@weavetab/skills 2.5.0 → 2.5.2

package/memory/site-learning.md

@@ -19,7 +19,9 @@ weavetab: ">=2.5.0"
 
 # Site Learning — Autonomous Workflow Memory
 
-Weavetab's Site Learning engine accumulates cross-session knowledge about websites and multi-step automation flows. Each site gets one profile file at ~/.weavetab-system/memory/sites/<origin>.json — never duplicated, always merged on write.
+Weavetab's Site Learning engine accumulates cross-session knowledge about websites and multi-step automation flows. Each site gets one profile file at `~/.weavetab-system/memory/sites/<origin>.json` — never duplicated, always merged on write.
+
+A profile holds `framework`, `captcha_frequency`, `quirks`, and named `patterns` (each with `steps`, `reliability`, `strikes`, and execution counters).
 
 ---
 
@@ -27,38 +29,41 @@ Weavetab's Site Learning engine accumulates cross-session knowledge about websit
 
 On every session visiting a known or potentially-known site, run:
 
-`json
-{ "tool": "browser_pattern_learn", "action": "get", "origin": "https://github.com" }
-`
+```json
+{ "action": "get", "origin": "https://github.com" }
+```
+
+`action` defaults to `"learn"`, so `get` must be stated explicitly. If `origin` is omitted, `get` reads the active tab's origin.
 
 Parse the response:
-- known: false → site is new, proceed exploratorily, teach after completion
-- known_patterns → list of named workflows with reliability scores
-- quirks → auto-handle any listed quirks (cookie banners, rate limits) before main task
-- ramework → adjust interaction strategy accordingly (React, Vue, etc.)
+- `known: false` → the site is new; proceed exploratorily and teach it after completion.
+- `_hint` → a compact text summary listing `framework`, `captcha_frequency`, `known_patterns` (with reliability and step counts), and `quirks`.
+- `quirks` → auto-handle any listed quirks (cookie banners, rate limits) before the main task.
 
 ---
 
 ## 2. Fast-Path vs. Exploratory Decision
 
-Use the _hint field or individual 
+Use the per-pattern `reliability` (and `strikes`) values to choose your strategy:
 
 | Reliability | Strikes | Strategy |
 |---|---|---|
-| ≥ 0.8, strikes = 0 | ✓ | **Fast path**: replay steps via rowser_burst directly |
-| 0.5–0.79 | 0–1 | **Cautious path**: replay steps, verify success_indicator after each critical step |
+| ≥ 0.8, strikes = 0 | — | **Fast path**: replay the stored steps via `browser_burst` directly |
+| 0.5–0.79 | 0–1 | **Cautious path**: replay steps, verify `success_indicator` after each critical step |
 | < 0.5 | any | **Re-explore**: navigate manually, collect correct steps, then teach |
-| any | ≥ 3 | **Re-learn**: ignore cached pattern, re-explore, then call rowser_pattern_learn with updated steps |
+| any | ≥ 3 | **Re-learn**: ignore the cached pattern, re-explore, then `learn` again with updated steps |
+
+The `_hint` string flags eligible patterns with `[fast-path eligible]` and stale ones with `[RE-LEARN NEEDED]`.
 
 ---
 
 ## 3. Quirk Auto-Handling
 
-If a profile has known quirks, resolve them immediately after navigation before executing your main task:
+If a profile lists quirks, resolve them immediately after navigation before executing your main task. Example stored quirk data:
 
-`
-Profile quirks: { cookie_banner: { selector: "#cookie-consent", action: "click .accept-all", appears: "first_visit" } }
-`
+```
+{ "cookie_banner": { "selector": "#cookie-consent", "action": "click .accept-all", "appears": "first_visit" } }
+```
 
 Execute the action before doing anything else. Never spend reasoning turns on a known dismissible popup.
 
