@jshookmcp/jshook 0.1.4 → 0.1.6

package/dist/modules/process/ProcessManager.impl.js

@@ -8,6 +8,7 @@ import { findChromiumProcessesWithConfig } from '../process/ProcessManager.chrom
 import { DEFAULT_CHROMIUM_CONFIG, } from '../process/ProcessManager.types.js';
 export { DEFAULT_CHROMIUM_CONFIG, } from '../process/ProcessManager.types.js';
 const execAsync = promisify(exec);
+const PROCESS_SNAPSHOT_CACHE_TTL_MS = 3000;
 function sanitizePsPattern(s) {
     return String(s || '').replace(/[`$"'{}();|<>@#%!\\\n\r]/g, '');
 }
@@ -21,6 +22,7 @@ export class ProcessManager {
     powershellPath = 'powershell.exe';
     scriptLoader;
     browserDiscovery;
+    processCache = new Map();
     constructor() {
         this.scriptLoader = new ScriptLoader();
         this.browserDiscovery = new BrowserDiscovery();
@@ -29,6 +31,12 @@ export class ProcessManager {
     async findProcesses(pattern) {
         try {
             const normalizedPattern = sanitizePsPattern(String(pattern || '').trim());
+            const cacheKey = normalizedPattern.toLowerCase() || '*';
+            const now = Date.now();
+            const cachedEntry = this.processCache.get(cacheKey);
+            if (cachedEntry && cachedEntry.expiresAt > now) {
+                return cachedEntry.snapshot;
+            }
             let psCommand;
             if (normalizedPattern) {
                 psCommand = `Get-Process -Name "*${normalizedPattern.replace(/"/g, '""')}*" -ErrorAction SilentlyContinue | Select-Object Id, ProcessName, Path, MainWindowTitle, MainWindowHandle, CPU, WorkingSet64 | ConvertTo-Json -Compress`;
@@ -37,20 +45,30 @@ export class ProcessManager {
                 psCommand = `Get-Process -ErrorAction SilentlyContinue | Select-Object Id, ProcessName, Path, MainWindowTitle, MainWindowHandle, CPU, WorkingSet64 | ConvertTo-Json -Compress`;
             }
             const { stdout } = await execAsync(`${this.powershellPath} -NoProfile -Command "${psCommand}"`, { maxBuffer: PROCESS_LIST_MAX_BUFFER_BYTES });
-            const processes = [];
             const lines = stdout.trim();
-            if (!lines || lines === 'null' || lines === '') {
-                return processes;
+            const processes = [];
+            if (lines && lines !== 'null') {
+                const data = JSON.parse(lines);
+                const procList = Array.isArray(data) ? data : [data];
+                for (const proc of procList) {
+                    processes.push({
+                        pid: proc.Id,
+                        name: proc.ProcessName,
+                        executablePath: proc.Path,
+                    });
+                }
             }
-            const data = JSON.parse(lines);
-            const procList = Array.isArray(data) ? data : [data];
-            for (const proc of procList) {
-                processes.push({
-                    pid: proc.Id,
-                    name: proc.ProcessName,
-                    executablePath: proc.Path,
-                });
+            const byPid = new Map();
+            for (const process of processes) {
+                byPid.set(process.pid, process);
             }
+            const lastDelta = this.computeProcessDiff(cachedEntry?.byPid ?? new Map(), byPid);
+            this.processCache.set(cacheKey, {
+                expiresAt: now + PROCESS_SNAPSHOT_CACHE_TTL_MS,
+                snapshot: processes,
+                byPid,
+                lastDelta,
+            });
             const patternStr = normalizedPattern.length > 0 ? `'${normalizedPattern}'` : 'all';
             logger.info(`Found ${processes.length} processes matching ${patternStr}`);
             return processes;
@@ -60,6 +78,29 @@ export class ProcessManager {
             return [];
         }
     }
+    computeProcessDiff(previousByPid, nextByPid) {
+        const added = [];
+        const removed = [];
+        const changed = [];
+        for (const [pid, nextProcess] of nextByPid) {
+            const previousProcess = previousByPid.get(pid);
+            if (!previousProcess) {
+                added.push(nextProcess);
+                continue;
+            }
+            if (previousProcess.pid !== nextProcess.pid ||
+                previousProcess.name !== nextProcess.name ||
+                previousProcess.executablePath !== nextProcess.executablePath) {
+                changed.push({ before: previousProcess, after: nextProcess });
+            }
+        }
+        for (const [pid, previousProcess] of previousByPid) {
+            if (!nextByPid.has(pid)) {
+                removed.push(previousProcess);
+            }
+        }
+        return { added, removed, changed };
+    }
     async getProcessByPid(pid) {
         try {
             pid = safePid(pid);
@@ -142,10 +183,10 @@ export class ProcessManager {
             return {};
         }
     }
-    async checkDebugPort(pid) {
+    async checkDebugPort(pid, options) {
         try {
             pid = safePid(pid);
-            const { commandLine } = await this.getProcessCommandLine(pid);
+            const commandLine = options?.commandLine ?? (await this.getProcessCommandLine(pid)).commandLine;
             if (commandLine) {
                 const match = commandLine.match(/--remote-debugging-port=(\d+)/);
                 if (match && match[1]) {
@@ -333,4 +374,3 @@ export class ProcessManager {
         }
     }
 }
-//# sourceMappingURL=ProcessManager.impl.js.map

