@weavetab/mcp 2.5.0-beta.2 → 2.5.0-beta.5

package/dist/cli/updater.js

@@ -1,19 +1,33 @@
 import fs from "node:fs";
 import path from "node:path";
+import os from "node:os";
 import { fileURLToPath } from "node:url";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
-export async function checkForUpdates() {
+const UPDATE_CACHE_FILE = path.join(os.homedir(), ".weavetab-system", "cache", "update_check.json");
+const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000; // 24 hours
+export async function checkForUpdates(force = false) {
     try {
+        const now = Date.now();
+        // Check cache unless forced
+        if (!force && fs.existsSync(UPDATE_CACHE_FILE)) {
+            try {
+                const cached = JSON.parse(fs.readFileSync(UPDATE_CACHE_FILE, "utf-8"));
+                if (cached.lastChecked && now - cached.lastChecked < CHECK_INTERVAL_MS) {
+                    return;
+                }
+            }
+            catch { /* malformed cache */ }
+        }
         // Read local package.json to get current version
         const packageJsonPath = path.resolve(__dirname, "../../package.json");
         if (!fs.existsSync(packageJsonPath))
             return;
         const pkg = JSON.parse(fs.readFileSync(packageJsonPath, "utf-8"));
         const currentVersion = pkg.version;
-        // Fast, non-blocking fetch with 2-second timeout
+        // Fast, non-blocking fetch with 1.5-second timeout
         const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), 2000);
+        const timeoutId = setTimeout(() => controller.abort(), 1500);
         const res = await fetch("https://registry.npmjs.org/@weavetab/mcp/latest", {
             signal: controller.signal,
         });
@@ -22,12 +36,18 @@ export async function checkForUpdates() {
             return;
         const data = await res.json();
         const latestVersion = data.version;
-        // Simple version comparison (assumes semver format like x.y.z)
+        // Save timestamp to cache
+        try {
+            fs.mkdirSync(path.dirname(UPDATE_CACHE_FILE), { recursive: true });
+            fs.writeFileSync(UPDATE_CACHE_FILE, JSON.stringify({ lastChecked: now, latestVersion }), "utf-8");
+        }
+        catch { /* non-fatal */ }
+        // Simple version comparison
         if (isNewerVersion(currentVersion, latestVersion)) {
             await printUpdateBox(currentVersion, latestVersion);
         }
     }
-    catch (err) {
+    catch {
         // Silently fail if offline or npm is down
     }
 }
@@ -52,7 +72,7 @@ async function printUpdateBox(current, latest) {
             chalk.bold(`Update available! `) + chalk.dim(current) + chalk.reset(` → `) + chalk.green(latest),
             `Run ${chalk.cyan("npm i -g @weavetab/mcp")} to update.`,
             ``,
-            `Changelog: ${chalk.blue(`https://github.com/weavetab/mcp/changelog/v${latest}`)}`
+            `Changelog: ${chalk.blue(`https://github.com/weavetab/mcp/releases/tag/v${latest}`)}`
         ].join("\n");
         const box = boxen(msg, {
             padding: 1,
@@ -67,6 +87,6 @@ async function printUpdateBox(current, latest) {
         // Fallback if formatting fails
         console.error(`\n[Weavetab MCP] Update available: ${current} -> ${latest}`);
         console.error(`Run "npm i -g @weavetab/mcp" to update.`);
-        console.error(`Changelog: https://github.com/weavetab/mcp/changelog/v${latest}\n`);
+        console.error(`Changelog: https://github.com/weavetab/mcp/releases/tag/v${latest}\n`);
     }
 }

package/dist/config/loader.d.ts

@@ -1,6 +1,6 @@
 export type DevModeConfig = boolean;
 export type PolicyMode = "allow" | "deny" | "audit-only" | "read-only";
-export type Role = "admin" | "viewer" | "automation" | "system";
+export type Role = "admin" | "operator" | "viewer" | "automation" | "system";
 export type BrowserEngine = "chromium" | "firefox" | "webkit";
 export interface PolicyEntry {
     pattern: string;
@@ -136,4 +136,12 @@ export declare function getSystemAppDir(appName: string): string;
  * Alias for consistency — identical to getSystemDir.
