@weavetab/mcp 2.5.0-beta.2 → 2.5.0-beta.5

package/dist/plugin/pipeline.js

@@ -0,0 +1,183 @@
+/**
+ * src/plugin/pipeline.ts — Central Hook Dispatch Pipeline for Weavetab Plugins
+ *
+ * Dispatches lifecycle events:
+ * - onBeforeAction / beforeToolCall: Intercept tool calls, modify arguments, or block unauthorized actions
+ * - onAfterAction / afterToolCall: Transform, redact, or augment tool return results
+ * - onDOMMutation: Stream real-time DOM mutation deltas to registered plugins
+ * - onPageNavigate: Notify plugins upon browser navigation
+ */
+class HookPipeline {
+    beforeToolCallHooks = [];
+    afterToolCallHooks = [];
+    onDOMMutationHooks = [];
+    onPageNavigateHooks = [];
+    /**
+     * Register hooks for a specific plugin.
+     */
+    registerPluginHooks(pluginName, hooks) {
+        if (!hooks)
+            return;
+        // 1. Before Action / Before Tool Call
+        const beforeFns = hooks.onBeforeAction || hooks.beforeToolCall;
+        if (beforeFns) {
+            const list = Array.isArray(beforeFns) ? beforeFns : [beforeFns];
+            for (const fn of list) {
+                if (typeof fn === "function") {
+                    this.beforeToolCallHooks.push({ pluginName, fn });
+                }
+            }
+        }
+        // 2. After Action (signature: (tool, result, session, args))
+        if (hooks.onAfterAction) {
+            const list = Array.isArray(hooks.onAfterAction) ? hooks.onAfterAction : [hooks.onAfterAction];
+            for (const fn of list) {
+                if (typeof fn === "function") {
+                    this.afterToolCallHooks.push({
+                        pluginName,
+                        fn: async (toolName, args, result, session) => {
+                            return await fn(toolName, result, session, args);
+                        },
+                    });
+                }
+            }
+        }
+        // Legacy After Tool Call (signature: (tool, args, result, session))
+        if (hooks.afterToolCall) {
+            const list = Array.isArray(hooks.afterToolCall) ? hooks.afterToolCall : [hooks.afterToolCall];
+            for (const fn of list) {
+                if (typeof fn === "function") {
+                    this.afterToolCallHooks.push({ pluginName, fn });
+                }
+            }
+        }
+        // 3. DOM Mutation Hooks
+        if (hooks.onDOMMutation) {
+            const list = Array.isArray(hooks.onDOMMutation) ? hooks.onDOMMutation : [hooks.onDOMMutation];
+            for (const fn of list) {
+                if (typeof fn === "function") {
+                    this.onDOMMutationHooks.push({ pluginName, fn });
+                }
+            }
+        }
+        // 4. Page Navigate Hooks
+        if (hooks.onPageNavigate) {
+            const list = Array.isArray(hooks.onPageNavigate) ? hooks.onPageNavigate : [hooks.onPageNavigate];
+            for (const fn of list) {
+                if (typeof fn === "function") {
+                    this.onPageNavigateHooks.push({ pluginName, fn });
+                }
+            }
+        }
+    }
+    /**
+     * Remove all hooks registered by a plugin on unload.
+     */
+    unregisterPluginHooks(pluginName) {
+        this.beforeToolCallHooks = this.beforeToolCallHooks.filter((h) => h.pluginName !== pluginName);
+        this.afterToolCallHooks = this.afterToolCallHooks.filter((h) => h.pluginName !== pluginName);
+        this.onDOMMutationHooks = this.onDOMMutationHooks.filter((h) => h.pluginName !== pluginName);
+        this.onPageNavigateHooks = this.onPageNavigateHooks.filter((h) => h.pluginName !== pluginName);
+    }
+    /**
+     * Dispatches beforeAction / beforeToolCall hooks in sequence.
+     * If a hook returns an object, arguments are augmented/modified.
