@weavetab/mcp 2.5.0-beta.2 → 2.5.0-beta.4

package/dist/cdp/walker.js

@@ -1,5 +1,7 @@
 import { logDebug } from "../audit/logger.js";
 import { SessionSecretTracker } from "../security/secrets.js";
+import { getStoredRef, getStoredProps } from "../state/delta.js";
+import { getRawCachedActionMap } from "../state/cache.js";
 // ─── Public types ─────────────────────────────────────────────────────────────
 export const WT_REGISTRY_INIT_EXPR = `
   window.__weavetab = window.__weavetab || {};
@@ -162,7 +164,7 @@ export async function buildActionMap(session, options = {}, targetId = "default"
             try {
                 const parsed = JSON.parse(liveIndexResult.value);
                 if (parsed.source === 'live-index' && parsed.elements && Array.isArray(parsed.elements)) {
-                    logDebug(`[Walker] Successfully read ${parsed.elements.length} elements from extension live index`);
+                    logDebug(`[Walker] read ${parsed.elements.length} elements from extension live index`);
                     extensionMap = parsed.elements;
                 }
             }
@@ -309,8 +311,16 @@ export async function buildActionMap(session, options = {}, targetId = "default"
             else if (role === 'input' && (el.type === 'text' || el.type === 'search')) role = 'textbox';
             var frameUrl = '';
             try { if (el.ownerDocument !== document) frameUrl = el.ownerDocument.defaultView.location.href; } catch(e) { frameUrl = 'cross-origin-' + (_coIdx++); }
-            var isSecret = el.hasAttribute('data-wt-secret') || (el.tagName === 'INPUT' && el.type === 'password');
-            var labelStr = el.getAttribute('aria-label') || el.innerText || el.value || el.placeholder || '';
+            var secretRegex = /password|passcode|pin|passphrase|secret|token|auth.?key|access.?code|mot.?de.?passe|contrase[nñ]a|kennwort|senha/i;
+            var isSecret = el.hasAttribute('data-wt-secret') ||
+              (el.tagName === 'INPUT' && (
+                el.type === 'password' ||
+                secretRegex.test(el.getAttribute('autocomplete') || '') ||
+                secretRegex.test(el.getAttribute('name') || '') ||
+                secretRegex.test(el.getAttribute('id') || '') ||
+                secretRegex.test(el.getAttribute('aria-label') || '')
+              ));
+            var labelStr = el.getAttribute('aria-label') || el.innerText || (isSecret ? '' : el.value) || el.placeholder || '';
             // For radio/checkbox, serialize checked state as 'true'/'false' so the agent
             // can see which option is selected without having to scrape the DOM separately.
             var elType = (el.type || '').toLowerCase();
@@ -345,10 +355,59 @@ export async function buildActionMap(session, options = {}, targetId = "default"
                 break;
               }
             }
+
+            // ── Container context binding ─────────────────────────────────────
+            // Walk up the DOM to find a meaningful card/row/list-item heading that
+            // describes this element's entity context, e.g. "Pro Plan ($29/mo)".