package/dist/modules/process/ProcessManager.js

@@ -1,2 +1 @@
 export { DEFAULT_CHROMIUM_CONFIG, ProcessManager } from '../process/ProcessManager.impl.js';
-//# sourceMappingURL=ProcessManager.js.map

package/dist/modules/process/ProcessManager.types.d.ts

@@ -35,4 +35,3 @@ export interface TargetAppConfig {
     windowClassPattern?: string | RegExp;
 }
 export declare const DEFAULT_CHROMIUM_CONFIG: TargetAppConfig;
-//# sourceMappingURL=ProcessManager.types.d.ts.map

package/dist/modules/process/ProcessManager.types.js

@@ -2,4 +2,3 @@ export const DEFAULT_CHROMIUM_CONFIG = {
     processNamePattern: /^(chromium|chrome|msedge)$/i,
     windowClassPattern: 'Chrome_WidgetWin',
 };
-//# sourceMappingURL=ProcessManager.types.js.map

package/dist/modules/process/index.d.ts

@@ -22,7 +22,9 @@ export declare class UnifiedProcessManager {
     findProcesses(pattern: string): Promise<import("../process/ProcessManager.js").ProcessInfo[]>;
     getProcessByPid(pid: number): Promise<import("../process/ProcessManager.js").ProcessInfo | null>;
     getProcessWindows(pid: number): Promise<import("../process/ProcessManager.js").WindowInfo[]>;
-    checkDebugPort(pid: number): Promise<number | null>;
+    checkDebugPort(pid: number, options?: {
+        commandLine?: string;
+    }): Promise<number | null>;
     launchWithDebug(executablePath: string, debugPort?: number, args?: string[]): Promise<import("../process/ProcessManager.js").ProcessInfo | null>;
     killProcess(pid: number): Promise<boolean>;
     getProcessCommandLine(pid: number): Promise<{
@@ -34,4 +36,3 @@ export declare class UnifiedProcessManager {
         windowClassPattern?: string;
     }): Promise<import("../process/ProcessManager.js").ChromiumProcess | null>;
 }
-//# sourceMappingURL=index.d.ts.map

package/dist/modules/process/index.js

@@ -58,8 +58,8 @@ export class UnifiedProcessManager {
     async getProcessWindows(pid) {
         return this.manager.getProcessWindows(pid);
     }
-    async checkDebugPort(pid) {
-        return this.manager.checkDebugPort(pid);
+    async checkDebugPort(pid, options) {
+        return this.manager.checkDebugPort(pid, options);
     }
     async launchWithDebug(executablePath, debugPort, args) {
         return this.manager.launchWithDebug(executablePath, debugPort, args);
@@ -89,4 +89,3 @@ export class UnifiedProcessManager {
         return null;
     }
 }
-//# sourceMappingURL=index.js.map

