@jshookmcp/jshook 0.1.8 → 0.2.0

package/dist/tests/server/domains/process/handlers.inject.test.js

@@ -0,0 +1,437 @@
+import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest';
+const state = vi.hoisted(() => ({
+    injectDll: vi.fn(),
+    injectShellcode: vi.fn(),
+    checkDebugPort: vi.fn(),
+    enumerateModules: vi.fn(),
+    recordMemoryAudit: vi.fn(),
+    connect: vi.fn(),
+    browserPages: vi.fn(),
+    browserDisconnect: vi.fn(),
+    pageEvaluate: vi.fn(),
+}));
+vi.mock(import('../../../../src/server/domains/shared/modules.js'), async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        UnifiedProcessManager: class {
+            getPlatform() {
+                return 'win32';
+            }
+        },
+        MemoryManager: class {
+            injectDll = state.injectDll;
+            injectShellcode = state.injectShellcode;
+            checkDebugPort = state.checkDebugPort;
+            enumerateModules = state.enumerateModules;
+        },
+    };
+});
+vi.mock(import('../../../../src/modules/process/memory/AuditTrail.js'), async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        MemoryAuditTrail: class {
+            record(entry) {
+                state.recordMemoryAudit(entry);
+            }
+            exportJson() {
+                return '[]';
+            }
+            clear() { }
+            size() {
+                return 0;
+            }
+        },
+    };
+});
+vi.mock('@src/utils/logger', () => ({
+    logger: {
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn(),
+    },
+}));
+vi.mock('rebrowser-puppeteer-core', () => ({
+    default: {
+        connect: (...args) => state.connect(...args),
+    },
+}));
+const mockEnableInjectionTools = { value: false };
+vi.mock(import('../../../../src/constants.js'), async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        get ENABLE_INJECTION_TOOLS() {
+            return mockEnableInjectionTools.value;
+        },
+    };
+});
+import { ProcessToolHandlersRuntime } from '../../../../src/server/domains/process/handlers.impl.core.runtime.inject.js';
+const originalFetch = global.fetch;
+function jsonResponse(body, init) {
+    return {
+        ok: init?.ok ?? true,
+        status: init?.status ?? 200,
+        json: vi.fn().mockResolvedValue(body),
+    };
+}
+function createBrowserPage(url) {
+    return {
+        url: () => url,
+        evaluate: (...args) => state.pageEvaluate(...args),
+    };
+}
+describe('handlers.impl.core.runtime.inject', () => {
+    let handler;
+    afterAll(() => {
+        global.fetch = originalFetch;
+    });
+    beforeEach(() => {
+        vi.clearAllMocks();
+        handler = new ProcessToolHandlersRuntime();
+        mockEnableInjectionTools.value = false;
+        global.fetch = vi.fn();
+        state.connect.mockResolvedValue({
+            pages: state.browserPages,
+            disconnect: state.browserDisconnect,
+        });
+        state.browserPages.mockResolvedValue([]);
+        state.browserDisconnect.mockResolvedValue(undefined);
+        state.pageEvaluate.mockReset();
+    });
+    describe('ENABLE_INJECTION_TOOLS=false branch', () => {
+        it('handleInjectDll returns disabled error when injection tools disabled', async () => {
+            const result = await handler.handleInjectDll({ pid: 1234, dllPath: 'C:\\test.dll' });
+            const response = JSON.parse(result.content[0].text);
+            expect(response.success).toBe(false);
+            expect(response.error).toContain('Injection tools are disabled by configuration');
+            expect(response.howToEnable).toContain('ENABLE_INJECTION_TOOLS=true');
+            expect(response.securityNotice).toBeDefined();
+            expect(state.injectDll).not.toHaveBeenCalled();
+            expect(state.recordMemoryAudit).toHaveBeenCalledWith(expect.objectContaining({
+                operation: 'inject_dll',
+                pid: 1234,
+                address: 'C:\\test.dll',
+                result: 'failure',
+            }));
+        });
+        it('handleInjectShellcode returns disabled error when injection tools disabled', async () => {