@@ -68,11 +73,10 @@ Execute the action before doing anything else. Never spend reasoning turns on a
 
 After successfully completing a multi-step flow for the first time (or after re-learning):
 
-`json
+```json
 {
-  "tool": "browser_pattern_learn",
-  "origin": "https://github.com",
   "action": "learn",
+  "origin": "https://github.com",
   "name": "login_flow",
   "steps": [
     { "tool": "browser_navigate", "target": "https://github.com/login" },
@@ -83,18 +87,19 @@ After successfully completing a multi-step flow for the first time (or after re-
   "success_indicator": "a[aria-label='Homepage']",
   "entry": "/login"
 }
-`
+```
+
+Each step accepts `tool`, an optional `target` (selector or URL), an optional `value`, and an optional `extra` object forwarded verbatim to `browser_burst` replay.
 
 **Pattern Naming Rules**:
-- Use snake_case
-- Be descriptive: login_flow, pr_review, csv_export, checkout_flow
-- Duplicate name on same origin = **update** (merge), never creates a second pattern
+- Use snake_case.
+- Be descriptive: `login_flow`, `pr_review`, `csv_export`, `checkout_flow`.
+- A duplicate name on the same origin is an **update** (merge) — it never creates a second pattern.
 
 **Step Quality Rules**:
-- Use semantic selectors: data-testid, id, ria-label, readable text-based selectors
-- Avoid: .hash_abc123, div:nth-child(4), deep anonymous chains like div > div > div > span
-  (the engine automatically drops volatile selectors during compilation)
-- For sensitive inputs, record the step with a placeholder like {{username}} — never hardcode credentials
+- Prefer semantic selectors: `data-testid`, `id`, `aria-label`, readable text-based selectors.
+- Avoid hashed classes (`.hash_abc123`), positional selectors (`div:nth-child(4)`), and deep anonymous chains (`div > div > div > span`) — the engine drops volatile selectors during compilation.
+- For sensitive inputs, record a placeholder like `{{username}}` — never hardcode credentials.
 
 ---
 
@@ -102,20 +107,21 @@ After successfully completing a multi-step flow for the first time (or after re-
 
 Every time you replay a pattern, report the outcome:
 
-`json
+```json
 {
-  "tool": "browser_pattern_learn",
-  "origin": "https://github.com",
   "action": "record_execution",
+  "origin": "https://github.com",
   "name": "login_flow",
   "success": true,
   "duration_ms": 3100
 }
-`
+```
+
+`success` is required. The engine updates reliability via EWMA (α=0.15):
+- A success nudges reliability toward 1.0 (and resets `strikes` to 0).
+- A failure lowers reliability and increments `strikes`; 3 consecutive failures trigger a re-learn flag.
 
-The engine uses EWMA (α=0.15) to update the reliability score:
-- Success run → reliability climbs toward 1.0 slowly
-- Failure run → reliability drops; 3 consecutive failures trigger [RE-LEARN NEEDED] flag
+If no pattern with that name exists for the origin, the call returns `error_code: "PATTERN_NOT_FOUND"`.
 
 ---
 
@@ -123,11 +129,10 @@ The engine uses EWMA (α=0.15) to update the reliability score:
 
 When you encounter a cookie consent modal, popup, or rate limit for the first time:
 
-`json
+```json
 {
-  "tool": "browser_pattern_learn",
-  "origin": "https://example.com",
   "action": "record_quirk",
+  "origin": "https://example.com",
   "quirk_key": "cookie_banner",
   "quirk_data": {
     "selector": "#cookie-consent",
@@ -135,46 +140,50 @@ When you encounter a cookie consent modal, popup, or rate limit for the first ti
     "appears": "first_visit"
   }
 }
-`
+```
 
-Supported quirk_key values: cookie_banner, 
+Supported `quirk_key` values: `cookie_banner`, `rate_limit`, `modal_popups`.
 
