@jshookmcp/jshook 0.2.1 → 0.2.3

package/README.md

@@ -8,7 +8,7 @@
 
 English | [中文](./README.zh.md)
 
-An MCP (Model Context Protocol) server providing **245 built-in tools** — **238 domain tools across 16 domains** plus **8 built-in meta-tools** — with runtime extension loading from `plugins/` and `workflows/` for AI-assisted JavaScript analysis and security analysis. Combines browser automation, Chrome DevTools Protocol debugging, network monitoring, intelligent JavaScript hooks, LLM-powered code analysis, process/memory inspection, WASM toolchain, binary encoding, anti-anti-debug, GraphQL discovery, source map reconstruction, AST transforms, crypto reconstruction, platform package analysis, Burp Suite / native analysis tool bridges, human behavior simulation, CAPTCHA solving, batch account workflows, and high-level composite workflow orchestration in a single server.
+An MCP (Model Context Protocol) server providing **290+ built-in tools** across **17+ domains** (including core meta-tools) — with runtime extension loading from `plugins/` and `workflows/` for AI-assisted JavaScript analysis and security analysis. Combines browser automation, Chrome DevTools Protocol debugging, network monitoring, intelligent JavaScript hooks, LLM-powered code analysis, process/memory inspection, WASM toolchain, binary encoding, anti-anti-debug, GraphQL discovery, source map reconstruction, AST transforms, crypto reconstruction, platform package analysis, Burp Suite / native analysis tool bridges, human behavior simulation, CAPTCHA solving, batch account workflows, and high-level composite workflow orchestration in a single server.
 
 ## Documentation / Quick Links
 
@@ -20,7 +20,7 @@ An MCP (Model Context Protocol) server providing **245 built-in tools** — **23
 ## 🌟 Key Highlights
 
 - 🤖 **AI-Driven Analysis**: Leverage LLMs for intelligent JavaScript deobfuscation, cryptographic algorithm detection, and AST-level code comprehension.
-- ⚡ **Search-First Context Efficiency**: BM25-powered `search_tools` + dynamic boosts cut jshook's tool-schema init delta from ~35.0K tokens (`full`) to ~3.0K (`search`) (Claude server-side count; excludes Claude Code base prompt).
+- ⚡ **Search-First Context Efficiency**: BM25-powered `search_tools` + dynamic boosts cut jshook's tool-schema init delta from ~40.0K+ tokens (`full`) to ~3.0K (`search`) (Claude server-side count; excludes Claude Code base prompt).
 - 🎯 **Progressive Capability Tiers**: Three built-in profiles (`search`/`workflow`/`full`), with `search` as the default base tier for on-demand capability scaling.
 - 🌐 **Full-Stack Automation**: Seamlessly orchestrate Chromium/Camoufox browsers, CDP debugging, and network interception as atomic actions.
 - 🛡️ **Advanced Anti-Debug**: Built-in evasion for debugger statements, timing checks, and strict headless bot fingerprinting techniques.
@@ -42,11 +42,11 @@ Provides a comprehensive suite of tools for AI-assisted JavaScript analysis, bro
 - **Lazy Domain Initialization**: Handler classes instantiated via Proxy on first invocation, not during startup
 - **Domain Self-Discovery**: Runtime manifest scanning (`domains/*/manifest.ts`) replaces hardcoded imports; add new domains by creating a single manifest file
 - **B-Skeleton Contracts**: Extensibility contracts for plugins (`PluginContract`), workflows (`WorkflowContract`), and observability (`InstrumentationContract`)
-- **Context Efficiency Benchmark**: Built-in tool-schema init delta (Claude server-side count, 2026-03-12): `search` ≈ 2,975 tokens vs `full` ≈ 34,985 tokens (12 vs 238 built-in tools; values change as tools/descriptions evolve)
+- **Context Efficiency Benchmark**: Built-in tool-schema init delta (Claude server-side count): `search` ≈ 3,000 tokens vs `full` ≈ 40,000+ tokens (10+ vs 290+ built-in tools; values change as tools/descriptions evolve)
 
 ## Tool Domains
 
-The server provides **245 built-in tools** across **16 domains** (Browser, Debugger, Network, Hooks, Maintenance, Core Analysis, Process/Memory, Workflows, WASM, Streaming, Encoding, Anti-Debug, GraphQL, Platform, Burp Suite, and Native Analysis).
+The server provides **290+ built-in tools** across **17+ domains** (`antidebug`, `browser`, `coordination`, `core`, `debugger`, `encoding`, `graphql`, `hooks`, `maintenance`, `network`, `platform`, `process`, `sourcemap`, `streaming`, `transform`, `wasm`, and `workflow`).
 
