@jshookmcp/jshook 0.2.0 → 0.2.2

package/dist/src/server/domains/process/manifest.js

@@ -10,6 +10,97 @@ function ensure(ctx) {
         ctx.processHandlers = new ProcessToolHandlers();
     return ctx.processHandlers;
 }
+const IS_WIN32 = process.platform === 'win32';
+const WIN32_ONLY_TOOLS = new Set([
+    'inject_dll',
+    'module_inject_dll',
+    'inject_shellcode',
+    'module_inject_shellcode',
+    'check_debug_port',
+]);
+const allRegistrations = [
+    { tool: t('electron_attach'), domain: DOMAIN, bind: b((h, a) => h.handleElectronAttach(a)) },
+    { tool: t('process_find'), domain: DOMAIN, bind: b((h, a) => h.handleProcessFind(a)) },
+    {
+        tool: t('process_list'),
+        domain: DOMAIN,
+        bind: b((h, _a) => h.handleProcessFind({ pattern: '' })),
+    },
+    { tool: t('process_get'), domain: DOMAIN, bind: b((h, a) => h.handleProcessGet(a)) },
+    { tool: t('process_windows'), domain: DOMAIN, bind: b((h, a) => h.handleProcessWindows(a)) },
+    {
+        tool: t('process_find_chromium'),
+        domain: DOMAIN,
+        bind: b((h, a) => h.handleProcessFindChromium(a)),
+    },
+    {
+        tool: t('process_check_debug_port'),
+        domain: DOMAIN,
+        bind: b((h, a) => h.handleProcessCheckDebugPort(a)),
+    },
+    {
+        tool: t('process_launch_debug'),
+        domain: DOMAIN,
+        bind: b((h, a) => h.handleProcessLaunchDebug(a)),
+    },
+    { tool: t('process_kill'), domain: DOMAIN, bind: b((h, a) => h.handleProcessKill(a)) },
+    { tool: t('memory_read'), domain: DOMAIN, bind: b((h, a) => h.handleMemoryRead(a)) },
+    { tool: t('memory_write'), domain: DOMAIN, bind: b((h, a) => h.handleMemoryWrite(a)) },
+    { tool: t('memory_scan'), domain: DOMAIN, bind: b((h, a) => h.handleMemoryScan(a)) },
+    {
+        tool: t('memory_check_protection'),
+        domain: DOMAIN,
+        bind: b((h, a) => h.handleMemoryCheckProtection(a)),
+    },
+    {
+        tool: t('memory_protect'),
+        domain: DOMAIN,
+        bind: b((h, a) => h.handleMemoryCheckProtection(a)),
+    },
+    {
+        tool: t('memory_scan_filtered'),
+        domain: DOMAIN,
+        bind: b((h, a) => h.handleMemoryScanFiltered(a)),
+    },
+    {
+        tool: t('memory_batch_write'),
+        domain: DOMAIN,
+        bind: b((h, a) => h.handleMemoryBatchWrite(a)),
+    },
+    {
+        tool: t('memory_dump_region'),
+        domain: DOMAIN,
+        bind: b((h, a) => h.handleMemoryDumpRegion(a)),
+    },
+    {
+        tool: t('memory_list_regions'),
+        domain: DOMAIN,
+        bind: b((h, a) => h.handleMemoryListRegions(a)),
+    },
+    {
+        tool: t('memory_audit_export'),
+        domain: DOMAIN,
+        bind: b((h, a) => h.handleMemoryAuditExport(a)),
+    },
+    { tool: t('inject_dll'), domain: DOMAIN, bind: b((h, a) => h.handleInjectDll(a)) },
+    { tool: t('module_inject_dll'), domain: DOMAIN, bind: b((h, a) => h.handleInjectDll(a)) },
+    { tool: t('inject_shellcode'), domain: DOMAIN, bind: b((h, a) => h.handleInjectShellcode(a)) },
+    {
+        tool: t('module_inject_shellcode'),
+        domain: DOMAIN,
+        bind: b((h, a) => h.handleInjectShellcode(a)),
+    },
+    { tool: t('check_debug_port'), domain: DOMAIN, bind: b((h, a) => h.handleCheckDebugPort(a)) },
+    {
+        tool: t('enumerate_modules'),
