfigAgentId } from "../config/loader.js";
+import { SessionSecretTracker } from "../security/secrets.js";
+import { sessionRegistry } from "../state/session.js";
 export async function browserScrape(session, options, _config) {
     const { query, type = "css", attributes = ["textContent"], multiple = true } = options;
     const res = await session.Runtime.evaluate({
@@ -34,14 +37,20 @@ export async function browserScrape(session, options, _config) {
       }
 
       const attrs = ${JSON.stringify(attributes)};
+      var secretRegex = /password|passcode|pin|passphrase|secret|token|auth.?key|access.?code|mot.?de.?passe|contrase[nñ]a|kennwort|senha/i;
       nodes.forEach(node => {
         const item = {};
 
         // Secret containment: redact any element marked as sensitive.
-        // data-wt-secret is set by browser_type_secret at injection time.
         const isSecret = node.hasAttribute && (
           node.hasAttribute('data-wt-secret') ||
-          (node.tagName === 'INPUT' && node.type === 'password')
+          (node.tagName === 'INPUT' && (
+            node.type === 'password' ||
+            secretRegex.test(node.getAttribute('autocomplete') || '') ||
+            secretRegex.test(node.getAttribute('name') || '') ||
+            secretRegex.test(node.getAttribute('id') || '') ||
+            secretRegex.test(node.getAttribute('aria-label') || '')
+          ))
         );
 
