@jshookmcp/jshook 0.2.2 → 0.2.5

package/README.md

@@ -1,14 +1,14 @@
 # @jshookmcp/jshook
 
 [![License: AGPLv3](https://img.shields.io/badge/License-AGPLv3-red.svg)](LICENSE)
-[![Node.js >= 22](https://img.shields.io/badge/node-%3E%3D20-brightgreen.svg)](https://nodejs.org/)
+[![Node.js >= 20](https://img.shields.io/badge/node-%3E%3D20-brightgreen.svg)](https://nodejs.org/)
 [![TypeScript](https://img.shields.io/badge/TypeScript-5.x-3178C6.svg)](https://www.typescriptlang.org/)
 [![MCP](https://img.shields.io/badge/MCP-current-8A2BE2.svg)](https://modelcontextprotocol.io/)
 [![pnpm](https://img.shields.io/badge/pnpm-10.x-F69220.svg)](https://pnpm.io/)
 
 English | [中文](./README.zh.md)
 
-An MCP (Model Context Protocol) server providing **249 built-in tools** — **242 domain tools across 17 domains** plus **7 built-in meta-tools** — with runtime extension loading from `plugins/` and `workflows/` for AI-assisted JavaScript analysis and security analysis. Combines browser automation, Chrome DevTools Protocol debugging, network monitoring, intelligent JavaScript hooks, LLM-powered code analysis, process/memory inspection, WASM toolchain, binary encoding, anti-anti-debug, GraphQL discovery, source map reconstruction, AST transforms, crypto reconstruction, platform package analysis, Burp Suite / native analysis tool bridges, human behavior simulation, CAPTCHA solving, batch account workflows, and high-level composite workflow orchestration in a single server.
+An MCP (Model Context Protocol) server with a runtime-registry-driven catalog of built-in tools for AI-assisted JavaScript analysis and security analysis. It combines browser automation, Chrome DevTools Protocol debugging, network monitoring, intelligent JavaScript hooks, LLM-powered code analysis, process and memory inspection, WASM tooling, source-map reconstruction, AST transforms, and composite workflows in a single server.
 
 ## Documentation / Quick Links
 
@@ -20,7 +20,7 @@ An MCP (Model Context Protocol) server providing **249 built-in tools** — **24
 ## 🌟 Key Highlights
 
 - 🤖 **AI-Driven Analysis**: Leverage LLMs for intelligent JavaScript deobfuscation, cryptographic algorithm detection, and AST-level code comprehension.
-- ⚡ **Search-First Context Efficiency**: BM25-powered `search_tools` + dynamic boosts cut jshook's tool-schema init delta from ~35.0K tokens (`full`) to ~3.0K (`search`) (Claude server-side count; excludes Claude Code base prompt).
+- ⚡ **Search-First Context Efficiency**: BM25-powered `search_tools` + dynamic boosts cut jshook's tool-schema init delta from ~40.0K+ tokens (`full`) to ~3.0K (`search`) (Claude server-side count; excludes Claude Code base prompt).
 - 🎯 **Progressive Capability Tiers**: Three built-in profiles (`search`/`workflow`/`full`), with `search` as the default base tier for on-demand capability scaling.
 - 🌐 **Full-Stack Automation**: Seamlessly orchestrate Chromium/Camoufox browsers, CDP debugging, and network interception as atomic actions.
 - 🛡️ **Advanced Anti-Debug**: Built-in evasion for debugger statements, timing checks, and strict headless bot fingerprinting techniques.
@@ -42,11 +42,20 @@ Provides a comprehensive suite of tools for AI-assisted JavaScript analysis, bro
 - **Lazy Domain Initialization**: Handler classes instantiated via Proxy on first invocation, not during startup
 - **Domain Self-Discovery**: Runtime manifest scanning (`domains/*/manifest.ts`) replaces hardcoded imports; add new domains by creating a single manifest file
 - **B-Skeleton Contracts**: Extensibility contracts for plugins (`PluginContract`), workflows (`WorkflowContract`), and observability (`InstrumentationContract`)
-- **Context Efficiency Benchmark**: Built-in tool-schema init delta (Claude server-side count, 2026-03-12): `search` ≈ 2,975 tokens vs `full` ≈ 34,985 tokens (12 vs 249 built-in tools; values change as tools/descriptions evolve)
+- **MCP ToolAnnotations**: Every tool carries semantic annotations (`readOnlyHint`, `destructiveHint`, `idempotentHint`, `openWorldHint`) enabling AI orchestrators to reason about tool safety and side-effects before invocation
+- **Context Efficiency Benchmark**: Built-in tool-schema init delta (Claude server-side count): `search` ≈ 3K tokens vs `full` ≈ 40K+ tokens; values change as tools/descriptions evolve
 