 > **[View the complete Tool Reference ↗](https://vmoranv.github.io/jshookmcp/reference/)**
 
@@ -58,7 +58,7 @@ The server provides **245 built-in tools** across **16 domains** (Browser, Debug
 
 <a href="https://www.star-history.com/?repos=vmoranv%2Fjshookmcp&type=date&legend=top-left">
  <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/image?repos=vmoranv/jshookmcp&type=date&theme=dark&legend=top-left" />
+   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/image?repos=vmoranv/jshookmcp&type=date&legend=top-left" />
    <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/image?repos=vmoranv/jshookmcp&type=date&legend=top-left" />
    <img alt="Star History Chart" src="https://api.star-history.com/image?repos=vmoranv/jshookmcp&type=date&legend=top-left" />
  </picture>

package/README.zh.md

@@ -8,7 +8,7 @@
 
 [English](./README.md) | 中文
 
-面向 AI 辅助 JavaScript 分析与安全分析的 MCP（模型上下文协议）服务器，提供 **245 个内置工具**——其中 **16 个域下 238 个域工具**，外加 **8 个内置元工具**——并支持从 `plugins/` 与 `workflows/` 目录运行时动态扩展。集成浏览器自动化、Chrome DevTools Protocol 调试、网络监控、智能 JavaScript Hook、LLM 驱动代码分析、进程/内存操作、WASM 工具链、二进制编码、反反调试、GraphQL 发现、Source Map 重建、AST 变换、加密重构、平台包分析、Burp Suite / Native 分析工具桥接及高层复合工作流编排。
+面向 AI 辅助 JavaScript 分析与安全分析的 MCP（模型上下文协议）服务器，提供 **290+ 个内置工具**——跨越 **17+ 个工具域**（包含核心元工具）——并支持从 `plugins/` 与 `workflows/` 目录运行时动态扩展。集成浏览器自动化、Chrome DevTools Protocol 调试、网络监控、智能 JavaScript Hook、LLM 驱动代码分析、进程/内存操作、WASM 工具链、二进制编码、反反调试、GraphQL 发现、Source Map 重建、AST 变换、加密重构、平台包分析、Burp Suite / Native 分析工具桥接及高层复合工作流编排。
 
 ## 文档与快速导航
 
@@ -20,7 +20,7 @@
 ## 🌟 核心亮点
 
 - 🤖 **AI 智能分析**：结合大语言模型实现 JavaScript 语义级反混淆、加密算法识别与深度 AST 结构理解。
-- ⚡ **搜索优先的上下文效率**：BM25 驱动的 `search_tools` 配合动态加权，可将 jshook 内置配置档位中的“工具 schema 增量初始化上下文”从 `full` 档约 ~35.0K tokens 降至 `search` 档约 ~3.0K（Claude 服务端计数；不含 Claude Code 基线提示词）。
+- ⚡ **搜索优先的上下文效率**：BM25 驱动的 `search_tools` 配合动态加权，可将 jshook 内置配置档位中的“工具 schema 增量初始化上下文”从 `full` 档约 ~40.0K+ tokens 降至 `search` 档约 ~3.0K（Claude 服务端计数；不含 Claude Code 基线提示词）。
 - 🎯 **渐进式能力分层**：内置三档配置（`search`/`workflow`/`full`），默认从 `search` 基座档启动，按需升级能力范围。
 - 🌐 **全链路自动化**：将浏览器环境（Chromium/Camoufox）、CDP 底层调试与网络拦截无缝整合为原子操作。
 - 🛡️ **高级反反调试**：内置强大的指纹伪装与检测绕过补丁，轻松应对各类反爬与调试器对抗保护。
@@ -42,7 +42,7 @@
 - **域延迟初始化**：处理器类通过 Proxy 在首次调用时实例化，而非启动时预加载
 - **域自发现架构**：运行时扫描 `domains/*/manifest.ts` 替代硬编码导入；新增域只需创建一个 manifest 文件
 - **B-Skeleton 契约**：插件（`PluginContract`）、工作流（`WorkflowContract`）、可观测性（`InstrumentationContract`）的扩展性契约
-- **上下文效率基准**：基于 Claude 服务端对当前内置工具 schema 的实测计数（2026-03-12），`search` 档 ≈ 2,975 tokens，`full` 档 ≈ 34,985 tokens（当前分别为 12 与 238 个 built-in tools；数值会随工具与描述变更而变化）
+- **上下文效率基准**：基于 Claude 服务端对当前内置工具 schema 的实测计数，`search` 档 ≈ 3,000 tokens，`full` 档 ≈ 40,000+ tokens（当前分别为 10+ 与 290+ 个 built-in tools；数值会随工具与描述变更而变化）
 
