@jshookmcp/jshook 0.1.2 → 0.1.4

package/README.md

@@ -1,4 +1,4 @@
-# @jshookmcp/jshook
+# @jshookmcp/jshook
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 [![Node.js >= 20](https://img.shields.io/badge/node-%3E%3D20-brightgreen.svg)](https://nodejs.org/)
@@ -8,7 +8,7 @@
 
 English | [中文](./README.zh.md)
 
-An MCP (Model Context Protocol) server providing **242 built-in tools** — **234 domain tools across 16 domains** plus **8 built-in meta-tools** — with runtime extension loading from `plugins/` and `workflows/` for AI-assisted JavaScript analysis and security analysis. Combines browser automation, Chrome DevTools Protocol debugging, network monitoring, intelligent JavaScript hooks, LLM-powered code analysis, process/memory inspection, WASM toolchain, binary encoding, anti-anti-debug, GraphQL discovery, source map reconstruction, AST transforms, crypto reconstruction, platform package analysis, Burp Suite / native analysis tool bridges, human behavior simulation, CAPTCHA solving, batch account workflows, and high-level composite workflow orchestration in a single server.
+An MCP (Model Context Protocol) server providing **242 built-in tools** — **234 domain tools across 16 domains** plus **8 built-in meta-tools** — with runtime extension loading from `plugins/` and `workflows/` for AI-assisted JavaScript analysis and security analysis. Combines browser automation, Chrome DevTools Protocol debugging, network monitoring, intelligent JavaScript hooks, LLM-powered code analysis, process/memory inspection, WASM toolchain, binary encoding, anti-anti-debug, GraphQL discovery, source map reconstruction, AST transforms, crypto reconstruction, platform package analysis, Burp Suite / native analysis tool bridges, human behavior simulation, CAPTCHA solving, batch account workflows, and high-level composite workflow orchestration in a single server.
 
 ## Features
 
@@ -21,7 +21,7 @@ An MCP (Model Context Protocol) server providing **242 built-in tools** — **23
 - **HAR Export / Request Replay** — Export captured traffic as HAR 1.2; replay any captured request with header/body/method overrides and SSRF-safe execution
 - **Tab Workflow** — Multi-tab coordination with named aliases and shared key-value context
 - **Composite Workflows** — Single-call orchestration tools (`web_api_capture_session`, `register_account_flow`, `api_probe_batch`, `js_bundle_search`) that chain navigation, DOM actions, network capture, and auth extraction into atomic operations
-- **Script Library** — Named reusable JavaScript snippets (`page_script_register` / `page_script_run`) with built-in analysis presets
+- **Script Library** — Named reusable JavaScript snippets (`page_script_register` / `page_script_run`) with built-in analysis presets
 - **Progressive Tool Discovery** — BM25-based `search_tools` meta-tool searches built-in + currently loaded extension tools by keyword (total is dynamic); `activate_tools` / `deactivate_tools` for individual tools; `activate_domain` for bulk domain activation; `boost_profile` / `unboost_profile` for tier-level upgrades with auto-expiring TTL
 - **JavaScript Hooks** — AI-generated hooks for any function, 20+ built-in presets (eval, crypto, atob, WebAssembly, etc.)
 - **Code Analysis** — Deobfuscation (JScrambler, JSVMP, packer), crypto algorithm detection, LLM-powered understanding
@@ -41,7 +41,7 @@ An MCP (Model Context Protocol) server providing **242 built-in tools** — **23
 - **CAPTCHA Handling** — AI vision detection, manual solve flow, configurable polling, 2captcha provider integration, Cloudflare Turnstile solving (hook / manual / API), per-provider API key isolation
 - **Human Behavior Simulation** — Bezier-curve mouse movement, natural scrolling with deceleration, realistic typing with typo simulation; all parameters runtime-clamped for safety
 - **Burp Suite Bridge** — Proxy status, intercept-and-replay, HAR import/diff, send-to-repeater; SSRF-protected loopback-only endpoints
-- **Native Analysis Tool Bridge** — Ghidra and IDA Pro bridge: decompile functions, list symbols, run scripts, cross-reference analysis; loopback-only SSRF protection
+- **Native Analysis Tool Bridge** — Ghidra and IDA Pro bridge: decompile functions, list symbols, run scripts, cross-reference analysis; loopback-only SSRF protection
 - **Batch Account Registration** — Orchestrate multi-account registration with per-account retry, capped exponential backoff, idempotent key deduplication, PII masking, timeout cleanup
 - **Stealth Injection** — Anti-detection patches for headless browser fingerprinting
 - **Process & Memory** — Cross-platform process enumeration, memory read/write/scan, DLL/shellcode injection (Windows), Electron app attachment
@@ -56,8 +56,8 @@ Built on `@modelcontextprotocol/sdk` v1.27+ using the **McpServer high-level API
 
 - All tools registered via `server.registerTool()` — no manual request handlers
 - Tool schemas built dynamically from JSON Schema (input validated per-tool by domain handlers)
-- **Four tool profiles**: `search` (BM25 discovery), `minimal` (fast startup), `workflow` (end-to-end JavaScript and security analysis), `full` (all domains)
-- **Progressive discovery**: `search` profile exposes 10 maintenance-domain tools + 8 built-in meta-tools; `search_tools` covers built-ins plus loaded plugins/workflows, and workflow-tier sessions boost workflow-domain results
+- **Four tool profiles**: `search` (BM25 discovery), `minimal` (fast startup), `workflow` (end-to-end JavaScript and security analysis), `full` (all domains)
+- **Progressive discovery**: `search` profile exposes 10 maintenance-domain tools + 8 built-in meta-tools; `search_tools` covers built-ins plus loaded plugins/workflows, and workflow/full-tier sessions boost workflow-domain results
 - **Domain self-discovery**: at startup the registry scans `domains/*/manifest.ts` via dynamic ESM import — new domains are auto-detected without modifying any central file
 - **DomainManifest contract**: each domain exports a standardized manifest (`kind`, `version`, `domain`, `depKey`, `profiles`, `registrations`, `ensure`) — profile membership, tool definitions, and handler factories all co-located in one file
 - **Lazy domain initialization**: handler classes instantiated on first tool invocation via Proxy, not during init
@@ -68,18 +68,35 @@ Built on `@modelcontextprotocol/sdk` v1.27+ using the **McpServer high-level API
 ## Requirements
 
 - Node.js >= 20
-- pnpm
+- npm (for global installation)
+- pnpm (only if you want to build from source)
 
 ## Installation
 
-### Default (Puppeteer only)
+### Recommended: Run with npx
+
+```bash
+npx @jshookmcp/jshook
+```
+
+This is the recommended way to use the package if you just want to run the MCP server without managing a global install.
+
+### Optional: Global install
+
+```bash
+npm install -g @jshookmcp/jshook
+```
+
+This installs the `jshook` and `jshookmcp` commands globally, but `npx` is preferred for most users.
+
+### From source (development / local hacking)
 
 ```bash
 pnpm install
 pnpm build
 ```
 
-### Full (Puppeteer + Camoufox)
+### From source with Camoufox
 
 ```bash
 pnpm run install:full
@@ -105,48 +122,23 @@ On Windows, common cache locations are:
 
 ## Configuration
 
-Copy `.env.example` to `.env` and fill in your values:
+If you are running from source, copy `.env.example` to `.env` and fill in your values:
 