  */
 export declare function getGlobalSystemDir(subdir: string): string;
+/**
+ * Returns the canonical directory for persistent site profiles and learned workflow patterns.
+ * Lives in ~/.weavetab-system/memory/sites/ — strictly machine-managed, never user-authored.
+ * Separated from the legacy selector-memory dir (~/.weavetab-system/memory/) so existing
+ * per-domain selector caches are not disrupted.
+ */
+export declare function getSystemMemorySitesDir(): string;
 export declare function saveConfig(config: Config): void;
+export declare function stopConfigWatcher(): void;

package/dist/config/loader.js

@@ -44,7 +44,7 @@ export const DEFAULT_CONFIG = {
     sessionTimeout: 3600,
     navigationTimeout: 30000,
     idleTimeout: 60000,
-    actionabilityTimeoutMs: 15000,
+    actionabilityTimeoutMs: 300,
     maxTabs: 10,
     maxActionsPerMinute: 60,
     githubCacheTtlMs: 30 * 60 * 1000,
@@ -153,7 +153,7 @@ export function validateConfigInternal(raw) {
     const d = DEFAULT_CONFIG;
     const VALID_MODES = ["session", "attach"];
     const VALID_ENGINES = ["chromium", "firefox", "webkit"];
-    const VALID_ROLES = ["admin", "viewer", "automation", "system"];
+    const VALID_ROLES = ["admin", "operator", "viewer", "automation", "system"];
     const mode = validateField("mode", raw.mode, isStr, d.mode, v => VALID_MODES.includes(v));
     // Path validation helpers
     function safePathField(field, value) {
@@ -761,6 +761,19 @@ export function getGlobalSystemDir(subdir) {
     }
     return dir;
 }
+/**
+ * Returns the canonical directory for persistent site profiles and learned workflow patterns.
+ * Lives in ~/.weavetab-system/memory/sites/ — strictly machine-managed, never user-authored.
+ * Separated from the legacy selector-memory dir (~/.weavetab-system/memory/) so existing
+ * per-domain selector caches are not disrupted.
+ */
+export function getSystemMemorySitesDir() {
+    const dir = path.join(GLOBAL_SYSTEM_DIR, "memory", "sites");
+    if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true });
+    }
+    return dir;
+}
 export function saveConfig(config) {
     const { dir, file } = getActiveConfigPath();
     ensureConfigDir(dir);
@@ -789,11 +802,18 @@ export function saveConfig(config) {
 }
 // ─── Live-reload watcher ───────────────────────────────────────────────────────
 let watchTimeout = null;
+let _configWatcher = null;
 function startWatcher(dir) {
     try {
         if (!fs.existsSync(dir))
             return;
-        fs.watch(dir, (eventType, filename) => {
+        if (_configWatcher) {
+            try {
+                _configWatcher.close();
+            }
+            catch { /* ignore */ }
+        }
+        _configWatcher = fs.watch(dir, (eventType, filename) => {
             if (filename === "config.json" && eventType === "change") {
                 if (watchTimeout)
                     clearTimeout(watchTimeout);
@@ -806,12 +826,31 @@ function startWatcher(dir) {
                         logDebug("[Weavetab] Failed to reload config", e);
                     }
                 }, 150);
+                if (watchTimeout && typeof watchTimeout.unref === "function") {
+                    watchTimeout.unref();
+                }
             }
         });
+        if (_configWatcher && typeof _configWatcher.unref === "function") {
+            _configWatcher.unref();
+        }
     }
     catch {
         // Ignore watch errors on some OS/network mounts
     }
 }
+export function stopConfigWatcher() {
+    if (watchTimeout) {
+        clearTimeout(watchTimeout);
+        watchTimeout = null;
+    }
+    if (_configWatcher) {
+        try {
+            _configWatcher.close();
+        }
+        catch { /* ignore */ }
+        _configWatcher = null;
+    }
+}
 // Watch global location so changes are picked up
 startWatcher(GLOBAL_CONFIG_DIR);

package/dist/desktop/discovery.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Weavetab — desktop/discovery.ts
+ * Auto-discovery scanner for running Electron desktop applications.