+        domain: DOMAIN,
+        bind: b((h, a) => h.handleEnumerateModules(a)),
+    },
+    { tool: t('module_list'), domain: DOMAIN, bind: b((h, a) => h.handleEnumerateModules(a)) },
+];
+const registrations = IS_WIN32
+    ? allRegistrations
+    : allRegistrations.filter((r) => !WIN32_ONLY_TOOLS.has(r.tool.name));
 const manifest = {
     kind: 'domain-manifest',
     version: 1,
@@ -17,33 +108,6 @@ const manifest = {
     depKey: DEP_KEY,
     profiles: ['full'],
     ensure,
-    registrations: [
-        { tool: t('electron_attach'), domain: DOMAIN, bind: b((h, a) => h.handleElectronAttach(a)) },
-        { tool: t('process_find'), domain: DOMAIN, bind: b((h, a) => h.handleProcessFind(a)) },
-        { tool: t('process_list'), domain: DOMAIN, bind: b((h, _a) => h.handleProcessFind({ pattern: '' })) },
-        { tool: t('process_get'), domain: DOMAIN, bind: b((h, a) => h.handleProcessGet(a)) },
-        { tool: t('process_windows'), domain: DOMAIN, bind: b((h, a) => h.handleProcessWindows(a)) },
-        { tool: t('process_find_chromium'), domain: DOMAIN, bind: b((h, a) => h.handleProcessFindChromium(a)) },
-        { tool: t('process_check_debug_port'), domain: DOMAIN, bind: b((h, a) => h.handleProcessCheckDebugPort(a)) },
-        { tool: t('process_launch_debug'), domain: DOMAIN, bind: b((h, a) => h.handleProcessLaunchDebug(a)) },
-        { tool: t('process_kill'), domain: DOMAIN, bind: b((h, a) => h.handleProcessKill(a)) },
-        { tool: t('memory_read'), domain: DOMAIN, bind: b((h, a) => h.handleMemoryRead(a)) },
-        { tool: t('memory_write'), domain: DOMAIN, bind: b((h, a) => h.handleMemoryWrite(a)) },
-        { tool: t('memory_scan'), domain: DOMAIN, bind: b((h, a) => h.handleMemoryScan(a)) },
-        { tool: t('memory_check_protection'), domain: DOMAIN, bind: b((h, a) => h.handleMemoryCheckProtection(a)) },
-        { tool: t('memory_protect'), domain: DOMAIN, bind: b((h, a) => h.handleMemoryCheckProtection(a)) },
-        { tool: t('memory_scan_filtered'), domain: DOMAIN, bind: b((h, a) => h.handleMemoryScanFiltered(a)) },
-        { tool: t('memory_batch_write'), domain: DOMAIN, bind: b((h, a) => h.handleMemoryBatchWrite(a)) },
-        { tool: t('memory_dump_region'), domain: DOMAIN, bind: b((h, a) => h.handleMemoryDumpRegion(a)) },
-        { tool: t('memory_list_regions'), domain: DOMAIN, bind: b((h, a) => h.handleMemoryListRegions(a)) },
-        { tool: t('memory_audit_export'), domain: DOMAIN, bind: b((h, a) => h.handleMemoryAuditExport(a)) },
-        { tool: t('inject_dll'), domain: DOMAIN, bind: b((h, a) => h.handleInjectDll(a)) },
-        { tool: t('module_inject_dll'), domain: DOMAIN, bind: b((h, a) => h.handleInjectDll(a)) },
-        { tool: t('inject_shellcode'), domain: DOMAIN, bind: b((h, a) => h.handleInjectShellcode(a)) },
-        { tool: t('module_inject_shellcode'), domain: DOMAIN, bind: b((h, a) => h.handleInjectShellcode(a)) },
-        { tool: t('check_debug_port'), domain: DOMAIN, bind: b((h, a) => h.handleCheckDebugPort(a)) },
-        { tool: t('enumerate_modules'), domain: DOMAIN, bind: b((h, a) => h.handleEnumerateModules(a)) },
-        { tool: t('module_list'), domain: DOMAIN, bind: b((h, a) => h.handleEnumerateModules(a)) },
-    ],
+    registrations,
 };
 export default manifest;

