@weavetab/mcp 2.5.0-beta.4 → 2.5.0-beta.5

package/dist/tools/navigate.js

@@ -1,5 +1,5 @@
 /**
- * Weavetab — tools/navigate.ts
+ * Weavetab — tools/navigate.ts
  * URL navigation with domain blocklist enforcement and post-navigation DOM stability wait.
  * Weavetab by fy2ne
  */
@@ -71,10 +71,10 @@ export async function weaveNavigate(session, url, config, targetId = "default",
         }
     }
     // Extension pages: open in new tab instead of navigating current tab
-    // (chrome-extension:// pages use a different process context — Page.navigate
+    // (chrome-extension:// pages use a different process context — Page.navigate
     //  can break the CDP session or not fire loadEventFired properly)
     if (parsed.protocol === 'chrome-extension:') {
-        logDebug(`[weaveNavigate] Extension URL detected — opening in new tab: ${parsed.href}`);
+        logDebug(`[weaveNavigate] Extension URL detected — opening in new tab: ${parsed.href}`);
         const { sendToExtension } = await import("../cdp/helpers.js");
         await sendToExtension(session, { type: 'Weavetab_STATE', hud: { action: `opening extension page...` } });
         const { WeavetabOpen } = await import("./tabs.js");
@@ -98,7 +98,7 @@ export async function weaveNavigate(session, url, config, targetId = "default",
             }
         }
         catch { /* overlay install is best-effort */ }
-        logAction("browser_go", url, `opened extension tab ${openRes.tabId}`);
+        logAction("browser_navigate", url, `opened extension tab ${openRes.tabId}`);
         return {
             success: true,
             url: openRes.url,
@@ -194,7 +194,7 @@ export async function weaveNavigate(session, url, config, targetId = "default",
     if (active)
         active.url = finalUrl;
     sendToExtension(session, { type: 'Weavetab_STATE', cursor: { x: 10, y: 10 }, state: 'idle', hud: { action: '' } }).catch(() => { });
-    logAction("browser_go", url, `arrived at ${title}`);
+    logAction("browser_navigate", url, `arrived at ${title}`);
     // Bump the visit counter for this domain exactly once per navigation
     bumpVisitCount(parsed.hostname).catch(() => { });
     return { success: true, url: finalUrl, title, tab_id: resolvedTargetId };

package/dist/tools/tabs.js

@@ -17,7 +17,7 @@ function resolvePort(_config, appName) {
     }
     const port = getPort() || readLock()?.port;
     if (!port)
-        throw new Error("[!] No active browser session. Run browser_go first.");
+        throw new Error("[!] No active browser session. Run browser_navigate first.");
     return port;
 }
 const IDLE_THRESHOLD_MS = 30_000;

package/dist/version.d.ts

@@ -2,4 +2,4 @@
  * Weavetab Version Constant
  * Single source of truth for runtime versioning.
  */
-export declare const WEAVETAB_VERSION = "2.5.0-beta.4";
+export declare const WEAVETAB_VERSION = "2.5.0-beta.5";

package/dist/version.js

@@ -2,4 +2,4 @@
  * Weavetab Version Constant
  * Single source of truth for runtime versioning.
  */
-export const WEAVETAB_VERSION = "2.5.0-beta.4";
+export const WEAVETAB_VERSION = "2.5.0-beta.5";

package/docs/DOCUMENTATION.md

@@ -65,7 +65,7 @@ MCP Client → stdio/WebSocket → WithSecurity Pipeline → CDP WebSocket → C
 
 All tools share: Zod schema validation, `withSecurity()` pipeline (rate limiting + domain policy + RBAC), structured audit logging.
 
-### Vision & Reading (7 tools)
+### Vision & Reading (8 tools)
 
 | Tool | Description |
 |------|-------------|
@@ -76,6 +76,7 @@ All tools share: Zod schema validation, `withSecurity()` pipeline (rate limiting
 | `browser_snapshot` | MHTML capture/restore of DOM state + resources |
 | `browser_screenshot` | PNG/JPEG capture via CDP, full-page + clip region, returns base64 data URL (no file pollution) |
 | `browser_console` | Read/clear buffered console logs and exceptions |
+| `browser_extract_design` | Extract design tokens, typography, colors, and clean CSS with pixel fidelity |
 
 ### Navigation (1 tool)
 
@@ -116,14 +117,15 @@ All tools share: Zod schema validation, `withSecurity()` pipeline (rate limiting
 | Tool | Description |
 |------|-------------|
 | `browser_dialog` | Accept/dismiss JavaScript alert/confirm/prompt dialogs |
-| `browser_thought` | Green thought bubbles: feedback (one-way) or question with input (sentence/paragraph modes) |
+| `browser_thoughts` | Green thought bubbles: feedback (one-way) or question with input (sentence/paragraph modes) |
 | `browser_clipboard` | System clipboard R/W (text + images) |
 
-### Wait & Timing (1 tool)
+### Wait & Timing (2 tools)
 
 | Tool | Description |
 |------|-------------|
 | `browser_wait` | Wait for element/text/URL/stable/network/auto — timeout configurable, optional loop counter reset (`reset_loop: true`) |
+| `browser_captcha` | Autonomous zero-API detection and solving for Cloudflare Turnstile, reCAPTCHA v2/v3, GeeTest, and hCaptcha via CDP mouse physics |
 
 ### Storage & Cookies (2 tools)
 
@@ -132,11 +134,12 @@ All tools share: Zod schema validation, `withSecurity()` pipeline (rate limiting
 | `browser_storage` | localStorage & sessionStorage get/set/clear |
 | `browser_cookies` | Cookies get/set/delete |
 
-### Device & Environment (1 tool)
+### Device & Environment (2 tools)
 
 | Tool | Description |
 |------|-------------|
 | `browser_viewport` | Viewport, device emulation, geolocation, timezone override |
+| `browser_emulate` | Network throttling (3G/4G/offline), CPU slowdown, geolocation, timezone, and User-Agent override |
 
 ### Network (1 tool)
 
@@ -176,12 +179,15 @@ All tools share: Zod schema validation, `withSecurity()` pipeline (rate limiting
 |------|-------------|
 | `browser_github` | Action-based repo metadata analysis, raw source file reading, issue triage, and PR inspection |
 
-### Utility (2 tools)
+### Utility (5 tools)
 
 | Tool | Description |
 |------|-------------|
-| `browser_thoughts` | Ask user a question or show a green sticky feedback |
-| Plugins | Dynamic loading from any npm package with `weavetab.json` (or `@weavetab/plugin-*`) |
+| `list_plugins` | Inspect installed SDK plugins, loaded tool overrides, and capability manifests |
+| `load_plugin` | Dynamically load a Weavetab plugin by npm package name with isolated sandboxing |
+| `browser_checkpoint` | Snapshot and restore browser state (cookies, storage, scroll/URL) into named checkpoints for time-travel and rollback |
+| `browser_pattern_learn` | Read, register, and update named workflow patterns and site quirks per origin |
+| `browser_office` | Parse Word (`.docx`), Excel (`.xlsx`), PDF, and CSV files into structured data |
 