+            const result = await handler.handleInjectShellcode({ pid: 1234, shellcode: '909090', encoding: 'hex' });
+            const response = JSON.parse(result.content[0].text);
+            expect(response.success).toBe(false);
+            expect(response.error).toContain('Injection tools are disabled by configuration');
+            expect(response.howToEnable).toContain('ENABLE_INJECTION_TOOLS=true');
+            expect(state.injectShellcode).not.toHaveBeenCalled();
+            expect(state.recordMemoryAudit).toHaveBeenCalledWith(expect.objectContaining({
+                operation: 'inject_shellcode',
+                pid: 1234,
+                size: 3,
+                result: 'failure',
+            }));
+        });
+        it('handleInjectShellcode calculates base64 size correctly when disabled', async () => {
+            const shellcode = Buffer.from([0x41, 0x41, 0x41]).toString('base64');
+            const result = await handler.handleInjectShellcode({ pid: 1234, shellcode, encoding: 'base64' });
+            const response = JSON.parse(result.content[0].text);
+            expect(response.success).toBe(false);
+            expect(state.recordMemoryAudit).toHaveBeenCalledWith(expect.objectContaining({
+                size: 3,
+            }));
+        });
+        it('handleInjectDll handles missing pid gracefully when disabled', async () => {
+            const result = await handler.handleInjectDll({ dllPath: 'C:\\test.dll' });
+            const response = JSON.parse(result.content[0].text);
+            expect(response.success).toBe(false);
+            expect(state.recordMemoryAudit).toHaveBeenCalledWith(expect.objectContaining({
+                pid: null,
+                address: 'C:\\test.dll',
+            }));
+        });
+        it('handleInjectShellcode handles missing shellcode gracefully when disabled', async () => {
+            const result = await handler.handleInjectShellcode({ pid: 1234 });
+            const response = JSON.parse(result.content[0].text);
+            expect(response.success).toBe(false);
+            expect(state.recordMemoryAudit).toHaveBeenCalledWith(expect.objectContaining({
+                pid: 1234,
+                size: null,
+            }));
+        });
+    });
+    describe('ENABLE_INJECTION_TOOLS=true branch', () => {
+        beforeEach(() => {
+            mockEnableInjectionTools.value = true;
+        });
+        it('handleInjectDll delegates to memoryManager when enabled', async () => {
+            state.injectDll.mockResolvedValue({ success: true, remoteThreadId: 42 });
+            const result = await handler.handleInjectDll({ pid: 1234, dllPath: 'C:\\test.dll' });
+            const response = JSON.parse(result.content[0].text);
+            expect(response.success).toBe(true);
+            expect(response.remoteThreadId).toBe(42);
+            expect(state.injectDll).toHaveBeenCalledWith(1234, 'C:\\test.dll');
+            expect(state.recordMemoryAudit).toHaveBeenCalledWith(expect.objectContaining({
+                operation: 'inject_dll',
+                pid: 1234,
+                address: 'C:\\test.dll',
+                result: 'success',
+            }));
+        });
+        it('handleInjectDll records failure when injection fails', async () => {
+            state.injectDll.mockResolvedValue({ success: false, error: 'Access denied' });
+            const result = await handler.handleInjectDll({ pid: 1234, dllPath: 'C:\\test.dll' });
+            const response = JSON.parse(result.content[0].text);
+            expect(response.success).toBe(false);
+            expect(response.error).toBe('Access denied');
+            expect(state.recordMemoryAudit).toHaveBeenCalledWith(expect.objectContaining({
+                result: 'failure',
+                error: 'Access denied',
+            }));
+        });
+        it('handleInjectDll handles exceptions and records audit', async () => {
+            state.injectDll.mockRejectedValue(new Error('Unexpected error'));
+            const result = await handler.handleInjectDll({ pid: 1234, dllPath: 'C:\\test.dll' });
+            const response = JSON.parse(result.content[0].text);