 ## 项目统计
 
@@ -50,7 +50,7 @@
 
 <a href="https://www.star-history.com/?repos=vmoranv%2Fjshookmcp&type=date&legend=top-left">
  <picture>
-   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/image?repos=vmoranv/jshookmcp&type=date&theme=dark&legend=top-left" />
+   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/image?repos=vmoranv/jshookmcp&type=date&legend=top-left" />
    <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/image?repos=vmoranv/jshookmcp&type=date&legend=top-left" />
    <img alt="Star History Chart" src="https://api.star-history.com/image?repos=vmoranv/jshookmcp&type=date&legend=top-left" />
  </picture>

package/dist/packages/extension-sdk/src/bridges/shared.d.ts

@@ -0,0 +1,40 @@
+export type JsonObject = Record<string, unknown>;
+export type TextToolResponse = {
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+};
+export type ProcessRunResult = {
+    ok: boolean;
+    exitCode: number | null;
+    signal: NodeJS.Signals | null;
+    stdout: string;
+    stderr: string;
+    durationMs: number;
+    truncated: boolean;
+};
+export type HttpJsonResult = {
+    status: number;
+    data: JsonObject;
+    text: string;
+};
+export declare function toTextResponse(payload: Record<string, unknown>): TextToolResponse;
+export declare function toErrorResponse(tool: string, error: unknown, extra?: Record<string, unknown>): TextToolResponse;
+export declare function parseStringArg(args: Record<string, unknown>, key: string, required?: boolean): string | undefined;
+export declare function toDisplayPath(absolutePath: string): string;
+export declare function resolveOutputDirectory(toolName: string, target: string, requestedDir?: string): Promise<{
+    absolutePath: string;
+    displayPath: string;
+}>;
+export declare function checkExternalCommand(command: string, versionArgs: string[], label: string, installHint?: string): Promise<TextToolResponse>;
+export declare function runProcess(command: string, args: string[], options?: {
+    timeoutMs?: number;
+    maxStdoutBytes?: number;
+    maxStderrBytes?: number;
+    cwd?: string;
+}): Promise<ProcessRunResult>;
+export declare function assertLoopbackUrl(value: string, label?: string): string;
+export declare function normalizeBaseUrl(value: string): string;
+export declare function buildUrl(baseUrl: string, path: string, query?: Record<string, unknown>): string;
+export declare function requestJson(url: string, method?: string, bodyObj?: Record<string, unknown>, timeoutMs?: number): Promise<HttpJsonResult>;

