@js-recon/js-recon 1.4.3 → 2.0.1-alpha.1

package/build/utility/urlUtils.js

@@ -7,15 +7,51 @@
  * @param {string} url - The URL to parse.
  * @returns {Object} An object with the host and directory of the URL.
  */
+export const toOutputHost = (host) => {
+    const normalized = host.normalize("NFKC").replace(/[^a-zA-Z0-9._\-[\]]/g, "_");
+    const nonTraversing = normalized.length === 0 || /^\.+$/.test(normalized) ? normalized.replace(/\./g, "_") || "_" : normalized;
+    const changed = nonTraversing !== host;
+    const reservedLiteral = nonTraversing.startsWith(ENCODED_HOST_PREFIX);
+    const needsBounding = nonTraversing.length > MAX_OUTPUT_HOST_LENGTH;
+    if (!changed && !reservedLiteral && !needsBounding)
+        return nonTraversing;
+    const category = changed ? "encoded" : needsBounding ? "bounded" : "literal";
+    const digest = createHash("sha256").update(host).digest("hex").slice(0, 12);
+    const tagged = `${ENCODED_HOST_PREFIX}${category}_${nonTraversing}`;
+    return `${tagged.slice(0, MAX_OUTPUT_HOST_LENGTH - digest.length - 1)}-${digest}`;
+};
+const canonicalNetworkHost = (host) => {
+    const candidate = host.trim();
+    if (!candidate)
+        return null;
+    try {
+        const parsed = new URL(candidate.includes("://") ? candidate : `http://${candidate}`);
+        return parsed.host.toLowerCase();
+    }
+    catch (_a) {
+        return null;
+    }
+};
+/** Compares canonical network hosts without using lossy filesystem naming. */
+export const hostMatchesScope = (host, scope) => {
+    const canonicalHost = canonicalNetworkHost(host);
+    if (!canonicalHost)
+        return false;
+    return scope.some((candidate) => candidate.trim() === "*" || canonicalNetworkHost(candidate) === canonicalHost);
+};
 const getURLDirectory = (url) => {
     const u = new URL(url);
     const pathname = u.pathname;
     // Remove filename (last part after final /) if it ends with .js or any file extension
     const dir = pathname.replace(/\/[^\/?#]+\.[^\/?#]+$/, "");
     return {
-        host: u.host.replace(":", "_"), // e.g., "vercel.com" or "localhost_3000"
+        host: toOutputHost(u.host), // e.g., "vercel.com" or "localhost_3000"
+        rawHost: u.host,
         directory: dir, // e.g., "/static/js"
     };
 };
 export { getURLDirectory };
+import { createHash } from "node:crypto";
+const ENCODED_HOST_PREFIX = "__jsr_host_";
+const MAX_OUTPUT_HOST_LENGTH = 180;
 //# sourceMappingURL=urlUtils.js.map