-## Tool Domains
+## Registry Snapshot
 
-The server provides **249 built-in tools** across **17 domains** (`antidebug`, `browser`, `coordination`, `core`, `debugger`, `encoding`, `graphql`, `hooks`, `maintenance`, `network`, `platform`, `process`, `sourcemap`, `streaming`, `transform`, `wasm`, and `workflow`).
+The built-in surface below is generated from the runtime registry and checked in CI.
+
+<!-- metadata-sync:start -->
+- Package version: `0.2.5`
+- Built-in domains: `23`
+- Built-in tools: `327`
+- Domains: `antidebug`, `browser`, `coordination`, `core`, `debugger`, `encoding`, `evidence`, `graphql`, `hooks`, `instrumentation`, `macro`, `maintenance`, `memory`, `network`, `platform`, `process`, `sandbox`, `sourcemap`, `streaming`, `trace`, `transform`, `wasm`, `workflow`
+- Note: this snapshot is generated from the runtime registry; do not edit the counts by hand.
+<!-- metadata-sync:end -->
 
 > **[View the complete Tool Reference ↗](https://vmoranv.github.io/jshookmcp/reference/)**
 

package/README.zh.md

@@ -1,14 +1,14 @@
 # @jshookmcp/jshook
 
 [![License: AGPLv3](https://img.shields.io/badge/License-AGPLv3-red.svg)](LICENSE)
-[![Node.js >= 22](https://img.shields.io/badge/node-%3E%3D20-brightgreen.svg)](https://nodejs.org/)
+[![Node.js >= 20](https://img.shields.io/badge/node-%3E%3D20-brightgreen.svg)](https://nodejs.org/)
 [![TypeScript](https://img.shields.io/badge/TypeScript-5.x-3178C6.svg)](https://www.typescriptlang.org/)
 [![MCP](https://img.shields.io/badge/MCP-current-8A2BE2.svg)](https://modelcontextprotocol.io/)
 [![pnpm](https://img.shields.io/badge/pnpm-10.x-F69220.svg)](https://pnpm.io/)
 
 [English](./README.md) | 中文
 
-面向 AI 辅助 JavaScript 分析与安全分析的 MCP（模型上下文协议）服务器，提供 **249 个内置工具**——其中 **17 个域下 242 个域工具**，外加 **7 个内置元工具**——并支持从 `plugins/` 与 `workflows/` 目录运行时动态扩展。集成浏览器自动化、Chrome DevTools Protocol 调试、网络监控、智能 JavaScript Hook、LLM 驱动代码分析、进程/内存操作、WASM 工具链、二进制编码、反反调试、GraphQL 发现、Source Map 重建、AST 变换、加密重构、平台包分析、Burp Suite / Native 分析工具桥接及高层复合工作流编排。
+面向 AI 辅助 JavaScript 分析与安全分析的 MCP（模型上下文协议）服务器，内置工具面来自运行时 registry，而不是手写清单。它将浏览器自动化、Chrome DevTools Protocol 调试、网络监控、JavaScript Hook、LLM 驱动代码分析、进程与内存检查、WASM 工具链、Source Map 重建、AST 变换与复合工作流整合到同一服务中。
 
