@jshookmcp/jshook 0.1.8 → 0.1.9

package/dist/src/server/domains/workflow/handlers.impl.workflow-base.js

@@ -0,0 +1,379 @@
+import { logger } from '../../../utils/logger.js';
+import { WORKFLOW_BUNDLE_CACHE_TTL_MS, WORKFLOW_BUNDLE_CACHE_MAX_BYTES, } from '../../../constants.js';
+import { mkdir, writeFile, realpath } from 'node:fs/promises';
+import { dirname, basename, resolve, relative, isAbsolute } from 'node:path';
+import { getProjectRoot } from '../../../utils/outputPaths.js';
+import { executeExtensionWorkflow } from '../../workflows/WorkflowEngine.js';
+export class WorkflowHandlersBase {
+    deps;
+    scriptRegistry = new Map();
+    bundleCache = new Map();
+    static BUNDLE_CACHE_TTL_MS = WORKFLOW_BUNDLE_CACHE_TTL_MS;
+    static MAX_SCRIPTS = 100;
+    static MAX_BUNDLE_CACHE = 50;
+    static MAX_BUNDLE_CACHE_BYTES = WORKFLOW_BUNDLE_CACHE_MAX_BYTES;
+    bundleCacheBytes = 0;
+    constructor(deps) {
+        this.deps = deps;
+        this.initBuiltinScripts();
+    }
+    evictBundleCache() {
+        const now = Date.now();
+        for (const [k, v] of this.bundleCache) {
+            if (now - v.cachedAt >= WorkflowHandlersBase.BUNDLE_CACHE_TTL_MS) {
+                this.bundleCacheBytes -= v.text.length;
+                this.bundleCache.delete(k);
+            }
+        }
+        while (this.bundleCache.size >= WorkflowHandlersBase.MAX_BUNDLE_CACHE ||
+            this.bundleCacheBytes > WorkflowHandlersBase.MAX_BUNDLE_CACHE_BYTES) {
+            const oldest = this.bundleCache.keys().next().value;
+            if (oldest !== undefined) {
+                const entry = this.bundleCache.get(oldest);
+                if (entry)
+                    this.bundleCacheBytes -= entry.text.length;
+                this.bundleCache.delete(oldest);
+            }
+            else
+                break;
+        }
+    }
+    normalizeOutputPath(inputPath, defaultPath, preferredDir) {
+        const requested = inputPath?.trim();
+        if (!requested) {
+            return defaultPath;
+        }
+        const normalizedRequested = requested.replace(/\\/g, '/');
+        if (normalizedRequested.startsWith('/') ||
+            /^[A-Za-z]:/.test(normalizedRequested) ||
+            normalizedRequested.split('/').includes('..')) {
+            return defaultPath;
+        }
+        if (!normalizedRequested.includes('/')) {
+            return `${preferredDir}/${normalizedRequested}`;
+        }
+        return normalizedRequested;
+    }
+    escapeInlineScriptLiteral(value) {
+        return value.replace(/[<>/\u2028\u2029]/g, (char) => {
+            switch (char) {
+                case '<':
+                    return '\\u003C';
+                case '>':
+                    return '\\u003E';
+                case '/':
+                    return '\\u002F';
+                case '\u2028':
+                    return '\\u2028';
+                case '\u2029':
+                    return '\\u2029';
+                default:
+                    return char;
+            }
+        });
+    }
+    async ensureParentDirectory(filePath) {
+        await mkdir(dirname(filePath), { recursive: true });
+    }
+    async safeWriteFile(filePath, data) {
+        const intendedPath = isAbsolute(filePath)
+            ? resolve(filePath)
+            : resolve(getProjectRoot(), filePath);
+        let existingParent = dirname(intendedPath);
+        const pendingSegments = [];
+        while (true) {
+            try {
+                existingParent = await realpath(existingParent);
+                break;
+            }
+            catch (error) {
+                const fsError = error;
+                if (fsError.code !== 'ENOENT') {
+                    throw error;
+                }
+                const nextParent = dirname(existingParent);
+                if (nextParent === existingParent) {
+                    throw new Error(`Unable to validate output path: ${filePath}`);
+                }
+                pendingSegments.unshift(basename(existingParent));
+                existingParent = nextParent;
+            }
+        }
+        const safeParent = resolve(existingParent, ...pendingSegments);
+        const safePath = resolve(safeParent, basename(intendedPath));
+        const realProjectRoot = await realpath(getProjectRoot());
+        const rel = relative(realProjectRoot, safePath);
+        if (rel.startsWith('..') || resolve(rel) === rel) {
+            throw new Error(`Output path escapes project root: ${filePath}`);
+        }
+        await this.ensureParentDirectory(safePath);
+        await writeFile(safePath, data, 'utf-8');
+    }
+    buildWebApiCaptureReportMarkdown(args) {
+        const lines = [
+            '# Web API Capture Report',
+            '',
+            `- Generated At: ${args.generatedAt}`,
+            `- URL: ${args.url}`,
+            `- Wait Until: ${args.waitUntil}`,
+            `- Wait After Actions (ms): ${args.waitAfterActionsMs}`,
+            `- Captured Requests: ${args.totalCaptured}`,
+            `- Auth Findings: ${args.authFindings.length}`,
