@jshookmcp/jshook 0.1.3 → 0.1.5

package/dist/server/domains/transform/handlers.impl.transform-base.js

@@ -28,98 +28,98 @@ export const CRYPTO_KEYWORDS = [
     'aes',
     'rsa',
 ];
-const CRYPTO_TEST_WORKER_SCRIPT = `
-const __bootstrap = async () => {
-  const [workerThreads, vm, perfHooks] = await Promise.all([
-    import('node:worker_threads'),
-    import('node:vm'),
-    import('node:perf_hooks'),
-  ]);
-
-  const parentPort = workerThreads.parentPort;
-  const performance = perfHooks.performance;
-
-  if (!parentPort) {
-    throw new Error('worker parentPort is unavailable');
-  }
-
-  function normalizeOutput(value) {
-    if (value === undefined) return '__undefined__';
-    if (value === null) return 'null';
-    if (typeof value === 'string') return value;
-    if (typeof value === 'number' || typeof value === 'boolean' || typeof value === 'bigint') return String(value);
-    try { return JSON.stringify(value); } catch { return String(value); }
-  }
-
-  parentPort.on('message', async (msg) => {
-    const { jobId, payload } = msg;
-    try {
-      const { code, functionName, testInputs } = payload;
-      const sandbox = {
-        console: { log() {}, warn() {}, error() {} },
-        Buffer,
-        TextEncoder,
-        TextDecoder,
-        atob: (v) => Buffer.from(String(v), 'base64').toString('binary'),
-        btoa: (v) => Buffer.from(String(v), 'binary').toString('base64'),
-      };
-      sandbox.globalThis = sandbox;
-      const context = vm.createContext(sandbox);
-
-      const isValidIdentifier = /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(functionName);
-      const bindCode = isValidIdentifier
-        ? "\\n;globalThis.__targetFn = (typeof " + functionName + " !== 'undefined' ? " + functionName + " : globalThis[" + JSON.stringify(functionName) + "]);"
-        : "\\n;globalThis.__targetFn = globalThis[" + JSON.stringify(functionName) + "];";
-
-      const script = new vm.Script(code + bindCode, { timeout: 5000 });
-      script.runInContext(context, { timeout: 5000 });
-
-      const targetFn = context.__targetFn;
-      if (typeof targetFn !== 'function') {
-        throw new Error("Function not found or not callable: " + functionName);
-      }
-
-      const rows = [];
-      for (const input of testInputs) {
-        const started = performance.now();
-        try {
-          const raw = targetFn(input);
-          const resolved = raw && typeof raw.then === 'function' ? await raw : raw;
-          rows.push({
-            input,
-            output: normalizeOutput(resolved),
-            duration: Number((performance.now() - started).toFixed(3)),
-          });
-        } catch (err) {
-          rows.push({
-            input,
-            output: '',
-            error: err && err.message ? err.message : String(err),
-            duration: Number((performance.now() - started).toFixed(3)),
-          });
-        }
-      }
-
-      parentPort.postMessage({ jobId, ok: true, result: { ok: true, results: rows } });
-    } catch (error) {
-      parentPort.postMessage({
-        jobId,
-        ok: true,
-        result: {
-          ok: false,
-          error: error && error.message ? error.message : String(error),
-          results: [],
-        },
-      });
-    }
-  });
-};
-
-__bootstrap().catch((error) => {
-  if (typeof console !== 'undefined' && typeof console.error === 'function') {
-    console.error('crypto harness worker bootstrap failed:', error && error.message ? error.message : String(error));
-  }
-});
+const CRYPTO_TEST_WORKER_SCRIPT = `
+const __bootstrap = async () => {
+  const [workerThreads, vm, perfHooks] = await Promise.all([
+    import('node:worker_threads'),
+    import('node:vm'),
+    import('node:perf_hooks'),
+  ]);
+
+  const parentPort = workerThreads.parentPort;
+  const performance = perfHooks.performance;
+
+  if (!parentPort) {
+    throw new Error('worker parentPort is unavailable');
+  }
+
+  function normalizeOutput(value) {
+    if (value === undefined) return '__undefined__';
+    if (value === null) return 'null';
+    if (typeof value === 'string') return value;
+    if (typeof value === 'number' || typeof value === 'boolean' || typeof value === 'bigint') return String(value);
+    try { return JSON.stringify(value); } catch { return String(value); }
+  }
+
+  parentPort.on('message', async (msg) => {
