@js-recon/js-recon 1.3.1-beta.2

package/CHANGELOG.md

@@ -0,0 +1,692 @@
+# Change Log
+
+## 1.3.1-beta.2 - 2026-06-12
+
+### Fixed
+
+- All error and warning messages (chalk.red, chalk.bgRed, chalk.yellow `[!]`, chalk.magenta `[!]`, chalk.dim `[!]`) now write to `stderr` instead of `stdout` — affects 62 source files across every subcommand; fixes machine-readable pipelines and shell redirects that expected clean stdout
+- Framework detection now falls back to checking Puppeteer-intercepted network request URLs when all HTML-attribute checks fail — catches Nuxt.js and Next.js sites that load their framework chunks dynamically (e.g. behind a Cloudflare challenge or SSO redirect) rather than referencing them in static HTML (`lazyload`)
+- Map step no longer crashes with SIGSEGV (JavaScript heap out of memory) on ad-heavy or large-bundle targets — all file-parsing loops in the Vue/React/Svelte resolvers now skip files larger than 1.5 MB before calling Babel, preventing unbounded AST memory accumulation on sites that download 100+ third-party JS files (`map`)
+- `run` now calls `process.exit(0)` after all pipeline steps complete — previously, abandoned Puppeteer navigations left by the lazyload hard timeout kept Node.js's event loop open indefinitely, causing the container to be SIGKILL'd (exit 137) even when analysis finished successfully (`run`)
+- Next.js lazyload recursive page-crawl now stops visiting pages after 200 unique page visits per crawl instance — prevents runaway crawl explosion on sites that expose many locale or language variants in their navigation, where each locale page links to every other locale causing the crawl frontier to grow exponentially and exhaust the lazyload timeout (`lazyload`)
+- Next.js fetch resolver now skips CSS stylesheet lazy-loader chunks (`markAssetError`, `fetchStyleSheet`) and Next.js internal data-fetcher chunks (`x-nextjs-data`) to avoid emitting false-positive API endpoints from framework internals (`map`)
+- Next.js fetch resolver resolves `[param:X]` URL placeholders by tracing callers of the enclosing wrapper function — tries same-module callers first, then falls back to cross-chunk exported callers; reduces unresolved placeholder markers in output (`map`)
+- Next.js fetch resolver guards `callHeaders` assignment against non-object values so a `null` or primitive returned by header resolution no longer causes a downstream crash (`map`)
+- `resolveWebpackChunkImport` in `utils.ts` now calls `resolveVariableInChunk` on identifier nodes inside template-literal expressions and function-call arguments, cutting `[var X]` placeholder noise in resolved chunk URLs (`map`)
+
+### Performance
+
+- Next.js subsequent-requests passes (steps 3/8 and 4.5/8) no longer re-run webpack chunk URL builder analysis — `next_GetLazyResourcesWebpackJs` (a full Puppeteer session) is now skipped when `subsequentRequestsFlag` is true, saving 3-6 minutes per call since the chunk URL builders are static and were already resolved in the initial lazyload (`lazyload`)
+- HTML inline-chunk scraping in `subsequentRequests` is now parallelised using the same thread-count semaphore as the RSC pass — previously sequential over all extracted paths, cutting the HTML phase from ~17 min to ~2 min for sites with 1000+ extracted paths (`lazyload`)
+
+## 1.3.1-beta.1 - 2026-06-08
+
+### Added
+
+### Changed
+
+### Fixed
+
+- Bumped versions for dependencies
+- Fixed container
+
+## 1.3.1-alpha.4 - 2026-06-08
+
+### Performance
+
+- `makeGetCallers` now caches per-file content + Babel AST tuples for the lifetime of the resolver instance, so repeated caller searches at high recursion depth no longer re-read and re-parse every JS file on each call — depth-8 runs that previously took 200+ minutes on a large real-world target now complete in under a minute (`map`)
+- `map -t svelte/vue/react`: `getViteConnections` now parses each JS file exactly once instead of twice (single-pass replaces the two-pass approach), cutting parse-time memory in half for large applications (`map`)
+- `map -t svelte/vue/react`: replaced `JSON.stringify(chunks)` (which allocated a string equal in size to the entire output file) with a streaming `createWriteStream` write that serialises one chunk at a time, eliminating the peak in-memory JSON string (`map`)
+- `map -t svelte/vue/react`: `vue_resolveFetch` no longer caches all parsed ASTs and file contents for "fetch"-containing files simultaneously; ASTs are now parsed on-demand and discarded after each file, with a bounded LRU cache of at most 20 ASTs kept alive for cross-file caller lookup (`map`)
+- `map -t svelte/vue/react`: `FetchEntry.enclosingFn.node` (an AST node reference that pinned each file's full Babel AST through the entries array until the end of the second pass) is now nulled out — the field is not read in the second pass; `FetchEntry.fileContent` is similarly cleared to avoid retaining all processed file contents in memory (`map`)
+
+### Added
+
