@jshookmcp/jshook 0.1.7 → 0.1.9

package/dist/tests/modules/process/MacProcessManager.test.js

@@ -0,0 +1,144 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { EventEmitter } from 'node:events';
+const state = vi.hoisted(() => {
+    const execAsync = vi.fn();
+    const execFileAsync = vi.fn();
+    const promisify = vi.fn(() => execAsync);
+    const spawn = vi.fn();
+    return { execAsync, execFileAsync, promisify, spawn };
+});
+vi.mock('child_process', () => ({
+    exec: vi.fn(),
+    execFile: vi.fn(),
+    spawn: state.spawn,
+}));
+vi.mock('util', () => ({
+    promisify: vi.fn((fn) => {
+        if (fn === require('child_process').execFile) {
+            return state.execFileAsync;
+        }
+        return state.execAsync;
+    }),
+}));
+vi.mock('@src/utils/logger', () => ({
+    logger: {
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn(),
+    },
+}));
+import { MacProcessManager } from '../../../src/modules/process/MacProcessManager.js';
+function setupExecByCommand(map) {
+    state.execAsync.mockImplementation(async (cmd) => {
+        for (const [key, value] of Object.entries(map)) {
+            if (cmd.includes(key))
+                return { stdout: value.stdout, stderr: value.stderr ?? '' };
+        }
+        return { stdout: '', stderr: '' };
+    });
+}
+describe('MacProcessManager', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+    it('findProcesses parses ps output and skips invalid PID rows', async () => {
+        setupExecByCommand({
+            'ps aux': {
+                stdout: [
+                    'USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND',
+                    'user 321 1.0 2.0 0 0 ?? S 00:00 00:00 /Applications/Primary Browser.app/Contents/MacOS/primary-browser',
+                ].join('\n'),
+            },
+        });
+        const manager = new MacProcessManager();
+        const list = await manager.findProcesses('primary-browser');
+        expect(list).toHaveLength(1);
+        expect(list[0]?.pid).toBe(321);
+    });
+    it('getProcessByPid parses ps -p output correctly', async () => {
+        setupExecByCommand({
+            'ps -p 123 -o pid,ppid,pcpu,pmem,comm,args': {
+                stdout: 'PID PPID %CPU %MEM COMM ARGS\n123 1 2.5 3.5 /usr/bin/primary-browser /usr/bin/primary-browser --test\n',
+            },
+            'ps -p 123 -o comm=': { stdout: '/usr/bin/primary-browser\n' },
+        });
+        const manager = new MacProcessManager();
+        const proc = await manager.getProcessByPid(123);
+        expect(proc?.pid).toBe(123);
+        expect(proc?.parentPid).toBe(1);
+        expect(proc?.commandLine).toContain('--test');
+        expect(proc?.executablePath).toBe('/usr/bin/primary-browser');
+    });
+    it('getProcessWindows returns empty when process lookup fails', async () => {
+        setupExecByCommand({
+            'ps -p 999 -o pid,ppid,pcpu,pmem,comm,args': { stdout: '' },
+        });
+        const manager = new MacProcessManager();
+        const windows = await manager.getProcessWindows(999);
+        expect(windows).toEqual([]);
+    });
+    it('getProcessWindows parses AppleScript window title output', async () => {
+        setupExecByCommand({
+            'ps -p 500 -o pid,ppid,pcpu,pmem,comm,args': {
+                stdout: 'PID PPID %CPU %MEM COMM ARGS\n500 1 0.1 0.2 Browser Browser\n',
+            },
+            'ps -p 500 -o comm=': { stdout: 'Browser\n' },
+            'osascript -e': { stdout: '{title:Page A, title:Page B}' },
+        });
+        const manager = new MacProcessManager();
+        const windows = await manager.getProcessWindows(500);
+        expect(windows).toHaveLength(2);
+        expect(windows[0]?.title).toBe('Page A');
+        expect(windows[1]?.title).toBe('Page B');
+    });
+    it('checkDebugPort reads debug port from command-line first', async () => {
+        setupExecByCommand({});
+        const manager = new MacProcessManager();
+        vi.spyOn(manager, 'getProcessCommandLine').mockResolvedValue({
+            commandLine: '--remote-debugging-port=9229',
+        });
+        const port = await manager.checkDebugPort(600);
+        expect(port).toBe(9229);
+    });
+    it('launchWithDebug spawns detached process and returns info', async () => {
+        vi.useFakeTimers();
+        const child = new EventEmitter();
+        child.pid = 777;
+        child.unref = vi.fn();
+        state.spawn.mockReturnValue(child);
+        setupExecByCommand({});
+        const manager = new MacProcessManager();
+        vi.spyOn(manager, 'getProcessByPid').mockResolvedValue({
+            pid: 777,
+            name: 'primary-browser',
+            executablePath: '/Applications/Primary Browser.app/Contents/MacOS/primary-browser',
+        });
+        const pending = manager.launchWithDebug('/Applications/Primary Browser.app/Contents/MacOS/primary-browser');
+        await vi.runAllTimersAsync();
+        const result = await pending;
+        expect(state.spawn).toHaveBeenCalled();
+        expect(result?.pid).toBe(777);
+        vi.useRealTimers();
+    });
+    it('killProcess returns false for invalid pid', async () => {
+        setupExecByCommand({});
+        const manager = new MacProcessManager();
+        const ok = await manager.killProcess(0);
+        expect(ok).toBe(false);
+    });
+    it('launchWithDebug returns null when spawn returns undefined PID', async () => {
+        vi.useFakeTimers();
+        const child = new EventEmitter();
+        child.pid = undefined;
+        child.unref = vi.fn();
+        state.spawn.mockReturnValue(child);
+        setupExecByCommand({});
+        const manager = new MacProcessManager();
+        const pending = manager.launchWithDebug('/Applications/Primary Browser.app/Contents/MacOS/primary-browser');
+        await vi.runAllTimersAsync();
+        const result = await pending;
+        expect(result).toBeNull();
+        vi.useRealTimers();
+    });
+});