+            var containerCtx = '';
+            try {
+              var CARD_SEL = '[class*="card"],[class*="row"],[class*="item"],[class*="product"],[class*="plan"],[class*="entry"],[class*="result"],[class*="tile"],[class*="option"],[data-entity]';
+              var ancestor = el.parentElement;
+              var depth3 = 0;
+              while (ancestor && depth3 < 8) {
+                if (ancestor.matches && ancestor.matches(CARD_SEL)) {
+                  var heading = ancestor.querySelector('h1,h2,h3,h4,h5,h6,[class*="title"],[class*="name"],[class*="heading"],[class*="label"]');
+                  if (heading) {
+                    var hText = (heading.innerText || heading.textContent || '').trim().slice(0, 60);
+                    if (hText && hText !== labelStr) { containerCtx = hText; break; }
+                  }
+                  var allText = (ancestor.innerText || ancestor.textContent || '').replace(/\s+/g, ' ').trim().slice(0, 60);
+                  if (allText && allText !== labelStr) { containerCtx = allText; break; }
+                }
+                ancestor = ancestor.parentElement;
+                depth3++;
+              }
+            } catch(e) {}
+
+            // ── Modal detection ───────────────────────────────────────────────
+            var inModal = false;
+            var modalTitleStr = '';
+            try {
+              var MODAL_SEL = 'dialog[open],[role="dialog"],[aria-modal="true"],[class*="modal"],[class*="overlay"],[class*="drawer"]';
+              var modalAnc = el.parentElement;
+              var md = 0;
+              while (modalAnc && md < 15) {
+                if (modalAnc.matches && modalAnc.matches(MODAL_SEL)) {
+                  inModal = true;
+                  var mh = modalAnc.querySelector('h1,h2,h3,h4,[class*="title"]');
+                  if (mh) {
+                    var lbId = modalAnc.getAttribute('aria-labelledby');
+                    var lbEl = lbId ? document.getElementById(lbId) : null;
+                    modalTitleStr = ((lbEl || mh).innerText || (lbEl || mh).textContent || '').trim().slice(0, 60);
+                  }
+                  break;
+                }
+                modalAnc = modalAnc.parentElement;
+                md++;
+              }
+            } catch(e) {}
+
             results.push({
               id: String(id),
               role: el.getAttribute('role') || role,
+              type: elType || undefined,
               label: labelStr,
+              placeholder: el.placeholder || undefined,
               value: valStr,
               x: Math.round(rect.left + rect.width / 2),
               y: Math.round(rect.top + rect.height / 2),
@@ -357,7 +416,12 @@ export async function buildActionMap(session, options = {}, targetId = "default"
               textContent: txtContent,
               className: el.className || '',
               frameUrl: frameUrl,
-              structuralIdiom: idiom || undefined
+              structuralIdiom: idiom || undefined,
+              containerContext: containerCtx || undefined,
+              isModal: inModal || undefined,
+              modalTitle: modalTitleStr || undefined,
+              disabled: (el.disabled || el.getAttribute('aria-disabled') === 'true') || undefined,
+              checked: isCheckable ? el.checked : undefined,
             });
           } catch (e) {
             // Silently skip elements that cause errors (cross-origin SVG, detached nodes, etc.)
@@ -446,6 +510,8 @@ export async function buildActionMap(session, options = {}, targetId = "default"
         role: el.role || el.tag || 'generic',
         label: el.label || el.text || el.placeholder || '',
         value: el.value,
+        placeholder: el.placeholder || undefined,
+        type: el.type || undefined,
         group: 'main_content',
         fingerprint: `${el.role || el.tag || 'generic'}:${el.label || el.text || ''}:${el.id}`,
         depth: 0,
@@ -459,6 +525,10 @@ export async function buildActionMap(session, options = {}, targetId = "default"
         className: el.className || el.attributes?.class || '',
         structuralIdiom: el.structuralIdiom || undefined,
         frameUrl: el.frameUrl || undefined,
+        containerContext: el.containerContext || undefined,
+        isModal: el.isModal || undefined,
+        modalTitle: el.modalTitle || undefined,
+        disabled: el.disabled || undefined,
     }));
     // Post-mapping sanitizer — catch any w:undefined/w:null and reassign.