+- GraphQL operation extraction during `--openapi` generation — `map` now scans every downloaded JS file's string and template literals, feeds candidates through the official `graphql` library's `parse()`, and emits each parsed query/mutation/subscription as a POST request. Output is placed under a flat top-level `GraphQL` folder in the Postman collection and tagged `GraphQL` in the OpenAPI spec, with method `POST`, path `/{{graphqlEndpoint}}`, and a JSON body of shape `{"operationName": "...", "query": "...", "variables": {...}}`. The printed query inlines transitively-referenced fragment definitions so each emitted request is self-contained. Disabled with `--no-graphql` (alias `--ngql`) on both `map` and `run` (`map`, `run`)
+- `collectionFolder` optional field on `OpenapiOutputItem` — when set, the OpenAPI generator uses it as the operation's `tags` value and the Postman generator places the item under a flat top-level folder with that name, bypassing the path-segment-derived hierarchy. Used by the new GraphQL resolver to group all operations under a single `GraphQL` folder regardless of transport URL (`map`)
+- `--lazyload-timeout <minutes>` flag on both `lazyload` and `run` commands (default 30, 0 = disabled) — sets a hard ceiling on how long each lazyLoad step runs. When the timer fires the module logs a warning and the pipeline continues to the next step; in-flight Puppeteer pages and downloads may still complete in the background but their results are discarded (`lazyload`, `run`)
+- Next.js lazyload now scans ALL downloaded JS files for webpack chunk URL builder functions (`__webpack_require__.u` pattern), not just `webpack-*.js` files — covers module federation entry points and other non-standard filenames. Scanning runs iteratively after the initial crawl until no new chunk URLs are discovered, with a CLI progress bar (`lazyload`)
+- `--max-recursion-depth <n>` flag on `map` (default 3) — controls how far the HTTP-client URL fan-out and cross-file resolver recurse through caller chains. Higher values resolve more `[param:X]` markers at the cost of runtime; the per-entry deadline scales with depth so deeper recursion still terminates (`map`)
+- `deepSubstituteBodyValue` body resolver — when a request body contains a `[param:X]` leaf whose call-site value is a structured object (e.g. a credentials/config object passed by an outer caller), the leaf is now replaced with the full nested object rather than left as a placeholder string. Used by both the HTTP-client and fetch resolvers (`map`)
+- `makeGetCallersSameFile` fallback for body-param resolution — when the param-owning function has a short minifier-local binding name (≤ 2 chars), `resolveParamToAnyValue` now does a targeted same-file AST search to catch direct in-file callers that `makeGetCallers` skips to avoid cross-file false positives. Same-file short-name calls are unambiguous because the binding is in scope (`map`)
+- Object-preference in `resolveParamToAnyValue` — prefers a caller whose argument resolves to a structured object/array over one that resolves to a bare string, since body params are typically objects and string-arg overloads are usually unrelated dispatch calls. Also skips resolved values where every leaf is still an unresolved placeholder marker (`map`)
+- `OptionalMemberExpression` AST node handling in `deepResolveValue`, `resolveReturnInline`, and `resolveNodeValue` — optional chaining (`a?.b`) in URL/body expressions is now resolved the same way as regular member expressions instead of returning the opaque "unsupported node type" marker (`map`)
+- HTTP-client method-call resolver for Vue/React/Svelte bundles — captures `<obj>.<verb>(<url>, [body], [config])` callsites (where `<verb>` ∈ {get,post,put,delete,patch,head,options}), runs same-function assignment recovery for late-bound locals, fans the URL out across every caller chain, and emits one OpenAPI entry per resolved caller. Designed for bundles whose transport layer overrides `XMLHttpRequest.prototype.{open,send,setRequestHeader}` (axios xhrAdapter and similar wrappers), where the literal URL is composed at the client-instance method call site rather than inside the adapter (`map`)
+- `EnclosingFn.paramNames` + `parent` chain in the shared taint primitives — taint substitution can now resolve `[param:X]` for any parameter at any index in any enclosing function, including across anonymous Promise-chain callbacks where the immediate enclosing function doesn't declare X (`map`)
+- Per-file alias map in `makeGetCallers` — recognizes `{ name: Binding }` re-exports and `{ name: () => Binding }` webpack getter exports so callsites that hit the binding through its public name (e.g. `ae.request(...)`, `r.default.postUnchecked(...)`) are correctly matched as callers of the local minified symbol. Aliases are scoped per file because minifier locals collide across modules (`map`)
+- Member-expression callsite matching in `makeGetCallers` — `<anything>.<exportedName>(...)` is now recognised as a caller of the bound function, in addition to bare-identifier calls (`map`)
+- XMLHttpRequest detection and resolution for Vue.JS, React, and Svelte/Astro bundles — resolves `.open()` method/URL, `.setRequestHeader()` header pairs, and `.send()` body from each XHR binding's call chain; results are registered in the OpenAPI output (`map`)
