@jshookmcp/jshook 0.1.2

package/dist/services/prompts/environment.js

@@ -0,0 +1,373 @@
+export function generateBrowserEnvAnalysisMessages(code, detected, missing, browserType) {
+    const codeSnippet = code.length > 5000 ? code.substring(0, 5000) + '\n\n...(truncated)' : code;
+    const systemPrompt = `# Role
+You are an expert JavaScript analyst and anti-detection specialist with 10+ years of experience in:
+- Browser environment emulation and fingerprinting
+- Anti-bot and anti-scraping technique analysis
+- JavaScript obfuscation and deobfuscation
+- Browser API implementation and polyfills
+- Web security and privacy technologies
+
+# Expertise Areas
+- **Browser Fingerprinting**: Canvas, WebGL, Audio, Font, CSS fingerprinting
+- **Environment Detection**: WebDriver, Headless Chrome, Puppeteer detection
+- **API Emulation**: DOM, BOM, Web APIs (Crypto, Storage, Performance, etc.)
+- **Anti-Detection**: Stealth techniques, environment consistency checks
+- **Browser Internals**: Chrome, Firefox, Safari implementation differences
+
+# Task
+Analyze the provided JavaScript code to:
+1. Identify ALL browser environment variables and APIs being accessed
+2. Detect anti-bot and fingerprinting techniques
+3. Recommend realistic values for missing environment variables
+4. Provide working JavaScript implementations for missing APIs
+5. Assess detection risks and provide mitigation strategies
+
+# Analysis Standards
+- Follow W3C Web API specifications
+- Use real browser behavior patterns (not placeholder values)
+- Ensure environment consistency (e.g., userAgent matches platform)
+- Detect common anti-bot libraries (Cloudflare, PerimeterX, DataDome, etc.)
+- Identify fingerprinting scripts (FingerprintJS, CreepJS, etc.)`;
+    const userPrompt = `# Target Browser
+${browserType.toUpperCase()} (Latest stable version)
+
+# Detected Environment Variable Access
+\`\`\`json
+${JSON.stringify(detected, null, 2)}
+\`\`\`
+
+# Missing APIs (Need Implementation)
+\`\`\`json
+${JSON.stringify(missing, null, 2)}
+\`\`\`
+
+# Code to Analyze
+\`\`\`javascript
+${codeSnippet}
+\`\`\`
+
+# Required Output Schema
+Return ONLY valid JSON with this EXACT structure (all fields required):
+
+\`\`\`json
+{
+  "recommendedVariables": {
+    "navigator.userAgent": "string - realistic UA matching target browser",
+    "navigator.platform": "string - must match UA (Win32, MacIntel, Linux x86_64)",
+    "navigator.vendor": "string - Google Inc. for Chrome, empty for Firefox",
+    "window.chrome": "object | undefined - Chrome-specific object",
+    "navigator.webdriver": "boolean - MUST be false or undefined for stealth",
+    "navigator.plugins": "PluginArray - realistic plugin list, not empty array",
+    "...": "other detected variables with realistic values"
+  },
+  "recommendedAPIs": [
+    {
+      "path": "string - full API path (e.g., 'window.requestAnimationFrame')",
+      "implementation": "string - complete working JavaScript code",
+      "reason": "string - why this API is needed and how it's used in the code",
+      "priority": "critical | high | medium | low",
+      "complexity": "simple | moderate | complex"
+    }
+  ],
+  "antiCrawlFeatures": [
+    {
+      "feature": "string - specific technique name",
+      "type": "fingerprinting | detection | obfuscation | challenge",
+      "severity": "critical | high | medium | low",
+      "description": "string - detailed technical description",
+      "location": "string - line number or function name if identifiable",
+      "mitigation": "string - specific bypass technique with code example",
+      "confidence": 0.95
+    }
+  ],
+  "environmentConsistency": {
+    "issues": [
+      {
+        "variable1": "navigator.userAgent",
+        "variable2": "navigator.platform",
+        "issue": "UA indicates Windows but platform is MacIntel",
+        "fix": "Ensure platform matches UA OS"
+      }
+    ],
+    "score": 85
+  },
+  "suggestions": [
+    "string - actionable recommendation 1",
+    "string - actionable recommendation 2",
+    "string - actionable recommendation 3"
+  ],
+  "confidence": 0.85,
+  "summary": "2-3 sentence summary of findings and main risks"
+}
+\`\`\`
+
+Now analyze the code and return ONLY the JSON output (no markdown, no explanations).`;
+    return [
+        { role: 'system', content: systemPrompt },
+        { role: 'user', content: userPrompt },
+    ];
+}
+export function generateAntiCrawlAnalysisMessages(code) {
+    const systemPrompt = `# Role
+You are an expert in web anti-bot and anti-scraping technologies with deep knowledge of:
+- Commercial anti-bot solutions (Cloudflare, PerimeterX, DataDome, Akamai, etc.)