package/dist/packages/extension-sdk/src/bridges/shared.js

@@ -0,0 +1,196 @@
+import { execFile, spawn } from 'node:child_process';
+import { mkdir } from 'node:fs/promises';
+import { relative, resolve } from 'node:path';
+import { promisify } from 'node:util';
+const execFileAsync = promisify(execFile);
+export function toTextResponse(payload) {
+    return {
+        content: [{ type: 'text', text: JSON.stringify(payload, null, 2) }],
+    };
+}
+export function toErrorResponse(tool, error, extra = {}) {
+    return toTextResponse({
+        success: false,
+        tool,
+        error: error instanceof Error ? error.message : String(error),
+        ...extra,
+    });
+}
+export function parseStringArg(args, key, required = false) {
+    const value = args[key];
+    if (typeof value === 'string') {
+        const trimmed = value.trim();
+        if (trimmed.length > 0)
+            return trimmed;
+    }
+    if (required) {
+        throw new Error(`${key} must be a non-empty string`);
+    }
+    return undefined;
+}
+export function toDisplayPath(absolutePath) {
+    const relPath = relative(process.cwd(), absolutePath).replace(/\\/g, '/');
+    if (relPath.length === 0)
+        return '.';
+    return relPath.startsWith('..') ? absolutePath.replace(/\\/g, '/') : relPath;
+}
+function sanitizePathSegment(value) {
+    return value.replace(/[^a-zA-Z0-9._-]/g, '_');
+}
+export async function resolveOutputDirectory(toolName, target, requestedDir) {
+    if (requestedDir) {
+        const absolutePath = resolve(requestedDir);
+        await mkdir(absolutePath, { recursive: true });
+        return { absolutePath, displayPath: toDisplayPath(absolutePath) };
+    }
+    const absolutePath = resolve(process.cwd(), 'artifacts', toolName, `${sanitizePathSegment(target)}-${Date.now()}`);
+    await mkdir(absolutePath, { recursive: true });
+    return { absolutePath, displayPath: toDisplayPath(absolutePath) };
+}
+export async function checkExternalCommand(command, versionArgs, label, installHint) {
+    try {
+        const { stdout, stderr } = await execFileAsync(command, versionArgs, {
+            timeout: 10_000,
+        });
+        const version = (stdout || stderr).trim().split('\n')[0] ?? '';
+        return toTextResponse({
+            success: true,
+            tool: label,
+            available: true,
+            version,
+        });
+    }
+    catch (error) {
+        return toTextResponse({
+            success: true,
+            tool: label,
+            available: false,
+            reason: error instanceof Error ? error.message : String(error),
+            ...(installHint ? { installHint } : {}),
+        });
+    }
+}
+export async function runProcess(command, args, options = {}) {
+    const timeoutMs = options.timeoutMs ?? 300_000;
+    const maxStdout = options.maxStdoutBytes ?? 10 * 1024 * 1024;
+    const maxStderr = options.maxStderrBytes ?? 1 * 1024 * 1024;
+    return await new Promise((resolveResult) => {
+        const startedAt = Date.now();
+        const child = spawn(command, args, {
+            shell: false,
+            windowsHide: true,
+            cwd: options.cwd,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        let stdout = '';
+        let stderr = '';
+        let stdoutTruncated = false;
+        let stderrTruncated = false;
+        let settled = false;
+        let timedOut = false;
+        const finish = (exitCode, signal) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timeoutHandle);
+            resolveResult({
+                ok: exitCode === 0 && !timedOut,
+                exitCode,
+                signal,
+                stdout,
+                stderr,
+                durationMs: Date.now() - startedAt,
+                truncated: stdoutTruncated || stderrTruncated,
+            });
+        };
+        const timeoutHandle = setTimeout(() => {
+            timedOut = true;
+            child.kill('SIGTERM');
+            setTimeout(() => child.kill('SIGKILL'), 2_000);
+        }, timeoutMs);
+        child.stdout.on('data', (chunk) => {
+            if (stdout.length >= maxStdout) {
+                stdoutTruncated = true;
+                return;
+            }
+            const raw = chunk.toString('utf-8');
+            const remaining = maxStdout - stdout.length;
+            stdout += raw.slice(0, remaining);
+            if (raw.length > remaining)
+                stdoutTruncated = true;
+        });
+        child.stderr.on('data', (chunk) => {
+            if (stderr.length >= maxStderr) {
+                stderrTruncated = true;
+                return;
+            }
+            const raw = chunk.toString('utf-8');
+            const remaining = maxStderr - stderr.length;
+            stderr += raw.slice(0, remaining);
+            if (raw.length > remaining)
+                stderrTruncated = true;
+        });
+        child.on('close', (code, signal) => {
+            finish(code, signal);
+        });
+        child.on('error', (error) => {
+            stderr += `${stderr ? '\n' : ''}Spawn error: ${error.message}`;
+            finish(1, null);
+        });
+    });
+}
+export function assertLoopbackUrl(value, label = 'endpoint') {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error(`Invalid ${label} URL: ${value}`);
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        throw new Error(`${label}: only http/https protocols are allowed, got ${url.protocol}`);
+    }
+    const host = url.hostname.replace(/^\[|\]$/g, '');
+    const isLoopback = host === '127.0.0.1' || host === 'localhost' || host === '::1';
+    if (!isLoopback) {
+        throw new Error(`${label}: only loopback hosts are allowed (127.0.0.1/localhost/::1), got ${host}`);
+    }
+    return url.toString();
+}
+export function normalizeBaseUrl(value) {
+    const url = new URL(value);
+    return `${url.protocol}//${url.host}`;
+}
+export function buildUrl(baseUrl, path, query = {}) {
+    const normalizedPath = path.startsWith('/') ? path : `/${path}`;
+    const url = new URL(`${baseUrl.replace(/\/$/, '')}${normalizedPath}`);
+    for (const [key, value] of Object.entries(query)) {
+        if (value === undefined || value === null || value === '')
+            continue;
+        url.searchParams.set(key, String(value));
+    }
+    return url.toString();
+}
+export async function requestJson(url, method = 'GET', bodyObj, timeoutMs = 15_000) {
+    const body = bodyObj ? JSON.stringify(bodyObj) : undefined;
+    const response = await fetch(url, {
+        method,
+        headers: {
+            Accept: 'application/json',
+            ...(body ? { 'Content-Type': 'application/json' } : {}),
+        },
+        body,
+        signal: AbortSignal.timeout(timeoutMs),
+    });
+    const text = await response.text();
+    let data = {};
+    if (text.length > 0) {
+        try {
+            data = JSON.parse(text);
+        }
+        catch {
+            data = { text };
+        }
+    }
+    return { status: response.status, data, text };
+}