     // Uses a stable hash derived from the element's fingerprint, coordinates, and
@@ -590,7 +660,15 @@ export async function buildActionMap(session, options = {}, targetId = "default"
     if (options.limit && filtered.length > options.limit) {
         filtered = filtered.slice(0, options.limit);
     }
-    return { url, title, elements: filtered, targetId };
+    // Apply session secret redaction over all element labels, values, placeholders
+    const redactedElements = filtered.map(el => ({
+        ...el,
+        label: targetId ? SessionSecretTracker.redact(targetId, el.label) : el.label,
+        value: el.value !== undefined ? (targetId ? SessionSecretTracker.redact(targetId, el.value) : el.value) : undefined,
+        placeholder: el.placeholder ? (targetId ? SessionSecretTracker.redact(targetId, el.placeholder) : el.placeholder) : undefined,
+        textContent: el.textContent ? (targetId ? SessionSecretTracker.redact(targetId, el.textContent) : el.textContent) : undefined,
+    }));
+    return { url, title, elements: redactedElements, targetId };
 }
 // ─── toRefEntries — converts ActionElements to RefEntry for delta tracking ───
 export function toRefEntries(elements) {
@@ -600,7 +678,7 @@ export function toRefEntries(elements) {
         label: el.label,
         type: el.type,
         href: el.href,
-        disabled: el.disabled,
+        disabled: el.disabled ?? false,
         value: el.value,
         fingerprint: el.fingerprint,
     }));
@@ -888,11 +966,17 @@ export async function buildAXTreeMap(session, _options = {}, targetId = "default
         else {
             value = node.value?.value !== undefined ? String(node.value.value) : undefined;
         }
-        const isSecretRole = role === 'password' || node.name?.value?.toLowerCase().includes('password');
+        const SECRET_TERMS = /password|passcode|pin|passphrase|secret|token|auth.?key|access.?code|mot.?de.?passe|contrase[nñ]a|kennwort|senha|пароль|密碼|密码/i;
+        const isSecretRole = role === 'password' || SECRET_TERMS.test(node.name?.value || '') || SECRET_TERMS.test(node.description?.value || '');
         if (isSecretRole || (node.backendDOMNodeId !== undefined && SessionSecretTracker.isNodeSecret(targetId, node.backendDOMNodeId))) {
             label = '[REDACTED]';
             value = '[REDACTED]';
         }
+        else {
+            label = targetId ? SessionSecretTracker.redact(targetId, label) : label;
+            if (value !== undefined)
+                value = targetId ? SessionSecretTracker.redact(targetId, value) : value;
+        }
         // Use globally-unique sequential ID (Bug #5 fix: was local idCounter = 1).
         const id = dedupeRefId(`w:${axIdCursor++}`);
         elements.push({
@@ -944,3 +1028,216 @@ export async function buildAXTreeMap(session, _options = {}, targetId = "default
     axTreeCacheSet(url, map);
     return map;
 }
+/**
+ * Sanitizes element IDs in an ActionElement list, replacing empty or malformed
+ * IDs with sequential fallback IDs.
+ */
+export function sanitizeElementIds(els, counter) {
+    let fixed = 0;
+    for (const el of els) {
+        if (!el.id || el.id === "w:undefined" || el.id === "w:null" || el.id === "w:") {
+            el.id = `w:${counter.value++}`;
+            fixed++;
+        }
+    }
+    return fixed;
+}
+/**
+ * Recovers a detached or invalidated w:NN ref on reactive SPAs.
+ * When hydration or DOM re-renders detach an element, this helper executes a sub-5ms
+ * multi-tier recovery heuristic (connected node verification, stored CSS selector,
+ * exact label/aria, placeholder/name match, and fuzzy substring) and re-stamps
+ * data-wt-id="NN" onto the live DOM node so subsequent interaction succeeds.