+    const { jobId, payload } = msg;
+    try {
+      const { code, functionName, testInputs } = payload;
+      const sandbox = {
+        console: { log() {}, warn() {}, error() {} },
+        Buffer,
+        TextEncoder,
+        TextDecoder,
+        atob: (v) => Buffer.from(String(v), 'base64').toString('binary'),
+        btoa: (v) => Buffer.from(String(v), 'binary').toString('base64'),
+      };
+      sandbox.globalThis = sandbox;
+      const context = vm.createContext(sandbox);
+
+      const isValidIdentifier = /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(functionName);
+      const bindCode = isValidIdentifier
+        ? "\\n;globalThis.__targetFn = (typeof " + functionName + " !== 'undefined' ? " + functionName + " : globalThis[" + JSON.stringify(functionName) + "]);"
+        : "\\n;globalThis.__targetFn = globalThis[" + JSON.stringify(functionName) + "];";
+
+      const script = new vm.Script(code + bindCode, { timeout: 5000 });
+      script.runInContext(context, { timeout: 5000 });
+
+      const targetFn = context.__targetFn;
+      if (typeof targetFn !== 'function') {
+        throw new Error("Function not found or not callable: " + functionName);
+      }
+
+      const rows = [];
+      for (const input of testInputs) {
+        const started = performance.now();
+        try {
+          const raw = targetFn(input);
+          const resolved = raw && typeof raw.then === 'function' ? await raw : raw;
+          rows.push({
+            input,
+            output: normalizeOutput(resolved),
+            duration: Number((performance.now() - started).toFixed(3)),
+          });
+        } catch (err) {
+          rows.push({
+            input,
+            output: '',
+            error: err && err.message ? err.message : String(err),
+            duration: Number((performance.now() - started).toFixed(3)),
+          });
+        }
+      }
+
+      parentPort.postMessage({ jobId, ok: true, result: { ok: true, results: rows } });
+    } catch (error) {
+      parentPort.postMessage({
+        jobId,
+        ok: true,
+        result: {
+          ok: false,
+          error: error && error.message ? error.message : String(error),
+          results: [],
+        },
+      });
+    }
+  });
+};
+
+__bootstrap().catch((error) => {
+  if (typeof console !== 'undefined' && typeof console.error === 'function') {
+    console.error('crypto harness worker bootstrap failed:', error && error.message ? error.message : String(error));
+  }
+});
 `;
 export class TransformToolHandlersBase {
     collector;
@@ -225,9 +225,9 @@ export class TransformToolHandlersBase {
             .replace(/\\v/g, '\v')
             .replace(/\\f/g, '\f')
             .replace(/\\0/g, '\0')
-            .replace(/\\\\/g, '\\')
             .replace(/\\"/g, '"')
-            .replace(/\\'/g, "'");
+            .replace(/\\'/g, "'")
+            .replace(/\\\\/g, '\\');
     }
     async resolveScriptSource(scriptId) {
         let manager = null;
@@ -333,16 +333,16 @@ export class TransformToolHandlersBase {
         return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(value);
     }
     buildCryptoPolyfills() {
-        return `
-const __textEncoder = typeof TextEncoder !== 'undefined' ? new TextEncoder() : null;
-const __textDecoder = typeof TextDecoder !== 'undefined' ? new TextDecoder() : null;
-
-if (typeof globalThis.atob === 'undefined') {
-  globalThis.atob = (value) => Buffer.from(String(value), 'base64').toString('binary');
-}
-if (typeof globalThis.btoa === 'undefined') {
-  globalThis.btoa = (value) => Buffer.from(String(value), 'binary').toString('base64');
-}
+        return `
+const __textEncoder = typeof TextEncoder !== 'undefined' ? new TextEncoder() : null;
+const __textDecoder = typeof TextDecoder !== 'undefined' ? new TextDecoder() : null;
+
+if (typeof globalThis.atob === 'undefined') {
+  globalThis.atob = (value) => Buffer.from(String(value), 'base64').toString('binary');
+}
+if (typeof globalThis.btoa === 'undefined') {
+  globalThis.btoa = (value) => Buffer.from(String(value), 'binary').toString('base64');
+}
 `.trim();
     }
     async runCryptoHarness(code, functionName, testInputs) {
@@ -392,4 +392,3 @@ if (typeof globalThis.btoa === 'undefined') {
         });
     }
 }
-//# sourceMappingURL=handlers.impl.transform-base.js.map

