@js-recon/js-recon 1.4.4 → 2.0.1-alpha.2

package/build/completion/index.js

@@ -1,307 +1,38 @@
-import chalk from "chalk";
-const COMMANDS = [
-    "lazyload",
-    "endpoints",
-    "strings",
-    "proxy",
-    "map",
-    "refactor",
-    "analyze",
-    "report",
-    "run",
-    "load",
-    "fingerprint",
-    "mcp",
-    "cs-mast",
-    "sourcemaps",
-    "completion",
-];
-const FLAGS = {
-    lazyload: [
-        "-u",
-        "--url",
-        "-o",
-        "--output",
-        "--strict-scope",
-        "-s",
-        "--scope",
-        "-t",
-        "--threads",
-        "--subsequent-requests",
-        "--urls-file",
-        "--proxy-config",
-        "--ignore-proxy-env",
-        "--oxylabs-waf-fallback",
-        "--oxylabs-fallback-max-requests",
-        "--oxylabs-fallback-max-total",
-        "--oxylabs-fallback-max-origins",
-        "--cache-file",
-        "--disable-cache",
-        "--cache-only",
-        "-y",
-        "--yes",
-        "--timeout",
-        "-k",
-        "--insecure",
-        "--no-sandbox",
-        "--build-id",
-        "--sourcemap-dir",
-        "--research",
-        "--research-output",
-        "--max-iterations",
-        "--max-js-size",
-        "--lazyload-timeout",
-        "--detection-timeout",
-        "--max-pages",
-        "--include-methods",
-        "--exclude-methods",
-        "--list-methods",
-    ],
-    endpoints: [
-        "-u",
-        "--url",
-        "-d",
-        "--directory",
-        "-o",
-        "--output",
-        "--output-format",
-        "-t",
-        "--tech",
-        "-l",
-        "--list",
-        "--mapped-json",
-    ],
-    strings: [
-        "-d",
-        "--directory",
-        "-o",
-        "--output",
-        "-e",
-        "--extract-urls",
-        "--extracted-url-path",
-        "-p",
-        "--permutate",
-        "--openapi",
-        "-s",
-        "--scan-secrets",
-        "--trufflehog",
-    ],
-    proxy: [
-        "-i",
-        "--init",
-        "-d",
-        "--destroy",
-        "--destroy-all",
-        "-r",
-        "--region",
-        "--aws-access-key",
-        "--aws-secret-key",
-        "-c",
-        "--config",
-        "-l",
-        "--list",
-        "--feasibility",
-        "--feasibility-url",
-        "--proxy-method",
-        "--proxy",
-        "--oxylabs-username",
-        "--oxylabs-password",
-        "--oxylabs-country",
-        "--oxylabs-city",
-        "--oxylabs-session-id",
-    ],
-    map: [
-        "-d",
-        "--directory",
-        "-t",
-        "--tech",
-        "-l",
-        "--list",
-        "-o",
-        "--output",
-        "-f",
-        "--format",
-        "-i",
-        "--interactive",
-        "-c",
-        "--command",
-        "--ai",
-        "--ai-threads",
-        "--ai-provider",
-        "--ai-endpoint",
-        "--openai-api-key",
-        "--model",
-        "--openapi",
-        "--openapi-output",
-        "--openapi-chunk-tag",
-        "--no-graphql",
-        "--ngql",
-        "--max-recursion-depth",
-        "--max-heap",
-    ],
-    refactor: [
-        "-m",
-        "--mapped-json",
-        "-o",
-        "--output",
-        "-t",
-        "--tech",
-        "-l",
-        "--list",
-        "--collisions",
-        "--sq",
-        "--signature-quality",
-        "--refresh-cache",
-        "--skip-cache-checks",
-        "--no-remote",
-        "--remote-collisions",
-        "--scat",
-        "--detect-version",
-        "--detect-version-config",
-        "--detect-version-dynamic-threshold",
-        "--detect-version-dynamic-conf-purge",
-    ],
-    analyze: [
-        "-r",
-        "--rules",
-        "--disable-rules-version-check",
-        "-m",
-        "--mapped-json",
-        "-t",
-        "--tech",
