@jshookmcp/jshook 0.2.3 → 0.2.5

package/dist/src/server/domains/transform/handlers.impl.transform-base.js

@@ -1,6 +1,11 @@
 import { ScriptManager } from '../../domains/shared/modules.js';
 import { WorkerPool } from '../../../utils/WorkerPool.js';
 import { TRANSFORM_WORKER_TIMEOUT_MS, TRANSFORM_CRYPTO_POOL_MAX_WORKERS, TRANSFORM_CRYPTO_POOL_IDLE_TIMEOUT_MS, TRANSFORM_CRYPTO_POOL_MAX_OLD_GEN_MB, TRANSFORM_CRYPTO_POOL_MAX_YOUNG_GEN_MB, } from '../../../constants.js';
+function extractLastSegment(value) {
+    const normalized = value.startsWith('window.') ? value.slice(7) : value;
+    const parts = normalized.split('.').filter(Boolean);
+    return parts.length > 0 ? parts[parts.length - 1] : '';
+}
 const SUPPORTED_TRANSFORMS = [
     'constant_fold',
     'string_decrypt',
@@ -31,98 +36,98 @@ export const CRYPTO_KEYWORDS = [
     'aes',
     'rsa',
 ];
-const CRYPTO_TEST_WORKER_SCRIPT = `
-const __bootstrap = async () => {
-  const [workerThreads, vm, perfHooks] = await Promise.all([
-    import('node:worker_threads'),
-    import('node:vm'),
-    import('node:perf_hooks'),
-  ]);
-
-  const parentPort = workerThreads.parentPort;
-  const performance = perfHooks.performance;
-
-  if (!parentPort) {
-    throw new Error('worker parentPort is unavailable');
-  }
-
-  function normalizeOutput(value) {
-    if (value === undefined) return '__undefined__';
-    if (value === null) return 'null';
-    if (typeof value === 'string') return value;
-    if (typeof value === 'number' || typeof value === 'boolean' || typeof value === 'bigint') return String(value);
-    try { return JSON.stringify(value); } catch { return String(value); }
-  }
-
-  parentPort.on('message', async (msg) => {
-    const { jobId, payload } = msg;
-    try {
-      const { code, functionName, testInputs } = payload;
-      const sandbox = {
-        console: { log() {}, warn() {}, error() {} },
-        Buffer,
-        TextEncoder,
-        TextDecoder,
-        atob: (v) => Buffer.from(String(v), 'base64').toString('binary'),
-        btoa: (v) => Buffer.from(String(v), 'binary').toString('base64'),
-      };
-      sandbox.globalThis = sandbox;
-      const context = vm.createContext(sandbox);
-
-      const isValidIdentifier = /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(functionName);
-      const bindCode = isValidIdentifier
-        ? "\\n;globalThis.__targetFn = (typeof " + functionName + " !== 'undefined' ? " + functionName + " : globalThis[" + JSON.stringify(functionName) + "]);"
-        : "\\n;globalThis.__targetFn = globalThis[" + JSON.stringify(functionName) + "];";
-
-      const script = new vm.Script(code + bindCode, { timeout: 5000 });
-      script.runInContext(context, { timeout: 5000 });
-
-      const targetFn = context.__targetFn;
-      if (typeof targetFn !== 'function') {
-        throw new Error("Function not found or not callable: " + functionName);
-      }
-
-      const rows = [];
-      for (const input of testInputs) {
-        const started = performance.now();
-        try {
-          const raw = targetFn(input);
-          const resolved = raw && typeof raw.then === 'function' ? await raw : raw;
-          rows.push({
-            input,
-            output: normalizeOutput(resolved),
-            duration: Number((performance.now() - started).toFixed(3)),
-          });
-        } catch (err) {
-          rows.push({
-            input,
-            output: '',
-            error: err && err.message ? err.message : String(err),
-            duration: Number((performance.now() - started).toFixed(3)),
-          });
-        }
-      }
-
-      parentPort.postMessage({ jobId, ok: true, result: { ok: true, results: rows } });
-    } catch (error) {
-      parentPort.postMessage({
-        jobId,
-        ok: true,
-        result: {
-          ok: false,
-          error: error && error.message ? error.message : String(error),
-          results: [],
-        },
-      });
-    }
-  });
-};
-
-__bootstrap().catch((error) => {
-  if (typeof console !== 'undefined' && typeof console.error === 'function') {
-    console.error('crypto harness worker bootstrap failed:', error && error.message ? error.message : String(error));
-  }
-});
+const CRYPTO_TEST_WORKER_SCRIPT = `
+const __bootstrap = async () => {