+ */
+export async function recoverDetachedRef(session, targetId, ref, preferredCandidate) {
+    const refNumericId = ref.replace(/^w:/, '');
+    // Extract known metadata for this ref
+    const storedRef = getStoredRef(targetId, ref);
+    const storedProps = getStoredProps(targetId, ref);
+    const rawMap = getRawCachedActionMap(targetId);
+    const cachedEl = rawMap?.elements?.find(e => e.id === ref || e.id === `w:${refNumericId}`);
+    const candidateLabel = preferredCandidate?.label || storedProps?.label || storedRef?.label || cachedEl?.label || '';
+    const candidatePlaceholder = preferredCandidate?.placeholder || storedProps?.placeholder || cachedEl?.placeholder || '';
+    const candidateRole = preferredCandidate?.role || storedProps?.role || storedRef?.role || cachedEl?.role || '';
+    const candidateSelector = preferredCandidate?.selector || cachedEl?.selector || (storedProps?.className ? `.${storedProps.className.split(' ')[0]}` : undefined);
+    const candidateText = preferredCandidate?.textContent || storedProps?.textContent || cachedEl?.textContent || '';
+    const meta = {
+        label: candidateLabel === '[REDACTED]' ? '' : candidateLabel,
+        placeholder: candidatePlaceholder === '[REDACTED]' ? '' : candidatePlaceholder,
+        role: candidateRole,
+        selector: candidateSelector,
+        textContent: candidateText === '[REDACTED]' ? '' : candidateText,
+    };
+    try {
+        const { result } = await session.Runtime.evaluate({
+            expression: `(function(refId, meta) {
+        // 1. Check if node with data-wt-id=refId is already in DOM, connected, and visible
+        const existing = document.querySelector('[data-wt-id="' + refId + '"]');
+        if (existing && existing.isConnected) {
+          const r = existing.getBoundingClientRect();
+          if (r.width > 0 && r.height > 0) {
+            return {
+              success: true,
+              strategy: 'connected_existing',
+              x: Math.round(r.left + r.width / 2),
+              y: Math.round(r.top + r.height / 2),
+              label: existing.getAttribute('aria-label') || (existing.innerText || existing.textContent || '').trim() || existing.placeholder || '',
+              role: existing.getAttribute('role') || existing.tagName.toLowerCase()
+            };
+          }
+        }
+
+        function isValidCandidate(el) {
+          if (!el || !el.isConnected) return false;
+          const r = el.getBoundingClientRect();
+          if (r.width <= 0 || r.height <= 0) return false;
+          try {
+            const style = window.getComputedStyle(el);
+            if (style.visibility === 'hidden' || style.display === 'none') return false;
+          } catch(e) {}
+          return true;
+        }
+
+        // 2. Strategy: Stored Selector (if stable CSS selector recorded)
+        if (meta.selector && !meta.selector.startsWith('[data-wt-id')) {
+          try {
+            const el = document.querySelector(meta.selector);
+            if (isValidCandidate(el)) {
+              el.setAttribute('data-wt-id', refId);
+              const r = el.getBoundingClientRect();
+              return {
+                success: true,
+                strategy: 'stored_selector',
+                x: Math.round(r.left + r.width / 2),
+                y: Math.round(r.top + r.height / 2),
+                label: el.getAttribute('aria-label') || (el.innerText || el.textContent || '').trim() || el.placeholder || '',
+                role: el.getAttribute('role') || el.tagName.toLowerCase()
+              };
+            }
+          } catch(e) {}
+        }
+
+        const normLabel = (meta.label || '').toLowerCase().trim();
+        const normPlaceholder = (meta.placeholder || '').toLowerCase().trim();
+
+        const candidates = Array.from(document.querySelectorAll(
+          'button, a, input, select, textarea, [role="button"], [role="link"], [role="textbox"], [role="checkbox"], [role="tab"], [tabindex="0"]'
+        ));
+
+        // 3. Strategy: Exact Label / Text / Aria match
+        if (normLabel) {
+          for (const c of candidates) {
+            if (!isValidCandidate(c)) continue;
+            const aria = (c.getAttribute('aria-label') || '').toLowerCase().trim();
