@jshookmcp/jshook 0.1.7 → 0.1.9

package/dist/tests/modules/debugger/XHRBreakpointManager.test.js

@@ -0,0 +1,52 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+vi.mock('@src/utils/logger', () => ({
+    logger: {
+        debug: vi.fn(),
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        success: vi.fn(),
+    },
+}));
+import { XHRBreakpointManager } from '../../../src/modules/debugger/XHRBreakpointManager.js';
+describe('XHRBreakpointManager', () => {
+    let session;
+    let manager;
+    beforeEach(() => {
+        session = {
+            send: vi.fn().mockResolvedValue({}),
+            on: vi.fn(),
+            off: vi.fn(),
+            detach: vi.fn(),
+        };
+        manager = new XHRBreakpointManager(session);
+    });
+    it('creates xhr breakpoint and stores metadata', async () => {
+        const id = await manager.setXHRBreakpoint('/api/');
+        expect(id).toBe('xhr_1');
+        expect(manager.getXHRBreakpoint(id)?.urlPattern).toBe('/api/');
+        expect(session.send).toHaveBeenCalledWith('DOMDebugger.setXHRBreakpoint', { url: '/api/' });
+    });
+    it('returns false when trying to remove unknown breakpoint', async () => {
+        await expect(manager.removeXHRBreakpoint('missing')).resolves.toBe(false);
+    });
+    it('removes existing breakpoint and updates state', async () => {
+        const id = await manager.setXHRBreakpoint('/v1/');
+        const removed = await manager.removeXHRBreakpoint(id);
+        expect(removed).toBe(true);
+        expect(manager.getXHRBreakpoint(id)).toBeUndefined();
+        expect(session.send).toHaveBeenCalledWith('DOMDebugger.removeXHRBreakpoint', { url: '/v1/' });
+    });
+    it('clearAll removes all known breakpoints even when a removal fails', async () => {
+        await manager.setXHRBreakpoint('/a/');
+        await manager.setXHRBreakpoint('/b/');
+        session.send.mockRejectedValueOnce(new Error('remove failed'));
+        await manager.clearAllXHRBreakpoints();
+        expect(manager.getAllXHRBreakpoints()).toEqual([]);
+    });
+    it('close delegates to clearAllXHRBreakpoints', async () => {
+        const spy = vi.spyOn(manager, 'clearAllXHRBreakpoints').mockResolvedValue(undefined);
+        await manager.close();
+        expect(spy).toHaveBeenCalledTimes(1);
+    });
+});

package/dist/tests/modules/deobfuscator/ASTOptimizer.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/modules/deobfuscator/ASTOptimizer.test.js

@@ -0,0 +1,49 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const loggerState = vi.hoisted(() => ({
+    debug: vi.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+}));
+vi.mock('@src/utils/logger', () => ({
+    logger: loggerState,
+}));
+import { ASTOptimizer } from '../../../src/modules/deobfuscator/ASTOptimizer.js';
+describe('ASTOptimizer', () => {
+    beforeEach(() => {
+        vi.restoreAllMocks();
+        Object.values(loggerState).forEach((fn) => fn.mockReset?.());
+    });
+    it('folds numeric and string constants', () => {
+        const code = 'const a = 1 + 2; const b = "x" + "y";';
+        const output = new ASTOptimizer().optimize(code);
+        expect(output).toContain('const a = 3');
+        expect(output).toContain('const b = "xy"');
+    });
+    it('eliminates dead branches and simplifies logical expressions', () => {
+        const code = 'if (false) { x(); } else { y(); } const z = true && run();';
+        const output = new ASTOptimizer().optimize(code);
+        expect(output).toContain('y();');
+        expect(output).toContain('const z = run()');
+        expect(output).not.toContain('if (false)');
+    });
+    it('unfolds computed member/property names where possible', () => {
+        const code = `const v = obj["name"]; const o = { ["foo"]: 1 };`;
+        const output = new ASTOptimizer().optimize(code);
+        expect(output).toContain('obj.name');
+        expect(output).toContain('foo: 1');
+    });
+    it('expands sequence expressions in expression statements', () => {
+        const code = '(a(), b(), c());';
+        const output = new ASTOptimizer().optimize(code);
+        expect(output).toContain('a();');
+        expect(output).toContain('b();');
+        expect(output).toContain('c();');
+    });
+    it('returns original code when parsing fails', () => {
+        const code = 'function broken( {';
+        const output = new ASTOptimizer().optimize(code);
+        expect(output).toBe(code);
+        expect(loggerState.error).toHaveBeenCalled();
+    });
+});

package/dist/tests/modules/deobfuscator/AdvancedDeobfuscator.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/modules/deobfuscator/AdvancedDeobfuscator.test.js