+            `- HAR Exported: ${args.harExported ? 'yes' : 'no'}`,
+            `- HAR Path: ${args.harOutputPath ?? 'n/a'}`,
+            '',
+            '## Steps',
+        ];
+        if (args.steps.length === 0) {
+            lines.push('- (none)');
+        }
+        else {
+            for (const step of args.steps) {
+                lines.push(`- ${step}`);
+            }
+        }
+        lines.push('', '## Auth Findings');
+        if (args.authFindings.length === 0) {
+            lines.push('- (none)');
+        }
+        else {
+            for (const finding of args.authFindings) {
+                const type = String(finding?.type ?? 'unknown');
+                const location = String(finding?.location ?? 'unknown');
+                const confidenceRaw = finding?.confidence;
+                const confidence = typeof confidenceRaw === 'number' ? confidenceRaw.toFixed(2) : String(confidenceRaw ?? 'n/a');
+                const value = String(finding?.maskedValue ??
+                    finding?.masked ??
+                    finding?.value ??
+                    finding?.token ??
+                    '');
+                lines.push(`- type=${type}, location=${location}, confidence=${confidence}${value ? `, value=${value}` : ''}`);
+            }
+        }
+        lines.push('', '## Warnings');
+        if (args.warnings.length === 0) {
+            lines.push('- (none)');
+        }
+        else {
+            for (const warning of args.warnings) {
+                lines.push(`- ${warning}`);
+            }
+        }
+        return lines.join('\n');
+    }
+    initBuiltinScripts() {
+        this.scriptRegistry.set('auth_extract', {
+            description: 'Extract auth tokens from localStorage and cookies',
+            code: `(function(){
+  var keys=['token','active_token','access_token','jwt','auth_token','userRole','id_token','refresh_token'];
+  var r={};
+  for(var i=0;i<keys.length;i++){var v=localStorage.getItem(keys[i]);if(v)r[keys[i]]=v;}
+  r._cookies=document.cookie;
+  return r;
+})()`,
+        });
+        this.scriptRegistry.set('bundle_search', {
+            description: 'Fetch a remote JS bundle and search it with regex patterns. params: { url: string, patterns: string[] }',
+            code: `(async function(){
+  var p=typeof __params__!=='undefined'?__params__:{};
+  if(!p.url)return{error:'params.url required'};
+  var resp=await fetch(p.url);
+  var text=await resp.text();
+  var patterns=p.patterns||[];
+  var results={};
+  for(var i=0;i<patterns.length;i++){
+    var re=new RegExp(patterns[i],'g');
+    var matches=[];var m;
+    while((m=re.exec(text))!==null){
+      var s=Math.max(0,m.index-80),e=Math.min(text.length,m.index+m[0].length+80);
+      matches.push({match:m[0],ctx:text.slice(s,e)});
+      if(matches.length>=10)break;
+    }
+    results[patterns[i]]=matches;
+  }
+  return{size:text.length,results:results};
+})()`,
+        });
+        this.scriptRegistry.set('react_fill_form', {
+            description: 'Fill React controlled form inputs using native setter trick. params: { fields: { "selector": "value" } }',
+            code: `(function(){
+  var p=typeof __params__!=='undefined'?__params__:{};
+  var fields=p.fields||{};
+  var ns=Object.getOwnPropertyDescriptor(window.HTMLInputElement.prototype,'value').set;
+  var r={};
+  var entries=Object.entries(fields);
+  for(var i=0;i<entries.length;i++){
+    var sel=entries[i][0],val=entries[i][1];
+    var el=document.querySelector(sel);
+    if(!el){r[sel]='not found';continue;}
+    ns.call(el,val);
+    el.dispatchEvent(new Event('input',{bubbles:true}));
+    el.dispatchEvent(new Event('change',{bubbles:true}));
+    r[sel]='filled';
+  }
+  return r;
+})()`,
+        });
+        this.scriptRegistry.set('dom_find_upgrade_buttons', {
+            description: 'Scan the current page for upgrade/subscription/tier-related UI elements',
+            code: `(function(){
+  var kw=['upgrade','plus','pro','premium','subscribe','plan','tier','vip','membership'];
+  var r=[];
+  document.querySelectorAll('button,a,[role=button],[class*=upgrade],[class*=premium],[class*=plus]').forEach(function(el){
+    var t=(el.textContent||'').toLowerCase().trim();
+    var c=(el.className||'').toLowerCase();
+    if(kw.some(function(k){return t.includes(k)||c.includes(k);})){
+      r.push({tag:el.tagName,text:t.slice(0,120),cls:c.slice(0,100),href:el.href||null,id:el.id||null});
+    }
+  });
+  return r;
+})()`,
+        });
+    }
+    getOptionalString(value) {
+        return typeof value === 'string' ? value : undefined;
+    }
+    getOptionalRecord(value) {
+        if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+            return undefined;
+        }
+        return value;
+    }
+    jsonTextResult(payload) {
+        return {
+            content: [{
+                    type: 'text',
+                    text: JSON.stringify(payload),
+                }],
+        };
+    }
+    async handlePageScriptRegister(args) {
+        const name = this.getOptionalString(args.name);
+        const code = this.getOptionalString(args.code);