package/dist/server/domains/transform/handlers.impl.transform-crypto.d.ts

@@ -19,4 +19,3 @@ export declare class TransformToolHandlersCrypto extends TransformToolHandlersOp
         }[];
     }>;
 }
-//# sourceMappingURL=handlers.impl.transform-crypto.d.ts.map

package/dist/server/domains/transform/handlers.impl.transform-crypto.js

@@ -250,4 +250,3 @@ export class TransformToolHandlersCrypto extends TransformToolHandlersOps {
         }
     }
 }
-//# sourceMappingURL=handlers.impl.transform-crypto.js.map

package/dist/server/domains/transform/handlers.impl.transform-ops.d.ts

@@ -12,4 +12,3 @@ export declare class TransformToolHandlersOps extends TransformToolHandlersBase
     protected buildDiff(original: string, transformed: string): string;
     protected buildFallbackDiff(oldLines: string[], newLines: string[]): string;
 }
-//# sourceMappingURL=handlers.impl.transform-ops.d.ts.map

package/dist/server/domains/transform/handlers.impl.transform-ops.js

@@ -224,4 +224,3 @@ export class TransformToolHandlersOps extends TransformToolHandlersBase {
         return [...removed, ...added].join('\n');
     }
 }
-//# sourceMappingURL=handlers.impl.transform-ops.js.map

package/dist/server/domains/transform/handlers.js

@@ -1,2 +1 @@
 export { TransformToolHandlers } from '../../domains/transform/handlers.impl.js';
-//# sourceMappingURL=handlers.js.map

package/dist/server/domains/transform/index.d.ts

@@ -1,3 +1,2 @@
 export { transformTools } from '../../domains/transform/definitions.js';
 export { TransformToolHandlers } from '../../domains/transform/handlers.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/server/domains/transform/index.js

@@ -1,3 +1,2 @@
 export { transformTools } from '../../domains/transform/definitions.js';
 export { TransformToolHandlers } from '../../domains/transform/handlers.js';
-//# sourceMappingURL=index.js.map

package/dist/server/domains/transform/manifest.d.ts

@@ -5,4 +5,3 @@ declare const DEP_KEY: "transformHandlers";
 type H = TransformToolHandlers;
 declare const manifest: DomainManifest<typeof DEP_KEY, H, typeof DOMAIN>;
 export default manifest;
-//# sourceMappingURL=manifest.d.ts.map

package/dist/server/domains/transform/manifest.js

@@ -30,4 +30,3 @@ const manifest = {
     ],
 };
 export default manifest;
-//# sourceMappingURL=manifest.js.map

package/dist/server/domains/wasm/definitions.d.ts

@@ -1,3 +1,2 @@
 import type { Tool } from '@modelcontextprotocol/sdk/types.js';
 export declare const wasmTools: Tool[];
-//# sourceMappingURL=definitions.d.ts.map

package/dist/server/domains/wasm/definitions.js

@@ -184,4 +184,3 @@ export const wasmTools = [
         },
     },
 ];
-//# sourceMappingURL=definitions.js.map

package/dist/server/domains/wasm/handlers.d.ts

@@ -54,4 +54,3 @@ export declare class WasmToolHandlers {
         }[];
     }>;
 }
-//# sourceMappingURL=handlers.d.ts.map

package/dist/server/domains/wasm/handlers.js

@@ -494,4 +494,3 @@ export class WasmToolHandlers {
         };
     }
 }
-//# sourceMappingURL=handlers.js.map

package/dist/server/domains/wasm/index.d.ts

@@ -1,3 +1,2 @@
 export { wasmTools } from '../../domains/wasm/definitions.js';
 export { WasmToolHandlers } from '../../domains/wasm/handlers.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/server/domains/wasm/index.js

@@ -1,3 +1,2 @@
 export { wasmTools } from '../../domains/wasm/definitions.js';
 export { WasmToolHandlers } from '../../domains/wasm/handlers.js';
-//# sourceMappingURL=index.js.map

package/dist/server/domains/wasm/manifest.d.ts

@@ -5,4 +5,3 @@ declare const DEP_KEY: "wasmHandlers";
 type H = WasmToolHandlers;
 declare const manifest: DomainManifest<typeof DEP_KEY, H, typeof DOMAIN>;
 export default manifest;
-//# sourceMappingURL=manifest.d.ts.map

package/dist/server/domains/wasm/manifest.js

@@ -32,4 +32,3 @@ const manifest = {
     ],
 };
 export default manifest;
-//# sourceMappingURL=manifest.js.map

package/dist/server/domains/workflow/definitions.d.ts

@@ -1,3 +1,2 @@
 import type { Tool } from '@modelcontextprotocol/sdk/types.js';
 export declare const workflowToolDefinitions: Tool[];
-//# sourceMappingURL=definitions.d.ts.map

package/dist/server/domains/workflow/definitions.js

@@ -357,4 +357,3 @@ export const workflowToolDefinitions = [
         },
     },
 ];
-//# sourceMappingURL=definitions.js.map