@@ -0,0 +1,117 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const loggerState = vi.hoisted(() => ({
+    debug: vi.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    success: vi.fn(),
+}));
+const webcrackState = vi.hoisted(() => ({
+    runWebcrack: vi.fn(async (code) => ({
+        applied: true,
+        code: `decoded:${code}`,
+        optionsUsed: { jsx: true, mangle: false, unminify: true, unpack: true },
+    })),
+}));
+vi.mock('@utils/logger', () => ({
+    logger: loggerState,
+}));
+vi.mock('@modules/deobfuscator/webcrack', () => ({
+    runWebcrack: webcrackState.runWebcrack,
+}));
+import { AdvancedDeobfuscator } from '../../../src/modules/deobfuscator/AdvancedDeobfuscator.js';
+describe('AdvancedDeobfuscator', () => {
+    beforeEach(() => {
+        vi.restoreAllMocks();
+        Object.values(loggerState).forEach((fn) => fn.mockReset?.());
+        webcrackState.runWebcrack.mockReset();
+        webcrackState.runWebcrack.mockImplementation(async (code) => ({
+            applied: true,
+            code: `decoded:${code}`,
+            optionsUsed: { jsx: true, mangle: false, unminify: true, unpack: true },
+        }));
+    });
+    it('returns static technique detection in detectOnly mode', async () => {
+        const result = await new AdvancedDeobfuscator().deobfuscate({
+            code: 'while(true){switch(state){case 1: break;}}',
+            detectOnly: true,
+        });
+        expect(webcrackState.runWebcrack).not.toHaveBeenCalled();
+        expect(result.webcrackApplied).toBe(false);
+        expect(result.engine).toBe('webcrack');
+        expect(result.astOptimized).toBe(false);
+        expect(result.detectedTechniques.length).toBeGreaterThan(0);
+        expect(result.warnings.some((warning) => warning.includes('detectOnly'))).toBe(true);
+    });
+    it('passes options straight through to webcrack and returns bundle metadata', async () => {
+        webcrackState.runWebcrack.mockResolvedValue({
+            applied: true,
+            code: 'const view = <App />;',
+            bundle: {
+                type: 'browserify',
+                entryId: 'main',
+                moduleCount: 1,
+                truncated: false,
+                modules: [{ id: 'main', path: './main.js', isEntry: true, size: 21 }],
+            },
+            savedTo: 'D:/tmp/advanced-webcrack',
+            savedArtifacts: [{ kind: 'bundle', path: 'D:/tmp/advanced-webcrack/bundle.json' }],
+            optionsUsed: { jsx: true, mangle: true, unminify: false, unpack: true },
+        });
+        const result = await new AdvancedDeobfuscator().deobfuscate({
+            code: 'packed',
+            unpack: true,
+            unminify: false,
+            jsx: true,
+            mangle: true,
+            outputDir: 'artifacts/advanced',
+            forceOutput: true,
+            includeModuleCode: true,
+            maxBundleModules: 5,
+            mappings: [{ path: './main.js', pattern: 'App', matchType: 'includes', target: 'code' }],
+        });
+        expect(webcrackState.runWebcrack).toHaveBeenCalledWith('packed', {
+            unpack: true,
+            unminify: false,
+            jsx: true,
+            mangle: true,
+            mappings: [{ path: './main.js', pattern: 'App', matchType: 'includes', target: 'code' }],
+            includeModuleCode: true,
+            maxBundleModules: 5,
+            outputDir: 'artifacts/advanced',
+            forceOutput: true,
+        });
+        expect(result.webcrackApplied).toBe(true);
+        expect(result.bundle?.type).toBe('browserify');
+        expect(result.savedTo).toBe('D:/tmp/advanced-webcrack');
+        expect(result.engine).toBe('webcrack');
+        expect(result.detectedTechniques).toContain('bundle-unpack');
+        expect(result.detectedTechniques).toContain('jsx-decompile');
+        expect(result.detectedTechniques).toContain('mangle');
+        expect(result.detectedTechniques).toContain('webcrack');
+    });
+    it('reports deprecated legacy flags as warnings without enabling old logic', async () => {
+        const result = await new AdvancedDeobfuscator().deobfuscate({
+            code: 'legacy()',
+            aggressiveVM: true,
+            useASTOptimization: true,
+            timeout: 1234,
+        });
+        expect(result.warnings).toEqual([
+            'aggressiveVM is deprecated and ignored; VM-specific legacy logic has been removed.',
+            'useASTOptimization is deprecated and ignored; legacy AST post-processing has been removed.',
+            'timeout is currently ignored; webcrack controls its own execution flow.',
+        ]);
+        expect(result.vmDetected).toBeUndefined();
+        expect(result.astOptimized).toBe(false);
+    });
+    it('throws when webcrack does not produce a result', async () => {
+        webcrackState.runWebcrack.mockResolvedValue({
+            applied: false,
+            code: 'raw',
+            optionsUsed: { jsx: true, mangle: false, unminify: true, unpack: true },
+            reason: 'mocked failure',
+        });
+        await expect(new AdvancedDeobfuscator().deobfuscate({ code: 'broken()' })).rejects.toThrow('mocked failure');
+    });
+});

