@weavetab/mcp 2.5.0-beta.2 → 2.5.0-beta.4

package/SECURITY.md

@@ -42,28 +42,43 @@ Weavetab interacts directly with the local Chromium browser instance via the Chr
 
 ---
 
-## Blind Injection Threat Model
+## Blind Injection Threat Model & Hardening
 
-The **Blind Injection** architecture specifically ensures that credentials do not leak back into the LLM context or Weavetab logs.
+The **Blind Injection** architecture specifically ensures that credentials do not leak back into the LLM context, Weavetab logs, DOM snapshots, visual captures, or scrape results.
 
 ### Threats Mitigated
 
-- **Accidental context inclusion** — LLM reading the DOM and echoing passwords
-- **Log scraping** — Passwords appearing in plaintext audit logs
-- **DOM snapshot leakage** — Secret values masked as `[REDACTED]` in all subsequent maps, deltas, and AX tree dumps
-- **Prompt injection domain theft** — Domain check runs before the secret value is ever resolved
+- **Accidental Context Inclusion** — LLM reading the DOM, AX tree, or input discovery and echoing passwords
+- **DOM & Scrape Scraping** — Passwords extracted via direct DOM access, `browser_scrape`, or `document.querySelector().value`
+- **Visual Capture Leaks** — Passwords visible in screenshots, MHTML snapshots, or PDF printouts
+- **Log Scraping** — Passwords appearing in plaintext action logs or audit records
+- **DOM Snapshot Leakage** — Secret values masked as `[REDACTED]` in all subsequent maps, deltas, and AX tree dumps
+- **Prompt Injection Domain Theft** — Domain check runs before the secret value is ever resolved from disk
+- **Coercion & Serialization Leaks** — `JSON.stringify(el)`, `String(el)`, or array spreads leaking underlying element values
+
+### Defense-in-Depth Implementation
+
+1. **Storage at Rest**: Secrets in `~/.weavetab/secrets.json` are encrypted using AES-256-GCM with a machine-isolated key in `~/.weavetab-system/secrets-key`.
+2. **In-Process Resolution**: The AI model only receives and passes the key name (`envKey: "MY_KEY"`). The secret value is resolved in memory and injected directly via CDP `Input.insertText`.
+3. **DOM Property Hardening**: Injected elements are tagged `data-wt-secret="true"`, instance `.value` getters are overridden with `[REDACTED]`, and `Symbol.iterator`, `Symbol.toPrimitive`, and `toJSON` are locked.
+4. **In-Memory SessionSecretTracker**: Tracks node IDs and secret substrings per session to redact any coincidental echoes across ActionMaps, delta diffs, or scrape outputs.
+5. **Universal Tool Containment**:
+   - `browser_type`: Broad secret regex (`type`, `name`, `id`, `autocomplete`, `aria-label`, PINs, tokens, multi-language variants) auto-hardens target fields and suppresses raw value readbacks.
+   - `browser_fill`: Registers secrets in both single and `blast_mode`, redacting return values and scan discovery mode (`scan: true`).
+   - `browser_scrape`: Evaluates in-page extraction substituting all attributes of sensitive nodes with `[REDACTED]`.
+   - `browser_screenshot`, `browser_snapshot`, `browser_pdf`: Dynamically blanks/masks sensitive fields during capture and restores them in `finally` blocks.
 
 ### Threats NOT Mitigated
 
-- This does **not** protect against a compromised host or a malicious process reading the secrets file directly
-- It is not "zero-knowledge"; Weavetab must read the secret from `secrets.json` to inject it
+- This does **not** protect against a compromised host or a malicious OS process with elevated privileges reading the secrets file directly.
+- It is not "zero-knowledge"; Weavetab must read and decrypt the secret from `secrets.json` to inject it into Chromium.
 