package/dist/src/server/domains/sandbox/definitions.d.ts

@@ -0,0 +1,2 @@
+import type { Tool } from '@modelcontextprotocol/sdk/types.js';
+export declare const sandboxTools: Tool[];

package/dist/src/server/domains/sandbox/definitions.js

@@ -0,0 +1,35 @@
+export const sandboxTools = [
+    {
+        name: 'execute_sandbox_script',
+        description: 'Execute JavaScript code in a WASM-isolated QuickJS sandbox with optional MCP tool bridging, session persistence, and auto-correction.',
+        inputSchema: {
+            type: 'object',
+            properties: {
+                code: {
+                    type: 'string',
+                    description: 'JavaScript source code to execute inside the sandbox.',
+                },
+                sessionId: {
+                    type: 'string',
+                    description: 'Optional session ID for scratchpad persistence across executions. If omitted, no persistence.',
+                },
+                timeoutMs: {
+                    type: 'number',
+                    description: 'Execution timeout in ms (default: 1000).',
+                },
+                autoCorrect: {
+                    type: 'boolean',
+                    description: 'When true, failed scripts are retried up to 2 times with error context appended.',
+                    default: false,
+                },
+            },
+            required: ['code'],
+        },
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: false,
+            openWorldHint: false,
+        },
+    },
+];

package/dist/src/server/domains/sandbox/handlers.d.ts

@@ -0,0 +1,7 @@
+import type { MCPServerContext } from '../../MCPServer.context.js';
+export declare class SandboxToolHandlers {
+    private readonly ctx;
+    private readonly scratchpad;
+    constructor(ctx: MCPServerContext);
+    handleExecuteSandboxScript(args: Record<string, unknown>): Promise<unknown>;
+}

package/dist/src/server/domains/sandbox/handlers.js

@@ -0,0 +1,66 @@
+import { QuickJSSandbox } from '../../sandbox/QuickJSSandbox.js';
+import { MCPBridge } from '../../sandbox/MCPBridge.js';
+import { SessionScratchpad } from '../../sandbox/SessionScratchpad.js';
+import { executeWithRetry } from '../../sandbox/AutoCorrectionLoop.js';
+export class SandboxToolHandlers {
+    ctx;
+    scratchpad = new SessionScratchpad();
+    constructor(ctx) {
+        this.ctx = ctx;
+    }
+    async handleExecuteSandboxScript(args) {
+        const code = args.code;
+        const sessionId = args.sessionId ?? undefined;
+        const timeoutMs = args.timeoutMs ?? undefined;
+        const autoCorrect = args.autoCorrect ?? false;
+        if (!code || typeof code !== 'string') {
+            return {
+                content: [
+                    { type: 'text', text: JSON.stringify({ ok: false, error: 'code parameter is required' }) },
+                ],
+            };
+        }
+        const sandbox = new QuickJSSandbox();
+        const bridge = new MCPBridge(this.ctx);
+        sandbox.setBridge(bridge);
+        const options = {};
+        if (timeoutMs !== undefined)
+            options.timeoutMs = timeoutMs;
+        if (sessionId) {
+            options.sessionId = sessionId;
+            const scratchpadState = this.scratchpad.getAll(sessionId);
+            options.globals = {
+                ...(options.globals ?? {}),
+                __scratchpad: scratchpadState,
+            };
+        }
+        let result;
+        if (autoCorrect) {
+            result = await executeWithRetry(sandbox, code, options);
+        }
+        else {
+            result = await sandbox.execute(code, options);
+        }
+        if (sessionId && result.ok && result.output && typeof result.output === 'object') {
+            const output = result.output;
+            if (output.__scratchpad && typeof output.__scratchpad === 'object') {
+                for (const [k, v] of Object.entries(output.__scratchpad)) {
+                    this.scratchpad.set(sessionId, k, v);
+                }
+            }
+        }
+        const summary = [
+            `**Status:** ${result.ok ? '✓ Success' : '✗ Failed'}`,
+            result.timedOut ? '**Timed out:** yes' : '',
+            `**Duration:** ${result.durationMs}ms`,
+            result.logs.length > 0 ? `**Console output:**\n\`\`\`\n${result.logs.join('\n')}\n\`\`\`` : '',
+            result.output !== undefined ? `**Result:** ${JSON.stringify(result.output)}` : '',
+            result.error ? `**Error:** ${result.error}` : '',
+        ]
+            .filter(Boolean)
+            .join('\n');
+        return {
+            content: [{ type: 'text', text: summary }],
+        };
+    }
+}