package/dist/tests/modules/deobfuscator/Deobfuscator.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/modules/deobfuscator/Deobfuscator.test.js

@@ -0,0 +1,134 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const loggerState = vi.hoisted(() => ({
+    debug: vi.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    success: vi.fn(),
+}));
+const promptState = vi.hoisted(() => ({
+    generateDeobfuscationPrompt: vi.fn(() => [{ role: 'user', content: 'analyze' }]),
+}));
+const webcrackState = vi.hoisted(() => ({
+    runWebcrack: vi.fn(async (code) => ({
+        applied: true,
+        code: `decoded:${code}`,
+        optionsUsed: { jsx: true, mangle: false, unminify: true, unpack: true },
+    })),
+}));
+vi.mock('@utils/logger', () => ({
+    logger: loggerState,
+}));
+vi.mock('@services/prompts/deobfuscation', () => ({
+    generateDeobfuscationPrompt: promptState.generateDeobfuscationPrompt,
+}));
+vi.mock('@modules/deobfuscator/webcrack', () => ({
+    runWebcrack: webcrackState.runWebcrack,
+}));
+import { Deobfuscator } from '../../../src/modules/deobfuscator/Deobfuscator.js';
+describe('Deobfuscator', () => {
+    beforeEach(() => {
+        vi.restoreAllMocks();
+        Object.values(loggerState).forEach((fn) => fn.mockReset?.());
+        promptState.generateDeobfuscationPrompt.mockReset();
+        promptState.generateDeobfuscationPrompt.mockReturnValue([{ role: 'user', content: 'analyze' }]);
+        webcrackState.runWebcrack.mockReset();
+        webcrackState.runWebcrack.mockImplementation(async (code) => ({
+            applied: true,
+            code: `decoded:${code}`,
+            optionsUsed: { jsx: true, mangle: false, unminify: true, unpack: true },
+        }));
+    });
+    it('uses webcrack as the only deobfuscation engine', async () => {
+        webcrackState.runWebcrack.mockResolvedValue({
+            applied: true,
+            code: 'const answer = 42;',
+            bundle: {
+                type: 'webpack',
+                entryId: '0',
+                moduleCount: 2,
+                truncated: false,
+                modules: [{ id: '0', path: './index.js', isEntry: true, size: 19 }],
+            },
+            savedTo: 'D:/tmp/webcrack-out',
+            savedArtifacts: [{ kind: 'code', path: 'D:/tmp/webcrack-out/deobfuscated.js' }],
+            optionsUsed: { jsx: true, mangle: false, unminify: true, unpack: true },
+        });
+        const result = await new Deobfuscator().deobfuscate({ code: 'obfuscated()' });
+        expect(webcrackState.runWebcrack).toHaveBeenCalledWith('obfuscated()', {
+            unpack: undefined,
+            unminify: undefined,
+            jsx: undefined,
+            mangle: undefined,
+            mappings: undefined,
+            includeModuleCode: undefined,
+            maxBundleModules: undefined,
+            outputDir: undefined,
+            forceOutput: undefined,
+        });
+        expect(result.code).toBe('const answer = 42;');
+        expect(result.bundle?.type).toBe('webpack');
+        expect(result.savedTo).toBe('D:/tmp/webcrack-out');