package/build/utility/urlUtils.js.map

@@ -1 +1 @@
-{"version":3,"file":"urlUtils.js","sourceRoot":"","sources":["../../src/utility/urlUtils.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,eAAe,GAAG,CAAC,GAAW,EAAE,EAAE;IACpC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;IAE5B,sFAAsF;IACtF,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;IAE1D,OAAO;QACH,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,yCAAyC;QACzE,SAAS,EAAE,GAAG,EAAE,qBAAqB;KACxC,CAAC;AACN,CAAC,CAAC;AAEF,OAAO,EAAE,eAAe,EAAE,CAAC"}
+{"version":3,"file":"urlUtils.js","sourceRoot":"","sources":["../../src/utility/urlUtils.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAY,EAAU,EAAE;IACjD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;IAC/E,MAAM,aAAa,GACf,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;IAC7G,MAAM,OAAO,GAAG,aAAa,KAAK,IAAI,CAAC;IACvC,MAAM,eAAe,GAAG,aAAa,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;IACtE,MAAM,aAAa,GAAG,aAAa,CAAC,MAAM,GAAG,sBAAsB,CAAC;IACpE,IAAI,CAAC,OAAO,IAAI,CAAC,eAAe,IAAI,CAAC,aAAa;QAAE,OAAO,aAAa,CAAC;IAEzE,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,GAAG,mBAAmB,GAAG,QAAQ,IAAI,aAAa,EAAE,CAAC;IACpE,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAsB,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC;AACtF,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAAC,IAAY,EAAiB,EAAE;IACzD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,SAAS,EAAE,CAAC,CAAC;QACtF,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IACrC,CAAC;IAAC,WAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC,CAAC;AAEF,8EAA8E;AAC9E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAE,KAAwB,EAAW,EAAE;IAChF,MAAM,aAAa,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IACjC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,oBAAoB,CAAC,SAAS,CAAC,KAAK,aAAa,CAAC,CAAC;AACpH,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,GAAW,EAAE,EAAE;IACpC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;IAE5B,sFAAsF;IACtF,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;IAE1D,OAAO;QACH,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,yCAAyC;QACrE,OAAO,EAAE,CAAC,CAAC,IAAI;QACf,SAAS,EAAE,GAAG,EAAE,qBAAqB;KACxC,CAAC;AACN,CAAC,CAAC;AAEF,OAAO,EAAE,eAAe,EAAE,CAAC;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAC1C,MAAM,sBAAsB,GAAG,GAAG,CAAC"}

