@weavetab/mcp 2.5.0-beta.2 → 2.5.0-beta.4

package/dist/tools/type.js

@@ -1,5 +1,5 @@
 import { logDebug } from "../audit/logger.js";
-import { buildActionMap, findBestMatch, findAllMatches, safeSelector, toMarkdownTable, resolveByAria } from "../cdp/walker.js";
+import { buildActionMap, findBestMatch, findAllMatches, safeSelector, toMarkdownTable, resolveByAria, recoverDetachedRef } from "../cdp/walker.js";
 import { checkDomain } from "../security/blacklist.js";
 import { logAction } from "../audit/logger.js";
 import { recordAction, getLoopDiagnostics, trackToolCall, detectStuckLoop } from "../intelligence/trail.js";
@@ -11,7 +11,8 @@ import { storeSnapshot, computeRichDelta } from "../state/delta.js";
 import { sessionRegistry } from "../state/session.js";
 import { saveDomainProfile, getBestSelectorForIntent, logMemorySuccess, logMemoryFailure, loadDomainProfile } from "../intelligence/sessionMemory.js";
 import { getConfigAgentId, getConfigHeadless } from "../config/loader.js";
-import { sendToExtension } from "../cdp/helpers.js";
+import { sendToExtension, registerAndHardenSecretField } from "../cdp/helpers.js";
+import { SessionSecretTracker } from "../security/secrets.js";
 import { appendKnowledgeHint } from "../intelligence/hints.js";
 import { verifyActionability, quickHitCheck } from "../sensors/actionability.js";
 /**
@@ -146,6 +147,13 @@ async function resolveTypingTarget(session, map, args, _targetId) {
         };
     }
     let element = id ? map.elements.find((el) => el.id === id || el.id.endsWith(id)) : undefined;
+    // SPA Auto-Recovery: if w:NN ref detached due to re-render, attempt fast heuristic recovery
+    if (!element && id && id.startsWith("w:")) {
+        const recovery = await recoverDetachedRef(session, _targetId, id);
+        if (recovery.recovered && recovery.element) {
+            element = recovery.element;
+        }
+    }
     // Fast-fail: w:NN IDs not in the current map are stale. Return immediately.
     if (!element && id && id.startsWith("w:")) {
         return {
@@ -253,18 +261,23 @@ async function resolveTypingTarget(session, map, args, _targetId) {
           y: Math.round(r.top + r.height/2)
         };
       };
-      var sel;
-      sel = 'textarea[name="q"], input[name="q"], [aria-label="Search"], [title="Search"]';
-      var q = document.querySelector(sel);
-      var fromQ = pick(q);
-      if (fromQ) return JSON.stringify(fromQ);
       var el = document.activeElement;
-      var isEditable = el && (
+      var isEditable = el && el !== document.body && (
         el.isContentEditable ||
         el.tagName === 'TEXTAREA' ||
-        (el.tagName === 'INPUT' && !['button','submit','checkbox','radio','hidden','file'].includes((el.type||'').toLowerCase()))
+        (el.tagName === 'INPUT' && !['button','submit','checkbox','radio','hidden','file'].includes((el.type||'').toLowerCase())) ||
+        el.getAttribute('role') === 'textbox' || el.getAttribute('role') === 'searchbox' || el.getAttribute('role') === 'combobox'
       );
-      if (isEditable) return JSON.stringify(pick(el));
+      if (isEditable) {
+        var fromActive = pick(el);
+        if (fromActive) return JSON.stringify(fromActive);
+      }
+
+      var sel = 'textarea[name="q"], input[name="q"], [aria-label="Search"], [title="Search"]';
+      var q = document.querySelector(sel);
+      var fromQ = pick(q);
+      if (fromQ) return JSON.stringify(fromQ);
+
       var sels = ['[contenteditable="true"]','[contenteditable=""]','textarea','input[type="search"]','input[type="text"]','input:not([type])','[role="textbox"]','[role="combobox"]','input[name="q"]'];
       var best = null, bestArea = 0;
       for (var si = 0; si < sels.length; si++) {
@@ -324,14 +337,12 @@ async function resolveTypingTarget(session, map, args, _targetId) {
     };
 }
 export async function weaveType(session, args, config) {
-    const { id, label, intent, backendNodeId: directNodeId, text, clearFirst, fast = false } = args;
+    const id = args.id || args.target || args.selector;
+    const { label, intent, backendNodeId: directNodeId, text, clearFirst, fast = false } = args;
     const { Page, DOM } = session;
     const startMs = Date.now();
     const { frameTree } = await Page.getFrameTree();
     const url = frameTree.frame.url;
-    if (!id && !label && !intent && args.x === undefined && args.y === undefined) {
-        return { success: false, error_code: "NO_TARGET", message: `[!] browser_type requires id, label, or intent — no target specified.` };
-    }
     const domainCheck = checkDomain(url, config);
     if (!domainCheck.allowed) {
         return { success: false, error_code: "DOMAIN_BLOCKED", message: `[!] Weave blocked: ${domainCheck.reason}` };
@@ -460,7 +471,7 @@ export async function weaveType(session, args, config) {
     }
     const loopDiag = getLoopDiagnostics("browser_type", target.ref);