package/dist/src/server/domains/sandbox/index.d.ts

@@ -0,0 +1,2 @@
+export { sandboxTools } from '../../domains/sandbox/definitions.js';
+export { SandboxToolHandlers } from '../../domains/sandbox/handlers.js';

package/dist/src/server/domains/sandbox/index.js

@@ -0,0 +1,2 @@
+export { sandboxTools } from '../../domains/sandbox/definitions.js';
+export { SandboxToolHandlers } from '../../domains/sandbox/handlers.js';

package/dist/src/server/domains/sandbox/manifest.d.ts

@@ -0,0 +1,57 @@
+import type { MCPServerContext } from '../../domains/shared/registry.js';
+import { SandboxToolHandlers } from '../../domains/sandbox/handlers.js';
+type H = SandboxToolHandlers;
+declare function ensure(ctx: MCPServerContext): H;
+declare const manifest: {
+    kind: "domain-manifest";
+    version: 1;
+    domain: "sandbox";
+    depKey: "sandboxHandlers";
+    profiles: "full"[];
+    ensure: typeof ensure;
+    registrations: {
+        tool: {
+            inputSchema: {
+                [x: string]: unknown;
+                type: "object";
+                properties?: {
+                    [x: string]: object;
+                } | undefined;
+                required?: string[] | undefined;
+            };
+            name: string;
+            description?: string | undefined;
+            outputSchema?: {
+                [x: string]: unknown;
+                type: "object";
+                properties?: {
+                    [x: string]: object;
+                } | undefined;
+                required?: string[] | undefined;
+            } | undefined;
+            annotations?: {
+                title?: string | undefined;
+                readOnlyHint?: boolean | undefined;
+                destructiveHint?: boolean | undefined;
+                idempotentHint?: boolean | undefined;
+                openWorldHint?: boolean | undefined;
+            } | undefined;
+            execution?: {
+                taskSupport?: "optional" | "required" | "forbidden" | undefined;
+            } | undefined;
+            _meta?: {
+                [x: string]: unknown;
+            } | undefined;
+            icons?: {
+                src: string;
+                mimeType?: string | undefined;
+                sizes?: string[] | undefined;
+                theme?: "light" | "dark" | undefined;
+            }[] | undefined;
+            title?: string | undefined;
+        };
+        domain: "sandbox";
+        bind: (deps: import("../../domains/shared/registry.js").ToolHandlerDeps) => (args: import("../../types.js").ToolArgs) => Promise<unknown>;
+    }[];
+};
+export default manifest;