 ### Secrets Resolution Order
 
 When `browser_type_secret({ envKey: 'MY_SECRET' })` is called, the `JsonSecretStore` resolves from:
 
-1. `./.Weavetab/secrets.json` (project-scoped, opt-in via `Weavetab secrets init --project`)
-2. `~/.Weavetab/secrets.json` (global default)
+1. `./.weavetab/secrets.json` (project-scoped, opt-in via `weavetab secrets init --project`)
+2. `~/.weavetab/secrets.json` (global default)
 
 The old `EnvSecretProvider` (`.env`-based) is **deprecated and no longer supported**. All secrets must be stored in `secrets.json`. See the [README Secrets Management section](README.md#-secrets-management) for the full CLI workflow.
 
@@ -72,14 +87,10 @@ The old `EnvSecretProvider` (`.env`-based) is **deprecated and no longer support
 ```json
 {
   "ACME_CORP_PASSWORD": {
-    "value": "hunter2",
+    "value": "encrypted_aes_gcm_string",
     "domains": ["login.example.com"],
-    "description": "Account password"
-  },
-  "GITHUB_2FA": {
-    "value": "123456",
-    "domains": ["github.com"],
-    "description": "2FA Code"
+    "createdAt": "2026-08-29T10:00:00.000Z",
+    "updatedAt": "2026-08-29T10:00:00.000Z"
   }
 }
 ```
@@ -91,9 +102,9 @@ The old `EnvSecretProvider` (`.env`-based) is **deprecated and no longer support
 | Tool Category | admin | viewer | system |
 |---------------|-------|--------|--------|
 | All mutation tools | ✅ | ❌ | ❌ |
-| Read-only (map, find, scrape, console, eval, inspect, snapshot, screenshot, pdf, cookies, tabs, wait, github_*) | ✅ | ✅ | ❌ |
+| Read-only (map, find, scrape, console, eval, inspect, snapshot, screenshot, pdf, cookies, tabs, wait, browser_github) | ✅ | ✅ | ❌ |
 | burst, plan, wait, map | ✅ | ❌ | ✅ |
-| System (logs, detect, performance, reset_loop_counter) | ✅ | ❌ | ❌ |
+| System (logs, detect, performance) | ✅ | ❌ | ❌ |
 
 ### Role Definitions
 
@@ -131,7 +142,7 @@ If you discover a security vulnerability in Weavetab, please **do not** open a p
 
 Instead, report via one of the following channels:
 
-- **Email**: security@weavetab.pages.dev
+- **Email**: security@weavetab.dev
 - **GitHub**: Use the private vulnerability reporting feature on the repository
 
 ### Disclosure Timeline
@@ -185,8 +196,8 @@ To receive security notifications:
 
 For security-related inquiries:
 
-- **Security Vulnerabilities**: security@weavetab.pages.dev
-- **Security Questions**: conduct@weavetab.pages.dev
+- **Security Vulnerabilities**: security@weavetab.dev
+- **Security Questions**: conduct@weavetab.dev
 - **GitHub Security**: https://github.com/weavetab/mcp/security
 
 ---

package/TROUBLESHOOTING.md

@@ -108,7 +108,7 @@ browser_click({ id: "w:42" })
 
 **Cause:** The warning previously relied on strict text matching.
 
-**Solution:** `stuck_warning` now respects the underlying `delta` computation. If the DOM changed, the warning will not fire. If you still see false positives, use `browser_reset_loop_counter` to manually reset.
+**Solution:** `stuck_warning` now respects the underlying `delta` computation. If the DOM changed, the warning will not fire. If you still see false positives, use `browser_map({ force: true })` or `browser_wait({ reset_loop: true })` to manually reset.
 