     if (loopDiag.severity === "critical") {
-        return { success: false, error_code: "STUCK_LOOP_WARNING", message: `[!] Loop detected: You have tried to type into [${target.ref}] ${loopDiag.strikes} times without success. Call browser_reset_loop_counter if this is a new task.` };
+        return { success: false, error_code: "STUCK_LOOP_WARNING", message: `[!] Loop detected: You have tried to type into [${target.ref}] ${loopDiag.strikes} times without success. Run browser_map({ force: true }) if this is a new task.` };
     }
     if (loopDiag.severity === "warning") {
         logAction("browser_type", target.ref, `loop warning: ${loopDiag.strikes} consecutive strikes on [${target.ref}]`);
@@ -536,7 +547,27 @@ export async function weaveType(session, args, config) {
             coords = { x: actCheck.x, y: actCheck.y };
         }
     }
-    const typePreview = text.slice(0, 20).replace(/'/g, "");
+    // Detect password / secret fields early to protect HUD, logs, and register secret
+    const isSecretParam = !!args.isSecret || !!args.secret;
+    const isPassword = isSecretParam || await session.Runtime.evaluate({
+        expression: `(function(sel) {
+      const el = (sel === 'document.activeElement') ? document.activeElement : (document.querySelector(sel) || (window.__Weavetab_shadowQuery ? window.__Weavetab_shadowQuery(sel) : null));
+      if (!el) return false;
+      const t = (el.getAttribute('type') || '').toLowerCase();
+      const ac = (el.getAttribute('autocomplete') || '').toLowerCase();
+      const name = (el.getAttribute('name') || '').toLowerCase();
+      const id = (el.getAttribute('id') || '').toLowerCase();
+      const aria = (el.getAttribute('aria-label') || '').toLowerCase();
+      const isSecAttr = el.hasAttribute('data-wt-secret');
+      const secretRegex = /password|passcode|pin|passphrase|secret|token|auth.?key|access.?code|mot.?de.?passe|contrase[nñ]a|kennwort|senha/i;
+      return isSecAttr || t === 'password' || ac.includes('password') || secretRegex.test(name) || secretRegex.test(id) || secretRegex.test(aria);
+    })(${JSON.stringify(selector)})`,
+        returnByValue: true
+    }).then(r => r.result?.value === true).catch(() => false);
+    if (isPassword && text) {
+        SessionSecretTracker.registerSecretValue(targetId, text);
+    }
+    const typePreview = isPassword ? "••••••••" : text.slice(0, 20).replace(/'/g, "");
     const typeStatus = ["typing", "entering", "inputting", "writing"][Math.floor(Math.random() * 4)];
     await sendToExtension(session, { type: 'Weavetab_STATE', hud: { action: `${typeStatus} ${typePreview}...` } });
     // ── 3. Focus + Type ──────────────────────────────────────────────────────
@@ -569,10 +600,31 @@ export async function weaveType(session, args, config) {
                 };
             }
         }
-        if (coords.x !== undefined && coords.y !== undefined) {
+        // Check if element is ALREADY focused before clicking it to prevent unfocusing or toggling
+        const alreadyFocusedRes = await session.Runtime.evaluate({
+            expression: `(function(sel) {
+        if (!sel || sel === 'document.activeElement') return true;
+        const el = document.querySelector(sel) || (window.__Weavetab_shadowQuery ? window.__Weavetab_shadowQuery(sel) : null);
+        return el ? (document.activeElement === el || el.contains(document.activeElement)) : false;
+      })(${JSON.stringify(selector)})`,
+            returnByValue: true
+        }).catch(() => null);
+        const isAlreadyFocused = alreadyFocusedRes?.result?.value === true;
+        if (!isAlreadyFocused && coords.x !== undefined && coords.y !== undefined) {
             await ghostClick(session, coords.x, coords.y);
             await session.Input.dispatchMouseEvent({ type: "mouseReleased", x: coords.x, y: coords.y, button: "left", clickCount: 1 });
-            await new Promise(r => setTimeout(r, fast ? 10 : 100 + Math.random() * 100));
+            await new Promise(r => setTimeout(r, fast ? 10 : 80 + Math.random() * 80));
+        }
+        else if (isAlreadyFocused) {
+            // Ensure focus without hardware click re-trigger
+            await session.Runtime.evaluate({
+                expression: `(function(sel) {
+          if (!sel || sel === 'document.activeElement') return;
+          const el = document.querySelector(sel) || (window.__Weavetab_shadowQuery ? window.__Weavetab_shadowQuery(sel) : null);
+          if (el && typeof el.focus === 'function') el.focus();
+        })(${JSON.stringify(selector)})`,
+                returnByValue: false
+            }).catch(() => { });
         }
         // Manual clear only when explicitly requested (insertText replaces naturally)
         const shouldPaste = args.paste || text.length > 8;
@@ -621,18 +673,10 @@ export async function weaveType(session, args, config) {