 ---
 
@@ -341,10 +347,11 @@ Configure policies directly in your config file (or via `~/.Weavetab/policy.json
 
 | Role | Permissions |
 |------|-------------|
-| `admin` | Full access to all tools and system operations |
-| `operator` | Full tool access except system operations (logs, detect, performance) |
-| `viewer` | Read-only access to observation tools only |
-| `automation` | Restricted to burst/plan/wait/map for automated workflows |
+| `admin` | Full access to all tools |
+| `operator` | Full access to all tools (standard agent role) |
+| `viewer` | Read-only observation tools only (`browser_map`, `browser_find`, `browser_scrape`, `browser_console`, `browser_eval`, `browser_inspect`, `browser_extract_design`, `browser_snapshot`, `browser_screenshot`, `browser_pdf`, `browser_cookies`, `browser_tabs`, `browser_wait`, `browser_pattern_learn`, `browser_github`) |
+| `automation` | Full access except `browser_thoughts` (non-interactive CI/CD mode) |
+| `system` | Internal tools only (`browser_thoughts`, `browser_detect`, `browser_performance`, `browser_checkpoint`, `browser_pattern_learn`) |
 
 ### Setting Role
 

package/docs/PLUGINS.md

@@ -1,6 +1,6 @@
-# Weavetab Plugin System & SDK Specification
+# Weavetab Plugin System & SDK Specification
 
-> **Version:** 2.5.0-beta.2 | **SDK:** @weavetab/sdk | **License:** AGPL-3.0-only
+> **Version:** 2.5.0-beta.5 | **SDK:** @weavetab/sdk (MIT) | **Runtime:** AGPL-3.0-only
 
 The **Weavetab Plugin System** allows developers to extend the MCP runtime with custom tools, visual HUD overlays, thought bubbles, lifecycle hooks, and tool overrides.
 
@@ -9,14 +9,14 @@ The **Weavetab Plugin System** allows developers to extend the MCP runtime with
 ## 1. Quick Start
 
 ### Scaffold a New Plugin
-`ash
+````bash
 npx @weavetab/sdk init my-custom-plugin
 cd my-custom-plugin
 npm install
 `
 
 ### Build & Compile
-`ash
+````bash
 npm run build
 `
 
@@ -104,7 +104,7 @@ Plugins require a weavetab.json manifest in their package root:
 
 ## 5. Installing Plugins
 
-`ash
+```bash
 # Install an official plugin
 weavetab plugin add @weavetab/plugin-youtube
 