-        "--openapi",
-        "-l",
-        "--list",
-        "--validate",
-        "-o",
-        "--output",
-    ],
-    report: [
-        "-s",
-        "--sqlite-db",
-        "-m",
-        "--mapped-json",
-        "-a",
-        "--analyze-json",
-        "-e",
-        "--endpoints-json",
-        "--map-openapi",
-        "--mapped-openapi-json",
-        "-o",
-        "--output",
-    ],
-    run: [
-        "-u",
-        "--url",
-        "-r",
-        "--rules",
-        "--disable-rules-version-check",
-        "-c",
-        "--command",
-        "-o",
-        "--output",
-        "--output-overwrite",
-        "--strict-scope",
-        "-s",
-        "--scope",
-        "-t",
-        "--threads",
-        "--proxy-config",
-        "--ignore-proxy-env",
-        "--proxy-waf-fallback",
-        "--oxylabs-waf-fallback",
-        "--oxylabs-fallback-max-requests",
-        "--oxylabs-fallback-max-total",
-        "--oxylabs-fallback-max-origins",
-        "--cache-file",
-        "--disable-cache",
-        "--cache-only",
-        "-y",
-        "--yes",
-        "--secrets",
-        "--trufflehog",
-        "--ai",
-        "--ai-threads",
-        "--ai-provider",
-        "--ai-endpoint",
-        "--openai-api-key",
-        "--model",
-        "--map-openapi-chunk-tag",
-        "--no-graphql",
-        "--ngql",
-        "--timeout",
-        "-k",
-        "--insecure",
-        "--no-sandbox",
-        "--sourcemap-dir",
-        "--research",
-        "--research-output",
-        "--max-iterations",
-        "--max-js-size",
-        "--lazyload-timeout",
-        "--detection-timeout",
-        "--max-heap",
-        "--max-pages",
-        "--include-methods",
-        "--exclude-methods",
-        "--list-methods",
-        "--cs-mast-tech-detect-threshold",
-        "--disable-refactor",
-    ],
-    load: ["-c", "--caido", "-u", "--url", "--cache-file"],
-    fingerprint: [
-        "-u",
-        "--url",
-        "-o",
-        "--output",
-        "-f",
-        "--format",
-        "-t",
-        "--threads",
-        "--timeout",
-        "-k",
-        "--insecure",
-        "--no-sandbox",
-    ],
-    mcp: [
-        "--cli",
-        "--server",
-        "-c",
-        "--chat",
-        "--config",
-        "--api-key",
-        "--model",
-        "--provider",
-        "--no-refresh-claude-creds",
-        "--claude-client-id",
-    ],
-    "cs-mast": [
-        "-o",
-        "--output",
-        "--ct",
-        "--collision-table",
-        "--min-collisions",
-        "--co",
-        "--collision-output",
-        "--cf",
-        "--collision-format",
-        "--scat",
-        "--sinc",
-        "--all-scat-permutations",
-        "--perm-output",
-        "--perm-concurrency",
-    ],
-    sourcemaps: ["-i", "--input", "-o", "--output"],
-    completion: ["bash", "zsh", "fish"],
-};
-function generateBashCompletion() {
-    const cmdList = COMMANDS.join(" ");
-    const cmdPattern = COMMANDS.join("|");
-    const caseBranches = Object.entries(FLAGS)
-        .map(([cmd, flags]) => `        ${cmd})\n            opts="${flags.join(" ")}"\n            ;;`)
-        .join("\n");
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { printMsg, MSG } from "../utility/printMsg.js";
+import { buildProgram } from "../cliProgram.js";
+import { buildCommandTree } from "./introspect.js";
+function bashLeafOpts(node) {
+    return [...node.options.flatMap((o) => o.flags), ...node.argumentChoices].join(" ");
+}
+// Recursively emits nested `case` blocks so multi-level subcommands (e.g. `proxy aws`) get their
+// own flags completed, not just the parent's child-name list. `wordIndex` is the COMP_WORDS index
+// this node's name occupies (1 for top-level commands, 2 for their children, and so on).