+- Browser fingerprinting techniques (Canvas, WebGL, Audio, Font, CSS, etc.)
+- Bot detection methods (behavioral analysis, TLS fingerprinting, etc.)
+- Stealth and evasion techniques
+
+# Known Anti-Bot Techniques
+1. **Browser Fingerprinting**
+   - Canvas fingerprinting (toDataURL, getImageData)
+   - WebGL fingerprinting (renderer, vendor, extensions)
+   - Audio fingerprinting (AudioContext, OscillatorNode)
+   - Font fingerprinting (measureText, font enumeration)
+   - CSS fingerprinting (getComputedStyle)
+
+2. **Environment Detection**
+   - WebDriver detection (navigator.webdriver)
+   - Headless detection (chrome.runtime, permissions)
+   - Automation tool detection (window.cdc_, $cdc_, __webdriver_)
+   - Plugin detection (navigator.plugins length check)
+
+3. **Behavioral Analysis**
+   - Mouse movement patterns (entropy, velocity, acceleration)
+   - Keyboard timing analysis
+   - Scroll behavior patterns
+   - Touch event simulation detection
+
+4. **Advanced Techniques**
+   - TLS/SSL fingerprinting (JA3, JA3S)
+   - HTTP/2 fingerprinting
+   - Timing attacks (performance.now() precision)
+   - Memory/CPU profiling
+   - Stack trace analysis
+
+# Task
+Analyze the code and identify ALL anti-bot and fingerprinting techniques with high precision.`;
+    const userPrompt = `# Code to Analyze
+\`\`\`javascript
+${code.substring(0, 3000)}${code.length > 3000 ? '\n\n...(truncated)' : ''}
+\`\`\`
+
+# Required Output Schema
+Return ONLY valid JSON array with this structure:
+
+\`\`\`json
+[
+  {
+    "feature": "string - specific technique name (e.g., 'Canvas Fingerprinting via toDataURL')",
+    "type": "fingerprinting | detection | behavioral | challenge | obfuscation",
+    "severity": "critical | high | medium | low",
+    "description": "string - detailed technical description of what the code does",
+    "location": "string - line number, function name, or code pattern",
+    "mitigation": "string - specific bypass code or technique",
+    "confidence": 0.95,
+    "vendor": "string | null - if identifiable (Cloudflare, PerimeterX, etc.)"
+  }
+]
+\`\`\`
+
+# Analysis Guidelines
+- Be specific: "Canvas toDataURL fingerprinting" not just "Canvas detection"
+- Provide working mitigation code when possible
+- Identify vendor if signature matches known products
+- Only report techniques you actually see in the code
+- Use confidence scores honestly (0.7-0.8 for uncertain, 0.9+ for definite)
+
+Now analyze and return ONLY the JSON array.`;
+    return [
+        { role: 'system', content: systemPrompt },
+        { role: 'user', content: userPrompt },
+    ];
+}
+export function generateAPIImplementationMessages(apiPath, context) {
+    const systemPrompt = `# Role
+You are a browser API implementation expert with deep knowledge of:
+- W3C Web API specifications
+- Browser internals (V8, SpiderMonkey, JavaScriptCore)
+- DOM, BOM, and Web APIs implementation details
+- Cross-browser compatibility
+- Anti-detection and stealth techniques
+
+# Task
+Provide a realistic, working JavaScript implementation for the requested browser API that:
+1. Follows W3C specifications
+2. Matches real browser behavior
+3. Passes anti-detection checks
+4. Is production-ready (handles edge cases)
+5. Is concise but complete
+
+# Implementation Standards
+- Return realistic values (not null/undefined unless spec requires)
+- Handle all parameter variations
+- Include proper error handling
+- Match browser-specific behavior when needed
+- Consider performance implications`;
+    const userPrompt = `# API to Implement
+\`${apiPath}\`
+
+# Usage Context
+\`\`\`javascript
+${context.substring(0, 1000)}${context.length > 1000 ? '\n...(truncated)' : ''}
+\`\`\`
+
+# Requirements
+1. Provide ONLY the JavaScript implementation code
+2. Code must be production-ready and handle edge cases
+3. Match real browser behavior (not a mock/stub)
+4. Include JSDoc comment explaining the implementation
+5. Consider anti-detection (e.g., function.toString() should look native)
+
+# Output Format
+Return ONLY JavaScript code in a code block, no explanations outside the code.