package/dist/src/server/domains/sandbox/manifest.js

@@ -0,0 +1,31 @@
+import { bindByDepKey, toolLookup } from '../../domains/shared/registry.js';
+import { sandboxTools } from '../../domains/sandbox/definitions.js';
+import { SandboxToolHandlers } from '../../domains/sandbox/handlers.js';
+const DOMAIN = 'sandbox';
+const DEP_KEY = 'sandboxHandlers';
+const t = toolLookup(sandboxTools);
+const b = (invoke) => bindByDepKey(DEP_KEY, invoke);
+function ensure(ctx) {
+    const existing = ctx.getDomainInstance(DEP_KEY);
+    if (existing)
+        return existing;
+    const handlers = new SandboxToolHandlers(ctx);
+    ctx.setDomainInstance(DEP_KEY, handlers);
+    return handlers;
+}
+const manifest = {
+    kind: 'domain-manifest',
+    version: 1,
+    domain: DOMAIN,
+    depKey: DEP_KEY,
+    profiles: ['full'],
+    ensure,
+    registrations: [
+        {
+            tool: t('execute_sandbox_script'),
+            domain: DOMAIN,
+            bind: b((h, a) => h.handleExecuteSandboxScript(a)),
+        },
+    ],
+};
+export default manifest;

package/dist/src/server/domains/shared/parse-args.d.ts

@@ -0,0 +1,14 @@
+type Args = Record<string, unknown>;
+export declare function argString(args: Args, key: string, fallback: string): string;
+export declare function argString(args: Args, key: string): string | undefined;
+export declare function argNumber(args: Args, key: string, fallback: number): number;
+export declare function argNumber(args: Args, key: string): number | undefined;
+export declare function argBool(args: Args, key: string, fallback: boolean): boolean;
+export declare function argBool(args: Args, key: string): boolean | undefined;
+export declare function argEnum<T extends string>(args: Args, key: string, allowed: ReadonlySet<T>, fallback: T): T;
+export declare function argEnum<T extends string>(args: Args, key: string, allowed: ReadonlySet<T>): T | undefined;
+export declare function argStringRequired(args: Args, key: string): string;
+export declare function argNumberRequired(args: Args, key: string): number;
+export declare function argStringArray(args: Args, key: string): string[];
+export declare function argObject(args: Args, key: string): Record<string, unknown> | undefined;
+export {};

package/dist/src/server/domains/shared/parse-args.js

@@ -0,0 +1,50 @@
+export function argString(args, key, fallback) {
+    const v = args[key];
+    return typeof v === 'string' ? v : fallback;
+}
+export function argNumber(args, key, fallback) {
+    const v = args[key];
+    return typeof v === 'number' ? v : fallback;
+}
+export function argBool(args, key, fallback) {
+    const v = args[key];
+    return typeof v === 'boolean' ? v : fallback;
+}
+export function argEnum(args, key, allowed, fallback) {
+    const v = args[key];
+    if (v === undefined || v === null)
+        return fallback;
+    if (typeof v !== 'string')
+        return fallback;
+    if (!allowed.has(v)) {
+        throw new Error(`Invalid ${key}: "${v}". Expected one of: ${[...allowed].join(', ')}`);
+    }
+    return v;
+}
+export function argStringRequired(args, key) {
+    const v = args[key];
+    if (typeof v !== 'string') {
+        throw new Error(`Missing required string argument: "${key}"`);
+    }
+    return v;
+}
+export function argNumberRequired(args, key) {
+    const v = args[key];
+    if (typeof v !== 'number') {
+        throw new Error(`Missing required number argument: "${key}"`);
+    }
+    return v;
+}
+export function argStringArray(args, key) {
+    const v = args[key];
+    if (!Array.isArray(v))
+        return [];
+    return v.filter((item) => typeof item === 'string');
+}
+export function argObject(args, key) {
+    const v = args[key];
+    if (v !== null && typeof v === 'object' && !Array.isArray(v)) {
+        return v;
+    }
+    return undefined;
+}