+        const description = this.getOptionalString(args.description) ?? '';
+        if (!name || !code) {
+            return this.jsonTextResult({ success: false, error: 'name and code are required' });
+        }
+        const isUpdate = this.scriptRegistry.has(name);
+        if (!isUpdate && this.scriptRegistry.size >= WorkflowHandlersBase.MAX_SCRIPTS) {
+            for (const k of this.scriptRegistry.keys()) {
+                if (!['auth_extract', 'bundle_search', 'react_fill_form', 'dom_find_upgrade_buttons'].includes(k)) {
+                    this.scriptRegistry.delete(k);
+                    break;
+                }
+            }
+        }
+        this.scriptRegistry.set(name, { code, description });
+        return this.jsonTextResult({
+            success: true,
+            action: isUpdate ? 'updated' : 'registered',
+            name,
+            description,
+            totalScripts: this.scriptRegistry.size,
+            available: Array.from(this.scriptRegistry.keys()),
+        });
+    }
+    async handlePageScriptRun(args) {
+        const name = this.getOptionalString(args.name);
+        const params = this.getOptionalRecord(args.params);
+        const entry = name ? this.scriptRegistry.get(name) : undefined;
+        if (!entry) {
+            const available = Array.from(this.scriptRegistry.keys());
+            return this.jsonTextResult({
+                success: false,
+                error: `Script "${name}" not found`,
+                available,
+            });
+        }
+        let codeToRun;
+        if (params !== undefined) {
+            const paramsPayloadLiteral = this.escapeInlineScriptLiteral(JSON.stringify(JSON.stringify(params)));
+            codeToRun = `(function(){const __params__=JSON.parse(${paramsPayloadLiteral});return(${entry.code});})()`;
+        }
+        else {
+            codeToRun = entry.code;
+        }
+        try {
+            const result = await this.deps.browserHandlers.handlePageEvaluate({ code: codeToRun });
+            return result;
+        }
+        catch (error) {
+            logger.error(`[page_script_run] Script "${name}" failed:`, error);
+            return this.jsonTextResult({
+                success: false,
+                script: name,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    async handleListExtensionWorkflows() {
+        const ctx = this.deps.serverContext;
+        if (!ctx) {
+            return this.jsonTextResult({
+                success: false,
+                error: 'Extension workflow runtime is unavailable in this handler context',
+            });
+        }
+        const workflows = [...ctx.extensionWorkflowsById.values()]
+            .sort((a, b) => a.id.localeCompare(b.id))
+            .map((record) => ({
+            id: record.id,
+            displayName: record.displayName,
+            description: record.description,
+            tags: record.tags,
+            timeoutMs: record.timeoutMs,
+            defaultMaxConcurrency: record.defaultMaxConcurrency,
+            source: record.source,
+        }));
+        return this.jsonTextResult({
+            success: true,
+            count: workflows.length,
+            workflows,
+        });
+    }
+    async handleRunExtensionWorkflow(args) {
+        const ctx = this.deps.serverContext;
+        if (!ctx) {
+            return this.jsonTextResult({
+                success: false,
+                error: 'Extension workflow runtime is unavailable in this handler context',
+            });
+        }
+        const workflowId = this.getOptionalString(args.workflowId) ?? this.getOptionalString(args.id);
+        if (!workflowId) {
+            return this.jsonTextResult({
+                success: false,
+                error: 'workflowId is required',
+            });
+        }
+        const runtimeRecord = ctx.extensionWorkflowRuntimeById.get(workflowId);
+        if (!runtimeRecord) {
+            return this.jsonTextResult({
+                success: false,
+                error: `Extension workflow "${workflowId}" not found`,
+                available: [...ctx.extensionWorkflowsById.keys()].sort((a, b) => a.localeCompare(b)),
+            });
+        }
+        const profile = this.getOptionalString(args.profile);
+        const config = this.getOptionalRecord(args.config);
+        const nodeInputOverrides = this.getOptionalRecord(args.nodeInputOverrides);
+        const timeoutMs = typeof args.timeoutMs === 'number' ? args.timeoutMs : undefined;
+        try {
+            const result = await executeExtensionWorkflow(ctx, runtimeRecord.workflow, {
+                profile,
+                config,
+                nodeInputOverrides,
+                timeoutMs,
+            });
+            return this.jsonTextResult({ success: true, ...result });
+        }
+        catch (error) {
+            logger.error(`[run_extension_workflow] Workflow "${workflowId}" failed:`, error);
+            return this.jsonTextResult({
+                success: false,
+                workflowId,
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+}