+     * If a hook returns { __blocked: true, reason } or throws, execution is aborted.
+     */
+    async dispatchBeforeToolCall(toolName, args, session) {
+        let currentArgs = { ...args };
+        for (const { pluginName, fn } of this.beforeToolCallHooks) {
+            try {
+                const modified = await fn(toolName, currentArgs, session);
+                if (modified && typeof modified === "object") {
+                    if (modified.__blocked) {
+                        const reason = modified.reason || `Action '${toolName}' blocked by plugin '${pluginName}'`;
+                        const blockError = new Error(reason);
+                        blockError.isBlocked = true;
+                        blockError.pluginName = pluginName;
+                        throw blockError;
+                    }
+                    if (!Array.isArray(modified)) {
+                        currentArgs = { ...currentArgs, ...modified };
+                    }
+                }
+            }
+            catch (err) {
+                if (err?.isBlocked) {
+                    throw err;
+                }
+                process.stderr.write(`[Weavetab Hooks] Error in beforeToolCall (${pluginName} on ${toolName}): ${err?.message || err}\n`);
+            }
+        }
+        return currentArgs;
+    }
+    /**
+     * Alias for dispatchBeforeToolCall.
+     */
+    async dispatchBeforeAction(toolName, args, session) {
+        return this.dispatchBeforeToolCall(toolName, args, session);
+    }
+    /**
+     * Dispatches afterAction / afterToolCall hooks in sequence.
+     * Allows plugins to inspect, transform, or redact tool results.
+     */
+    async dispatchAfterToolCall(toolName, args, result, session) {
+        let currentResult = result;
+        for (const { pluginName, fn } of this.afterToolCallHooks) {
+            try {
+                const modified = await fn(toolName, args, currentResult, session);
+                if (modified !== undefined) {
+                    currentResult = modified;
+                }
+            }
+            catch (err) {
+                process.stderr.write(`[Weavetab Hooks] Error in afterToolCall (${pluginName} on ${toolName}): ${err?.message || err}\n`);
+            }
+        }
+        return currentResult;
+    }
+    /**
+     * Alias for dispatchAfterToolCall.
+     */
+    async dispatchAfterAction(toolName, result, session, args) {
+        return this.dispatchAfterToolCall(toolName, args || {}, result, session);
+    }
+    /**
+     * Dispatches DOM mutation deltas to all listening plugins.
+     */
+    async dispatchDOMMutation(delta, session) {
+        if (this.onDOMMutationHooks.length === 0)
+            return;
+        for (const { pluginName, fn } of this.onDOMMutationHooks) {
+            try {
+                await fn(delta, session);
+            }
+            catch (err) {
+                process.stderr.write(`[Weavetab Hooks] Error in onDOMMutation (${pluginName}): ${err?.message || err}\n`);
+            }
+        }
+    }
+    /**
+     * Dispatches onPageNavigate hooks when navigation occurs.
+     */
+    async dispatchPageNavigate(url, session) {
+        for (const { pluginName, fn } of this.onPageNavigateHooks) {
+            try {
+                await fn(url, session);
+            }
+            catch (err) {
+                process.stderr.write(`[Weavetab Hooks] Error in onPageNavigate (${pluginName}): ${err?.message || err}\n`);
+            }
+        }
+    }
+    /**
+     * Clears all registered hooks.
+     */
+    clearAllHooks() {
+        this.beforeToolCallHooks = [];
+        this.afterToolCallHooks = [];
+        this.onDOMMutationHooks = [];
+        this.onPageNavigateHooks = [];
+    }
+}
+export const hookPipeline = new HookPipeline();