package/config.dist.yaml

@@ -0,0 +1,251 @@
+# js-recon application configuration
+#
+# The CLI creates ~/.config/js-recon/config.yaml on first use. Copy this file
+# elsewhere when you want to use: js-recon --config /path/to/config.yaml <command>
+#
+# Precedence (highest first): environment, command-line flag, this YAML file,
+# built-in default. Every command option also has a canonical environment name:
+# JS_RECON_<COMMAND>_<OPTION>, for example JS_RECON_RUN_THREADS.
+#
+# null means "not configured". Keep credential-bearing files mode 0600.
+version: 1
+
+oxylabs:
+    # Required in an explicitly selected config when oxylabsWafFallback is true.
+    # JS_RECON_OXYLABS_USERNAME/PASSWORD/COUNTRY may override these values.
+    username: null
+    password: null
+    country: null
+
+commands:
+    lazyload:
+        # May also be a YAML list of HTTP(S) URLs:
+        # url:
+        #     - https://one.example.com
+        #     - https://two.example.com
+        url: null
+        output: output
+        strictScope: false
+        scope: "*"
+        threads: "1"
+        subsequentRequests: false
+        urlsFile: extracted_urls.json
+        proxyConfig: .proxy_config.json
+        ignoreProxyEnv: false
+        oxylabsWafFallback: false
+        oxylabsFallbackMaxRequests: "10"
+        oxylabsFallbackMaxTotal: "100"
+        oxylabsFallbackMaxOrigins: "25"
+        cacheFile: .resp_cache.json
+        disableCache: false
+        cacheOnly: false
+        yes: false
+        timeout: "30000"
+        insecure: false
+        sandbox: true
+        buildId: false
+        sourcemapDir: extracted
+        research: false
+        researchOutput: research.json
+        maxIterations: "10"
+        maxJsSize: "2"
+        lazyloadTimeout: "30"
+        detectionTimeout: "30"
+        maxPages: "200"
+        includeMethods: null
+        excludeMethods: null
+        listMethods: null
+
+    endpoints:
+        url: null
+        directory: null
+        output: endpoints
+        outputFormat: json
+        tech: null
+        list: false
+        mappedJson: null
+
+    strings:
+        directory: null
+        output: strings.json
+        extractUrls: false
+        extractedUrlPath: extracted_urls
+        permutate: false
+        openapi: false
+        scanSecrets: false
+        trufflehog: false
+
+    proxy:
+        init: false
+        destroy: null
+        destroyAll: false
+        region: null
+        awsAccessKey: null
+        awsSecretKey: null
+        config: .proxy_config.json
+        list: false
+        feasibility: false
+        feasibilityUrl: null
+        proxyMethod: null
+        proxy: null
+        oxylabsUsername: null
+        oxylabsPassword: null
+        oxylabsCountry: null
+        oxylabsCity: null
+        oxylabsSessionId: null
+
+    map:
+        directory: null
+        tech: null
+        list: false
+        output: mapped
+        format: json
+        interactive: false
+        command: []
+        ai: null
+        aiThreads: "5"
+        aiProvider: openai
+        aiEndpoint: null
+        openaiApiKey: null
+        model: gpt-4o-mini
+        openapi: false
+        openapiOutput: mapped-openapi.json
+        openapiChunkTag: false
+        graphql: true
+        ngql: null
+        maxRecursionDepth: "3"
+        maxHeap: null
+
+    refactor:
+        mappedJson: mapped.json
+        output: output_refactored
+        tech: null
+        list: false
+        collisions: null
+        signatureQuality: "100"
+        refreshCache: false
+        skipCacheChecks: false
+        remote: true
+        remoteCollisions: null
+        scat: null
+        detectVersion: false
+        detectVersionConfig: null
+        detectVersionDynamicThreshold: "3"
+        detectVersionDynamicConfPurge: false
+
+    analyze:
+        rules: null
+        mappedJson: mapped.json
+        tech: null
+        openapi: null
+        list: false
+        validate: false
+        output: analyze.json
+        disableRulesVersionCheck: false
+
+    report:
+        sqliteDb: js-recon.db
+        mappedJson: null
+        analyzeJson: null
+        endpointsJson: null
+        mappedOpenapiJson: null
+        output: report
+
+    run:
+        # May also be a YAML list. Repeated -u flags and comma-separated URLs
+        # are supported on the command line; a target-file path is also valid.
+        # url:
+        #     - https://one.example.com
+        #     - https://two.example.com
+        url: null
+        rules: null
+        disableRulesVersionCheck: false
+        command: []
+        output: output
+        outputOverwrite: false
+        strictScope: false
+        scope: "*"
+        threads: "1"
+        proxyConfig: .proxy_config.json
+        ignoreProxyEnv: false
+        proxyWafFallback: false
+        oxylabsWafFallback: false
+        oxylabsFallbackMaxRequests: "10"
+        oxylabsFallbackMaxTotal: "100"
+        oxylabsFallbackMaxOrigins: "25"
+        cacheFile: .resp_cache.json
+        disableCache: false
+        cacheOnly: false
+        yes: false
+        secrets: false
+        trufflehog: false
+        ai: null
+        aiThreads: "5"
+        aiProvider: openai
+        aiEndpoint: null
+        openaiApiKey: null
+        model: gpt-4o-mini
+        mapOpenapiChunkTag: false
+        graphql: true
+        ngql: null
+        timeout: "30000"
+        insecure: false
+        sandbox: true
+        sourcemapDir: extracted
+        research: false
+        researchOutput: research.json
+        maxIterations: "10"
+        maxJsSize: "2"
+        lazyloadTimeout: "30"
+        detectionTimeout: "30"
+        maxHeap: null
+        maxPages: "200"
+        includeMethods: null
+        excludeMethods: null
+        listMethods: null
+        csMastTechDetectThreshold: "50"
+        disableRefactor: false
+
+    load:
+        caido: null
+        url: null
+        cacheFile: .resp_cache.json
+
+    fingerprint:
+        # May also be a YAML list of HTTP(S) URLs.
+        url: null
+        output: null
+        format: text
+        threads: "5"
+        timeout: "30000"
+        insecure: false
+        sandbox: true
+
+    mcp:
+        cli: false
+        server: false
+        chat: []
+        config: null
+        apiKey: null
+        model: null
+        provider: null
+        refreshClaudeCreds: true
+        claudeClientId: null
+
+    cs-mast:
+        output: output
+        collisionTable: false
+        minCollisions: "2"
+        collisionOutput: null
+        collisionFormat: csv
+        scat: lit,decl,loop,cond
+        sinc: ""
+        allScatPermutations: false
+        permOutput: null
+        permConcurrency: "0"
+
+    sourcemaps:
+        input: null
+        output: extracted
+
+    completion: {}

