@weavetab/mcp 2.5.0-beta.2 → 2.5.0-beta.4

package/dist/intelligence/patternCompiler.js

@@ -0,0 +1,259 @@
+/**
+ * Weavetab — intelligence/patternCompiler.ts
+ *
+ * Compiles raw browser session trails (action sequences) into persistent,
+ * reusable site workflow patterns stored under ~/.weavetab-system/memory/sites/.
+ *
+ * Design invariants:
+ *  - One file per origin (sanitized hostname). Never creates per-path or per-run files.
+ *  - Pattern names are caller-supplied (snake_case). Duplicate calls for the same
+ *    name on the same origin UPDATE the existing pattern rather than creating a new file.
+ *  - Volatile / unstable selectors (auto-generated classes, nth-child paths) are
+ *    stripped and replaced with semantic anchors where possible.
+ *  - Never reads or writes to ~/.weavetab/ (user config space).
+ */
+import { readFile, writeFile } from "fs/promises";
+import { join } from "path";
+import fs from "fs";
+import { getSystemMemorySitesDir } from "../config/loader.js";
+import { logDebug } from "../audit/logger.js";
+// ─── Volatile selector detection ────────────────────────────────────────────
+const VOLATILE_PATTERNS = [
+    /\[class\*="[a-z0-9]+-[a-z0-9]+"\]/, // CSS-module hash attribute selectors
+    /:nth-child\(\d+\)/, // positional pseudo-selectors
+    /\.\w{8,}[-_]\w{4,}/, // hashed Tailwind / CSS-module class combos
+    /div > div > div > /, // deep anonymous structural chains (3+ levels)
+];
+function isVolatileSelector(sel) {
+    return VOLATILE_PATTERNS.some((rx) => rx.test(sel));
+}
+function stabilizeSelector(sel) {
+    if (!sel)
+        return undefined;
+    if (isVolatileSelector(sel)) {
+        logDebug(`[PatternCompiler] Dropping volatile selector: ${sel}`);
+        return undefined;
+    }
+    return sel;
+}
+// ─── File path helpers ───────────────────────────────────────────────────────
+function originToFilename(origin) {
+    return origin
+        .replace(/^https?:\/\//, "")
+        .replace(/[^a-zA-Z0-9.-]/g, "_");
+}
+function siteProfilePath(origin) {
+    const sitesDir = getSystemMemorySitesDir();
+    return join(sitesDir, `${originToFilename(origin)}.json`);
+}
+// ─── In-process LRU cache ───────────────────────────────────────────────────
+const profileCache = new Map();
+const CACHE_MAX = 100;
+function cacheSet(origin, profile) {
+    if (profileCache.size >= CACHE_MAX && !profileCache.has(origin)) {
+        const firstKey = profileCache.keys().next().value;
+        if (firstKey !== undefined)
+            profileCache.delete(firstKey);
+    }
+    profileCache.set(origin, profile);
+}
+export function clearSiteProfileCache() {
+    profileCache.clear();
+}
+// ─── Public API ──────────────────────────────────────────────────────────────
+/**
+ * Load a site profile from disk. Returns null if the site has never been profiled.
+ * Hits in-process cache first — no redundant disk reads within a session.
+ */
+export async function getSiteProfile(origin) {
+    if (profileCache.has(origin))
+        return profileCache.get(origin);
+    const filePath = siteProfilePath(origin);
+    if (!fs.existsSync(filePath))
+        return null;
+    try {
+        const raw = await readFile(filePath, "utf-8");
+        const profile = JSON.parse(raw);
+        cacheSet(origin, profile);
+        return profile;
+    }
+    catch (e) {
+        logDebug(`[PatternCompiler] Failed to parse site profile for ${origin}: ${e}`);
+        return null;
+    }
+}
+/**
+ * Persist a site profile. Always deep-merges into existing data on disk — never
+ * blindly overwrites — so concurrent tool calls don't clobber each other.
+ */
+export async function saveSiteProfile(profile) {
+    const filePath = siteProfilePath(profile.origin);
+    let base = null;
+    if (fs.existsSync(filePath)) {
+        try {
+            base = JSON.parse(await readFile(filePath, "utf-8"));
+        }
+        catch { /* treat corrupt file as empty */ }
+    }
+    const merged = {
+        ...base,
+        ...profile,
+        origin: profile.origin,
+        patterns: { ...(base?.patterns ?? {}), ...profile.patterns },
+        quirks: { ...(base?.quirks ?? {}), ...profile.quirks },
+        visitCount: profile.visitCount ?? base?.visitCount ?? 0,
+        updatedAt: new Date().toISOString(),
+    };
+    cacheSet(profile.origin, merged);
+    await writeFile(filePath, JSON.stringify(merged, null, 2), "utf-8");
+    logDebug(`[PatternCompiler] Saved site profile → ${filePath}`);
+}
+/**
+ * Learn or update a named workflow pattern for a given origin.
+ * - Duplicate name = merge/update, never duplicate file.
+ * - Volatile selectors in steps are dropped to keep patterns stable.
+ * - Anti-spam: skips disk write when content is identical to existing.
+ */
+export async function learnPattern(origin, name, incoming) {
+    const profile = (await getSiteProfile(origin)) ?? {
+        origin,
+        quirks: {},
+        patterns: {},
+        visitCount: 0,
+        updatedAt: new Date().toISOString(),
+    };
+    const existing = profile.patterns[name] ?? {
+        name,
+        steps: [],
+        reliability: 1.0,
+        strikes: 0,
+        last_verified: new Date().toISOString(),
+        total_executions: 0,
+        successful_executions: 0,
+    };