package/dist/modules/process/memory/AuditTrail.d.ts

@@ -0,0 +1,25 @@
+export interface AuditEntry {
+    timestamp: string;
+    operation: string;
+    pid: number | null;
+    address: string | null;
+    size: number | null;
+    result: 'success' | 'failure';
+    error?: string;
+    durationMs: number;
+    user: string;
+    pattern?: string;
+    resultsCount?: number;
+    dllPath?: string;
+}
+export declare class MemoryAuditTrail {
+    private buffer;
+    private head;
+    private count;
+    private readonly capacity;
+    constructor(capacity?: number);
+    record(entry: Omit<AuditEntry, 'timestamp' | 'user'>): void;
+    exportJson(): string;
+    clear(): void;
+    size(): number;
+}

package/dist/modules/process/memory/AuditTrail.js

@@ -0,0 +1,44 @@
+export class MemoryAuditTrail {
+    buffer;
+    head = 0;
+    count = 0;
+    capacity;
+    constructor(capacity = 5000) {
+        this.capacity = Number.isInteger(capacity) && capacity > 0 ? capacity : 5000;
+        this.buffer = [];
+    }
+    record(entry) {
+        const fullEntry = {
+            ...entry,
+            timestamp: new Date().toISOString(),
+            user: process.env.USERNAME || process.env.USER || 'unknown',
+        };
+        if (this.count < this.capacity) {
+            const writeIndex = (this.head + this.count) % this.capacity;
+            this.buffer[writeIndex] = fullEntry;
+            this.count += 1;
+            return;
+        }
+        this.buffer[this.head] = fullEntry;
+        this.head = (this.head + 1) % this.capacity;
+    }
+    exportJson() {
+        const entries = [];
+        for (let i = 0; i < this.count; i += 1) {
+            const index = (this.head + i) % this.capacity;
+            const entry = this.buffer[index];
+            if (entry) {
+                entries.push(entry);
+            }
+        }
+        return JSON.stringify(entries, null, 2);
+    }
+    clear() {
+        this.buffer = [];
+        this.head = 0;
+        this.count = 0;
+    }
+    size() {
+        return this.count;
+    }
+}

package/dist/modules/process/memory/availability.d.ts

@@ -8,4 +8,3 @@ export declare function checkDebugPort(platform: Platform, pid: number): Promise
     isDebugged?: boolean;
     error?: string;
 }>;
-//# sourceMappingURL=availability.d.ts.map

package/dist/modules/process/memory/availability.js

@@ -166,4 +166,3 @@ try {
         };
     }
 }
-//# sourceMappingURL=availability.js.map

package/dist/modules/process/memory/index.d.ts

@@ -6,4 +6,3 @@ export { dumpMemoryRegion, enumerateRegions, checkMemoryProtection, enumerateMod
 export { injectDll, injectShellcode } from '../../process/memory/injector.js';
 export { MemoryMonitorManager } from '../../process/memory/monitor.js';
 export { checkAvailability, checkDebugPort } from '../../process/memory/availability.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/modules/process/memory/index.js

@@ -5,4 +5,3 @@ export { dumpMemoryRegion, enumerateRegions, checkMemoryProtection, enumerateMod
 export { injectDll, injectShellcode } from '../../process/memory/injector.js';
 export { MemoryMonitorManager } from '../../process/memory/monitor.js';
 export { checkAvailability, checkDebugPort } from '../../process/memory/availability.js';
-//# sourceMappingURL=index.js.map

package/dist/modules/process/memory/injector.d.ts

@@ -9,4 +9,3 @@ export declare function injectShellcode(platform: Platform, pid: number, shellco
     remoteThreadId?: number;
     error?: string;
 }>;
-//# sourceMappingURL=injector.d.ts.map

package/dist/modules/process/memory/injector.js

@@ -249,4 +249,3 @@ export async function injectShellcode(platform, pid, shellcode, encoding = 'hex'
         };
     }
 }
-//# sourceMappingURL=injector.js.map

package/dist/modules/process/memory/linux/mapsParser.d.ts

@@ -0,0 +1,16 @@
+export interface LinuxMemoryRegion {
+    start: bigint;
+    end: bigint;
+    permissions: {
+        read: boolean;
+        write: boolean;
+        exec: boolean;
+        private: boolean;
+    };
+    offset: bigint;
+    dev: string;
+    inode: number;
+    pathname: string;
+}
+export declare function parseProcMaps(content: string): LinuxMemoryRegion[];
+export declare function formatLinuxProtection(perms: LinuxMemoryRegion['permissions']): string;