+        expect(result.engine).toBe('webcrack');
+        expect(result.webcrackApplied).toBe(true);
+        expect(result.transformations.some((t) => t.type === 'webcrack' && t.success)).toBe(true);
+    });
+    it('caches deobfuscation results and avoids repeated webcrack and LLM calls', async () => {
+        const chat = vi.fn(async () => ({ content: 'LLM summary' }));
+        const deobfuscator = new Deobfuscator({ chat });
+        const options = { code: 'var v = 5;', llm: 'provider-a' };
+        const first = await deobfuscator.deobfuscate(options);
+        const second = await deobfuscator.deobfuscate(options);
+        expect(first.analysis).toBe('LLM summary');
+        expect(webcrackState.runWebcrack).toHaveBeenCalledTimes(1);
+        expect(chat).toHaveBeenCalledTimes(1);
+        expect(second).toBe(first);
+    });
+    it('passes webcrack options through and maps renameVariables to mangle', async () => {
+        await new Deobfuscator().deobfuscate({
+            code: 'bundle',
+            renameVariables: true,
+            unpack: false,
+            unminify: false,
+            jsx: false,
+            outputDir: 'artifacts/deobf',
+            forceOutput: true,
+            includeModuleCode: true,
+            maxBundleModules: 10,
+            mappings: [{ path: './main.js', pattern: 'bootstrap', matchType: 'includes', target: 'code' }],
+        });
+        expect(webcrackState.runWebcrack).toHaveBeenCalledWith('bundle', {
+            unpack: false,
+            unminify: false,
+            jsx: false,
+            mangle: true,
+            mappings: [{ path: './main.js', pattern: 'bootstrap', matchType: 'includes', target: 'code' }],
+            includeModuleCode: true,
+            maxBundleModules: 10,
+            outputDir: 'artifacts/deobf',
+            forceOutput: true,
+        });
+    });
+    it('surfaces deprecated legacy flags as warnings instead of running old logic', async () => {
+        const result = await new Deobfuscator().deobfuscate({
+            code: 'legacy()',
+            aggressive: true,
+            preserveLogic: true,
+            inlineFunctions: true,
+        });
+        expect(result.warnings).toEqual([
+            'aggressive is deprecated and ignored; webcrack is now the only deobfuscation engine.',
+            'preserveLogic is deprecated and ignored.',
+            'inlineFunctions is deprecated and ignored.',
+        ]);
+    });
+    it('throws immediately when webcrack does not produce a result', async () => {
+        webcrackState.runWebcrack.mockResolvedValue({
+            applied: false,
+            code: 'raw',
+            optionsUsed: { jsx: true, mangle: false, unminify: true, unpack: true },
+            reason: 'mocked failure',
+        });
+        await expect(new Deobfuscator().deobfuscate({ code: 'broken()' })).rejects.toThrow('mocked failure');
+    });
+});

package/dist/tests/modules/deobfuscator/JSVMPDeobfuscator.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/modules/deobfuscator/JSVMPDeobfuscator.test.js