package/dist/src/server/extensions/ExtensionManager.discovery.d.ts

@@ -0,0 +1,2 @@
+export declare function discoverPluginFiles(pluginRoots: string[]): Promise<string[]>;
+export declare function discoverWorkflowFiles(workflowRoots: string[]): Promise<string[]>;

package/dist/src/server/extensions/ExtensionManager.discovery.js

@@ -0,0 +1,109 @@
+import { basename, dirname } from 'node:path';
+import { glob } from 'tinyglobby';
+async function collectMatchingFiles(roots, matcher) {
+    const files = new Set();
+    for (const root of roots) {
+        let matchedPaths;
+        try {
+            matchedPaths = await glob('**/*', {
+                cwd: root,
+                absolute: true,
+                onlyFiles: true,
+                ignore: ['**/node_modules/**', '**/.git/**', '**/.pnpm/**'],
+            });
+        }
+        catch {
+            continue;
+        }
+        for (const file of matchedPaths) {
+            if (matcher(basename(file))) {
+                files.add(file);
+            }
+        }
+    }
+    return [...files].sort((a, b) => a.localeCompare(b));
+}
+function normalizeExtensionCandidateKey(root, file) {
+    const normalizedRoot = root
+        .replace(/\\/g, '/')
+        .replace(/\/+/g, '/')
+        .replace(/^\/+|\/+$/g, '')
+        .toLowerCase();
+    const relDir = dirname(file)
+        .slice(root.length)
+        .replace(/^[/\\]+/, '')
+        .replace(/\\/g, '/')
+        .replace(/\/+/g, '/')
+        .replace(/^\/+|\/+$/g, '')
+        .toLowerCase();
+    if (!relDir || relDir === 'dist') {
+        return `${normalizedRoot}::`;
+    }
+    const normalizedRelDir = relDir.endsWith('/dist') ? relDir.slice(0, -'/dist'.length) : relDir;
+    return `${normalizedRoot}::${normalizedRelDir}`;
+}
+function extensionRank(candidate) {
+    if (candidate.isJs)
+        return 0;
+    if (candidate.isTs)
+        return 1;
+    return 2;
+}
+function deduplicateCandidates(candidates) {
+    const byKey = new Map();
+    for (const candidate of candidates.sort((a, b) => a.file.localeCompare(b.file))) {
+        const existing = byKey.get(candidate.key);
+        if (!existing) {
+            byKey.set(candidate.key, candidate);
+            continue;
+        }
+        const existingRoot = existing.rootIndex;
+        const candidateRoot = candidate.rootIndex;
+        const existingExtRank = extensionRank(existing);
+        const candidateExtRank = extensionRank(candidate);
+        const shouldReplace = candidateRoot < existingRoot ||
+            (candidateRoot === existingRoot && candidateExtRank < existingExtRank) ||
+            (candidateRoot === existingRoot &&
+                candidateExtRank === existingExtRank &&
+                candidate.file.localeCompare(existing.file) < 0);
+        if (shouldReplace) {
+            byKey.set(candidate.key, candidate);
+        }
+    }
+    return [...byKey.values()].map((item) => item.file).sort((a, b) => a.localeCompare(b));
+}
+export async function discoverPluginFiles(pluginRoots) {
+    const candidates = [];
+    for (const [rootIndex, root] of pluginRoots.entries()) {
+        const files = await collectMatchingFiles([root], (filename) => filename === 'manifest.js' || filename === 'manifest.ts');
+        for (const file of files) {
+            candidates.push({
+                file,
+                key: normalizeExtensionCandidateKey(root, file),
+                isJs: file.endsWith('.js'),
+                isTs: file.endsWith('.ts'),
+                rootIndex,
+            });
+        }
+    }
+    return deduplicateCandidates(candidates);
+}
+export async function discoverWorkflowFiles(workflowRoots) {
+    const candidates = [];
+    for (const [rootIndex, root] of workflowRoots.entries()) {
+        const files = await collectMatchingFiles([root], (filename) => filename.endsWith('.workflow.js') ||
+            filename.endsWith('.workflow.ts') ||
+            filename === 'workflow.js' ||
+            filename === 'workflow.ts');
+        for (const file of files) {
+            candidates.push({
+                file,
+                key: normalizeExtensionCandidateKey(root, file),
+                isJs: file.endsWith('.js'),
+                isTs: file.endsWith('.ts'),
+                rootIndex,
+            });
+        }
+    }
+    return deduplicateCandidates(candidates);
+}