 ---
 
@@ -360,6 +360,6 @@ If you continue to experience issues:
 ## Additional Resources
 
 - [Architecture Documentation](ARCHITECTURE.md)
-- [Tool Reference](docs/TOOLS.md)
+- [Tool Reference](docs/tools/tools.md)
 - [Security Policy](SECURITY.md)
 - [Contributing Guidelines](CONTRIBUTING.md)

package/dist/cdp/bridge.js

@@ -940,7 +940,8 @@ export async function launchElectronApp(appName, config) {
             throw new Error(`[Weavetab] ✗ Invalid or unreachable dev URL for "${appName}": ${e?.message || e}`);
         }
     }
-    const execPath = appCfg.path;
+    const { resolveElectronExecutablePath } = await import("../desktop/discovery.js");
+    const execPath = resolveElectronExecutablePath(appName, appCfg.path) || appCfg.path;
     if (!execPath || !isValidElectronExecutablePath(execPath)) {
         throw new Error(`[Weavetab] ✗ Invalid or non-existent Electron executable path for "${appName}": ${execPath}`);
     }

package/dist/cdp/connector.d.ts

@@ -21,6 +21,8 @@ export interface BrowserClient {
     isElectron?: boolean;
     /** Sticky pruning state: if true, all subsequent DOM reads by action tools (click, type, etc.) will also apply pruning. */
     pruneActive?: boolean;
+    /** Port the CDP session is connected to */
+    port?: number;
 }
 export declare function getOrConnect(config: Config, targetApp?: string): Promise<BrowserClient>;
 export declare function getTabList(agentId?: string, targetApp?: string): Promise<any[]>;

package/dist/cdp/connector.js

@@ -17,6 +17,7 @@ import { recordTabActivity } from "../tools/tabs.js";
 import { initDialogHandler } from "../tools/dialog.js";
 import { WT_REGISTRY_INIT_EXPR } from "./walker.js";
 import { urcInvalidate } from "./ref_cache.js";
+import { marksInvalidate } from "../intelligence/marks.js";
 import { readLock, clearLock, isLockValid, isLockPending, acquireMutex } from "./lock.js";
 import { getSessionProfile } from "./profiles.js";
 import { safelyKillWeavetabProcesses, verifyProfileIsolation, verifyBrowserFingerprint, clearProfileVerificationCache } from "./security.js";
@@ -97,7 +98,6 @@ async function waitForPageReady(session) {
 // ─── Session init (overlay + re-injection) ───────────────────────────────────
 async function initSession(session, targetId, port, config, isElectron) {
     initDialogHandler(session);
-    // Initialize Omni-Context Broker for iframes
     const { initOmniBroker } = await import("./omni_broker.js");
     await initOmniBroker(session, targetId, port);
     if (isElectron) {
@@ -151,6 +151,7 @@ async function initSession(session, targetId, port, config, isElectron) {
         clearTabCache(targetId);
         // Invalidate URC on navigation — elements from the old page are stale
         urcInvalidate(targetId);
+        marksInvalidate(targetId);
         if (isElectron || activeEngine === "chromium") {
             try {
                 await waitForPageReady(session);
@@ -223,7 +224,10 @@ async function initSession(session, targetId, port, config, isElectron) {
 // ─── Main connection entry point ──────────────────────────────────────────────
 export async function getOrConnect(config, targetApp) {
     if (getConfigMode(config) === "attach" && !targetApp) {
-        throw new Error("[!] Attach mode (connect to your real browser) coming soon. Use session mode for now.");
+        // track as limitation - use session mode
+        const err = new Error("[!] Attach mode is not yet supported. Use session mode (default) instead.");
+        err.code = "NOT_IMPLEMENTED";
+        throw err;
     }
     // 1. Check existing active session for this agent & app
     const activeClient = sessionRegistry.getActive(getConfigAgentId(config), targetApp);
@@ -505,7 +509,7 @@ export async function getOrConnect(config, targetApp) {
                 // Continue anyway for now - in production this should be a hard failure
             }
             else {
-                logDebug(`[Weavetab Security] Browser fingerprint verified successfully`);
+                logDebug(`[Weavetab Security] Browser fingerprint verified`);
             }
         }
         // NOTE: initSession() already installs the frameNavigated handler (overlay
@@ -521,7 +525,7 @@ export async function getOrConnect(config, targetApp) {
             // Continue anyway for now - in production this should be a hard failure
         }
         else {
-            logDebug(`[Weavetab Security] Profile isolation verified successfully`);
+            logDebug(`[Weavetab Security] Profile isolation`);
         }
         await session.Target.setDiscoverTargets({ discover: true });
         session.on("Target.targetActivated", (event) => {