+function generateBashCaseBranch(node, wordIndex) {
+    const indent = "    ".repeat(wordIndex + 1);
+    if (node.subcommands.length === 0) {
+        return `${indent}${node.name})
+${indent}    opts="${bashLeafOpts(node)}"
+${indent}    ;;`;
+    }
+    const childBranches = node.subcommands.map((child) => generateBashCaseBranch(child, wordIndex + 1)).join("\n");
+    const childNames = node.subcommands.map((c) => c.name).join(" ");
+    return `${indent}${node.name})
+${indent}    case "\${words[${wordIndex + 1}]:-}" in
+${childBranches}
+${indent}        *)
+${indent}            opts="${childNames}"
+${indent}            ;;
+${indent}    esac
+${indent}    ;;`;
+}
+function generateBashCompletion(tree) {
+    const cmdList = tree.map((n) => n.name).join(" ");
+    const caseBranches = tree.map((node) => generateBashCaseBranch(node, 1)).join("\n");
     return `# js-recon bash completion
-# Add to ~/.bashrc:  eval "$(js-recon completion bash)"
+# Installed automatically by: js-recon completion bash
 _js_recon_completion() {
     local cur prev words cword opts
     COMPREPLY=()
@@ -310,25 +41,13 @@ _js_recon_completion() {
     words=("\${COMP_WORDS[@]}")
     cword=\${COMP_CWORD}
 
-    if [[ \${prev} == "--config" ]]; then
-        COMPREPLY=( \$(compgen -f -- "\${cur}") )
-        return 0
-    fi
-
-    local cmd=""
-    local word
-    for word in "\${words[@]}"; do
-        case "\${word}" in
-            ${cmdPattern}) cmd="\${word}"; break ;;
-        esac
-    done
-    if [[ -z \${cmd} ]]; then
-        COMPREPLY=( \$(compgen -W "--config ${cmdList}" -- "\${cur}") )
+    if [[ \${cword} -eq 1 ]]; then
+        COMPREPLY=( \$(compgen -W "${cmdList}" -- "\${cur}") )
         return 0
     fi
 
     opts=""
-    case "\${cmd}" in
+    case "\${words[1]}" in
 ${caseBranches}
     esac
 
@@ -338,34 +57,88 @@ ${caseBranches}
 complete -F _js_recon_completion js-recon
 `;
 }
-function generateZshCompletion() {
-    const commandDescriptions = [
-        "'lazyload:Run lazy load module'",
-        "'endpoints:Extract client-side endpoints'",
-        "'strings:Extract strings from JS files'",
-        "'proxy:Manage proxy configuration (AWS API Gateway IP rotation, SOCKS/HTTP, Oxylabs)'",
-        "'map:Map all the functions'",
-        "'refactor:Refactor the code'",
-        "'analyze:Analyze the code'",
-        "'report:Generate a report'",
-        "'run:Run all modules'",
-        "'load:Populate response cache from a Caido/Burp request history export'",
-        "'fingerprint:Detect front-end frameworks across one or more URLs'",
-        "'mcp:AI-powered CLI / one-shot chat / MCP server'",
-        "'cs-mast:Compute CS-MAST hashes for downloaded JS files'",
-        "'sourcemaps:Extract source files from .map sourcemap file(s)'",
-        "'completion:Generate shell completion scripts'",
-    ].join("\n                ");
-    const caseBranches = Object.entries(FLAGS)
-        .map(([cmd, flags]) => {
-        const flagArgs = flags.map((f) => `'${f}'`).join(" ");
-        return `                (${cmd})\n                    _arguments '*: :(${flagArgs})'\n                    ;;`;
+// zsh escaping: backslash first, then compsys metacharacters, then the shell-level single-quote
+// trick last (since every spec string here is wrapped in '...').
+function zshBracketDesc(desc) {
+    return desc.replace(/\\/g, "\\\\").replace(/\]/g, "\\]").replace(/\[/g, "\\[").replace(/'/g, "'\\''");
+}
+// Used inside `_describe` `name:description` arrays, where `:` is the field delimiter.