+  const [workerThreads, vm, perfHooks] = await Promise.all([
+    import('node:worker_threads'),
+    import('node:vm'),
+    import('node:perf_hooks'),
+  ]);
+
+  const parentPort = workerThreads.parentPort;
+  const performance = perfHooks.performance;
+
+  if (!parentPort) {
+    throw new Error('worker parentPort is unavailable');
+  }
+
+  function normalizeOutput(value) {
+    if (value === undefined) return '__undefined__';
+    if (value === null) return 'null';
+    if (typeof value === 'string') return value;
+    if (typeof value === 'number' || typeof value === 'boolean' || typeof value === 'bigint') return String(value);
+    try { return JSON.stringify(value); } catch { return String(value); }
+  }
+
+  parentPort.on('message', async (msg) => {
+    const { jobId, payload } = msg;
+    try {
+      const { code, functionName, testInputs } = payload;
+      const sandbox = {
+        console: { log() {}, warn() {}, error() {} },
+        Buffer,
+        TextEncoder,
+        TextDecoder,
+        atob: (v) => Buffer.from(String(v), 'base64').toString('binary'),
+        btoa: (v) => Buffer.from(String(v), 'binary').toString('base64'),
+      };
+      sandbox.globalThis = sandbox;
+      const context = vm.createContext(sandbox);
+
+      const isValidIdentifier = /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(functionName);
+      const bindCode = isValidIdentifier
+        ? "\\n;globalThis.__targetFn = (typeof " + functionName + " !== 'undefined' ? " + functionName + " : globalThis[" + JSON.stringify(functionName) + "]);"
+        : "\\n;globalThis.__targetFn = globalThis[" + JSON.stringify(functionName) + "];";
+
+      const script = new vm.Script(code + bindCode, { timeout: 5000 });
+      script.runInContext(context, { timeout: 5000 });
+
+      const targetFn = context.__targetFn;
+      if (typeof targetFn !== 'function') {
+        throw new Error("Function not found or not callable: " + functionName);
+      }
+
+      const rows = [];
+      for (const input of testInputs) {
+        const started = performance.now();
+        try {
+          const raw = targetFn(input);
+          const resolved = raw && typeof raw.then === 'function' ? await raw : raw;
+          rows.push({
+            input,
+            output: normalizeOutput(resolved),
+            duration: Number((performance.now() - started).toFixed(3)),
+          });
+        } catch (err) {
+          rows.push({
+            input,
+            output: '',
+            error: err && err.message ? err.message : String(err),
+            duration: Number((performance.now() - started).toFixed(3)),
+          });
+        }
+      }
+
+      parentPort.postMessage({ jobId, ok: true, result: { ok: true, results: rows } });
+    } catch (error) {
+      parentPort.postMessage({
+        jobId,
+        ok: true,
+        result: {
+          ok: false,
+          error: error && error.message ? error.message : String(error),
+          results: [],
+        },
+      });
+    }
+  });
+};
+
+__bootstrap().catch((error) => {
+  if (typeof console !== 'undefined' && typeof console.error === 'function') {
+    console.error('crypto harness worker bootstrap failed:', error && error.message ? error.message : String(error));
+  }
+});
 `;
 export class TransformToolHandlersBase {
     collector;
@@ -279,7 +284,7 @@ export class TransformToolHandlersBase {
                 }
             }
             for (const script of scripts) {
-                if (script.id === id || (script.dataset?.scriptId === id)) {
+                if (script.id === id || script.dataset?.scriptId === id) {
                     if (script.textContent && script.textContent.trim().length > 0) {
                         return script.textContent;
                     }
@@ -313,11 +318,6 @@ export class TransformToolHandlersBase {
         throw new Error(`Unable to resolve source from scriptId: ${scriptId}`);
     }
     resolveFunctionName(targetFunction, targetPath, source) {
-        const extractLastSegment = (value) => {
-            const normalized = value.startsWith('window.') ? value.slice(7) : value;
-            const parts = normalized.split('.').filter(Boolean);
-            return parts.length > 0 ? parts[parts.length - 1] : '';
-        };