package/dist/server/domains/workflow/handlers.d.ts

@@ -1,2 +1 @@
 export { WorkflowHandlers } from '../../domains/workflow/handlers.impl.js';
-//# sourceMappingURL=handlers.d.ts.map

package/dist/server/domains/workflow/handlers.impl.core.d.ts

@@ -1,4 +1,3 @@
 import { WorkflowHandlersBatch } from '../../domains/workflow/handlers.impl.workflow-batch.js';
 export declare class WorkflowHandlers extends WorkflowHandlersBatch {
 }
-//# sourceMappingURL=handlers.impl.core.d.ts.map

package/dist/server/domains/workflow/handlers.impl.core.js

@@ -1,4 +1,3 @@
 import { WorkflowHandlersBatch } from '../../domains/workflow/handlers.impl.workflow-batch.js';
 export class WorkflowHandlers extends WorkflowHandlersBatch {
 }
-//# sourceMappingURL=handlers.impl.core.js.map

package/dist/server/domains/workflow/handlers.impl.d.ts

@@ -1,2 +1 @@
 export { WorkflowHandlers } from '../../domains/workflow/handlers.impl.core.js';
-//# sourceMappingURL=handlers.impl.d.ts.map

package/dist/server/domains/workflow/handlers.impl.js

@@ -1,2 +1 @@
 export { WorkflowHandlers } from '../../domains/workflow/handlers.impl.core.js';
-//# sourceMappingURL=handlers.impl.js.map

package/dist/server/domains/workflow/handlers.impl.workflow-account-bundle.d.ts

@@ -13,4 +13,3 @@ export declare class WorkflowHandlersAccountBundle extends WorkflowHandlersApi {
         }[];
     }>;
 }
-//# sourceMappingURL=handlers.impl.workflow-account-bundle.d.ts.map

