@jshookmcp/jshook 0.2.2 → 0.2.5

package/dist/src/server/domains/workflow/handlers.impl.workflow-base.js

@@ -1,10 +1,84 @@
 import { logger } from '../../../utils/logger.js';
 import { WORKFLOW_BUNDLE_CACHE_TTL_MS, WORKFLOW_BUNDLE_CACHE_MAX_BYTES } from '../../../constants.js';
 import { mkdir, writeFile, realpath } from 'node:fs/promises';
-import { dirname, basename, resolve, relative, isAbsolute } from 'node:path';
+import { dirname, basename, resolve, relative, isAbsolute, posix as pathPosix } from 'node:path';
 import { getProjectRoot } from '../../../utils/outputPaths.js';
+import { ensureWorkflowsLoaded } from '../../extensions/ExtensionManager.js';
 import { executeExtensionWorkflow } from '../../workflows/WorkflowEngine.js';
 import { argNumber, argObject } from '../../domains/shared/parse-args.js';
+const BUILTIN_SCRIPT_ENTRIES = [
+    {
+        name: 'auth_extract',
+        description: 'Extract auth tokens from localStorage and cookies',
+        code: `(function(){
+  var keys=['token','active_token','access_token','jwt','auth_token','userRole','id_token','refresh_token'];
+  var r={};
+  for(var i=0;i<keys.length;i++){var v=localStorage.getItem(keys[i]);if(v)r[keys[i]]=v;}
+  r._cookies=document.cookie;
+  return r;
+})()`,
+    },
+    {
+        name: 'bundle_search',
+        description: 'Fetch a remote JS bundle and search it with regex patterns. params: { url: string, patterns: string[] }',
+        code: `(async function(){
+  var p=typeof __params__!=='undefined'?__params__:{};
+  if(!p.url)return{error:'params.url required'};
+  var resp=await fetch(p.url);
+  var text=await resp.text();
+  var patterns=p.patterns||[];
+  var results={};
+  for(var i=0;i<patterns.length;i++){
+    var re=new RegExp(patterns[i],'g');
+    var matches=[];var m;
+    while((m=re.exec(text))!==null){
+      var s=Math.max(0,m.index-80),e=Math.min(text.length,m.index+m[0].length+80);
+      matches.push({match:m[0],ctx:text.slice(s,e)});
+      if(matches.length>=10)break;
+    }
+    results[patterns[i]]=matches;
+  }
+  return{size:text.length,results:results};
+})()`,
+    },
+    {
+        name: 'react_fill_form',
+        description: 'Fill React controlled form inputs using native setter trick. params: { fields: { "selector": "value" } }',
+        code: `(function(){
+  var p=typeof __params__!=='undefined'?__params__:{};
+  var fields=p.fields||{};
+  var ns=Object.getOwnPropertyDescriptor(window.HTMLInputElement.prototype,'value').set;
+  var r={};
+  var entries=Object.entries(fields);
+  for(var i=0;i<entries.length;i++){
+    var sel=entries[i][0],val=entries[i][1];
+    var el=document.querySelector(sel);
+    if(!el){r[sel]='not found';continue;}
+    ns.call(el,val);
+    el.dispatchEvent(new Event('input',{bubbles:true}));
+    el.dispatchEvent(new Event('change',{bubbles:true}));
+    r[sel]='filled';
+  }
+  return r;
+})()`,
+    },
+    {
+        name: 'dom_find_upgrade_buttons',
+        description: 'Scan the current page for upgrade/subscription/tier-related UI elements',
+        code: `(function(){
+  var kw=['upgrade','plus','pro','premium','subscribe','plan','tier','vip','membership'];
+  var r=[];
+  document.querySelectorAll('button,a,[role=button],[class*=upgrade],[class*=premium],[class*=plus]').forEach(function(el){
+    var t=(el.textContent||'').toLowerCase().trim();
+    var c=(el.className||'').toLowerCase();
+    if(kw.some(function(k){return t.includes(k)||c.includes(k);})){
+      r.push({tag:el.tagName,text:t.slice(0,120),cls:c.slice(0,100),href:el.href||null,id:el.id||null});
+    }
+  });
+  return r;
+})()`,
+    },
+];
 export class WorkflowHandlersBase {
     deps;
     scriptRegistry = new Map();
@@ -47,13 +121,13 @@ export class WorkflowHandlersBase {
         const normalizedRequested = requested.replace(/\\/g, '/');
         if (normalizedRequested.startsWith('/') ||
             /^[A-Za-z]:/.test(normalizedRequested) ||
-            normalizedRequested.split('/').includes('..')) {
+            pathPosix.normalize(normalizedRequested).split('/').includes('..')) {
             return defaultPath;
         }
         if (!normalizedRequested.includes('/')) {
-            return `${preferredDir}/${normalizedRequested}`;