         const candidateFromTarget = extractLastSegment(targetFunction);
         if (this.isValidIdentifier(candidateFromTarget)) {
             return candidateFromTarget;
@@ -336,16 +336,16 @@ export class TransformToolHandlersBase {
         return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(value);
     }
     buildCryptoPolyfills() {
-        return `
-const __textEncoder = typeof TextEncoder !== 'undefined' ? new TextEncoder() : null;
-const __textDecoder = typeof TextDecoder !== 'undefined' ? new TextDecoder() : null;
-
-if (typeof globalThis.atob === 'undefined') {
-  globalThis.atob = (value) => Buffer.from(String(value), 'base64').toString('binary');
-}
-if (typeof globalThis.btoa === 'undefined') {
-  globalThis.btoa = (value) => Buffer.from(String(value), 'binary').toString('base64');
-}
+        return `
+const __textEncoder = typeof TextEncoder !== 'undefined' ? new TextEncoder() : null;
+const __textDecoder = typeof TextDecoder !== 'undefined' ? new TextDecoder() : null;
+
+if (typeof globalThis.atob === 'undefined') {
+  globalThis.atob = (value) => Buffer.from(String(value), 'base64').toString('binary');
+}
+if (typeof globalThis.btoa === 'undefined') {
+  globalThis.btoa = (value) => Buffer.from(String(value), 'binary').toString('base64');
+}
 `.trim();
     }
     async runCryptoHarness(code, functionName, testInputs) {

package/dist/src/server/domains/transform/handlers.impl.transform-crypto.js

@@ -11,24 +11,6 @@ export class TransformToolHandlersCrypto extends TransformToolHandlersOps {
                 const keywordList = Array.isArray(keywords) ? keywords : [];
                 const lowerKeywords = keywordList.map((item) => String(item).toLowerCase());
                 const globalObj = window;
-                const resolvePath = (path) => {
-                    const normalized = path.startsWith('window.') ? path.slice(7) : path;
-                    const parts = normalized.split('.').filter(Boolean);
-                    let cursor = window;
-                    for (const part of parts) {
-                        if (cursor === null ||
-                            cursor === undefined ||
-                            (typeof cursor !== 'object' && typeof cursor !== 'function')) {
-                            return undefined;
-                        }
-                        const carrier = cursor;
-                        if (!(part in carrier)) {
-                            return undefined;
-                        }
-                        cursor = carrier[part];
-                    }
-                    return cursor;
-                };
                 const scoreFunction = (path, source) => {
                     const text = (path + '\\n' + source).toLowerCase();
                     let score = 0;
@@ -56,7 +38,24 @@ export class TransformToolHandlersCrypto extends TransformToolHandlersOps {
                     });
                 };
                 if (target.length > 0) {
-                    const resolved = resolvePath(target);
+                    const resolved = (() => {
+                        const normalized = target.startsWith('window.') ? target.slice(7) : target;
+                        const parts = normalized.split('.').filter(Boolean);
+                        let cursor = window;
+                        for (const part of parts) {
+                            if (cursor === null ||
+                                cursor === undefined ||
+                                (typeof cursor !== 'object' && typeof cursor !== 'function')) {
+                                return undefined;
+                            }
+                            const carrier = cursor;
+                            if (!(part in carrier)) {
+                                return undefined;
+                            }
+                            cursor = carrier[part];
+                        }
+                        return cursor;
+                    })();
                     pushCandidate(target, resolved, 100);
                 }
                 const globalKeys = Object.getOwnPropertyNames(globalObj).slice(0, 800);

package/dist/src/server/domains/transform/manifest.d.ts

@@ -7,7 +7,7 @@ declare const manifest: {
     version: 1;
     domain: "transform";
     depKey: "transformHandlers";