 ```bash
 cp .env.example .env
 ```
 
-Key variables:
-
-| Variable | Description | Default |
-|----------|-------------|---------|
-| `DEFAULT_LLM_PROVIDER` | `openai` or `anthropic` | `openai` |
-| `OPENAI_API_KEY` | OpenAI (or compatible) API key | — |
-| `OPENAI_BASE_URL` | Base URL for OpenAI-compatible endpoint | `https://api.openai.com/v1` |
-| `OPENAI_MODEL` | Model name | `gpt-4-turbo-preview` |
-| `ANTHROPIC_API_KEY` | Anthropic API key | — |
-| `PUPPETEER_HEADLESS` | Run browser in headless mode | `false` |
-| `PUPPETEER_EXECUTABLE_PATH` | Optional browser executable path | Puppeteer managed |
-| `LOG_LEVEL` | Logging verbosity (`debug`, `info`, `warn`, `error`) | `info` |
-| `MCP_TRANSPORT` | Transport mode: `stdio` or `http` | `stdio` |
-| `MCP_PORT` | HTTP port (only when `MCP_TRANSPORT=http`) | `3000` |
-| `MCP_HOST` | HTTP bind address | `127.0.0.1` |
-| `MCP_TOOL_PROFILE` | Tool profile: `search`, `minimal`, `full`, or `workflow` | `minimal` |
-| `MCP_TOOL_DOMAINS` | Comma-separated domain override | — |
-| `MCP_AUTH_TOKEN` | Bearer token for HTTP transport auth | — |
-| `MCP_MAX_BODY_BYTES` | HTTP request body size limit (bytes) | `10485760` (10 MB) |
-| `MCP_ALLOW_INSECURE` | Allow non-localhost HTTP without auth token | `false` |
-| `MCP_SCREENSHOT_DIR` | Screenshot base directory (normalized under project root) | `screenshots/manual` |
-| `BURP_ADAPTER_URL` | Burp Suite REST API adapter endpoint (loopback only) | `http://127.0.0.1:18443` |
-| `GHIDRA_BRIDGE_URL` | Ghidra bridge server endpoint (loopback only) | `http://127.0.0.1:18080` |
-| `IDA_BRIDGE_URL` | IDA Pro bridge server endpoint (loopback only) | `http://127.0.0.1:18081` |
-| `CAPTCHA_PROVIDER` | Default CAPTCHA provider: `manual`, `2captcha`, or `none` | `manual` |
-| `CAPTCHA_API_KEY` | API key for external CAPTCHA solving services | — |
-
-### Profiles
+If you installed the package globally, you can provide the same settings through your shell environment or your MCP client configuration.
+
+Key variables from `.env.example`:\n\n| Variable | Description | Default / Example |\n|----------|-------------|-------------------|\n| `DEFAULT_LLM_PROVIDER` | Active LLM provider: `openai` or `anthropic` | `openai` |\n| `OPENAI_API_KEY` | OpenAI-compatible API key | — |\n| `OPENAI_MODEL` | OpenAI-compatible model name | `gpt-4-turbo-preview` |\n| `OPENAI_BASE_URL` | OpenAI-compatible base URL | `https://api.openai.com/v1` |\n| `ANTHROPIC_API_KEY` | Anthropic API key | — |\n| `ANTHROPIC_MODEL` | Anthropic model name | `claude-3-5-sonnet-20241022` |\n| `PUPPETEER_HEADLESS` | Run the browser in headless mode | `true` in `.env.example` |\n| `PUPPETEER_TIMEOUT` | Default Puppeteer timeout in milliseconds | `30000` |\n| `PUPPETEER_EXECUTABLE_PATH` | Optional explicit browser executable path | commented example |\n| `MCP_SERVER_NAME` | Server name advertised by the process | `jshookmcp` |\n| `MCP_SERVER_VERSION` | Server version advertised by the process | `0.1.0` in `.env.example` |\n| `MCP_TOOL_PROFILE` | Tool profile: `search`, `minimal`, `workflow`, or `full` | commented example: `minimal` |\n| `MCP_TOOL_DOMAINS` | Comma-separated domain override; takes precedence over `MCP_TOOL_PROFILE` | commented example |\n| `LOG_LEVEL` | Logging verbosity (`debug`, `info`, `warn`, `error`) | `info` |\n| `ENABLE_CACHE` | Enable disk-backed caching | `true` |\n| `CACHE_DIR` | Cache directory | `.cache` |\n| `CACHE_TTL` | Cache TTL in seconds | `3600` |\n| `MAX_CONCURRENT_ANALYSIS` | Max concurrent analysis jobs | `3` |\n| `MAX_CODE_SIZE_MB` | Max code payload size for analysis | `10` |\n| `CAPTCHA_SCREENSHOT_DIR` | Fallback CAPTCHA screenshot directory | `./screenshots` |\n| `MCP_SCREENSHOT_DIR` | Screenshot output root constrained inside project root | commented example: `./screenshots/manual` |\n| `MCP_PLUGIN_ROOTS` | Comma-separated plugin roots | commented example: `./plugins,./dist/plugins` |\n| `MCP_WORKFLOW_ROOTS` | Comma-separated workflow roots | commented example: `./workflows` |\n| `MCP_DEFAULT_PLUGIN_BOOST_TIER` | Default tier for plugin auto-registration during boost | commented example: `full` |\n| `BURP_MCP_SSE_URL` | Burp SSE bridge URL | commented example |\n| `BURP_MCP_AUTH_TOKEN` | Optional Burp SSE auth token | commented example |\n| `ZAP_API_URL` | OWASP ZAP REST endpoint | commented example |\n| `ZAP_API_KEY` | OWASP ZAP API key | commented example |\n| `GHIDRA_BRIDGE_URL` | Ghidra bridge endpoint | commented example: `http://127.0.0.1:18080` |\n| `IDA_BRIDGE_URL` | IDA bridge endpoint | commented example: `http://127.0.0.1:18081` |\n| `EXTENSION_REGISTRY_BASE_URL` | Extension registry base URL used by `browse_extension_registry` / `install_extension` | `https://raw.githubusercontent.com/vmoranv/jshookmcpextension/master/registry` |\n\nAdditional runtime options exist in code but are not enabled by default in `.env.example`, such as `MCP_PORT`, `MCP_HOST`, `MCP_AUTH_TOKEN`, `MCP_MAX_BODY_BYTES`, and `MCP_ALLOW_INSECURE`.\n\n### Profiles
 
 | Profile | Domains | Tools | Init Tokens | vs Full |
 |---------|---------|-------|-------------|---------|
-| `search` | maintenance | 18 (10 domain + 8 meta) | ~3,096 | 7% |
-| `minimal` | browser, maintenance | 78 (70 domain + 8 meta) | ~13,416 | 32% |
-| `workflow` | browser, network, workflow, maintenance, core, debugger, streaming, encoding, graphql | 179 (171 domain + 8 meta) | ~30,788 | 74% |
-| `full` | all 16 domains | 242 (234 domain + 8 meta) | ~41,624 | 100% |
-> Token counts are rough estimates derived from the previous `claude /doctor` average of ~172 tokens/tool. All profiles include 8 meta-tools: `search_tools`, `activate_tools`, `deactivate_tools`, `activate_domain`, `boost_profile`, `unboost_profile`, `extensions_list`, `extensions_reload`.
+| `search` | maintenance | 18 (10 domain + 8 meta) | ~3,096 | 7% |
+| `minimal` | browser, maintenance | 78 (70 domain + 8 meta) | ~13,416 | 32% |
+| `workflow` | browser, network, workflow, maintenance, core, debugger, streaming, encoding, graphql | 179 (171 domain + 8 meta) | ~30,788 | 74% |
+| `full` | all 16 domains | 242 (234 domain + 8 meta) | ~41,624 | 100% |
+> Token counts are rough estimates derived from the previous `claude /doctor` average of ~172 tokens/tool. All profiles include 8 meta-tools: `search_tools`, `activate_tools`, `deactivate_tools`, `activate_domain`, `boost_profile`, `unboost_profile`, `extensions_list`, `extensions_reload`.
 
 > If `MCP_TOOL_DOMAINS` is set, it overrides `MCP_TOOL_PROFILE`.
 
@@ -154,19 +146,19 @@ Examples:
 
 ```bash
 # Search-based progressive discovery (recommended for context-constrained LLMs)
-MCP_TOOL_PROFILE=search node dist/index.js
+MCP_TOOL_PROFILE=search jshook
 
 # Lean local MCP profile
-MCP_TOOL_PROFILE=minimal node dist/index.js
+MCP_TOOL_PROFILE=minimal jshook
 
-# Full JavaScript analysis + composite workflow profile
-MCP_TOOL_PROFILE=workflow node dist/index.js
+# Full JavaScript analysis + composite workflow profile
+MCP_TOOL_PROFILE=workflow jshook
 
-# Only keep browser and maintenance tools
-MCP_TOOL_DOMAINS=browser,maintenance node dist/index.js
+# Only keep browser and maintenance tools
+MCP_TOOL_DOMAINS=browser,maintenance jshook
 