@@ -0,0 +1,109 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import * as parser from '@babel/parser';
+const loggerState = vi.hoisted(() => ({
+    debug: vi.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    success: vi.fn(),
+}));
+const promptState = vi.hoisted(() => ({
+    generateVMAnalysisMessages: vi.fn(() => [{ role: 'user', content: 'vm' }]),
+}));
+const sandboxState = vi.hoisted(() => ({
+    instances: [],
+}));
+vi.mock('@src/utils/logger', () => ({
+    logger: loggerState,
+}));
+vi.mock('@src/services/prompts/deobfuscation', () => ({
+    generateVMAnalysisMessages: promptState.generateVMAnalysisMessages,
+}));
+vi.mock('@src/modules/security/ExecutionSandbox', () => {
+    class ExecutionSandbox {
+        execute = vi.fn(async () => ({ ok: true, output: 'sandbox-output' }));
+        constructor() {
+            sandboxState.instances.push(this);
+        }
+    }
+    return { ExecutionSandbox };
+});
+import { JSVMPDeobfuscator } from '../../../src/modules/deobfuscator/JSVMPDeobfuscator.js';
+describe('JSVMPDeobfuscator', () => {
+    beforeEach(() => {
+        vi.restoreAllMocks();
+        sandboxState.instances.length = 0;
+        Object.values(loggerState).forEach((fn) => fn.mockReset?.());
+        promptState.generateVMAnalysisMessages.mockClear();
+    });
+    it('returns non-JSVMP result when VM patterns are not detected', async () => {
+        const deobfuscator = new JSVMPDeobfuscator();
+        vi.spyOn(deobfuscator, 'detectJSVMP').mockReturnValue(null);
+        const result = await deobfuscator.deobfuscate({ code: 'const x = 1;' });
+        expect(result.isJSVMP).toBe(false);
+        expect(result.confidence).toBe(0);
+        expect(result.warnings[0]).toContain('JSVMP');
+    });
+    it('returns full deobfuscation payload for detected VM code', async () => {
+        const deobfuscator = new JSVMPDeobfuscator();
+        vi.spyOn(deobfuscator, 'detectJSVMP').mockReturnValue({
+            instructionCount: 15,
+            interpreterLocation: 'Line 1',
+            complexity: 'medium',
+            hasSwitch: true,
+            hasInstructionArray: true,
+            hasProgramCounter: true,
+        });
+        vi.spyOn(deobfuscator, 'identifyVMType').mockReturnValue('custom');
+        vi.spyOn(deobfuscator, 'extractInstructions').mockReturnValue([
+            { opcode: 1, name: 'INST_1', type: 'load', description: 'x' },
+        ]);
+        vi.spyOn(deobfuscator, 'restoreCode').mockResolvedValue({
+            code: 'decoded-code',
+            confidence: 0.77,
+            warnings: ['partial'],
+            unresolvedParts: [{ location: 'x', reason: 'y', suggestion: 'z' }],
+        });
+        const result = await deobfuscator.deobfuscate({
+            code: 'vm-code',
+            extractInstructions: true,
+        });
+        expect(result.isJSVMP).toBe(true);
+        expect(result.vmType).toBe('custom');
+        expect(result.instructions).toHaveLength(1);
+        expect(result.deobfuscatedCode).toBe('decoded-code');
+        expect(result.stats?.originalSize).toBe('vm-code'.length);
+    });
+    it('handles unexpected errors and returns safe failure payload', async () => {
+        const deobfuscator = new JSVMPDeobfuscator();
+        vi.spyOn(deobfuscator, 'detectJSVMP').mockImplementation(() => {
+            throw new Error('boom');
+        });
+        const result = await deobfuscator.deobfuscate({ code: 'x' });
+        expect(result.isJSVMP).toBe(false);
+        expect(result.warnings[0]).toContain('boom');
+    });
+    it('detects VM hints using regex fallback', () => {
+        const deobfuscator = new JSVMPDeobfuscator();
+        const result = deobfuscator.detectJSVMPWithRegex('while(true){switch(i){case 1:break;} a.apply(b,c); parseInt("" + arr[i],16);}');
+        expect(result).not.toBeNull();
+        expect(result.hasSwitch).toBe(true);
+    });
+    it('applies basic custom VM restoration cleanup heuristics', () => {
+        const deobfuscator = new JSVMPDeobfuscator();
+        const warnings = [];
+        const unresolved = [];
+        const output = deobfuscator.restoreCustomVMBasic('debugger; if(a){}; "" + value; cond ? same : same;', true, warnings, unresolved);
+        expect(output.code).not.toContain('debugger');
+        expect(output.warnings.length).toBeGreaterThan(0);
+        expect(output.unresolvedParts?.length).toBeGreaterThan(0);
+    });
+    it('infers arithmetic opcode type from switch case content', () => {
+        const deobfuscator = new JSVMPDeobfuscator();
+        const ast = parser.parse('switch(x){case 1: a + b; break;}', { sourceType: 'script' });
+        const switchNode = ast.program.body[0];
+        const caseNode = switchNode.cases[0];
+        const type = deobfuscator.inferInstructionType(caseNode);
+        expect(type).toBe('arithmetic');
+    });
+});