 ## 文档与快速导航
 
@@ -20,7 +20,7 @@
 ## 🌟 核心亮点
 
 - 🤖 **AI 智能分析**：结合大语言模型实现 JavaScript 语义级反混淆、加密算法识别与深度 AST 结构理解。
-- ⚡ **搜索优先的上下文效率**：BM25 驱动的 `search_tools` 配合动态加权，可将 jshook 内置配置档位中的“工具 schema 增量初始化上下文”从 `full` 档约 ~35.0K tokens 降至 `search` 档约 ~3.0K（Claude 服务端计数；不含 Claude Code 基线提示词）。
+- ⚡ **搜索优先的上下文效率**：BM25 驱动的 `search_tools` 配合动态加权，可将 jshook 内置配置档位中的“工具 schema 增量初始化上下文”从 `full` 档约 ~40.0K+ tokens 降至 `search` 档约 ~3.0K（Claude 服务端计数；不含 Claude Code 基线提示词）。
 - 🎯 **渐进式能力分层**：内置三档配置（`search`/`workflow`/`full`），默认从 `search` 基座档启动，按需升级能力范围。
 - 🌐 **全链路自动化**：将浏览器环境（Chromium/Camoufox）、CDP 底层调试与网络拦截无缝整合为原子操作。
 - 🛡️ **高级反反调试**：内置强大的指纹伪装与检测绕过补丁，轻松应对各类反爬与调试器对抗保护。
@@ -42,7 +42,22 @@
 - **域延迟初始化**：处理器类通过 Proxy 在首次调用时实例化，而非启动时预加载
 - **域自发现架构**：运行时扫描 `domains/*/manifest.ts` 替代硬编码导入；新增域只需创建一个 manifest 文件
 - **B-Skeleton 契约**：插件（`PluginContract`）、工作流（`WorkflowContract`）、可观测性（`InstrumentationContract`）的扩展性契约
-- **上下文效率基准**：基于 Claude 服务端对当前内置工具 schema 的实测计数（2026-03-12），`search` 档 ≈ 2,975 tokens，`full` 档 ≈ 34,985 tokens（当前分别为 12 与 249 个 built-in tools；数值会随工具与描述变更而变化）
+- **MCP ToolAnnotations**：每个工具均带有语义标注（`readOnlyHint`、`destructiveHint`、`idempotentHint`、`openWorldHint`），使 AI 协调器能在调用前推理工具安全性与副作用
+- **上下文效率基准**：基于 Claude 服务端实测，`search` 档 ≈ 3K tokens，`full` 档 ≈ 40K+ tokens；数值会随工具与描述变更而变化
+
+## 注册表快照
+
+下面的内置能力快照由运行时 registry 动态生成，并在 CI 中校验。
+
+<!-- metadata-sync:start -->
+- 包版本：`0.2.5`
+- 内置工具域：`23`
+- 内置工具数：`327`
+- 域列表：`antidebug`, `browser`, `coordination`, `core`, `debugger`, `encoding`, `evidence`, `graphql`, `hooks`, `instrumentation`, `macro`, `maintenance`, `memory`, `network`, `platform`, `process`, `sandbox`, `sourcemap`, `streaming`, `trace`, `transform`, `wasm`, `workflow`
+- 说明：以上数据由运行时 registry 动态生成，不要手改计数。
+<!-- metadata-sync:end -->
+
+> **[查看完整工具参考 ↗](https://vmoranv.github.io/jshookmcp/reference/)**
 
 ## 项目统计
 

package/dist/native/scripts/linux/enum-windows.sh

@@ -1,12 +1,12 @@
-#!/bin/bash
-# enum-windows.sh
-# Linux window enumeration script (placeholder)
-
-TARGET_PID=$1
-
-# Use xdotool or wmctrl for window enumeration
-# This is a placeholder for future implementation
-
-if command -v xdotool &> /dev/null; then
-    xdotool search --pid "$TARGET_PID" --name "" get-window-name
-fi
+#!/bin/bash
+# enum-windows.sh
+# Linux window enumeration script (placeholder)
+
+TARGET_PID=$1
+
+# Use xdotool or wmctrl for window enumeration
+# This is a placeholder for future implementation
+
+if command -v xdotool &> /dev/null; then
+    xdotool search --pid "$TARGET_PID" --name "" get-window-name
+fi