         if (isSecret) {
@@ -53,6 +62,9 @@ export async function browserScrape(session, options, _config) {
               item[attr] = node[attr]?.trim() || '';
             } else if (attr === 'outerHTML') {
               item[attr] = node.outerHTML;
+            } else if (attr === 'value') {
+              // Read live DOM property (not HTML attribute) so getter overrides work
+              item[attr] = node.value !== undefined ? String(node.value) : '';
             } else {
               item[attr] = node.getAttribute(attr) || node[attr] || '';
             }
@@ -98,6 +110,7 @@ export async function browserScrape(session, options, _config) {
             const fullExpr = type === 'xpath'
                 ? `(function(){
             var attrs = ${JSON.stringify(attributes)};
+            var secretRegex = /password|passcode|pin|passphrase|secret|token|auth.?key|access.?code|mot.?de.?passe|contrase[nñ]a|kennwort|senha/i;
             var snap = document.evaluate(${JSON.stringify(query)}, document, null, XPathResult.ORDERED_NODE_SNAPSHOT_TYPE, null);
             var limit = ${multiple} ? snap.snapshotLength : Math.min(snap.snapshotLength, 1);
             var results = [];
@@ -105,11 +118,25 @@ export async function browserScrape(session, options, _config) {
               var node = snap.snapshotItem(i);
               if (!node || node.nodeType !== 1) continue;
               var item = {};
-              attrs.forEach(function(attr) {
-                if (attr === 'textContent' || attr === 'innerText') { item[attr] = (node[attr] || '').trim(); }
-                else if (attr === 'outerHTML') { item[attr] = node.outerHTML; }
-                else { item[attr] = node.getAttribute ? (node.getAttribute(attr) || node[attr] || '') : ''; }
-              });
+              var isSecret = node.hasAttribute && (
+                node.hasAttribute('data-wt-secret') ||
+                (node.tagName === 'INPUT' && (
+                  node.type === 'password' ||
+                  secretRegex.test(node.getAttribute('autocomplete') || '') ||
+                  secretRegex.test(node.getAttribute('name') || '') ||
+                  secretRegex.test(node.getAttribute('id') || '') ||
+                  secretRegex.test(node.getAttribute('aria-label') || '')
+                ))
+              );
+              if (isSecret) {
+                attrs.forEach(function(attr) { item[attr] = '[REDACTED]'; });
+              } else {
+                attrs.forEach(function(attr) {
+                  if (attr === 'textContent' || attr === 'innerText') { item[attr] = (node[attr] || '').trim(); }
+                  else if (attr === 'outerHTML') { item[attr] = node.outerHTML; }
+                  else { item[attr] = node.getAttribute ? (node.getAttribute(attr) || node[attr] || '') : ''; }
+                });
+              }
               results.push(item);
             }
             return { data: results };
@@ -120,13 +147,28 @@ export async function browserScrape(session, options, _config) {
               try { nodes = Array.from(window.__Weavetab_shadowQuery_all(${JSON.stringify(query)})); } catch(_){}
             }
             var attrs = ${JSON.stringify(attributes)};
+            var secretRegex = /password|passcode|pin|passphrase|secret|token|auth.?key|access.?code|mot.?de.?passe|contrase[nñ]a|kennwort|senha/i;
             return { data: nodes.map(function(node) {
               var item = {};
-              attrs.forEach(function(attr) {
-                if (attr === 'textContent' || attr === 'innerText') { item[attr] = (node[attr] || '').trim(); }
-                else if (attr === 'outerHTML') { item[attr] = node.outerHTML; }
-                else { item[attr] = node.getAttribute(attr) || node[attr] || ''; }
-              });
+              var isSecret = node.hasAttribute && (
+                node.hasAttribute('data-wt-secret') ||
+                (node.tagName === 'INPUT' && (
+                  node.type === 'password' ||
+                  secretRegex.test(node.getAttribute('autocomplete') || '') ||
+                  secretRegex.test(node.getAttribute('name') || '') ||
+                  secretRegex.test(node.getAttribute('id') || '') ||
+                  secretRegex.test(node.getAttribute('aria-label') || '')
+                ))
+              );
+              if (isSecret) {
+                attrs.forEach(function(attr) { item[attr] = '[REDACTED]'; });
+              } else {
+                attrs.forEach(function(attr) {
+                  if (attr === 'textContent' || attr === 'innerText') { item[attr] = (node[attr] || '').trim(); }
+                  else if (attr === 'outerHTML') { item[attr] = node.outerHTML; }
+                  else { item[attr] = node.getAttribute(attr) || node[attr] || ''; }
+                });
+              }
               return item;
             })};
           })()`;
@@ -136,5 +178,17 @@ export async function browserScrape(session, options, _config) {
             }
         }
     }
-    return { success: true, data: val?.data || [], message: `Extracted ${val?.data?.length || 0} elements` };
+    let targetId = "default";
+    const active = sessionRegistry.getActive(getConfigAgentId(_config));
+    if (active)
+        targetId = active.targetId;
+    const rawData = (val?.data || []);
+    const sanitizedData = rawData.map(item => {
+        const sanitizedItem = {};
+        for (const [k, v] of Object.entries(item)) {
+            sanitizedItem[k] = typeof v === 'string' ? SessionSecretTracker.redact(targetId, v) : v;
+        }
+        return sanitizedItem;
+    });
+    return { success: true, data: sanitizedData, message: `Extracted ${sanitizedData.length} elements` };
 }

package/dist/tools/screenshot.js

@@ -1,4 +1,4 @@
-import { hideWeaveTabOverlay, restoreWeaveTabOverlay } from "../cdp/helpers.js";
+import { hideWeaveTabOverlay, restoreWeaveTabOverlay, maskSecretFieldsForCapture, restoreSecretFieldsAfterCapture } from "../cdp/helpers.js";
 export async function browserScreenshot(session, options = {}, _config) {
     const format = options.format ?? "png";
     const quality = format === "jpeg" ? (options.quality ?? 90) : undefined;
@@ -42,33 +42,38 @@ export async function browserScreenshot(session, options = {}, _config) {
         if (clip)
             params.clip = clip;
     }
-    // ── AI-blind: hide Weavetab overlay elements before screenshot ──────────────
+    // ── AI-blind: hide Weavetab overlay elements and mask secrets before screenshot ─
     // The chat panel, ghost cursor, thought bubble, HUD iframe, and all scripted
-    // UI are FOR THE USER only. The AI must never see or interact with them.
-    // hideOverlay defaults to true — only set to false if explicitly requested.
+    // UI are FOR THE USER only. Secret values are masked to prevent visual leaks.
     const shouldHide = options.hideOverlay !== false;
     if (shouldHide) {
         await hideWeaveTabOverlay(session);
     }
+    await maskSecretFieldsForCapture(session);
     let data;
     try {
-        const res = await session.Page.captureScreenshot(params);
-        data = res.data;
-    }
-    catch (e) {
-        if (params.captureBeyondViewport) {
-            params.captureBeyondViewport = false;
-            delete params.clip;
+        try {
             const res = await session.Page.captureScreenshot(params);
             data = res.data;
         }
-        else {
-            throw e;
+        catch (e) {
+            if (params.captureBeyondViewport) {
+                params.captureBeyondViewport = false;
+                delete params.clip;
+                const res = await session.Page.captureScreenshot(params);
+                data = res.data;
+            }
+            else {
+                throw e;
+            }
         }
     }
-    // Restore overlay visibility immediately after capture
-    if (shouldHide) {
-        await restoreWeaveTabOverlay(session);
+    finally {
+        // Restore secret fields and overlay visibility immediately after capture
+        await restoreSecretFieldsAfterCapture(session);
+        if (shouldHide) {
+            await restoreWeaveTabOverlay(session);
+        }
     }
     // ─────────────────────────────────────────────────────────────────────────────
     const width = clip ? clip.width : vp.w;