 # HTTP mode with auth
-MCP_TRANSPORT=http MCP_AUTH_TOKEN=mysecret node dist/index.js
+MCP_TRANSPORT=http MCP_AUTH_TOKEN=mysecret jshook
 ```
 
 ## MCP Client Setup
@@ -176,23 +168,22 @@ MCP_TRANSPORT=http MCP_AUTH_TOKEN=mysecret node dist/index.js
 ```json
 {
   "mcpServers": {
-    "jshook": {
-      "command": "node",
-      "args": ["path/to/@jshookmcp/jshook/dist/index.js"],
+    "jshook": {
+      "command": "jshook",
       "env": {
-        "OPENAI_API_KEY": "your-key",
-        "OPENAI_BASE_URL": "https://api.openai.com/v1",
-        "OPENAI_MODEL": "gpt-4-turbo-preview"
+        "OPENAI_API_KEY": "your-key"
       }
     }
   }
 }
 ```
 
+Set `OPENAI_MODEL` or `OPENAI_BASE_URL` only if you need to override the defaults. If you plan to use image-heavy tools (for example CAPTCHA vision workflows), choose a vision-capable model explicitly rather than treating it as the default for every installation.
+
 ### Streamable HTTP (remote / MCP current revision)
 
 ```bash
-MCP_TRANSPORT=http MCP_PORT=3000 node dist/index.js
+MCP_TRANSPORT=http MCP_PORT=3000 jshook
 ```
 
 Connect your MCP client to `http://localhost:3000/mcp`. The server supports:
@@ -203,7 +194,7 @@ Connect your MCP client to `http://localhost:3000/mcp`. The server supports:
 
 Session IDs are issued via the `Mcp-Session-Id` response header.
 
-## Tool Domains (234 Domain Tools)
+## Tool Domains (234 Domain Tools)
 
 ### Core / Analysis (13 tools)
 
@@ -457,7 +448,7 @@ Session IDs are issued via the `Mcp-Session-Id` response header.
 ### Workflow / Composite (7 tools)
 
 <details>
-<summary>High-level orchestration for full-chain JavaScript analysis and security analysis tasks, plus batch operations</summary>
+<summary>High-level orchestration for full-chain JavaScript analysis and security analysis tasks, plus batch operations</summary>
 
 | # | Tool | Description |
 |---|------|-------------|
@@ -592,7 +583,7 @@ Session IDs are issued via the `Mcp-Session-Id` response header.
 
 </details>
 
-### Native Analysis Tool Bridge (4 tools)
+### Native Analysis Tool Bridge (4 tools)
 
 <details>
 <summary>Ghidra and IDA Pro bridge: decompilation, symbol lookup, script execution, cross-reference analysis</summary>
@@ -643,11 +634,11 @@ Session IDs are issued via the `Mcp-Session-Id` response header.
 
 | # | Tool | Description |
 |---|------|-------------|
-| 1 | `search_tools` | *(meta-tool)* BM25 keyword search across built-in tools + loaded plugin/workflow tools; in `workflow` tier, workflow-domain matches receive a ranking boost |
+| 1 | `search_tools` | *(meta-tool)* BM25 keyword search across built-in tools + loaded plugin/workflow tools; in `workflow/full` tiers, workflow-domain matches receive a ranking boost. When extension workflows are loaded, `run_extension_workflow` / `list_extension_workflows` get extra ranking weight (especially for register/captcha/keygen-style intents). |
 | 2 | `activate_tools` | *(meta-tool)* Dynamically register specific tools by name (from search results) |
 | 3 | `deactivate_tools` | *(meta-tool)* Remove previously activated tools to free context |
 | 4 | `activate_domain` | *(meta-tool)* Activate all tools in a domain at once (e.g. `debugger`, `network`) |
-| 5 | `boost_profile` | *(meta-tool)* Upgrade to a higher-capability tier (search → minimal → workflow → full); auto-expires after TTL |
+| 5 | `boost_profile` | *(meta-tool)* Upgrade to a higher-capability tier (search → minimal → workflow → full); auto-expires after TTL |
 | 6 | `unboost_profile` | *(meta-tool)* Downgrade to a lower tier and remove boost-added tools |
 | 7 | `extensions_list` | *(meta-tool)* List currently loaded extensions from `plugins/` and `workflows/` |
 | 8 | `extensions_reload` | *(meta-tool)* Reload extensions at runtime and register extension tools dynamically |
@@ -676,15 +667,20 @@ Session IDs are issued via the `Mcp-Session-Id` response header.
 - Recommended import source for extension repos: `@jshookmcp/extension-sdk/plugin`.
 - A plugin can contribute `DomainManifest` + `WorkflowContract` via `manifest.contributes`.
 
-### Workflow layout
-
-- Put workflow contracts at:
-  - `workflows/*.workflow.js` / `workflows/*.workflow.ts`
-  - `workflows/**/workflow.js` / `workflows/**/workflow.ts`
-- Export a default `WorkflowContract`.
-- Recommended import source for extension repos: `@jshookmcp/extension-sdk/workflow`.
-
-### Runtime behavior
+### Workflow layout
+
+- Put workflow contracts at:
+  - `workflows/*.workflow.js` / `workflows/*.workflow.ts`
+  - `workflows/**/workflow.js` / `workflows/**/workflow.ts`
+- Export a default `WorkflowContract`.
+- Recommended import source for extension repos: `@jshookmcp/extension-sdk/workflow`.
+- Discovery de-dup behavior (important):
+  - Workflow files are grouped by a normalized relative-directory key.
+  - Only one workflow file is kept per key during reload.
+  - If you place multiple files directly under `workflows/*.workflow.js`, only one may be retained.
+  - Preferred multi-workflow layout: `workflows/<workflow-name>/workflow.js` (or `workflow.ts`).
+
+### Runtime behavior
 
 - Quick flow:
   1. Place plugin/workflow files under configured roots.

package/README.zh.md

@@ -1,4 +1,4 @@
-# @jshookmcp/jshook
+# @jshookmcp/jshook
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 [![Node.js >= 20](https://img.shields.io/badge/node-%3E%3D20-brightgreen.svg)](https://nodejs.org/)
@@ -8,7 +8,7 @@
 
 [English](./README.md) | 中文
 
-面向 AI 辅助 JavaScript 分析与安全分析的 MCP（模型上下文协议）服务器，提供 **242 个内置工具**——其中 **16 个域下 234 个域工具**，外加 **8 个内置元工具**——并支持从 `plugins/` 与 `workflows/` 目录运行时动态扩展。集成浏览器自动化、Chrome DevTools Protocol 调试、网络监控、智能 JavaScript Hook、LLM 驱动代码分析、进程/内存操作、WASM 工具链、二进制编码、反反调试、GraphQL 发现、Source Map 重建、AST 变换、加密重构、平台包分析、Burp Suite / Native 分析工具桥接及高层复合工作流编排。
+面向 AI 辅助 JavaScript 分析与安全分析的 MCP（模型上下文协议）服务器，提供 **242 个内置工具**——其中 **16 个域下 234 个域工具**，外加 **8 个内置元工具**——并支持从 `plugins/` 与 `workflows/` 目录运行时动态扩展。集成浏览器自动化、Chrome DevTools Protocol 调试、网络监控、智能 JavaScript Hook、LLM 驱动代码分析、进程/内存操作、WASM 工具链、二进制编码、反反调试、GraphQL 发现、Source Map 重建、AST 变换、加密重构、平台包分析、Burp Suite / Native 分析工具桥接及高层复合工作流编排。
 
 ## 功能特性
 
@@ -21,7 +21,7 @@
 - **HAR 导出 / 请求重放** — 导出 HAR 1.2 流量；重放任意请求，支持请求头/Body/方法覆盖，内置 SSRF 安全防护
 - **Tab 工作流** — 多标签页协调：命名别名绑定、跨标签共享 KV 上下文
 - **复合工作流** — 单次调用编排工具（`web_api_capture_session`、`register_account_flow`、`api_probe_batch`、`js_bundle_search`），将导航、DOM 操作、网络捕获和 Auth 提取链式合并为原子操作
-- **脚本库** — 命名可复用 JS 片段（`page_script_register` / `page_script_run`），内置分析预设
+- **脚本库** — 命名可复用 JS 片段（`page_script_register` / `page_script_run`），内置分析预设
 - **渐进工具发现** — 基于 BM25 的 `search_tools` 元工具可按关键字搜索“内置工具 + 当前已加载扩展工具”（总数动态变化）；`activate_tools` / `deactivate_tools` 按名激活/停用单个工具；`activate_domain` 批量激活整个域；`boost_profile` / `unboost_profile` 档位级升降级，支持 TTL 自动过期
 - **JavaScript Hook** — AI 生成任意函数 Hook，20+ 内置预设（eval、crypto、atob、WebAssembly 等）
 - **代码分析** — 反混淆（JScrambler、JSVMP、Packer）、加密算法检测、LLM 驱动代码理解
@@ -39,7 +39,7 @@
 - **平台工具** — 小程序包扫描/解包/分析、Electron ASAR 提取、Electron 应用检查
 - **外部工具桥接** — Frida 脚本生成与 Jadx 反编译集成（桥接模式，用户自行安装外部工具）
 - **Burp Suite 桥接** — 代理状态、请求拦截重放、HAR 导入/对比、发送 Repeater；端点仅允许回环地址并具备 SSRF 防护
-- **Native 分析工具桥接** — Ghidra 与 IDA Pro 桥接：函数反编译、符号查询、脚本执行、交叉引用分析；端点仅允许回环地址并具备 SSRF 防护
+- **Native 分析工具桥接** — Ghidra 与 IDA Pro 桥接：函数反编译、符号查询、脚本执行、交叉引用分析；端点仅允许回环地址并具备 SSRF 防护
 - **CAPTCHA 处理** — AI 视觉检测、手动验证流程、可配置轮询
 - **隐身注入** — 针对无头浏览器指纹识别的反检测补丁
 - **进程与内存** — 跨平台进程枚举、内存读写/扫描、DLL/Shellcode 注入（Windows）、Electron 应用附加
@@ -53,8 +53,8 @@
 
 - 所有工具通过 `server.registerTool()` 注册，无手动请求处理
 - 工具 Schema 从 JSON Schema 动态构建（输入由各域 handler 验证）
-- **四种工具档位**：`search`（BM25 搜索发现）、`minimal`（快速启动）、`workflow`（端到端 JavaScript 与安全分析）、`full`（全部域）
-- **渐进发现**：`search` 档位暴露 10 个 maintenance 域工具 + 8 个内置元工具；`search_tools` 会同时搜索内置工具与已加载的插件/工作流工具，且 `workflow` 档位会提高工作流结果的排序优先级
+- **四种工具档位**：`search`（BM25 搜索发现）、`minimal`（快速启动）、`workflow`（端到端 JavaScript 与安全分析）、`full`（全部域）
+- **渐进发现**：`search` 档位暴露 10 个 maintenance 域工具 + 8 个内置元工具；`search_tools` 会同时搜索内置工具与已加载的插件/工作流工具，且 `workflow/full` 档位会提高工作流结果的排序优先级
 - **域自发现**：启动时 registry 通过动态 ESM import 扫描 `domains/*/manifest.ts` — 新域无需修改任何中心文件即可被自动检测
 - **DomainManifest 契约**：每个域导出标准化清单（`kind`、`version`、`domain`、`depKey`、`profiles`、`registrations`、`ensure`）— 档位归属、工具定义和 handler 工厂全部集中在一个文件中
 - **按域懒初始化**：handler 类通过 Proxy 在首次工具调用时实例化，不在 init 阶段创建
@@ -65,18 +65,35 @@
 ## 环境要求
 
 - Node.js >= 20
-- pnpm
+- npm（用于全局安装）
+- pnpm（仅在需要从源码构建时使用）
 
 ## 安装
 
-### 默认安装（仅 Puppeteer）
+### 推荐：使用 npx 直接运行
+
+```bash
+npx @jshookmcp/jshook
+```
+
+如果你只是想直接运行 MCP 服务，而不想管理全局安装，这是推荐方式。
+
+### 可选：全局安装
+
+```bash
+npm install -g @jshookmcp/jshook
+```
+
+这会全局安装 `jshook` 和 `jshookmcp` 命令，但对大多数用户来说，优先推荐 `npx`。
+
+### 从源码安装（开发 / 本地调试）
 