package/dist/tests/modules/process/MemoryManager.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/modules/process/MemoryManager.test.js

@@ -0,0 +1,117 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const state = vi.hoisted(() => ({
+    readMemory: vi.fn(),
+    writeMemory: vi.fn(),
+    batchMemoryWrite: vi.fn(),
+    scanMemory: vi.fn(),
+    scanMemoryFiltered: vi.fn(),
+    dumpMemoryRegion: vi.fn(),
+    enumerateRegions: vi.fn(),
+    checkMemoryProtection: vi.fn(),
+    enumerateModules: vi.fn(),
+    injectDll: vi.fn(),
+    injectShellcode: vi.fn(),
+    checkAvailability: vi.fn(),
+    checkDebugPort: vi.fn(),
+    monitorStart: vi.fn(() => 'monitor-id'),
+    monitorStop: vi.fn(() => true),
+}));
+vi.mock('@src/modules/process/memory/index', () => ({
+    readMemory: state.readMemory,
+    writeMemory: state.writeMemory,
+    batchMemoryWrite: state.batchMemoryWrite,
+    scanMemory: state.scanMemory,
+    scanMemoryFiltered: state.scanMemoryFiltered,
+    dumpMemoryRegion: state.dumpMemoryRegion,
+    enumerateRegions: state.enumerateRegions,
+    checkMemoryProtection: state.checkMemoryProtection,
+    enumerateModules: state.enumerateModules,
+    injectDll: state.injectDll,
+    injectShellcode: state.injectShellcode,
+    checkAvailability: state.checkAvailability,
+    checkDebugPort: state.checkDebugPort,
+    MemoryMonitorManager: class {
+        start = state.monitorStart;
+        stop = state.monitorStop;
+    },
+}));
+vi.mock('@src/utils/logger', () => ({
+    logger: {
+        info: vi.fn(),
+        debug: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+    },
+}));
+import { MemoryManager } from '../../../src/modules/process/MemoryManager.js';
+function currentPlatform() {
+    if (process.platform === 'win32')
+        return 'win32';
+    if (process.platform === 'linux')
+        return 'linux';
+    if (process.platform === 'darwin')
+        return 'darwin';
+    return 'unknown';
+}
+describe('MemoryManager', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+    it('delegates readMemory with platform and protection callback', async () => {
+        state.checkMemoryProtection.mockResolvedValue({ success: true, isReadable: true });
+        state.readMemory.mockImplementation(async (platform, pid, address, size, checkFn) => {
+            expect(platform).toBe(currentPlatform());
+            expect(pid).toBe(123);
+            expect(address).toBe('0x10');
+            expect(size).toBe(8);
+            await checkFn(123, '0x10');
+            return { success: true, data: 'AA' };
+        });
+        const manager = new MemoryManager();
+        const result = await manager.readMemory(123, '0x10', 8);
+        expect(result.success).toBe(true);
+        expect(state.checkMemoryProtection).toHaveBeenCalledWith(currentPlatform(), 123, '0x10');
+    });
+    it('delegates writeMemory and preserves encoding argument', async () => {
+        state.writeMemory.mockResolvedValue({ success: true, bytesWritten: 4 });
+        const manager = new MemoryManager();
+        await manager.writeMemory(1, '0x20', 'DE AD BE EF', 'hex');
+        expect(state.writeMemory).toHaveBeenCalledWith(currentPlatform(), 1, '0x20', 'DE AD BE EF', 'hex', expect.any(Function));
+    });
+    it('delegates scanMemoryFiltered with read/scan callbacks', async () => {
+        state.readMemory.mockResolvedValue({ success: true, data: 'AB CD' });
+        state.scanMemory.mockResolvedValue({ success: true, addresses: ['0x100'] });
+        state.scanMemoryFiltered.mockImplementation(async (_pid, _pattern, _addresses, _patternType, readFn, scanFn) => {
+            await readFn(9, '0x99', 4);
+            await scanFn(9, 'AA', 'hex');
+            return { success: true, addresses: ['0x99'] };
+        });
+        const manager = new MemoryManager();
+        const result = await manager.scanMemoryFiltered(9, 'AA', ['0x99'], 'hex');
+        expect(result.success).toBe(true);
+        expect(state.scanMemoryFiltered).toHaveBeenCalled();
+        expect(state.readMemory).toHaveBeenCalled();
+        expect(state.scanMemory).toHaveBeenCalled();
+    });
+    it('delegates monitor start/stop to MemoryMonitorManager instance', () => {
+        const manager = new MemoryManager();
+        const onChange = vi.fn();
+        const monitorId = manager.startMemoryMonitor(10, '0x1234', 4, 200, onChange);
+        const stopped = manager.stopMemoryMonitor(monitorId);
+        expect(monitorId).toBe('monitor-id');
+        expect(state.monitorStart).toHaveBeenCalledWith(10, '0x1234', 4, 200, expect.any(Function), onChange);
+        expect(stopped).toBe(true);
+        expect(state.monitorStop).toHaveBeenCalledWith('monitor-id');
+    });
+    it('delegates availability and debug checks', async () => {
+        state.checkAvailability.mockResolvedValue({ available: true });
+        state.checkDebugPort.mockResolvedValue({ success: true, isDebugged: false });
+        const manager = new MemoryManager();
+        const availability = await manager.checkAvailability();
+        const debugState = await manager.checkDebugPort(100);
+        expect(availability.available).toBe(true);
+        expect(debugState.isDebugged).toBe(false);
+        expect(state.checkAvailability).toHaveBeenCalledWith(currentPlatform());
+        expect(state.checkDebugPort).toHaveBeenCalledWith(currentPlatform(), 100);
+    });
+});

package/dist/tests/modules/process/ProcessManager.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/modules/process/ProcessManager.test.js