     // When true the post-type event dispatch block is suppressed to prevent
     // the double-onChange triplication bug on React/Vue controlled inputs.
     let nativeSetterUsed = false;
-    // Detect password fields — always ghost type these regardless of profile
-    const isPassword = await session.Runtime.evaluate({
-        expression: `(function(sel) {
-      const el = document.querySelector(sel);
-      return el ? (el.getAttribute('type') || '').toLowerCase() === 'password' : false;
-    })(${JSON.stringify(selector)})`,
-        returnByValue: true
-    }).then(r => r.result?.value === true).catch(() => false);
     // Click-to-type delay
     await new Promise(r => setTimeout(r, 50 + Math.random() * 100));
-    // Auto-enable paste mode for long inputs to prevent character dropping
-    const shouldPasteForType = args.paste || text.length > 8;
+    // Auto-enable paste mode for long inputs to prevent character dropping (never for secret/password fields)
+    const shouldPasteForType = args.paste || (text.length > 8 && !isPassword);
     if (shouldPasteForType && !isPassword) {
         // Paste mode: Use clipboard for reliable long input handling
         // This prevents character dropping on long inputs
@@ -653,7 +697,7 @@ export async function weaveType(session, args, config) {
             await session.Input.dispatchKeyEvent({ type: "rawKeyDown", key: "v", windowsVirtualKeyCode: 86, nativeVirtualKeyCode: 86, modifiers: 2 });
             await session.Input.dispatchKeyEvent({ type: "keyUp", key: "v", windowsVirtualKeyCode: 86, nativeVirtualKeyCode: 86, modifiers: 2 });
             await new Promise(r => setTimeout(r, 120));
-            // Paste verification: check if the field actually received the text.
+            // Paste verification: check if the field actually received text.
             // Vue/React controlled inputs re-render the DOM node during focus, making
             // Ctrl+V land on the old (detached) node. If el.value is still empty,
             // fallback to Input.insertText which targets the currently-focused element.
@@ -662,6 +706,8 @@ export async function weaveType(session, args, config) {
                     expression: `(function(sel) {
             var el = (sel === 'document.activeElement') ? document.activeElement : (document.querySelector(sel) || (window.__Weavetab_shadowQuery ? window.__Weavetab_shadowQuery(sel) : null));
             if (!el) return null;
+            var isSec = el.hasAttribute('data-wt-secret') || (el.tagName === 'INPUT' && el.type === 'password');
+            if (isSec) return (el.value && el.value.length > 0) ? '__HAS_CONTENT__' : '';
             return el.value !== undefined ? el.value : (el.textContent || null);
           })(${JSON.stringify(selector)})`,
                     returnByValue: true,
@@ -782,53 +828,50 @@ export async function weaveType(session, args, config) {
     if (text) {
         try {
             const isActiveElementRef = selector === "document.activeElement";
-            const getFieldValue = async () => {
+            const checkFieldValue = async () => {
                 const expression = isActiveElementRef
-                    ? `(function() {
+                    ? `(function(expected) {
               var el = document.activeElement;
-              if (!el) return null;
-              return el.value !== undefined ? el.value : (el.textContent || null);
-            })()`
-                    : `(function(sel) {
-              var el = document.querySelector(sel);
-              if (!el) return null;
-              return el.value !== undefined ? el.value : (el.textContent || null);
-            })(${JSON.stringify(selector)})`;
-                const { result } = await session.Runtime.evaluate({ expression, returnByValue: true });
-                return result?.value;
+              if (!el) return false;
+              var val = el.value !== undefined ? el.value : (el.textContent || '');
+              return val === expected || (typeof val === 'string' && val.trim() === expected.trim())
+                     || (typeof val === 'string' && typeof expected === 'string' &&
+                         val.replace(/\\D/g, '') === expected.replace(/\\D/g, '') && expected.length > 3);
+            })(${JSON.stringify(text)})`
+                    : `(function(sel, expected) {
+              var el = document.querySelector(sel) || (window.__Weavetab_shadowQuery ? window.__Weavetab_shadowQuery(sel) : null);
+              if (!el) return false;
+              var val = el.value !== undefined ? el.value : (el.textContent || '');
+              return val === expected || (typeof val === 'string' && val.trim() === expected.trim())
+                     || (typeof val === 'string' && typeof expected === 'string' &&
+                         val.replace(/\\D/g, '') === expected.replace(/\\D/g, '') && expected.length > 3);