+            return pathPosix.join(preferredDir, normalizedRequested);
         }
-        return normalizedRequested;
+        return pathPosix.normalize(normalizedRequested);
     }
     escapeInlineScriptLiteral(value) {
         return value.replace(/[<>/\u2028\u2029]/g, (char) => {
@@ -94,7 +168,7 @@ export class WorkflowHandlersBase {
                 }
                 const nextParent = dirname(existingParent);
                 if (nextParent === existingParent) {
-                    throw new Error(`Unable to validate output path: ${filePath}`);
+                    throw new Error(`Unable to validate output path: ${filePath}`, { cause: error });
                 }
                 pendingSegments.unshift(basename(existingParent));
                 existingParent = nextParent;
@@ -161,73 +235,14 @@ export class WorkflowHandlersBase {
         return lines.join('\n');
     }
     initBuiltinScripts() {
-        this.scriptRegistry.set('auth_extract', {
-            description: 'Extract auth tokens from localStorage and cookies',
-            code: `(function(){
-  var keys=['token','active_token','access_token','jwt','auth_token','userRole','id_token','refresh_token'];
-  var r={};
-  for(var i=0;i<keys.length;i++){var v=localStorage.getItem(keys[i]);if(v)r[keys[i]]=v;}
-  r._cookies=document.cookie;
-  return r;
-})()`,
-        });
-        this.scriptRegistry.set('bundle_search', {
-            description: 'Fetch a remote JS bundle and search it with regex patterns. params: { url: string, patterns: string[] }',
-            code: `(async function(){
-  var p=typeof __params__!=='undefined'?__params__:{};
-  if(!p.url)return{error:'params.url required'};
-  var resp=await fetch(p.url);
-  var text=await resp.text();
-  var patterns=p.patterns||[];
-  var results={};
-  for(var i=0;i<patterns.length;i++){
-    var re=new RegExp(patterns[i],'g');
-    var matches=[];var m;
-    while((m=re.exec(text))!==null){
-      var s=Math.max(0,m.index-80),e=Math.min(text.length,m.index+m[0].length+80);
-      matches.push({match:m[0],ctx:text.slice(s,e)});
-      if(matches.length>=10)break;
-    }
-    results[patterns[i]]=matches;
-  }
-  return{size:text.length,results:results};
-})()`,
-        });
-        this.scriptRegistry.set('react_fill_form', {
-            description: 'Fill React controlled form inputs using native setter trick. params: { fields: { "selector": "value" } }',
-            code: `(function(){
-  var p=typeof __params__!=='undefined'?__params__:{};
-  var fields=p.fields||{};
-  var ns=Object.getOwnPropertyDescriptor(window.HTMLInputElement.prototype,'value').set;
-  var r={};
-  var entries=Object.entries(fields);
-  for(var i=0;i<entries.length;i++){
-    var sel=entries[i][0],val=entries[i][1];
-    var el=document.querySelector(sel);
-    if(!el){r[sel]='not found';continue;}
-    ns.call(el,val);
-    el.dispatchEvent(new Event('input',{bubbles:true}));
-    el.dispatchEvent(new Event('change',{bubbles:true}));
-    r[sel]='filled';
-  }
-  return r;
-})()`,
-        });
-        this.scriptRegistry.set('dom_find_upgrade_buttons', {
-            description: 'Scan the current page for upgrade/subscription/tier-related UI elements',
-            code: `(function(){
-  var kw=['upgrade','plus','pro','premium','subscribe','plan','tier','vip','membership'];
-  var r=[];
-  document.querySelectorAll('button,a,[role=button],[class*=upgrade],[class*=premium],[class*=plus]').forEach(function(el){
-    var t=(el.textContent||'').toLowerCase().trim();
-    var c=(el.className||'').toLowerCase();
-    if(kw.some(function(k){return t.includes(k)||c.includes(k);})){
-      r.push({tag:el.tagName,text:t.slice(0,120),cls:c.slice(0,100),href:el.href||null,id:el.id||null});
-    }
-  });
-  return r;
-})()`,
-        });
+        for (const entry of BUILTIN_SCRIPT_ENTRIES) {
+            this.scriptRegistry.set(entry.name, {
+                code: entry.code,
+                description: entry.description,
+                source: 'core',
+                protectedFromEviction: true,
+            });
+        }
     }
     getOptionalString(value) {
         return typeof value === 'string' ? value : undefined;