+            expect(response.success).toBe(false);
+            expect(response.error).toBe('Unexpected error');
+            expect(state.recordMemoryAudit).toHaveBeenCalledWith(expect.objectContaining({
+                result: 'failure',
+                error: 'Unexpected error',
+            }));
+        });
+        it('handleInjectShellcode delegates to memoryManager when enabled', async () => {
+            state.injectShellcode.mockResolvedValue({ success: true, remoteThreadId: 100 });
+            const result = await handler.handleInjectShellcode({ pid: 1234, shellcode: '9090', encoding: 'hex' });
+            const response = JSON.parse(result.content[0].text);
+            expect(response.success).toBe(true);
+            expect(response.remoteThreadId).toBe(100);
+            expect(state.injectShellcode).toHaveBeenCalledWith(1234, '9090', 'hex');
+            expect(state.recordMemoryAudit).toHaveBeenCalledWith(expect.objectContaining({
+                operation: 'inject_shellcode',
+                size: 2,
+                result: 'success',
+            }));
+        });
+        it('handleInjectShellcode defaults to hex encoding', async () => {
+            state.injectShellcode.mockResolvedValue({ success: true, remoteThreadId: 100 });
+            await handler.handleInjectShellcode({ pid: 1234, shellcode: '9090' });
+            expect(state.injectShellcode).toHaveBeenCalledWith(1234, '9090', 'hex');
+        });
+    });
+    describe('checkDebugPort', () => {
+        it('returns result from memoryManager', async () => {
+            state.checkDebugPort.mockResolvedValue({ success: true, isDebugged: false });
+            const result = await handler.handleCheckDebugPort({ pid: 1234 });
+            const response = JSON.parse(result.content[0].text);
+            expect(response.success).toBe(true);
+            expect(response.isDebugged).toBe(false);
+        });
+        it('handles errors', async () => {
+            state.checkDebugPort.mockRejectedValue(new Error('Check failed'));
+            const result = await handler.handleCheckDebugPort({ pid: 1234 });
+            const response = JSON.parse(result.content[0].text);
+            expect(response.success).toBe(false);
+            expect(response.error).toBe('Check failed');
+        });
+    });
+    describe('enumerateModules', () => {
+        it('returns modules from memoryManager', async () => {
+            state.enumerateModules.mockResolvedValue({
+                success: true,
+                modules: [{ name: 'kernel32.dll', baseAddress: '0x7FFE0000', size: 0x1000 }],
+            });
+            const result = await handler.handleEnumerateModules({ pid: 1234 });
+            const response = JSON.parse(result.content[0].text);
+            expect(response.success).toBe(true);
+            expect(response.modules).toHaveLength(1);
+            expect(response.modules[0].name).toBe('kernel32.dll');
+        });
+        it('handles errors', async () => {
+            state.enumerateModules.mockRejectedValue(new Error('Enumeration failed'));
+            const result = await handler.handleEnumerateModules({ pid: 1234 });
+            const response = JSON.parse(result.content[0].text);
+            expect(response.success).toBe(false);
+            expect(response.error).toBe('Enumeration failed');
+        });
+    });
+    describe('electronAttach', () => {
+        it('returns a validation error for invalid ports', async () => {
+            const result = await handler.handleElectronAttach({ port: 'abc' });
+            const response = JSON.parse(result.content[0].text);
+            expect(response.success).toBe(false);
+            expect(response.error).toContain('Invalid port');
+            expect(state.connect).not.toHaveBeenCalled();
+        });
+        it('falls back from /json/list to /json and returns filtered pages when evaluate is omitted', async () => {
+            const fetchMock = vi.fn();
+            fetchMock.mockRejectedValueOnce(new Error('ECONNREFUSED'));
+            fetchMock.mockResolvedValueOnce(jsonResponse([
+                {
+                    id: 'page-1',