+            })(${JSON.stringify(selector)}, ${JSON.stringify(text)})`;
+                const { result } = await session.Runtime.evaluate({ expression, returnByValue: true }).catch(() => ({ result: { value: false } }));
+                return result?.value === true;
             };
-            const val = await getFieldValue();
-            textApplied = val === text || (typeof val === 'string' && val.trim() === text.trim())
-                // tel/formatted inputs may strip chars (e.g. dashes); also
-                // accept if the value simply contains the digits we typed.
-                || (typeof val === 'string' && typeof text === 'string' &&
-                    val.replace(/\D/g, '') === text.replace(/\D/g, '') && text.length > 3);
+            textApplied = await checkFieldValue();
             if (!textApplied) {
                 await new Promise(r => setTimeout(r, 200));
                 await waitForDOMStable(session, 50, 200).catch(() => { });
-                const retryVal = await getFieldValue();
-                textApplied = retryVal === text || (typeof retryVal === 'string' && retryVal.trim() === text.trim());
+                textApplied = await checkFieldValue();
             }
             if (!textApplied) {
                 await new Promise(r => setTimeout(r, 400));
                 await waitForDOMStable(session, 50, 300).catch(() => { });
-                const finalVal = await getFieldValue();
-                textApplied = finalVal === text || (typeof finalVal === 'string' && finalVal.trim() === text.trim());
+                textApplied = await checkFieldValue();
             }
             // ghostType may drop characters on busy Windows machines.
             // Retry with atomic Input.insertText if ghostType failed verification.
             if (!textApplied && !args.noRetry && (isPassword || args.profile === 'deliberate')) {
                 await session.Input.insertText({ text });
                 await new Promise(r => setTimeout(r, 300));
-                const retryVal = await getFieldValue();
-                textApplied = retryVal === text || (typeof retryVal === 'string' && retryVal.trim() === text.trim());
+                textApplied = await checkFieldValue();
             }
             // Paste mode failed — retry with Input.insertText (already focused, so this lands correctly).
             if (!textApplied && !args.noRetry && shouldPasteForType && !isPassword) {
                 await session.Input.insertText({ text });
                 await new Promise(r => setTimeout(r, 200));
-                const pasteRetryVal = await getFieldValue();
-                textApplied = pasteRetryVal === text || (typeof pasteRetryVal === 'string' && pasteRetryVal.trim() === text.trim());
+                textApplied = await checkFieldValue();
             }
         }
         catch { /* non-fatal */ }
@@ -955,7 +998,11 @@ export async function weaveType(session, args, config) {
         }
     }
     catch { /* best-effort */ }
-    logAction("browser_type", resolvedRef, `[text] into ${resolvedLabel} (exec: ${executionMs}ms)`);
+    // If typing into a password/secret field, register and harden DOM immediately
+    if (isPassword) {
+        await registerAndHardenSecretField(session, targetId, selector, text, target.objectId);
+    }
+    logAction("browser_type", resolvedRef, isPassword ? `[secret text] into ${resolvedLabel} (exec: ${executionMs}ms)` : `[text] into ${resolvedLabel} (exec: ${executionMs}ms)`);
     recordAction({
         timestamp: new Date().toISOString(),
         tool: "browser_type",
@@ -1007,15 +1054,17 @@ export async function weaveType(session, args, config) {
     else {
         suggestedNext = "Typing successful - consider clicking submit or proceeding to next field";
     }
-    // Read back the verified field value to report accurate length.
+    // Read back the verified field value to report accurate length (skip DOM value inspect for password fields).
     // Previously this was always text.length, which was misleading when paste failed silently.
     let verifiedLength = text.length;
-    if (selector && selector !== 'document.activeElement') {
+    if (!isPassword && selector && selector !== 'document.activeElement') {
         try {
             const { result: vlRes } = await session.Runtime.evaluate({
                 expression: `(function(sel) {
           var el = document.querySelector(sel) || (window.__Weavetab_shadowQuery ? window.__Weavetab_shadowQuery(sel) : null);
           if (!el) return -1;
+          var isSec = el.hasAttribute('data-wt-secret') || (el.tagName === 'INPUT' && el.type === 'password');
+          if (isSec) return -1;
           var v = el.value !== undefined ? el.value : (el.textContent || '');
           return (v || '').length;
         })(${JSON.stringify(selector)})`,