+            const text = ((c.innerText || c.textContent || '')).toLowerCase().trim();
+            const val = (c.value || '').toLowerCase().trim();
+            const placeholder = (c.placeholder || '').toLowerCase().trim();
+            const name = (c.getAttribute('name') || '').toLowerCase().trim();
+
+            if (aria === normLabel || text === normLabel || placeholder === normLabel || name === normLabel || (val && val === normLabel)) {
+              c.setAttribute('data-wt-id', refId);
+              const r = c.getBoundingClientRect();
+              return {
+                success: true,
+                strategy: 'exact_label',
+                x: Math.round(r.left + r.width / 2),
+                y: Math.round(r.top + r.height / 2),
+                label: c.getAttribute('aria-label') || (c.innerText || c.textContent || '').trim() || c.placeholder || '',
+                role: c.getAttribute('role') || c.tagName.toLowerCase()
+              };
+            }
+          }
+        }
+
+        // 4. Strategy: Placeholder or Name match
+        if (normPlaceholder) {
+          for (const c of candidates) {
+            if (!isValidCandidate(c)) continue;
+            const placeholder = (c.placeholder || '').toLowerCase().trim();
+            const name = (c.getAttribute('name') || '').toLowerCase().trim();
+            if (placeholder === normPlaceholder || name === normPlaceholder) {
+              c.setAttribute('data-wt-id', refId);
+              const r = c.getBoundingClientRect();
+              return {
+                success: true,
+                strategy: 'placeholder_or_name',
+                x: Math.round(r.left + r.width / 2),
+                y: Math.round(r.top + r.height / 2),
+                label: c.placeholder || c.getAttribute('name') || '',
+                role: c.getAttribute('role') || c.tagName.toLowerCase()
+              };
+            }
+          }
+        }
+
+        // 5. Strategy: Fuzzy Substring Match (if label length >= 3)
+        if (normLabel && normLabel.length >= 3) {
+          let bestMatch = null;
+          let minDiff = Infinity;
+          for (const c of candidates) {
+            if (!isValidCandidate(c)) continue;
+            const text = ((c.innerText || c.textContent || '')).toLowerCase().trim();
+            const aria = (c.getAttribute('aria-label') || '').toLowerCase().trim();
+            const candStr = aria || text;
+            if (candStr && candStr.includes(normLabel)) {
+              const diff = candStr.length - normLabel.length;
+              if (diff >= 0 && diff < minDiff) {
+                minDiff = diff;
+                bestMatch = c;
+              }
+            }
+          }
+          if (bestMatch) {
+            bestMatch.setAttribute('data-wt-id', refId);
+            const r = bestMatch.getBoundingClientRect();
+            return {
+              success: true,
+              strategy: 'fuzzy_label',
+              x: Math.round(r.left + r.width / 2),
+              y: Math.round(r.top + r.height / 2),
+              label: bestMatch.getAttribute('aria-label') || (bestMatch.innerText || bestMatch.textContent || '').trim() || bestMatch.placeholder || '',
+              role: bestMatch.getAttribute('role') || bestMatch.tagName.toLowerCase()
+            };
+          }
+        }
+
+        return { success: false };
+      })(${JSON.stringify(refNumericId)}, ${JSON.stringify(meta)})`,
+            returnByValue: true,
+        });
+        const res = result?.value;
+        if (res && res.success) {
+            const recoveredElement = {
+                id: ref.startsWith('w:') ? ref : `w:${ref}`,
+                role: res.role || candidateRole || 'button',
+                label: res.label || candidateLabel || 'recovered-element',
+                x: res.x,
+                y: res.y,
+                selector: `[data-wt-id="${refNumericId}"]`,
+                group: "utility",
+                depth: 0,
+                fingerprint: `${res.role || candidateRole}:${res.label || candidateLabel}`,
+            };
+            // Patch the raw cache if present so subsequent lookups hit
+            if (rawMap && rawMap.elements) {
