@weavetab/skills 2.5.0-beta.4 → 2.5.0-beta.5

package/dist/bundled/weavetab-plugins.md

@@ -1,10 +1,10 @@
-# Weavetab Domain Profile: PLUGINS
-
-Generated for @weavetab/skills v2.5.0-beta.4
-
-
-## hooks-and-overrides
-
+# Weavetab Domain Profile: PLUGINS
+
+Generated for @weavetab/skills v2.5.0-beta.5
+
+
+## hooks-and-overrides
+
 # Plugin Hooks & Lifecycle Overrides
 
 Plugins built with `@weavetab/sdk` register lifecycle hooks that run before and after tool executions. Understanding these hooks helps agents interpret metadata and custom tool responses.
@@ -26,53 +26,58 @@ Plugins built with `@weavetab/sdk` register lifecycle hooks that run before and
 
 ## 2. Agent Operational Awareness
 
-When plugins are active, tool return payloads may include an optional `_pluginMetadata` object containing trace IDs, custom metrics, or security audit timestamps. Agents should treat this object as informational telemetry.
-
-
-## plugin-runtime
-
-# Plugin Runtime: Dynamic Extension Loading
-
-Weavetab features an extensible plugin architecture powered by `@weavetab/sdk`. Agents can query loaded extensions and dynamically load community or official plugins into the live MCP runtime without restarting the server.
-
----
-
-## 1. Inspecting Active Plugins (`list_plugins`)
-
-Discover all installed plugins, their versions, and the tools or hooks they expose:
-
-```json
-{}
-```
-
-### Response Example:
-```json
-{
-  "plugins": [
-    {
-      "name": "@weavetab/plugin-recaptcha-solver",
-      "version": "1.2.0",
-      "status": "active",
-      "toolsProvided": ["captcha_solve_token"],
-      "hooks": ["beforeToolCall"]
-    }
-  ]
-}
-```
-
----
-
-## 2. Dynamic Runtime Loading (`load_plugin`)
-
-Load a verified plugin package into the active runtime session:
-
-```json
-{
-  "name": "@weavetab/plugin-datadog-tracer"
-}
-```
-
-### Plugin Verification Guarantees:
-- Plugins must implement the `@weavetab/sdk` standard interface.
-- Loaded tools become immediately callable by the agent in subsequent turns.
-- If an agent is in the `viewer` RBAC tier, `load_plugin` is rejected with `PERMISSION_DENIED`.
+When plugins are active, tool return payloads may include an optional `_pluginMetadata` object containing trace IDs, custom metrics, or security audit timestamps. Agents should treat this object as informational telemetry.
+
+
+## plugin-runtime
+
+# Plugin Runtime: Weavetab Plugin Architecture
+
+Weavetab features an extensible plugin architecture powered by `@weavetab/sdk`. All installed plugins are loaded automatically at server startup — their tools appear directly in the MCP tool list alongside built-in tools. Agents never need to discover or activate plugins manually.
+
+---
+
+## 1. How Plugin Tools Appear
+
+Plugin tools are first-class MCP tools. If `@weavetab/plugin-recaptcha-solver` is installed, `captcha_solve_token` appears in the tool list immediately on startup — no discovery step needed.
+
+There are **no** `list_plugins` or `load_plugin` tools. Managing plugins is a CLI operation:
+
+```bash
+# Install a plugin (restart required)
+weavetab plugin add @weavetab/plugin-youtube
+
+# Remove a plugin
+weavetab plugin rm @weavetab/plugin-youtube
+
+# List installed plugins
+weavetab plugin list
+```
+
+---
+
+## 2. Plugin Permission Model
+
+Every plugin declares what it can do in `weavetab.json`. The runtime enforces this at load time:
+
+| Permission | What it gates |
+|---|---|
+| `tools.add: true` | Plugin can register new MCP tools |
+| `tools.override: ["browser_navigate"]` | Plugin can wrap/replace that built-in tool |
+| `tools.remove: ["browser_pdf"]` | Plugin can disable that built-in tool |
+| `hooks.onBeforeAction: true` | Plugin can intercept all tool calls before execution |
+| `hooks.onAfterAction: true` | Plugin can inspect/transform all tool results |
+
+Plugins that attempt to exceed their declared permissions are blocked with a stderr warning — they do not crash.
+
+---
+
+## 3. Trust Tiers
+
+| Tier | Badge | Condition |
+|---|---|---|
+| Official | `✚ [Official]` | `@weavetab/plugin-*` packages |
+| Verified | `✔ [Verified]` | Listed in the Weavetab verified registry |
+| Unverified | `⚠ [Unverified]` | Unknown community package |
+
+Unverified plugins are loaded but their permissions are logged visibly at startup for user review.