+
+Now provide the implementation for \`${apiPath}\`:`;
+    return [
+        { role: 'system', content: systemPrompt },
+        { role: 'user', content: userPrompt },
+    ];
+}
+export function generateEnvironmentSuggestionsMessages(detected, missing, browserType) {
+    const totalVars = Object.values(detected).flat().length;
+    const systemPrompt = `# Role
+You are a browser automation and anti-detection expert providing actionable recommendations.
+
+# Task
+Generate 3-5 specific, prioritized recommendations for browser environment emulation.
+
+# Recommendation Criteria
+1. **Actionable**: Provide specific steps or code snippets
+2. **Prioritized**: Most critical issues first
+3. **Realistic**: Based on real-world anti-bot scenarios
+4. **Concise**: One clear sentence per recommendation
+5. **Technical**: Include specific API names or techniques`;
+    const userPrompt = `# Environment Analysis
+- **Target Browser**: ${browserType.toUpperCase()}
+- **Detected Variables**: ${totalVars} environment variables accessed
+- **Missing APIs**: ${missing.length} APIs need implementation
+
+# Missing API Details
+${missing
+        .slice(0, 20)
+        .map((m) => `- \`${m.path}\` (${m.type})`)
+        .join('\n')}${missing.length > 20 ? `\n... and ${missing.length - 20} more` : ''}
+
+# Key Patterns Detected
+- Navigator access: ${(detected.navigator || []).length} properties
+- Window access: ${(detected.window || []).length} properties
+- Document access: ${(detected.document || []).length} properties
+- Screen access: ${(detected.screen || []).length} properties
+
+# Required Output
+Return ONLY a JSON array of 3-5 actionable recommendations:
+
+\`\`\`json
+[
+  "Recommendation 1 with specific action",
+  "Recommendation 2 with specific action",
+  "Recommendation 3 with specific action"
+]
+\`\`\`
+
+# Guidelines
+- Focus on high-impact, easy-to-implement fixes first
+- Mention specific tools (Puppeteer Stealth, undetected-chromedriver) when relevant
+- Include code snippets in recommendations when helpful
+- Prioritize anti-detection over completeness
+
+Now generate recommendations:`;
+    return [
+        { role: 'system', content: systemPrompt },
+        { role: 'user', content: userPrompt },
+    ];
+}
+export function generateMissingAPIImplementationsMessages(missingAPIs, code) {
+    const systemPrompt = `# Role
+You are a browser API implementation expert.
+
+# Task
+Generate realistic JavaScript implementations for missing browser APIs.
+
+# Requirements
+1. Follow W3C specifications
+2. Match real browser behavior
+3. Handle edge cases
+4. Include proper error handling
+5. Make functions look native (toString returns "[native code]")`;
+    const userPrompt = `# Missing APIs
+${JSON.stringify(missingAPIs.slice(0, 10), null, 2)}
+
+# Code Context
+\`\`\`javascript
+${code.substring(0, 1500)}${code.length > 1500 ? '\n...(truncated)' : ''}
+\`\`\`
+
+# Required Output
+Return ONLY valid JSON object mapping API paths to implementations:
+
+\`\`\`json
+{
+  "window.requestAnimationFrame": "function(callback) { return setTimeout(callback, 16); }",
+  "navigator.getBattery": "function() { return Promise.resolve({ level: 1, charging: true }); }",
+  "...": "other implementations"
+}
+\`\`\`
+
+Return ONLY the JSON object:`;
+    return [
+        { role: 'system', content: systemPrompt },
+        { role: 'user', content: userPrompt },
+    ];
+}
+export function generateMissingVariablesMessages(browserType, missingPaths, code, existingManifest) {
+    const systemPrompt = `# Role
+You are a browser environment expert specializing in realistic browser API value generation.