+                const existingIdx = rawMap.elements.findIndex(e => e.id === recoveredElement.id);
+                if (existingIdx !== -1) {
+                    rawMap.elements[existingIdx] = recoveredElement;
+                }
+                else {
+                    rawMap.elements.push(recoveredElement);
+                }
+            }
+            return {
+                recovered: true,
+                element: recoveredElement,
+                strategy: res.strategy,
+                warning: `(Auto-recovered detached ref '${ref}' via ${res.strategy}: '${recoveredElement.label}')`,
+            };
+        }
+    }
+    catch (err) {
+        logDebug(`[Walker] Detached ref recovery failed for ${ref}: ${err}`);
+    }
+    return { recovered: false };
+}

package/dist/cli/plugin.js

@@ -5,17 +5,18 @@ import ora from "ora";
 import path from "node:path";
 import { spawn } from "node:child_process";
 import { createRequire } from "node:module";
+import { WEAVETAB_VERSION } from "../version.js";
 const _require = createRequire(import.meta.url);
 function getVersion() {
     try {
-        return _require("../../package.json").version || "2.5.0-beta.2";
+        return _require("../../package.json").version || WEAVETAB_VERSION;
     }
     catch {
-        return "2.5.0-beta.2";
+        return WEAVETAB_VERSION;
     }
 }
-import { getVerifiedPackages, resolvePluginTrust, resolvePluginCandidates, REGISTRY_URL, } from "../plugin/registry.js";
-import { listInstalledPlugins, inspectInstalledPackage } from "../plugin/loader.js";
+import { getVerifiedPackages, resolvePluginTrust, resolvePluginCandidates, invalidateRegistryCache, REGISTRY_URL, } from "../plugin/registry.js";
+import { listInstalledPlugins, inspectInstalledPackage, normalizePermissions } from "../plugin/loader.js";
 // Helper to run child process safely
 function runCommand(cmd, cmdArgs, cwd = process.cwd()) {
     return new Promise((resolve) => {
@@ -23,7 +24,7 @@ function runCommand(cmd, cmdArgs, cwd = process.cwd()) {
         const executable = isWin && !cmd.endsWith(".cmd") && !cmd.endsWith(".exe") ? `${cmd}.cmd` : cmd;
         const child = spawn(executable, cmdArgs, {
             cwd,
-            shell: isWin,
+            shell: false,
             stdio: ["ignore", "pipe", "pipe"],
         });
         let stdout = "";
@@ -167,14 +168,14 @@ export async function runPluginAdd(inputName, args = []) {
         }
         return;
     }
-    spinner.succeed(pc.green(`Successfully installed ${pc.bold(selectedPkg)}`));
+    spinner.succeed(pc.green(`installed ${pc.bold(selectedPkg)}`));
     // Inspect installed package for weavetab.json
     const targetDir = path.join(process.cwd(), "node_modules", selectedPkg);
     const installedInfo = inspectInstalledPackage(targetDir);
     if (installedInfo && installedInfo.manifest) {
         const manifest = installedInfo.manifest;
         const tools = manifest.tools || [];
-        const permissions = manifest.permissions || {};
+        const permissions = normalizePermissions(manifest.permissions);
         const infoLines = [
             `${pc.bold("Plugin Details:")}`,
             `  ${pc.dim("Name:")}        ${manifest.name || selectedPkg}`,
@@ -387,7 +388,7 @@ export async function runPluginRemove(pkgName, args = []) {
             console.error(pc.dim(result.stderr));
         return;
     }
-    spinner.succeed(pc.green(`Successfully removed ${pc.bold(pkgName)}`));
+    spinner.succeed(pc.green(`removed ${pc.bold(pkgName)}`));
     console.log(pc.dim("The plugin and its tools have been uninstalled.\n"));
 }
 // ---------------------------------------------------------------------------
@@ -419,7 +420,12 @@ export async function runPluginVerify(pkgName) {
 // 7. MAIN CLI ROUTER FOR PLUGINS (User / Operations Mode)
 // ---------------------------------------------------------------------------
 export async function runPluginCli(args) {
-    const subcmd = args[0]?.toLowerCase();
+    if (args.includes("--refresh")) {
+        invalidateRegistryCache();
+        console.log(pc.green("[OK] Plugin registry cache refreshed.\n"));
+    }
+    const cleanArgs = args.filter((a) => a !== "--refresh");
+    const subcmd = cleanArgs[0]?.toLowerCase();