+ *
+ * Detects:
+ *   1. Active Electron instances with open CDP remote debugging ports
+ *      (Slack, Discord, VS Code, Notion, Obsidian, Linear, Cursor, etc.).
+ *   2. Running Electron processes without remote debugging enabled,
+ *      providing actionable launch flags.
+ *
+ * Weavetab by fy2ne
+ */
+export interface DiscoveredElectronApp {
+    name: string;
+    port?: number;
+    status: "debug_port_open" | "process_running_no_debug_port";
+    title?: string;
+    webSocketDebuggerUrl?: string;
+    browserVersion?: string;
+    pid?: number;
+    recommendation?: string;
+}
+export declare const COMMON_DEBUG_PORTS: number[];
+/**
+ * Fast probe of a potential CDP debug port on 127.0.0.1.
+ * Resolves with version/target metadata if open, or null if unreachable.
+ */
+export declare function probeDebugPort(port: number, timeoutMs?: number): Promise<{
+    versionInfo: any;
+    targets: any[];
+} | null>;
+export declare function fetchTargets(port: number, timeoutMs?: number): Promise<any[]>;
+/**
+ * Infers an application name from CDP version and target metadata.
+ */
+export declare function identifyElectronAppName(versionInfo: any, targets: any[]): string;
+/**
+ * Discovers running Electron apps on the host machine.
+ * 1. Probes common and provided debug ports for open CDP listeners.
+ * 2. Checks OS process list for running Electron apps lacking debug ports.
+ */
+export declare function discoverElectronApps(customPorts?: number[]): Promise<DiscoveredElectronApp[]>;
+export declare function isValidElectronExecutablePath(execPath: string): boolean;
+export declare function resolveElectronExecutablePath(appName: string, configuredPath?: string): string | null;

package/dist/desktop/discovery.js

@@ -0,0 +1,364 @@
+/**
+ * Weavetab — desktop/discovery.ts
+ * Auto-discovery scanner for running Electron desktop applications.
+ *
+ * Detects:
+ *   1. Active Electron instances with open CDP remote debugging ports
+ *      (Slack, Discord, VS Code, Notion, Obsidian, Linear, Cursor, etc.).
+ *   2. Running Electron processes without remote debugging enabled,
+ *      providing actionable launch flags.
+ *
+ * Weavetab by fy2ne
+ */
+import http from "node:http";
+import fs from "node:fs";
+import path from "node:path";
+import { exec } from "node:child_process";
+import { promisify } from "node:util";
+import { logDebug } from "../audit/logger.js";
+const execAsync = promisify(exec);
+export const COMMON_DEBUG_PORTS = [9222, 9229, 9333, 8315, 9223, 9224];
+const KNOWN_ELECTRON_PROCS = {
+    slack: "Slack",
+    discord: "Discord",
+    code: "VS Code",
+    "visual studio code": "VS Code",
+    notion: "Notion",
+    obsidian: "Obsidian",
+    linear: "Linear",
+    spotify: "Spotify",
+    postman: "Postman",
+    cursor: "Cursor",
+    figma: "Figma",
+};
+/**
+ * Fast probe of a potential CDP debug port on 127.0.0.1.
+ * Resolves with version/target metadata if open, or null if unreachable.