-    profiles: "full"[];
+    profiles: ("workflow" | "full")[];
     ensure: typeof ensure;
     registrations: {
         tool: {

package/dist/src/server/domains/transform/manifest.js

@@ -20,7 +20,7 @@ const manifest = {
     version: 1,
     domain: DOMAIN,
     depKey: DEP_KEY,
-    profiles: ['full'],
+    profiles: ['workflow', 'full'],
     ensure,
     registrations: [
         {

package/dist/src/server/domains/wasm/definitions.js

@@ -1,234 +1,57 @@
+import { tool } from '../../registry/tool-builder.js';
 export const wasmTools = [
-    {
-        name: 'wasm_dump',
-        description: 'Dump a WebAssembly module from the current browser page.\n\nExtracts the WASM binary via the webassembly-full hook preset, saves it to disk, and returns module metadata (hash, size, imports, exports).\n\nPrerequisites: A page with WASM must be loaded. The webassembly-full hook preset will be auto-injected if not already active.',
-        inputSchema: {
-            type: 'object',
-            properties: {
-                moduleIndex: {
-                    type: 'number',
-                    description: 'Index of the WASM module to dump if multiple were loaded (default: 0 = first)',
-                    default: 0,
-                },
-                outputPath: {
-                    type: 'string',
-                    description: 'Custom output file path. If omitted, auto-generates in artifacts/wasm/',
-                },
-            },
-        },
-        annotations: {
-            readOnlyHint: false,
-            destructiveHint: false,
-            idempotentHint: false,
-            openWorldHint: false,
-        },
-    },
-    {
-        name: 'wasm_disassemble',
-        description: 'Disassemble a .wasm file to WebAssembly Text Format (WAT) using wasm2wat.\n\nRequires: wabt toolchain installed (wasm2wat in PATH).\n\nUSE THIS to read WASM bytecode as human-readable text. The output shows all functions, imports, exports, and instructions.',
-        inputSchema: {
-            type: 'object',
-            properties: {
-                inputPath: {
-                    type: 'string',
-                    description: 'Path to the .wasm file to disassemble',
-                },
-                outputPath: {
-                    type: 'string',
-                    description: 'Output .wat file path. If omitted, auto-generates in artifacts/wasm/',
-                },
-                foldExprs: {
-                    type: 'boolean',
-                    description: 'Fold expressions for more compact output (default: true)',
-                    default: true,
-                },
-            },
-            required: ['inputPath'],
-        },
-        annotations: {
-            readOnlyHint: false,
-            destructiveHint: false,
-            idempotentHint: false,
-            openWorldHint: false,
-        },
-    },
-    {
-        name: 'wasm_decompile',
-        description: 'Decompile a .wasm file to C-like pseudo-code using wasm-decompile.\n\nRequires: wabt toolchain installed (wasm-decompile in PATH).\n\nProduces more readable output than WAT, resembling C/JavaScript syntax. Useful for understanding VMP handler logic.',
-        inputSchema: {
-            type: 'object',
-            properties: {
-                inputPath: {
-                    type: 'string',
-                    description: 'Path to the .wasm file to decompile',
-                },
-                outputPath: {
-                    type: 'string',
-                    description: 'Output file path. If omitted, auto-generates in artifacts/wasm/',
-                },
-            },
-            required: ['inputPath'],
-        },
-        annotations: {
-            readOnlyHint: false,
-            destructiveHint: false,
-            idempotentHint: false,
-            openWorldHint: false,
-        },
-    },
-    {
-        name: 'wasm_inspect_sections',
-        description: 'Inspect sections and metadata of a .wasm file using wasm-objdump.\n\nRequires: wabt toolchain installed (wasm-objdump in PATH).\n\nReturns section headers, import/export tables, function signatures, and memory layout.',
-        inputSchema: {
-            type: 'object',
-            properties: {
-                inputPath: {