package/dist/bundled/weavetab-resilience.md

@@ -1,10 +1,10 @@
-# Weavetab Domain Profile: RESILIENCE
-
-Generated for @weavetab/skills v2.5.0-beta.4
-
-
-## loop-breaker
-
+# Weavetab Domain Profile: RESILIENCE
+
+Generated for @weavetab/skills v2.5.0-beta.5
+
+
+## loop-breaker
+
 # Loop Breaker & CAPTCHA Escalation Protocol
 
 Agents can get trapped in repetitive click loops when a button does not advance the state (e.g. failing silent validation, unhandled reCAPTCHA challenges, or modals swallowing events). Weavetab actively monitors repetitive patterns and provides circuit breakers.
@@ -54,11 +54,11 @@ Invoke `browser_captcha` to analyze and manage the challenge:
 
 ### Action Strategy:
 1. If the challenge is interactive and requires human intervention (e.g. image classification), inform the user cleanly or request human bypass.
-2. If the challenge is a simple checkbox Turnstile widget, pass `"action": "solve"` or click the detected widget ref with `browser_click`.
-
-
-## session-time-travel
-
+2. If the challenge is a simple checkbox Turnstile widget, pass `"action": "solve"` or click the detected widget ref with `browser_click`.
+
+
+## session-time-travel
+
 # Session Time-Travel & Instant State Rollback
 
 In complex multi-step workflows (e.g. checkout funnels, multi-page configuration wizards, onboarding questionnaires), an error at Step 7 traditionally forces an agent to reload the root URL, re-authenticate, and waste 10+ turns repeating steps.
@@ -172,11 +172,11 @@ Query or clear `localStorage` and `sessionStorage` keys:
   "action": "get",
   "key": "authToken"
 }
-```
-
-
-## stale-ref-recovery
-
+```
+
+
+## stale-ref-recovery
+
 # Stale Ref Recovery & SPA Hydration Resilience
 
 In modern Single Page Applications (built with React, Next.js, Vue, Nuxt, Svelte), DOM nodes are frequently destroyed and recreated during client-side hydration or reactive state updates. This often causes `STALE_ELEMENT_REFERENCE` or `NODE_DETACHED` errors when an agent attempts an action.
@@ -213,4 +213,4 @@ If an action returns `ERROR: STALE_ELEMENT_REFERENCE` because all 4 recovery tie
 
 1. **Do NOT Repeat the Identical Call**: Retrying the exact same stale `ref` (`w:14`) will fail again.
 2. **Execute a Fast Targeted Lookup**: Run `browser_find` with the text of the button or input field.
-3. **Execute the Action on the New Handle**: Use the updated handle returned by `browser_find`.
+3. **Execute the Action on the New Handle**: Use the updated handle returned by `browser_find`.

package/dist/bundled/weavetab-security.md

@@ -1,10 +1,10 @@
-# Weavetab Domain Profile: SECURITY
-
-Generated for @weavetab/skills v2.5.0-beta.4
-
-
-## rbac-and-policies
-
+# Weavetab Domain Profile: SECURITY
+
+Generated for @weavetab/skills v2.5.0-beta.5
+
+
+## rbac-and-policies
+
 # Role-Based Access Control (RBAC) & Agent Guardrails
 
 Weavetab allows developers to run untrusted or lower-privilege subagents within strict security boundaries to prevent accidental destructive operations or data leaks.
@@ -35,11 +35,11 @@ If an agent attempts an action outside its allocated role tier:
 ### Protocol:
 1. Do not retry the denied tool.
 2. Delegate the interactive action to the parent agent or primary operator.
-3. Limit your output to findings gathered via read-only tools (`browser_scrape`, `browser_map`, `browser_inspect`).
-
-
-## secret-containment-protocol
-
+3. Limit your output to findings gathered via read-only tools (`browser_scrape`, `browser_map`, `browser_inspect`).
+
+
+## secret-containment-protocol
+
 # Secret Containment Protocol & Zero-Bleed Execution
 
 AI agent transcripts, LLM providers, and tool logs represent massive attack surfaces for credential leaks. Weavetab enforces a hardware-grade **Zero-Bleed Security Guarantee** for sensitive inputs.
@@ -84,4 +84,4 @@ When `browser_type_secret` is invoked:
 > - `browser_fill`
 > - `browser_eval`
 > 
-> Doing so causes plaintext secrets to enter unmasked transcripts and tool logs.
+> Doing so causes plaintext secrets to enter unmasked transcripts and tool logs.