package/dist/src/server/domains/sourcemap/definitions.js

@@ -12,6 +12,12 @@ export const sourcemapTools = [
                 },
             },
         },
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: false,
+            openWorldHint: false,
+        },
     },
     {
         name: 'sourcemap_fetch_and_parse',
@@ -30,6 +36,12 @@ export const sourcemapTools = [
             },
             required: ['sourceMapUrl'],
         },
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: false,
+            openWorldHint: false,
+        },
     },
     {
         name: 'sourcemap_reconstruct_tree',
@@ -48,6 +60,12 @@ export const sourcemapTools = [
             },
             required: ['sourceMapUrl'],
         },
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: false,
+            openWorldHint: false,
+        },
     },
     {
         name: 'extension_list_installed',
@@ -56,6 +74,12 @@ export const sourcemapTools = [
             type: 'object',
             properties: {},
         },
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: false,
+            openWorldHint: false,
+        },
     },
     {
         name: 'extension_execute_in_context',
@@ -79,5 +103,11 @@ export const sourcemapTools = [
             },
             required: ['extensionId', 'code'],
         },
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: false,
+            openWorldHint: false,
+        },
     },
 ];

package/dist/src/server/domains/sourcemap/handlers.d.ts

@@ -1 +1 @@
-export { SourcemapToolHandlers } from '../../domains/sourcemap/handlers.impl.js';
+export { SourcemapToolHandlers } from '../../domains/sourcemap/handlers.impl.core.js';

package/dist/src/server/domains/sourcemap/handlers.impl.sourcemap-extension.js

@@ -64,9 +64,7 @@ export class SourcemapToolHandlersExtension extends SourcemapToolHandlersCommon
     }
     async getExtensionTargets(session, expectedExtensionId) {
         const response = this.asRecord(await session.send('Target.getTargets'));
-        const targetInfos = Array.isArray(response.targetInfos)
-            ? response.targetInfos
-            : [];
+        const targetInfos = Array.isArray(response.targetInfos) ? response.targetInfos : [];
         const allowedTypes = new Set(['service_worker', 'background_page']);
         const result = [];
         for (const item of targetInfos) {
@@ -182,9 +180,7 @@ export class SourcemapToolHandlersExtension extends SourcemapToolHandlersCommon
         }
         const resultEnvelope = this.asRecord(responseMessage.result);
         const resultValue = resultEnvelope.result !== undefined ? resultEnvelope.result : null;
-        const exceptionDetails = resultEnvelope.exceptionDetails !== undefined
-            ? resultEnvelope.exceptionDetails
-            : null;
+        const exceptionDetails = resultEnvelope.exceptionDetails !== undefined ? resultEnvelope.exceptionDetails : null;
         return {
             result: resultValue,
             exceptionDetails,

package/dist/src/server/domains/sourcemap/handlers.impl.sourcemap-main.js

@@ -19,7 +19,7 @@ export class SourcemapToolHandlersMain extends SourcemapToolHandlersExtension {
             const existing = scripts.get(scriptId);
             const sourceMapUrlResolved = sourceMapUrlRaw
                 ? this.resolveSourceMapUrl(sourceMapUrlRaw, scriptUrl)
-                : existing?.sourceMapUrl ?? '';
+                : (existing?.sourceMapUrl ?? '');
             scripts.set(scriptId, {
                 scriptId,
                 scriptUrl: scriptUrl || existing?.scriptUrl || '',