+ */
+export async function probeDebugPort(port, timeoutMs = 300) {
+    return new Promise((resolve) => {
+        const req = http.get(`http://127.0.0.1:${port}/json/version`, { timeout: timeoutMs }, (res) => {
+            if (res.statusCode !== 200) {
+                res.resume();
+                return resolve(null);
+            }
+            let data = "";
+            res.on("data", (chunk) => (data += chunk));
+            res.on("end", async () => {
+                try {
+                    const versionInfo = JSON.parse(data);
+                    const targets = await fetchTargets(port, timeoutMs).catch(() => []);
+                    resolve({ versionInfo, targets });
+                }
+                catch {
+                    resolve(null);
+                }
+            });
+        });
+        req.on("error", () => resolve(null));
+        req.on("timeout", () => {
+            req.destroy();
+            resolve(null);
+        });
+    });
+}
+export async function fetchTargets(port, timeoutMs = 300) {
+    return new Promise((resolve) => {
+        const req = http.get(`http://127.0.0.1:${port}/json/list`, { timeout: timeoutMs }, (res) => {
+            if (res.statusCode !== 200) {
+                res.resume();
+                return resolve([]);
+            }
+            let data = "";
+            res.on("data", (chunk) => (data += chunk));
+            res.on("end", () => {
+                try {
+                    resolve(JSON.parse(data));
+                }
+                catch {
+                    resolve([]);
+                }
+            });
+        });
+        req.on("error", () => resolve([]));
+        req.on("timeout", () => {
+            req.destroy();
+            resolve([]);
+        });
+    });
+}
+/**
+ * Infers an application name from CDP version and target metadata.
+ */
+export function identifyElectronAppName(versionInfo, targets) {
+    const allText = [
+        versionInfo?.Browser || "",
+        versionInfo?.["User-Agent"] || "",
+        ...targets.map((t) => `${t.title || ""} ${t.url || ""}`),
+    ].join(" ").toLowerCase();
+    for (const [key, displayName] of Object.entries(KNOWN_ELECTRON_PROCS)) {
+        if (allText.includes(key)) {
+            return displayName;
+        }
+    }
+    // Fallback to first non-empty page title
+    const primaryTarget = targets.find((t) => t.type === "page" && t.title);
+    if (primaryTarget?.title) {
+        return primaryTarget.title.slice(0, 30);
+    }
+    return "Electron Application";
+}
+/**
+ * Discovers running Electron apps on the host machine.
+ * 1. Probes common and provided debug ports for open CDP listeners.
+ * 2. Checks OS process list for running Electron apps lacking debug ports.
+ */
+export async function discoverElectronApps(customPorts = []) {
+    const discovered = [];
+    const portsToScan = Array.from(new Set([...COMMON_DEBUG_PORTS, ...customPorts]));
+    // 1. Probe all candidate debug ports in parallel
+    const probeResults = await Promise.all(portsToScan.map(async (port) => ({
+        port,
+        res: await probeDebugPort(port),
+    })));
+    const openAppNames = new Set();
+    for (const { port, res } of probeResults) {
+        if (res) {
+            const name = identifyElectronAppName(res.versionInfo, res.targets);
+            openAppNames.add(name.toLowerCase());
+            discovered.push({
+                name,
+                port,
+                status: "debug_port_open",
+                title: res.targets.find((t) => t.title)?.title || undefined,
+                webSocketDebuggerUrl: res.versionInfo.webSocketDebuggerUrl,
+                browserVersion: res.versionInfo.Browser,
+            });
+        }
+    }
+    // 2. Scan OS process list for known Electron apps without debug ports
+    try {
+        const runningProcs = await getRunningElectronProcesses();
+        for (const proc of runningProcs) {
+            if (!openAppNames.has(proc.name.toLowerCase())) {
+                discovered.push({
+                    name: proc.name,
+                    pid: proc.pid,
+                    status: "process_running_no_debug_port",
+                    recommendation: `Launch or restart ${proc.name} with: --remote-debugging-port=9222`,
+                });
+            }
+        }
+    }
+    catch {
+        // Process list scan is best-effort across restricted OS environments
+    }
+    return discovered;
+}
+async function getRunningElectronProcesses() {
+    const platform = process.platform;
+    const running = [];
+    try {
+        if (platform === "win32") {