package/dist/modules/process/memory/linux/mapsParser.js

@@ -0,0 +1,28 @@
+const PROC_MAPS_LINE_RE = /^([0-9a-f]+)-([0-9a-f]+)\s+([r-][w-][x-][ps])\s+([0-9a-f]+)\s+(\S+)\s+(\d+)\s*(.*)$/i;
+export function parseProcMaps(content) {
+    const regions = [];
+    for (const line of content.split(/\r?\n/)) {
+        const match = line.trimEnd().match(PROC_MAPS_LINE_RE);
+        if (!match)
+            continue;
+        const perms = match[3];
+        regions.push({
+            start: BigInt(`0x${match[1]}`),
+            end: BigInt(`0x${match[2]}`),
+            permissions: {
+                read: perms[0] === 'r',
+                write: perms[1] === 'w',
+                exec: perms[2] === 'x',
+                private: perms[3] === 'p',
+            },
+            offset: BigInt(`0x${match[4]}`),
+            dev: match[5],
+            inode: parseInt(match[6], 10),
+            pathname: match[7]?.trim() ?? '',
+        });
+    }
+    return regions;
+}
+export function formatLinuxProtection(perms) {
+    return `${perms.read ? 'r' : '-'}${perms.write ? 'w' : '-'}${perms.exec ? 'x' : '-'}`;
+}

package/dist/modules/process/memory/monitor.d.ts

@@ -4,4 +4,3 @@ export declare class MemoryMonitorManager {
     start(pid: number, address: string, size: number | undefined, intervalMs: number | undefined, readMemoryFn: (pid: number, address: string, size: number) => Promise<MemoryReadResult>, onChange?: (oldValue: string, newValue: string) => void): string;
     stop(monitorId: string): boolean;
 }
-//# sourceMappingURL=monitor.d.ts.map

package/dist/modules/process/memory/monitor.js

@@ -35,4 +35,3 @@ export class MemoryMonitorManager {
         return false;
     }
 }
-//# sourceMappingURL=monitor.js.map

package/dist/modules/process/memory/reader.d.ts

@@ -1,3 +1,2 @@
 import { type Platform, type MemoryReadResult, type MemoryProtectionInfo } from '../../process/memory/types.js';
 export declare function readMemory(platform: Platform, pid: number, address: string, size: number, checkProtectionFn: (pid: number, address: string) => Promise<MemoryProtectionInfo>): Promise<MemoryReadResult>;
-//# sourceMappingURL=reader.d.ts.map

package/dist/modules/process/memory/reader.js

@@ -169,4 +169,3 @@ export async function readMemory(platform, pid, address, size, checkProtectionFn
         return { success: false, error: error instanceof Error ? error.message : String(error) };
     }
 }
-//# sourceMappingURL=reader.js.map

package/dist/modules/process/memory/regions.d.ts

@@ -1,2 +1 @@
 export { dumpMemoryRegion, enumerateRegions, checkMemoryProtection, enumerateModules, } from '../../process/memory/regions.impl.js';
-//# sourceMappingURL=regions.d.ts.map

package/dist/modules/process/memory/regions.dump.d.ts

@@ -3,4 +3,3 @@ export declare function dumpMemoryRegion(platform: Platform, pid: number, startA
     success: boolean;
     error?: string;
 }>;
-//# sourceMappingURL=regions.dump.d.ts.map

package/dist/modules/process/memory/regions.dump.js

@@ -111,4 +111,3 @@ export async function dumpMemoryRegion(platform, pid, startAddress, size, output
         };
     }
 }
-//# sourceMappingURL=regions.dump.js.map

package/dist/modules/process/memory/regions.enumerate.d.ts

@@ -16,4 +16,3 @@ export declare function enumerateRegions(platform: Platform, pid: number): Promi
     error?: string;
 }>;
 export {};
-//# sourceMappingURL=regions.enumerate.d.ts.map