package/dist/tools/type_secret.js

@@ -4,7 +4,7 @@ import { recordAction } from "../intelligence/trail.js";
 import { SessionSecretTracker, secretStore } from "../security/secrets.js";
 import { sessionRegistry } from "../state/session.js";
 import { getConfigAgentId } from "../config/loader.js";
-import { sendToExtension } from "../cdp/helpers.js";
+import { sendToExtension, applySecretHardening } from "../cdp/helpers.js";
 import { cacheActionMap, getCachedActionMap } from "../state/cache.js";
 export async function weaveTypeSecret(session, args, config) {
     const startTime = Date.now();
@@ -68,30 +68,45 @@ export async function weaveTypeSecret(session, args, config) {
         map = await buildActionMap(session, { lite: true }, targetId);
         cacheActionMap(targetId, map);
     }
-    const query = args.id || args.target;
+    const query = args.id || args.target || args.selector;
     if (!query) {
-        return { success: false, error_code: "INVALID_ARGS", message: "[!] Must provide id or target" };
+        return { success: false, error_code: "INVALID_ARGS", message: "[!] Must provide id, target, or selector" };
     }
-    let target = map.elements.find(el => el.id === query || el.id.endsWith(query.startsWith("w:") ? query.slice(2) : query));
-    if (!target) {
-        const matches = findAllMatches(map.elements, query);
-        if (matches.length === 0) {
-            return {
-                success: false,
-                error_code: "ELEMENT_NOT_FOUND",
-                message: `[!] Could not find input matching "${query}"`,
-            };
+    let target = map.elements.find(el => el.id === query ||
+        el.id === `w:${query}` ||
+        el.selector === query ||
+        el.id.endsWith(query.startsWith("w:") ? query.slice(2) : query));
+    let selector = "";
+    if (query === "focused") {
+        selector = "document.activeElement";
+    }
+    else if (!target) {
+        if (query.startsWith("#") || query.startsWith(".") || query.startsWith("[") || query.startsWith("input")) {
+            selector = query;
         }
-        if (matches.length > 1) {
-            return {
-                success: false,
-                error_code: "MULTIPLE_ELEMENTS_FOUND",
-                message: `[!] Refusing to guess: found ${matches.length} matches for "${query}". Please use a more specific selector.`,
-            };
+        else {
+            const matches = findAllMatches(map.elements, query);
+            if (matches.length === 0) {
+                return {
+                    success: false,
+                    error_code: "ELEMENT_NOT_FOUND",
+                    message: `[!] Could not find input matching "${query}"`,
+                };
+            }
+            if (matches.length > 1) {
+                return {
+                    success: false,
+                    error_code: "MULTIPLE_ELEMENTS_FOUND",
+                    message: `[!] Refusing to guess: found ${matches.length} matches for "${query}". Please use a more specific selector.`,
+                };
+            }
+            target = matches[0];
         }
-        target = matches[0];
     }
-    const selector = target.selector || `[data-wt-id="${target.id}"]`;
+    if (!selector && target) {
+        const rawId = (target.id ?? "").replace(/^w:/, "");
+        selector = target.selector || `[data-wt-id="${rawId}"]`;
+    }
     await sendToExtension(session, { type: 'Weavetab_STATE', hud: { action: `injecting [REDACTED]...` } });
     // ── Step 5: Resolve DOM node, mark as secret, focus ───────────────────────
     const nodeInfo = await session.Runtime.evaluate({
@@ -151,76 +166,27 @@ export async function weaveTypeSecret(session, args, config) {
     SessionSecretTracker.registerSecretValue(targetId, secretValue);
     await session.Input.insertText({ text: secretValue });