package/dist/packages/extension-sdk/src/plugin.d.ts

@@ -21,40 +21,43 @@ export interface ExtensionToolDefinition {
     description: string;
     schema: Record<string, unknown>;
     handler: ExtensionToolHandler;
+    profiles?: ToolProfileId[];
 }
+export declare const jsonResponse: (payload: Record<string, unknown>) => ToolResponse;
+export declare const errorResponse: (tool: string, error: unknown, extra?: Record<string, unknown>) => ToolResponse;
 export declare class ExtensionBuilder {
-    _id: string;
-    _version: string;
+    private readonly _id;
+    private readonly _version;
+    private _name;
+    private _description;
+    private _author;
+    private _sourceRepo;
+    private _compatibleCore;
+    private _profiles;
+    private _tools;
+    private _allowCommands;
+    private _allowHosts;
+    private _allowTools;
+    private _metrics;
+    private _configDefaults;
+    private _onLoadHandler?;
+    private _onValidateHandler?;
+    private _onActivateHandler?;
+    private _onDeactivateHandler?;
     constructor(id: string, version: string);
     get id(): string;
     get version(): string;
-    _name: string;
-    _description: string;
-    _compatibleCore: string;
-    _tools: ExtensionToolDefinition[];
-    _allowCommands: string[];
-    _allowHosts: string[];
-    _allowTools: string[];
-    _metrics: string[];
-    _configDefaults: Record<string, unknown>;
-    _onLoadHandler?: (ctx: PluginLifecycleContext) => Promise<void> | void;
-    _onValidateHandler?: (ctx: PluginLifecycleContext) => Promise<{
-        valid: boolean;
-        errors: string[];
-    }> | {
-        valid: boolean;
-        errors: string[];
-    };
-    _onActivateHandler?: (ctx: PluginLifecycleContext) => Promise<void> | void;
-    _onDeactivateHandler?: (ctx: PluginLifecycleContext) => Promise<void> | void;
-    get getName(): string;
-    get getDescription(): string;
-    get getCompatibleCore(): string;
+    get pluginName(): string;
+    get pluginDescription(): string;
+    get pluginAuthor(): string;
+    get pluginSourceRepo(): string;
+    get compatibleCoreRange(): string;
+    get profiles(): ToolProfileId[];
     get tools(): ExtensionToolDefinition[];
-    get allowCommands(): string[];
-    get allowHosts(): string[];
-    get allowTools(): string[];
-    get metrics(): string[];
+    get allowedCommands(): string[];
+    get allowedHosts(): string[];
+    get allowedTools(): string[];
+    get declaredMetrics(): string[];
     get configDefaults(): Record<string, unknown>;
     get onLoadHandler(): ((ctx: PluginLifecycleContext) => Promise<void> | void) | undefined;
     get onValidateHandler(): ((ctx: PluginLifecycleContext) => Promise<{
@@ -66,15 +69,24 @@ export declare class ExtensionBuilder {
     }) | undefined;
     get onActivateHandler(): ((ctx: PluginLifecycleContext) => Promise<void> | void) | undefined;
     get onDeactivateHandler(): ((ctx: PluginLifecycleContext) => Promise<void> | void) | undefined;
-    name(name: string): this;
+    name(n: string): this;
     description(desc: string): this;
+    author(a: string): this;
+    sourceRepo(url: string): this;
     compatibleCore(range: string): this;
+    mergeMetadata(meta: {
+        name?: string;
+        description?: string;
+        author?: string;
+        source_repo?: string;
+    }): this;
+    profile(p: ToolProfileId | ToolProfileId[]): this;
     allowCommand(cmd: string | string[]): this;
     allowHost(host: string | string[]): this;
     allowTool(tool: string | string[]): this;
     metric(m: string | string[]): this;
     configDefault(key: string, value: unknown): this;
-    tool(name: string, desc: string, schema: Record<string, unknown>, handler: ExtensionToolHandler): this;
+    tool(name: string, desc: string, schema: Record<string, unknown>, handler: ExtensionToolHandler, profiles?: ToolProfileId[]): this;
     onLoad(h: (ctx: PluginLifecycleContext) => Promise<void> | void): this;
     onValidate(h: (ctx: PluginLifecycleContext) => Promise<{
         valid: boolean;