+function zshDescribeDesc(desc) {
+    return desc.replace(/\\/g, "\\\\").replace(/:/g, "\\:").replace(/'/g, "'\\''");
+}
+function zshOptionSpec(option) {
+    const desc = zshBracketDesc(option.description);
+    const short = option.flags.find((f) => f.length === 2 && f.startsWith("-") && !f.startsWith("--"));
+    const long = option.flags.find((f) => f.startsWith("--"));
+    if (short && long)
+        return `'(${short} ${long})'{${short},${long}}'[${desc}]'`;
+    if (long)
+        return `'${long}[${desc}]'`;
+    if (short)
+        return `'${short}[${desc}]'`;
+    return "";
+}
+function zshDescribeEntry(node) {
+    return `'${node.name}:${zshDescribeDesc(node.description)}'`;
+}
+function zshLeafArguments(node) {
+    const parts = [];
+    if (node.argumentChoices.length > 0) {
+        parts.push(`'1: :(${node.argumentChoices.join(" ")})'`);
+    }
+    parts.push(...node.options.map(zshOptionSpec).filter(Boolean));
+    if (parts.length === 0)
+        return ":";
+    return `_arguments ${parts.join(" ")}`;
+}
+// Recursively emits a nested `_arguments -C` + `case $state` block for a level of subcommands.
+// Reusing the generic `cmd`/`args` state labels at every nesting level is safe here because each
+// `_arguments -C` call is evaluated strictly before the `case $state` that reads its result — by
+// the time a nested level's `$state` is inspected, the outer level's value is no longer needed.
+function zshSubcommandBlock(nodes, describeTag) {
+    const entries = nodes.map(zshDescribeEntry).join("\n                                ");
+    const branches = nodes
+        .map((node) => {
+        const body = node.subcommands.length > 0 ? zshSubcommandBlock(node.subcommands, node.name) : zshLeafArguments(node);
+        return `                                (${node.name})
+                                    ${body}
+                                    ;;`;
+    })
+        .join("\n");
+    return `_arguments -C \\
+                        '1: :->cmd' \\
+                        '*::arg:->args'
+
+                    case \$state in
+                        cmd)
+                            local -a items
+                            items=(
+                                ${entries}
+                            )
+                            _describe -t items '${describeTag}' items
+                            ;;
+                        args)
+                            case \$line[1] in
+${branches}
+                            esac
+                            ;;
+                    esac`;
+}
+function generateZshCompletion(tree) {
+    const commandDescriptions = tree.map(zshDescribeEntry).join("\n                ");
+    const caseBranches = tree
+        .map((node) => {
+        const body = node.subcommands.length > 0
+            ? zshSubcommandBlock(node.subcommands, `${node.name} subcommand`)
+            : zshLeafArguments(node);
+        return `                (${node.name})
+                    ${body}
+                    ;;`;
     })
         .join("\n");
     return `#compdef js-recon
 # js-recon zsh completion
-# Add to ~/.zshrc:  eval "$(js-recon completion zsh)"
-# Or:               js-recon completion zsh > "\${fpath[1]}/_js-recon"
+# Installed automatically by: js-recon completion zsh
 
 _js_recon() {
     local state line
@@ -374,7 +147,6 @@ _js_recon() {
     _arguments -C \\
         '(-h --help)'{-h,--help}'[Show help]' \\
         '(-V --version)'{-V,--version}'[Show version]' \\
-        '--config[Application YAML config]:file:_files' \\
         '1: :->command' \\
         '*: :->args'
 
@@ -397,40 +169,55 @@ ${caseBranches}
 _js_recon "\$@"
 `;
 }
-function generateFishCompletion() {
-    const cmdCompletions = COMMANDS.map((cmd) => `complete -c js-recon -f -n '__fish_use_subcommand' -a ${cmd}`).join("\n");
-    const flagCompletions = Object.entries(FLAGS)
-        .flatMap(([cmd, flags]) => flags.map((flag) => {
-        if (flag.startsWith("--")) {
-            return `complete -c js-recon -n '__fish_seen_subcommand_from ${cmd}' -l ${flag.slice(2)}`;
+function fishDesc(desc) {
+    return desc.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
+}
+function fishConditionForPath(namePath) {
+    return namePath.map((name) => `__fish_seen_subcommand_from ${name}`).join("; and ");
+}
+// Recursively emits `complete` lines for a node's own flags/argument choices (gated on the full
+// name path having been seen so far) and, for each child, both a name-completion at this level
+// and a recursive call so the child's own flags are completed too (e.g. `proxy aws --<tab>`).