package/dist/modules/process/memory/regions.enumerate.js

@@ -1,5 +1,9 @@
+import { readFileSync } from 'fs';
 import { logger } from '../../../utils/logger.js';
 import { execAsync, executePowerShellScript } from '../../process/memory/types.js';
+import { parseProcMaps, formatLinuxProtection } from './linux/mapsParser.js';
+import { nativeMemoryManager } from '../../../native/NativeMemoryManager.js';
+import { isKoffiAvailable } from '../../../native/NativeMemoryManager.utils.js';
 function buildEnumerateRegionsScript(pid) {
     return `
 Add-Type @"
@@ -111,8 +115,28 @@ try {
   `.trim();
 }
 export async function enumerateRegions(platform, pid) {
+    if (platform === 'linux') {
+        try {
+            const mapsContent = readFileSync(`/proc/${pid}/maps`, 'utf-8');
+            const readableRegions = parseProcMaps(mapsContent).filter(region => region.permissions.read);
+            const regions = readableRegions
+                .map(region => ({
+                baseAddress: `0x${region.start.toString(16)}`,
+                size: Number(region.end - region.start),
+                state: 'COMMIT',
+                protection: formatLinuxProtection(region.permissions),
+                isReadable: true,
+                type: region.pathname || 'anonymous',
+            }));
+            return { success: true, regions };
+        }
+        catch (error) {
+            logger.error('Linux region enumeration failed:', error);
+            return { success: false, error: error instanceof Error ? error.message : String(error) };
+        }
+    }
     if (platform !== 'win32' && platform !== 'darwin') {
-        return { success: false, error: 'Region enumeration currently only implemented for Windows and macOS' };
+        return { success: false, error: 'Region enumeration currently only implemented for Windows, Linux, and macOS' };
     }
     if (platform === 'darwin') {
         try {
@@ -148,6 +172,26 @@ export async function enumerateRegions(platform, pid) {
             return { success: false, error: error instanceof Error ? error.message : String(error) };
         }
     }
+    if (isKoffiAvailable()) {
+        try {
+            const nativeResult = await nativeMemoryManager.enumerateRegions(pid);
+            if (nativeResult.success) {
+                return nativeResult;
+            }
+            logger.warn('Native Windows region enumeration failed, falling back to PowerShell', {
+                pid,
+                error: nativeResult.error,
+                nativeAvailable: isKoffiAvailable(),
+            });
+        }
+        catch (error) {
+            logger.warn('Native Windows region enumeration threw, falling back to PowerShell', {
+                pid,
+                error: error instanceof Error ? error.message : String(error),
+                nativeAvailable: isKoffiAvailable(),
+            });
+        }
+    }
     try {
         const psScript = buildEnumerateRegionsScript(pid);
         const { stdout } = await executePowerShellScript(psScript, {
@@ -168,4 +212,3 @@ export async function enumerateRegions(platform, pid) {
         };
     }
 }
-//# sourceMappingURL=regions.enumerate.js.map

package/dist/modules/process/memory/regions.impl.d.ts

@@ -2,4 +2,3 @@ export { dumpMemoryRegion } from '../../process/memory/regions.dump.js';
 export { enumerateRegions } from '../../process/memory/regions.enumerate.js';
 export { checkMemoryProtection } from '../../process/memory/regions.protection.js';
 export { enumerateModules } from '../../process/memory/regions.modules.js';
-//# sourceMappingURL=regions.impl.d.ts.map

package/dist/modules/process/memory/regions.impl.js

@@ -2,4 +2,3 @@ export { dumpMemoryRegion } from '../../process/memory/regions.dump.js';
 export { enumerateRegions } from '../../process/memory/regions.enumerate.js';
 export { checkMemoryProtection } from '../../process/memory/regions.protection.js';
 export { enumerateModules } from '../../process/memory/regions.modules.js';
-//# sourceMappingURL=regions.impl.js.map

package/dist/modules/process/memory/regions.js

@@ -1,2 +1 @@
 export { dumpMemoryRegion, enumerateRegions, checkMemoryProtection, enumerateModules, } from '../../process/memory/regions.impl.js';
-//# sourceMappingURL=regions.js.map

package/dist/modules/process/memory/regions.modules.d.ts

@@ -8,4 +8,3 @@ export declare function enumerateModules(platform: Platform, pid: number): Promi
     }[];
     error?: string;
 }>;
-//# sourceMappingURL=regions.modules.d.ts.map

package/dist/modules/process/memory/regions.modules.js

@@ -101,4 +101,3 @@ try {
         };
     }
 }
-//# sourceMappingURL=regions.modules.js.map