package/dist/native/scripts/macos/enum-windows.applescript

@@ -1,22 +1,22 @@
--- enum-windows.applescript
--- macOS window enumeration script (placeholder)
-
-param TargetPid
-
--- AppleScript implementation for window enumeration
--- This is a placeholder for future implementation
-
-tell application "System Events"
-    set windowList to {}
-    repeat with proc in (every process whose unix id is TargetPid)
-        repeat with win in windows of proc
-            set end of windowList to {¬
-                title: name of win, ¬
-                position: position of win, ¬
-                size: size of win ¬
-            }
-        end repeat
-    end repeat
-end tell
-
-return windowList
+-- enum-windows.applescript
+-- macOS window enumeration script (placeholder)
+
+param TargetPid
+
+-- AppleScript implementation for window enumeration
+-- This is a placeholder for future implementation
+
+tell application "System Events"
+    set windowList to {}
+    repeat with proc in (every process whose unix id is TargetPid)
+        repeat with win in windows of proc
+            set end of windowList to {¬
+                title: name of win, ¬
+                position: position of win, ¬
+                size: size of win ¬
+            }
+        end repeat
+    end repeat
+end tell
+
+return windowList

package/dist/native/scripts/windows/enum-windows-by-class.ps1

@@ -1,51 +1,51 @@
-param(
-    [string]$ClassPattern
-)
-
-Add-Type @"
-  using System;
-  using System.Runtime.InteropServices;
-  public class Win32 {
-    [DllImport("user32.dll")] public static extern IntPtr FindWindowEx(IntPtr parent, IntPtr childAfter, string className, string title);
-    [DllImport("user32.dll")] public static extern int GetWindowThreadProcessId(IntPtr hWnd, out int pid);
-    [DllImport("user32.dll")] public static extern int GetWindowText(IntPtr hWnd, System.Text.StringBuilder text, int count);
-    [DllImport("user32.dll")] public static extern int GetClassName(IntPtr hWnd, System.Text.StringBuilder className, int maxCount);
-  }
-"@
-
-$windows = @()
-$hwnd = [IntPtr]::Zero
-while ($true) {
-  $hwnd = [Win32]::FindWindowEx([IntPtr]::Zero, $hwnd, $null, $null)
-  if ($hwnd -eq [IntPtr]::Zero) { break }
-
-  $className = New-Object System.Text.StringBuilder 256
-  [Win32]::GetClassName($hwnd, $className, 256) | Out-Null
-  $classNameStr = $className.ToString()
-
-  # Support wildcard pattern matching
-  $isMatch = $false
-  if ($ClassPattern -eq $classNameStr) {
-    $isMatch = $true
-  } elseif ($ClassPattern.Contains('*')) {
-    # Convert wildcard pattern to regex
-    $regexPattern = [regex]::Escape($ClassPattern).Replace('\*', '.*')
-    if ($classNameStr -match $regexPattern) {
-      $isMatch = $true
-    }
-  }
-
-  if ($isMatch) {
-    $windowPid = 0
-    [Win32]::GetWindowThreadProcessId($hwnd, [ref]$windowPid) | Out-Null
-    $title = New-Object System.Text.StringBuilder 256
-    [Win32]::GetWindowText($hwnd, $title, 256) | Out-Null
-    $windows += @{
-      Handle = $hwnd.ToString()
-      Title = $title.ToString()
-      ClassName = $classNameStr
-      ProcessId = $windowPid
-    }
-  }
-}
-$windows | ConvertTo-Json -Compress
+param(
+    [string]$ClassPattern
+)
+
+Add-Type @"
+  using System;
+  using System.Runtime.InteropServices;
+  public class Win32 {
+    [DllImport("user32.dll")] public static extern IntPtr FindWindowEx(IntPtr parent, IntPtr childAfter, string className, string title);
+    [DllImport("user32.dll")] public static extern int GetWindowThreadProcessId(IntPtr hWnd, out int pid);
+    [DllImport("user32.dll")] public static extern int GetWindowText(IntPtr hWnd, System.Text.StringBuilder text, int count);
+    [DllImport("user32.dll")] public static extern int GetClassName(IntPtr hWnd, System.Text.StringBuilder className, int maxCount);
+  }
+"@
+
+$windows = @()
+$hwnd = [IntPtr]::Zero
+while ($true) {
+  $hwnd = [Win32]::FindWindowEx([IntPtr]::Zero, $hwnd, $null, $null)
+  if ($hwnd -eq [IntPtr]::Zero) { break }
+
+  $className = New-Object System.Text.StringBuilder 256
+  [Win32]::GetClassName($hwnd, $className, 256) | Out-Null
+  $classNameStr = $className.ToString()
+
+  # Support wildcard pattern matching
+  $isMatch = $false
+  if ($ClassPattern -eq $classNameStr) {
+    $isMatch = $true
+  } elseif ($ClassPattern.Contains('*')) {
+    # Convert wildcard pattern to regex
+    $regexPattern = [regex]::Escape($ClassPattern).Replace('\*', '.*')
+    if ($classNameStr -match $regexPattern) {
+      $isMatch = $true
+    }
+  }
+
+  if ($isMatch) {
+    $windowPid = 0
+    [Win32]::GetWindowThreadProcessId($hwnd, [ref]$windowPid) | Out-Null
+    $title = New-Object System.Text.StringBuilder 256
+    [Win32]::GetWindowText($hwnd, $title, 256) | Out-Null
+    $windows += @{
+      Handle = $hwnd.ToString()
+      Title = $title.ToString()
+      ClassName = $classNameStr
+      ProcessId = $windowPid
+    }
+  }
+}
+$windows | ConvertTo-Json -Compress