package/dist/granular/browser_dom-strategy.md

@@ -14,7 +14,7 @@ tools:
   - "browser_scrape"
   - "browser_snapshot"
   - "browser_eval"
-weavetab: ">=2.5.0-beta.4"
+weavetab: ">=2.5.0-beta.5"
 ---
 
 # DOM Strategy & Token Conservation Engine

package/dist/granular/browser_form-automation.md

@@ -11,7 +11,7 @@ triggers:
 tools:
   - "browser_fill"
   - "browser_select"
-weavetab: ">=2.5.0-beta.4"
+weavetab: ">=2.5.0-beta.5"
 ---
 
 # Form Automation: Atomic Multi-Field Execution

package/dist/granular/browser_interaction-pipeline.md

@@ -19,7 +19,7 @@ tools:
   - "browser_burst"
   - "browser_highlight"
   - "browser_clipboard"
-weavetab: ">=2.5.0-beta.4"
+weavetab: ">=2.5.0-beta.5"
 ---
 
 # Interaction Pipeline: Physical & Synthetic Input Engine

package/dist/granular/browser_tab-and-window.md

@@ -11,7 +11,7 @@ triggers:
   - "desktop app tabs"
 tools:
   - "browser_tabs"
-weavetab: ">=2.5.0-beta.4"
+weavetab: ">=2.5.0-beta.5"
 ---
 
 # Tab & Window Lifecycle Management

package/dist/granular/desktop_desktop-targeting.md

@@ -15,7 +15,7 @@ tools:
   - "browser_detect"
   - "browser_tabs"
   - "browser_navigate"
-weavetab: ">=2.5.0-beta.4"
+weavetab: ">=2.5.0-beta.5"
 ---
 
 # Desktop App Targeting & Multi-Window Routing

package/dist/granular/desktop_electron-discovery.md

@@ -10,7 +10,7 @@ triggers:
   - "electron automation"
 tools:
   - "browser_detect"
-weavetab: ">=2.5.0-beta.4"
+weavetab: ">=2.5.0-beta.5"
 ---
 
 # Electron Discovery & Environment Handshake

package/dist/granular/developer_github-forensics.md

@@ -9,7 +9,7 @@ triggers:
   - "inspect repo"
 tools:
   - "browser_github"
-weavetab: ">=2.5.0-beta.4"
+weavetab: ">=2.5.0-beta.5"
 ---
 
 # GitHub Forensics & Repository Architecture Inspection

package/dist/granular/documents_canvas-and-visual-capture.md

@@ -15,7 +15,7 @@ tools:
   - "browser_extract_design"
   - "browser_map"
   - "browser_click"
-weavetab: ">=2.5.0-beta.4"
+weavetab: ">=2.5.0-beta.5"
 ---
 
 # Visual Capture, Canvas Forensics & Design Extraction

package/dist/granular/documents_office-document-ingestion.md

@@ -10,7 +10,7 @@ triggers:
   - "parse table"
 tools:
   - "browser_office"
-weavetab: ">=2.5.0-beta.4"
+weavetab: ">=2.5.0-beta.5"
 ---
 
 # Office Document Ingestion: Word, Excel & CSV Parsing

package/dist/granular/memory_selector-memory-system.md

@@ -15,7 +15,7 @@ tools:
   - "browser_click"
   - "browser_fill"
   - "browser_pattern_learn"
-weavetab: ">=2.5.0-beta.4"
+weavetab: ">=2.5.0-beta.5"
 ---
 
 # Two-Tier Memory System

package/dist/granular/memory_session-trail.md

@@ -12,7 +12,7 @@ tools:
   - "browser_recording"
   - "browser_automation"
   - "browser_thoughts"
-weavetab: ">=2.5.0-beta.4"
+weavetab: ">=2.5.0-beta.5"
 ---
 
 # Session Trails & Deterministic Macro Compilation
@@ -49,7 +49,7 @@ Or pass `dry_run: true` to inspect the compiled macro steps before running them:
   "success": true,
   "steps_completed": 0,
   "compiled_steps": [
-    { "tool": "browser_go", "args": { "url": "https://analytics.example.com" } },
+    { "tool": "browser_navigate", "args": { "url": "https://analytics.example.com" } },
     { "tool": "browser_fill", "args": { "ref": "w:12", "value": "metrics" } },
     { "tool": "click_and_wait", "args": { "ref": "w:15" } }
   ],

package/dist/granular/memory_site-learning.md

@@ -14,7 +14,7 @@ triggers:
 tools:
   - "browser_pattern_learn"
   - "browser_burst"
-weavetab: ">=2.5.0-beta.4"
+weavetab: ">=2.5.0-beta.5"
 ---
 