+            const { stdout } = await execAsync('tasklist /FO CSV /NH', { timeout: 1500 });
+            const lines = stdout.split("\r\n");
+            const seenNames = new Set();
+            for (const line of lines) {
+                if (!line.trim())
+                    continue;
+                const parts = line.split('","').map((p) => p.replace(/"/g, ""));
+                const exeName = (parts[0] || "").toLowerCase();
+                const pid = parseInt(parts[1], 10);
+                for (const [key, displayName] of Object.entries(KNOWN_ELECTRON_PROCS)) {
+                    if (exeName.includes(key) && !seenNames.has(displayName)) {
+                        seenNames.add(displayName);
+                        running.push({ name: displayName, pid });
+                    }
+                }
+            }
+        }
+        else {
+            const { stdout } = await execAsync('ps -eo pid,comm', { timeout: 1500 });
+            const lines = stdout.split("\n");
+            const seenNames = new Set();
+            for (const line of lines) {
+                const trimmed = line.trim();
+                if (!trimmed)
+                    continue;
+                const [pidStr, ...cmdParts] = trimmed.split(/\s+/);
+                const cmd = cmdParts.join(" ").toLowerCase();
+                const pid = parseInt(pidStr, 10);
+                for (const [key, displayName] of Object.entries(KNOWN_ELECTRON_PROCS)) {
+                    if (cmd.includes(key) && !seenNames.has(displayName)) {
+                        seenNames.add(displayName);
+                        running.push({ name: displayName, pid });
+                    }
+                }
+            }
+        }
+    }
+    catch {
+        // ignore
+    }
+    return running;
+}
+export function isValidElectronExecutablePath(execPath) {
+    if (!execPath || typeof execPath !== "string")
+        return false;
+    const normalizedPath = execPath.toLowerCase().trim();
+    // Check for suspicious patterns that might indicate command injection or shell escapes
+    const suspiciousPatterns = [
+        '%', // URL encoding
+        'cmd.exe', 'powershell.exe', 'bash', 'sh', 'wscript.exe', 'cscript.exe'
+    ];
+    if (suspiciousPatterns.some(pattern => normalizedPath.includes(pattern))) {
+        logDebug(`[SECURITY] Electron path validation failed: suspicious pattern in path: ${execPath}`);
+        return false;
+    }
+    try {
+        if (!fs.existsSync(execPath)) {
+            return false;
+        }
+        const stat = fs.statSync(execPath);
+        if (!stat.isFile()) {
+            return false;
+        }
+    }
+    catch {
+        return false;
+    }
+    return true;
+}
+export function resolveElectronExecutablePath(appName, configuredPath) {
+    const normApp = appName.toLowerCase().trim();
+    // 1. If configuredPath is provided and valid, return it
+    if (configuredPath && isValidElectronExecutablePath(configuredPath)) {
+        return path.resolve(configuredPath);
+    }
+    // 2. If configuredPath was provided, but does not exist, check versioned parent folder (e.g. Squirrel app-*)
+    if (configuredPath) {
+        try {
+            const parsed = path.parse(path.resolve(configuredPath));
+            const parentDir = parsed.dir;
+            const baseExe = parsed.base || (process.platform === "win32" ? `${appName}.exe` : appName);
+            const parentBase = path.basename(parentDir);
+            const searchDirs = [];
+            if (parentBase.toLowerCase().startsWith("app-") || parentBase.toLowerCase().startsWith("app_")) {
+                searchDirs.push(path.dirname(parentDir));
+            }
+            else {
+                searchDirs.push(parentDir);
+            }
+            for (const sDir of searchDirs) {
+                if (fs.existsSync(sDir)) {
+                    const entries = fs.readdirSync(sDir, { withFileTypes: true });
+                    const versionDirs = entries
+                        .filter(e => e.isDirectory() && (e.name.startsWith("app-") || e.name.startsWith("app_")))
+                        .map(e => e.name)
+                        .sort((a, b) => b.localeCompare(a, undefined, { numeric: true, sensitivity: 'base' }));
+                    for (const vDir of versionDirs) {
+                        const candidate = path.join(sDir, vDir, baseExe);
+                        if (isValidElectronExecutablePath(candidate)) {
+                            return candidate;
+                        }
+                    }
+                    const directCandidate = path.join(sDir, baseExe);
+                    if (isValidElectronExecutablePath(directCandidate)) {