package/dist/packages/extension-sdk/src/plugin.js

@@ -1,15 +1,15 @@
+import { toTextResponse, toErrorResponse, } from './bridges/shared.js';
+export const jsonResponse = toTextResponse;
+export const errorResponse = toErrorResponse;
 export class ExtensionBuilder {
     _id;
     _version;
-    constructor(id, version) {
-        this._id = id;
-        this._version = version;
-    }
-    get id() { return this._id; }
-    get version() { return this._version; }
     _name = '';
     _description = '';
+    _author = '';
+    _sourceRepo = '';
     _compatibleCore = '>=0.1.0';
+    _profiles = ['full'];
     _tools = [];
     _allowCommands = [];
     _allowHosts = [];
@@ -20,29 +20,61 @@ export class ExtensionBuilder {
     _onValidateHandler;
     _onActivateHandler;
     _onDeactivateHandler;
-    get getName() { return this._name; }
-    get getDescription() { return this._description; }
-    get getCompatibleCore() { return this._compatibleCore; }
+    constructor(id, version) {
+        this._id = id;
+        this._version = version;
+    }
+    get id() { return this._id; }
+    get version() { return this._version; }
+    get pluginName() { return this._name; }
+    get pluginDescription() { return this._description; }
+    get pluginAuthor() { return this._author; }
+    get pluginSourceRepo() { return this._sourceRepo; }
+    get compatibleCoreRange() { return this._compatibleCore; }
+    get profiles() { return this._profiles; }
     get tools() { return this._tools; }
-    get allowCommands() { return this._allowCommands; }
-    get allowHosts() { return this._allowHosts; }
-    get allowTools() { return this._allowTools; }
-    get metrics() { return this._metrics; }
+    get allowedCommands() { return this._allowCommands; }
+    get allowedHosts() { return this._allowHosts; }
+    get allowedTools() { return this._allowTools; }
+    get declaredMetrics() { return this._metrics; }
     get configDefaults() { return this._configDefaults; }
     get onLoadHandler() { return this._onLoadHandler; }
     get onValidateHandler() { return this._onValidateHandler; }
     get onActivateHandler() { return this._onActivateHandler; }
     get onDeactivateHandler() { return this._onDeactivateHandler; }
-    name(name) { this._name = name; return this; }
+    name(n) { this._name = n; return this; }
     description(desc) { this._description = desc; return this; }
+    author(a) { this._author = a; return this; }
+    sourceRepo(url) { this._sourceRepo = url; return this; }
     compatibleCore(range) { this._compatibleCore = range; return this; }
+    mergeMetadata(meta) {
+        if (!this._name && meta.name)
+            this._name = meta.name;
+        if (!this._description && meta.description)
+            this._description = meta.description;
+        if (!this._author && meta.author)
+            this._author = meta.author;
+        if (!this._sourceRepo && meta.source_repo)
+            this._sourceRepo = meta.source_repo;
+        return this;
+    }
+    profile(p) {
+        this._profiles = Array.isArray(p) ? p : [p];
+        return this;
+    }
     allowCommand(cmd) { this._allowCommands.push(...(Array.isArray(cmd) ? cmd : [cmd])); return this; }
     allowHost(host) { this._allowHosts.push(...(Array.isArray(host) ? host : [host])); return this; }
     allowTool(tool) { this._allowTools.push(...(Array.isArray(tool) ? tool : [tool])); return this; }
     metric(m) { this._metrics.push(...(Array.isArray(m) ? m : [m])); return this; }
     configDefault(key, value) { this._configDefaults[key] = value; return this; }
-    tool(name, desc, schema, handler) {
-        this._tools.push({ name, description: desc, schema: { type: 'object', properties: schema }, handler });
+    tool(name, desc, schema, handler, profiles) {
+        this._tools.push({
+            name,
+            description: desc,
+            schema: { type: 'object', properties: schema },
+            handler,
+            profiles,
+        });
         return this;
     }
     onLoad(h) { this._onLoadHandler = h; return this; }