package/docs/TOOLS.md

@@ -1,56 +1,54 @@
-# Weavetab MCP Tool Reference
-
-> **Version:** 2.5.0-beta.4 | **Total Tools:** 44 | **Architecture:** Layer 0 Direct CDP
-
-Weavetab provides 44 production-grade MCP tools organized into functional categories.
-
-| Tool Name | Category | Description | Key Features |
-| :--- | :--- | :--- | :--- |
-| `browser_map` | `vision` | Snapshot interactive DOM with stable ref IDs (w:NN). For complex SPAs, use scope or query to constrain tokens. Supports delta temporal diffing (up to 97% token reduction), semantic pruning (dropping hidden elements), Set-of-Marks visual grounding (visual: true / "auto" for canvas/WebGL pages), AX tree fallback (Shadow DOM traversal), scope filtering, query filtering, and forced rebuilds with automatic loop strike reset (force: true). | Semantic DOM pruning (up to 97% token reduction with delta), Set-of-Marks visual grounding (visual: true / "auto"), Per-tab snapshot temporal diffing (delta mode) |
-| `browser_navigate` | `navigation` | Navigate to a URL. Enforces domain security policies and rate limits prior to navigation. Waits for network idle and DOM readiness. Supports internal protocol schemes (e.g. weavetab://). | Domain policy engine and blocklist enforcement, Deterministic DOM stability and network idle waiting, weavetab:// internal protocol support |
-| `browser_click` | `input` | Click a DOM element. Physical click engine incorporating Bézier curve trajectory kinematics (Ghost Cursor). Multi-stage targeting fallback: mark number (SoM visual grounding) -> ref ID -> selector -> label -> intent -> coordinates -> backendNodeId. | Direct mark number targeting (mark: N) from visual mode, Bézier curve trajectory kinematics, Humanized acceleration and velocity curves |
-| `browser_type` | `input` | Type text into a single input field. Keystroke dispatch engine with per-character temporal jitter and burst profiling. Real-time DOM-diffing monitors stuck input state. Supports atomic clearFirst and clipboard paste modes. | Per-character temporal jitter simulation, Burst keystroke profiling, Stuck-typing loop detection via DOM diffing |
-| `browser_type_secret` | `input` | Inject a secret from an environment variable / secrets.json. Blind Injection: securely injects credentials without exposing sensitive values to the LLM context. Permanently masked as [REDACTED] in DOM maps and logs. | Zero LLM context exposure for credentials, Domain-scoped authorization checks, Shadow DOM input isolation |
-| `browser_key` | `input` | Press a keyboard key. Dispatches native hardware key events with modifier key support (Ctrl, Shift, Alt, Meta) to focused elements. | Native key code and key identifier mapping, Modifier key combination handling, Per-tab keyboard focus targeting |
-| `browser_scroll` | `input` | Scroll the page or targeted element. Smooth scrolling engine via CDP Input.dispatchMouseEvent wheel events. Supports directional delta scrolling and element-relative scroll centering. | Directional scrolling (up, down, left, right), Configurable pixel scroll distance, Element-relative scroll targeting via ref ID or label |
-| `browser_dialog` | `dialog_and_interaction` | Accept or dismiss JS dialogs (alert, confirm, prompt) via CDP Page.handleJavaScriptDialog. | Handling of alert, confirm, and prompt modal types, Accept and dismiss actions, Prompt response text payload submission |
-| `browser_burst` | `mission_execution` | HIGH-SPEED MULTI-ACTION PIPELINE: Executes 2 or more sequential browser actions in a single round-trip without waiting for LLM turns between steps. PREFER THIS over individual single-action calls to slash latency and token burn. Supports native primitives (browser_click, browser_fill, browser_type, browser_type_secret, browser_navigate, browser_key, browser_scroll, browser_wait, browser_map) plus compound macros (type_and_send, click_and_wait, navigate_and_read, scroll_and_read, fill_form). If compile_from_history: true is passed, automatically compiles and executes recent successful session trail actions into a burst macro. | Single-request multi-action pipeline execution with zero intermediate LLM round-trips, Compound macro abstractions (type_and_send, click_and_wait, navigate_and_read, scroll_and_read, fill_form, drag_and_drop, hover_and_read), Automatic session history compilation into replayable burst macros (compile_from_history: true) |
-| `browser_tabs` | `tabs` | Manage browser and Electron app tabs/windows (open, switch, close, list). Specify 'app' when targeting desktop apps (e.g. app: 'discord') to avoid opening web browser. | Single and batch tab operations, Duplicate tab consolidation, Crash session recovery (heal) |
-| `browser_wait` | `navigation` | Pause until a condition is met ('element', 'text', 'url', 'stable', 'network', 'auto'). Deterministic wait engine for asynchronous web state synchronization. | Element, text, URL, DOM stability, and network idle conditions, Configurable timeout thresholds, Per-tab asynchronous execution target |
-| `browser_captcha` | `safety` | Autonomous zero-API detection and solving of Turnstile, reCAPTCHA, GeeTest, and hCaptcha bot challenges using local CDP behavioral solvers. | Zero-API autonomous solving, Cloudflare Turnstile, reCAPTCHA v2/v3, GeeTest, and hCaptcha support, Human oversight fallback via wait_for_user |
-| `browser_thoughts` | `dialog_and_interaction` | Agent-to-user communication layer rendered in the middle down of the page. Supports question mode (interactive prompt with answer submission) and feedback mode (status, observation, decision, or warning update). Supports contextual element anchoring (anchor: 'w:NN') and visual styles ('observation', 'decision', 'warning', 'question'). | Middle-down floating card HUD with precision dark styling, Contextual element anchoring (anchor: 'w:NN') with auto-highlighting, Feedback mode (observation, decision, warning updates) |
-| `browser_pointer` | `input` | Advanced pointer control (hover, click, double_click, drag_and_drop) with Bézier curve kinematics. Supports waitForChild pattern for dynamic flyout menus. | Hover, click, double_click, and drag_and_drop actions, Bézier curve cursor motion, waitForChild trigger menu resolution |
-| `browser_select` | `input` | Select an option from a native dropdown by visible text or value. Uses native property setters and dispatches input/change events for framework compatibility (React, Vue, Angular). | Option matching by visible text or value, Framework-safe prototype property setter invocation, Synthetic input and change event dispatch |
-| `browser_fill` | `input` | Smart multi-field form-filling. Evaluates field control types (text, select, checkbox, radio, contenteditable) and processes inputs sequentially with atomic verification. | Multi-field batch input execution, Automatic control type classification, Per-field post-input verification |
-| `browser_highlight` | `canvas_and_visual` | Highlight elements on page. Renders temporary visual overlays over target elements without DOM tree mutations. Supports multi-element consideration overlays (refs: ['w:12', 'w:15']), presentation styles ('consideration', 'target', 'danger', 'success', 'shimmer'), floating badges, and configurable durations. | Multi-candidate consideration overlay (refs array), Five visual styles: consideration, target lock, danger, success, shimmer, Floating label badge display above highlighted elements |
-| `browser_upload` | `input` | Upload files to a file input. Bypasses OS native file pickers via CDP DOM.setFileInputFiles directly targeting file input node IDs using absolute file paths. | Direct CDP file payload injection, Multi-file payload support, Zero OS file picker interaction required |
-| `browser_find` | `vision` | Sub-5ms CDP text search. Zero token waste. Best for locating specific keywords/text on page without a full DOM walk. | Native CDP search (zero DOM walk overhead), Sub-5ms execution latency, Exact keyword matching and match indexing |
-| `browser_storage` | `storage_and_cookies` | Manage localStorage and sessionStorage. Reads, writes, and clears key-value pairs for the active origin. | localStorage and sessionStorage scope targeting, Atomic key-value retrieval and mutation, Origin storage purging |
-| `browser_checkpoint` | `storage_and_cookies` | Snapshot and restore browser state (cookies, localStorage, sessionStorage, and scroll/URL) into named checkpoints to time-travel and rollback failed automation branches. | Session state time-travel and rollback, Cookies backup and restoration (HttpOnly and Secure via CDP), LocalStorage and SessionStorage snapshotting |
-| `browser_network_intercept` | `network` | Intercept/stub network responses (mock APIs, block tracking) and capture raw protocol network telemetry (TLS/SSL certificate metadata, microsecond timing breakdown, and OS-level network failure reasons). | URL glob pattern matching and response mocking, TLS/SSL Certificate security metadata (issuer, protocol, validity, cipher), Microsecond Network Timing breakdown (DNS, TCP, SSL, send, TTFB, download) |
-| `browser_console` | `vision` | 1-5ms latency access to buffered browser console messages, JS exceptions, and network errors tracked via CDP Runtime.consoleAPICalled. | Buffered console output stream retrieval, Buffer clearance actions, Runtime exception stack capture |
-| `browser_pdf` | `output` | Print the current page to a PDF file via CDP Page.printToPDF with configurable orientation, scale, and page ranges. | Landscape and portrait orientation options, Print scale factor adjustment, Page range subset printing |
-| `browser_eval` | `evaluation` | Run arbitrary JS via CDP in page context via CDP Runtime.evaluate. Supports asynchronous evaluation and structured JSON serialization. | Page JS context execution, Async/await promise resolution, Structured JSON return serialization |
-| `browser_cookies` | `storage_and_cookies` | Manage browser cookies. Full CRUD management for HTTP and document cookies via CDP Network domain. | Cookie property retrieval, setting, and deletion, Domain and path attribute scoping |
-| `browser_canvas` | `canvas_and_visual` | For ALL canvas content (charts, games, graphs). Use get_image to read pixel data as Base64 PNG, draw to simulate programmatic coordinate gesture paths. | Base64 PNG pixel buffer export, Programmatic gesture path drawing, Canvas node targeting via ref ID or selector |