 ```bash
 pnpm install
 pnpm build
 ```
 
-### Full 安装（Puppeteer + Camoufox）
+### 从源码安装（含 Camoufox）
 
 ```bash
 pnpm run install:full
@@ -102,46 +119,23 @@ Windows 常见缓存路径：
 
 ## 配置
 
-将 `.env.example` 复制为 `.env` 并填写：
+如果你是从源码运行，请将 `.env.example` 复制为 `.env` 并填写：
 
 ```bash
 cp .env.example .env
 ```
 
-主要配置项：
-
-| 变量 | 说明 | 默认值 |
-|------|------|--------|
-| `DEFAULT_LLM_PROVIDER` | `openai` 或 `anthropic` | `openai` |
-| `OPENAI_API_KEY` | OpenAI（或兼容接口）API Key | — |
-| `OPENAI_BASE_URL` | OpenAI 兼容接口 Base URL | `https://api.openai.com/v1` |
-| `OPENAI_MODEL` | 模型名称 | `gpt-4-turbo-preview` |
-| `ANTHROPIC_API_KEY` | Anthropic API Key | — |
-| `PUPPETEER_HEADLESS` | 无头模式 | `false` |
-| `PUPPETEER_EXECUTABLE_PATH` | 可选浏览器路径 | Puppeteer 管理 |
-| `LOG_LEVEL` | 日志级别（`debug`/`info`/`warn`/`error`） | `info` |
-| `MCP_TRANSPORT` | 传输模式：`stdio` 或 `http` | `stdio` |
-| `MCP_PORT` | HTTP 端口（`MCP_TRANSPORT=http` 时生效） | `3000` |
-| `MCP_HOST` | HTTP 绑定地址 | `127.0.0.1` |
-| `MCP_TOOL_PROFILE` | 工具档位：`search`/`minimal`/`full`/`workflow` | `minimal` |
-| `MCP_TOOL_DOMAINS` | 逗号分隔域覆盖 | — |
-| `MCP_AUTH_TOKEN` | HTTP 传输 Bearer 令牌认证 | — |
-| `MCP_MAX_BODY_BYTES` | HTTP 请求体大小限制（字节） | `10485760`（10 MB） |
-| `MCP_ALLOW_INSECURE` | 允许非 localhost HTTP 无认证 | `false` |
-| `MCP_SCREENSHOT_DIR` | 截图基础目录（归一化至项目根） | `screenshots/manual` |
-| `BURP_ADAPTER_URL` | Burp Suite REST API 适配器端点（仅回环地址） | `http://127.0.0.1:18443` |
-| `GHIDRA_BRIDGE_URL` | Ghidra 桥接服务端点（仅回环地址） | `http://127.0.0.1:18080` |
-| `IDA_BRIDGE_URL` | IDA Pro 桥接服务端点（仅回环地址） | `http://127.0.0.1:18081` |
-
-### 档位规则
+如果你是通过全局 npm 包运行，也可以直接在 shell 环境变量或 MCP 客户端配置里传入同样的配置项。
+
+主要配置项（以 `.env.example` 为准）：\n\n| 变量 | 说明 | 默认值 / 示例 |\n|------|------|---------------|\n| `DEFAULT_LLM_PROVIDER` | 当前启用的 LLM 提供方：`openai` 或 `anthropic` | `openai` |\n| `OPENAI_API_KEY` | OpenAI 兼容接口 API Key | — |\n| `OPENAI_MODEL` | OpenAI 兼容模型名 | `gpt-4-turbo-preview` |\n| `OPENAI_BASE_URL` | OpenAI 兼容接口 Base URL | `https://api.openai.com/v1` |\n| `ANTHROPIC_API_KEY` | Anthropic API Key | — |\n| `ANTHROPIC_MODEL` | Anthropic 模型名 | `claude-3-5-sonnet-20241022` |\n| `PUPPETEER_HEADLESS` | 是否启用无头浏览器 | `.env.example` 中为 `true` |\n| `PUPPETEER_TIMEOUT` | Puppeteer 默认超时（毫秒） | `30000` |\n| `PUPPETEER_EXECUTABLE_PATH` | 可选浏览器可执行文件路径 | 注释示例 |\n| `MCP_SERVER_NAME` | 进程对外公布的服务名 | `jshookmcp` |\n| `MCP_SERVER_VERSION` | 进程对外公布的服务版本 | `.env.example` 中为 `0.1.0` |\n| `MCP_TOOL_PROFILE` | 工具档位：`search`、`minimal`、`workflow`、`full` | 注释示例：`minimal` |\n| `MCP_TOOL_DOMAINS` | 逗号分隔域覆盖；优先级高于 `MCP_TOOL_PROFILE` | 注释示例 |\n| `LOG_LEVEL` | 日志级别（`debug`/`info`/`warn`/`error`） | `info` |\n| `ENABLE_CACHE` | 是否启用磁盘缓存 | `true` |\n| `CACHE_DIR` | 缓存目录 | `.cache` |\n| `CACHE_TTL` | 缓存 TTL（秒） | `3600` |\n| `MAX_CONCURRENT_ANALYSIS` | 最大并发分析任务数 | `3` |\n| `MAX_CODE_SIZE_MB` | 分析阶段允许的最大代码体积 | `10` |\n| `CAPTCHA_SCREENSHOT_DIR` | CAPTCHA 兜底截图目录 | `./screenshots` |\n| `MCP_SCREENSHOT_DIR` | 截图输出根目录（始终限制在项目根下） | 注释示例：`./screenshots/manual` |\n| `MCP_PLUGIN_ROOTS` | 逗号分隔插件根目录 | 注释示例：`./plugins,./dist/plugins` |\n| `MCP_WORKFLOW_ROOTS` | 逗号分隔工作流根目录 | 注释示例：`./workflows` |\n| `MCP_DEFAULT_PLUGIN_BOOST_TIER` | 插件在 boost 时自动注册的默认档位 | 注释示例：`full` |\n| `BURP_MCP_SSE_URL` | Burp SSE bridge 地址 | 注释示例 |\n| `BURP_MCP_AUTH_TOKEN` | Burp SSE bridge 可选认证令牌 | 注释示例 |\n| `ZAP_API_URL` | OWASP ZAP REST 接口地址 | 注释示例 |\n| `ZAP_API_KEY` | OWASP ZAP API Key | 注释示例 |\n| `GHIDRA_BRIDGE_URL` | Ghidra bridge 端点 | 注释示例：`http://127.0.0.1:18080` |\n| `IDA_BRIDGE_URL` | IDA bridge 端点 | 注释示例：`http://127.0.0.1:18081` |\n| `EXTENSION_REGISTRY_BASE_URL` | `browse_extension_registry` / `install_extension` 使用的扩展 registry 基址 | `https://raw.githubusercontent.com/vmoranv/jshookmcpextension/master/registry` |\n\n代码里还支持一些更高级的运行时选项，但 `.env.example` 默认没有展开，例如 `MCP_PORT`、`MCP_HOST`、`MCP_AUTH_TOKEN`、`MCP_MAX_BODY_BYTES`、`MCP_ALLOW_INSECURE`。\n\n### 档位规则
 