+function generateFishNode(node, parentPath) {
+    const namePath = [...parentPath, node.name];
+    const cond = fishConditionForPath(namePath);
+    const lines = [];
+    for (const option of node.options) {
+        const short = option.flags.find((f) => f.length === 2 && f.startsWith("-") && !f.startsWith("--"));
+        const long = option.flags.find((f) => f.startsWith("--"));
+        const desc = fishDesc(option.description);
+        if (short && long) {
+            lines.push(`complete -c js-recon -n '${cond}' -s ${short.slice(1)} -l ${long.slice(2)} -d '${desc}'`);
+        }
+        else if (long) {
+            lines.push(`complete -c js-recon -n '${cond}' -l ${long.slice(2)} -d '${desc}'`);
         }
-        else if (flag.startsWith("-") && flag.length === 2) {
-            return `complete -c js-recon -n '__fish_seen_subcommand_from ${cmd}' -s ${flag.slice(1)}`;
+        else if (short) {
+            lines.push(`complete -c js-recon -n '${cond}' -s ${short.slice(1)} -d '${desc}'`);
         }
-        // positional (e.g. shell names for 'completion' subcommand)
-        return `complete -c js-recon -n '__fish_seen_subcommand_from ${cmd}' -a ${flag}`;
-    }))
+    }
+    if (node.argumentChoices.length > 0) {
+        lines.push(`complete -c js-recon -n '${cond}' -a '${node.argumentChoices.join(" ")}'`);
+    }
+    for (const child of node.subcommands) {
+        lines.push(`complete -c js-recon -f -n '${cond}' -a ${child.name} -d '${fishDesc(child.description)}'`);
+        lines.push(...generateFishNode(child, namePath));
+    }
+    return lines;
+}
+function generateFishCompletion(tree) {
+    const cmdCompletions = tree
+        .map((node) => `complete -c js-recon -f -n '__fish_use_subcommand' -a ${node.name} -d '${fishDesc(node.description)}'`)
         .join("\n");
+    const flagCompletions = tree.flatMap((node) => generateFishNode(node, [])).join("\n");
     return `# js-recon fish completion
-# Save to: ~/.config/fish/completions/js-recon.fish
-# Or run: js-recon completion fish > ~/.config/fish/completions/js-recon.fish
+# Installed automatically by: js-recon completion fish
+# (written to ~/.config/fish/completions/js-recon.fish, which fish auto-loads)
 
 function __fish_use_subcommand
     set -l cmd (commandline -poc)
     set -e cmd[1]
-    set -l skip_next 0
     for c in $cmd
-        if test $skip_next -eq 1
-            set skip_next 0
-            continue
-        end
-        if test "$c" = "--config"
-            set skip_next 1
-            continue
-        end
-        if string match -q -- '--config=*' "$c"
-            continue
-        end
         if string match -qr '^[^-]' -- $c
             return 1
         end
@@ -451,29 +238,107 @@ end
 
 ${cmdCompletions}
 
-complete -c js-recon -l config -r -F
-
 ${flagCompletions}
 `;
 }
-export default function completion(shell) {
-    if (!shell) {
-        console.error(chalk.red("[!] Shell type required. Usage: js-recon completion <bash|zsh|fish>"));
-        process.exit(1);
+const RC_MARKER = "# JS Recon shell completion";
+function getCompletionDir() {
+    return path.join(os.homedir(), ".js-recon", "completion");
+}
+function getFishCompletionsDir() {
+    return path.join(os.homedir(), ".config", "fish", "completions");
+}
+// Path each shell's full generated script gets written to. Fish uses its own
+// auto-loaded completions dir instead of ~/.js-recon, so it needs no rc-file entry.
+function getInstalledScriptPath(shell) {
+    switch (shell) {
+        case "bash":
+            return path.join(getCompletionDir(), "js-recon.bash");
+        case "zsh":
+            return path.join(getCompletionDir(), "_js-recon");
+        case "fish":
+            return path.join(getFishCompletionsDir(), "js-recon.fish");
+        default:
+            throw new Error(`Unknown shell: ${shell}`);
+    }
+}
+function getRcFilePath(shell) {
+    return path.join(os.homedir(), shell === "bash" ? ".bashrc" : ".zshrc");
+}
+// Small snippet printed for `--rc-file` — this is what actually goes in the user's rc file
+// (via `eval "$(js-recon completion <shell> --rc-file)"`), pointing at the full script on disk.