package/dist/tests/modules/deobfuscator/JScramblerDeobfuscator.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/modules/deobfuscator/JScramblerDeobfuscator.test.js

@@ -0,0 +1,74 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const loggerState = vi.hoisted(() => ({
+    debug: vi.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    success: vi.fn(),
+}));
+vi.mock('@src/utils/logger', () => ({
+    logger: loggerState,
+}));
+import { JScramberDeobfuscator } from '../../../src/modules/deobfuscator/JScramblerDeobfuscator.js';
+describe('JScramberDeobfuscator', () => {
+    beforeEach(() => {
+        vi.restoreAllMocks();
+        Object.values(loggerState).forEach((fn) => fn.mockReset?.());
+    });
+    it('removes self-defending debugger statements', async () => {
+        const code = `
+      function guard(){ debugger; return 1; }
+      setInterval(function(){ debugger; }, 1000);
+      guard();
+    `;
+        const result = await new JScramberDeobfuscator().deobfuscate({ code });
+        expect(result.success).toBe(true);
+        expect(result.code).not.toContain('debugger');
+        expect(result.transformations.length).toBeGreaterThan(0);
+    });
+    it('replaces decrypt-function calls with placeholder strings', async () => {
+        const code = `
+      function dec(s){ return s.split('').map(c=>String.fromCharCode(c.charCodeAt(0))).join(''); }
+      const value = dec("abc");
+    `;
+        const result = await new JScramberDeobfuscator().deobfuscate({ code, decryptStrings: true });
+        expect(result.code).toContain('[DECRYPTED_STRING]');
+    });
+    it('restores flattened control-flow while-switch pattern', async () => {
+        const code = `
+      while (true) {
+        switch (state) {
+          case 0: a(); break;
+          case 1: b(); break;
+        }
+      }
+    `;
+        const result = await new JScramberDeobfuscator().deobfuscate({ code, restoreControlFlow: true });
+        expect(result.success).toBe(true);
+        expect(result.code).toContain('a();');
+        expect(result.code).toContain('b();');
+    });
+    it('removes dead branches and simplifies arithmetic expressions', async () => {
+        const code = `
+      if (false) { drop(); } else { keep(); }
+      const n = 2 + 3;
+    `;
+        const result = await new JScramberDeobfuscator().deobfuscate({ code });
+        expect(result.code).toContain('keep();');
+        expect(result.code).toContain('const n = 5');
+    });
+    it('calculates confidence from transformation count', () => {
+        const deobfuscator = new JScramberDeobfuscator();
+        expect(deobfuscator.calculateConfidence(0)).toBe(0);
+        expect(deobfuscator.calculateConfidence(3)).toBeCloseTo(0.6);
+        expect(deobfuscator.calculateConfidence(9)).toBe(1);
+    });
+    it('returns failure payload when parse pipeline throws', async () => {
+        const result = await new JScramberDeobfuscator().deobfuscate({
+            code: 'function broken( {',
+        });
+        expect(result.success).toBe(false);
+        expect(result.confidence).toBe(0);
+        expect(result.warnings.length).toBeGreaterThan(0);
+    });
+});

package/dist/tests/modules/deobfuscator/PackerDeobfuscator.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/modules/deobfuscator/PackerDeobfuscator.test.js