+- Detect Next.js Server Actions registered via `createServerReference` and emit them as POST endpoints in the OpenAPI spec and Postman collection — includes `next-action` / `Accept` / `Content-Type` headers, route derived from App Router file path, and argument hints traced from the first call site (`map`)
+- Argument hints in Server Action request bodies carry the inferred type alongside the variable name (e.g. `<string:userId>`) instead of an opaque placeholder (`map`)
+- Location metadata for Server Actions: definition chunk + absolute file path + line and call-site chunk + absolute file path + line, surfaced as the `description` field in both the OpenAPI spec and Postman collection (`map`)
+- `list server_actions` interactive command — prints all discovered Server Actions with route, body args, and source locations (`map -i`)
+- Svelte/Astro framework support — `lazyload` now discovers island JS files via recursive HTML page crawl and ESM import following; `map` decodes Vite production chunks using the same logic as Vue; `analyze` and `run` pipeline added for Svelte/Astro apps (`lazyload`, `map`, `analyze`, `run`)
+- `fingerprint` subcommand — batch framework detection against one or more target URLs; outputs detected framework and version to stdout in `text` (default), `json`, `jsonl`, or `csv` format; useful for triaging large target lists before running the full pipeline (`fingerprint`)
+- React (Vite/Rolldown) framework detection via `<link rel="modulepreload">` elements and fast-path filename matching, in addition to inline `<script>` tags (`lazyload`)
+- Recursive ESM import following for React bundles — static imports, dynamic `import()`, and Vite `__vite_mapDeps` arrays are parsed from each downloaded file so all referenced chunks are fetched transitively (`lazyload`)
+- `map` and `analyze` pipeline support for React (Vite/Rolldown) applications, using the same fetch-resolver and analyze engine as Vue with vendor-chunk filtering (`map`, `analyze`, `run`)
+- Content-entropy deduplication in `lazyload` — query-param variants of the same path are probed and only skipped when their extracted script sets are identical, so genuinely distinct parameterised routes are still crawled (`lazyload`)
+- Ctrl-C interrupt menu in `run` — pressing Ctrl-C during a pipeline step shows an interactive prompt (skip current step / skip current target / exit) instead of immediately killing the process; in batch mode an extra "skip target" option is offered (`run`)
+- `regexMatch` step type in the AST rule engine — matches string and template literals against a regex pattern, enabling rules that detect hardcoded credentials and other value-pattern findings (`analyze`)
+- React tech added to all tech-gated type definitions and rule schemas (`analyze`)
+- Model Context Protocol stdio server (`mcp --server`) — speaks the MCP protocol so js-recon can be wired into Claude Code, Cursor, and other MCP-aware hosts as a tool provider. Registers `lazyload`, `strings`, `map`, `endpoints`, `analyze`, `report`, `run`, `list_skills`, and `run_skill` as MCP tools. Subcommand stdout is captured and redirected to stderr so the chatty `console.log` output never corrupts the JSON-RPC frame; captured text is returned as the tool result (`mcp`)
+- One-shot chat flag `-c/--chat <prompt>` on `mcp` (repeatable) — sends a single prompt to the AI agent non-interactively, prints the reply, and exits. Intent-detected `lazyload`/`run` jobs are awaited before the reply so the LLM sees the captured output (`mcp`)
+- Claude Code OAuth credential reuse — when no API key is configured, `mcp --cli` and `mcp -c` fall back to the OAuth bearer token stored by the official Claude Code CLI (macOS keychain service `Claude Code-credentials`, or `~/.claude/.credentials.json` on Linux). The Anthropic SDK is constructed with `authToken` + `anthropic-beta: oauth-2025-04-20`. Tokens are auto-refreshed when expired (with a warning); refresh tokens are written back to the source credential store. OAuth tokens are never persisted to `~/.js-recon/mcp.yaml`. Disable refresh with `--no-refresh-claude-creds` (`mcp`)
+- Background-job runner for `mcp --cli` — `lazyload` and `run` actions now spawn child processes (`node build/index.js <subcmd> ...`) and return immediately so the REPL stays responsive. The user can chat with the LLM while a job runs; tails of running jobs are auto-injected into the LLM context on every turn so the model can answer "how's it going?" naturally. New slash commands: `/jobs`, `/log <id>`, `/tail <id> [n]`, `/cancel <id>`. Ctrl-C cancels the most recent running job (SIGTERM → SIGKILL after 3s) before falling through to the exit warning (`mcp --cli`)
+- Skills system — workflow prompts shipped under `~/.js-recon/skills/*.md` (delivered via a new `skills/` directory in the `js-recon-rules` release zipball, staged by `initRules`). Each skill carries YAML frontmatter (`name`, `description`, `params`, optional `pre_actions`). Invoke from the REPL with `/skill <name> [--param value …]`, via natural-language intent (e.g. `pentest <url>` routes to `web_app_pentest`), or from external MCP hosts via the `run_skill` MCP tool. `pre_actions` declare tool jobs (e.g. `run`) that are spawned before the rendered skill prompt is handed to the LLM. Ships with `graphql_pentest` and `web_app_pentest` (`mcp`, `analyze`)