package/contributing/testing.md

@@ -0,0 +1,106 @@
+# Writing tests for js-recon
+
+New functionality must ship with tests. Which kind depends on what you're adding — see below.
+
+## Unit tests (Vitest)
+
+Test framework is [Vitest](https://vitest.dev/) — ESM-native, TypeScript-native, no build step.
+
+```bash
+npm test          # run all unit tests once
+npm run test:watch  # watch mode
+npm run test:coverage  # run with coverage report
+```
+
+**What to test.** Pure functions: anything that takes plain inputs and returns a value without I/O.
+Puppeteer, network calls (`makeRequest`), and file writes are intentionally left untested at the
+unit level — they're validated end-to-end via the `run` subcommand instead (see below). When a
+function mixes I/O with logic, extract the parse/transform step into an exported pure function and
+test that:
+
+```typescript
+// Exported pure function — testable
+export const parseThings = (content: string, baseUrl: string): string[] => {
+    /* ... */
+};
+
+// Orchestrator — not unit-tested
+const myModule = async (url: string): Promise<string[]> => {
+    const resp = await makeRequest(url);
+    const content = await resp.text();
+    return parseThings(content, url);
+};
+```
+
+**File layout.** Tests live in `src/__tests__/<component>/<name>.test.ts`, mirroring the source
+path. Use `describe`/`it` blocks grouped by function name; cover the happy path, edge cases (empty
+input, malformed input), and threshold boundaries.
+
+**Local imports use the `.js` extension** (this is an ESM project with `"module": "node16"`):
+
+```typescript
+import { fn } from "../../lazyLoad/next_js/myModule.js";
+```
+
+**Constructing Babel AST nodes for tests.** If a function under test requires a real Babel AST node
+(with `scope`, `path`, correct `start`/`end` offsets), parse a snippet and capture the node via a
+`traverse` visitor rather than building it by hand:
+
+```typescript
+import parser from "@babel/parser";
+import _traverse from "@babel/traverse";
+const traverse = (_traverse.default ?? _traverse) as typeof _traverse.default;
+
+function parseExpr(code: string) {
+    const src = `const _x = ${code};`;
+    const ast = parser.parse(src, { sourceType: "unambiguous", plugins: ["jsx", "typescript"] });
+    let node: any;
+    traverse(ast, {
+        VariableDeclarator(p) {
+            node = p.node.init;
+            p.stop();
+        },
+    });
+    return { node, src };
+}
+```
+
+**Avoid GitHub's secret scanner false-positives.** Strings that look like real secrets (webhook
+URLs, API keys) get blocked by push protection even inside test files. Assemble them at runtime:
+
+```typescript
+// BAD — blocked by secret scanner
+const url = "https://hooks.slack.com/services/TABCDEF/BABCDEF/xxxxxxxxxxxx";
+
+// GOOD — assembled at runtime
+const parts = ["https://hooks.slack.com/services/T", "ABCDEF/B", "ABCDEF/xxxx"];
+const url = parts.join("");
+```
+
+## Fuzz tests (fast-check)
+
+js-recon's job is parsing and analyzing JS bundles pulled from third-party targets — that input is
+fully untrusted. Functions on that boundary (parsing raw bundle text, resolving URLs/strings out of
+it) should get a property-based fuzz test in addition to example-based unit tests, using
+[fast-check](https://fast-check.dev/).
+
+```bash
+npm run test:fuzz   # runs src/**/*.fuzz.test.ts via vitest.fuzz.config.ts
+```
+
+Fuzz tests live alongside the function's regular unit test, named `<name>.fuzz.test.ts`, and are
+excluded from the default `npm test` run (they're slower — property-based, hundreds of generated
+cases per run). See `src/__tests__/strings/extractStrings.fuzz.test.ts` for the reference shape:
+generate arbitrary/adversarial strings, feed them through the same parse config the real call site
+uses, and assert the function under test never throws uncaught or hangs. If a parse step can
+legitimately throw on malformed input (Babel's `errorRecovery: true` does not guarantee it won't),
+wrap it in try/catch inside the test exactly as the real call site does — a caught, expected error
+is not a fuzz failure; an uncaught throw or a hang is.
+
+## Smoke tests (CI)
+
+The `rules-smoke-test` GitHub Actions workflow runs js-recon end-to-end against a seeded lab app and
+asserts every expected rule fires. If you're adding a new AST/request rule to `js-recon-rules`, seed
+the corresponding vulnerability in `js-recon-labs`'s `next_js/vuln-all-rules` app and add the rule ID
+to `EXPECTED_RULES` in `scripts/smoke-test.js`. See the root `CLAUDE.md`'s "Rules smoke test (CI)"
+section for details.