 For rate limits:
-`json
+
+```json
 {
+  "action": "record_quirk",
+  "origin": "https://example.com",
   "quirk_key": "rate_limit",
   "quirk_data": { "threshold": "60req/min", "recovery": "wait 30s" }
 }
-`
+```
 
 ---
 
 ## 7. Anti-Patterns to Avoid
 
-- **Never create per-session pattern names** like login_2026_09_16 — one name per workflow per origin, forever updated in place.
-- **Never call rowser_pattern_learn in a loop** — one call per workflow completion. The write is idempotent (skips disk write if nothing changed).
-- **Never store credentials in steps** — use placeholders or rowser_type_secret in actual execution.
-- **Never write to ~/.weavetab/** — all memory belongs in ~/.weavetab-system/memory/sites/.
+- **Never create per-session pattern names** like `login_2026_09_16` — one name per workflow per origin, forever updated in place.
+- **Never call `browser_pattern_learn` in a loop** — one call per workflow completion. The write is idempotent (skips the disk write if nothing changed).
+- **Never store credentials in steps** — use placeholders or `browser_type_secret` during actual execution.
+- **Never write to `~/.weavetab/`** — all memory belongs in `~/.weavetab-system/memory/sites/`.
 
 ---
 
 ## 8. Full Session Example: GitHub PR Review
 
-`
+```
 1. browser_pattern_learn { action: "get", origin: "https://github.com" }
-   → patterns: { pr_review: { reliability: 0.95, steps: 3 } }
-   → quirks: {} (none)
+   → known_patterns: pr_review (reliability 0.95, 3 steps) [fast-path eligible]
+   → quirks: none
 
-2. Since reliability=0.95 (≥ 0.8): use fast path
-   browser_burst with the 3 stored steps
+2. Since reliability = 0.95 (≥ 0.8): use the fast path.
+   browser_burst with the 3 stored steps.
 
 3. After completion:
    browser_pattern_learn {
      action: "record_execution",
      name: "pr_review",
+     origin: "https://github.com",
      success: true,
      duration_ms: 2800
    }
-`
+```
 
-Total agent turns for a known site: **3 tool calls** vs. potentially 12+ with full exploration.
+Total agent turns for a known site: **3 tool calls** vs. potentially 12+ with full exploration.