-                    type: 'string',
-                    description: 'Path to the .wasm file to inspect',
-                },
-                sections: {
-                    type: 'string',
-                    enum: ['headers', 'details', 'disassemble', 'all'],
-                    description: 'What to dump: headers (section overview), details (full metadata), disassemble (bytecode), all. Default: details',
-                    default: 'details',
-                },
-            },
-            required: ['inputPath'],
-        },
-        annotations: {
-            readOnlyHint: false,
-            destructiveHint: false,
-            idempotentHint: false,
-            openWorldHint: false,
-        },
-    },
-    {
-        name: 'wasm_offline_run',
-        description: 'Execute a specific exported function from a .wasm file offline using wasmtime or wasmer.\n\nRequires: wasmtime or wasmer installed in PATH.\n\nUSE THIS to run sign/encrypt functions extracted from WASM VMP without a browser. Provide the function name and arguments.\n\nSecurity: Runs in a sandboxed WASM runtime with no filesystem or network access.',
-        inputSchema: {
-            type: 'object',
-            properties: {
-                inputPath: {
-                    type: 'string',
-                    description: 'Path to the .wasm file',
-                },
-                functionName: {
-                    type: 'string',
-                    description: 'Name of the exported function to invoke (e.g., "_sign", "encrypt")',
-                },
-                args: {
-                    type: 'array',
-                    items: { type: 'string' },
-                    description: 'Arguments to pass to the function (will be parsed as integers/floats)',
-                },
-                runtime: {
-                    type: 'string',
-                    enum: ['wasmtime', 'wasmer', 'auto'],
-                    description: 'WASM runtime to use. "auto" tries wasmtime first, then wasmer. Default: auto',
-                    default: 'auto',
-                },
-                timeoutMs: {
-                    type: 'number',
-                    description: 'Execution timeout in ms (default: 10000)',
-                    default: 10000,
-                },
-            },
-            required: ['inputPath', 'functionName'],
-        },
-        annotations: {
-            readOnlyHint: false,
-            destructiveHint: false,
-            idempotentHint: false,
-            openWorldHint: false,
-        },
-    },
-    {
-        name: 'wasm_optimize',
-        description: 'Optimize a .wasm file using binaryen wasm-opt.\n\nRequires: binaryen toolchain installed (wasm-opt in PATH).\n\nApplies optimization passes (dead code elimination, constant folding, etc.) to reduce size and improve performance. Optimized output can be re-injected into the browser.',
-        inputSchema: {
-            type: 'object',
-            properties: {
-                inputPath: {
-                    type: 'string',
-                    description: 'Path to the .wasm file to optimize',
-                },
-                outputPath: {
-                    type: 'string',
-                    description: 'Output optimized .wasm file path. If omitted, auto-generates in artifacts/wasm/',
-                },
-                level: {
-                    type: 'string',
-                    enum: ['O1', 'O2', 'O3', 'O4', 'Os', 'Oz'],
-                    description: 'Optimization level (default: O2)',
-                    default: 'O2',
-                },
-            },
-            required: ['inputPath'],
-        },
-        annotations: {
-            readOnlyHint: false,
-            destructiveHint: false,
-            idempotentHint: false,
-            openWorldHint: false,
-        },
-    },
-    {
-        name: 'wasm_vmp_trace',
-        description: 'Trace WASM VMP (Virtual Machine Protection) opcode execution.\n\nCombines the webassembly-full hook preset with enhanced import call tracing to reconstruct VMP handler tables and execution flows.\n\nUSE THIS when a page uses WASM-based VMP to protect sign/encrypt functions. Returns:\n- Import call sequence (opcode trace)\n- Identified handler patterns\n- Input→output data flow',