package/eslint.config.js

@@ -0,0 +1,24 @@
+import tseslint from "typescript-eslint";
+import security from "eslint-plugin-security";
+
+export default tseslint.config(
+    {
+        ignores: ["build/**", "output/**", "output_refactored/**", "node_modules/**"],
+    },
+    {
+        files: ["src/**/*.ts"],
+        extends: [...tseslint.configs.recommended],
+        plugins: {
+            security,
+        },
+        rules: {
+            ...security.configs.recommended.rules,
+            // These fire on legitimate dynamic-code patterns intrinsic to a bundle-analysis tool
+            // (parsing/instrumenting untrusted third-party JS is the entire point of js-recon).
+            "security/detect-non-literal-fs-filename": "off",
+            "security/detect-object-injection": "off",
+            "@typescript-eslint/no-explicit-any": "off",
+            "@typescript-eslint/no-unused-vars": ["warn", { argsIgnorePattern: "^_" }],
+        },
+    }
+);

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@js-recon/js-recon",
-    "version": "1.4.3",
+    "version": "2.0.1-alpha.1",
     "description": "JS Recon Tool",
     "main": "build/index.js",
     "type": "module",
@@ -13,9 +13,12 @@
         "start": "node --max-old-space-size=8192 build/index.js",
         "test": "vitest run",
         "test:watch": "vitest",
+        "test:coverage": "vitest run --coverage",
+        "test:fuzz": "vitest run --config vitest.fuzz.config.ts",
         "test:build": "node build/index.js -h",
-        "postinstall": "patch-package",
-        "cleanup": "rm -rf build output output_refactored .resp_cache.json endpoints.json extracted_urls{.txt,.json,-openapi.json} strings.json mapped{-openapi.json,.json,-openapi.postman_collection.json} analyze.json test{.yaml,.js} js-recon-js-recon-*.tgz js-recon.db report.{html,md} js_recon_run_output *_test.js extracted/ research.json results* out.* && tsc"
+        "lint": "eslint src",
+        "postinstall": "patch-package || true; node scripts/postinstall-completion.mjs",
+        "cleanup": "rm -rf build output output_refactored .resp_cache.json .resp_cache.json.entries endpoints.json extracted_urls{.txt,.json,-openapi.json} strings.json mapped{-openapi.json,.json,-openapi.postman_collection.json} analyze.json test{.yaml,.js} js-recon-js-recon-*.tgz js-recon.db report.{html,md} js_recon_run_output *_test.js extracted/ research.json results* out.* swagger-jacker-results.json && tsc"
     },
     "keywords": [],
     "author": "Shriyans Sudhi",
@@ -27,7 +30,7 @@
         "@babel/traverse": "^7.28.5",
         "@babel/types": "^7.27.6",
         "@modelcontextprotocol/sdk": "^1.29.0",
-        "@shriyanss/cli-print-img": "^1.1.0",
+        "@shriyanss/cli-print-img": "^1.1.1",
         "@shriyanss/cs-mast": "0.1.8",
         "@types/chalk": "^0.4.31",
         "@types/cli-progress": "^3.11.6",
@@ -41,6 +44,7 @@
         "datatables.net": "^2.3.6",
         "datatables.net-dt": "^2.3.6",
         "esquery": "^1.6.0",
+        "express": "^5.2.1",
         "extract-zip": "^2.0.1",
         "fs": "^0.0.2",
         "graphql": "^16.14.1",
@@ -48,6 +52,7 @@
         "inquirer": "^12.6.3",
         "marked": "^16.1.2",
         "md5": "^2.3.0",
+        "ohash": "^2.0.11",
         "ollama": "^0.6.3",
         "openai": "^5.8.2",
         "patch-package": "^8.0.1",
@@ -58,7 +63,10 @@
         "puppeteer-extra-plugin-stealth": "^2.11.2",
         "readline": "^1.3.0",
         "ses": "^1.13.0",
-        "undici": "^7.28.0",