package/network-and-perf/device-and-environment.md

@@ -1,87 +1,100 @@
----
-id: device-and-environment
-domain: network-and-perf
-triggers:
-  - "emulate device"
-  - "mobile view"
-  - "throttle network"
-  - "geolocation override"
-  - "user agent"
-  - "responsive testing"
-tools:
-  - "browser_emulate"
-weavetab: ">=2.5.0"
----
-
-# Device Emulation & Environment Simulation
-
-Auditing mobile responsive layouts, testing geographic restrictions, and simulating degraded network conditions can all be accomplished with `browser_emulate`.
-
----
-
-## 1. Device Presets & Viewport Simulation
-
-Switch from desktop to realistic mobile hardware profiles:
-
-```json
-{
-  "device": "iPhone 15 Pro",
-  "orientation": "portrait"
-}
-```
-
-Or configure custom screen geometries:
-
-```json
-{
-  "viewport": {
-    "width": 393,
-    "height": 852,
-    "deviceScaleFactor": 3,
-    "isMobile": true,
-    "hasTouch": true
-  }
-}
-```
-
----
-
-## 2. Network Throttling Simulation
-
-Verify how web applications degrade under poor connectivity:
-
-```json
-{
-  "network": {
-    "offline": false,
-    "downloadThroughput": 1024 * 500, // 500 kb/s (Slow 3G)
-    "uploadThroughput": 1024 * 250,
-    "latency": 400 // ms
-  }
-}
-```
-
----
-
-## 3. Geolocation & Timezone Overrides
-
-Bypass localized IP redirects or verify localized content rendering:
-
-```json
-{
-  "geolocation": {
-    "latitude": 37.7749,
-    "longitude": -122.4194,
-    "accuracy": 100
-  },
-  "timezoneId": "America/Los_Angeles",
-  "locale": "en-US"
-}
-```
-
-To reset all overrides back to default host system parameters:
-```json
-{
-  "reset": true
-}
-```
+---
+id: device-and-environment
+domain: network-and-perf
+triggers:
+  - "emulate device"
+  - "mobile view"
+  - "throttle network"
+  - "geolocation override"
+  - "user agent"
+  - "responsive testing"
+tools:
+  - "browser_viewport"
+  - "browser_emulate"
+weavetab: ">=2.5.0"
+---
+
+# Device Emulation & Environment Simulation
+
+Auditing mobile responsive layouts, testing geographic restrictions, and simulating degraded network conditions are split across two tools: `browser_viewport` owns device geometry, locale, timezone, and color-scheme emulation; `browser_emulate` owns network throttling and CPU slowdown.
+
+---
+
+## 1. Device Presets & Viewport Simulation (`browser_viewport`)
+
+List the available hardware presets, then apply one:
+
+```json
+{ "action": "list" }
+```
+
+```json
+{
+  "action": "preset",
+  "devicePreset": "iPhone 15 Pro"
+}
+```
+
+Or configure custom screen geometry directly with `action: "set"`:
+
+```json
+{
+  "action": "set",
+  "width": 393,
+  "height": 852,
+  "deviceScaleFactor": 3,
+  "mobile": true,
+  "hasTouch": true,
+  "screenOrientation": "portrait"
+}
+```
+
+Clear all viewport and emulation overrides back to the host defaults:
+
+```json
+{ "action": "clear" }
+```
+
+---
+
+## 2. Network & CPU Throttling (`browser_emulate`)
+
+Verify how web applications degrade under poor connectivity:
+
+```json
+{
+  "network": {
+    "offline": false,
+    "downloadThroughput": 512000,
+    "uploadThroughput": 256000,
+    "latency": 400
+  },
+  "cpuThrottlingRate": 4
+}
+```
+
+Use a named profile for common cases (`"slow3g"`, `"fast3g"`, `"4g"`, `"offline"`, `"online"`):
+
+```json
+{ "network": "slow3g" }
+```
+
+---
+
+## 3. Geolocation, Timezone, Locale & Color Scheme (`browser_viewport`)
+
+Bypass localized IP redirects or verify localized content rendering:
+
+```json
+{
+  "action": "set",
+  "geolocation": {
+    "latitude": 37.7749,
+    "longitude": -122.4194,
+    "accuracy": 100
+  },
+  "timezoneId": "America/Los_Angeles",
+  "locale": "en-US",
+  "colorScheme": "dark"
+}
+```