+- `--claude-client-id <id>` flag on `mcp` — OAuth client ID used when auto-refreshing Claude Code credentials; required in environments where the default Anthropic client ID is not registered (`mcp --cli`, `mcp -c`)
+
+### Changed
+
+- Fetch resolution log lines now include the resolved URL, method, headers, and body immediately after the `[+] Found fetch call in "file":line` line instead of being grouped at the end (`map`)
+- Fetch resolution logs correctly label the framework ("React" or "Vue.JS") in the start and summary messages (`map`)
+- `mcp --cli` launches in the user's current working directory and prints a `Working directory: <abs>` + `Artifacts are preserved across runs.` banner. Spawned job child processes inherit that cwd explicitly so artifacts always land next to the user's other working files (`mcp --cli`)
+- Intent detector now requires word-boundary matches on `scan|run|check|test` so the substring `pentest` no longer accidentally routes to `run`; "pentest" + URL now routes to the `web_app_pentest` skill (or any `*_pentest` skill) when one is loaded (`mcp --cli`)
+- Updated `@anthropic-ai/sdk` dependency to **0.102.0**
+
+### Fixed
+
+- `refactor -t react`: chunks whose AST already contains `export { X as default }` or `export default X` no longer receive a second trailing `export default` statement — the refactor pass now checks for an existing default export in the generated code before appending one (`refactor`)
+- Fetch resolver second pass now handles `[param:X]` markers in request bodies — previously `MARKER_RE` matched only `[member:]` / `[urlsearchparams:]` and the resolver explicitly excluded `[param:]` markers, so a fetch wrapper whose body was an outer function parameter (`fetch(url, { body: JSON.stringify({ ..., body: E }) })`) was emitted with the literal placeholder string instead of the structured object the caller actually passed. The body JSON is now parsed and walked with `deepSubstituteBodyValue` so nested object/array call-site values replace the marker leaves (`map`)
+- `[MemberExpression -> X]`, `[var X]`, and other unresolved placeholders in URLs are now substituted with their OpenAPI equivalents (`{X}`) before URL parsing in the OpenAPI spec generator, preventing spurious `Invalid URL` errors for placeholder-containing paths (`map`)
+- Silenced the `Invalid URL` catch in the OpenAPI query-parameter extractor — URLs that remain unparseable after placeholder substitution (e.g. absolute URLs with placeholder hostnames) are skipped silently, since this is expected behaviour (`map`)
+- Add error handling if webpack JS file is not valid
+- `getRuleFilesRecursive` now skips hidden directories (e.g. `.github`) so GitHub Actions workflow YAML files are not loaded as rules (`analyze`)
+- `run` now deletes stale map artifacts (`mapped.json`, `mapped-openapi.json`, `mapped-openapi.postman_collection.json`) before invoking `map`, preventing a leftover file from a previous run being reused when the output directory has been cleared without a full `cleanup` — which caused `resolveFetch` to look up file paths from the wrong target (`run`)
+- `regexMatch` engine step now collects all matching string/template-literal nodes instead of stopping at the first hit; each matched node emits its own finding, so all hardcoded secrets in a single chunk are reported individually rather than only the first one (`analyze`)
+- Taint propagation now follows callback parameters: when a tainted value is passed alongside an inline function argument in a call (e.g. Vue `watch(source, cb)`), the parameters of the inline function are marked tainted, fixing false-negatives where the callback param received a tainted value at runtime but was not tracked (`analyze`)
+- CSPT rule no longer treats `route.params.*` and `useParams()` as taint sources — route segment params are validated against the router's path pattern and cannot carry arbitrary `../` traversal strings; only query params (`route.query`, `URLSearchParams`, `location.search/hash`) are high-confidence CSPT sources (`analyze`)
+- Vue and React pipelines now also delete stale map artifacts before invoking `map`, applying the same fix as the Next.js pipeline; previously a stale `mapped.json` from a prior run would cause the analyze step to report findings against the wrong target's chunk IDs (`run`)
+- `mcp --cli` "Thinking..." spinner no longer ticks forever after a provider error — the `setInterval` is now declared outside the `try` and cleared in `finally`, so 4xx/network failures render cleanly and the next prompt is not mangled (`mcp --cli`)
+- Job/skill announcements (e.g. `[Job 1] run started ...`, `[Invoking skill: web_app_pentest]`) are now echoed to the REPL the moment `handleToolExecution` returns, in addition to being baked into the LLM context. Previously, if the subsequent LLM call failed (quota / auth), the user had no visible signal that a background scan had actually been spawned (`mcp --cli`)