+                    title: 'Home',
+                    url: 'https://app.local/home',
+                    type: 'page',
+                    webSocketDebuggerUrl: 'ws://127.0.0.1:9229/devtools/page/page-1',
+                },
+                {
+                    id: 'page-2',
+                    title: 'Settings',
+                    url: 'https://app.local/settings',
+                    type: 'page',
+                    webSocketDebuggerUrl: 'ws://127.0.0.1:9229/devtools/page/page-2',
+                },
+            ]));
+            global.fetch = fetchMock;
+            const result = await handler.handleElectronAttach({ port: 9229, pageUrl: 'settings' });
+            const response = JSON.parse(result.content[0].text);
+            expect(fetchMock).toHaveBeenNthCalledWith(1, 'http://127.0.0.1:9229/json/list');
+            expect(fetchMock).toHaveBeenNthCalledWith(2, 'http://127.0.0.1:9229/json');
+            expect(response.total).toBe(2);
+            expect(response.filtered).toBe(1);
+            expect(response.pages[0]).toEqual(expect.objectContaining({
+                title: 'Settings',
+                url: 'https://app.local/settings',
+            }));
+            expect(state.connect).not.toHaveBeenCalled();
+        });
+        it('returns a structured connection failure when both CDP endpoints fail', async () => {
+            const fetchMock = vi.fn();
+            fetchMock.mockResolvedValueOnce(jsonResponse(null, { ok: false, status: 500 }));
+            fetchMock.mockResolvedValueOnce(jsonResponse(null, { ok: false, status: 503 }));
+            global.fetch = fetchMock;
+            const result = await handler.handleElectronAttach({ port: 9229, evaluate: '1 + 1' });
+            const response = JSON.parse(result.content[0].text);
+            expect(response.success).toBe(false);
+            expect(response.error).toContain('Cannot connect to Electron CDP at http://127.0.0.1:9229');
+            expect(response.error).toContain('CDP fallback endpoint returned HTTP 503');
+        });
+        it('fails when the CDP target payload is not an array', async () => {
+            global.fetch = vi.fn().mockResolvedValue(jsonResponse({ invalid: true }));
+            const result = await handler.handleElectronAttach({ port: 9229, evaluate: '1 + 1' });
+            const response = JSON.parse(result.content[0].text);
+            expect(response.success).toBe(false);
+            expect(response.error).toBe('CDP target list is not an array');
+        });
+        it('returns available targets when no matching page or websocket url is found', async () => {
+            global.fetch = vi.fn().mockResolvedValue(jsonResponse([
+                {
+                    id: 'page-1',
+                    title: 'Home',
+                    url: 'https://app.local/home',
+                    type: 'page',
+                },
+            ]));
+            const result = await handler.handleElectronAttach({
+                port: 9229,
+                pageUrl: 'settings',
+                evaluate: 'window.location.href',
+            });
+            expect(result.content[0].text).toContain('No matching page found');
+            expect(result.content[0].text).toContain('[page] Home — https://app.local/home');
+            expect(state.connect).not.toHaveBeenCalled();
+        });
+        it('uses the browser websocket endpoint from /json/version for successful evaluation', async () => {
+            const fetchMock = vi.fn();
+            fetchMock.mockResolvedValueOnce(jsonResponse([
+                {
+                    id: 'page-1',
+                    title: 'Main Window',
+                    url: 'https://app.local/dashboard',
+                    type: 'page',
+                    webSocketDebuggerUrl: 'ws://127.0.0.1:9229/devtools/page/page-1',
+                },
+            ]));
+            fetchMock.mockResolvedValueOnce(jsonResponse({
+                webSocketDebuggerUrl: 'ws://127.0.0.1:9229/devtools/browser/browser-id',
+            }));
+            global.fetch = fetchMock;
+            state.browserPages.mockResolvedValue([createBrowserPage('https://app.local/dashboard')]);