 # Site Learning — Autonomous Workflow Memory

package/dist/granular/network-and-perf_device-and-environment.md

@@ -10,7 +10,7 @@ triggers:
   - "responsive testing"
 tools:
   - "browser_emulate"
-weavetab: ">=2.5.0-beta.4"
+weavetab: ">=2.5.0-beta.5"
 ---
 
 # Device Emulation & Environment Simulation

package/dist/granular/network-and-perf_network-intercept-and-mock.md

@@ -10,7 +10,7 @@ triggers:
   - "network waterfall"
 tools:
   - "browser_network_intercept"
-weavetab: ">=2.5.0-beta.4"
+weavetab: ">=2.5.0-beta.5"
 ---
 
 # Network Interception, Mocking & TLS Forensics
@@ -61,7 +61,7 @@ Extract cryptographic handshake metadata, cipher suites, expiration dates, and m
 ```json
 {
   "action": "auditTls",
-  "url": "https://weavetab.pages.dev"
+  "url": "https://weavetab.dev"
 }
 ```
 

package/dist/granular/network-and-perf_performance-and-vitals.md

@@ -12,7 +12,7 @@ triggers:
 tools:
   - "browser_performance"
   - "browser_wait"
-weavetab: ">=2.5.0-beta.4"
+weavetab: ">=2.5.0-beta.5"
 ---
 
 # Performance Forensics & Core Web Vitals

package/dist/granular/plugins_hooks-and-overrides.md

@@ -7,9 +7,8 @@ triggers:
   - "after tool call"
   - "telemetry interception"
   - "sdk hooks"
-tools:
-  - "list_plugins"
-weavetab: ">=2.5.0-beta.4"
+tools: []
+weavetab: ">=2.5.0-beta.5"
 ---
 
 # Plugin Hooks & Lifecycle Overrides

package/dist/granular/plugins_plugin-runtime.md

@@ -1,60 +1,63 @@
----
-id: plugin-runtime
-domain: plugins
-triggers:
-  - "list plugins"
-  - "load plugin"
-  - "install plugin"
-  - "weavetab plugin"
-  - "extend mcp"
-tools:
-  - "list_plugins"
-  - "load_plugin"
-weavetab: ">=2.5.0-beta.4"
----
-
-# Plugin Runtime: Dynamic Extension Loading
-
-Weavetab features an extensible plugin architecture powered by `@weavetab/sdk`. Agents can query loaded extensions and dynamically load community or official plugins into the live MCP runtime without restarting the server.
-
----
-
-## 1. Inspecting Active Plugins (`list_plugins`)
-
-Discover all installed plugins, their versions, and the tools or hooks they expose:
-
-```json
-{}
-```
-
-### Response Example:
-```json
-{
-  "plugins": [
-    {
-      "name": "@weavetab/plugin-recaptcha-solver",
-      "version": "1.2.0",
-      "status": "active",
-      "toolsProvided": ["captcha_solve_token"],
-      "hooks": ["beforeToolCall"]
-    }
-  ]
-}
-```
-
----
-
-## 2. Dynamic Runtime Loading (`load_plugin`)
-
-Load a verified plugin package into the active runtime session:
-
-```json
-{
-  "name": "@weavetab/plugin-datadog-tracer"
-}
-```
-
-### Plugin Verification Guarantees:
-- Plugins must implement the `@weavetab/sdk` standard interface.
-- Loaded tools become immediately callable by the agent in subsequent turns.
-- If an agent is in the `viewer` RBAC tier, `load_plugin` is rejected with `PERMISSION_DENIED`.
+---
+id: plugin-runtime
+domain: plugins
+triggers:
+  - "what plugins are installed"
+  - "weavetab plugin"
+  - "extend mcp"
+  - "plugin tools"
+  - "plugin permissions"
+tools: []
+weavetab: ">=2.5.0-beta.5"
+---
+
+# Plugin Runtime: Weavetab Plugin Architecture
+
+Weavetab features an extensible plugin architecture powered by `@weavetab/sdk`. All installed plugins are loaded automatically at server startup — their tools appear directly in the MCP tool list alongside built-in tools. Agents never need to discover or activate plugins manually.
+
+---
+
+## 1. How Plugin Tools Appear
+
+Plugin tools are first-class MCP tools. If `@weavetab/plugin-recaptcha-solver` is installed, `captcha_solve_token` appears in the tool list immediately on startup — no discovery step needed.
+
+There are **no** `list_plugins` or `load_plugin` tools. Managing plugins is a CLI operation:
+
+```bash
+# Install a plugin (restart required)
+weavetab plugin add @weavetab/plugin-youtube
+
+# Remove a plugin
+weavetab plugin rm @weavetab/plugin-youtube
+
+# List installed plugins
+weavetab plugin list
+```
+
+---
+
+## 2. Plugin Permission Model
+
+Every plugin declares what it can do in `weavetab.json`. The runtime enforces this at load time:
+
+| Permission | What it gates |
+|---|---|
+| `tools.add: true` | Plugin can register new MCP tools |
+| `tools.override: ["browser_navigate"]` | Plugin can wrap/replace that built-in tool |
+| `tools.remove: ["browser_pdf"]` | Plugin can disable that built-in tool |
+| `hooks.onBeforeAction: true` | Plugin can intercept all tool calls before execution |
+| `hooks.onAfterAction: true` | Plugin can inspect/transform all tool results |
+
+Plugins that attempt to exceed their declared permissions are blocked with a stderr warning — they do not crash.
+
+---
+
+## 3. Trust Tiers
+
+| Tier | Badge | Condition |
+|---|---|---|
+| Official | `✚ [Official]` | `@weavetab/plugin-*` packages |
+| Verified | `✔ [Verified]` | Listed in the Weavetab verified registry |
+| Unverified | `⚠ [Unverified]` | Unknown community package |
+
+Unverified plugins are loaded but their permissions are logged visibly at startup for user review.