@@ -257,19 +272,20 @@ export class WorkflowHandlersBase {
         }
         const isUpdate = this.scriptRegistry.has(name);
         if (!isUpdate && this.scriptRegistry.size >= WorkflowHandlersBase.MAX_SCRIPTS) {
-            for (const k of this.scriptRegistry.keys()) {
-                if (![
-                    'auth_extract',
-                    'bundle_search',
-                    'react_fill_form',
-                    'dom_find_upgrade_buttons',
-                ].includes(k)) {
-                    this.scriptRegistry.delete(k);
+            for (const [scriptName, entry] of this.scriptRegistry) {
+                if (!entry.protectedFromEviction) {
+                    this.scriptRegistry.delete(scriptName);
                     break;
                 }
             }
         }
-        this.scriptRegistry.set(name, { code, description });
+        const existingEntry = this.scriptRegistry.get(name);
+        this.scriptRegistry.set(name, {
+            code,
+            description,
+            source: existingEntry?.source ?? 'user',
+            protectedFromEviction: existingEntry?.protectedFromEviction ?? false,
+        });
         return this.jsonTextResult({
             success: true,
             action: isUpdate ? 'updated' : 'registered',
@@ -320,9 +336,10 @@ export class WorkflowHandlersBase {
                 error: 'Extension workflow runtime is unavailable in this handler context',
             });
         }
-        const workflows = [...ctx.extensionWorkflowsById.values()]
-            .sort((a, b) => a.id.localeCompare(b.id))
-            .map((record) => ({
+        await ensureWorkflowsLoaded(ctx);
+        const workflows = [...ctx.extensionWorkflowsById.values()].filter((record) => record.route?.kind !== 'preset');
+        workflows.sort((a, b) => a.id.localeCompare(b.id));
+        const serializedWorkflows = workflows.map((record) => ({
             id: record.id,
             displayName: record.displayName,
             description: record.description,
@@ -330,11 +347,20 @@ export class WorkflowHandlersBase {
             timeoutMs: record.timeoutMs,
             defaultMaxConcurrency: record.defaultMaxConcurrency,
             source: record.source,
+            route: record.route
+                ? {
+                    kind: record.route.kind,
+                    priority: record.route.priority,
+                    requiredDomains: record.route.requiredDomains,
+                    triggerPatterns: record.route.triggerPatterns.map((pattern) => pattern.source),
+                    steps: record.route.steps,
+                }
+                : undefined,
         }));
         return this.jsonTextResult({
             success: true,
-            count: workflows.length,
-            workflows,
+            count: serializedWorkflows.length,
+            workflows: serializedWorkflows,
         });
     }
     async handleRunExtensionWorkflow(args) {
@@ -352,12 +378,25 @@ export class WorkflowHandlersBase {
                 error: 'workflowId is required',
             });
         }
+        await ensureWorkflowsLoaded(ctx);
         const runtimeRecord = ctx.extensionWorkflowRuntimeById.get(workflowId);
         if (!runtimeRecord) {
+            const available = [...ctx.extensionWorkflowsById.values()]
+                .filter((record) => record.route?.kind !== 'preset')
+                .map((record) => record.id);
+            available.sort((a, b) => a.localeCompare(b));
             return this.jsonTextResult({
                 success: false,
                 error: `Extension workflow "${workflowId}" not found`,
-                available: [...ctx.extensionWorkflowsById.keys()].sort((a, b) => a.localeCompare(b)),
+                available,
+            });
+        }
+        if (runtimeRecord.route?.kind === 'preset') {
+            return this.jsonTextResult({
+                success: false,
+                workflowId,
+                error: `Extension workflow "${workflowId}" is a routing preset and cannot be executed directly. ` +
+                    'Use route_tool or the suggested preset steps instead.',
             });
         }
         const profile = this.getOptionalString(args.profile);