package/dist/cdp/helpers.d.ts

@@ -9,3 +9,7 @@ export declare function sendToExtension(session: CDP.Client, message: object): P
 export declare function getFromExtension<T = any>(session: CDP.Client, message: object, retries?: number): Promise<T | null>;
 export declare function hideWeaveTabOverlay(session: CDP.Client): Promise<void>;
 export declare function restoreWeaveTabOverlay(session: CDP.Client): Promise<void>;
+export declare function applySecretHardening(session: CDP.Client, objectId?: string, selector?: string): Promise<void>;
+export declare function registerAndHardenSecretField(session: CDP.Client, targetId: string, selector: string, secretValue?: string, objectId?: string): Promise<void>;
+export declare function maskSecretFieldsForCapture(session: CDP.Client): Promise<void>;
+export declare function restoreSecretFieldsAfterCapture(session: CDP.Client): Promise<void>;

package/dist/cdp/helpers.js

@@ -1,4 +1,5 @@
 import { logDebug } from "../audit/logger.js";
+import { SessionSecretTracker } from "../security/secrets.js";
 const MAX_QUEUE_SIZE = 50;
 const BATCH_INTERVAL_MS = 10; // Reduced from 20ms for faster message delivery
 const messageQueues = new Map();
@@ -191,3 +192,183 @@ export async function restoreWeaveTabOverlay(session) {
         returnByValue: false,
     }).catch(() => { });
 }
+// ─── Secret Hardening & Containment Helpers ──────────────────────────────────
+export async function applySecretHardening(session, objectId, selector) {
+    const hardeningScript = `function() {
+    try {
+      const el = this;
+      if (!el) return;
+      // Mark as secret
+      try { el.setAttribute('data-wt-secret', 'true'); } catch (_) {}
+      
+      // 1. Redact direct .value access via instance-level property override
+      const proto = Object.getPrototypeOf(el);
+      const origDesc = proto ? Object.getOwnPropertyDescriptor(proto, 'value') : null;
+      if (origDesc) {
+        Object.defineProperty(el, 'value', {
+          get: function() { return '[REDACTED]'; },
+          set: origDesc.set,
+          configurable: true,
+          enumerable: true
+        });
+      }
+      
+      // 2. Defeat array spread, iteration, and coercion
+      try {
+        Object.defineProperty(el, Symbol.iterator, {
+          value: function* () { yield '[REDACTED]'; },
+          configurable: true
+        });
+        Object.defineProperty(el, Symbol.toPrimitive, {
+          value: function() { return '[REDACTED]'; },
+          configurable: true
+        });
+        // Defeat JSON.stringify / structuredClone leaks
+        Object.defineProperty(el, 'toJSON', {
+          value: function() { return '[REDACTED]'; },
+          configurable: true
+        });
+      } catch(_) {}
+    } catch (e) {
+      // fail silently so as not to disrupt the page execution
+    }
+  }`;
+    if (objectId) {
+        await session.Runtime.callFunctionOn({
+            functionDeclaration: hardeningScript,
+            objectId,
+            silent: true
+        }).catch(() => { });
+    }
+    else if (selector) {
+        await session.Runtime.evaluate({
+            expression: `(function(sel) {
+        const el = document.querySelector(sel) || (window.__Weavetab_shadowQuery ? window.__Weavetab_shadowQuery(sel) : null);
+        if (el) {
+          (${hardeningScript}).call(el);
+        }
+      })(${JSON.stringify(selector)})`,
+            returnByValue: false
+        }).catch(() => { });
+    }
+}
+export async function registerAndHardenSecretField(session, targetId, selector, secretValue, objectId) {
+    try {
+        if (secretValue) {
+            SessionSecretTracker.registerSecretValue(targetId, secretValue);
+        }
+        let resolvedObjectId = objectId;
+        if (!resolvedObjectId && selector) {
+            const nodeInfo = await session.Runtime.evaluate({
+                expression: `(function(sel) {
+          return document.querySelector(sel) || (window.__Weavetab_shadowQuery ? window.__Weavetab_shadowQuery(sel) : null);
+        })(${JSON.stringify(selector)})`,
+                returnByValue: false
+            }).catch(() => null);
+            resolvedObjectId = nodeInfo?.result?.objectId;
+        }