package/dist/native/scripts/windows/enum-windows.ps1

@@ -1,44 +1,44 @@
-param(
-    [int]$TargetPid
-)
-
-Add-Type @"
-  using System;
-  using System.Runtime.InteropServices;
-  public class Win32 {
-    [DllImport("user32.dll")] public static extern IntPtr FindWindowEx(IntPtr parent, IntPtr childAfter, string className, string title);
-    [DllImport("user32.dll")] public static extern int GetWindowThreadProcessId(IntPtr hWnd, out int pid);
-    [DllImport("user32.dll")] public static extern int GetWindowText(IntPtr hWnd, System.Text.StringBuilder text, int count);
-    [DllImport("user32.dll")] public static extern int GetClassName(IntPtr hWnd, System.Text.StringBuilder className, int maxCount);
-    [DllImport("user32.dll")] public static extern bool GetWindowRect(IntPtr hWnd, out RECT rect);
-    [StructLayout(LayoutKind.Sequential)] public struct RECT { public int Left, Top, Right, Bottom; }
-  }
-"@
-
-$windows = @()
-$hwnd = [IntPtr]::Zero
-while ($true) {
-  $hwnd = [Win32]::FindWindowEx([IntPtr]::Zero, $hwnd, $null, $null)
-  if ($hwnd -eq [IntPtr]::Zero) { break }
-  $windowPid = 0
-  [Win32]::GetWindowThreadProcessId($hwnd, [ref]$windowPid) | Out-Null
-  if ($windowPid -eq $TargetPid) {
-    $title = New-Object System.Text.StringBuilder 256
-    $className = New-Object System.Text.StringBuilder 256
-    [Win32]::GetWindowText($hwnd, $title, 256) | Out-Null
-    [Win32]::GetClassName($hwnd, $className, 256) | Out-Null
-    $rect = New-Object Win32+RECT
-    [Win32]::GetWindowRect($hwnd, [ref]$rect) | Out-Null
-    $windows += @{
-      Handle = $hwnd.ToString()
-      Title = $title.ToString()
-      ClassName = $className.ToString()
-      ProcessId = $windowPid
-      Left = $rect.Left
-      Top = $rect.Top
-      Right = $rect.Right
-      Bottom = $rect.Bottom
-    }
-  }
-}
-$windows | ConvertTo-Json -Compress
+param(
+    [int]$TargetPid
+)
+
+Add-Type @"
+  using System;
+  using System.Runtime.InteropServices;
+  public class Win32 {
+    [DllImport("user32.dll")] public static extern IntPtr FindWindowEx(IntPtr parent, IntPtr childAfter, string className, string title);
+    [DllImport("user32.dll")] public static extern int GetWindowThreadProcessId(IntPtr hWnd, out int pid);
+    [DllImport("user32.dll")] public static extern int GetWindowText(IntPtr hWnd, System.Text.StringBuilder text, int count);
+    [DllImport("user32.dll")] public static extern int GetClassName(IntPtr hWnd, System.Text.StringBuilder className, int maxCount);
+    [DllImport("user32.dll")] public static extern bool GetWindowRect(IntPtr hWnd, out RECT rect);
+    [StructLayout(LayoutKind.Sequential)] public struct RECT { public int Left, Top, Right, Bottom; }
+  }
+"@
+
+$windows = @()
+$hwnd = [IntPtr]::Zero
+while ($true) {
+  $hwnd = [Win32]::FindWindowEx([IntPtr]::Zero, $hwnd, $null, $null)
+  if ($hwnd -eq [IntPtr]::Zero) { break }
+  $windowPid = 0
+  [Win32]::GetWindowThreadProcessId($hwnd, [ref]$windowPid) | Out-Null
+  if ($windowPid -eq $TargetPid) {
+    $title = New-Object System.Text.StringBuilder 256
+    $className = New-Object System.Text.StringBuilder 256
+    [Win32]::GetWindowText($hwnd, $title, 256) | Out-Null
+    [Win32]::GetClassName($hwnd, $className, 256) | Out-Null
+    $rect = New-Object Win32+RECT
+    [Win32]::GetWindowRect($hwnd, [ref]$rect) | Out-Null
+    $windows += @{
+      Handle = $hwnd.ToString()
+      Title = $title.ToString()
+      ClassName = $className.ToString()
+      ProcessId = $windowPid
+      Left = $rect.Left
+      Top = $rect.Top
+      Right = $rect.Right
+      Bottom = $rect.Bottom
+    }
+  }
+}
+$windows | ConvertTo-Json -Compress