     if (!subcmd || subcmd === "--help" || subcmd === "-h" || subcmd === "help") {
         console.log();
         console.log(boxen(pc.bold(pc.cyan(" WEAVETAB PLUGIN MANAGER ")), { padding: 0, borderStyle: "round", borderColor: "cyan" }));
@@ -428,7 +434,7 @@ export async function runPluginCli(args) {
         console.log(`  weavetab plugin <command> [options]`);
         console.log();
         console.log(pc.bold("COMMANDS"));
-        console.log(`  ${pc.cyan("add <pkg>")}          Install a plugin (resolves official @weavetab/ & community)`);
+        console.log(`  ${pc.cyan("add <pkg>")}          Install any plugin by npm package name (e.g. @fy2ne/wt-youtube, my-plugin)`);
         console.log(`  ${pc.cyan("browse")}             Interactive terminal explorer to browse & 1-click install`);
         console.log(`  ${pc.cyan("search [query]")}     Search plugins across official registry & npm`);
         console.log(`  ${pc.cyan("list")}               List all installed plugins and their registered tools`);
@@ -436,10 +442,11 @@ export async function runPluginCli(args) {
         console.log(`  ${pc.cyan("verify <pkg>")}       Check trust tier and registry verification status`);
         console.log();
         console.log(pc.bold("DEVELOPER SDK (@weavetab/sdk)"));
-        console.log(`  ${pc.dim("Scaffold a plugin:")}  ${pc.cyan("npx -y @weavetab/sdk init <name>")}`);
+        console.log(`  ${pc.dim("Scaffold a plugin:")}  ${pc.cyan("npx @weavetab/sdk init <name>")}`);
         console.log(`  ${pc.dim("Build & validate:")}   ${pc.cyan("npx @weavetab/sdk build")}`);
         console.log();
-        console.log(pc.bold("OPTIONS (for 'add')"));
+        console.log(pc.bold("OPTIONS (for 'add' / general)"));
+        console.log(`  ${pc.cyan("--refresh")}          Invalidate and refresh the verified plugin cache`);
         console.log(`  ${pc.cyan("--official, -O")}     Prefer official @weavetab/plugin-<name>`);
         console.log(`  ${pc.cyan("--community, -C")}    Prefer community package`);
         console.log(`  ${pc.cyan("--yes, -y")}          Bypass interactive warning prompt for unverified plugins`);
@@ -448,13 +455,13 @@ export async function runPluginCli(args) {
     }
     if (subcmd === "init" || subcmd === "create" || subcmd === "new" || subcmd === "build" || subcmd === "manifest") {
         console.log(pc.yellow(`\n[Weavetab] Plugin authoring commands belong to the developer SDK (@weavetab/sdk).`));
-        console.log(pc.dim("To scaffold a new plugin:   ") + pc.cyan("npx -y @weavetab/sdk init <name>"));
+        console.log(pc.dim("To scaffold a new plugin:   ") + pc.cyan("npx @weavetab/sdk init <name>"));
         console.log(pc.dim("To build/validate a plugin: ") + pc.cyan("npx @weavetab/sdk build"));
         console.log(pc.dim("SDK documentation:          ") + pc.cyan("https://github.com/weavetab/sdk\n"));
         return;
     }
     if (subcmd === "add" || subcmd === "install" || subcmd === "i") {
-        await runPluginAdd(args[1], args.slice(2));
+        await runPluginAdd(cleanArgs[1], cleanArgs.slice(2));
         return;
     }
     if (subcmd === "browse" || subcmd === "explore") {
@@ -462,7 +469,7 @@ export async function runPluginCli(args) {
         return;
     }
     if (subcmd === "search" || subcmd === "find") {
-        await runPluginSearch(args[1]);
+        await runPluginSearch(cleanArgs[1]);
         return;
     }
     if (subcmd === "list" || subcmd === "ls") {
@@ -470,11 +477,11 @@ export async function runPluginCli(args) {
         return;
     }
     if (subcmd === "remove" || subcmd === "rm" || subcmd === "uninstall") {
-        await runPluginRemove(args[1], args.slice(2));
+        await runPluginRemove(cleanArgs[1], cleanArgs.slice(2));
         return;
     }
     if (subcmd === "verify" || subcmd === "check") {
-        await runPluginVerify(args[1]);
+        await runPluginVerify(cleanArgs[1]);
         return;
     }
     console.log(pc.red(`[ERROR] Unknown plugin subcommand: "${subcmd}"`));

package/dist/cli/updater.d.ts

@@ -1 +1 @@
-export declare function checkForUpdates(): Promise<void>;
+export declare function checkForUpdates(force?: boolean): Promise<void>;

package/dist/cli/updater.js