@@ -0,0 +1,159 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { EventEmitter } from 'node:events';
+const state = vi.hoisted(() => {
+    const execAsync = vi.fn();
+    const promisify = vi.fn(() => execAsync);
+    const spawn = vi.fn();
+    const getScriptPath = vi.fn(() => 'C:/scripts/enum-windows.ps1');
+    const discoverBrowsers = vi.fn();
+    const findByWindowClass = vi.fn();
+    const findByProcessName = vi.fn();
+    const detectDebugPort = vi.fn();
+    return {
+        execAsync,
+        promisify,
+        spawn,
+        getScriptPath,
+        discoverBrowsers,
+        findByWindowClass,
+        findByProcessName,
+        detectDebugPort,
+    };
+});
+vi.mock('child_process', () => ({
+    exec: vi.fn(),
+    spawn: state.spawn,
+}));
+vi.mock('util', () => ({
+    promisify: state.promisify,
+}));
+vi.mock('@src/native/ScriptLoader', () => ({
+    ScriptLoader: class {
+        getScriptPath = state.getScriptPath;
+    },
+}));
+vi.mock('@src/modules/browser/BrowserDiscovery', () => ({
+    BrowserDiscovery: class {
+        discoverBrowsers = state.discoverBrowsers;
+        findByWindowClass = state.findByWindowClass;
+        findByProcessName = state.findByProcessName;
+        detectDebugPort = state.detectDebugPort;
+    },
+}));
+vi.mock('@src/utils/logger', () => ({
+    logger: {
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn(),
+    },
+}));
+import { ProcessManager } from '../../../src/modules/process/ProcessManager.js';
+function createSpawnChild(pid = 9999) {
+    const child = new EventEmitter();
+    child.pid = pid;
+    child.unref = vi.fn();
+    return child;
+}
+describe('ProcessManager', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+    it('findProcesses sanitizes pattern and parses process list', async () => {
+        state.execAsync.mockResolvedValue({
+            stdout: JSON.stringify([
+                { Id: 101, ProcessName: 'browser-bin', Path: 'C:/Browser/browser-bin.exe' },
+            ]),
+            stderr: '',
+        });
+        const manager = new ProcessManager();
+        const results = await manager.findProcesses('browse"r-bin`$()');
+        expect(results).toEqual([{ pid: 101, name: 'browser-bin', executablePath: 'C:/Browser/browser-bin.exe' }]);
+        const cmd = state.execAsync.mock.calls[0]?.[0];
+        expect(cmd).toContain('*browser-bin*');
+        expect(cmd).not.toContain('`');
+        expect(cmd).not.toContain('$');
+    });
+    it('getProcessByPid returns null when process is not found', async () => {
+        state.execAsync.mockResolvedValue({ stdout: 'null', stderr: '' });
+        const manager = new ProcessManager();
+        const result = await manager.getProcessByPid(1234);
+        expect(result).toBeNull();
+    });
+    it('getProcessWindows loads external script and parses single window object', async () => {
+        state.execAsync.mockResolvedValue({
+            stdout: JSON.stringify({
+                Handle: '0x100',
+                Title: 'My Window',
+                ClassName: 'Browser_WidgetWin_1',