 | 档位 | 包含域 | 工具数 | 初始化 Tokens | 占比 |
 |------|--------|--------|--------------|------|
-| `search` | maintenance | 18（10 个域工具 + 8 个元工具） | ~3,096 | 7% |
-| `minimal` | browser, maintenance | 78（70 个域工具 + 8 个元工具） | ~13,416 | 32% |
-| `workflow` | browser, network, workflow, maintenance, core, debugger, streaming, encoding, graphql | 179（171 个域工具 + 8 个元工具） | ~30,788 | 74% |
-| `full` | 全部 16 个域 | 242（234 个域工具 + 8 个元工具） | ~41,624 | 100% |
-> Token 数据为近似值，按此前 `claude /doctor` 的平均 172 tokens/工具估算。所有档位均包含 8 个元工具：`search_tools`、`activate_tools`、`deactivate_tools`、`activate_domain`、`boost_profile`、`unboost_profile`、`extensions_list`、`extensions_reload`。
+| `search` | maintenance | 18（10 个域工具 + 8 个元工具） | ~3,096 | 7% |
+| `minimal` | browser, maintenance | 78（70 个域工具 + 8 个元工具） | ~13,416 | 32% |
+| `workflow` | browser, network, workflow, maintenance, core, debugger, streaming, encoding, graphql | 179（171 个域工具 + 8 个元工具） | ~30,788 | 74% |
+| `full` | 全部 16 个域 | 242（234 个域工具 + 8 个元工具） | ~41,624 | 100% |
+> Token 数据为近似值，按此前 `claude /doctor` 的平均 172 tokens/工具估算。所有档位均包含 8 个元工具：`search_tools`、`activate_tools`、`deactivate_tools`、`activate_domain`、`boost_profile`、`unboost_profile`、`extensions_list`、`extensions_reload`。
 
 > 若设置了 `MCP_TOOL_DOMAINS`，优先级高于 `MCP_TOOL_PROFILE`。
 
@@ -166,19 +160,19 @@ cp .env.example .env
 
 ```bash
 # 基于搜索的渐进发现（推荐用于上下文受限的 LLM）
-MCP_TOOL_PROFILE=search node dist/index.js
+MCP_TOOL_PROFILE=search jshook
 
 # 本地轻量模式
-MCP_TOOL_PROFILE=minimal node dist/index.js
+MCP_TOOL_PROFILE=minimal jshook
 
-# 端到端 JavaScript 与安全分析流程
-MCP_TOOL_PROFILE=workflow node dist/index.js
+# 端到端 JavaScript 与安全分析流程
+MCP_TOOL_PROFILE=workflow jshook
 
-# 只启用浏览器+维护工具
-MCP_TOOL_DOMAINS=browser,maintenance node dist/index.js
+# 只启用浏览器+维护工具
+MCP_TOOL_DOMAINS=browser,maintenance jshook
 
 # HTTP 模式 + 认证
-MCP_TRANSPORT=http MCP_AUTH_TOKEN=mysecret node dist/index.js
+MCP_TRANSPORT=http MCP_AUTH_TOKEN=mysecret jshook
 ```
 
 ## MCP 客户端配置
@@ -188,23 +182,22 @@ MCP_TRANSPORT=http MCP_AUTH_TOKEN=mysecret node dist/index.js
 ```json
 {
   "mcpServers": {
-    "jshook": {
-      "command": "node",
-      "args": ["path/to/@jshookmcp/jshook/dist/index.js"],
+    "jshook": {
+      "command": "jshook",
       "env": {
-        "OPENAI_API_KEY": "your-key",
-        "OPENAI_BASE_URL": "https://api.openai.com/v1",
-        "OPENAI_MODEL": "gpt-4-turbo-preview"
+        "OPENAI_API_KEY": "your-key"
       }
     }
   }
 }
 ```
 
+只有在你需要覆盖默认模型或自定义兼容接口时，才需要额外设置 `OPENAI_MODEL` / `OPENAI_BASE_URL`。如果你准备使用图像相关工具（例如 CAPTCHA 视觉识别工作流），再显式指定支持视觉能力的模型即可，不要把它当成所有安装场景的默认配置。
+
 ### Streamable HTTP（远程 / MCP 当前修订版）
 
 ```bash
-MCP_TRANSPORT=http MCP_PORT=3000 node dist/index.js
+MCP_TRANSPORT=http MCP_PORT=3000 jshook
 ```
 
 连接至 `http://localhost:3000/mcp`。服务器支持：
@@ -215,7 +208,7 @@ MCP_TRANSPORT=http MCP_PORT=3000 node dist/index.js
 
 会话 ID 通过 `Mcp-Session-Id` 响应头下发。
 
-## 工具域（234 个域工具）
+## 工具域（234 个域工具）
 
 ### 核心 / 分析（13 个工具）
 
@@ -464,7 +457,7 @@ MCP_TRANSPORT=http MCP_PORT=3000 node dist/index.js
 ### 工作流 / 复合（6 个工具）
 
 <details>
-<summary>面向全链路 JavaScript 分析与安全分析任务的高层编排</summary>
+<summary>面向全链路 JavaScript 分析与安全分析任务的高层编排</summary>
 
 | # | 工具 | 说明 |
 |---|------|------|
@@ -598,7 +591,7 @@ MCP_TRANSPORT=http MCP_PORT=3000 node dist/index.js
 