@@ -1,19 +1,33 @@
 import fs from "node:fs";
 import path from "node:path";
+import os from "node:os";
 import { fileURLToPath } from "node:url";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
-export async function checkForUpdates() {
+const UPDATE_CACHE_FILE = path.join(os.homedir(), ".weavetab-system", "cache", "update_check.json");
+const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000; // 24 hours
+export async function checkForUpdates(force = false) {
     try {
+        const now = Date.now();
+        // Check cache unless forced
+        if (!force && fs.existsSync(UPDATE_CACHE_FILE)) {
+            try {
+                const cached = JSON.parse(fs.readFileSync(UPDATE_CACHE_FILE, "utf-8"));
+                if (cached.lastChecked && now - cached.lastChecked < CHECK_INTERVAL_MS) {
+                    return;
+                }
+            }
+            catch { /* malformed cache */ }
+        }
         // Read local package.json to get current version
         const packageJsonPath = path.resolve(__dirname, "../../package.json");
         if (!fs.existsSync(packageJsonPath))
             return;
         const pkg = JSON.parse(fs.readFileSync(packageJsonPath, "utf-8"));
         const currentVersion = pkg.version;
-        // Fast, non-blocking fetch with 2-second timeout
+        // Fast, non-blocking fetch with 1.5-second timeout
         const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), 2000);
+        const timeoutId = setTimeout(() => controller.abort(), 1500);
         const res = await fetch("https://registry.npmjs.org/@weavetab/mcp/latest", {
             signal: controller.signal,
         });
@@ -22,12 +36,18 @@ export async function checkForUpdates() {
             return;
         const data = await res.json();
         const latestVersion = data.version;
-        // Simple version comparison (assumes semver format like x.y.z)
+        // Save timestamp to cache
+        try {
+            fs.mkdirSync(path.dirname(UPDATE_CACHE_FILE), { recursive: true });
+            fs.writeFileSync(UPDATE_CACHE_FILE, JSON.stringify({ lastChecked: now, latestVersion }), "utf-8");
+        }
+        catch { /* non-fatal */ }
+        // Simple version comparison
         if (isNewerVersion(currentVersion, latestVersion)) {
             await printUpdateBox(currentVersion, latestVersion);
         }
     }
-    catch (err) {
+    catch {
         // Silently fail if offline or npm is down
     }
 }
@@ -52,7 +72,7 @@ async function printUpdateBox(current, latest) {
             chalk.bold(`Update available! `) + chalk.dim(current) + chalk.reset(` → `) + chalk.green(latest),
             `Run ${chalk.cyan("npm i -g @weavetab/mcp")} to update.`,
             ``,
-            `Changelog: ${chalk.blue(`https://github.com/weavetab/mcp/changelog/v${latest}`)}`
+            `Changelog: ${chalk.blue(`https://github.com/weavetab/mcp/releases/tag/v${latest}`)}`
         ].join("\n");
         const box = boxen(msg, {
             padding: 1,
@@ -67,6 +87,6 @@ async function printUpdateBox(current, latest) {
         // Fallback if formatting fails
         console.error(`\n[Weavetab MCP] Update available: ${current} -> ${latest}`);
         console.error(`Run "npm i -g @weavetab/mcp" to update.`);
-        console.error(`Changelog: https://github.com/weavetab/mcp/changelog/v${latest}\n`);
+        console.error(`Changelog: https://github.com/weavetab/mcp/releases/tag/v${latest}\n`);
     }
 }

package/dist/config/loader.d.ts

@@ -136,4 +136,12 @@ export declare function getSystemAppDir(appName: string): string;
  * Alias for consistency — identical to getSystemDir.
  */
 export declare function getGlobalSystemDir(subdir: string): string;
+/**
+ * Returns the canonical directory for persistent site profiles and learned workflow patterns.
+ * Lives in ~/.weavetab-system/memory/sites/ — strictly machine-managed, never user-authored.
+ * Separated from the legacy selector-memory dir (~/.weavetab-system/memory/) so existing
+ * per-domain selector caches are not disrupted.
+ */
+export declare function getSystemMemorySitesDir(): string;
 export declare function saveConfig(config: Config): void;
+export declare function stopConfigWatcher(): void;