-        inputSchema: {
-            type: 'object',
-            properties: {
-                maxEvents: {
-                    type: 'number',
-                    description: 'Maximum import call events to capture (default: 5000)',
-                    default: 5000,
-                },
-                filterModule: {
-                    type: 'string',
-                    description: 'Only trace calls to this import module name (e.g., "env", "wasi_snapshot_preview1")',
-                },
-            },
-        },
-        annotations: {
-            readOnlyHint: false,
-            destructiveHint: false,
-            idempotentHint: false,
-            openWorldHint: false,
-        },
-    },
-    {
-        name: 'wasm_memory_inspect',
-        description: 'Inspect WebAssembly.Memory contents from the browser.\n\nReads the linear memory buffer of the active WASM module, displaying it as hex dump, ASCII, or searching for patterns.\n\nUSE THIS to:\n- Examine WASM memory layout (stack, heap, data segments)\n- Find strings, keys, or encoded data in WASM memory\n- Track how input data is transformed through WASM functions',
-        inputSchema: {
-            type: 'object',
-            properties: {
-                offset: {
-                    type: 'number',
-                    description: 'Starting byte offset to read from (default: 0)',
-                    default: 0,
-                },
-                length: {
-                    type: 'number',
-                    description: 'Number of bytes to read (default: 256, max: 65536)',
-                    default: 256,
-                },
-                format: {
-                    type: 'string',
-                    enum: ['hex', 'ascii', 'both'],
-                    description: 'Output format (default: both)',
-                    default: 'both',
-                },
-                searchPattern: {
-                    type: 'string',
-                    description: 'Search for this hex pattern or ASCII string in the memory range',
-                },
-            },
-        },
-        annotations: {
-            readOnlyHint: false,
-            destructiveHint: false,
-            idempotentHint: false,
-            openWorldHint: false,
-        },
-    },
+    tool('wasm_dump')
+        .desc('Dump a WebAssembly module from the current browser page.\n\nExtracts the WASM binary via the webassembly-full hook preset, saves it to disk, and returns module metadata (hash, size, imports, exports).\n\nPrerequisites: A page with WASM must be loaded. The webassembly-full hook preset will be auto-injected if not already active.')
+        .number('moduleIndex', 'Index of the WASM module to dump if multiple were loaded', {
+        default: 0,
+    })
+        .string('outputPath', 'Custom output file path. If omitted, auto-generates in artifacts/wasm/')
+        .build(),
+    tool('wasm_disassemble')
+        .desc('Disassemble a .wasm file to WebAssembly Text Format (WAT) using wasm2wat.\n\nRequires: wabt toolchain installed (wasm2wat in PATH).\n\nUSE THIS to read WASM bytecode as human-readable text. The output shows all functions, imports, exports, and instructions.')
+        .string('inputPath', 'Path to the .wasm file to disassemble')
+        .string('outputPath', 'Output .wat file path. If omitted, auto-generates in artifacts/wasm/')
+        .boolean('foldExprs', 'Fold expressions for more compact output', { default: true })
+        .required('inputPath')
+        .build(),
+    tool('wasm_decompile')
+        .desc('Decompile a .wasm file to C-like pseudo-code using wasm-decompile.\n\nRequires: wabt toolchain installed (wasm-decompile in PATH).\n\nProduces more readable output than WAT, resembling C/JavaScript syntax. Useful for understanding VMP handler logic.')
+        .string('inputPath', 'Path to the .wasm file to decompile')
+        .string('outputPath', 'Output file path. If omitted, auto-generates in artifacts/wasm/')
+        .required('inputPath')
+        .build(),
+    tool('wasm_inspect_sections')
+        .desc('Inspect sections and metadata of a .wasm file using wasm-objdump.\n\nRequires: wabt toolchain installed (wasm-objdump in PATH).\n\nReturns section headers, import/export tables, function signatures, and memory layout.')