+    const stabilizedSteps = (incoming.steps ?? existing.steps).map((step) => ({
+        ...step,
+        target: step.target ? stabilizeSelector(step.target) : undefined,
+    }));
+    const hasChanges = (!profile.patterns[name] ||
+        (incoming.steps !== undefined && JSON.stringify(stabilizedSteps) !== JSON.stringify(existing.steps)) ||
+        (incoming.success_indicator !== undefined && incoming.success_indicator !== existing.success_indicator) ||
+        (incoming.entry !== undefined && incoming.entry !== existing.entry));
+    if (hasChanges) {
+        const updated = {
+            ...existing,
+            ...incoming,
+            name,
+            steps: stabilizedSteps,
+            last_verified: new Date().toISOString(),
+        };
+        await saveSiteProfile({
+            ...profile,
+            patterns: { ...profile.patterns, [name]: updated },
+        });
+        logDebug(`[PatternCompiler] Pattern "${name}" learned/updated for ${origin}`);
+        return updated;
+    }
+    else {
+        logDebug(`[PatternCompiler] Pattern "${name}" unchanged — skipping write`);
+        return existing;
+    }
+}
+/**
+ * Record the outcome of executing a named pattern.
+ * Updates reliability via EWMA (α=0.15) and tracks consecutive strikes.
+ * 3 strikes → reliability will naturally fall below 0.4, agent should re-explore.
+ */
+export async function recordPatternExecution(origin, patternName, success, durationMs) {
+    const profile = await getSiteProfile(origin);
+    if (!profile)
+        return null;
+    const pattern = profile.patterns[patternName];
+    if (!pattern)
+        return null;
+    const alpha = 0.15;
+    const newReliability = Math.round((0.85 * pattern.reliability + alpha * (success ? 1 : 0)) * 1000) / 1000;
+    const updated = {
+        ...pattern,
+        reliability: newReliability,
+        strikes: success ? 0 : pattern.strikes + 1,
+        last_verified: success ? new Date().toISOString() : pattern.last_verified,
+        total_executions: pattern.total_executions + 1,
+        successful_executions: success ? pattern.successful_executions + 1 : pattern.successful_executions,
+        avg_duration_ms: durationMs !== undefined
+            ? Math.round(pattern.avg_duration_ms !== undefined
+                ? 0.8 * pattern.avg_duration_ms + 0.2 * durationMs
+                : durationMs)
+            : pattern.avg_duration_ms,
+    };
+    if (updated.strikes >= 3) {
+        logDebug(`[PatternCompiler] ⚠ Pattern "${patternName}" on ${origin} hit 3 strikes (reliability: ${updated.reliability}) — re-learning recommended`);
+    }
+    await saveSiteProfile({
+        ...profile,
+        patterns: { ...profile.patterns, [patternName]: updated },
+    });
+    return updated;
+}
+/**
+ * Record or update a site quirk (cookie banner, rate limit, modal popup, etc.)
+ * Only writes if the stored data differs from incoming — prevents spam writes.
+ */
+export async function recordQuirk(origin, quirkKey, quirkData) {
+    const profile = (await getSiteProfile(origin)) ?? {
+        origin,
+        quirks: {},
+        patterns: {},
+        visitCount: 0,
+        updatedAt: new Date().toISOString(),
+    };
+    const existing = profile.quirks[quirkKey];
+    if (JSON.stringify(existing) === JSON.stringify(quirkData)) {
+        logDebug(`[PatternCompiler] Quirk "${quirkKey}" unchanged — skipping write`);
+        return;
+    }
+    await saveSiteProfile({
+        ...profile,
+        quirks: { ...profile.quirks, [quirkKey]: quirkData },
+    });
+    logDebug(`[PatternCompiler] Recorded quirk "${quirkKey}" for ${origin}`);
+}
+/**
+ * Returns the reliability score (0–1) of a named pattern, or -1 if unknown.
+ */
+export async function getPatternReliability(origin, patternName) {
+    const profile = await getSiteProfile(origin);
+    if (!profile)
+        return -1;
+    return profile.patterns[patternName]?.reliability ?? -1;
+}
+/**
+ * Formats a compact site profile hint string for agent system prompt injection.
+ * Called at session start when navigating to a known origin.
+ */
+export function formatSiteProfileHint(profile) {
+    const lines = [`[SiteProfile] ${profile.origin}`];
+    if (profile.framework)
+        lines.push(`  framework: ${profile.framework}`);
+    if (profile.captcha_frequency && profile.captcha_frequency !== "none") {
+        lines.push(`  captcha_frequency: ${profile.captcha_frequency}`);
+    }
+    const patternNames = Object.keys(profile.patterns);
+    if (patternNames.length > 0) {
+        lines.push("  known_patterns:");
+        for (const name of patternNames) {
+            const p = profile.patterns[name];
+            const flag = p.strikes >= 3
+                ? " [RE-LEARN NEEDED]"
+                : p.reliability >= 0.8
+                    ? " [fast-path eligible]"
+                    : "";
+            lines.push(`    - ${name}: reliability=${p.reliability.toFixed(2)}, steps=${p.steps.length}${flag}`);
+        }
+    }
+    const quirkKeys = Object.keys(profile.quirks).filter((k) => profile.quirks[k] !== undefined && profile.quirks[k] !== null);
+    if (quirkKeys.length > 0) {
+        lines.push(`  quirks: ${quirkKeys.join(", ")}`);
+    }
+    return lines.join("\n");
+}