package/dist/granular/resilience_loop-breaker.md

@@ -12,7 +12,7 @@ tools:
   - "browser_map"
   - "browser_console"
   - "browser_captcha"
-weavetab: ">=2.5.0-beta.4"
+weavetab: ">=2.5.0-beta.5"
 ---
 
 # Loop Breaker & CAPTCHA Escalation Protocol

package/dist/granular/resilience_session-time-travel.md

@@ -11,7 +11,7 @@ tools:
   - "browser_checkpoint"
   - "browser_cookies"
   - "browser_storage"
-weavetab: ">=2.5.0-beta.4"
+weavetab: ">=2.5.0-beta.5"
 ---
 
 # Session Time-Travel & Instant State Rollback

package/dist/granular/resilience_stale-ref-recovery.md

@@ -11,7 +11,7 @@ tools:
   - "browser_find"
   - "browser_map"
   - "browser_click"
-weavetab: ">=2.5.0-beta.4"
+weavetab: ">=2.5.0-beta.5"
 ---
 
 # Stale Ref Recovery & SPA Hydration Resilience

package/dist/granular/security_rbac-and-policies.md

@@ -11,7 +11,7 @@ tools:
   - "browser_inspect"
   - "browser_scrape"
   - "browser_map"
-weavetab: ">=2.5.0-beta.4"
+weavetab: ">=2.5.0-beta.5"
 ---
 
 # Role-Based Access Control (RBAC) & Agent Guardrails

package/dist/granular/security_secret-containment-protocol.md

@@ -9,7 +9,7 @@ triggers:
   - "secret containment"
 tools:
   - "browser_type_secret"
-weavetab: ">=2.5.0-beta.4"
+weavetab: ">=2.5.0-beta.5"
 ---
 
 # Secret Containment Protocol & Zero-Bleed Execution

package/documents/canvas-and-visual-capture.md

@@ -15,7 +15,7 @@ tools:
   - "browser_extract_design"
   - "browser_map"
   - "browser_click"
-weavetab: ">=2.5.0-beta.4"
+weavetab: ">=2.5.0-beta.5"
 ---
 
 # Visual Capture, Canvas Forensics & Design Extraction

package/documents/office-document-ingestion.md

@@ -10,7 +10,7 @@ triggers:
   - "parse table"
 tools:
   - "browser_office"
-weavetab: ">=2.5.0-beta.4"
+weavetab: ">=2.5.0-beta.5"
 ---
 
 # Office Document Ingestion: Word, Excel & CSV Parsing

package/evals/evaluator.js

@@ -16,8 +16,8 @@ const OFFICIAL_TOOLS = new Set([
   "browser_screenshot", "browser_viewport", "browser_clipboard", "browser_inspect",
   "browser_extract_design", "browser_automation", "browser_recording",
   "browser_detect", "browser_performance",
-  "browser_github", "browser_office", "browser_emulate", "list_plugins",
-  "load_plugin", "browser_checkpoint", "browser_pattern_learn"
+  "browser_github", "browser_office", "browser_emulate",
+  "browser_checkpoint", "browser_pattern_learn"
 ]);
 
 const BANNED_TOOLS = [