@@ -0,0 +1,81 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const loggerState = vi.hoisted(() => ({
+    debug: vi.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    success: vi.fn(),
+}));
+const sandboxState = vi.hoisted(() => ({
+    executeImpl: vi.fn(async () => ({ ok: false, output: null })),
+}));
+vi.mock('@src/utils/logger', () => ({
+    logger: loggerState,
+}));
+vi.mock('@src/modules/security/ExecutionSandbox', () => {
+    class ExecutionSandbox {
+        execute = vi.fn((...args) => sandboxState.executeImpl(...args));
+    }
+    return { ExecutionSandbox };
+});
+import { AAEncodeDeobfuscator, PackerDeobfuscator, URLEncodeDeobfuscator, UniversalUnpacker, } from '../../../src/modules/deobfuscator/PackerDeobfuscator.js';
+const PACKER_LIKE = "eval(function(p,a,c,k,e,d){return p;}('0',62,1,'x'.split('|'),0,{}))";
+describe('Packer-family deobfuscators', () => {
+    beforeEach(() => {
+        vi.restoreAllMocks();
+        sandboxState.executeImpl.mockReset();
+        Object.values(loggerState).forEach((fn) => fn.mockReset?.());
+    });
+    it('detects packer signature via static helper', () => {
+        expect(PackerDeobfuscator.detect(PACKER_LIKE)).toBe(true);
+        expect(PackerDeobfuscator.detect('const x = 1;')).toBe(false);
+    });
+    it('iterates unpacking until code stops changing', async () => {
+        const deobfuscator = new PackerDeobfuscator();
+        vi.spyOn(deobfuscator, 'unpack')
+            .mockResolvedValueOnce(PACKER_LIKE + ';')
+            .mockResolvedValueOnce(PACKER_LIKE + ';');
+        const result = await deobfuscator.deobfuscate({ code: PACKER_LIKE, maxIterations: 3 });
+        expect(result.success).toBe(true);
+        expect(result.iterations).toBe(1);
+        expect(result.warnings.length).toBeGreaterThan(0);
+    });
+    it('parses packer params from sandbox output', async () => {
+        const deobfuscator = new PackerDeobfuscator();
+        sandboxState.executeImpl.mockResolvedValue({
+            ok: true,
+            output: ['payload', 62, 2, 'foo|bar'],
+        });
+        const parsed = await deobfuscator.parsePackerParams("'payload',62,2,'foo|bar'");
+        expect(parsed.p).toBe('payload');
+        expect(parsed.a).toBe(62);
+        expect(parsed.k).toEqual(['foo', 'bar']);
+    });
+    it('decodes AAEncode payload through sandbox execution', async () => {
+        const aa = new AAEncodeDeobfuscator();
+        sandboxState.executeImpl.mockResolvedValue({ ok: true, output: 'decoded-aa' });
+        const output = await aa.deobfuscate('ω゜)');
+        expect(output).toBe('decoded-aa');
+    });
+    it('detects and decodes URL encoded content with safe fallback', async () => {
+        const urlDeobfuscator = new URLEncodeDeobfuscator();
+        const encoded = '%41%42%43%44%45%46%47%48%49%4A%4B';
+        expect(URLEncodeDeobfuscator.detect(encoded)).toBe(true);
+        expect(await urlDeobfuscator.deobfuscate(encoded)).toBe('ABCDEFGHIJK');
+        expect(await urlDeobfuscator.deobfuscate('%E0%A4%A')).toBe('%E0%A4%A');
+    });
+    it('dispatches through UniversalUnpacker by detected obfuscation type', async () => {
+        const unpacker = new UniversalUnpacker();
+        vi.spyOn(unpacker.packerDeobfuscator, 'deobfuscate').mockResolvedValue({
+            code: 'decoded-packer',
+            success: true,
+            iterations: 1,
+            warnings: [],
+        });
+        const packerResult = await unpacker.deobfuscate(PACKER_LIKE);
+        const unknownResult = await unpacker.deobfuscate('plain-code');
+        expect(packerResult.type).toBe('Packer');
+        expect(packerResult.code).toBe('decoded-packer');
+        expect(unknownResult).toEqual({ code: 'plain-code', type: 'Unknown', success: false });
+    });
+});

package/dist/tests/modules/deobfuscator/VMDeobfuscator.test.d.ts

@@ -0,0 +1 @@
+export {};