package/dist/src/config/search-defaults.d.ts

@@ -39,4 +39,8 @@ export declare const DEFAULT_SEARCH_CONFIG: {
             bonus: number;
         }[];
     }[];
+    vectorEnabled: boolean;
+    vectorModelId: string;
+    vectorCosineWeight: number;
+    vectorDynamicWeight: boolean;
 };

package/dist/src/config/search-defaults.js

@@ -1,3 +1,4 @@
+import { SEARCH_VECTOR_ENABLED, SEARCH_VECTOR_MODEL_ID, SEARCH_VECTOR_COSINE_WEIGHT, SEARCH_VECTOR_DYNAMIC_WEIGHT, } from '../constants.js';
 export const DEFAULT_QUERY_CATEGORY_PROFILE_CONFIGS = [
     {
         pattern: '(?:security|vuln|xss|injection|csrf|exploit|attack|prototype\\s*pollution|漏洞|安全|注入|攻击)',
@@ -143,4 +144,8 @@ export const DEFAULT_SEARCH_CONFIG = {
     queryCategoryProfiles: DEFAULT_QUERY_CATEGORY_PROFILE_CONFIGS,
     cjkQueryAliases: DEFAULT_CJK_QUERY_ALIAS_CONFIGS,
     intentToolBoostRules: DEFAULT_INTENT_TOOL_BOOST_RULE_CONFIGS,
+    vectorEnabled: SEARCH_VECTOR_ENABLED,
+    vectorModelId: SEARCH_VECTOR_MODEL_ID,
+    vectorCosineWeight: SEARCH_VECTOR_COSINE_WEIGHT,
+    vectorDynamicWeight: SEARCH_VECTOR_DYNAMIC_WEIGHT,
 };