+        .string('inputPath', 'Path to the .wasm file to inspect')
+        .enum('sections', ['headers', 'details', 'disassemble', 'all'], 'What to dump: headers (section overview), details (full metadata), disassemble (bytecode), all', { default: 'details' })
+        .required('inputPath')
+        .build(),
+    tool('wasm_offline_run')
+        .desc('Execute a specific exported function from a .wasm file offline using wasmtime or wasmer.\n\nRequires: wasmtime or wasmer installed in PATH.\n\nUSE THIS to run sign/encrypt functions extracted from WASM VMP without a browser. Provide the function name and arguments.\n\nSecurity: Runs in a sandboxed WASM runtime with no filesystem or network access.')
+        .string('inputPath', 'Path to the .wasm file')
+        .string('functionName', 'Name of the exported function to invoke (e.g., "_sign", "encrypt")')
+        .array('args', { type: 'string' }, 'Arguments to pass to the function (will be parsed as integers/floats)')
+        .enum('runtime', ['wasmtime', 'wasmer', 'auto'], 'WASM runtime to use. "auto" tries wasmtime first, then wasmer', { default: 'auto' })
+        .number('timeoutMs', 'Execution timeout in ms', { default: 10000 })
+        .required('inputPath', 'functionName')
+        .build(),
+    tool('wasm_optimize')
+        .desc('Optimize a .wasm file using binaryen wasm-opt.\n\nRequires: binaryen toolchain installed (wasm-opt in PATH).\n\nApplies optimization passes (dead code elimination, constant folding, etc.) to reduce size and improve performance. Optimized output can be re-injected into the browser.')
+        .string('inputPath', 'Path to the .wasm file to optimize')
+        .string('outputPath', 'Output optimized .wasm file path. If omitted, auto-generates in artifacts/wasm/')
+        .enum('level', ['O1', 'O2', 'O3', 'O4', 'Os', 'Oz'], 'Optimization level', { default: 'O2' })
+        .required('inputPath')
+        .build(),
+    tool('wasm_vmp_trace')
+        .desc('Trace WASM VMP (Virtual Machine Protection) opcode execution.\n\nCombines the webassembly-full hook preset with enhanced import call tracing to reconstruct VMP handler tables and execution flows.\n\nUSE THIS when a page uses WASM-based VMP to protect sign/encrypt functions. Returns:\n- Import call sequence (opcode trace)\n- Identified handler patterns\n- Input→output data flow')
+        .number('maxEvents', 'Maximum import call events to capture', { default: 5000 })
+        .string('filterModule', 'Only trace calls to this import module name (e.g., "env", "wasi_snapshot_preview1")')
+        .build(),
+    tool('wasm_memory_inspect')
+        .desc('Inspect WebAssembly.Memory contents from the browser.\n\nReads the linear memory buffer of the active WASM module, displaying it as hex dump, ASCII, or searching for patterns.\n\nUSE THIS to:\n- Examine WASM memory layout (stack, heap, data segments)\n- Find strings, keys, or encoded data in WASM memory\n- Track how input data is transformed through WASM functions')
+        .number('offset', 'Starting byte offset to read from', { default: 0 })
+        .number('length', 'Number of bytes to read', { default: 256 })
+        .enum('format', ['hex', 'ascii', 'both'], 'Output format', { default: 'both' })
+        .string('searchPattern', 'Search for this hex pattern or ASCII string in the memory range')
+        .build(),
 ];

package/dist/src/server/domains/wasm/handlers.js

@@ -411,7 +411,7 @@ export class WasmToolHandlers {
                 fnCounts[key] = (fnCounts[key] || 0) + 1;
             }
             const sorted = Object.entries(fnCounts)
-                .sort((a, b) => b[1] - a[1])
+                .toSorted((a, b) => b[1] - a[1])
                 .slice(0, 30)
                 .map(([name, count]) => ({ name, count }));
             return {