+        if (resolvedObjectId) {
+            try {
+                const nodeDetails = await session.DOM.requestNode({ objectId: resolvedObjectId });
+                if (nodeDetails?.nodeId) {
+                    const desc = await session.DOM.describeNode({ nodeId: nodeDetails.nodeId });
+                    if (desc?.node?.backendNodeId) {
+                        SessionSecretTracker.markNodeAsSecret(targetId, desc.node.backendNodeId);
+                    }
+                }
+            }
+            catch { /* DOM lookup best-effort */ }
+        }
+        await applySecretHardening(session, resolvedObjectId, selector);
+    }
+    catch (err) {
+        logDebug(`[Weavetab] registerAndHardenSecretField failed: ${err}`);
+    }
+}
+export async function maskSecretFieldsForCapture(session) {
+    await session.Runtime.evaluate({
+        expression: `(function() {
+      var secretRegex = /password|passcode|pin|passphrase|secret|token|auth.?key|access.?code|mot.?de.?passe|contrase[nñ]a|kennwort|senha/i;
+      
+      function queryAllDeep(root, matchFn) {
+        var matched = [];
+        var elements = root.querySelectorAll('*');
+        for (var i = 0; i < elements.length; i++) {
+          var el = elements[i];
+          if (matchFn(el)) matched.push(el);
+          if (el.shadowRoot) {
+            matched = matched.concat(queryAllDeep(el.shadowRoot, matchFn));
+          }
+        }
+        return matched;
+      }
+
+      function isSecretNode(el) {
+        if (!el || !el.tagName) return false;
+        if (el.hasAttribute && el.hasAttribute('data-wt-secret')) return true;
+        var tag = el.tagName.toLowerCase();
+        if (tag === 'input' || tag === 'textarea') {
+          var t = (el.getAttribute('type') || '').toLowerCase();
+          var ac = (el.getAttribute('autocomplete') || '').toLowerCase();
+          var name = (el.getAttribute('name') || '').toLowerCase();
+          var id = (el.getAttribute('id') || '').toLowerCase();
+          var aria = (el.getAttribute('aria-label') || '').toLowerCase();
+          return t === 'password' || ac.includes('password') || secretRegex.test(name) || secretRegex.test(id) || secretRegex.test(aria);
+        }
+        return false;
+      }
+
+      var els = queryAllDeep(document, isSecretNode);
+      for (var i = 0; i < els.length; i++) {
+        var el = els[i];
+        el.__wt_cap_val_backup = el.value;
+        try { el.value = ''; } catch(e) {}
+        if (el.isContentEditable) {
+          el.__wt_cap_txt_backup = el.textContent;
+          try { el.textContent = ''; } catch(e) {}
+        }
+        el.__wt_cap_sec_backup = el.style.webkitTextSecurity;
+        try { el.style.webkitTextSecurity = 'disc'; } catch(e) {}
+      }
+    })()`,
+        returnByValue: false,
+    }).catch(() => { });
+}
+export async function restoreSecretFieldsAfterCapture(session) {
+    await session.Runtime.evaluate({
+        expression: `(function() {
+      function queryAllDeep(root) {
+        var matched = [];
+        var elements = root.querySelectorAll('*');
+        for (var i = 0; i < elements.length; i++) {
+          var el = elements[i];
+          if (el.__wt_cap_val_backup !== undefined || el.__wt_cap_txt_backup !== undefined || el.__wt_cap_sec_backup !== undefined) {
+            matched.push(el);
+          }
+          if (el.shadowRoot) {
+            matched = matched.concat(queryAllDeep(el.shadowRoot));
+          }
+        }
+        return matched;
+      }
+
+      var els = queryAllDeep(document);
+      for (var i = 0; i < els.length; i++) {
+        var el = els[i];
+        if (el.__wt_cap_val_backup !== undefined) {
+          try { el.value = el.__wt_cap_val_backup; } catch(e) {}
+          delete el.__wt_cap_val_backup;
+        }
+        if (el.__wt_cap_txt_backup !== undefined) {
+          try { el.textContent = el.__wt_cap_txt_backup; } catch(e) {}
+          delete el.__wt_cap_txt_backup;
+        }
+        if (el.__wt_cap_sec_backup !== undefined) {
+          try { el.style.webkitTextSecurity = el.__wt_cap_sec_backup; } catch(e) {}
+          delete el.__wt_cap_sec_backup;
+        }
+      }
+    })()`,
+        returnByValue: false,
+    }).catch(() => { });
+}