package/dist/tools/scroll.js

@@ -5,8 +5,7 @@
  */
 import { buildActionMap, findBestMatch, safeSelector } from "../cdp/walker.js";
 import { getCachedActionMap, cacheActionMap } from "../state/cache.js";
-import { computeDelta, storeSnapshot } from "../state/delta.js";
-import { waitForDOMStable } from "../sensors/guard.js";
+import { storeSnapshot } from "../state/delta.js";
 import { sessionRegistry } from "../state/session.js";
 import { logAction } from "../audit/logger.js";
 import { getConfigAgentId } from "../config/loader.js";
@@ -175,22 +174,18 @@ export async function browserScroll(session, args, config) {
                 x: vp.x, y: vp.y,
                 deltaX: chunkX, deltaY: chunkY
             });
-            await sleep(profile.baseDelay + Math.random() * 8);
+            await sleep(profile.baseDelay + Math.random() * 4);
         }
     }
-    await waitForDOMStable(session, 80, 600).catch(() => { });
-    await sendToExtension(session, { type: 'Weavetab_STATE', hud: { action: '' } });
-    const nextMap = await buildActionMap(session, { lite: true }, targetId);
-    cacheActionMap(targetId, nextMap);
-    const diff = computeDelta(targetId, nextMap.url, nextMap.elements);
-    const changesCount = diff ? diff.added.length + diff.removed.length + diff.changed.length : 0;
+    await sleep(40);
+    await sendToExtension(session, { type: 'Weavetab_STATE', hud: { action: '' } }).catch(() => { });
     logAction("browser_scroll", direction, `${distance}px`);
     return {
         success: true,
         scrolled: id ?? label ?? "window",
         direction,
         distance,
-        new_visible_count: nextMap.elements.length,
-        dom_changed: changesCount > 0,
+        new_visible_count: 0,
+        dom_changed: true,
     };
 }

package/dist/tools/select.js

@@ -9,6 +9,12 @@ async function getSelector(session, options, config) {
         return options.selector;
     if (options.ref || options.id) {
         const ref = (options.ref || options.id);
+        if (ref.startsWith("w:")) {
+            return `[data-wt-id="${ref.slice(2)}"]`;
+        }
+        if (ref.startsWith("#") || ref.startsWith(".") || ref.startsWith("[")) {
+            return ref;
+        }
         let targetId = "default";
         const active = sessionRegistry.getActive(getConfigAgentId(config));
         if (active)
@@ -20,13 +26,13 @@ async function getSelector(session, options, config) {
             map = await buildActionMap(session, { lite: true }, targetId);
             cacheActionMap(targetId, map);
         }
-        const element = map.elements.find(el => el.id === ref || el.id.endsWith(ref.startsWith("w:") ? ref.slice(2) : ref));
+        const element = map.elements.find(el => el.id === ref || el.label === ref || el.id.endsWith(ref.startsWith("w:") ? ref.slice(2) : ref));
         if (element) {
             const sel = safeSelector(element);
             if (sel)
                 return sel;
         }
-        throw new Error(`Could not resolve element for ref/id: ${ref}`);
+        return `[name="${ref}"], #${ref}, [aria-label="${ref}"]`;
     }
     if (options.nodeId) {
         const { nodeIds } = await session.DOM.pushNodesByBackendIdsToFrontend({ backendNodeIds: [options.nodeId] });