package/dist/src/server/domains/workflow/handlers.impl.workflow-batch.js

@@ -4,6 +4,11 @@ import { WORKFLOW_BATCH_MAX_RETRIES, WORKFLOW_BATCH_MAX_BACKOFF_MS, WORKFLOW_BAT
 import { argNumber, argString, argObject, argStringArray } from '../../domains/shared/parse-args.js';
 const BATCH_MAX_ACCOUNTS = WORKFLOW_BATCH_MAX_ACCOUNTS;
 const BATCH_MAX_CONCURRENCY = WORKFLOW_BATCH_MAX_CONCURRENCY;
+function maskKey(key) {
+    if (key.length <= 6)
+        return key.charAt(0) + '***' + key.charAt(key.length - 1);
+    return key.slice(0, 2) + '***' + key.slice(-2);
+}
 const MAX_RETRIES = WORKFLOW_BATCH_MAX_RETRIES;
 const MAX_BACKOFF_MS = WORKFLOW_BATCH_MAX_BACKOFF_MS;
 const MAX_TIMEOUT_MS = WORKFLOW_BATCH_MAX_TIMEOUT_MS;
@@ -38,11 +43,6 @@ export class WorkflowHandlersBatch extends WorkflowHandlersAccountBundle {
                 Object.values(fields)[0] ??
                 `account-${globalIdx}`);
         };
-        const maskKey = (key) => {
-            if (key.length <= 6)
-                return key.charAt(0) + '***' + key.charAt(key.length - 1);
-            return key.slice(0, 2) + '***' + key.slice(-2);
-        };
         for (let i = 0; i < accounts.length; i += maxConcurrency) {
             const chunk = accounts.slice(i, i + maxConcurrency);
             const chunkPromises = chunk.map(async (acct, chunkIdx) => {

package/dist/src/server/evidence/ReverseEvidenceGraph.d.ts

@@ -0,0 +1,20 @@
+import type { EvidenceNode, EvidenceNodeType, EvidenceEdge, EvidenceEdgeType, EvidenceGraphSnapshot } from './types.js';
+export declare function _resetIdCounter(): void;
+export declare class ReverseEvidenceGraph {
+    private readonly nodes;
+    private readonly edges;
+    addNode(type: EvidenceNodeType, label: string, metadata?: Record<string, unknown>): EvidenceNode;
+    addEdge(sourceId: string, targetId: string, type: EvidenceEdgeType, metadata?: Record<string, unknown>): EvidenceEdge;
+    getNode(id: string): EvidenceNode | undefined;
+    removeNode(id: string): boolean;
+    getEdgesFrom(nodeId: string): EvidenceEdge[];
+    getEdgesTo(nodeId: string): EvidenceEdge[];
+    get nodeCount(): number;
+    get edgeCount(): number;
+    getEvidenceChain(nodeId: string, direction?: 'forward' | 'backward'): EvidenceNode[];
+    queryByUrl(url: string): EvidenceNode[];
+    queryByFunction(name: string): EvidenceNode[];
+    queryByScriptId(scriptId: string): EvidenceNode[];
+    exportJson(): EvidenceGraphSnapshot;
+    exportMarkdown(): string;
+}