+                        return directCandidate;
+                    }
+                }
+            }
+        }
+        catch { /* ignore fallback errors */ }
+    }
+    // 3. Platform-specific auto-discovery for known apps
+    const platform = process.platform;
+    const candidates = [];
+    if (platform === "win32") {
+        const localAppData = process.env.LOCALAPPDATA || "";
+        const progFiles = process.env.ProgramFiles || "C:\\Program Files";
+        const progFilesX86 = process.env["ProgramFiles(x86)"] || "C:\\Program Files (x86)";
+        if (normApp === "discord") {
+            const discordDir = path.join(localAppData, "Discord");
+            if (fs.existsSync(discordDir)) {
+                try {
+                    const entries = fs.readdirSync(discordDir, { withFileTypes: true });
+                    const vDirs = entries
+                        .filter(e => e.isDirectory() && e.name.startsWith("app-"))
+                        .map(e => e.name)
+                        .sort((a, b) => b.localeCompare(a, undefined, { numeric: true, sensitivity: 'base' }));
+                    for (const v of vDirs) {
+                        candidates.push(path.join(discordDir, v, "Discord.exe"));
+                    }
+                }
+                catch { }
+            }
+            candidates.push(path.join(progFiles, "Discord", "Discord.exe"));
+            candidates.push(path.join(progFilesX86, "Discord", "Discord.exe"));
+        }
+        else if (normApp === "slack") {
+            const slackDir = path.join(localAppData, "slack");
+            if (fs.existsSync(slackDir)) {
+                try {
+                    const entries = fs.readdirSync(slackDir, { withFileTypes: true });
+                    const vDirs = entries
+                        .filter(e => e.isDirectory() && e.name.startsWith("app-"))
+                        .map(e => e.name)
+                        .sort((a, b) => b.localeCompare(a, undefined, { numeric: true, sensitivity: 'base' }));
+                    for (const v of vDirs) {
+                        candidates.push(path.join(slackDir, v, "slack.exe"));
+                    }
+                }
+                catch { }
+            }
+            candidates.push(path.join(progFiles, "Slack", "slack.exe"));
+            candidates.push(path.join(progFilesX86, "Slack", "slack.exe"));
+        }
+        else if (normApp === "antigravity") {
+            candidates.push(path.join(localAppData, "Programs", "antigravity", "Antigravity.exe"));
+        }
+        else if (normApp === "antigravity-ide") {
+            candidates.push(path.join(localAppData, "Programs", "Antigravity IDE", "Antigravity IDE.exe"));
+        }
+        else if (normApp === "code" || normApp === "vscode") {
+            candidates.push(path.join(localAppData, "Programs", "Microsoft VS Code", "Code.exe"));
+            candidates.push(path.join(progFiles, "Microsoft VS Code", "Code.exe"));
+            candidates.push(path.join(progFilesX86, "Microsoft VS Code", "Code.exe"));
+        }
+        else if (normApp === "linear") {
+            candidates.push(path.join(localAppData, "Programs", "Linear", "Linear.exe"));
+        }
+        else if (normApp === "notion") {
+            candidates.push(path.join(localAppData, "Programs", "Notion", "Notion.exe"));
+        }
+        else if (normApp === "obsidian") {
+            candidates.push(path.join(localAppData, "Programs", "obsidian", "Obsidian.exe"));
+        }
+    }
+    else if (platform === "darwin") {
+        if (normApp === "discord")
+            candidates.push("/Applications/Discord.app/Contents/MacOS/Discord");
+        else if (normApp === "slack")
+            candidates.push("/Applications/Slack.app/Contents/MacOS/Slack");
+        else if (normApp === "code" || normApp === "vscode")
+            candidates.push("/Applications/Visual Studio Code.app/Contents/MacOS/Electron");
+        else if (normApp === "linear")
+            candidates.push("/Applications/Linear.app/Contents/MacOS/Linear");
+        else if (normApp === "notion")
+            candidates.push("/Applications/Notion.app/Contents/MacOS/Notion");
+        else if (normApp === "obsidian")
+            candidates.push("/Applications/Obsidian.app/Contents/MacOS/Obsidian");
+    }
+    else {
+        // Linux
+        candidates.push(`/usr/bin/${normApp}`);
+        candidates.push(`/usr/local/bin/${normApp}`);
+        candidates.push(`/usr/share/${normApp}/${normApp}`);
+    }
+    for (const c of candidates) {
+        if (isValidElectronExecutablePath(c)) {
+            return c;
+        }
+    }
+    return null;
+}