-| `browser_scrape` | `vision` | Sub-5ms latency, zero waste extraction via CSS or XPath selectors in a single CDP evaluation step. Returns structured text/attribute arrays. | CSS and XPath query evaluation, Targeted attribute extraction, Single-step execution (high throughput) |
-| `browser_snapshot` | `vision` | Capture or restore an MHTML snapshot (DOM + inline assets). Facilitates offline state serialization, replay verification, and compliance auditing. | Full DOM and asset stream serialization, Atomic capture and restore operations, Offline state audit capability |
-| `browser_screenshot` | `vision` | 95-135ms capture latency via CDP Page.captureScreenshot. Supports PNG and JPEG formats, full-page rendering, and clip region bounding boxes. | Full-page and viewport bounding box capture, PNG and JPEG format encoding, Custom clip region bounding box support |
-| `browser_viewport` | `device_and_environment` | Set viewport dimensions and device emulation (width, height, DPR, mobile, geolocation, timezone, locale, color scheme). | Viewport width, height, and DPR emulation, Mobile viewport and touch event emulation, Geolocation coordinate override |
-| `browser_clipboard` | `dialog_and_interaction` | Read or write to the system clipboard (plaintext or Base64 image payload data). | Read and write data operations, Plaintext and Base64 image payload format support |
-| `browser_inspect` | `vision` | 15-35ms latency, zero waste. Deep DOM inspection returning computed styles, inline styles, box model dimensions, and attached event listener types. | Computed CSS style property inspection, Event listener type registration enumeration, Box model geometry verification |
-| `browser_extract_design` | `vision` | Extract design tokens (colors, typography, spacing, shadows, CSS variables), semantic HTML layouts, and clean CSS into structured files and an LLM design blueprint. Ideal for cloning websites, UI components, and design systems with 100% pixel fidelity. | CSS custom properties and design token harvesting, Palette extraction and typography hierarchy mapping, Semantic clean DOM extraction with inline SVGs preserved |
-| `browser_automation` | `mission_execution` | Inject self-running background script for monitoring/polling. Inject persistent scripts into the page context for continuous event tracking. | Background script context injection, Named automation script management, Decoupled event monitoring lifecycle |
-| `browser_recording` | `output` | Record video screencasts of browser sessions. Automatically compiles captured frames into animated video files (.webp, .gif, .webm, .mp4) using native Node processing or system ffmpeg. | Native WebP/GIF animation compilation in pure Node, Configurable FPS and frame limits, FFmpeg fallback for WebM/MP4 encoding |
-| `browser_detect` | `tabs` | CRITICAL INITIALIZATION TOOL. Detect available browsers and configured desktop apps (Discord, Slack, etc.). Call this FIRST before interacting with the environment to know if apps are online/offline and what tabs they have open. | Local browser engine discovery, Engine CDP API coverage analysis, Tool compatibility reporting per browser engine |
-| `browser_performance` | `performance` | Retrieve page performance metrics. Collects Core Web Vitals (FCP, LCP, CLS) and detailed network resource timing distributions. | First Contentful Paint (FCP) and Largest Contentful Paint (LCP) capture, Cumulative Layout Shift (CLS) tracking, Resource loading timing distributions |
-| `browser_pattern_learn` | `memory` | Read (action=get), register (action=learn), update, or record execution outcome for a named workflow pattern on a given origin in ~/.weavetab-system/memory/sites/. Use action=get at session start to inspect site profiles and reliability scores. Use learn after completing a flow to persist it for future fast-path replay. | Site profile inspection via action=get (reads ~/.weavetab-system/memory/sites/), Named pattern creation and update (merge-on-write, no duplicates), Volatile selector stabilization before persistence |
-| `browser_github` | `github` | Interact with GitHub repositories without burning browser turns. Analyze repo trees, read raw source files, search/inspect issues, and examine PR diffs and review comments. | Action-based repo analysis, file reading, issues, and PR review, Zero GitHub API token requirement for raw reads, Automated active tab repository context resolution |
-| `browser_office` | `documents` | Read and extract structured content from office documents (Excel, Word, PDF, CSV) via live browser session cookies or local downloads directory. | In-session authenticated document fetching, Structured tabular extraction (.xlsx, .csv), Document text and metadata extraction (.docx, .pdf) |
-| `browser_emulate` | `environment` | Emulate browser environmental conditions over CDP: network throttling profiles, CPU slowdown multipliers, geolocation overrides, timezone IDs, and custom User-Agent strings. | Network throttling (Offline, Slow 3G, Fast 3G, 4G), CPU throttling multipliers, Geolocation and timezone overrides |
-| `list_plugins` | `plugins` | Inspect installed Weavetab SDK plugins, available unloadable plugins, tool overrides, custom schemas, and capability manifests. | Installed plugin discovery, Manifest and schema introspection, Ecosystem capability listing |
-| `load_plugin` | `plugins` | Dynamically load any published Weavetab plugin by npm package name into the active runtime with isolated sandboxing and hot tool registration. | Dynamic npm package loading, Hot tool registration with client notification, Isolated plugin execution context |
-
----
-
-*Auto-generated via `npm run docs:generate` on 2026-09-24.*
+# Weavetab MCP Tool Reference
+
+> **Version:** 2.5.0-beta.5 | **Total Tools:** 42 | **Architecture:** Layer 0 Direct CDP
+
+Weavetab provides 42 production-grade MCP tools organized into functional categories.
+
+| Tool Name | Category | Description | Key Features |
+| :--- | :--- | :--- | :--- |
+| `browser_map` | `vision` | Snapshot interactive DOM with stable ref IDs (w:NN). For complex SPAs, use scope or query to constrain tokens. Supports delta temporal diffing (up to 97% token reduction), semantic pruning (dropping hidden elements), Set-of-Marks visual grounding (visual: true / "auto" for canvas/WebGL pages), AX tree fallback (Shadow DOM traversal), scope filtering, query filtering, and forced rebuilds with automatic loop strike reset (force: true). | Semantic DOM pruning (up to 97% token reduction with delta), Set-of-Marks visual grounding (visual: true / "auto"), Per-tab snapshot temporal diffing (delta mode) |
+| `browser_navigate` | `navigation` | Navigate to a URL. Enforces domain security policies and rate limits prior to navigation. Waits for network idle and DOM readiness. Supports internal protocol schemes (e.g. weavetab://). | Domain policy engine and blocklist enforcement, Deterministic DOM stability and network idle waiting, weavetab:// internal protocol support |
+| `browser_click` | `input` | Click a DOM element. Physical click engine incorporating Bézier curve trajectory kinematics (Ghost Cursor). Multi-stage targeting fallback: mark number (SoM visual grounding) -> ref ID -> selector -> label -> intent -> coordinates -> backendNodeId. | Direct mark number targeting (mark: N) from visual mode, Bézier curve trajectory kinematics, Humanized acceleration and velocity curves |
+| `browser_type` | `input` | Type text into a single input field. Keystroke dispatch engine with per-character temporal jitter and burst profiling. Real-time DOM-diffing monitors stuck input state. Supports atomic clearFirst and clipboard paste modes. | Per-character temporal jitter simulation, Burst keystroke profiling, Stuck-typing loop detection via DOM diffing |
+| `browser_type_secret` | `input` | Inject a secret from an environment variable / secrets.json. Blind Injection: securely injects credentials without exposing sensitive values to the LLM context. Permanently masked as [REDACTED] in DOM maps and logs. | Zero LLM context exposure for credentials, Domain-scoped authorization checks, Shadow DOM input isolation |
+| `browser_key` | `input` | Press a keyboard key. Dispatches native hardware key events with modifier key support (Ctrl, Shift, Alt, Meta) to focused elements. | Native key code and key identifier mapping, Modifier key combination handling, Per-tab keyboard focus targeting |
+| `browser_scroll` | `input` | Scroll the page or targeted element. Smooth scrolling engine via CDP Input.dispatchMouseEvent wheel events. Supports directional delta scrolling and element-relative scroll centering. | Directional scrolling (up, down, left, right), Configurable pixel scroll distance, Element-relative scroll targeting via ref ID or label |
+| `browser_dialog` | `dialog_and_interaction` | Accept or dismiss JS dialogs (alert, confirm, prompt) via CDP Page.handleJavaScriptDialog. | Handling of alert, confirm, and prompt modal types, Accept and dismiss actions, Prompt response text payload submission |
+| `browser_burst` | `mission_execution` | HIGH-SPEED MULTI-ACTION PIPELINE: Executes 2 or more sequential browser actions in a single round-trip without waiting for LLM turns between steps. PREFER THIS over individual single-action calls to slash latency and token burn. Supports native primitives (browser_click, browser_fill, browser_type, browser_type_secret, browser_navigate, browser_key, browser_scroll, browser_wait, browser_map) plus compound macros (type_and_send, click_and_wait, navigate_and_read, scroll_and_read, fill_form). If compile_from_history: true is passed, automatically compiles and executes recent successful session trail actions into a burst macro. | Single-request multi-action pipeline execution with zero intermediate LLM round-trips, Compound macro abstractions (type_and_send, click_and_wait, navigate_and_read, scroll_and_read, fill_form, drag_and_drop, hover_and_read), Automatic session history compilation into replayable burst macros (compile_from_history: true) |
+| `browser_tabs` | `tabs` | Manage browser and Electron app tabs/windows (open, switch, close, list). Specify 'app' when targeting desktop apps (e.g. app: 'discord') to avoid opening web browser. | Single and batch tab operations, Duplicate tab consolidation, Crash session recovery (heal) |
+| `browser_wait` | `navigation` | Pause until a condition is met ('element', 'text', 'url', 'stable', 'network', 'auto'). Deterministic wait engine for asynchronous web state synchronization. | Element, text, URL, DOM stability, and network idle conditions, Configurable timeout thresholds, Per-tab asynchronous execution target |