 </details>
 
-### Native 分析工具桥接（4 个工具）
+### Native 分析工具桥接（4 个工具）
 
 <details>
 <summary>Ghidra 与 IDA Pro 桥接：反编译、符号检索、脚本执行、交叉引用分析</summary>
@@ -649,11 +642,11 @@ MCP_TRANSPORT=http MCP_PORT=3000 node dist/index.js
 
 | # | 工具 | 说明 |
 |---|------|------|
-| 1 | `search_tools` | *(元工具)* BM25 关键字搜索内置工具 + 已加载的插件/工作流工具；在 `workflow` 档位下，工作流域结果会获得额外排序加权 |
+| 1 | `search_tools` | *(元工具)* BM25 关键字搜索内置工具 + 已加载的插件/工作流工具；在 `workflow/full` 档位下，工作流域结果会获得额外排序加权。若已加载扩展 workflow，`run_extension_workflow` / `list_extension_workflows` 还会获得额外权重（尤其在注册/验证码/keygen 等意图下）。 |
 | 2 | `activate_tools` | *(元工具)* 按名称动态注册指定工具（来自搜索结果） |
 | 3 | `deactivate_tools` | *(元工具)* 移除先前激活的工具以释放上下文 |
 | 4 | `activate_domain` | *(元工具)* 一次激活整个域的所有工具（如 `debugger`、`network`） |
-| 5 | `boost_profile` | *(元工具)* 升级至更高档位（search → minimal → workflow → full）；TTL 自动过期 |
+| 5 | `boost_profile` | *(元工具)* 升级至更高档位（search → minimal → workflow → full）；TTL 自动过期 |
 | 6 | `unboost_profile` | *(元工具)* 降级至更低档位并移除 boost 添加的工具 |
 | 7 | `extensions_list` | *(元工具)* 列出当前已加载的 `plugins/` / `workflows/` 扩展 |
 | 8 | `extensions_reload` | *(元工具)* 运行时重新扫描扩展目录并动态注册扩展工具 |
@@ -682,15 +675,20 @@ MCP_TRANSPORT=http MCP_PORT=3000 node dist/index.js
 - 扩展仓建议从 `@jshookmcp/extension-sdk/plugin` 导入插件开发类型与工具函数。
 - 插件可通过 `manifest.contributes` 提供 `DomainManifest` 与 `WorkflowContract`。
 
-#### Workflow 放置规范
-
-- Workflow 文件放在：
-  - `workflows/*.workflow.js` / `workflows/*.workflow.ts`
-  - `workflows/**/workflow.js` / `workflows/**/workflow.ts`
-- 默认导出 `WorkflowContract`。
-- 扩展仓建议从 `@jshookmcp/extension-sdk/workflow` 导入 Workflow 契约与 builder。
-
-#### 热加载流程（推荐）
+#### Workflow 放置规范
+
+- Workflow 文件放在：
+  - `workflows/*.workflow.js` / `workflows/*.workflow.ts`
+  - `workflows/**/workflow.js` / `workflows/**/workflow.ts`
+- 默认导出 `WorkflowContract`。
+- 扩展仓建议从 `@jshookmcp/extension-sdk/workflow` 导入 Workflow 契约与 builder。
+- 发现与去重规则（重要）：
+  - workflow 文件会按“规范化相对目录 key”分组。
+  - 每个 key 在 reload 时只保留一个文件。
+  - 如果把多个文件都放在 `workflows/*.workflow.js` 顶层，最终可能只加载其中一个。
+  - 推荐多 workflow 目录结构：`workflows/<workflow-name>/workflow.js`（或 `workflow.ts`）。
+
+#### 热加载流程（推荐）
 
 1. 按规范放置插件/工作流文件。
 2. 调用 `extensions_reload`。

package/dist/constants.d.ts

@@ -58,6 +58,17 @@ export declare const WORKFLOW_JS_BUNDLE_MAX_REDIRECTS: number;
 export declare const WORKFLOW_JS_BUNDLE_FETCH_TIMEOUT_MS: number;
 export declare const WORKFLOW_BUNDLE_CACHE_TTL_MS: number;
 export declare const WORKFLOW_BUNDLE_CACHE_MAX_BYTES: number;
+export declare const SEARCH_WORKFLOW_BOOST_TIERS: Set<string>;
+export declare const SEARCH_WORKFLOW_DOMAIN_BOOST_MULTIPLIER: number;
+export type SearchIntentToolBoostRuleConfig = {
+    pattern: string;
+    flags?: string;
+    boosts: Array<{
+        tool: string;
+        bonus: number;
+    }>;
+};
+export declare const SEARCH_INTENT_TOOL_BOOST_RULES_OVERRIDE: SearchIntentToolBoostRuleConfig[] | null;
 export declare const EXTENSION_GIT_CLONE_TIMEOUT_MS: number;
 export declare const EXTENSION_GIT_CHECKOUT_TIMEOUT_MS: number;
 export declare const PROCESS_LIST_MAX_BUFFER_BYTES: number;