+                ProcessId: 88,
+            }),
+            stderr: '',
+        });
+        const manager = new ProcessManager();
+        const windows = await manager.getProcessWindows(88);
+        expect(state.getScriptPath).toHaveBeenCalledWith('enum-windows.ps1');
+        expect(windows).toEqual([
+            {
+                handle: '0x100',
+                title: 'My Window',
+                className: 'Browser_WidgetWin_1',
+                processId: 88,
+                threadId: 0,
+            },
+        ]);
+    });
+    it('checkDebugPort returns port from command-line argument when present', async () => {
+        const manager = new ProcessManager();
+        vi.spyOn(manager, 'getProcessCommandLine').mockResolvedValue({
+            commandLine: '--remote-debugging-port=9333',
+        });
+        const port = await manager.checkDebugPort(77);
+        expect(port).toBe(9333);
+        expect(state.execAsync).not.toHaveBeenCalled();
+    });
+    it('killProcess rejects invalid PID values early', async () => {
+        const manager = new ProcessManager();
+        const ok = await manager.killProcess(0);
+        expect(ok).toBe(false);
+        expect(state.execAsync).not.toHaveBeenCalled();
+    });
+    it('launchWithDebug returns process details from resolved listener PID', async () => {
+        vi.useFakeTimers();
+        state.spawn.mockReturnValue(createSpawnChild(5000));
+        state.execAsync.mockResolvedValue({
+            stdout: JSON.stringify({ OwningProcess: 5000 }),
+            stderr: '',
+        });
+        const manager = new ProcessManager();
+        vi.spyOn(manager, 'getProcessByPid').mockResolvedValue({
+            pid: 5000,
+            name: 'app.exe',
+            executablePath: 'C:/app.exe',
+        });
+        const pending = manager.launchWithDebug('C:/app.exe', 9222, []);
+        await vi.runAllTimersAsync();
+        const result = await pending;
+        expect(state.spawn).toHaveBeenCalledWith('C:/app.exe', ['--remote-debugging-port=9222'], {
+            detached: true,
+            stdio: 'ignore',
+        });
+        expect(result?.pid).toBe(5000);
+        vi.useRealTimers();
+    });
+    it('delegates browser discovery APIs', async () => {
+        state.discoverBrowsers.mockResolvedValue([{ type: 'chrome', pid: 1 }]);
+        state.findByWindowClass.mockResolvedValue([{ type: 'edge', pid: 2 }]);
+        state.findByProcessName.mockResolvedValue([{ type: 'firefox', pid: 3 }]);
+        state.detectDebugPort.mockResolvedValue(9222);
+        const manager = new ProcessManager();
+        const all = await manager.discoverBrowsers();
+        const byClass = await manager.findBrowserByWindowClass('Browser_WidgetWin_*');
+        const byName = await manager.findBrowserByProcessName('browser-bin.exe');
+        const port = await manager.detectBrowserDebugPort(1);
+        expect(all).toHaveLength(1);
+        expect(byClass[0]?.pid).toBe(2);
+        expect(byName[0]?.pid).toBe(3);
+        expect(port).toBe(9222);
+    });
+});