package/dist/tools/snapshot.js

@@ -1,7 +1,7 @@
 import fs from "fs/promises";
 import path from "path";
 import { getOutputDir, getConfigAgentId } from "../config/loader.js";
-import { hideWeaveTabOverlay, restoreWeaveTabOverlay } from "../cdp/helpers.js";
+import { hideWeaveTabOverlay, restoreWeaveTabOverlay, maskSecretFieldsForCapture, restoreSecretFieldsAfterCapture } from "../cdp/helpers.js";
 import { clearTabCache } from "../state/cache.js";
 import { clearSnapshot } from "../state/delta.js";
 import { sessionRegistry } from "../state/session.js";
@@ -28,22 +28,7 @@ export async function browserSnapshot(session, options, config) {
         }
         // ── Blank secret field values before capture ──────────────────────────
         // Prevents credential values from being embedded in the MHTML archive.
-        // data-wt-secret is set by browser_type_secret at injection time.
-        await session.Runtime.evaluate({
-            expression: `(function() {
-        var els = document.querySelectorAll('[data-wt-secret], input[type="password"]');
-        for (var i = 0; i < els.length; i++) {
-          var el = els[i];
-          el.__wt_snap_backup = el.value;
-          try { el.value = ''; } catch(e) {}
-          if (el.isContentEditable) {
-            el.__wt_snap_text_backup = el.textContent;
-            try { el.textContent = ''; } catch(e) {}
-          }
-        }
-      })()`,
-            returnByValue: false,
-        }).catch(() => { });
+        await maskSecretFieldsForCapture(session);
         let snapshotData;
         try {
             const res = await session.Page.captureSnapshot({ format: "mhtml" });
@@ -51,26 +36,10 @@ export async function browserSnapshot(session, options, config) {
         }
         finally {
             // ── Restore secret field values after capture (always runs) ──────────
+            await restoreSecretFieldsAfterCapture(session);
             if (shouldHide) {
                 await restoreWeaveTabOverlay(session);
             }
-            await session.Runtime.evaluate({
-                expression: `(function() {
-          var els = document.querySelectorAll('[data-wt-secret], input[type="password"]');
-          for (var i = 0; i < els.length; i++) {
-            var el = els[i];
-            if (el.__wt_snap_backup !== undefined) {
-              try { el.value = el.__wt_snap_backup; } catch(e) {}
-              delete el.__wt_snap_backup;
-            }
-            if (el.__wt_snap_text_backup !== undefined) {
-              try { el.textContent = el.__wt_snap_text_backup; } catch(e) {}
-              delete el.__wt_snap_text_backup;
-            }
-          }
-        })()`,
-                returnByValue: false,
-            }).catch(() => { });
         }
         await fs.mkdir(path.dirname(filePath), { recursive: true });
         await fs.writeFile(filePath, snapshotData, "utf8");