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAiCA,eAAO,MAAM,qBAAqB,UAA0D,CAAC;AAG7F,eAAO,MAAM,kBAAkB,QAAkC,CAAC;AAGlE,eAAO,MAAM,sBAAsB,QAAqD,CAAC;AAGzF,eAAO,MAAM,mBAAmB,QAAkD,CAAC;AAGnF,eAAO,MAAM,yBAAyB,QAA2D,CAAC;AAGlG,eAAO,MAAM,2BAA2B,QAAwD,CAAC;AAMjG,eAAO,MAAM,2BAA2B,QAA6C,CAAC;AACtF,eAAO,MAAM,2BAA2B,QAA6C,CAAC;AACtF,eAAO,MAAM,6BAA6B,QAA+C,CAAC;AAC1F,eAAO,MAAM,+BAA+B,QAAgD,CAAC;AAE7F,eAAO,MAAM,wBAAwB,QAA0C,CAAC;AAChF,eAAO,MAAM,8BAA8B,QAA+C,CAAC;AAC3F,eAAO,MAAM,gCAAgC,QAAkD,CAAC;AAChG,eAAO,MAAM,iCAAiC,QAAkD,CAAC;AAEjG,eAAO,MAAM,uBAAuB,QAAwC,CAAC;AAC7E,eAAO,MAAM,uBAAuB,QAAsC,CAAC;AAC3E,eAAO,MAAM,qBAAqB,QAAkC,CAAC;AACrE,eAAO,MAAM,0BAA0B,QAA2C,CAAC;AAEnF,eAAO,MAAM,uBAAuB,QAAsC,CAAC;AAC3E,eAAO,MAAM,uBAAuB,QAAqC,CAAC;AAC1E,eAAO,MAAM,wBAAwB,QAA0C,CAAC;AAEhF,eAAO,MAAM,4BAA4B,QAA8C,CAAC;AACxF,eAAO,MAAM,oBAAoB,QAAmC,CAAC;AACrE,eAAO,MAAM,wBAAwB,QAAyC,CAAC;AAC/E,eAAO,MAAM,yBAAyB,QAA2C,CAAC;AAElF,eAAO,MAAM,mCAAmC,QAAqD,CAAC;AACtG,eAAO,MAAM,qBAAqB,QAAsC,CAAC;AAEzE,eAAO,MAAM,2BAA2B,QAA6C,CAAC;AACtF,eAAO,MAAM,8BAA8B,QAA+C,CAAC;AAC3F,eAAO,MAAM,iCAAiC,QAA8C,CAAC;AAC7F,eAAO,MAAM,qCAAqC,QAAuD,CAAC;AAC1G,eAAO,MAAM,oCAAoC,QAAmD,CAAC;AACrG,eAAO,MAAM,sCAAsC,QAAoD,CAAC;AAExG,eAAO,MAAM,8BAA8B,QAAgD,CAAC;AAE5F,eAAO,MAAM,oBAAoB,QAAsC,CAAC;AACxE,eAAO,MAAM,2BAA2B,QAA6C,CAAC;AACtF,eAAO,MAAM,wBAAwB,QAA2C,CAAC;AAEjF,eAAO,MAAM,yBAAyB,QAA4C,CAAC;AAEnF,eAAO,MAAM,yBAAyB,QAA2C,CAAC;AAClF,eAAO,MAAM,wBAAwB,QAAyC,CAAC;AAC/E,eAAO,MAAM,yBAAyB,QAA2C,CAAC;AAClF,eAAO,MAAM,0BAA0B,QAA6C,CAAC;AACrF,eAAO,MAAM,sBAAsB,QAAuC,CAAC;AAC3E,eAAO,MAAM,sBAAsB,QAAyC,CAAC;AAC7E,eAAO,MAAM,mBAAmB,QAAoC,CAAC;AACrE,eAAO,MAAM,uBAAuB,QAAoC,CAAC;AAEzE,eAAO,MAAM,yBAAyB,QAA2C,CAAC;AAClF,eAAO,MAAM,6BAA6B,QAAgD,CAAC;AAC3F,eAAO,MAAM,4BAA4B,QAAyC,CAAC;AACnF,eAAO,MAAM,4BAA4B,QAAyC,CAAC;AAEnF,eAAO,MAAM,0BAA0B,QAAuC,CAAC;AAC/E,eAAO,MAAM,6BAA6B,QAA+C,CAAC;AAC1F,eAAO,MAAM,6BAA6B,QAAgD,CAAC;AAC3F,eAAO,MAAM,+BAA+B,QAAgD,CAAC;AAC7F,eAAO,MAAM,qCAAqC,QAAuD,CAAC;AAC1G,eAAO,MAAM,iCAAiC,QAA6D,CAAC;AAC5G,eAAO,MAAM,gCAAgC,QAA6C,CAAC;AAC3F,eAAO,MAAM,mCAAmC,QAAqD,CAAC;AACtG,eAAO,MAAM,4BAA4B,QAAqD,CAAC;AAC/F,eAAO,MAAM,+BAA+B,QAA4D,CAAC;AAEzG,eAAO,MAAM,8BAA8B,QAAgD,CAAC;AAC5F,eAAO,MAAM,iCAAiC,QAAmD,CAAC;AAMlG,eAAO,MAAM,6BAA6B,QAAyD,CAAC;AACpG,eAAO,MAAM,8BAA8B,QAA0D,CAAC;AACtG,eAAO,MAAM,8BAA8B,QAAyD,CAAC;AAMrG,eAAO,MAAM,uBAAuB,QAAoC,CAAC;AACzE,eAAO,MAAM,uBAAuB,QAAoC,CAAC;AACzE,eAAO,MAAM,2BAA2B,QAA6C,CAAC;AACtF,eAAO,MAAM,0BAA0B,QAA4C,CAAC;AAEpF,eAAO,MAAM,4BAA4B,QAAyC,CAAC;AACnF,eAAO,MAAM,2BAA2B,QAA6C,CAAC;AACtF,eAAO,MAAM,4BAA4B,QAAyC,CAAC;AACnF,eAAO,MAAM,8BAA8B,QAA+C,CAAC;AAM3F,eAAO,MAAM,2BAA2B,QAAwD,CAAC;AACjG,eAAO,MAAM,4BAA4B,QAAgE,CAAC;AAC1G,eAAO,MAAM,uBAAuB,QAA0C,CAAC;AAC/E,eAAO,MAAM,4BAA4B,QAAsD,CAAC;AAChG,eAAO,MAAM,wBAAwB,QAAkD,CAAC;AACxF,eAAO,MAAM,mCAAmC,QAAwD,CAAC;AAMzG,eAAO,MAAM,wBAAwB,QAAyC,CAAC;AAC/E,eAAO,MAAM,uBAAuB,QAAwC,CAAC;AAC7E,eAAO,MAAM,oBAAoB,QAAqC,CAAC;AACvE,eAAO,MAAM,4BAA4B,QAA6C,CAAC;AAMvF,eAAO,MAAM,sBAAsB,QAAwC,CAAC;AAC5E,eAAO,MAAM,qBAAqB,QAAiD,CAAC;AACpF,eAAO,MAAM,uBAAuB,QAAyC,CAAC;AAC9E,eAAO,MAAM,sBAAsB,QAA2C,CAAC;AAC/E,eAAO,MAAM,sBAAsB,QAAwC,CAAC;AAC5E,eAAO,MAAM,sBAAsB,QAAyC,CAAC;AAC7E,eAAO,MAAM,4BAA4B,QAAwD,CAAC;AAClG,eAAO,MAAM,uBAAuB,QAAyC,CAAC;AAC9E,eAAO,MAAM,uBAAuB,QAAyC,CAAC;AAC9E,eAAO,MAAM,4BAA4B,QAAkD,CAAC;AAC5F,eAAO,MAAM,wBAAwB,QAA0C,CAAC;AAChF,eAAO,MAAM,0BAA0B,QAA2C,CAAC;AAEnF,eAAO,MAAM,uBAAuB,QAAyC,CAAC;AAC9E,eAAO,MAAM,kCAAkC,QAAoD,CAAC;AACpG,eAAO,MAAM,iCAAiC,QAAmD,CAAC;AAElG,eAAO,MAAM,6BAA6B,QAA8C,CAAC;AACzF,eAAO,MAAM,uBAAuB,QAAyC,CAAC;AAG9E,eAAO,MAAM,sBAAsB,QAAuC,CAAC;AAG3E,eAAO,MAAM,4BAA4B,QAA0C,CAAC;AACpF,eAAO,MAAM,+BAA+B,QAA8C,CAAC;AAE3F,eAAO,MAAM,yBAAyB,QAA0C,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AA4DA,eAAO,MAAM,qBAAqB,UAA0D,CAAC;AAG7F,eAAO,MAAM,kBAAkB,QAAkC,CAAC;AAGlE,eAAO,MAAM,sBAAsB,QAAqD,CAAC;AAGzF,eAAO,MAAM,mBAAmB,QAAkD,CAAC;AAGnF,eAAO,MAAM,yBAAyB,QAA2D,CAAC;AAGlG,eAAO,MAAM,2BAA2B,QAAwD,CAAC;AAMjG,eAAO,MAAM,2BAA2B,QAA6C,CAAC;AACtF,eAAO,MAAM,2BAA2B,QAA6C,CAAC;AACtF,eAAO,MAAM,6BAA6B,QAA+C,CAAC;AAC1F,eAAO,MAAM,+BAA+B,QAAgD,CAAC;AAE7F,eAAO,MAAM,wBAAwB,QAA0C,CAAC;AAChF,eAAO,MAAM,8BAA8B,QAA+C,CAAC;AAC3F,eAAO,MAAM,gCAAgC,QAAkD,CAAC;AAChG,eAAO,MAAM,iCAAiC,QAAkD,CAAC;AAEjG,eAAO,MAAM,uBAAuB,QAAwC,CAAC;AAC7E,eAAO,MAAM,uBAAuB,QAAsC,CAAC;AAC3E,eAAO,MAAM,qBAAqB,QAAkC,CAAC;AACrE,eAAO,MAAM,0BAA0B,QAA2C,CAAC;AAEnF,eAAO,MAAM,uBAAuB,QAAsC,CAAC;AAC3E,eAAO,MAAM,uBAAuB,QAAqC,CAAC;AAC1E,eAAO,MAAM,wBAAwB,QAA0C,CAAC;AAEhF,eAAO,MAAM,4BAA4B,QAA8C,CAAC;AACxF,eAAO,MAAM,oBAAoB,QAAmC,CAAC;AACrE,eAAO,MAAM,wBAAwB,QAAyC,CAAC;AAC/E,eAAO,MAAM,yBAAyB,QAA2C,CAAC;AAElF,eAAO,MAAM,mCAAmC,QAAqD,CAAC;AACtG,eAAO,MAAM,qBAAqB,QAAsC,CAAC;AAEzE,eAAO,MAAM,2BAA2B,QAA6C,CAAC;AACtF,eAAO,MAAM,8BAA8B,QAA+C,CAAC;AAC3F,eAAO,MAAM,iCAAiC,QAA8C,CAAC;AAC7F,eAAO,MAAM,qCAAqC,QAAuD,CAAC;AAC1G,eAAO,MAAM,oCAAoC,QAAmD,CAAC;AACrG,eAAO,MAAM,sCAAsC,QAAoD,CAAC;AAExG,eAAO,MAAM,8BAA8B,QAAgD,CAAC;AAE5F,eAAO,MAAM,oBAAoB,QAAsC,CAAC;AACxE,eAAO,MAAM,2BAA2B,QAA6C,CAAC;AACtF,eAAO,MAAM,wBAAwB,QAA2C,CAAC;AAEjF,eAAO,MAAM,yBAAyB,QAA4C,CAAC;AAEnF,eAAO,MAAM,yBAAyB,QAA2C,CAAC;AAClF,eAAO,MAAM,wBAAwB,QAAyC,CAAC;AAC/E,eAAO,MAAM,yBAAyB,QAA2C,CAAC;AAClF,eAAO,MAAM,0BAA0B,QAA6C,CAAC;AACrF,eAAO,MAAM,sBAAsB,QAAuC,CAAC;AAC3E,eAAO,MAAM,sBAAsB,QAAyC,CAAC;AAC7E,eAAO,MAAM,mBAAmB,QAAoC,CAAC;AACrE,eAAO,MAAM,uBAAuB,QAAoC,CAAC;AAEzE,eAAO,MAAM,yBAAyB,QAA2C,CAAC;AAClF,eAAO,MAAM,6BAA6B,QAAgD,CAAC;AAC3F,eAAO,MAAM,4BAA4B,QAAyC,CAAC;AACnF,eAAO,MAAM,4BAA4B,QAAyC,CAAC;AAEnF,eAAO,MAAM,0BAA0B,QAAuC,CAAC;AAC/E,eAAO,MAAM,6BAA6B,QAA+C,CAAC;AAC1F,eAAO,MAAM,6BAA6B,QAAgD,CAAC;AAC3F,eAAO,MAAM,+BAA+B,QAAgD,CAAC;AAC7F,eAAO,MAAM,qCAAqC,QAAuD,CAAC;AAC1G,eAAO,MAAM,iCAAiC,QAA6D,CAAC;AAC5G,eAAO,MAAM,gCAAgC,QAA6C,CAAC;AAC3F,eAAO,MAAM,mCAAmC,QAAqD,CAAC;AACtG,eAAO,MAAM,4BAA4B,QAAqD,CAAC;AAC/F,eAAO,MAAM,+BAA+B,QAA4D,CAAC;AAOzG,eAAO,MAAM,2BAA2B,aAEvC,CAAC;AACF,eAAO,MAAM,uCAAuC,QAAwD,CAAC;AAa7G,MAAM,MAAM,+BAA+B,GAAG;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD,CAAC;AACF,eAAO,MAAM,uCAAuC,0CACyC,CAAC;AAE9F,eAAO,MAAM,8BAA8B,QAAgD,CAAC;AAC5F,eAAO,MAAM,iCAAiC,QAAmD,CAAC;AAMlG,eAAO,MAAM,6BAA6B,QAAyD,CAAC;AACpG,eAAO,MAAM,8BAA8B,QAA0D,CAAC;AACtG,eAAO,MAAM,8BAA8B,QAAyD,CAAC;AAMrG,eAAO,MAAM,uBAAuB,QAAoC,CAAC;AACzE,eAAO,MAAM,uBAAuB,QAAoC,CAAC;AACzE,eAAO,MAAM,2BAA2B,QAA6C,CAAC;AACtF,eAAO,MAAM,0BAA0B,QAA4C,CAAC;AAEpF,eAAO,MAAM,4BAA4B,QAAyC,CAAC;AACnF,eAAO,MAAM,2BAA2B,QAA6C,CAAC;AACtF,eAAO,MAAM,4BAA4B,QAAyC,CAAC;AACnF,eAAO,MAAM,8BAA8B,QAA+C,CAAC;AAM3F,eAAO,MAAM,2BAA2B,QAAwD,CAAC;AACjG,eAAO,MAAM,4BAA4B,QAAgE,CAAC;AAC1G,eAAO,MAAM,uBAAuB,QAA0C,CAAC;AAC/E,eAAO,MAAM,4BAA4B,QAAsD,CAAC;AAChG,eAAO,MAAM,wBAAwB,QAAkD,CAAC;AACxF,eAAO,MAAM,mCAAmC,QAAwD,CAAC;AAMzG,eAAO,MAAM,wBAAwB,QAAyC,CAAC;AAC/E,eAAO,MAAM,uBAAuB,QAAwC,CAAC;AAC7E,eAAO,MAAM,oBAAoB,QAAqC,CAAC;AACvE,eAAO,MAAM,4BAA4B,QAA6C,CAAC;AAMvF,eAAO,MAAM,sBAAsB,QAAwC,CAAC;AAC5E,eAAO,MAAM,qBAAqB,QAAiD,CAAC;AACpF,eAAO,MAAM,uBAAuB,QAAyC,CAAC;AAC9E,eAAO,MAAM,sBAAsB,QAA2C,CAAC;AAC/E,eAAO,MAAM,sBAAsB,QAAwC,CAAC;AAC5E,eAAO,MAAM,sBAAsB,QAAyC,CAAC;AAC7E,eAAO,MAAM,4BAA4B,QAAwD,CAAC;AAClG,eAAO,MAAM,uBAAuB,QAAyC,CAAC;AAC9E,eAAO,MAAM,uBAAuB,QAAyC,CAAC;AAC9E,eAAO,MAAM,4BAA4B,QAAkD,CAAC;AAC5F,eAAO,MAAM,wBAAwB,QAA0C,CAAC;AAChF,eAAO,MAAM,0BAA0B,QAA2C,CAAC;AAEnF,eAAO,MAAM,uBAAuB,QAAyC,CAAC;AAC9E,eAAO,MAAM,kCAAkC,QAAoD,CAAC;AACpG,eAAO,MAAM,iCAAiC,QAAmD,CAAC;AAElG,eAAO,MAAM,6BAA6B,QAA8C,CAAC;AACzF,eAAO,MAAM,uBAAuB,QAAyC,CAAC;AAG9E,eAAO,MAAM,sBAAsB,QAAuC,CAAC;AAG3E,eAAO,MAAM,4BAA4B,QAA0C,CAAC;AACpF,eAAO,MAAM,+BAA+B,QAA8C,CAAC;AAE3F,eAAO,MAAM,yBAAyB,QAA0C,CAAC"}