     // ── Step 7.5: Hardened Proxy & Shadow DOM Isolation ───────────────────────
-    await session.Runtime.callFunctionOn({
-        functionDeclaration: `function() {
-      try {
-        const el = this;
-        // 1. Redact direct .value access
-        const proto = Object.getPrototypeOf(el);
-        const origDesc = Object.getOwnPropertyDescriptor(proto, 'value');
-        if (origDesc) {
-          Object.defineProperty(el, 'value', {
-            get: function() { return '[REDACTED]'; },
-            set: origDesc.set,
-            configurable: false,
-            enumerable: true
-          });
-        }
-        
-        // 2. Defeat array spread, iteration, and coercion
-        Object.defineProperty(el, Symbol.iterator, {
-          value: function* () { yield '[REDACTED]'; },
-          configurable: false
-        });
-        Object.defineProperty(el, Symbol.toPrimitive, {
-          value: function() { return '[REDACTED]'; },
-          configurable: false
-        });
-        // 2b. Defeat JSON.stringify and structuredClone data leaks
-        Object.defineProperty(el, 'toJSON', {
-          value: function() { return '[REDACTED]'; },
-          configurable: false
-        });
-        
-        // 3. Isolate in closed shadow DOM to prevent outer-world DOM traversal
-        if (el.parentNode && !el.parentNode.shadowRoot) {
-          const wrapper = document.createElement('div');
-          wrapper.className = '__wt_secret_vault';
-          // copy styles so layout doesn't break
-          const compStyle = window.getComputedStyle(el);
-          wrapper.style.display = compStyle.display === 'inline' ? 'inline-block' : compStyle.display;
-          wrapper.style.width = compStyle.width;
-          wrapper.style.height = compStyle.height;
-          
-          el.parentNode.insertBefore(wrapper, el);
-          const shadow = wrapper.attachShadow({ mode: 'closed' });
-          shadow.appendChild(el);
-        }
-      } catch (e) {
-        // fail silently so as not to disrupt the page execution
-      }
-    }`,
-        objectId: nodeInfo.result.objectId,
-        silent: true
-    });
+    await applySecretHardening(session, nodeInfo.result.objectId, selector);
     // Immediately zero out the local binding after use
     // (TypeScript doesn't guarantee this but it signals intent to reviewers)
     // secretValue = undefined; // can't reassign const — variable goes out of scope here
     const executionMs = Date.now() - startTime;
     // ── Step 8: Trail — key name + domain only, NEVER value ──────────────────
-    const finalRef = target.id.startsWith('w:') ? target.id : `w:${target.id}`;
-    logAction("browser_type_secret", finalRef, `[secret injected: ${args.envKey}@${currentHostname}] into ${target.label} (exec: ${executionMs}ms)`);
+    const targetLabel = target?.label || selector;
+    const targetIdStr = target?.id || query;
+    const finalRef = targetIdStr.startsWith('w:') ? targetIdStr : `w:${targetIdStr}`;
+    logAction("browser_type_secret", finalRef, `[secret injected: ${args.envKey}@${currentHostname}] into ${targetLabel} (exec: ${executionMs}ms)`);
     recordAction({
         timestamp: new Date().toISOString(),
         tool: "browser_type_secret",
         // input contains key name and domain ONLY — value is excluded intentionally
-        input: { ref: finalRef, label: target.label, envKey: args.envKey, domain: currentHostname },
+        input: { ref: finalRef, label: targetLabel, envKey: args.envKey, domain: currentHostname },
         result: { success: true },
     });
     // ── Step 9: Return — no secret value in result ────────────────────────────
     return {
         success: true,
-        typed_into: target.label,
+        typed_into: targetLabel,
         ref: finalRef,
         key: args.envKey,
         domain: currentHostname,