package/dist/tools/tabs.js

@@ -111,16 +111,24 @@ async function enforceMaxTabs(config) {
 }
 // ─── Tools ────────────────────────────────────────────────────────────────────
 export async function WeavetabOpen(url, config, reuse = true, appName) {
-    const port = resolvePort(config, appName);
+    // Infer appName from active session if omitted
+    let resolvedAppName = appName;
+    if (!resolvedAppName) {
+        const lastApp = sessionRegistry.getLastActiveApp();
+        if (lastApp) {
+            resolvedAppName = lastApp;
+        }
+    }
+    const port = resolvePort(config, resolvedAppName);
     // Tab reuse: if same URL is already open, focus it instead of duplicating
     if (reuse && url) {
         try {
-            const targets = await getTabList(getConfigAgentId(config), appName);
+            const targets = await getTabList(getConfigAgentId(config), resolvedAppName);
             const existing = targets.find((t) => t.url === url);
             if (existing) {
-                const client = await connectToTab(existing.id, undefined, undefined, undefined, appName);
+                const client = await connectToTab(existing.id, undefined, undefined, undefined, resolvedAppName);
                 await client.session.Target.activateTarget({ targetId: existing.id });
-                sessionRegistry.setActive(existing.id, getConfigAgentId(config), appName);
+                sessionRegistry.setActive(existing.id, getConfigAgentId(config), resolvedAppName);
                 recordTabActivity(existing.id);
                 logAction("browser_tabs", url, `reused existing tab ${existing.id}`);
                 return { success: true, tabId: existing.id, url, reused: true };
@@ -128,10 +136,10 @@ export async function WeavetabOpen(url, config, reuse = true, appName) {
         }
         catch { /* fall through to open new */ }
     }
-    if (!appName) {
+    if (!resolvedAppName) {
         await enforceMaxTabs(config);
     }
-    const bctxId = appName ? undefined : sessionRegistry.getBrowserContextIdForAgent(getConfigAgentId(config));
+    const bctxId = resolvedAppName ? undefined : sessionRegistry.getBrowserContextIdForAgent(getConfigAgentId(config));
     const metaSession = await CDP({ host: "127.0.0.1", port });
     const { targetId } = await metaSession.Target.createTarget({ url, browserContextId: bctxId });
     await metaSession.close();

package/dist/tools/thought.d.ts

@@ -2,6 +2,8 @@ import CDP from "chrome-remote-interface";
 export interface ThoughtOptions {
     action: "feedback" | "question";
     message: string;
+    anchor?: string;
+    style?: "observation" | "decision" | "warning" | "question";
     input?: "sentence" | "paragraph";
     timeout?: number;
 }

package/dist/tools/thought.js

@@ -7,32 +7,31 @@ function sleep(ms) {
     return new Promise(r => setTimeout(r, ms));
 }
 export async function browserThought(session, args) {
-    const { action, message, input, timeout } = args;
+    const { action, message, input, timeout, anchor, style } = args;
     logAction("browser_thought", action, message);
     if (action === "feedback") {
-        await sendToExtension(session, {
-            type: 'Weavetab_STATE',
-            hud: { action: message },
-            stickyFeedback: true,
-        }).catch(() => { });
-        // Forward to sidepanel thought stream
+        // Forward thought event to extension
         await sendToExtension(session, {
             type: 'WT_THOUGHT',
             text: message,
             kind: 'thought',
+            anchor,
+            style: style || 'observation',
+            action: 'feedback',
         }).catch(() => { });
         return { success: true };
     }
     if (action === "question") {
         const QUESTION_TIMEOUT_MS = Math.min((timeout || 20), 20) * 1000;
         await sendToExtension(session, {
-            type: 'Weavetab_STATE',
-            hud: { action: message },
-            stickyFeedback: true,
-            ask: {
-                input: input || "sentence",
-                timeout: Math.min((timeout || 20), 20),
-            },
+            type: 'WT_THOUGHT',
+            text: message,
+            kind: 'question',
+            anchor,
+            style: style || 'question',
+            action: 'question',
+            input: input || "sentence",
+            timeout: Math.min((timeout || 20), 20),
         }).catch(() => { });
         const start = Date.now();
         while (Date.now() - start < QUESTION_TIMEOUT_MS + 5000) {

package/dist/tools/type.d.ts

@@ -48,6 +48,8 @@ export declare function detectFramework(session: CDP.Client): Promise<'react' |
 export declare function frameworkAwareType(session: CDP.Client, objectId: string, text: string, framework: 'react' | 'vue' | 'angular' | 'vanilla'): Promise<boolean>;
 export declare function weaveType(session: CDP.Client, args: {
     id?: string;
+    target?: string;
+    selector?: string;
     label?: string;
     intent?: string;
     backendNodeId?: number;