+| `browser_captcha` | `safety` | Autonomous zero-API detection and solving of Turnstile, reCAPTCHA, GeeTest, and hCaptcha bot challenges using local CDP behavioral solvers. | Zero-API autonomous solving, Cloudflare Turnstile, reCAPTCHA v2/v3, GeeTest, and hCaptcha support, Human oversight fallback via wait_for_user |
+| `browser_thoughts` | `dialog_and_interaction` | Agent-to-user communication layer rendered in the middle down of the page. Supports question mode (interactive prompt with answer submission) and feedback mode (status, observation, decision, or warning update). Supports contextual element anchoring (anchor: 'w:NN') and visual styles ('observation', 'decision', 'warning', 'question'). | Middle-down floating card HUD with precision dark styling, Contextual element anchoring (anchor: 'w:NN') with auto-highlighting, Feedback mode (observation, decision, warning updates) |
+| `browser_pointer` | `input` | Advanced pointer control (hover, click, double_click, drag_and_drop) with Bézier curve kinematics. Supports waitForChild pattern for dynamic flyout menus. | Hover, click, double_click, and drag_and_drop actions, Bézier curve cursor motion, waitForChild trigger menu resolution |
+| `browser_select` | `input` | Select an option from a native dropdown by visible text or value. Uses native property setters and dispatches input/change events for framework compatibility (React, Vue, Angular). | Option matching by visible text or value, Framework-safe prototype property setter invocation, Synthetic input and change event dispatch |
+| `browser_fill` | `input` | Smart multi-field form-filling. Evaluates field control types (text, select, checkbox, radio, contenteditable) and processes inputs sequentially with atomic verification. | Multi-field batch input execution, Automatic control type classification, Per-field post-input verification |
+| `browser_highlight` | `canvas_and_visual` | Highlight elements on page. Renders temporary visual overlays over target elements without DOM tree mutations. Supports multi-element consideration overlays (refs: ['w:12', 'w:15']), presentation styles ('consideration', 'target', 'danger', 'success', 'shimmer'), floating badges, and configurable durations. | Multi-candidate consideration overlay (refs array), Five visual styles: consideration, target lock, danger, success, shimmer, Floating label badge display above highlighted elements |
+| `browser_upload` | `input` | Upload files to a file input. Bypasses OS native file pickers via CDP DOM.setFileInputFiles directly targeting file input node IDs using absolute file paths. | Direct CDP file payload injection, Multi-file payload support, Zero OS file picker interaction required |
+| `browser_find` | `vision` | Sub-5ms CDP text search. Zero token waste. Best for locating specific keywords/text on page without a full DOM walk. | Native CDP search (zero DOM walk overhead), Sub-5ms execution latency, Exact keyword matching and match indexing |
+| `browser_storage` | `storage_and_cookies` | Manage localStorage and sessionStorage. Reads, writes, and clears key-value pairs for the active origin. | localStorage and sessionStorage scope targeting, Atomic key-value retrieval and mutation, Origin storage purging |
+| `browser_checkpoint` | `storage_and_cookies` | Snapshot and restore browser state (cookies, localStorage, sessionStorage, and scroll/URL) into named checkpoints to time-travel and rollback failed automation branches. | Session state time-travel and rollback, Cookies backup and restoration (HttpOnly and Secure via CDP), LocalStorage and SessionStorage snapshotting |
+| `browser_network_intercept` | `network` | Intercept/stub network responses (mock APIs, block tracking) and capture raw protocol network telemetry (TLS/SSL certificate metadata, microsecond timing breakdown, and OS-level network failure reasons). | URL glob pattern matching and response mocking, TLS/SSL Certificate security metadata (issuer, protocol, validity, cipher), Microsecond Network Timing breakdown (DNS, TCP, SSL, send, TTFB, download) |
+| `browser_console` | `vision` | 1-5ms latency access to buffered browser console messages, JS exceptions, and network errors tracked via CDP Runtime.consoleAPICalled. | Buffered console output stream retrieval, Buffer clearance actions, Runtime exception stack capture |
+| `browser_pdf` | `output` | Print the current page to a PDF file via CDP Page.printToPDF with configurable orientation, scale, and page ranges. | Landscape and portrait orientation options, Print scale factor adjustment, Page range subset printing |
+| `browser_eval` | `evaluation` | Run arbitrary JS via CDP in page context via CDP Runtime.evaluate. Supports asynchronous evaluation and structured JSON serialization. | Page JS context execution, Async/await promise resolution, Structured JSON return serialization |
+| `browser_cookies` | `storage_and_cookies` | Manage browser cookies. Full CRUD management for HTTP and document cookies via CDP Network domain. | Cookie property retrieval, setting, and deletion, Domain and path attribute scoping |
+| `browser_canvas` | `canvas_and_visual` | For ALL canvas content (charts, games, graphs). Use get_image to read pixel data as Base64 PNG, draw to simulate programmatic coordinate gesture paths. | Base64 PNG pixel buffer export, Programmatic gesture path drawing, Canvas node targeting via ref ID or selector |
+| `browser_scrape` | `vision` | Sub-5ms latency, zero waste extraction via CSS or XPath selectors in a single CDP evaluation step. Returns structured text/attribute arrays. | CSS and XPath query evaluation, Targeted attribute extraction, Single-step execution (high throughput) |
+| `browser_snapshot` | `vision` | Capture or restore an MHTML snapshot (DOM + inline assets). Facilitates offline state serialization, replay verification, and compliance auditing. | Full DOM and asset stream serialization, Atomic capture and restore operations, Offline state audit capability |
+| `browser_screenshot` | `vision` | 95-135ms capture latency via CDP Page.captureScreenshot. Supports PNG and JPEG formats, full-page rendering, and clip region bounding boxes. | Full-page and viewport bounding box capture, PNG and JPEG format encoding, Custom clip region bounding box support |
+| `browser_viewport` | `device_and_environment` | Set viewport dimensions and device emulation (width, height, DPR, mobile, geolocation, timezone, locale, color scheme). | Viewport width, height, and DPR emulation, Mobile viewport and touch event emulation, Geolocation coordinate override |
+| `browser_clipboard` | `dialog_and_interaction` | Read or write to the system clipboard (plaintext or Base64 image payload data). | Read and write data operations, Plaintext and Base64 image payload format support |
+| `browser_inspect` | `vision` | 15-35ms latency, zero waste. Deep DOM inspection returning computed styles, inline styles, box model dimensions, and attached event listener types. | Computed CSS style property inspection, Event listener type registration enumeration, Box model geometry verification |
+| `browser_extract_design` | `vision` | Extract design tokens (colors, typography, spacing, shadows, CSS variables), semantic HTML layouts, and clean CSS into structured files and an LLM design blueprint. Ideal for cloning websites, UI components, and design systems with 100% pixel fidelity. | CSS custom properties and design token harvesting, Palette extraction and typography hierarchy mapping, Semantic clean DOM extraction with inline SVGs preserved |
+| `browser_automation` | `mission_execution` | Inject self-running background script for monitoring/polling. Inject persistent scripts into the page context for continuous event tracking. | Background script context injection, Named automation script management, Decoupled event monitoring lifecycle |
+| `browser_recording` | `output` | Record video screencasts of browser sessions. Automatically compiles captured frames into animated video files (.webp, .gif, .webm, .mp4) using native Node processing or system ffmpeg. | Native WebP/GIF animation compilation in pure Node, Configurable FPS and frame limits, FFmpeg fallback for WebM/MP4 encoding |
+| `browser_detect` | `tabs` | CRITICAL INITIALIZATION TOOL. Detect available browsers and configured desktop apps (Discord, Slack, etc.). Call this FIRST before interacting with the environment to know if apps are online/offline and what tabs they have open. | Local browser engine discovery, Engine CDP API coverage analysis, Tool compatibility reporting per browser engine |
+| `browser_performance` | `performance` | Retrieve page performance metrics. Collects Core Web Vitals (FCP, LCP, CLS) and detailed network resource timing distributions. | First Contentful Paint (FCP) and Largest Contentful Paint (LCP) capture, Cumulative Layout Shift (CLS) tracking, Resource loading timing distributions |
+| `browser_pattern_learn` | `memory` | Read (action=get), register (action=learn), update, or record execution outcome for a named workflow pattern on a given origin in ~/.weavetab-system/memory/sites/. Use action=get at session start to inspect site profiles and reliability scores. Use learn after completing a flow to persist it for future fast-path replay. | Site profile inspection via action=get (reads ~/.weavetab-system/memory/sites/), Named pattern creation and update (merge-on-write, no duplicates), Volatile selector stabilization before persistence |
+| `browser_github` | `github` | Interact with GitHub repositories without burning browser turns. Analyze repo trees, read raw source files, search/inspect issues, and examine PR diffs and review comments. | Action-based repo analysis, file reading, issues, and PR review, Zero GitHub API token requirement for raw reads, Automated active tab repository context resolution |
+| `browser_office` | `documents` | Read and extract structured content from office documents (Excel, Word, PDF, CSV) via live browser session cookies or local downloads directory. | In-session authenticated document fetching, Structured tabular extraction (.xlsx, .csv), Document text and metadata extraction (.docx, .pdf) |
+| `browser_emulate` | `environment` | Emulate browser environmental conditions over CDP: network throttling profiles, CPU slowdown multipliers, geolocation overrides, timezone IDs, and custom User-Agent strings. | Network throttling (Offline, Slow 3G, Fast 3G, 4G), CPU throttling multipliers, Geolocation and timezone overrides |
+
+---
+
+*Auto-generated via `npm run docs:generate` on 2026-10-17.*