package/dist/tools/upload.js

@@ -93,7 +93,7 @@ export async function browserUpload(session, options, config) {
         }
         return {
             success: uploaded,
-            message: `Successfully attached ${filePaths.length} file(s)`,
+            message: `attached ${filePaths.length} file(s)`,
             file: path.basename(filePaths[0])
         };
     }

package/dist/tools/video_compiler.d.ts

@@ -15,7 +15,7 @@ export interface CompileVideoResult {
     compilerUsed?: string;
 }
 /**
- * Checks if ffmpeg is available on the system PATH.
+ * Checks if ffmpeg is available on the system PATH without using a shell.
  */
 export declare function isFFmpegAvailable(): boolean;
 /**

package/dist/tools/video_compiler.js

@@ -5,17 +5,16 @@
  * Falls back to ffmpeg if installed for .mp4/.webm video encoding.
  * Weavetab by fy2ne
  */
-import { exec, execSync } from "node:child_process";
+import { execFile, spawnSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
 /**
- * Checks if ffmpeg is available on the system PATH.
+ * Checks if ffmpeg is available on the system PATH without using a shell.
  */
 export function isFFmpegAvailable() {
     try {
-        const cmd = process.platform === "win32" ? "where ffmpeg" : "which ffmpeg";
-        execSync(cmd, { stdio: "ignore" });
-        return true;
+        const res = spawnSync("ffmpeg", ["-version"], { stdio: "ignore" });
+        return res.status === 0;
     }
     catch {
         return false;
@@ -120,21 +119,21 @@ export async function compileVideo(options) {
                 const concatFilePath = path.join(recordingDir, "concat.txt");
                 const concatContent = files.map(f => `file '${f.replace(/'/g, "'\\''")}'\nduration ${1 / fps}`).join("\n");
                 fs.writeFileSync(concatFilePath, concatContent);
-                let codecFlags = "";
+                let ffmpegArgs = ["-y", "-f", "concat", "-safe", "0", "-i", concatFilePath];
                 if (format === "webm") {
-                    codecFlags = "-c:v libvpx-vp9 -pix_fmt yuv420p -b:v 1M";
+                    ffmpegArgs.push("-c:v", "libvpx-vp9", "-pix_fmt", "yuv420p", "-b:v", "1M");
                 }
                 else if (format === "mp4") {
-                    codecFlags = "-c:v libx264 -pix_fmt yuv420p -vf \"trunc(iw/2)*2:trunc(ih/2)*2\"";
+                    ffmpegArgs.push("-c:v", "libx264", "-pix_fmt", "yuv420p", "-vf", "trunc(iw/2)*2:trunc(ih/2)*2");
                 }
                 else if (format === "gif") {
-                    codecFlags = `-vf "fps=${fps},scale=640:-1:flags=lanczos"`;
+                    ffmpegArgs.push("-vf", `fps=${fps},scale=640:-1:flags=lanczos`);
                 }
                 else {
-                    codecFlags = "-c:v libvpx-vp9 -pix_fmt yuv420p -b:v 1M";
+                    ffmpegArgs.push("-c:v", "libvpx-vp9", "-pix_fmt", "yuv420p", "-b:v", "1M");
                 }
-                const cmd = `ffmpeg -y -f concat -safe 0 -i "${concatFilePath}" ${codecFlags} "${videoPath}"`;
-                exec(cmd, { cwd: recordingDir }, (error) => {
+                ffmpegArgs.push(videoPath);
+                execFile("ffmpeg", ffmpegArgs, { cwd: recordingDir }, (error) => {
                     try {
                         fs.unlinkSync(concatFilePath);
                     }

package/dist/version.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Weavetab Version Constant
+ * Single source of truth for runtime versioning.
+ */
+export declare const WEAVETAB_VERSION = "2.5.0-beta.4";

package/dist/version.js

@@ -0,0 +1,5 @@
+/**
+ * Weavetab Version Constant
+ * Single source of truth for runtime versioning.
+ */
+export const WEAVETAB_VERSION = "2.5.0-beta.4";