package/dist/tests/modules/process/memory/availability.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/modules/process/memory/availability.test.js

@@ -0,0 +1,77 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const state = vi.hoisted(() => ({
+    executePowerShellScript: vi.fn(),
+    execAsync: vi.fn(),
+}));
+vi.mock('@src/modules/process/memory/types', () => ({
+    executePowerShellScript: state.executePowerShellScript,
+    execAsync: state.execAsync,
+}));
+async function loadAvailabilityModule() {
+    return import('../../../../src/modules/process/memory/availability.js');
+}
+describe('memory/availability', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+        vi.resetModules();
+    });
+    it('caches successful Windows availability checks within TTL', async () => {
+        state.executePowerShellScript.mockResolvedValue({ stdout: 'True\n', stderr: '' });
+        const { checkAvailability } = await loadAvailabilityModule();
+        const first = await checkAvailability('win32');
+        const second = await checkAvailability('win32');
+        expect(first.available).toBe(true);
+        expect(second.available).toBe(true);
+        expect(state.executePowerShellScript).toHaveBeenCalledTimes(1);
+    });
+    it('returns administrator-required reason when PowerShell outputs false', async () => {
+        state.executePowerShellScript.mockResolvedValue({ stdout: 'False\n', stderr: '' });
+        const { checkAvailability } = await loadAvailabilityModule();
+        const result = await checkAvailability('win32');
+        expect(result.available).toBe(false);
+        expect(result.reason).toContain('Administrator privileges');
+    });
+    it('maps PowerShell-not-found errors to a specific reason', async () => {
+        state.executePowerShellScript.mockRejectedValue(new Error('spawn ENOENT powershell'));
+        const { checkAvailability } = await loadAvailabilityModule();
+        const result = await checkAvailability('win32');
+        expect(result.available).toBe(false);
+        expect(result.reason).toContain('PowerShell is unavailable');
+    });
+    it('reports Linux available when running as root', async () => {
+        state.execAsync.mockResolvedValueOnce({ stdout: '0\n', stderr: '' });
+        const { checkAvailability } = await loadAvailabilityModule();
+        const result = await checkAvailability('linux');
+        expect(result).toEqual({ available: true });
+    });
+    it('reports Linux available when CAP_SYS_PTRACE exists for non-root', async () => {
+        state.execAsync
+            .mockResolvedValueOnce({ stdout: '1000\n', stderr: '' })
+            .mockResolvedValueOnce({ stdout: '', stderr: '' });
+        const { checkAvailability } = await loadAvailabilityModule();
+        const result = await checkAvailability('linux');
+        expect(result.available).toBe(true);
+    });
+    it('reports missing lldb on macOS', async () => {
+        state.execAsync.mockRejectedValue(new Error('lldb not found'));
+        const { checkAvailability } = await loadAvailabilityModule();
+        const result = await checkAvailability('darwin');
+        expect(result.available).toBe(false);
+        expect(result.reason).toContain('xcode-select --install');
+    });
+    it('checkDebugPort rejects non-windows platform', async () => {
+        const { checkDebugPort } = await loadAvailabilityModule();
+        const result = await checkDebugPort('linux', 123);