package/dist/plugin/registry.d.ts

@@ -19,7 +19,8 @@ export interface PluginCandidate {
     description?: string;
 }
 export declare const OFFICIAL_PLUGIN_PREFIX = "@weavetab/plugin-";
-export declare const REGISTRY_URL = "https://raw.githubusercontent.com/weavetab/registry/main/verified.json";
+export declare const REGISTRY_URL = "https://weavetab.dev/api/registry/verified.json";
+export declare const REGISTRY_FALLBACK_URL = "https://raw.githubusercontent.com/weavetab/registry/main/verified.json";
 /**
  * Returns the set of verified package names.
  * - Tries local registry/verified.json first (dev/test mode).

package/dist/plugin/registry.js

@@ -2,13 +2,14 @@ import { readFileSync, existsSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createRequire } from "node:module";
+import { WEAVETAB_VERSION } from "../version.js";
 const _require = createRequire(import.meta.url);
 function getVersion() {
     try {
-        return _require("../../package.json").version || "2.4.0";
+        return _require("../../package.json").version || WEAVETAB_VERSION;
     }
     catch {
-        return "2.4.0";
+        return WEAVETAB_VERSION;
     }
 }
 const __filename = fileURLToPath(import.meta.url);
@@ -17,8 +18,9 @@ const __dirname = dirname(__filename);
 // Verification Registry
 // ---------------------------------------------------------------------------
 export const OFFICIAL_PLUGIN_PREFIX = "@weavetab/plugin-";
-// The production remote URL — points to weavetab/registry on GitHub.
-export const REGISTRY_URL = "https://raw.githubusercontent.com/weavetab/registry/main/verified.json";
+// The production remote URLs — weavetab.dev (D1-backed) primary, GitHub raw fallback.
+export const REGISTRY_URL = "https://weavetab.dev/api/registry/verified.json";
+export const REGISTRY_FALLBACK_URL = "https://raw.githubusercontent.com/weavetab/registry/main/verified.json";
 // Local override: when this file exists at the root of the repo, we use it instead
 // of the remote URL. This allows full offline/local testing.
 const LOCAL_REGISTRY_PATH = join(__dirname, "..", "..", "..", "registry", "verified.json");
@@ -58,16 +60,24 @@ function loadLocalRegistry() {
     return null;
 }
 async function fetchRemoteRegistry() {
-    const res = await fetch(REGISTRY_URL, {
-        signal: AbortSignal.timeout(5000),
-        headers: { "User-Agent": "Weavetab-Registry-Check/1.0" },
-    });
-    if (!res.ok)
-        throw new Error(`registry fetch failed: ${res.status}`);
-    const data = await res.json();
-    if (!Array.isArray(data.verified))
-        throw new Error("invalid registry format");
-    return extractPackageNames(data.verified);
+    for (const url of [REGISTRY_URL, REGISTRY_FALLBACK_URL]) {
+        try {
+            const res = await fetch(url, {
+                signal: AbortSignal.timeout(5000),
+                headers: { "User-Agent": "Weavetab-Registry-Check/1.0" },
+            });
+            if (!res.ok)
+                continue;
+            const data = await res.json();
+            if (!Array.isArray(data.verified))
+                continue;
+            return extractPackageNames(data.verified);
+        }
+        catch {
+            continue;
+        }
+    }
+    throw new Error("registry fetch failed: all sources unreachable");
 }
 /**
  * Returns the set of verified package names.

package/dist/security/secrets.d.ts

@@ -18,6 +18,12 @@ export interface SecretListEntry {
     updatedAt: string;
 }
 export declare const GLOBAL_SECRETS_PATH: string;
+export declare const PROJECT_SECRETS_DIRNAME = ".weavetab";
+export declare const PROJECT_SECRETS_FILENAME = "secrets.json";
+/** Absolute path of the project-scoped secrets file for a directory (default: cwd). */
+export declare function getProjectSecretsPath(cwd?: string): string;
+/** Creates an empty project-scoped secrets file (chmod 600). Returns its path. */
+export declare function initProjectSecrets(cwd?: string): string;
 declare class JsonSecretStoreImpl implements SecretProvider {
     /**
      * Resolve a secret value by key.
@@ -69,6 +75,7 @@ declare class SessionSecretTrackerImpl {
     isNodeSecret(sessionId: string, backendNodeId: number): boolean;
     registerSecretValue(sessionId: string, value: string): void;
     redact(sessionId: string, text: string): string;
+    redactAll(text: string): string;
     clearSession(sessionId: string): void;
 }
 export declare const SessionSecretTracker: SessionSecretTrackerImpl;

package/dist/security/secrets.js

@@ -86,7 +86,31 @@ function decrypt(ciphertext) {
 import { GLOBAL_CONFIG_DIR } from "../config/loader.js";
 // ─── Path resolution ──────────────────────────────────────────────────────────
 export const GLOBAL_SECRETS_PATH = path.join(GLOBAL_CONFIG_DIR, "secrets.json");
+export const PROJECT_SECRETS_DIRNAME = ".weavetab";
+export const PROJECT_SECRETS_FILENAME = "secrets.json";
+/** Absolute path of the project-scoped secrets file for a directory (default: cwd). */
+export function getProjectSecretsPath(cwd = process.cwd()) {
+    return path.join(cwd, PROJECT_SECRETS_DIRNAME, PROJECT_SECRETS_FILENAME);
+}
+/** Creates an empty project-scoped secrets file (chmod 600). Returns its path. */
+export function initProjectSecrets(cwd = process.cwd()) {
+    const filePath = getProjectSecretsPath(cwd);
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    if (!fs.existsSync(filePath)) {
+        fs.writeFileSync(filePath, JSON.stringify({ version: 1, secrets: {} }, null, 2), { mode: 0o600 });
+    }
+    return filePath;
+}
 function resolveSecretsPath() {
+    // Project-scoped file wins when present — lets a checkout carry its own keys.
+    try {
+        const projectPath = getProjectSecretsPath();
+        if (fs.existsSync(projectPath))
+            return projectPath;
+    }
+    catch {
+        // fall through to global
+    }
     return GLOBAL_SECRETS_PATH;
 }
 // ─── Permission guard ─────────────────────────────────────────────────────────
@@ -357,6 +381,19 @@ class SessionSecretTrackerImpl {
         }
         return redacted;
     }
+    redactAll(text) {
+        if (!text || typeof text !== 'string')
+            return text;
+        let redacted = text;
+        for (const set of this.sessionSecrets.values()) {
+            for (const secret of set) {
+                if (secret && secret.length >= 3) {
+                    redacted = redacted.split(secret).join('[REDACTED]');
+                }
+            }
+        }
+        return redacted;
+    }
     clearSession(sessionId) {
         this.trackedNodes.delete(sessionId);
         this.sessionSecrets.delete(sessionId);