+- Ctrl-C in `mcp --cli` no longer crashes the readline with `SES_UNCAUGHT_EXCEPTION: readline was closed`. The SIGINT handler is wrapped in a try/catch and `prompt()` is guarded by a `promptingActive` flag so a re-entrant call against an already-pending `rl.question` is dropped instead of tearing the interface down (`mcp --cli`)
+- `extractSourceMaps` no longer crashes with `EISDIR` when a source map entry has a degenerate path (e.g. a bare `webpack://` prefix with no trailing path) that `normalizePath` reduces to `"."` — such entries are now silently skipped (`lazyload`, `run`)
+- Source map files extracted during `run` are now written to `output/<domain>/extracted/` (or the equivalent per-target subdirectory) instead of a bare `extracted/` directory in the current working directory (`lazyload`, `run`)
+
+## 1.3.1-alpha.3 - 2026-05-20
+
+### Added
+
+- Add version for rule templates
+- Add Vue js support for analyze module
+- `esquery` interactive command + headless `-c/--command` runner for `map` and `run`, with `&&` chaining (`map`)
+- Line-editor behavior in interactive mode: cursor movement (left/right/home/end/ctrl-a/ctrl-e), word-wise motion/delete (ctrl-w, ctrl-left/right), kill-to-start/end (ctrl-u/ctrl-k), delete-at-cursor, mid-string insertion so paste lands at the cursor, and horizontal scroll for long inputs (`map -i`)
+
+### Changed
+
+- Removed `mouse: true` from the interactive output pane so terminal-native text selection/copy works in the output area (`map -i`)
+- Vue.js fetch resolver now walks back to the enclosing wrapper function's caller(s) so `URLSearchParams(param.subprop)` expands to real `?k1={k1}&k2={k2}` query strings and spread-header / member-value placeholders get substituted from the caller's object literal — including transitive resolution when the caller passes its own param through (`map`)
+- Vue.js fetch resolver recognises destructured fetch wrappers (e.g. `const { wrapperKey: x } = factory({ ... })`) and resolves their callsites as fetch calls, with positional-first-arg filtering to avoid mis-identifying object-shaped wrappers that construct the URL from a property of their input (`map`)
+- Distinct callsites for the same `(path, method)` are preserved in both the OpenAPI spec (path key gets a `#N` suffix) and the Postman collection (request name gets a `#N` suffix) instead of being collapsed to a single entry (`map`)
+
+### Fixed
+
+- Spread elements in request bodies and option objects are no longer silently dropped when the spread argument is unresolvable — the output surfaces a sentinel key (e.g. `"...arg": "<spread>"`, `"...call()": "<spread>"`) so downstream readers know more fields exist at runtime (`map`)
+
+## 1.3.1-alpha.2 - 2026-05-18
+
+### Added
+
+- Added taint analysis in the `analyze` engine for Next.js
+- Download JS files as soon as they are discovered (`lazyload`)
+- Recursively resolve HTTP requests in Next.js (`map`)
+- Stream JS file downloads during Vue.js discovery — downloads start as soon as each discovery step finds files instead of waiting for the full pipeline (`lazyload`)
+- Resolve `UnaryExpression` nodes (`!x`, `void 0`, `-x`, `typeof x`) so request bodies surface real boolean/null values instead of `[unsupported node type: UnaryExpression]` (`map`)
+- Resolve `ArrayExpression` nodes recursively so array body fields render their element shape instead of `[unsupported node type: ArrayExpression]` (`map`)
+- Resolve `JSON.stringify(variable)` calls by tracing the argument, replacing the opaque `[call:JSON.stringify()]` placeholder (`map`)
+- Resolve `new URLSearchParams({...})` to a real query string, using `{key}` placeholders for values that can't be statically resolved (`map`)
+- Partial-concatenation fallback for binary `+` expressions so resolvable fragments are preserved when one side is unresolved (`map`)
+
+### Changed
+
+- Nested `JSON.stringify(expr)` inside a body object now resolves `expr` instead of emitting `[call to object...]` (`map`)
+
+### Fixed
+
+- Invalidate request cache if the memory is full
+- Progress bars no longer hide the terminal cursor permanently when they exit without a clean `stop()` — all bars now use `hideCursor: false` (`lazyload`)
+- Removed the concurrent download progress bar in the Vue.js section that was causing display corruption — discovery `console.log` calls no longer collide with the bar's render line (`lazyload`)
+- API spec / Postman collection URLs no longer get `{{baseUrl}}` prepended to already-absolute URLs — full URLs are now reduced to their pathname (`map`)
+- Spread elements that can't be resolved are now skipped instead of being emitted as fake `"...spread": "[spread:e]"` body fields (`map`)
+- Request bodies that reduce to an empty `{}` after resolution are now omitted from the Postman collection (`map`)
+
+## 1.3.1-alpha.1 - 2026.05.13
+
+### Added
+
+- Added MCP CLI support with model and provider configuration
+- Vue.js support to get JS files from the page source
+- Vue.js suppor to get JS files from runtime.js file
+- Pass a URL list to `run -u`
+- Turbopack support for Next.js `map`
+- Added an `inScopeOf` option to AST `esquery` steps so a rule can scope a query to the subtree of a previous match — useful for requiring source and sink to live inside the same function rather than just the same chunk.