package/docs/architecture/overview.md

@@ -15,7 +15,7 @@ Weavetab is decomposed into **five functional layers**, all running in-process w
 
 | # | Layer | Responsibility |
 |---|---|---|
-| 1 | **Transport** | JSON-RPC 2.0 over stdio or WebSocket (`--ws --port 3000`) |
+| 1 | **Transport** | JSON-RPC 2.0 over stdio (default) or WebSocket (`--ws --port 3000`) |
 | 2 | **Security & Governance** | Domain blacklist, rate limiter (mutex), RBAC roles, policy engine, root guard |
 | 3 | **Intelligence Engine** | Session memory, semantic delta diffing, DOM pruner, loop detection, intent intercept |
 | 4 | **Sensor Systems** | Network telemetry, DOM mutation observer, human pacing, agent state machine |

package/docs/architecture/security.md

@@ -19,7 +19,7 @@ Weavetab executes direct Layer 0 CDP commands — security is layered and **deny
 | **Domain Policy Engine** | Per-domain enforcement modes: `allow`, `read-only`, `deny`, `audit`. |
 | **Localhost Binding** | WebSocket server and CDP endpoints strictly bound to `127.0.0.1`. |
 | **Rate Limiting** | Mutex-enforced actions-per-minute rate limiter. |
-| **RBAC Roles** | 4 strict roles gating tool access (`admin`, `operator`, `viewer`, `automation`). |
+| **RBAC Roles** | 5 roles gating tool access (`admin`, `operator`, `viewer`, `automation`, `system`). |
 | **Root Guard** | Prevents execution as root/superuser on Unix systems. |
 | **Blind Injection** | Credential injection from `secrets.json` without exposing raw text to LLM context. |
 | **Shadow DOM Isolation** | All injected HUD and modal overlays run in isolated Shadow DOM trees. |
@@ -27,9 +27,10 @@ Weavetab executes direct Layer 0 CDP commands — security is layered and **deny
 
 ## RBAC Role Matrix
 
-| Tool Category | admin | operator | viewer | automation |
-|---|:---:|:---:|:---:|:---:|
-| Mutation tools (`click`, `type`, `fill`, etc.) | yes | yes | no | yes |
-| Read-only tools (`map`, `find`, `scrape`, `screenshot`) | yes | yes | yes | yes |
-| High-level orchestration (`burst`, `plan`, `wait`) | yes | yes | no | yes |
-| System management (`detect`, `reset_loop_counter`) | yes | no | no | no |
+| Tool Category | admin | operator | viewer | automation | system |
+|---|:---:|:---:|:---:|:---:|:---:|
+| Mutation tools (`click`, `type`, `fill`, etc.) | yes | yes | no | yes | no |
+| Read-only tools (`map`, `find`, `scrape`, `screenshot`) | yes | yes | yes | yes | no |
+| High-level orchestration (`burst`, `automation`, `wait`) | yes | yes | no | yes | no |
+| Interactive HUD (`thoughts`) | yes | yes | no | no | yes |
+| System introspection (`detect`, `performance`, `checkpoint`) | yes | yes | no | yes | yes |

package/docs/architecture/transport.md

@@ -12,7 +12,7 @@ slug: transport
 | Mode | Flag | Protocol | Use Case |
 |---|---|---|---|
 | **stdio** | *(default)* | JSON-RPC 2.0 / stdio | Claude Desktop, Cursor, VS Code Copilot, Antigravity |
-| **WebSocket** | `--ws` | JSON-RPC 2.0 / WebSocket | Custom agents, Python/Go backends, remote daemons, n8n |
+| **WebSocket** | `--ws [--port N]` | JSON-RPC 2.0 / WebSocket | Custom agents, Python/Go backends, remote daemons, n8n |
 