package/dist/cdp/omni_broker.d.ts

@@ -1,7 +1,7 @@
 /**
  * Weavetab — cdp/omni_broker.ts
  * Omni-Context Execution Broker
- * Handles Target.setAutoAttach to seamlessly execute code in cross-origin iframes.
+ * Handles Target.setAutoAttach to run code in cross-origin iframes.
  * Weavetab by fy2ne
  */
 import CDP from "chrome-remote-interface";

package/dist/cdp/omni_broker.js

@@ -1,7 +1,7 @@
 /**
  * Weavetab — cdp/omni_broker.ts
  * Omni-Context Execution Broker
- * Handles Target.setAutoAttach to seamlessly execute code in cross-origin iframes.
+ * Handles Target.setAutoAttach to run code in cross-origin iframes.
  * Weavetab by fy2ne
  */
 import CDP from "chrome-remote-interface";

package/dist/cdp/walker.d.ts

@@ -4,7 +4,7 @@
  * Weavetab by fy2ne
  */
 import CDP from "chrome-remote-interface";
-import type { RefEntry } from "../state/delta.js";
+import { type RefEntry } from "../state/delta.js";
 export declare const WT_REGISTRY_INIT_EXPR = "\n  window.__weavetab = window.__weavetab || {};\n  window.__weavetab.registry = window.__weavetab.registry || new WeakMap();\n";
 export type HrefType = "same-origin" | "external" | "anchor" | "email" | "unknown";
 export interface ActionElement {
@@ -31,6 +31,9 @@ export interface ActionElement {
     y?: number;
     viewport?: string;
     structuralIdiom?: string;
+    containerContext?: string;
+    isModal?: boolean;
+    modalTitle?: string;
 }
 export interface ActionMap {
     url: string;
@@ -89,3 +92,24 @@ export declare function resolveByAria(session: CDP.Client, query: string): Promi
 } | null>;
 export declare function clearAXTreeCache(targetId: string): void;
 export declare function buildAXTreeMap(session: CDP.Client, _options?: WalkerOptions, targetId?: string): Promise<ActionMap>;
+/**
+ * Sanitizes element IDs in an ActionElement list, replacing empty or malformed
+ * IDs with sequential fallback IDs.
+ */
+export declare function sanitizeElementIds(els: ActionElement[], counter: {
+    value: number;
+}): number;
+export interface RecoveredRefResult {
+    recovered: boolean;
+    element?: ActionElement;
+    strategy?: "connected_existing" | "stored_selector" | "exact_label" | "placeholder_or_name" | "fuzzy_label";
+    warning?: string;
+}
+/**
+ * Recovers a detached or invalidated w:NN ref on reactive SPAs.
+ * When hydration or DOM re-renders detach an element, this helper executes a sub-5ms
+ * multi-tier recovery heuristic (connected node verification, stored CSS selector,
+ * exact label/aria, placeholder/name match, and fuzzy substring) and re-stamps
+ * data-wt-id="NN" onto the live DOM node so subsequent interaction succeeds.
+ */
+export declare function recoverDetachedRef(session: CDP.Client, targetId: string, ref: string, preferredCandidate?: Partial<ActionElement>): Promise<RecoveredRefResult>;