package/dist/native/scripts/windows/inject-dll.ps1

@@ -1,21 +1,21 @@
-param(
-    [int]$TargetPid,
-    [string]$DllPath
-)
-
-Add-Type @"
-  using System;
-  using System.Runtime.InteropServices;
-  public class Injector {
-    [DllImport("kernel32.dll")] public static extern IntPtr OpenProcess(int access, bool inherit, int pid);
-    [DllImport("kernel32.dll")] public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr addr, int size, int alloc, int protect);
-    [DllImport("kernel32.dll")] public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr addr, byte[] buffer, int size, out int written);
-    [DllImport("kernel32.dll")] public static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr attr, int stack, IntPtr start, IntPtr param, int flags, out int threadId);
-    [DllImport("kernel32.dll")] public static extern IntPtr GetModuleHandle(string name);
-    [DllImport("kernel32.dll")] public static extern IntPtr GetProcAddress(IntPtr hModule, string name);
-    [DllImport("kernel32.dll")] public static extern bool CloseHandle(IntPtr handle);
-  }
-"@
-
-# Injection requires elevated privileges and is disabled for safety
-Write-Output "DLL injection is disabled for safety in this implementation. PID: $TargetPid, DLL: $DllPath"
+param(
+    [int]$TargetPid,
+    [string]$DllPath
+)
+
+Add-Type @"
+  using System;
+  using System.Runtime.InteropServices;
+  public class Injector {
+    [DllImport("kernel32.dll")] public static extern IntPtr OpenProcess(int access, bool inherit, int pid);
+    [DllImport("kernel32.dll")] public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr addr, int size, int alloc, int protect);
+    [DllImport("kernel32.dll")] public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr addr, byte[] buffer, int size, out int written);
+    [DllImport("kernel32.dll")] public static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr attr, int stack, IntPtr start, IntPtr param, int flags, out int threadId);
+    [DllImport("kernel32.dll")] public static extern IntPtr GetModuleHandle(string name);
+    [DllImport("kernel32.dll")] public static extern IntPtr GetProcAddress(IntPtr hModule, string name);
+    [DllImport("kernel32.dll")] public static extern bool CloseHandle(IntPtr handle);
+  }
+"@
+
+# Injection requires elevated privileges and is disabled for safety
+Write-Output "DLL injection is disabled for safety in this implementation. PID: $TargetPid, DLL: $DllPath"

package/dist/packages/extension-sdk/src/bridges/shared.js

@@ -52,7 +52,7 @@ export async function checkExternalCommand(command, versionArgs, label, installH
         const { stdout, stderr } = await execFileAsync(command, versionArgs, {
             timeout: 10_000,
         });
-        const version = (stdout || stderr).trim().split('\n')[0] ?? '';
+        const version = (stdout || stderr).trim().split('\n')[0];
         return toTextResponse({
             success: true,
             tool: label,
@@ -179,7 +179,7 @@ export async function requestJson(url, method = 'GET', bodyObj, timeoutMs = 15_0
             Accept: 'application/json',
             ...(body ? { 'Content-Type': 'application/json' } : {}),
         },
-        body,
+        ...(body === undefined ? {} : { body }),
         signal: AbortSignal.timeout(timeoutMs),
     });
     const text = await response.text();