package/dist/src/server/domains/sourcemap/handlers.impl.sourcemap-parse-base.js

@@ -1,7 +1,11 @@
-const VLQ_BASE_SHIFT = 5;
-const VLQ_BASE = 1 << VLQ_BASE_SHIFT;
-const VLQ_BASE_MASK = VLQ_BASE - 1;
-const VLQ_CONTINUATION_BIT = VLQ_BASE;
+import { evaluateWithTimeout } from '../../../modules/collector/PageController.js';
+var VlqConstant;
+(function (VlqConstant) {
+    VlqConstant[VlqConstant["BASE_SHIFT"] = 5] = "BASE_SHIFT";
+    VlqConstant[VlqConstant["BASE"] = 32] = "BASE";
+    VlqConstant[VlqConstant["BASE_MASK"] = 31] = "BASE_MASK";
+    VlqConstant[VlqConstant["CONTINUATION_BIT"] = 32] = "CONTINUATION_BIT";
+})(VlqConstant || (VlqConstant = {}));
 const BASE64_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
 const BASE64_DECODE_MAP = new Map(Array.from(BASE64_ALPHABET).map((char, index) => [char, index]));
 export class SourcemapToolHandlersParseBase {
@@ -145,10 +149,10 @@ export class SourcemapToolHandlersParseBase {
                 if (digit === undefined) {
                     throw new Error(`Invalid VLQ base64 char "${char}" in segment "${segment}"`);
                 }
-                continuation = (digit & VLQ_CONTINUATION_BIT) !== 0;
-                const digitValue = digit & VLQ_BASE_MASK;
+                continuation = (digit & VlqConstant.CONTINUATION_BIT) !== 0;
+                const digitValue = digit & VlqConstant.BASE_MASK;
                 result += digitValue << shift;
-                shift += VLQ_BASE_SHIFT;
+                shift += VlqConstant.BASE_SHIFT;
             }
             values.push(this.fromVlqSigned(result));
         }
@@ -161,37 +165,52 @@ export class SourcemapToolHandlersParseBase {
     }
     async fetchSourceMapText(resolvedUrl) {
         this.validateFetchUrl(resolvedUrl);
-        try {
-            const response = await fetch(resolvedUrl);
-            if (!response.ok) {
-                throw new Error(`HTTP ${response.status} ${response.statusText}`);
+        {
+            const ac = new AbortController();
+            const t = setTimeout(() => ac.abort(), 10000);
+            try {
+                const response = await fetch(resolvedUrl, { signal: ac.signal });
+                if (!response.ok) {
+                    throw new Error(`HTTP ${response.status} ${response.statusText}`);
+                }
+                return await response.text();
             }
-            return await response.text();
-        }
-        catch {
-            const page = await this.collector.getActivePage();
-            const fetched = await page.evaluate(async (url) => {
-                try {
-                    const resp = await fetch(url);
-                    if (!resp.ok) {
-                        return `__FETCH_ERROR__HTTP ${resp.status} ${resp.statusText}`;
-                    }
-                    return await resp.text();
+            catch (err) {
+                if (err.name === 'AbortError') {
+                    throw new Error(`SourceMap fetch timed out after 10s: ${resolvedUrl}`);
                 }
-                catch (error) {
-                    const message = error instanceof Error ? error.message : String(error);
-                    return `__FETCH_ERROR__${message}`;
+            }
+            finally {
+                clearTimeout(t);
+            }
+        }
+        const page = await this.collector.getActivePage();
+        const fetched = await evaluateWithTimeout(page, async (url) => {
+            const ac = new AbortController();
+            const t = setTimeout(() => ac.abort(), 10000);
+            try {
+                const resp = await fetch(url, { signal: ac.signal });
+                if (!resp.ok) {
+                    return `__FETCH_ERROR__HTTP ${resp.status} ${resp.statusText}`;
                 }
-            }, resolvedUrl);
-            if (typeof fetched !== 'string') {
-                throw new Error('Failed to fetch SourceMap content');
+                return await resp.text();
             }
-            if (fetched.startsWith('__FETCH_ERROR__')) {
-                const message = fetched.slice('__FETCH_ERROR__'.length);
-                throw new Error(message || 'Failed to fetch SourceMap content');
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                return `__FETCH_ERROR__${message}`;
             }
-            return fetched;
+            finally {
+                clearTimeout(t);
+            }
+        }, resolvedUrl);
+        if (typeof fetched !== 'string') {
+            throw new Error('Failed to fetch SourceMap content');
+        }
+        if (fetched.startsWith('__FETCH_ERROR__')) {
+            const message = fetched.slice('__FETCH_ERROR__'.length);
+            throw new Error(message || 'Failed to fetch SourceMap content');
         }
+        return fetched;
     }
     validateFetchUrl(url) {
         let parsed;

package/dist/src/server/domains/sourcemap/handlers.js

@@ -1 +1 @@
-export { SourcemapToolHandlers } from '../../domains/sourcemap/handlers.impl.js';
+export { SourcemapToolHandlers } from '../../domains/sourcemap/handlers.impl.core.js';