package/dist/constants.js

@@ -5,6 +5,13 @@ const int = (key, fallback) => {
     const n = parseInt(v, 10);
     return Number.isFinite(n) ? n : fallback;
 };
+const float = (key, fallback) => {
+    const v = process.env[key];
+    if (v === undefined || v === '')
+        return fallback;
+    const n = Number.parseFloat(v);
+    return Number.isFinite(n) ? n : fallback;
+};
 const str = (key, fallback) => process.env[key] || fallback;
 const list = (key, fallback) => {
     const v = process.env[key];
@@ -12,6 +19,27 @@ const list = (key, fallback) => {
         return fallback;
     return v.split(',').map(Number).filter(Number.isFinite);
 };
+const csv = (key, fallback) => {
+    const v = process.env[key];
+    if (!v)
+        return fallback;
+    const parsed = v
+        .split(',')
+        .map((item) => item.trim().toLowerCase())
+        .filter(Boolean);
+    return parsed.length > 0 ? parsed : fallback;
+};
+const json = (key, fallback) => {
+    const v = process.env[key];
+    if (!v)
+        return fallback;
+    try {
+        return JSON.parse(v);
+    }
+    catch {
+        return fallback;
+    }
+};
 export const DEBUG_PORT_CANDIDATES = list('DEBUG_PORT_CANDIDATES', [9222, 9229, 9333, 2039]);
 export const DEFAULT_DEBUG_PORT = int('DEFAULT_DEBUG_PORT', 9222);
 export const GHIDRA_BRIDGE_ENDPOINT = str('GHIDRA_BRIDGE_URL', 'http://127.0.0.1:18080');
@@ -72,6 +100,9 @@ export const WORKFLOW_JS_BUNDLE_MAX_REDIRECTS = int('WORKFLOW_JS_BUNDLE_MAX_REDI
 export const WORKFLOW_JS_BUNDLE_FETCH_TIMEOUT_MS = int('WORKFLOW_JS_BUNDLE_FETCH_TIMEOUT_MS', 30_000);
 export const WORKFLOW_BUNDLE_CACHE_TTL_MS = int('WORKFLOW_BUNDLE_CACHE_TTL_MS', 5 * 60 * 1000);
 export const WORKFLOW_BUNDLE_CACHE_MAX_BYTES = int('WORKFLOW_BUNDLE_CACHE_MAX_BYTES', 100 * 1024 * 1024);
+export const SEARCH_WORKFLOW_BOOST_TIERS = new Set(csv('SEARCH_WORKFLOW_BOOST_TIERS', ['workflow', 'full']));
+export const SEARCH_WORKFLOW_DOMAIN_BOOST_MULTIPLIER = float('SEARCH_WORKFLOW_DOMAIN_BOOST_MULTIPLIER', 1.5);
+export const SEARCH_INTENT_TOOL_BOOST_RULES_OVERRIDE = json('SEARCH_INTENT_TOOL_BOOST_RULES_JSON', null);
 export const EXTENSION_GIT_CLONE_TIMEOUT_MS = int('EXTENSION_GIT_CLONE_TIMEOUT_MS', 60_000);
 export const EXTENSION_GIT_CHECKOUT_TIMEOUT_MS = int('EXTENSION_GIT_CHECKOUT_TIMEOUT_MS', 30_000);
 export const PROCESS_LIST_MAX_BUFFER_BYTES = int('PROCESS_LIST_MAX_BUFFER_BYTES', 1024 * 1024 * 10);