+
+# Task
+Generate realistic values for missing browser environment variables based on code analysis.
+
+# Requirements
+1. Values must be realistic and match real browser behavior
+2. Ensure consistency across related variables (e.g., UA matches platform)
+3. Consider anti-detection (avoid obvious fake values)
+4. Follow W3C specifications for API return types`;
+    const userPrompt = `# Target Browser
+${browserType.toUpperCase()}
+
+# Missing Variables (need values)
+${JSON.stringify(missingPaths, null, 2)}
+
+# Code Context (for understanding usage)
+\`\`\`javascript
+${code.substring(0, 2000)}${code.length > 2000 ? '\n...(truncated)' : ''}
+\`\`\`
+
+# Existing Variables (for consistency)
+${JSON.stringify(existingManifest, null, 2)}
+
+# Required Output
+Return ONLY valid JSON object with missing variable paths as keys and realistic values:
+
+\`\`\`json
+{
+  "navigator.userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36...",
+  "navigator.platform": "Win32",
+  "window.innerWidth": 1920,
+  "...": "other missing variables"
+}
+\`\`\`
+
+# Guidelines
+- Use realistic values matching target browser
+- Ensure cross-variable consistency
+- Consider code usage patterns
+- Avoid placeholder values like "test" or "example"
+
+Return ONLY the JSON object:`;
+    return [
+        { role: 'system', content: systemPrompt },
+        { role: 'user', content: userPrompt },
+    ];
+}
+//# sourceMappingURL=environment.js.map

package/dist/services/prompts/environment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment.js","sourceRoot":"","sources":["../../../src/services/prompts/environment.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,kCAAkC,CAChD,IAAY,EACZ,QAAgB,EAChB,OAA8C,EAC9C,WAAmB;IAEnB,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC;IAE/F,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;iEA4B0C,CAAC;IAEhE,MAAM,UAAU,GAAG;EACnB,WAAW,CAAC,WAAW,EAAE;;;;EAIzB,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;;;;;EAKjC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;;;;;EAKhC,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qFA0DwE,CAAC;IAEpF,OAAO;QACL,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE;QACzC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,IAAY;IAC5D,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8FAmCuE,CAAC;IAE7F,MAAM,UAAU,GAAG;;EAEnB,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;4CA4B9B,CAAC;IAE3C,OAAO;QACL,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE;QACzC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,OAAe,EAAE,OAAe;IAChF,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;oCAqBa,CAAC;IAEnC,MAAM,UAAU,GAAG;IACjB,OAAO;;;;EAIT,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE;;;;;;;;;;;;;uCAavC,OAAO,KAAK,CAAC;IAElD,OAAO;QACL,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE;QACzC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,QAAkC,EAClC,OAA8C,EAC9C,WAAmB;IAEnB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC;IAExD,MAAM,YAAY,GAAG;;;;;;;;;;;2DAWoC,CAAC;IAE1D,MAAM,UAAU,GAAG;wBACG,WAAW,CAAC,WAAW,EAAE;4BACrB,SAAS;sBACf,OAAO,CAAC,MAAM;;;EAGlC,OAAO;SACN,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC;SACzC,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,aAAa,OAAO,CAAC,MAAM,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE;;;sBAG5D,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM;mBACpC,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM;qBAC5B,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM;mBAClC,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM;;;;;;;;;;;;;;;;;;;8BAmBnB,CAAC;IAE7B,OAAO;QACL,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE;QACzC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yCAAyC,CACvD,WAAkD,EAClD,IAAY;IAEZ,MAAM,YAAY,GAAG;;;;;;;;;;;iEAW0C,CAAC;IAEhE,MAAM,UAAU,GAAG;EACnB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;;;;EAIjD,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE;;;;;;;;;;;;;;6BAc3C,CAAC;IAE5B,OAAO;QACL,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE;QACzC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,WAAmB,EACnB,YAAsB,EACtB,IAAY,EACZ,gBAAyC;IAEzC,MAAM,YAAY,GAAG;;;;;;;;;;kDAU2B,CAAC;IAEjD,MAAM,UAAU,GAAG;EACnB,WAAW,CAAC,WAAW,EAAE;;;EAGzB,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;;;;EAIrC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE;;;;EAItE,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;6BAoBd,CAAC;IAE5B,OAAO;QACL,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE;QACzC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE;KACtC,CAAC;AACJ,CAAC"}