package/dist/sensors/actionability.js

@@ -23,7 +23,7 @@
  */
 // ── Constants ─────────────────────────────────────────────────────────────────
 /** Playwright's per-action retry backoff (ms). */
-const BACKOFF = [0, 20, 100, 100, 500];
+const BACKOFF = [0, 20, 100];
 /**
  * 4-way scroll alignment rotation — escape sticky headers.
  * undefined = browser default (nearest), then progressively more aggressive.
@@ -121,7 +121,6 @@ function buildPageExpression(selector, scrollOptions, fingerprint, stabilityMs)
     let stable = false;
     while (Date.now() < stabilityDeadline) {
       await new Promise(r => requestAnimationFrame(r));
-      await new Promise(r => requestAnimationFrame(r)); // two ticks like Playwright
       const cur = el.getBoundingClientRect();
       if (
         Math.abs(cur.x - prevRect.x) < 0.5 &&

package/dist/sensors/guard.js

@@ -148,9 +148,7 @@ export async function detectPageWeight(session) {
         };
     }
 }
-// ─── Navigation wait — used after clicks that trigger navigation ──────────────
-export async function awaitNavigation(session, timeout = 6000 // Reduced from 10000ms
-) {
+export async function awaitNavigation(session, timeout = 6000) {
     // Poll readyState instead of consuming one-shot event
     await pollUntil(async () => {
         const { result } = await session.Runtime.evaluate({
@@ -158,11 +156,7 @@ export async function awaitNavigation(session, timeout = 6000 // Reduced from 10
             returnByValue: true,
         }).catch(() => ({ result: { value: 'loading' } }));
         return result?.value === 'complete' || result?.value === 'interactive';
-    }, { timeout, interval: 50 }).catch(() => {
-        throw new Error(`Navigation timeout after ${timeout}ms`);
-    });
-    // After DOM content fires, detect page weight for post-load stability wait
-    const weight = await detectPageWeight(session);
-    const stabilityTimeout = weight.level === "heavy" ? 3000 : weight.level === "medium" ? 2000 : 1000; // Reduced from 5000/3000/2000
-    await waitForDOMStable(session, 50, stabilityTimeout); // Reduced quiet period from 100ms
+    }, { timeout, interval: 30 }).catch(() => { });
+    // Quick 40ms settle window for hydration/initial script exec
+    await new Promise(r => setTimeout(r, 40));
 }

package/dist/sensors/mutations.js

@@ -1,3 +1,4 @@
+import { hookPipeline } from "../plugin/pipeline.js";
 // Heuristics for "significant" changes
 const SIGNIFICANT_TAGS = new Set(['button', 'a', 'input', 'textarea', 'select', 'h1', 'h2', 'h3', '[role="button"]', '[role="link"]']);
 const MAX_TEXT_LEN = 150;
@@ -89,5 +90,16 @@ export async function watchMutations(session, durationMs) {
         // Disabling the DOM agent automatically removes all listeners.
         await DOM.disable();
     }
+    if (summary.significantChange || summary.newElements.length > 0 || summary.removedElements.length > 0 || summary.attributeChanges.length > 0) {
+        const delta = {
+            type: "cdp_mutation",
+            timestamp: Date.now(),
+            added: summary.newElements.map(e => ({ backendNodeId: e.backendNodeId, tag: e.tag, text: e.text, role: e.role })),
+            removed: summary.removedElements.map(e => ({ backendNodeId: e.backendNodeId, tag: e.tag })),
+            changed: summary.attributeChanges.map(a => ({ backendNodeId: a.backendNodeId, attribute: a.attribute, newValue: a.newValue })),
+            significantChange: summary.significantChange,
+        };
+        hookPipeline.dispatchDOMMutation(delta, session).catch(() => { });
+    }
     return summary;
 }

package/dist/sensors/operation_monitor.js

@@ -33,6 +33,7 @@ class OperationMonitor {
         const diagnosticsTimer = setInterval(() => {
             this.checkOperationHealth(operationId);
         }, 1000); // Check every 1 second (reduced from 2s for faster detection)
+        diagnosticsTimer.unref();
         this.activeOperations.get(operationId).diagnosticsTimer = diagnosticsTimer;
     }
     /**

package/dist/server.d.ts

@@ -1,6 +1,6 @@
 /**
  * Weavetab — server.ts
- * MCP server: 43 browser automation tools with security, rate limiting, and visual overlay.
+ * MCP server: 44 browser automation tools with security, rate limiting, and visual overlay.
  * Weavetab by fy2ne
  */
 import type { Config } from "./config/loader.js";