 ## stdio (Default)
 
@@ -34,4 +34,4 @@ The MCP client spawns Weavetab as a child process and pipes messages over stdin/
 weavetab --ws --port 3000
 ```
 
-WebSocket mode binds strictly to `127.0.0.1` for local security. Front it with your own TLS/auth layer if exposing across a private network.
+Starts the daemon on `127.0.0.1:3000` (override with `--port <n>` / `--port=<n>`). The daemon binds strictly to loopback for local security — front it with your own TLS/auth layer if exposing across a private network.

package/docs/cli/cli-commands.md

@@ -14,10 +14,14 @@ slug: cli-commands
 | Command | Description |
 |---|---|
 | `weavetab` | Start the MCP server (stdio mode — default for MCP clients). When run in a TTY without arguments, launches the interactive UI menu. |
-| `weavetab config` | Launch the 5-phase interactive configuration wizard. |
+| `weavetab --ws [--port N]` | Start the WebSocket daemon on `127.0.0.1` (default port `3000`). |
+| `weavetab --version` | Print version and exit. |
+| `weavetab config` | Launch the 6-phase interactive configuration wizard. |
 | `weavetab view` | Display the current active configuration report. Press **[R]** to view raw JSON, **[Q]** to quit. |
 | `weavetab reset` | Purge browser profiles, lockfiles, mutexes, session registries, and kill orphan browser processes. Accepts `--yes`/`-y` to skip confirmation prompts. |
 | `weavetab reload-ext` | Send a reload signal to the Weavetab browser extension via CDP `Runtime.evaluate`. |
+| `weavetab plugin <add\|browse\|search\|list\|remove\|verify>` | Manage plugins — see `weavetab plugin --help`. |
+| `weavetab skills [options]` | Install or update AI agent skills (passthrough to `@weavetab/skills`). |
 | `weavetab help` / `--help` | Show full CLI help message with all commands, flags, and environment variables. |
 
 ## Secrets Management
@@ -39,6 +43,8 @@ When run without arguments in a TTY terminal, Weavetab opens an interactive keyb
 |---|---|
 | `[C]` | Launch the configuration wizard |
 | `[V]` | View current active configuration |
+| `[P]` | List installed Weavetab plugins |
 | `[R]` | Purge browser profiles and lockfiles |
 | `[H]` | Show help information |
+| `[G]` / `[N]` / `[W]` | Open GitHub / npm / website links |
 | `[Q]` | Exit Weavetab |

package/docs/cli/cli-flags.md

@@ -1,6 +1,6 @@
 ---
 title: "Flags"
-description: "Global flags accepted by the server."
+description: "Global flags accepted by the CLI."
 product: mcp
 section: cli
 icon: Flag
@@ -9,12 +9,20 @@ slug: cli-flags
 
 # Flags
 
+Only these flags are parsed by the CLI (`MCP/src/index.ts`). Anything else is ignored.
+
 | Flag | Type | Description |
 |---|---|---|
-| `--version` | boolean | Print CLI version and exit |
 | `--help` / `-h` | boolean | Show help message and exit |
-| `--ws` | boolean | Start server in WebSocket mode instead of stdio |
-| `--port <port>` | number | Port for WebSocket server (default `3000`) |
-| `--headless` | boolean | Run browser in headless mode |
-| `--role <role>` | enum | Override RBAC role (`admin`, `operator`, `viewer`, `automation`) |
-| `--yes` / `-y` | boolean | Skip confirmation prompt when running `weavetab reset` |
+| `help` | command | Show help message and exit |
+| `--version` / `-v` | boolean | Print version and exit |
+| `--ws` | boolean | Start the WebSocket daemon instead of stdio |
+| `--port <port>` / `--port=<port>` | number | Port for the WebSocket daemon (default `3000`) |
+| `--yes` / `-y` | boolean | Skip confirmation prompt when running `weavetab reset` / `reload` |
+| `--official` / `-O` | boolean | Prefer the official `@weavetab/plugin-<name>` candidate (`plugin add`) |
+| `--community` / `-C` | boolean | Prefer the community package candidate (`plugin add`) |
+| `--refresh` | boolean | Invalidate and refresh the verified plugin cache (`plugin`) |
+| `--project` | boolean | Project-scoped secrets file (`secrets init --project`) |
+
+Notes:
+- There are no `--headless` / `--role` CLI flags. Browser headless mode and RBAC role come from `~/.weavetab/config.json` (`weavetab config` / `weavetab view`). The wizard offers `admin` / `operator` / `viewer` / `automation`.

package/docs/cli/cli-scripting.md

@@ -18,8 +18,11 @@ weavetab reset --yes
 # List stored secrets
 weavetab secrets list
 
-# Start the MCP server in WebSocket mode for custom scripts
-weavetab --ws --port 3000 --headless &
+# List installed plugins
+weavetab plugin list
+
+# Start the MCP server in WebSocket daemon mode for custom scripts
+weavetab --ws --port 3000 &
 ```
 