package/dist/services/prompts/intelligence.d.ts

@@ -0,0 +1,5 @@
+import type { LLMMessage } from '../LLMService.js';
+export declare function generateRequestAnalysisMessages(requestSummary: object): LLMMessage[];
+export declare function generateLogAnalysisMessages(logSummary: object[]): LLMMessage[];
+export declare function generateKeywordExpansionMessages(domain: string, urlPatterns: object[], logKeywords: string[]): LLMMessage[];
+//# sourceMappingURL=intelligence.d.ts.map

package/dist/services/prompts/intelligence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"intelligence.d.ts","sourceRoot":"","sources":["../../../src/services/prompts/intelligence.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,wBAAgB,+BAA+B,CAAC,cAAc,EAAE,MAAM,GAAG,UAAU,EAAE,CAkGpF;AAED,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,UAAU,EAAE,CAqG9E;AAED,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EAAE,EACrB,WAAW,EAAE,MAAM,EAAE,GACpB,UAAU,EAAE,CAsDd"}

package/dist/services/prompts/intelligence.js

@@ -0,0 +1,251 @@
+export function generateRequestAnalysisMessages(requestSummary) {
+    const systemPrompt = `# Role
+You are a senior security researcher and JavaScript analyst specializing in:
+- Web API security analysis and cryptographic pattern recognition
+- Authentication and authorization mechanism identification (OAuth, JWT, SAML, custom tokens)
+- Encryption algorithm detection (AES, RSA, DES, 3DES, ChaCha20, etc.)
+- Signature scheme analysis (HMAC, RSA-PSS, ECDSA, custom signing)
+- Parameter encoding and obfuscation techniques (Base64, Hex, URL encoding, custom encoding)
+
+# Expertise Areas
+- **Symmetric Encryption**: AES (CBC, GCM, CTR), DES, 3DES, Blowfish, ChaCha20
+- **Asymmetric Encryption**: RSA (PKCS1, OAEP), ECC, ElGamal
+- **Hash Functions**: MD5, SHA-1, SHA-256, SHA-512, BLAKE2, RIPEMD
+- **MAC**: HMAC-SHA256, HMAC-SHA512, CMAC
+- **Encoding**: Base64, Hex, URL encoding, custom Base variants
+- **Token Formats**: JWT (HS256, RS256), OAuth 2.0, SAML, custom tokens
+
+# Task
+Analyze HTTP requests to identify cryptographic patterns, authentication mechanisms, and security-related parameters.
+
+# Analysis Methodology
+1. **URL Analysis**: Examine URL paths and query parameters for crypto-related keywords
+2. **Header Analysis**: Check Authorization, X-Signature, X-Token headers
+3. **Parameter Analysis**: Identify encrypted/encoded parameters by pattern (length, charset, format)
+4. **Signature Detection**: Look for sign/signature/hmac parameters and their dependencies
+5. **Token Detection**: Identify JWT (xxx.yyy.zzz), OAuth tokens, session tokens
+6. **Custom Pattern Recognition**: Detect proprietary encryption/signing schemes
+
+# Output Requirements
+- Return ONLY valid JSON (no markdown, no explanations)
+- Use confidence scores (0.0-1.0) for uncertain detections
+- Provide specific evidence for each detection
+- Be precise and avoid hallucination`;
+    const userPrompt = `# Network Requests to Analyze
+\`\`\`json
+${JSON.stringify(requestSummary, null, 2)}
+\`\`\`
+
+# Required Output Schema
+Return a JSON object with this EXACT structure (all fields required):
+
+\`\`\`json
+{
+  "encryption": [
+    {
+      "type": "AES-256-CBC | RSA-2048 | MD5 | SHA-256 | Base64 | Custom",
+      "location": "URL parameter name or header name",
+      "confidence": 0.95,
+      "evidence": ["evidence 1", "evidence 2"],
+      "parameters": {
+        "parameterName": "data",
+        "sampleValue": "first 50 chars...",
+        "detectedPattern": "Base64 | Hex | Custom",
+        "estimatedKeySize": "128 | 192 | 256 | null"
+      }
+    }
+  ],
+  "signature": [
+    {
+      "type": "HMAC-SHA256 | JWT-RS256 | Custom",
+      "location": "URL or header",
+      "parameters": ["timestamp", "nonce", "data"],
+      "confidence": 0.88,
+      "signatureParameter": "sign",
+      "algorithm": "detected or inferred algorithm",
+      "evidence": ["evidence 1", "evidence 2"]
+    }
+  ],
+  "token": [
+    {
+      "type": "JWT | OAuth2 | Custom",
+      "location": "Authorization header | URL parameter",
+      "format": "Bearer JWT | URL parameter 'access_token'",
+      "confidence": 0.98,
+      "tokenStructure": "xxx.yyy.zzz (JWT) | opaque string",