+- Added a re-pass of the subsequent-requests crawl after the second strings extraction in `run` so dynamic-route paths (e.g. `/post/1`, `/profile/2`) that are only discovered after the first crawl + strings extraction get their chunks downloaded.
+- Added interactive mode support `-i` for vue
+- Use `puppeteer-extra` rather than `puppeteer`
+- Added React Support
+- Added Cloudfront firewall bypass
+
+### Changed
+
+- AST rules now fire when every declared step matches at least once in the chunk (counted as distinct completed steps), instead of requiring an exact total count of matches — multiple matches in a single step no longer prevent the rule from firing.
+
+### Fixed
+
+- Added try-catch for .map file bruteforce requests
+- Subsequent-request chunk discovery regexes now accept the `~` character so Turbopack content-hashed filenames such as `static/chunks/18865ghy~7gi9.js` are picked up.
+
+## 1.2.2 - 2026.04.04
+
+### Added
+
+- Implemented recursive crawling in Next.js modules to discover more JS files
+- Added `--max-iterations` flag to limit recursive crawl iterations in `lazyload` module
+
+### Changed
+
+### Fixed
+
+## 1.2.2-alpha.11 - 2026.03.01
+
+### Added
+
+- Added support for finding JS files through the single JS file on homepage for Vue.js
+- Added support to get JS files from `../` paths in import statements for Vue.js
+
+### Changed
+
+### Fixed
+
+- Add the single JS file to the list of files to download in Vue.js
+
+## 1.2.2-alpha.10 - 2026.02.07
+
+### Added
+
+### Changed
+
+### Fixed
+
+- CI pipline failed to release package on NPM - fixed
+
+## 1.2.2-alpha.9 - 2026.02.07
+
+### Added
+
+- Added `--research` and `--research-output` flag to lazyload module
+
+### Changed
+
+### Fixed
+
+## 1.2.2-alpha.8 - 2026.01.27
+
+### Added
+
+- Add sourcemap reconstruction for Next.js
+
+### Changed
+
+### Fixed
+
+- Add error handling for AST parsing in next_parseLayoutJs.ts
+- Fixed scope issue in parseLayoutJs.ts
+
+## 1.2.2-alpha.7 - 2026.01.24
+
+### Added
+
+- Added support for extracting JS files from client-side paths (HTML) in Next.js
+
+### Changed
+
+- Fixed recursive script tag parsing
+
+### Fixed
+
+## 1.2.2-alpha.6 - 2026.01.18
+
+### Added
+
+- Added support for parsing layout.js files in Next.js
+
+### Changed
+
+### Fixed
+
+## 1.2.2-alpha.5 - 2025.01.18
+
+### Added
+
+- Add support to bruteforce request `.js.map` files
+- Add support for Promise.all-based lazy loading in Next.js Turbopack builds
+
+### Changed
+
+- Add referer header to requests for improved stability
+
+### Fixed
+
+## 1.2.2-alpha.4 - 2025.12.05
+
+### Added
+
+- Added support for direct axios calls like `axios.Z.get()` for Next.js
+- Added support for axios with URLs exported to chunks
+- Added new method for Vue.js detection using `app.js` `Vue.component()` calls
+- Added new method to find JS files through the single JS file on homepage for Vue.js
+- Added new method to find JS files through import statements for Vue.js
+- Added support for sourcemap reconstruction for Vue.js
+
+### Changed
+
+- Improved node value resolver with research about Axios library
+- Improved node value resolver with research about fetch() usage
+
+### Fixed
+
+- Fixed CDN handling for Next.js applications with custom ports
+
+## 1.2.2-alpha.3 - 2025.11.23
+
+### Added
+
+- Added support for `.Z.create()` axios pattern detection in Next.js
+
+### Changed
+
+### Fixed
+
+- Fixed build ID extraction for Next.js applications when the subsequent requests directory is missing or inaccessible
+- Fixed handling of exit when tech in one target can't be detected
+- Fixed syntax error issue in Next.js build manifest parsing
+- Fixed SECURITY issues by upgrading the packages
+
+## 1.2.2-alpha.2 - 2025.10.28
+
+### Added
+
+- Added Angular support to lazyload module
+
+### Changed
+
+- Added root path (`/`) to endpoints list for Next.js subsequent requests
+
+### Fixed
+
+## 1.2.2-alpha.1 - 2025.10.09
+
+### Added
+
+- Added `--timeout` flag to run and lazyload modules
+- Added `--no-sandbox` flag to disable browser sandbox
+- Added `--build-id` flag to lazyload module to get the buildId from the Next.js app
+
+### Changed
+
+### Fixed
+