+            state.pageEvaluate.mockResolvedValue({ ok: true, result: { value: 2 } });
+            const result = await handler.handleElectronAttach({ port: 9229, evaluate: '1 + 1' });
+            const response = JSON.parse(result.content[0].text);
+            expect(state.connect).toHaveBeenCalledWith({
+                browserWSEndpoint: 'ws://127.0.0.1:9229/devtools/browser/browser-id',
+                defaultViewport: null,
+            });
+            expect(state.pageEvaluate).toHaveBeenCalledWith(expect.any(Function), '1 + 1');
+            expect(state.browserDisconnect).toHaveBeenCalledTimes(1);
+            expect(response).toEqual(expect.objectContaining({
+                success: true,
+                result: { value: 2 },
+            }));
+        });
+        it('derives a websocket endpoint from the page target and reports evaluate failures', async () => {
+            const fetchMock = vi.fn();
+            fetchMock.mockResolvedValueOnce(jsonResponse([
+                {
+                    id: 'page-1',
+                    title: 'Main Window',
+                    url: 'https://app.local/dashboard',
+                    type: 'page',
+                    webSocketDebuggerUrl: 'ws://127.0.0.1:9229/devtools/page/page-1',
+                },
+            ]));
+            fetchMock.mockRejectedValueOnce(new Error('version endpoint unavailable'));
+            global.fetch = fetchMock;
+            state.browserPages.mockResolvedValue([createBrowserPage('https://app.local/other')]);
+            state.pageEvaluate.mockResolvedValue({
+                ok: false,
+                error: { name: 'TypeError', message: 'boom' },
+            });
+            const result = await handler.handleElectronAttach({ port: 9229, evaluate: 'throw new Error("boom")' });
+            const response = JSON.parse(result.content[0].text);
+            expect(state.connect).toHaveBeenCalledWith({
+                browserWSEndpoint: 'ws://127.0.0.1:9229',
+                defaultViewport: null,
+            });
+            expect(response.success).toBe(false);
+            expect(response.error).toBe('Evaluation failed: TypeError: boom');
+            expect(response.target).toEqual({
+                title: 'Main Window',
+                url: 'https://app.local/dashboard',
+            });
+            expect(state.browserDisconnect).toHaveBeenCalledTimes(1);
+        });
+        it('fails when the connected browser exposes no pages', async () => {
+            global.fetch = vi.fn().mockResolvedValue(jsonResponse([
+                {
+                    id: 'page-1',
+                    title: 'Main Window',
+                    url: 'https://app.local/dashboard',
+                    type: 'page',
+                    webSocketDebuggerUrl: 'ws://127.0.0.1:9229/devtools/page/page-1',
+                },
+            ]));
+            state.browserPages.mockResolvedValue([]);
+            const result = await handler.handleElectronAttach({
+                port: 9229,
+                wsEndpoint: 'ws://127.0.0.1:9229/devtools/browser/from-arg',
+                evaluate: '1 + 1',
+            });
+            const response = JSON.parse(result.content[0].text);
+            expect(response.success).toBe(false);
+            expect(response.error).toBe('Could not get page from connected browser');
+            expect(state.browserDisconnect).toHaveBeenCalledTimes(1);
+        });
+        it('formats non-Error failures from connect through the outer catch handler', async () => {
+            global.fetch = vi.fn().mockResolvedValue(jsonResponse([
+                {
+                    id: 'page-1',
+                    title: 'Main Window',
+                    url: 'https://app.local/dashboard',
+                    type: 'page',
+                    webSocketDebuggerUrl: 'ws://127.0.0.1:9229/devtools/page/page-1',
+                },
+            ]));
+            state.connect.mockRejectedValue({ code: 'E_BROKEN' });
+            const result = await handler.handleElectronAttach({
+                port: 9229,