package/dist/intelligence/sessionMemory.d.ts

@@ -34,6 +34,8 @@ export interface DomainProfile {
     updatedAt: string;
     visitCount: number;
 }
+export declare function clearMemoryCache(): void;
+export declare function getDomainFilePath(hostname: string): string;
 export declare function loadDomainProfile(hostname: string): Promise<DomainProfile | null>;
 export declare function saveDomainProfile(hostname: string, updates: Partial<DomainProfile>): Promise<DomainProfile>;
 /**

package/dist/intelligence/sessionMemory.js

@@ -1,20 +1,30 @@
 import { readFile, writeFile } from "fs/promises";
 import { join } from "path";
-import { GLOBAL_CONFIG_DIR } from "../config/loader.js";
+import { GLOBAL_CONFIG_DIR, getSystemDir } from "../config/loader.js";
 import { logDebug } from "../audit/logger.js";
 import fs from "fs";
 function domainFile(hostname) {
     const safe = hostname.replace(/[^a-zA-Z0-9.-]/g, "_");
-    const memoryDir = join(GLOBAL_CONFIG_DIR, "memory");
-    if (!fs.existsSync(memoryDir))
-        fs.mkdirSync(memoryDir, { recursive: true });
-    return join(memoryDir, `${safe}.json`);
+    const memoryDir = getSystemDir("memory");
+    const systemPath = join(memoryDir, `${safe}.json`);
+    // Backward compatibility: migrate legacy ~/.weavetab/memory/<safe>.json if it exists
+    const legacyPath = join(GLOBAL_CONFIG_DIR, "memory", `${safe}.json`);
+    if (!fs.existsSync(systemPath) && fs.existsSync(legacyPath)) {
+        try {
+            fs.copyFileSync(legacyPath, systemPath);
+        }
+        catch { /* ignore migration error */ }
+    }
+    return systemPath;
 }
-// memoryCache is capped at 200 DomainProfile entries (one per unique hostname).
-// When the cap is hit, the oldest entry is evicted (insertion-order LRU) so the
-// cache can't grow without bound over a long session.
 const memoryCache = new Map();
 const MEMORY_CACHE_MAX = 200;
+export function clearMemoryCache() {
+    memoryCache.clear();
+}
+export function getDomainFilePath(hostname) {
+    return domainFile(hostname);
+}
 function memoryCacheSet(hostname, profile) {
     if (memoryCache.size >= MEMORY_CACHE_MAX && !memoryCache.has(hostname)) {
         // Evict the oldest (first) entry