+        "shell-quote": "^1.10.0",
+        "tar": "^7.5.22",
+        "undici": "^7.29.0",
+        "ws": "^8.21.2",
         "yaml": "^2.8.0",
         "zod": "^3.23.8"
     },
@@ -78,11 +86,20 @@
         "@types/babel__traverse": "^7.28.0",
         "@types/better-sqlite3": "^7.6.13",
         "@types/blessed": "^0.1.25",
+        "@types/express": "^5.0.6",
         "@types/graphql": "^14.2.3",
         "@types/node": "^24.12.4",
+        "@types/shell-quote": "^1.7.5",
+        "@types/ws": "^8.18.1",
+        "@vitest/coverage-v8": "^4.1.10",
+        "eslint": "^10.8.0",
+        "eslint-plugin-security": "^4.0.1",
+        "fast-check": "^4.9.0",
+        "patch-package": "^8.0.1",
         "ts-node": "^10.9.2",
         "tsconfig-paths": "^4.2.0",
         "typescript": "^5.9.2",
+        "typescript-eslint": "^8.66.0",
         "vitest": "^4.1.10"
     }
 }

package/scripts/exploit-smoke-test.js

@@ -0,0 +1,82 @@
+#!/usr/bin/env node
+/**
+ * Smoke test: verifies that the `exploit` module reported `vulnerable: true` for every CVE
+ * fixture in js-recon-labs.
+ *
+ * Usage:
+ *   node scripts/exploit-smoke-test.js [results-dir]
+ *
+ * Expects one `<CVE-ID>.json` (rich exploit.json output shape) per CVE in results-dir, as
+ * produced by the `exploit-smoke-test.yaml` workflow's `-o` flag.
+ */
+
+import { readFileSync, existsSync } from "fs";
+import { resolve } from "path";
+
+const resultsDir = process.argv[2] || "/tmp/exploit-results";
+
+const EXPECTED_CVES = [
+    "CVE-2025-29927",
+    "CVE-2026-64645",
+    "CVE-2025-30208",
+    "CVE-2026-39363",
+    "CVE-2026-71320",
+    "CVE-2026-71315",
+    "CVE-2026-68945",
+    "CVE-2025-55182",
+];
+
+// RCE-class CVEs must additionally prove their `id` proof output looks like real `id` command
+// output, not just any non-empty string — otherwise a broken payload that returns garbage would
+// still satisfy a loose `vulnerable: true` check.
+const RCE_OUTPUT_PATTERN = /uid=\d+.*gid=\d+/;
+const RCE_CVES = new Set(["CVE-2026-71320", "CVE-2025-55182"]);
+
+let failures = [];
+
+for (const cveId of EXPECTED_CVES) {
+    const filePath = resolve(resultsDir, `${cveId}.json`);
+    if (!existsSync(filePath)) {
+        failures.push(`${cveId}: no result file at ${filePath}`);
+        continue;
+    }
+
+    let findings;
+    try {
+        findings = JSON.parse(readFileSync(filePath, "utf-8"));
+    } catch (err) {
+        failures.push(`${cveId}: could not parse ${filePath}: ${err.message}`);
+        continue;
+    }
+
+    const finding = findings[0];
+    if (!finding || finding.vulnerable !== true) {
+        failures.push(`${cveId}: not reported vulnerable (evidence: ${finding?.evidence ?? "none"})`);
+        continue;
+    }
+
+    if (RCE_CVES.has(cveId)) {
+        const execOutput = finding.execOutput ?? "";
+        if (!RCE_OUTPUT_PATTERN.test(execOutput)) {
+            failures.push(
+                `${cveId}: vulnerable=true but execOutput doesn't look like real 'id' output: "${execOutput}"`
+            );
+        }
+    }
+
+    console.log(`[✓] ${cveId}: vulnerable (${finding.evidence.slice(0, 120)})`);
+}
+
+console.log();
+console.log(`[i] ${EXPECTED_CVES.length - failures.length} / ${EXPECTED_CVES.length} CVEs confirmed vulnerable.`);
+
+if (failures.length > 0) {
+    console.error();
+    console.error("[!] Exploit smoke test FAILED:");
+    for (const f of failures) {
+        console.error(`      - ${f}`);
+    }
+    process.exit(1);
+}
+
+console.log("[✓] Exploit smoke test PASSED.");