package/dist/server/domains/workflow/handlers.impl.workflow-account-bundle.js

@@ -1,9 +1,11 @@
 import { logger } from '../../../utils/logger.js';
 import { WORKFLOW_JS_BUNDLE_MAX_SIZE_BYTES, WORKFLOW_JS_BUNDLE_MAX_REDIRECTS, WORKFLOW_JS_BUNDLE_FETCH_TIMEOUT_MS, } from '../../../constants.js';
-import { isSsrfTarget, isPrivateHost } from '../../domains/network/replay.js';
+import { isSsrfTarget, isPrivateHost, isLoopbackHost } from '../../domains/network/replay.js';
 import { lookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
 import { WorkflowHandlersBase } from '../../domains/workflow/handlers.impl.workflow-base.js';
 import { WorkflowHandlersApi } from '../../domains/workflow/handlers.impl.workflow-api.js';
+const LOOPBACK_HTTP_URL_RE = /^http:\/\/(localhost|127\.0\.0\.1|\[::1\])(?::\d+)?(\/|$)/i;
 export class WorkflowHandlersAccountBundle extends WorkflowHandlersApi {
     async handleRegisterAccountFlow(args) {
         const registerUrl = args.registerUrl;
@@ -54,8 +56,9 @@ export class WorkflowHandlersAccountBundle extends WorkflowHandlersApi {
             for (const cbSelector of checkboxSelectors) {
                 steps.push(`page_click(${cbSelector})`);
                 try {
+                    const checkboxSelectorLiteral = this.escapeInlineScriptLiteral(JSON.stringify(cbSelector));
                     await this.deps.browserHandlers.handlePageEvaluate({
-                        code: `(function(){const cb=document.querySelector('${cbSelector.replace(/'/g, "\\'")}');if(!cb)return false;cb.click();cb.checked=true;cb.dispatchEvent(new Event('change',{bubbles:true}));return true;})()`,
+                        code: `(function(){const cb=document.querySelector(${checkboxSelectorLiteral});if(!cb)return false;cb.click();cb.checked=true;cb.dispatchEvent(new Event('change',{bubbles:true}));return true;})()`,
                     });
                 }
                 catch (e) {
@@ -93,11 +96,12 @@ export class WorkflowHandlersAccountBundle extends WorkflowHandlersApi {
                     const deadline = Date.now() + timeoutMs;
                     while (Date.now() < deadline) {
                         try {
+                            const verificationLinkPatternLiteral = this.escapeInlineScriptLiteral(JSON.stringify(verificationLinkPattern));
                             const linkResult = await this.deps.browserHandlers.handleTabWorkflow({
                                 action: 'transfer',
                                 fromAlias: 'emailTab',
                                 key: '__verificationLink',
-                                expression: `(function(){const links=Array.from(document.querySelectorAll('a'));const l=links.find(a=>(a.href||'').includes('${verificationLinkPattern.replace(/'/g, "\\'")}'));return l?l.href:null;})()`,
+                                expression: `(function(){const links=Array.from(document.querySelectorAll('a'));const l=links.find(a=>(a.href||'').includes(${verificationLinkPatternLiteral}));return l?l.href:null;})()`,
                             });
                             const linkText = linkResult.content[0]?.text;
                             if (typeof linkText !== 'string') {
@@ -197,16 +201,22 @@ export class WorkflowHandlersAccountBundle extends WorkflowHandlersApi {
                 const hostname = parsed.hostname.replace(/^\[|\]$/g, '');
                 let fetchUrl = currentUrl;
                 const headers = {};
-                if (!/^\d+\.\d+\.\d+\.\d+$/.test(hostname) && !hostname.startsWith('[')) {
+                const isIpLiteral = isIP(hostname) !== 0;
+                if (parsed.protocol === 'http:' && !isLoopbackHost(hostname)) {
+                    throw new Error(`Blocked: insecure HTTP is only allowed for loopback targets, got "${currentUrl}"`);
+                }
+                if (!isIpLiteral) {
                     try {
                         const { address: resolvedIp } = await lookup(hostname);
                         if (isPrivateHost(resolvedIp)) {
                             throw new Error(`Blocked: "${currentUrl}" resolved to private IP ${resolvedIp}`);
                         }
-                        const originalHost = parsed.host;
-                        parsed.hostname = resolvedIp.includes(':') ? `[${resolvedIp}]` : resolvedIp;
-                        fetchUrl = parsed.toString();
-                        headers['Host'] = originalHost;
+                        if (parsed.protocol === 'http:') {
+                            const originalHost = parsed.host;
+                            parsed.hostname = resolvedIp.includes(':') ? `[${resolvedIp}]` : resolvedIp;
+                            fetchUrl = parsed.toString();
+                            headers['Host'] = originalHost;
+                        }
                     }
                     catch (e) {
                         if (e instanceof Error && e.message.startsWith('Blocked:'))
@@ -214,6 +224,9 @@ export class WorkflowHandlersAccountBundle extends WorkflowHandlersApi {
                         throw new Error(`DNS resolution failed for "${currentUrl}"`);
                     }
                 }
+                if (!fetchUrl.startsWith('https://') && !LOOPBACK_HTTP_URL_RE.test(fetchUrl)) {
+                    throw new Error(`Blocked: insecure HTTP is only allowed for loopback targets, got "${currentUrl}"`);
+                }
                 const resp = await fetch(fetchUrl, { signal, redirect: 'manual', headers });
                 if (resp.status >= 300 && resp.status < 400) {
                     const location = resp.headers.get('location');
@@ -356,4 +369,3 @@ export class WorkflowHandlersAccountBundle extends WorkflowHandlersApi {
         };
     }
 }
-//# sourceMappingURL=handlers.impl.workflow-account-bundle.js.map

package/dist/server/domains/workflow/handlers.impl.workflow-api.d.ts

@@ -8,4 +8,3 @@ export declare class WorkflowHandlersApi extends WorkflowHandlersBase {
         }[];
     }>;
 }
-//# sourceMappingURL=handlers.impl.workflow-api.d.ts.map

package/dist/server/domains/workflow/handlers.impl.workflow-api.js

@@ -329,4 +329,3 @@ export class WorkflowHandlersApi extends WorkflowHandlersBase {
         }
     }
 }
-//# sourceMappingURL=handlers.impl.workflow-api.js.map

package/dist/server/domains/workflow/handlers.impl.workflow-base.d.ts

@@ -58,6 +58,7 @@ export declare class WorkflowHandlersBase {
     constructor(deps: WorkflowHandlersDeps);
     protected evictBundleCache(): void;
     protected normalizeOutputPath(inputPath: string | undefined, defaultPath: string, preferredDir: string): string;
+    protected escapeInlineScriptLiteral(value: string): string;
     protected ensureParentDirectory(filePath: string): Promise<void>;
     protected safeWriteFile(filePath: string, data: string): Promise<void>;
     protected buildWebApiCaptureReportMarkdown(args: {
@@ -82,4 +83,3 @@ export declare class WorkflowHandlersBase {
     handleRunExtensionWorkflow(args: Record<string, unknown>): Promise<ToolHandlerResult>;
 }
 export {};
-//# sourceMappingURL=handlers.impl.workflow-base.d.ts.map