 ## CI/CD Pipeline
@@ -28,5 +31,5 @@ weavetab --ws --port 3000 --headless &
 # In GitHub Actions or Docker CI
 npm install -g @weavetab/mcp
 weavetab reset --yes
-weavetab --ws --port 3000 --headless &
+weavetab --ws --port 3000 &
 ```

package/docs/configuration/config-locations.md

@@ -1,6 +1,6 @@
 ---
 title: "Locations & Merge"
-description: "Three-tier merge: local → global → built-in defaults."
+description: "Two-tier merge: global config → built-in defaults."
 product: mcp
 section: configuration
 icon: FolderTree
@@ -11,9 +11,8 @@ slug: config-locations
 
 ## Priority Tiers
 
-1. **Local (Project-scoped)** — `./.weavetab/config.json` (takes top priority)
-2. **Global** — `~/.weavetab/config.json`
-3. **Built-in defaults** — defined in `DEFAULT_CONFIG`
+1. **Global** — `~/.weavetab/config.json` (the only config file Weavetab reads)
+2. **Built-in defaults** — defined in `DEFAULT_CONFIG`
 
 ## Live Reload
 

package/docs/configuration/env-variables.md

@@ -9,11 +9,11 @@ slug: env-variables
 
 # Environment Variables
 
+Only these two are read at runtime (`MCP/src/config/loader.ts`). Everything else
+(browser path, role, headless, dev mode) lives in `~/.weavetab/config.json`
+— run `weavetab config` to change it.
+
 | Variable | Description |
 |---|---|
-| `CHROME_PATH` | Absolute path to Chromium/Chrome binary |
-| `WEAVETAB_CONFIG` | Path to a custom config file |
-| `WEAVETAB_ROLE` | Override RBAC role at runtime (`admin`, `operator`, `viewer`, `automation`) |
-| `WEAVETAB_DEV` | Set to `1` to enable verbose CDP dev logging |
 | `WT_AGENT_ID` | Override the auto-generated agent UUID |
 | `WT_PROXY_URL` | Set outbound HTTP/SOCKS proxy server URL |

package/docs/desktop-automation/electron-apps.md

@@ -31,18 +31,15 @@ AI Agent (MCP) ──► withSecurity()
 
 ---
 
-## Interactive App Configurator & Agent Generator
+## Interactive App Configurator
 
-Use the interactive configurator below to customize your desktop applications. Select presets or add custom apps, toggle between executable path strings, remote debug ports, or advanced objects, and copy the ready-to-use JSON or an automated setup prompt for your AI coding agent:
-
-```electron-configurator
-```
+Build your `electron` block in the [Desktop app configurator](/mcp/desktop) — presets for Discord, VS Code, Figma, Slack and more, path / port / advanced formats, plus a copy-ready agent setup prompt. Then paste the block into your global `~/.weavetab/config.json`.
 
 ---
 
 ## 1. Configuring Desktop Apps in `config.json`
 
-Add an `"electron"` object to your local `./.weavetab/config.json` or global `~/.weavetab/config.json`:
+Add an `"electron"` object to your global `~/.weavetab/config.json` (the only config file Weavetab reads):
 
 ```json
 {

package/docs/get-started/introduction.md

@@ -43,11 +43,11 @@ npm install -D @weavetab/sdk@latest
 
 ## What You Get
 
-- **49 built-in MCP tools** covering DOM vision, input synthesis, desktop apps, tabs, network interception, office files, design extraction, and plugin lifecycle
+- **44 built-in MCP tools** covering DOM vision, input synthesis, desktop apps, tabs, network interception, office files, design extraction, and plugin lifecycle
 - **Universal Desktop App Runtime** — control Chrome and native Electron apps (Discord, Figma, VS Code) side-by-side without port conflicts
 - **Autonomous Zero-API CAPTCHA Solver** — solve Cloudflare Turnstile, GeeTest, and reCAPTCHA locally via CDP mouse physics with $0 API costs
-- **Two transport modes** — stdio (Claude Desktop, Cursor, VS Code, Windsurf, Antigravity) and WebSocket (`--ws --port 3000`)
-- **Four RBAC roles** — `admin`, `operator`, `viewer`, and `automation`
+- **Two transport modes** — stdio (Claude Desktop, Cursor, VS Code, Windsurf, Antigravity) and WebSocket (`weavetab --ws --port 3000`)
+- **Five RBAC roles** — `admin`, `operator`, `viewer`, `automation`, and `system`
 - **Per-domain policies** — ring-fences sensitive banking, internal, and production surfaces
 - **Blind Injection** — credentials resolved server-side from `secrets.json` and never exposed to the LLM
 - **Extensible Plugin System** — auto-discovers and mounts custom MCP tools from `node_modules`
@@ -57,4 +57,4 @@ npm install -D @weavetab/sdk@latest
 - **[Quickstart](quickstart.md)** — install and run a first mission in 60 seconds
 - **[Desktop & Electron Apps](../desktop-automation/electron-apps.md)** — configure and control desktop apps
 - **[Autonomous CAPTCHA Solver](../captcha-stealth/captcha-solver.md)** — zero-API anti-bot solving
-- **[MCP Tools Reference](../tools/tools.md)** — full reference for all 49 built-in automation tools
+- **[MCP Tools Reference](../tools/tools.md)** — full reference for all 44 built-in automation tools

package/docs/get-started/setup-wizard.md

@@ -15,12 +15,13 @@ Run the interactive CLI configuration wizard:
 weavetab config
 ```
 
-The wizard walks through every option across 5 interactive phases. Re-run it at any time to update your saved config.
+The wizard walks through every option across 6 interactive phases. Re-run it at any time to update your saved config.
 
 ## Wizard Phases
 
-1. **Phase 1 — Essentials:** Browser path, RBAC role (`admin`, `operator`, `viewer`, `automation`), headless mode, dev mode, max tabs, actionability timeout, domain block/allow lists.
-2. **Phase 2 — Advanced:** Browser engine selection, navigation timeouts, dark mode preferences, telemetry opt-in, outbound HTTP/SOCKS proxy, domain policy modes.
-3. **Phase 3 — Save Location:** Global (`~/.weavetab/config.json`) or Project-scoped (`./.weavetab/config.json`).
-4. **Phase 4 — MCP Auto-Config:** Auto-detects installed IDEs (Claude Desktop, Cursor, Windsurf, VS Code, OpenCode, Claude Code, Antigravity) and merges Weavetab into their MCP configuration.
-5. **Phase 5 — Summary:** Displays full configuration validation report.
+1. **Phase 1 — Essentials:** Browser path, RBAC role (`admin`, `viewer`, `automation`), headless mode, dev mode, max tabs, actionability timeout, domain block/allow lists.
+2. **Phase 2 — Advanced (optional):** Browser engine selection, timeouts and rate limits, telemetry opt-in, download/proxy directories, domain policy entries.
+3. **Phase 3 — Save Location:** Global (`~/.weavetab/config.json`).
+4. **Phase 4 — MCP Auto-Config:** Auto-detects installed IDEs (Claude Desktop, Cursor, Windsurf) and merges Weavetab into their MCP configuration.
+5. **Phase 5 — Agent Skills:** Optionally installs `@weavetab/skills` for your agent framework.
+6. **Phase 6 — Summary:** Displays full configuration validation report.

package/docs/tools/tools.md

@@ -9,7 +9,7 @@ slug: tools
 
 # MCP Tools Master Reference
 
-Weavetab exposes **49 production-grade MCP tools** engineered for sub-10ms browser automation, visual inspection, desktop app orchestration, zero-API CAPTCHA solving, and human-like interaction.
+Weavetab exposes **44 production-grade MCP tools** engineered for sub-10ms browser automation, visual inspection, desktop app orchestration, zero-API CAPTCHA solving, and human-like interaction.
 
 Every tool adheres to a strict contract:
 - **Zod schema validation** for all runtime arguments

package/docs/troubleshooting/trouble-browser.md

@@ -24,4 +24,4 @@ slug: trouble-browser
 
 **Fixes:**
 1. Run `weavetab reset` to purge corrupted profiles
-2. Check `CHROME_PATH` environment variable points to a valid Chromium executable
+2. Run `weavetab config` and set the browser executable path (or `browserPath: "auto"` to detect)