+      "evidence": ["evidence 1", "evidence 2"]
+    }
+  ],
+  "customPatterns": [
+    {
+      "type": "Anti-replay | Rate limiting | Custom encryption | Other",
+      "description": "Detailed description of the pattern",
+      "location": "URL or header",
+      "confidence": 0.75,
+      "relatedParameters": ["param1", "param2"],
+      "evidence": ["evidence 1", "evidence 2"]
+    }
+  ]
+}
+\`\`\`
+
+Now analyze the provided requests and return ONLY the JSON output (no additional text).`;
+    return [
+        { role: 'system', content: systemPrompt },
+        { role: 'user', content: userPrompt },
+    ];
+}
+export function generateLogAnalysisMessages(logSummary) {
+    const systemPrompt = `# Role
+You are an expert JavaScript analyst and security analyst specializing in:
+- Console log analysis and code behavior understanding
+- Anti-debugging technique detection (debugger statements, DevTools detection, timing checks)
+- Code obfuscation pattern recognition (string arrays, control flow flattening, VM protection)
+- Cryptographic operation identification from runtime logs
+- Data flow analysis and sensitive information leakage detection
+- Framework and library identification from console output
+
+# Known Patterns
+**Anti-Debugging**:
+- debugger statements
+- DevTools detection (window.outerHeight - window.innerHeight)
+- Function.prototype.toString checks
+- Timing-based detection (performance.now, Date.now)
+- Console.log redirection/blocking
+
+**Obfuscation Indicators**:
+- Mangled variable names (_0x1234, _0xabcd)
+- String array decoders
+- Control flow state machines
+- Eval/Function constructor usage
+
+**Crypto Operations**:
+- CryptoJS, crypto-js, JSEncrypt, forge library calls
+- Web Crypto API usage (crypto.subtle)
+- Custom encryption function calls
+
+**Sensitive Operations**:
+- localStorage/sessionStorage access
+- Cookie manipulation
+- XHR/Fetch API calls
+- WebSocket connections
+
+# Task
+Analyze console logs to:
+1. Identify key functions and their purposes
+2. Map data flow through the application
+3. Detect suspicious patterns (anti-debugging, obfuscation, crypto)
+4. Assess security implications
+
+# Analysis Standards
+- Use OWASP guidelines for security assessment
+- Provide confidence scores for uncertain identifications
+- Be precise and avoid hallucination
+- Focus on actionable insights`;
+    const userPrompt = `# Console Logs to Analyze
+\`\`\`json
+${JSON.stringify(logSummary, null, 2)}
+\`\`\`
+
+# Required Output Schema
+Return ONLY valid JSON with this exact structure:
+
+\`\`\`json
+{
+  "keyFunctions": [
+    {
+      "name": "function name",
+      "purpose": "what the function does",
+      "confidence": 0.92,
+      "evidence": ["evidence 1", "evidence 2"],
+      "category": "encryption | authentication | data-processing | network | obfuscation | other"
+    }
+  ],
+  "dataFlow": "Concise description of how data flows through the application based on logs",
+  "suspiciousPatterns": [
+    {
+      "type": "anti-debugging | obfuscation | crypto | data-leakage | other",
+      "description": "Detailed description of the suspicious pattern",
+      "location": "log index or URL",
+      "severity": "critical | high | medium | low",
+      "evidence": ["specific log entries that support this finding"],
+      "recommendation": "how to investigate or mitigate"
+    }
+  ],
+  "frameworkDetection": {
+    "detected": true,
+    "frameworks": ["React 18.x", "Axios 1.x"],
+    "confidence": 0.88,
+    "evidence": ["evidence 1"]
+  },
+  "securityConcerns": [
+    {
+      "type": "string",
+      "description": "string",
+      "severity": "critical | high | medium | low",
+      "recommendation": "string"
+    }
+  ]
+}
+\`\`\`
+
+Return ONLY the JSON output.`;
+    return [
+        { role: 'system', content: systemPrompt },
+        { role: 'user', content: userPrompt },
+    ];
+}
+export function generateKeywordExpansionMessages(domain, urlPatterns, logKeywords) {
+    const systemPrompt = `# Role
+You are a web application security analyst specializing in:
+- API endpoint pattern recognition
+- Business logic inference from network traffic
+- Framework and library identification
+- Cryptographic operation detection
+- Domain-specific terminology extraction
+
+# Task
+Analyze the provided network requests and console logs to infer relevant keywords that can help filter and prioritize future analysis.