+                wsEndpoint: 'ws://127.0.0.1:9229/devtools/browser/from-arg',
+                evaluate: '1 + 1',
+            });
+            const response = JSON.parse(result.content[0].text);
+            expect(response.success).toBe(false);
+            expect(response.error).toContain('"code": "E_BROKEN"');
+        });
+    });
+});

package/dist/tests/server/domains/process/handlers.memory.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tests/server/domains/process/handlers.memory.test.js

@@ -0,0 +1,184 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const state = vi.hoisted(() => ({
+    getProcessByPid: vi.fn(),
+    checkAvailability: vi.fn(),
+    readMemory: vi.fn(),
+    writeMemory: vi.fn(),
+    scanMemory: vi.fn(),
+    checkMemoryProtection: vi.fn(),
+    enumerateModules: vi.fn(),
+    scanMemoryFiltered: vi.fn(),
+    batchMemoryWrite: vi.fn(),
+    dumpMemoryRegion: vi.fn(),
+    enumerateRegions: vi.fn(),
+    auditEntries: [],
+}));
+vi.mock(import('../../../../src/server/domains/shared/modules.js'), async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        UnifiedProcessManager: class {
+            getPlatform() {
+                return 'win32';
+            }
+            getProcessByPid = state.getProcessByPid;
+        },
+        MemoryManager: class {
+            checkAvailability = state.checkAvailability;
+            readMemory = state.readMemory;
+            writeMemory = state.writeMemory;
+            scanMemory = state.scanMemory;
+            checkMemoryProtection = state.checkMemoryProtection;
+            enumerateModules = state.enumerateModules;
+            scanMemoryFiltered = state.scanMemoryFiltered;
+            batchMemoryWrite = state.batchMemoryWrite;
+            dumpMemoryRegion = state.dumpMemoryRegion;
+            enumerateRegions = state.enumerateRegions;
+        },
+    };
+});
+vi.mock(import('../../../../src/modules/process/memory/AuditTrail.js'), async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        MemoryAuditTrail: class {
+            record(entry) {
+                state.auditEntries.push({
+                    ...entry,
+                    timestamp: '2026-03-10T00:00:00.000Z',
+                    user: 'test-user',
+                });
+            }
+            exportJson() {
+                return JSON.stringify(state.auditEntries);
+            }
+            clear() {
+                state.auditEntries.length = 0;
+            }
+            size() {
+                return state.auditEntries.length;
+            }
+        },
+    };
+});
+vi.mock('@src/utils/logger', () => ({
+    logger: {
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        debug: vi.fn(),
+    },
+}));
+import { ProcessToolHandlersMemory } from '../../../../src/server/domains/process/handlers.impl.core.runtime.memory.js';
+function parseJson(response) {
+    return JSON.parse(response.content[0].text);
+}
+describe('handlers.impl.core.runtime.memory', () => {
+    let handler;
+    beforeEach(() => {
+        vi.clearAllMocks();
+        state.auditEntries.length = 0;
+        state.checkAvailability.mockResolvedValue({ available: true });
+        state.getProcessByPid.mockResolvedValue(null);
+        state.checkMemoryProtection.mockResolvedValue({
+            success: true,
+            protection: 'RW',
+            regionStart: '0x1000',
+            regionSize: 16,
+            isReadable: true,
+            isWritable: true,
+        });
+        state.enumerateModules.mockResolvedValue({
+            success: true,
+            modules: [{ name: 'kernel32.dll', baseAddress: '0x1000', size: 4096 }],
+        });
+        state.readMemory.mockResolvedValue({ success: true, data: '90', error: undefined });
+        state.writeMemory.mockResolvedValue({ success: true, bytesWritten: 1, error: undefined });
+        state.scanMemory.mockResolvedValue({ success: true, addresses: ['0x1000'], error: undefined });
+        handler = new ProcessToolHandlersMemory();
+    });
+    it('records failed memory reads and exports the audit trail with diagnostics', async () => {
+        const readBody = parseJson(await handler.handleMemoryRead({ pid: 0, address: '0x1234', size: 8 }));