+        expect(result.success).toBe(false);
+        expect(result.error).toContain('only implemented for Windows');
+    });
+    it('checkDebugPort parses successful windows JSON output', async () => {
+        state.executePowerShellScript.mockResolvedValue({
+            stdout: '{"success":true,"isDebugged":false}',
+            stderr: '',
+        });
+        const { checkDebugPort } = await loadAvailabilityModule();
+        const result = await checkDebugPort('win32', 555);
+        expect(result).toEqual({ success: true, isDebugged: false });
+    });
+});

package/dist/tests/modules/process/memory/injector.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/modules/process/memory/injector.test.js

@@ -0,0 +1,62 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const state = vi.hoisted(() => ({
+    executePowerShellScript: vi.fn(),
+}));
+vi.mock('@src/modules/process/memory/types', () => ({
+    executePowerShellScript: state.executePowerShellScript,
+}));
+vi.mock('@src/utils/logger', () => ({
+    logger: {
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn(),
+    },
+}));
+import { injectDll, injectShellcode } from '../../../../src/modules/process/memory/injector.js';
+describe('memory/injector', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+    it('injectDll rejects non-windows platform', async () => {
+        const result = await injectDll('linux', 1, 'a.dll');
+        expect(result.success).toBe(false);
+        expect(result.error).toContain('only implemented for Windows');
+    });
+    it('injectDll parses successful PowerShell response', async () => {
+        state.executePowerShellScript.mockResolvedValue({
+            stdout: '{"success":true,"remoteThreadId":42}',
+            stderr: '',
+        });
+        const result = await injectDll('win32', 2, 'C:\\test.dll');
+        expect(result).toEqual({ success: true, remoteThreadId: 42, error: undefined });
+    });
+    it('injectDll fails when PowerShell returns empty output', async () => {
+        state.executePowerShellScript.mockResolvedValue({ stdout: '   ', stderr: '' });
+        const result = await injectDll('win32', 3, 'C:\\test.dll');
+        expect(result.success).toBe(false);
+        expect(result.error).toContain('PowerShell returned empty output');
+    });
+    it('injectShellcode rejects non-windows platform', async () => {
+        const result = await injectShellcode('darwin', 1, '90', 'hex');
+        expect(result.success).toBe(false);
+        expect(result.error).toContain('only implemented for Windows');
+    });
+    it('injectShellcode supports base64 input and parses success result', async () => {
+        state.executePowerShellScript.mockResolvedValue({
+            stdout: '{"success":true,"remoteThreadId":100}',
+            stderr: '',
+        });
+        const payload = Buffer.from([0x90, 0x90]).toString('base64');
+        const result = await injectShellcode('win32', 4, payload, 'base64');
+        expect(result.success).toBe(true);
+        expect(result.remoteThreadId).toBe(100);
+        expect(state.executePowerShellScript).toHaveBeenCalled();
+    });
+    it('injectShellcode returns failure when script execution throws', async () => {
+        state.executePowerShellScript.mockRejectedValue(new Error('execution failed'));
+        const result = await injectShellcode('win32', 5, '90', 'hex');
+        expect(result.success).toBe(false);
+        expect(result.error).toContain('execution failed');
+    });
+});