package/dist/src/server/extensions/ExtensionManager.guards.d.ts

@@ -0,0 +1,4 @@
+import type { ExtensionBuilder } from '../plugins/PluginContract.js';
+import type { WorkflowContract } from '../workflows/WorkflowContract.js';
+export declare function isExtensionBuilder(value: unknown): value is ExtensionBuilder;
+export declare function isWorkflowContract(value: unknown): value is WorkflowContract;

package/dist/src/server/extensions/ExtensionManager.guards.js

@@ -0,0 +1,18 @@
+export function isExtensionBuilder(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const candidate = value;
+    return !!(typeof candidate.id === 'string' &&
+        typeof candidate.version === 'string' &&
+        Array.isArray(candidate.tools));
+}
+export function isWorkflowContract(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const candidate = value;
+    return !!(candidate.kind === 'workflow-contract' &&
+        candidate.version === 1 &&
+        typeof candidate.id === 'string' &&
+        typeof candidate.displayName === 'string' &&
+        typeof candidate.build === 'function');
+}

package/dist/src/server/extensions/ExtensionManager.integrity.d.ts

@@ -0,0 +1,11 @@
+import type { ExtensionBuilder } from '../plugins/PluginContract.js';
+export declare function sha256Hex(filePath: string): Promise<string>;
+export declare function normalizeHex(value: string): string;
+export declare function isPluginSignatureRequired(): boolean;
+export declare function isPluginStrictLoad(): boolean;
+export declare function parseDigestAllowlist(raw: string | undefined): Set<string>;
+export declare function verifyPluginIntegrity(plugin: ExtensionBuilder, currentVersion: string): Promise<{
+    ok: boolean;
+    errors: string[];
+    warnings: string[];
+}>;

package/dist/src/server/extensions/ExtensionManager.integrity.js

@@ -0,0 +1,48 @@
+import { readFile } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import { isCompatibleVersion } from './ExtensionManager.version.js';
+export async function sha256Hex(filePath) {
+    const content = await readFile(filePath);
+    return createHash('sha256').update(content).digest('hex');
+}
+export function normalizeHex(value) {
+    return value.trim().toLowerCase().replace(/^0x/, '');
+}
+function isTruthyEnv(value) {
+    return ['1', 'true'].includes((value ?? '').toLowerCase());
+}
+export function isPluginSignatureRequired() {
+    const raw = process.env.MCP_PLUGIN_SIGNATURE_REQUIRED;
+    if (raw === undefined || raw.trim() === '') {
+        return process.env.NODE_ENV === 'production';
+    }
+    return isTruthyEnv(raw);
+}
+export function isPluginStrictLoad() {
+    const raw = process.env.MCP_PLUGIN_STRICT_LOAD;
+    if (raw === undefined || raw.trim() === '') {
+        return isPluginSignatureRequired();
+    }
+    return isTruthyEnv(raw) || isPluginSignatureRequired();
+}
+export function parseDigestAllowlist(raw) {
+    const value = raw?.trim();
+    if (!value)
+        return new Set();
+    return new Set(value
+        .split(',')
+        .map((item) => normalizeHex(item))
+        .filter((item) => item.length > 0));
+}
+export async function verifyPluginIntegrity(plugin, currentVersion) {
+    const errors = [];
+    const warnings = [];
+    if (!isCompatibleVersion(plugin.getCompatibleCore, currentVersion)) {
+        errors.push(`Plugin ${plugin.id} incompatible with core ${currentVersion}; requires ${plugin.getCompatibleCore}`);
+    }
+    return {
+        ok: errors.length === 0,
+        errors,
+        warnings,
+    };
+}