+function generateRcFileLoader(shell) {
+    const importantHeader = `# IMPORTANT: the contents of this command are expected to be present in
+# the shell's rc file, invoked as \`eval "$(js-recon completion ${shell} --rc-file)"\`.
+# Run \`js-recon completion ${shell}\` to (re)install.`;
+    if (shell === "bash") {
+        return `${importantHeader}
+if [ -f "$HOME/.js-recon/completion/js-recon.bash" ]; then
+    source "$HOME/.js-recon/completion/js-recon.bash"
+fi
+`;
     }
-    switch (shell.toLowerCase()) {
+    return `${importantHeader}
+fpath=("$HOME/.js-recon/completion" $fpath)
+autoload -Uz compinit
+compinit
+`;
+}
+function generateCompletionScript(shell) {
+    const tree = buildCommandTree(buildProgram());
+    switch (shell) {
         case "bash":
-            process.stdout.write(generateBashCompletion());
-            break;
+            return generateBashCompletion(tree);
         case "zsh":
-            process.stdout.write(generateZshCompletion());
-            break;
+            return generateZshCompletion(tree);
         case "fish":
-            process.stdout.write(generateFishCompletion());
-            break;
+            return generateFishCompletion(tree);
         default:
-            console.error(chalk.red(`[!] Unknown shell: "${shell}". Supported shells: bash, zsh, fish`));
+            throw new Error(`Unknown shell: ${shell}`);
+    }
+}
+// Writes the full script to disk and, for bash/zsh, wires a tiny loader entry into the
+// user's rc file (idempotent — checks RC_MARKER before appending).
+function installCompletion(shell) {
+    const scriptPath = getInstalledScriptPath(shell);
+    fs.mkdirSync(path.dirname(scriptPath), { recursive: true });
+    fs.writeFileSync(scriptPath, generateCompletionScript(shell));
+    if (shell === "fish") {
+        printMsg(MSG.Run, `[+] Installed fish completion to ${scriptPath}`);
+        printMsg(MSG.Run, "[+] Fish auto-loads this — no further action needed.");
+        return;
+    }
+    const rcPath = getRcFilePath(shell);
+    const rcContent = fs.existsSync(rcPath) ? fs.readFileSync(rcPath, "utf8") : "";
+    if (rcContent.includes(RC_MARKER)) {
+        printMsg(MSG.Run, `[+] Installed ${shell} completion to ${scriptPath}`);
+        printMsg(MSG.Run, `[+] ${rcPath} already wired for js-recon completion.`);
+        return;
+    }
+    const entry = `\n${RC_MARKER}\neval "$(js-recon completion ${shell} --rc-file)"\n`;
+    fs.appendFileSync(rcPath, entry);
+    printMsg(MSG.Run, `[+] Installed ${shell} completion to ${scriptPath}`);
+    printMsg(MSG.Run, `[+] Added completion loader to ${rcPath}`);
+    printMsg(MSG.Run, `[+] Restart your shell or run: source ${rcPath}`);
+}
+export default function completion(shell, rcFile) {
+    if (!shell) {
+        printMsg(MSG.Err, "[!] Shell type required. Usage: js-recon completion <bash|zsh|fish>");
+        process.exit(1);
+    }
+    const normalizedShell = shell.toLowerCase();
+    if (normalizedShell !== "bash" && normalizedShell !== "zsh" && normalizedShell !== "fish") {
+        printMsg(MSG.Err, `[!] Unknown shell: "${shell}". Supported shells: bash, zsh, fish`);
+        process.exit(1);
+    }
+    if (rcFile) {
+        if (normalizedShell === "fish") {
+            printMsg(MSG.Err, '[!] --rc-file is not applicable to fish; fish auto-loads completions from "~/.config/fish/completions/".');
             process.exit(1);
+        }
+        process.stdout.write(generateRcFileLoader(normalizedShell));
+        return;
     }
+    installCompletion(normalizedShell);
 }
 //# sourceMappingURL=index.js.map