package/dist/overlay/injector.js

@@ -152,7 +152,7 @@ export async function ensureVisualLayer(session, config, client) {
                 returnByValue: true
             });
             if (checkResult?.value) {
-                logDebug(`[Weavetab] [OK] Minimal overlay injected successfully`);
+                logDebug(`[Weavetab] overlay injected`);
             }
             else {
                 logDebug(`[Weavetab] [!] Minimal overlay injection failed - element not found`);
@@ -171,7 +171,7 @@ export async function setupOverlay(session, config) {
     await ensureVisualLayer(session, config);
 }
 export async function setFaviconState(_session, _state) {
-    // Handled robustly via extension content.js
+    // handled via extension content.js
 }
 export async function removeTitleBadge(_session) {
     // No-op: title dot prefix removed in favor of favicon indicators

package/dist/plugin/interface.d.ts

@@ -62,6 +62,11 @@ export interface WeavetabPermissions {
         write?: string[];
         reason?: string;
     };
+    filesystem?: {
+        read?: string[];
+        write?: string[];
+        reason?: string;
+    };
     tools?: {
         /** List of built-in tool names this plugin is permitted to override */
         override?: string[];
@@ -72,7 +77,7 @@ export interface WeavetabPermissions {
     };
     [key: string]: any;
 }
-export type WeavetabManifestPermissions = WeavetabPermissions;
+export type WeavetabManifestPermissions = WeavetabPermissions | string[];
 export interface WeavetabManifestAuthor {
     name: string;
     role?: string;
@@ -96,6 +101,8 @@ export interface WeavetabManifest {
     version: string;
     /** Short summary of what this plugin provides */
     description?: string;
+    /** Entry point file relative to the plugin root (e.g., 'dist/index.js') */
+    entry?: string;
     /** Single author or multiple authors with roles */
     author?: string | WeavetabManifestAuthor | (string | WeavetabManifestAuthor)[];
     /** Array of authors */
@@ -114,12 +121,14 @@ export interface WeavetabManifest {
     engines?: Record<string, string>;
     /** Supported environments */
     environments?: string[];
+    /** Whether the plugin should be lazy-loaded on demand */
+    lazy?: boolean;
     /** Tools exposed by this plugin to the MCP server */
     tools?: WeavetabManifestTool[];
     /** Default configuration template */
     defaultConfig?: Record<string, any>;
     /** Required permissions with security rationale */
-    permissions?: WeavetabPermissions;
+    permissions?: WeavetabManifestPermissions;
     /** Open source license */
     license?: string;
     [key: string]: any;
@@ -132,7 +141,57 @@ export interface WeavetabPluginTool<TArgs = any> {
     parameters?: Record<string, any>;
     handler: (args: TArgs, session?: any, config?: any) => Promise<any>;
 }
+export interface DOMMutationDelta {
+    type?: "cdp_mutation" | "action_delta" | "page_update" | "dom_diff" | "rich_delta" | string;
+    timestamp?: number;
+    url?: string;
+    added?: Array<{
+        id?: string;
+        role?: string;
+        label?: string;
+        tag?: string;
+        text?: string;
+        backendNodeId?: number;
+        [key: string]: any;
+    }>;
+    removed?: Array<string | {
+        backendNodeId?: number;
+        tag?: string;
+        text?: string;
+        [key: string]: any;
+    }>;
+    changed?: Array<{
+        ref?: string;
+        role?: string;
+        label?: string;
+        attribute?: string;
+        oldValue?: any;
+        newValue?: any;
+        changes?: Record<string, {
+            from: any;
+            to: any;
+        }>;
+        actionable?: boolean;
+        [key: string]: any;
+    }>;
+    significantChange?: boolean;
+    stable_count?: number;
+    iframes?: any[];
+    [key: string]: any;
+}
+export type BeforeActionHook = (tool: string, args: Record<string, any>, session?: any) => Promise<Record<string, any> | {
+    __blocked: boolean;
+    reason?: string;
+} | void> | Record<string, any> | {
+    __blocked: boolean;
+    reason?: string;
+} | void;
+export type AfterActionHook = (tool: string, result: any, session?: any, args?: Record<string, any>) => Promise<any> | any;
+export type DOMMutationHook = (delta: DOMMutationDelta, session?: any) => Promise<void> | void;
 export interface PluginHooksContext {
+    onBeforeAction: (handler: BeforeActionHook) => void;
+    onAfterAction: (handler: AfterActionHook) => void;
+    onDOMMutation: (handler: DOMMutationHook) => void;
     beforeToolCall: (handler: (toolName: string, args: Record<string, any>, session?: any) => Promise<any> | void) => void;
     afterToolCall: (handler: (toolName: string, args: Record<string, any>, result: any, session?: any) => Promise<any> | void) => void;
     onPageNavigate?: (handler: (url: string, session?: any) => Promise<void> | void) => void;
@@ -144,6 +203,13 @@ export interface PluginMcpContext {
     unregisterTool?: (toolName: string) => void;
     [key: string]: any;
 }
+export interface PluginMemoryContext {
+    getSiteProfile(origin: string): Promise<any>;
+    learnPattern(origin: string, name: string, pattern: any): Promise<any>;
+    recordExecution(origin: string, name: string, success: boolean, durationMs?: number): Promise<any>;
+    getReliability(origin: string, patternName: string): Promise<number>;
+    recordQuirk(origin: string, quirkKey: string, quirkData: any): Promise<void>;
+}
 export interface PluginContext {
     name: string;
     version?: string;
@@ -153,6 +219,7 @@ export interface PluginContext {
     extension: IPluginExtensionBridge;
     mcp: PluginMcpContext;
     hooks: PluginHooksContext;
+    memory?: PluginMemoryContext;
     logger: {
         info: (...args: any[]) => void;
         warn: (...args: any[]) => void;
@@ -169,6 +236,9 @@ export interface WeavetabPluginDefinition {
     overrides?: WeavetabToolOverride[];
     removeTools?: string[];
     defaultConfig?: Record<string, any>;
+    onBeforeAction?: BeforeActionHook;
+    onAfterAction?: AfterActionHook;
+    onDOMMutation?: DOMMutationHook;
     onLoad?: (ctx: PluginContext) => Promise<void> | void;
     onUnload?: (ctx: PluginContext) => Promise<void> | void;
 }
@@ -189,8 +259,12 @@ export interface WeavetabPlugin {
     hooks?: {
         beforeToolCall: Array<(toolName: string, args: Record<string, any>, session?: any) => Promise<any> | void>;
         afterToolCall: Array<(toolName: string, args: Record<string, any>, result: any, session?: any) => Promise<any> | void>;
+        onDOMMutation: Array<DOMMutationHook>;
         onPageNavigate: Array<(url: string, session?: any) => Promise<void> | void>;
     };
+    onBeforeAction?: BeforeActionHook;
+    onAfterAction?: AfterActionHook;
+    onDOMMutation?: DOMMutationHook;
     onLoad?: (ctx: PluginContext) => Promise<void> | void;
     onUnload?: (ctx: PluginContext) => Promise<void> | void;
 }