+## 1.2.1 - 2025.09.23
+
+### Added
+
+### Changed
+
+### Fixed
+
+- Add try-catch block when checking version from GH for rules
+
+## 1.2.1-beta.2 - 2025.08.10
+
+### Added
+
+- Added tabular view to the report
+
+### Changed
+
+- The run module will skip the target if it is invalid, rather than exiting the program
+
+### Fixed
+
+- Fix "Attempted to use detached Frame" error by adding try-catch block
+- Fix "Cannot read properties of undefined (reading 'split')" error in openapi generator by adding try catch
+
+## 1.2.1-beta.1 - 2025.08.07
+
+### Added
+
+### Changed
+
+- Added `-k` as shorthand flag to the `run` module
+- Added standard exit codes to the application
+
+### Fixed
+
+- Fix errors when the target is using a CDN
+- Fix "possible EventEmitter memory leak detected" error
+- Fix "Maximum call stack size exceeded" error in resolveNodeValue
+- Fix "UND_ERR_HEADERS_OVERFLOW" error
+
+## 1.2.1-alpha.2 - 2025.08.06
+
+### Added
+
+- Added support for parsing URL list in the run module
+
+### Changed
+
+### Fixed
+
+## 1.2.1-alpha.1 - 2025.08.04
+
+### Added
+
+- Added `-k/--insecure` flag to disable SSL certificate verification
+- Added `json` output feature to analyze module
+- Added `analyze` module auto-run to `run` module
+- Added `report` module
+
+### Changed
+
+- Updated the `postMessageFunctionResolve` step to resolve function expressions
+- Updated the `postMessageFunctionResolve` step to resolve arrow function expressions
+- Remove `--map-openapi` flag from run module (enabled by default)
+- Remove `--map-openapi-output` flag from run module
+
+### Fixed
+
+## 1.1.4 - 2025.08.01
+
+### Added
+
+### Changed
+
+- Replace `:` with `_` when creating host directories in `output/`
+- Rename `esquery` engine to `ast` engine
+- Allow any string type for `CheckAssignmentExistStep`
+
+### Fixed
+
+- Fix the issue in ast engine to handle direct assignments in `checkAssignmentExist`
+
+## 1.1.4-alpha.4 - 2025.07.31
+
+### Added
+
+- Added HTTP method condition support in request analysis engine
+- Added esquery engine for static code analysis with AST queries
+- Added support for multiple technologies in esquery engine
+
+### Changed
+
+### Fixed
+
+- Fix the issue when tech wasn't checked before running a rule
+- Fix the issue with next.js lazy loading (support URLs starting with http, or CDN URLs)
+- Fixed broken logic in next_GetLazyResourcesWebpackJs.ts when re-building JS URLs
+
+## 1.1.4-alpha.3 - 2025.07.30
+
+### Added
+
+- Added `analyze` module
+- Added analysis of OpenAPI spec file (requestEngine)
+- Use the repo https://github.com/shriyanss/js-recon-rules to remotely store and download rules
+
+### Changed
+
+### Fixed
+
+## 1.1.4-alpha.2 - 2025.07.29
+
+### Added
+
+- Add description to chunks in mapped.json by default when using `map` module (an axios lib is detected) or when using the `endpoints` module (when a client-side path is detected)
+- Add `list desc` command to show functions with non-empty descriptions in interactive mode
+- Add `refactor` module
+- Iterate through all the chunks, and write it to a separate file, and add export statements
+
+### Changed
+
+### Fixed
+
+## 1.1.4-alpha.1 - 2025.07.28
+
+### Added
+
+- Get the exports of the chunks in next.js
+- Added command to get the exports of a chunk in next.js - `list exportnames`
+- Added `--mapped-json` flag to endpoints module
+
+### Changed
+
+- Type for `exports` is now `string[]` rather than `string` in `mapped.json`
+- Remove `md` output format for endpoints module
+- Removed `--subsequent-requests-dir` option from endpoints module (now use `-d` only)
+
+### Fixed
+
+## 1.1.3 - 2025.07.28
+
+### Added
+
+### Changed
+
+### Fixed
+
+## 1.1.3-beta.3 - 2025.07.26
+
+### Added
+
+- Added path and query parameter extraction to OpenAPI spec generation
+
+### Changed
+
+### Fixed
+
+## 1.1.3-beta.2 - 2025.07.25
+
+### Added
+
+- Added flags for generating OpenAPI config
+
+### Changed
+
+- Prepend the baseUrl when printing the URL of axios.create() calls in next.js
+
+### Fixed
+
+## 1.1.3-beta.1 - 2025.07.24
+
+### Added
+
+- Added support for axios.create() detection in Next.js resolver
+
+### Changed
+
+### Fixed
+