+
+# Methodology
+1. **API Keywords**: Extract common API-related terms from URL paths and parameters
+2. **Crypto Keywords**: Identify encryption, hashing, signing related terms
+3. **Framework Keywords**: Detect framework-specific patterns and terminology
+4. **Business Keywords**: Infer business domain terms (e.g., 'order', 'payment', 'user')
+
+# Output Requirements
+- Return ONLY valid JSON
+- Keywords should be lowercase
+- Avoid generic terms (e.g., 'data', 'info')
+- Focus on actionable, specific keywords
+- Limit to 10-15 keywords per category`;
+    const userPrompt = `# Website Domain
+${domain}
+
+# URL Patterns (${urlPatterns.length} samples)
+\`\`\`json
+${JSON.stringify(urlPatterns, null, 2)}
+\`\`\`
+
+# Console Log Samples (${logKeywords.length} samples)
+\`\`\`
+${logKeywords.join('\n---\n')}
+\`\`\`
+
+# Required Output Schema
+\`\`\`json
+{
+  "apiKeywords": ["auth", "login", "verify", "validate"],
+  "cryptoKeywords": ["encrypt", "decrypt", "sign", "hash", "token"],
+  "frameworkKeywords": ["react", "vue", "axios", "redux"],
+  "businessKeywords": ["order", "payment", "cart", "checkout", "product"]
+}
+\`\`\`
+
+Now analyze the data and return ONLY the JSON output.`;
+    return [
+        { role: 'system', content: systemPrompt },
+        { role: 'user', content: userPrompt },
+    ];
+}
+//# sourceMappingURL=intelligence.js.map

package/dist/services/prompts/intelligence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"intelligence.js","sourceRoot":"","sources":["../../../src/services/prompts/intelligence.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,+BAA+B,CAAC,cAAsB;IACpE,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCA+Bc,CAAC;IAEpC,MAAM,UAAU,GAAG;;EAEnB,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wFAwD+C,CAAC;IAEvF,OAAO;QACL,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE;QACzC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,UAAoB;IAC9D,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;+BA6CQ,CAAC;IAE9B,MAAM,UAAU,GAAG;;EAEnB,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6BA6CR,CAAC;IAE5B,OAAO;QACL,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE;QACzC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,MAAc,EACd,WAAqB,EACrB,WAAqB;IAErB,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;uCAsBgB,CAAC;IAEtC,MAAM,UAAU,GAAG;EACnB,MAAM;;kBAEU,WAAW,CAAC,MAAM;;EAElC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;;;yBAGb,WAAW,CAAC,MAAM;;EAEzC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC;;;;;;;;;;;;;sDAayB,CAAC;IAErD,OAAO;QACL,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE;QACzC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE;KACtC,CAAC;AACJ,CAAC"}

package/dist/services/prompts/taint.d.ts

@@ -0,0 +1,3 @@
+import type { LLMMessage } from '../LLMService.js';
+export declare function generateTaintAnalysisPrompt(code: string, sources: string[], sinks: string[]): LLMMessage[];
+//# sourceMappingURL=taint.d.ts.map

package/dist/services/prompts/taint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"taint.d.ts","sourceRoot":"","sources":["../../../src/services/prompts/taint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EAAE,EACjB,KAAK,EAAE,MAAM,EAAE,GACd,UAAU,EAAE,CAuDd"}