package/dist/src/constants.d.ts

@@ -48,6 +48,8 @@ export declare const NETWORK_REPLAY_TIMEOUT_MS: number;
 export declare const NETWORK_REPLAY_MAX_BODY_BYTES: number;
 export declare const NETWORK_REPLAY_MAX_REDIRECTS: number;
 export declare const NETWORK_HAR_BODY_CONCURRENCY: number;
+export declare const WORKFLOW_BATCH_MAX_ACCOUNTS: number;
+export declare const WORKFLOW_BATCH_MAX_CONCURRENCY: number;
 export declare const WORKFLOW_BATCH_MAX_RETRIES: number;
 export declare const WORKFLOW_BATCH_MAX_BACKOFF_MS: number;
 export declare const WORKFLOW_BATCH_MAX_TIMEOUT_MS: number;
@@ -67,11 +69,30 @@ export declare const SEARCH_AFFINITY_BOOST_FACTOR: number;
 export declare const SEARCH_AFFINITY_TOP_N: number;
 export declare const SEARCH_DOMAIN_HUB_THRESHOLD: number;
 export declare const SEARCH_QUERY_CACHE_CAPACITY: number;
+export declare const SEARCH_TRIGRAM_WEIGHT: number;
+export declare const SEARCH_RRF_K: number;
+export declare const SEARCH_SYNONYM_EXPANSION_LIMIT: number;
+export declare const SEARCH_PARAM_TOKEN_WEIGHT: number;
+export declare const SEARCH_VECTOR_ENABLED: boolean;
+export declare const SEARCH_VECTOR_MODEL_ID: string;
+export declare const SEARCH_VECTOR_COSINE_WEIGHT: number;
+export declare const SEARCH_VECTOR_DYNAMIC_WEIGHT: boolean;
 export declare const EXTENSION_GIT_CLONE_TIMEOUT_MS: number;
 export declare const EXTENSION_GIT_CHECKOUT_TIMEOUT_MS: number;
 export declare const PROCESS_LIST_MAX_BUFFER_BYTES: number;
 export declare const EXTERNAL_TOOL_MAX_STDOUT_BYTES: number;
 export declare const EXTERNAL_TOOL_MAX_STDERR_BYTES: number;
+export declare const GRAPHQL_MAX_PREVIEW_CHARS: number;
+export declare const GRAPHQL_MAX_SCHEMA_CHARS: number;
+export declare const GRAPHQL_MAX_QUERY_CHARS: number;
+export declare const GRAPHQL_MAX_GRAPH_NODES: number;
+export declare const GRAPHQL_MAX_GRAPH_EDGES: number;
+export declare const ANALYSIS_MAX_SUMMARY_FILES: number;
+export declare const ANALYSIS_MAX_SAFE_COLLECTED_BYTES: number;
+export declare const ANALYSIS_MAX_SAFE_RESPONSE_BYTES: number;
+export declare const WS_PAYLOAD_PREVIEW_LIMIT: number;
+export declare const WS_PAYLOAD_SAMPLE_LIMIT: number;
+export declare const SCRIPTS_MAX_CAP: number;
 export declare const WORKER_POOL_MIN_WORKERS: number;
 export declare const WORKER_POOL_MAX_WORKERS: number;
 export declare const WORKER_POOL_IDLE_TIMEOUT_MS: number;
@@ -112,3 +133,27 @@ export declare const PROCESS_LAUNCH_WAIT_MS: number;
 export declare const WIN_DEBUG_PORT_POLL_ATTEMPTS: number;
 export declare const WIN_DEBUG_PORT_POLL_INTERVAL_MS: number;
 export declare const PACKER_SANDBOX_TIMEOUT_MS: number;
+export declare const CODE_CAVE_MIN_SIZE: number;
+export declare const BREAKPOINT_HIT_TIMEOUT_MS: number;
+export declare const BREAKPOINT_TRACE_MAX_HITS: number;
+export declare const HEAP_ENUMERATE_MAX_BLOCKS: number;
+export declare const HEAP_SPRAY_THRESHOLD: number;
+export declare const HEAP_SPRAY_SIZE_TOLERANCE: number;
+export declare const HEAP_SUSPICIOUS_BLOCK_SIZE: number;
+export declare const FREEZE_DEFAULT_INTERVAL_MS: number;
+export declare const WRITE_HISTORY_MAX: number;
+export declare const SCAN_MAX_RESULTS_PER_SCAN: number;
+export declare const SCAN_DISPLAY_RESULTS_LIMIT: number;
+export declare const SCAN_UNKNOWN_INITIAL_MAX_ADDRESSES: number;
+export declare const SCAN_POINTER_MAX_RESULTS: number;
+export declare const SCAN_GROUP_MAX_PATTERN_SIZE: number;
+export declare const SCAN_SESSION_MAX_COUNT: number;
+export declare const SCAN_SESSION_TTL_MS: number;
+export declare const POINTER_CHAIN_MAX_DEPTH: number;
+export declare const POINTER_CHAIN_MAX_OFFSET: number;
+export declare const POINTER_CHAIN_MAX_RESULTS: number;
+export declare const POINTER_CHAIN_SCAN_CHUNK_SIZE: number;
+export declare const STRUCT_ANALYZE_DEFAULT_SIZE: number;
+export declare const STRUCT_VTABLE_MAX_FUNCTIONS: number;
+export declare const STRUCT_RTTI_MAX_STRING_LEN: number;
+export declare const STRUCT_CSTRING_MAX_LEN: number;