package/dist/src/server/evidence/ReverseEvidenceGraph.js

@@ -0,0 +1,208 @@
+let nextId = 1;
+function generateId(prefix) {
+    return `${prefix}-${nextId++}`;
+}
+export function _resetIdCounter() {
+    nextId = 1;
+}
+export class ReverseEvidenceGraph {
+    nodes = new Map();
+    edges = new Map();
+    addNode(type, label, metadata = {}) {
+        const node = {
+            id: generateId(type),
+            type,
+            label,
+            metadata,
+            createdAt: Date.now(),
+        };
+        this.nodes.set(node.id, node);
+        return node;
+    }
+    addEdge(sourceId, targetId, type, metadata) {
+        if (!this.nodes.has(sourceId))
+            throw new Error(`Source node "${sourceId}" not found`);
+        if (!this.nodes.has(targetId))
+            throw new Error(`Target node "${targetId}" not found`);
+        const edge = {
+            id: generateId('edge'),
+            source: sourceId,
+            target: targetId,
+            type,
+            metadata,
+        };
+        this.edges.set(edge.id, edge);
+        return edge;
+    }
+    getNode(id) {
+        return this.nodes.get(id);
+    }
+    removeNode(id) {
+        if (!this.nodes.has(id))
+            return false;
+        this.nodes.delete(id);
+        for (const [edgeId, edge] of this.edges) {
+            if (edge.source === id || edge.target === id) {
+                this.edges.delete(edgeId);
+            }
+        }
+        return true;
+    }
+    getEdgesFrom(nodeId) {
+        return [...this.edges.values()].filter((e) => e.source === nodeId);
+    }
+    getEdgesTo(nodeId) {
+        return [...this.edges.values()].filter((e) => e.target === nodeId);
+    }
+    get nodeCount() {
+        return this.nodes.size;
+    }
+    get edgeCount() {
+        return this.edges.size;
+    }
+    getEvidenceChain(nodeId, direction = 'forward') {
+        const start = this.nodes.get(nodeId);
+        if (!start)
+            return [];
+        const visited = new Set();
+        const queue = [nodeId];
+        const result = [];
+        while (queue.length > 0) {
+            const current = queue.shift();
+            if (visited.has(current))
+                continue;
+            visited.add(current);
+            const node = this.nodes.get(current);
+            if (node)
+                result.push(node);
+            const connectedEdges = direction === 'forward' ? this.getEdgesFrom(current) : this.getEdgesTo(current);
+            for (const edge of connectedEdges) {
+                const nextNodeId = direction === 'forward' ? edge.target : edge.source;
+                if (!visited.has(nextNodeId)) {
+                    queue.push(nextNodeId);
+                }
+            }
+        }
+        return result;
+    }
+    queryByUrl(url) {
+        const matchingNodes = [...this.nodes.values()].filter((n) => {
+            if (n.type === 'request' && typeof n.metadata.url === 'string') {
+                return n.metadata.url.includes(url);
+            }
+            if (typeof n.metadata.url === 'string') {
+                return n.metadata.url.includes(url);
+            }
+            return false;
+        });
+        const allNodes = new Set();
+        for (const node of matchingNodes) {
+            for (const n of this.getEvidenceChain(node.id, 'forward')) {
+                allNodes.add(n.id);
+            }
+            for (const n of this.getEvidenceChain(node.id, 'backward')) {
+                allNodes.add(n.id);
+            }
+        }
+        return [...allNodes].map((id) => this.nodes.get(id)).filter(Boolean);
+    }
+    queryByFunction(name) {
+        const matchingNodes = [...this.nodes.values()].filter((n) => {
+            if (n.type === 'function' && typeof n.metadata.functionName === 'string') {
+                return n.metadata.functionName.includes(name);
+            }
+            if (n.label.includes(name) && (n.type === 'function' || n.type === 'breakpoint-hook')) {
+                return true;
+            }
+            return false;
+        });
+        const allNodes = new Set();
+        for (const node of matchingNodes) {
+            for (const n of this.getEvidenceChain(node.id, 'forward')) {
+                allNodes.add(n.id);
+            }
+            for (const n of this.getEvidenceChain(node.id, 'backward')) {
+                allNodes.add(n.id);
+            }
+        }
+        return [...allNodes].map((id) => this.nodes.get(id)).filter(Boolean);
+    }
+    queryByScriptId(scriptId) {
+        const matchingNodes = [...this.nodes.values()].filter((n) => {
+            if (n.type === 'script' && n.metadata.scriptId === scriptId)
+                return true;
+            return false;
+        });
+        const allNodes = new Set();
+        for (const node of matchingNodes) {
+            for (const n of this.getEvidenceChain(node.id, 'forward')) {
+                allNodes.add(n.id);
+            }
+            for (const n of this.getEvidenceChain(node.id, 'backward')) {
+                allNodes.add(n.id);
+            }
+        }
+        return [...allNodes].map((id) => this.nodes.get(id)).filter(Boolean);
+    }
+    exportJson() {
+        return {
+            version: 1,
+            nodes: [...this.nodes.values()],
+            edges: [...this.edges.values()],
+            exportedAt: new Date().toISOString(),
+        };
+    }
+    exportMarkdown() {
+        const lines = [];
+        lines.push('# Reverse Evidence Graph Report');
+        lines.push('');
+        lines.push(`**Exported:** ${new Date().toISOString()}`);
+        lines.push(`**Nodes:** ${this.nodes.size} | **Edges:** ${this.edges.size}`);
+        lines.push('');
+        const byType = new Map();
+        for (const node of this.nodes.values()) {
+            const list = byType.get(node.type) ?? [];
+            list.push(node);
+            byType.set(node.type, list);
+        }
+        const typeOrder = [
+            'request',
+            'initiator-stack',
+            'script',
+            'function',
+            'breakpoint-hook',
+            'captured-data',
+            'replay-artifact',
+        ];
+        for (const type of typeOrder) {
+            const nodes = byType.get(type);
+            if (!nodes || nodes.length === 0)
+                continue;
+            lines.push(`## ${type} (${nodes.length})`);
+            lines.push('');
+            for (const node of nodes) {
+                lines.push(`### ${node.label}`);
+                lines.push(`- **ID:** \`${node.id}\``);
+                lines.push(`- **Created:** ${new Date(node.createdAt).toISOString()}`);
+                const metaKeys = Object.keys(node.metadata);
+                if (metaKeys.length > 0) {
+                    for (const key of metaKeys) {
+                        const val = node.metadata[key];
+                        const display = typeof val === 'string' ? val : JSON.stringify(val);
+                        lines.push(`- **${key}:** ${display}`);
+                    }
+                }
+                const outEdges = this.getEdgesFrom(node.id);
+                const inEdges = this.getEdgesTo(node.id);
+                if (outEdges.length > 0) {
+                    lines.push(`- **→ Out:** ${outEdges.map((e) => `${e.type} → \`${e.target}\``).join(', ')}`);
+                }
+                if (inEdges.length > 0) {
+                    lines.push(`- **← In:** ${inEdges.map((e) => `\`${e.source}\` ${e.type} →`).join(', ')}`);
+                }
+                lines.push('');
+            }
+        }
+        return lines.join('\n');
+    }
+}