package/dist/tests/modules/process/memory/monitor.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/modules/process/memory/monitor.test.js

@@ -0,0 +1,54 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { MemoryMonitorManager } from '../../../../src/modules/process/memory/monitor.js';
+describe('memory/monitor', () => {
+    beforeEach(() => {
+        vi.useFakeTimers();
+        vi.clearAllMocks();
+    });
+    it('start returns monitor id and polls with provided interval', async () => {
+        const manager = new MemoryMonitorManager();
+        const readMemory = vi.fn().mockResolvedValue({ success: true, data: 'AA' });
+        const id = manager.start(1, '0x10', 4, 1000, readMemory);
+        expect(id).toMatch(/^monitor_/);
+        await vi.advanceTimersByTimeAsync(3000);
+        expect(readMemory).toHaveBeenCalledTimes(3);
+        manager.stop(id);
+    });
+    it('onChange fires only after value changes from a previous value', async () => {
+        const manager = new MemoryMonitorManager();
+        const readMemory = vi
+            .fn()
+            .mockResolvedValueOnce({ success: true, data: 'AA' })
+            .mockResolvedValueOnce({ success: true, data: 'BB' });
+        const onChange = vi.fn();
+        const id = manager.start(2, '0x20', 4, 500, readMemory, onChange);
+        await vi.advanceTimersByTimeAsync(1000);
+        expect(onChange).toHaveBeenCalledTimes(1);
+        expect(onChange).toHaveBeenCalledWith('AA', 'BB');
+        manager.stop(id);
+    });
+    it('does not fire onChange when value remains the same', async () => {
+        const manager = new MemoryMonitorManager();
+        const readMemory = vi.fn().mockResolvedValue({ success: true, data: 'AA' });
+        const onChange = vi.fn();
+        const id = manager.start(3, '0x30', 4, 400, readMemory, onChange);
+        await vi.advanceTimersByTimeAsync(1200);
+        expect(onChange).not.toHaveBeenCalled();
+        manager.stop(id);
+    });
+    it('stop returns true for active monitor and prevents further polling', async () => {
+        const manager = new MemoryMonitorManager();
+        const readMemory = vi.fn().mockResolvedValue({ success: true, data: 'AA' });
+        const id = manager.start(4, '0x40', 4, 300, readMemory);
+        await vi.advanceTimersByTimeAsync(600);
+        const callsBeforeStop = readMemory.mock.calls.length;
+        const stopped = manager.stop(id);
+        await vi.advanceTimersByTimeAsync(900);
+        expect(stopped).toBe(true);
+        expect(readMemory.mock.calls.length).toBe(callsBeforeStop);
+    });
+    it('stop returns false for unknown monitor id', () => {
+        const manager = new MemoryMonitorManager();
+        expect(manager.stop('monitor_not_found')).toBe(false);
+    });
+});

package/dist/tests/modules/process/memory/nativeMemoryManager.test.d.ts

@@ -0,0 +1 @@
+export {};