package/network-and-perf/network-intercept-and-mock.md

@@ -1,84 +1,97 @@
----
-id: network-intercept-and-mock
-domain: network-and-perf
-triggers:
-  - "mock api"
-  - "intercept network"
-  - "stub request"
-  - "inspect tls"
-  - "ssl certificate"
-  - "network waterfall"
-tools:
-  - "browser_network_intercept"
-weavetab: ">=2.5.0"
----
-
-# Network Interception, Mocking & TLS Forensics
-
-Autonomous testing and debugging often require simulating backend error states (e.g. 500 Internal Server Error, 429 Rate Limit), stubbing third-party analytics, or verifying TLS/SSL certificates.
-
-`browser_network_intercept` provides fine-grained CDP request and response modification.
-
----
-
-## 1. Mocking API Responses
-
-Intercept outgoing HTTP requests matching a URL pattern and return custom mock data:
-
-```json
-{
-  "pattern": "*/api/v1/user/profile",
-  "response": {
-    "status": 200,
-    "headers": {
-      "Content-Type": "application/json"
-    },
-    "body": "{\"id\": \"usr_test\", \"role\": \"admin\", \"credits\": 9999}"
-  }
-}
-```
-
----
-
-## 2. Blocking Unnecessary Traffic & Trackers
-
-Accelerate page loads and eliminate token bloat by aborting non-essential requests:
-
-```json
-{
-  "pattern": "*google-analytics.com*",
-  "action": "abort",
-  "errorReason": "BlockedByClient"
-}
-```
-
----
-
-## 3. TLS / SSL Forensics & Timing Waterfalls
-
-Extract cryptographic handshake metadata, cipher suites, expiration dates, and microsecond network waterfalls (DNS lookup, TCP connect, SSL handshake, TTFB):
-
-```json
-{
-  "action": "auditTls",
-  "url": "https://weavetab.dev"
-}
-```
-
-### Response Example:
-```json
-{
-  "security": {
-    "protocol": "TLS 1.3",
-    "cipher": "AES_128_GCM",
-    "issuer": "Let's Encrypt",
-    "validTo": "2026-11-15T00:00:00.000Z"
-  },
-  "waterfall": {
-    "dnsMs": 1.4,
-    "tcpMs": 3.2,
-    "sslMs": 4.1,
-    "ttfbMs": 12.8
-  }
-}
-```
+---
+id: network-intercept-and-mock
+domain: network-and-perf
+triggers:
+  - "mock api"
+  - "intercept network"
+  - "stub request"
+  - "inspect tls"
+  - "ssl certificate"
+  - "network waterfall"
+tools:
+  - "browser_network_intercept"
+weavetab: ">=2.5.0"
+---
+
+# Network Interception, Mocking & Telemetry
+
+Autonomous testing and debugging often require simulating backend error states (e.g. 500 Internal Server Error, 429 Rate Limit), stubbing third-party analytics, or inspecting real request timing and TLS metadata.
+
+`browser_network_intercept` exposes four actions: `enable`, `disable`, `get_telemetry`, and `clear_telemetry`.
+
+---
+
+## 1. Mocking API Responses (`enable`)
+
+`enable` requires a `pattern` (URL glob). Every matching response is fulfilled with your mock:
+
+```json
+{
+  "action": "enable",
+  "pattern": "*/api/v1/user/profile",
+  "mockStatus": 200,
+  "mockBody": "{\"id\": \"usr_test\", \"role\": \"admin\", \"credits\": 9999}"
+}
+```
+
+- **`pattern`** — URL glob, e.g. `*api/users*`. `*` and `?` are treated as wildcards.
+- **`mockStatus`** — HTTP status to return (default `200`). Use `500`/`429`/`404` to simulate failures.
+- **`mockBody`** — response body string (default `{}`). Pass JSON as a string.
+
+Mocks are served from the extension when present, otherwise via CDP's Fetch domain (fallback mode).
+
+---
+
+## 2. Stopping Interception (`disable`)
+
+Return the browser to live traffic when a test completes:
+
+```json
+{
+  "action": "disable"
+}
+```
+
+---
+
+## 3. Network Telemetry (`get_telemetry`)
+
+`get_telemetry` starts a background capture (if not already running) and returns the recorded requests — including per-request protocol timing phases, TLS/SSL certificate details when the connection exposes them, and failure reasons:
+
+```json
+{
+  "action": "get_telemetry",
+  "pattern": "*api/*"
+}
+```
+
+An optional `pattern` filters the returned requests by URL. The response includes:
+
+```json
+{
+  "success": true,
+  "count": 12,
+  "requests": [
+    {
+      "url": "https://weavetab.dev/api/v1/session",
+      "timing": { "dnsMs": 1.4, "tcpMs": 3.2, "sslMs": 4.1, "ttfbMs": 12.8 }
+    }
+  ],
+  "navigationOccurred": false,
+  "errors": []
+}
+```
+
+> Certificates and timing fields are surfaced only when the underlying connection exposes them; treat missing fields as "not reported", not "absent".
+
+---
+
+## 4. Clearing the Buffer (`clear_telemetry`)
+
+Reset the capture buffer between scenarios without tearing down the session:
+
+```json
+{
+  "action": "clear_telemetry"
+}
+```