package/dist/plugin/loader.d.ts

@@ -1,4 +1,6 @@
-import type { WeavetabPlugin, WeavetabManifest } from "./interface.js";
+import type { WeavetabPlugin, WeavetabManifest, WeavetabPermissions, PluginContext } from "./interface.js";
+import { PluginStorageManager } from "./storage.js";
+import { PluginExtensionBridge } from "./extension_bridge.js";
 export interface InstalledPluginInfo {
     packageName: string;
     dir: string;
@@ -6,6 +8,10 @@ export interface InstalledPluginInfo {
     pkgJson?: Record<string, any>;
     hasValidManifest: boolean;
 }
+/**
+ * Normalizes permissions format across legacy arrays and object aliases (filesystem vs fs).
+ */
+export declare function normalizePermissions(perms?: any): WeavetabPermissions;
 /**
  * Reads the manifest (weavetab.json) and package.json for an installed package
  * without executing its runtime code (safe for listing/inspection).
@@ -15,6 +21,14 @@ export declare function inspectInstalledPackage(pkgDir: string): InstalledPlugin
  * Scan node_modules and return metadata for all installed Weavetab plugins.
  */
 export declare function listInstalledPlugins(pluginDir?: string): InstalledPluginInfo[];
+/**
+ * Builds the canonical rich PluginContext for a loaded plugin.
+ */
+export declare function buildPluginContext(plugin: WeavetabPlugin, storageManager: PluginStorageManager, extensionBridge: PluginExtensionBridge, pluginConfig: Record<string, any>, hooks: {
+    beforeToolCall: Array<(toolName: string, args: Record<string, any>, session?: any) => Promise<any> | void>;
+    afterToolCall: Array<(toolName: string, args: Record<string, any>, result: any, session?: any) => Promise<any> | void>;
+    onPageNavigate: Array<(url: string, session?: any) => Promise<void> | void>;
+}): PluginContext;
 export declare function discoverPlugins(pluginDir?: string): WeavetabPlugin[];
 /**
  * Loads a specific plugin by name from node_modules.