package/dist/modules/process/memory/regions.protection.d.ts

@@ -1,3 +1,2 @@
 import { type MemoryProtectionInfo, type Platform } from '../../process/memory/types.js';
 export declare function checkMemoryProtection(platform: Platform, pid: number, address: string): Promise<MemoryProtectionInfo>;
-//# sourceMappingURL=regions.protection.d.ts.map

package/dist/modules/process/memory/regions.protection.js

@@ -1,5 +1,9 @@
+import { readFileSync } from 'fs';
 import { logger } from '../../../utils/logger.js';
 import { execAsync, executePowerShellScript } from '../../process/memory/types.js';
+import { parseProcMaps, formatLinuxProtection } from './linux/mapsParser.js';
+import { nativeMemoryManager } from '../../../native/NativeMemoryManager.js';
+import { isKoffiAvailable } from '../../../native/NativeMemoryManager.utils.js';
 function buildProtectionCheckScript(pid, address) {
     return `
 Add-Type @"
@@ -110,8 +114,28 @@ try {
   `.trim();
 }
 export async function checkMemoryProtection(platform, pid, address) {
-    if (platform !== 'win32' && platform !== 'darwin') {
-        return { success: false, error: 'Memory protection check currently only implemented for Windows and macOS' };
+    const addrNum = BigInt(address.startsWith('0x') ? address : `0x${address}`);
+    if (platform === 'linux') {
+        try {
+            const mapsContent = readFileSync(`/proc/${pid}/maps`, 'utf-8');
+            const regions = parseProcMaps(mapsContent);
+            const region = regions.find(r => addrNum >= r.start && addrNum < r.end);
+            if (!region) {
+                return { success: false, error: `Address ${address} not found in any memory region` };
+            }
+            return {
+                success: true,
+                protection: formatLinuxProtection(region.permissions),
+                isReadable: region.permissions.read,
+                isWritable: region.permissions.write,
+                isExecutable: region.permissions.exec,
+                regionStart: `0x${region.start.toString(16)}`,
+                regionSize: Number(region.end - region.start),
+            };
+        }
+        catch (error) {
+            return { success: false, error: error instanceof Error ? error.message : String(error) };
+        }
     }
     if (platform === 'darwin') {
         try {
@@ -145,6 +169,28 @@ export async function checkMemoryProtection(platform, pid, address) {
             return { success: false, error: error instanceof Error ? error.message : String(error) };
         }
     }
+    if (isKoffiAvailable()) {
+        try {
+            const nativeResult = await nativeMemoryManager.checkMemoryProtection(pid, address);
+            if (nativeResult.success) {
+                return nativeResult;
+            }
+            logger.warn('Native Windows memory protection check failed, falling back to PowerShell', {
+                pid,
+                address,
+                error: nativeResult.error,
+                nativeAvailable: isKoffiAvailable(),
+            });
+        }
+        catch (error) {
+            logger.warn('Native Windows memory protection check threw, falling back to PowerShell', {
+                pid,
+                address,
+                error: error instanceof Error ? error.message : String(error),
+                nativeAvailable: isKoffiAvailable(),
+            });
+        }
+    }
     try {
         const addrNum = parseInt(address, 16);
         if (isNaN(addrNum)) {
@@ -175,4 +221,3 @@ export async function checkMemoryProtection(platform, pid, address) {
         };
     }
 }
-//# sourceMappingURL=regions.protection.js.map

package/dist/modules/process/memory/scanner.d.ts

@@ -3,10 +3,12 @@ export declare function buildPatternBytesAndMask(pattern: string, patternType: s
     patternBytes: number[];
     mask: number[];
 };
-export declare function patternToBytesMac(pattern: string, patternType: string): number[];
+export declare function patternToBytesMac(pattern: string, patternType: string): {
+    bytes: number[];
+    mask: number[];
+};
 export declare function scanMemory(platform: Platform, pid: number, pattern: string, patternType?: PatternType): Promise<MemoryScanResult>;
 export declare function scanMemoryFiltered(pid: number, pattern: string, addresses: string[], patternType: PatternType | undefined, _readMemoryFn: (pid: number, address: string, size: number) => Promise<{
     success: boolean;
     data?: string;
 }>, scanMemoryFn: (pid: number, pattern: string, patternType: PatternType) => Promise<MemoryScanResult>): Promise<MemoryScanResult>;
-//# sourceMappingURL=scanner.d.ts.map