package/dist/packages/extension-sdk/src/plugin.d.ts

@@ -1,4 +1,5 @@
 import type { CallToolResult } from '@modelcontextprotocol/sdk/types.js';
+import type { WorkflowContract } from './workflow.js';
 export type ToolProfileId = 'search' | 'workflow' | 'full';
 export type ToolArgs = Record<string, unknown>;
 export type ToolResponse = CallToolResult;
@@ -23,6 +24,7 @@ export interface ExtensionToolDefinition {
     handler: ExtensionToolHandler;
     profiles?: ToolProfileId[];
 }
+export type ExtensionWorkflowDefinition = WorkflowContract;
 export declare const jsonResponse: (payload: Record<string, unknown>) => ToolResponse;
 export declare const errorResponse: (tool: string, error: unknown, extra?: Record<string, unknown>) => ToolResponse;
 export declare class ExtensionBuilder {
@@ -35,6 +37,7 @@ export declare class ExtensionBuilder {
     private _compatibleCore;
     private _profiles;
     private _tools;
+    private _workflows;
     private _allowCommands;
     private _allowHosts;
     private _allowTools;
@@ -54,6 +57,7 @@ export declare class ExtensionBuilder {
     get compatibleCoreRange(): string;
     get profiles(): ToolProfileId[];
     get tools(): ExtensionToolDefinition[];
+    get workflows(): ExtensionWorkflowDefinition[];
     get allowedCommands(): string[];
     get allowedHosts(): string[];
     get allowedTools(): string[];
@@ -87,6 +91,7 @@ export declare class ExtensionBuilder {
     metric(m: string | string[]): this;
     configDefault(key: string, value: unknown): this;
     tool(name: string, desc: string, schema: Record<string, unknown>, handler: ExtensionToolHandler, profiles?: ToolProfileId[]): this;
+    workflow(workflow: ExtensionWorkflowDefinition | ExtensionWorkflowDefinition[]): this;
     onLoad(h: (ctx: PluginLifecycleContext) => Promise<void> | void): this;
     onValidate(h: (ctx: PluginLifecycleContext) => Promise<{
         valid: boolean;