package/dist/src/server/evidence/index.d.ts

@@ -0,0 +1,2 @@
+export { ReverseEvidenceGraph, _resetIdCounter } from './ReverseEvidenceGraph.js';
+export type { EvidenceNode, EvidenceNodeType, EvidenceEdge, EvidenceEdgeType, EvidenceGraphSnapshot, } from './types.js';

package/dist/src/server/evidence/index.js

@@ -0,0 +1 @@
+export { ReverseEvidenceGraph, _resetIdCounter } from './ReverseEvidenceGraph.js';

package/dist/src/server/evidence/types.d.ts

@@ -0,0 +1,22 @@
+export type EvidenceNodeType = 'request' | 'initiator-stack' | 'script' | 'function' | 'breakpoint-hook' | 'captured-data' | 'replay-artifact';
+export type EvidenceEdgeType = 'initiates' | 'contains' | 'triggers' | 'captures' | 'replays' | 'loads' | 'references';
+export interface EvidenceNode {
+    readonly id: string;
+    readonly type: EvidenceNodeType;
+    label: string;
+    metadata: Record<string, unknown>;
+    readonly createdAt: number;
+}
+export interface EvidenceEdge {
+    readonly id: string;
+    readonly source: string;
+    readonly target: string;
+    readonly type: EvidenceEdgeType;
+    metadata?: Record<string, unknown>;
+}
+export interface EvidenceGraphSnapshot {
+    version: 1;
+    nodes: EvidenceNode[];
+    edges: EvidenceEdge[];
+    exportedAt: string;
+}

package/dist/src/server/evidence/types.js

@@ -0,0 +1 @@
+export {};

package/dist/src/server/extensions/ExtensionManager.d.ts

@@ -2,3 +2,4 @@ import type { MCPServerContext } from '../MCPServer.context.js';
 import type { ExtensionListResult, ExtensionReloadResult } from '../extensions/types.js';
 export declare function listExtensions(ctx: MCPServerContext): ExtensionListResult;
 export declare function reloadExtensions(ctx: MCPServerContext): Promise<ExtensionReloadResult>;
+export declare function ensureWorkflowsLoaded(ctx: MCPServerContext): Promise<void>;