package/scripts/framework-detect-smoke-test.js

@@ -0,0 +1,64 @@
+#!/usr/bin/env node
+/**
+ * Smoke test: verifies that js-recon's `fingerprint` command detects the
+ * correct front-end framework for every lab app in the framework-detection
+ * matrix (js-recon-labs/detection/*).
+ *
+ * Usage:
+ *   node scripts/framework-detect-smoke-test.js [path-to-fingerprint-result.json]
+ *
+ * Default path: /tmp/fingerprint-result.json
+ */
+
+import { readFileSync } from "fs";
+import { resolve } from "path";
+
+const resultPath = process.argv[2] || "/tmp/fingerprint-result.json";
+const absolutePath = resolve(resultPath);
+
+let results;
+try {
+    results = JSON.parse(readFileSync(absolutePath, "utf-8"));
+} catch (err) {
+    console.error(`[!] Could not read ${absolutePath}: ${err.message}`);
+    console.error("    Make sure `js-recon fingerprint -f json` completed successfully before running this script.");
+    process.exit(1);
+}
+
+// URL -> expected framework name, matching js-recon-labs/detection/* app ports.
+const EXPECTED = {
+    "http://localhost:3010": "next",
+    "http://localhost:3011": "vue",
+    "http://localhost:3012": "nuxt",
+    "http://localhost:3013": "svelte",
+    "http://localhost:3014": "angular",
+    "http://localhost:3015": "react",
+    "http://localhost:3016": "react",
+};
+
+const detected = new Map(results.map((r) => [r.url, r.framework]));
+const rows = [];
+let failed = false;
+
+for (const [url, expected] of Object.entries(EXPECTED)) {
+    const actual = detected.get(url) ?? "unknown";
+    const ok = actual === expected;
+    if (!ok) failed = true;
+    rows.push({ url, expected, actual, ok });
+}
+
+console.log(`[i] Checked ${rows.length} lab apps.`);
+console.log();
+console.log("URL".padEnd(28), "Expected".padEnd(10), "Detected".padEnd(10), "Result");
+for (const { url, expected, actual, ok } of rows) {
+    console.log(url.padEnd(28), expected.padEnd(10), actual.padEnd(10), ok ? "OK" : "MISMATCH");
+}
+console.log();
+
+if (failed) {
+    const mismatches = rows.filter((r) => !r.ok).length;
+    console.error(`[!] ${mismatches} / ${rows.length} apps failed framework detection. Smoke test FAILED.`);
+    process.exit(1);
+}
+
+console.log(`[✓] All ${rows.length} apps detected correctly. Smoke test PASSED.`);