package/dist/packages/extension-sdk/src/plugin.js

@@ -1,4 +1,4 @@
-import { toTextResponse, toErrorResponse, } from './bridges/shared.js';
+import { toTextResponse, toErrorResponse } from './bridges/shared.js';
 export const jsonResponse = toTextResponse;
 export const errorResponse = toErrorResponse;
 export class ExtensionBuilder {
@@ -11,6 +11,7 @@ export class ExtensionBuilder {
     _compatibleCore = '>=0.1.0';
     _profiles = ['full'];
     _tools = [];
+    _workflows = [];
     _allowCommands = [];
     _allowHosts = [];
     _allowTools = [];
@@ -24,29 +25,83 @@ export class ExtensionBuilder {
         this._id = id;
         this._version = version;
     }
-    get id() { return this._id; }
-    get version() { return this._version; }
-    get pluginName() { return this._name; }
-    get pluginDescription() { return this._description; }
-    get pluginAuthor() { return this._author; }
-    get pluginSourceRepo() { return this._sourceRepo; }
-    get compatibleCoreRange() { return this._compatibleCore; }
-    get profiles() { return this._profiles; }
-    get tools() { return this._tools; }
-    get allowedCommands() { return this._allowCommands; }
-    get allowedHosts() { return this._allowHosts; }
-    get allowedTools() { return this._allowTools; }
-    get declaredMetrics() { return this._metrics; }
-    get configDefaults() { return this._configDefaults; }
-    get onLoadHandler() { return this._onLoadHandler; }
-    get onValidateHandler() { return this._onValidateHandler; }
-    get onActivateHandler() { return this._onActivateHandler; }
-    get onDeactivateHandler() { return this._onDeactivateHandler; }
-    name(n) { this._name = n; return this; }
-    description(desc) { this._description = desc; return this; }
-    author(a) { this._author = a; return this; }
-    sourceRepo(url) { this._sourceRepo = url; return this; }
-    compatibleCore(range) { this._compatibleCore = range; return this; }
+    get id() {
+        return this._id;
+    }
+    get version() {
+        return this._version;
+    }
+    get pluginName() {
+        return this._name;
+    }
+    get pluginDescription() {
+        return this._description;
+    }
+    get pluginAuthor() {
+        return this._author;
+    }
+    get pluginSourceRepo() {
+        return this._sourceRepo;
+    }
+    get compatibleCoreRange() {
+        return this._compatibleCore;
+    }
+    get profiles() {
+        return this._profiles;
+    }
+    get tools() {
+        return this._tools;
+    }
+    get workflows() {
+        return this._workflows;
+    }
+    get allowedCommands() {
+        return this._allowCommands;
+    }
+    get allowedHosts() {
+        return this._allowHosts;
+    }
+    get allowedTools() {
+        return this._allowTools;
+    }
+    get declaredMetrics() {
+        return this._metrics;
+    }
+    get configDefaults() {
+        return this._configDefaults;
+    }
+    get onLoadHandler() {
+        return this._onLoadHandler;
+    }
+    get onValidateHandler() {
+        return this._onValidateHandler;
+    }
+    get onActivateHandler() {
+        return this._onActivateHandler;
+    }
+    get onDeactivateHandler() {
+        return this._onDeactivateHandler;
+    }
+    name(n) {
+        this._name = n;
+        return this;
+    }
+    description(desc) {
+        this._description = desc;
+        return this;
+    }
+    author(a) {
+        this._author = a;
+        return this;
+    }
+    sourceRepo(url) {
+        this._sourceRepo = url;
+        return this;
+    }
+    compatibleCore(range) {
+        this._compatibleCore = range;
+        return this;
+    }
     mergeMetadata(meta) {
         if (!this._name && meta.name)
             this._name = meta.name;
@@ -62,11 +117,26 @@ export class ExtensionBuilder {
         this._profiles = Array.isArray(p) ? p : [p];
         return this;
     }
-    allowCommand(cmd) { this._allowCommands.push(...(Array.isArray(cmd) ? cmd : [cmd])); return this; }
-    allowHost(host) { this._allowHosts.push(...(Array.isArray(host) ? host : [host])); return this; }
-    allowTool(tool) { this._allowTools.push(...(Array.isArray(tool) ? tool : [tool])); return this; }
-    metric(m) { this._metrics.push(...(Array.isArray(m) ? m : [m])); return this; }
-    configDefault(key, value) { this._configDefaults[key] = value; return this; }
+    allowCommand(cmd) {
+        this._allowCommands.push(...(Array.isArray(cmd) ? cmd : [cmd]));
+        return this;
+    }
+    allowHost(host) {
+        this._allowHosts.push(...(Array.isArray(host) ? host : [host]));
+        return this;
+    }
+    allowTool(tool) {
+        this._allowTools.push(...(Array.isArray(tool) ? tool : [tool]));
+        return this;
+    }
+    metric(m) {
+        this._metrics.push(...(Array.isArray(m) ? m : [m]));
+        return this;
+    }
+    configDefault(key, value) {
+        this._configDefaults[key] = value;
+        return this;
+    }
     tool(name, desc, schema, handler, profiles) {
         this._tools.push({
             name,
@@ -77,10 +147,26 @@ export class ExtensionBuilder {
         });
         return this;
     }
-    onLoad(h) { this._onLoadHandler = h; return this; }
-    onValidate(h) { this._onValidateHandler = h; return this; }
-    onActivate(h) { this._onActivateHandler = h; return this; }
-    onDeactivate(h) { this._onDeactivateHandler = h; return this; }
+    workflow(workflow) {
+        this._workflows.push(...(Array.isArray(workflow) ? workflow : [workflow]));
+        return this;
+    }
+    onLoad(h) {
+        this._onLoadHandler = h;
+        return this;
+    }
+    onValidate(h) {
+        this._onValidateHandler = h;
+        return this;
+    }
+    onActivate(h) {
+        this._onActivateHandler = h;
+        return this;
+    }
+    onDeactivate(h) {
+        this._onDeactivateHandler = h;
+        return this;
+    }
 }
 export function createExtension(id, version) {
     return new ExtensionBuilder(id, version);