+        expect(readBody.success).toBe(false);
+        expect(readBody.error).toBe('Invalid PID: 0');
+        expect(readBody.diagnostics.permission.available).toBe(true);
+        expect(readBody.diagnostics.address.queried).toBe(false);
+        const auditBody = parseJson(await handler.handleMemoryAuditExport({ clear: false }));
+        expect(auditBody.success).toBe(true);
+        expect(auditBody.count).toBe(1);
+        expect(auditBody.entries[0]).toMatchObject({
+            operation: 'memory_read',
+            address: '0x1234',
+            size: 8,
+            result: 'failure',
+            error: 'Invalid PID: 0',
+        });
+    });
+    it('includes diagnostics and audit entries when memory write is unavailable', async () => {
+        state.checkAvailability.mockResolvedValue({ available: false, reason: 'Need admin' });
+        const body = parseJson(await handler.handleMemoryWrite({ pid: 1234, address: '0x2000', data: '90', encoding: 'hex' }));
+        expect(body.success).toBe(false);
+        expect(body.reason).toBe('Need admin');
+        expect(body.diagnostics.permission.reason).toBe('Need admin');
+        expect(body.diagnostics.recommendedActions).toContain('Run as administrator');
+        expect(state.auditEntries[0]).toMatchObject({
+            operation: 'memory_write',
+            pid: 1234,
+            address: '0x2000',
+            size: 1,
+            result: 'failure',
+            error: 'Need admin',
+        });
+    });
+    it('adds diagnostics when memory scans fail after reaching the memory manager', async () => {
+        state.getProcessByPid.mockResolvedValue({ pid: 1234, name: 'game.exe' });
+        state.scanMemory.mockResolvedValue({
+            success: false,
+            addresses: [],
+            error: 'Access denied',
+        });
+        const body = parseJson(await handler.handleMemoryScan({ pid: 1234, pattern: 'AA', patternType: 'hex' }));
+        expect(body.success).toBe(false);
+        expect(body.error).toBe('Access denied');
+        expect(body.diagnostics.process).toMatchObject({ exists: true, pid: 1234, name: 'game.exe' });
+        expect(body.diagnostics.aslr.note).toContain('Enumerated 1 module');
+        expect(body.diagnostics.recommendedActions).toContain('Run as administrator');
+        expect(state.auditEntries[0]).toMatchObject({
+            operation: 'memory_scan',
+            pid: 1234,
+            result: 'failure',
+            error: 'Access denied',
+        });
+    });
+    it('exports and clears audit entries when requested', async () => {
+        await handler.handleMemoryRead({ pid: 0, address: '0x9999', size: 4 });
+        expect(state.auditEntries).toHaveLength(1);
+        const body = parseJson(await handler.handleMemoryAuditExport({ clear: true }));
+        expect(body.success).toBe(true);
+        expect(body.count).toBe(1);
+        expect(body.cleared).toBe(true);
+        expect(state.auditEntries).toHaveLength(0);
+    });
+    it('returns availability failures for filtered scans', async () => {
+        state.checkAvailability.mockResolvedValue({ available: false, reason: 'ptrace required' });
+        const body = parseJson(await handler.handleMemoryScanFiltered({
+            pid: 1234,
+            pattern: 'AA',
+            addresses: ['0x1000'],
+            patternType: 'hex',
+        }));
+        expect(body.success).toBe(false);
+        expect(body.reason).toBe('ptrace required');
+        expect(body.pid).toBe(1234);
+    });
+    it('returns availability failures for batch writes', async () => {
+        state.checkAvailability.mockResolvedValue({ available: false, reason: 'write access denied' });
+        const body = parseJson(await handler.handleMemoryBatchWrite({
+            pid: 1234,
+            patches: [{ address: '0x1000', data: '90', encoding: 'hex' }],
+        }));
+        expect(body.success).toBe(false);
+        expect(body.reason).toBe('write access denied');
+        expect(body.pid).toBe(1234);
+    });
+});

package/dist/tests/server/domains/process/handlers.test.d.ts

@@ -0,0 +1 @@
+export {};