+- Fixed [issue 30](https://github.com/shriyanss/js-recon/issues/30): `FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory`
+
+## 1.1.3-alpha.2 - 2025.07.23
+
+### Added
+
+- Added request body extraction and display for axios calls
+- Resolve `.concat()` operations when traversing code
+
+### Changed
+
+- Display full file path in fetch call log message
+- Improve output in the openapi file
+
+### Fixed
+
+## 1.1.3-alpha.1 - 2025.07.22
+
+### Added
+
+- Added axios URL resolution in next.js (those using `.concat()`)
+- Added openapi spec generation for map module
+
+### Changed
+
+### Fixed
+
+## 1.1.2 - 2025.07.21
+
+### Added
+
+### Changed
+
+### Fixed
+
+## 1.1.2-alpha.4 - 2025.07.21
+
+### Added
+
+### Changed
+
+### Fixed
+
+- Fix CI pipeline for GitHub Container Registry publishing
+
+## 1.1.2-alpha.3 - 2025.07.21
+
+### Added
+
+### Changed
+
+- Remove `--no-sandbox` arg when launching browser (security)
+
+### Fixed
+
+- Disable chrome sandbox when running in docker to fix errors
+
+## 1.1.2-alpha.2 - 2025.07.20
+
+### Added
+
+- Created docker image for js-recon
+
+### Changed
+
+### Fixed
+
+## 1.1.2-alpha.1 - 2025.07.19
+
+### Added
+
+- Added axios client detection in next.js
+- Added `list axios` command in interactive mode for next.js
+
+### Changed
+
+### Fixed
+
+- Provide proper directory for JS files to the `map` module when the `run` module is used
+- Added output directory conflict check when using `run` module
+
+## 1.1.1 - 2025.07.18
+
+### Added
+
+### Changed
+
+### Fixed
+
+- Fixed the version number mismatch in `CHANGELOG.md` (stated 1.1.0) and `package.json` (stated 1.1.0-beta.5)
+
+## 1.1.0/1.1.0-beta.5 - 2025.07.18
+
+### Added
+
+- Detect next in servers in which src includes '/\_next/' rather than just startsWith
+- Detect webpack chunks in \_buildManifest.js
+
+### Changed
+
+### Fixed
+
+## 1.1.0-beta.4 - 2025.07.09
+
+### Added
+
+- Added `set funcdesc <functionId> <description>` command to interactive mode
+
+### Changed
+
+- Pressing C-c in input box (interactive mode) will now also print the command like OS terminal
+- Set the default value of `set writeimports` as `false`
+- Do not store dupe and non-existent entries in `state.functionNavHistory` (interactive mode)
+
+### Fixed
+
+- Fix error of body has been read when running the tool for first time
+- Print an error when the user passes a URL list (file) to the run command
+- Add error recovery in Nuxt ast parse
+
+## 1.1.0-beta.3 - 2025.07.08
+
+### Added
+
+- Added command `set writeimports` in interactive mode for next.js
+- Detect ArrowFunctionExpression when getting webpack connections (Next.JS)
+
+### Changed
+
+### Fixed
+
+- Implement proper error handling in `list nav` in interactive mode
+- Implement error handling when going to non-existent function by `back` and `ahead` in interactive mode
+- Add errorRecovery in all parser.parse to enable parsing the file even if invalid due to any reason
+- Implement coderabbit suggestion: 'Truthiness check can skip fd 0'
+
+## 1.1.0-beta.2 - 2025.07.07
+
+### Added
+
+### Changed
+
+### Fixed
+
+- Fix build errors (type errors)
+
+## 1.1.0-beta.1 - 2025.07.07
+
+### Added
+
+- Svelte framework detection, and JS extraction
+- JSON-based file cache
+- Auto-approve executing JS code (`-y`/`--yes`)
+- Added max threads for downloading JS files `-t`/`--threads`
+- Add timeout handling and network idle check for page load in tech detection
+- Parse script tags to extract additional JavaScript URLs from page
+- Add secret scanning
+- Add feasibility check to API gateway function
+- Add endpoints module to support client-side path extraction
+- Add subsequent-requests feature (`RSC: 1`) in Next.JS
+- Add map module
+    - Webpack chunk parsing
+    - Interactive mode
+    - `fetch()` detection
+- Permutation in `strings` module
+- OpenAI and Ollama integration for AI descriptions
+
+### Changed
+
+### Fixed
+
+- Standardize UTF-8 encoding and improve URL path handling in lazy load module
+
+## 1.0.0 - 2025.06.18
+
+### Added
+
+- Lazy Load Support for Next.js and Nuxt.js
+- JavaScript String Extraction from downloaded JS files
+- API Gateway Proxying to rotate IP addresses
+
+### Changed
+
+### Fixed