@jshookmcp/jshook 0.2.3 → 0.2.6

package/workflows/electron-bridge-mapper/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "noEmit": false,
+    "outDir": "dist",
+    "rootDir": ".",
+    "strict": true,
+    "skipLibCheck": true,
+    "types": ["node"]
+  },
+  "include": ["workflow.ts"],
+  "exclude": ["dist", "node_modules"]
+}

package/workflows/electron-bridge-mapper/workflow.ts

@@ -0,0 +1,125 @@
+import {
+  createWorkflow,
+  type WorkflowExecutionContext,
+  SequenceNodeBuilder,
+} from '@jshookmcp/extension-sdk/workflow';
+
+const workflowId = 'workflow.electron-bridge-mapper.v1';
+
+export default createWorkflow(workflowId, 'Electron Bridge Mapper')
+  .description(
+    'Maps Electron/NW.js application internals: inspects app structure, checks Electron fuses, sniffs IPC channels, scans preload scripts for bridge APIs, extracts ASAR contents, and identifies exposed Node.js APIs — producing a bridge surface map for exploit analysis.',
+  )
+  .tags(['reverse', 'electron', 'bridge', 'ipc', 'preload', 'asar', 'nwjs', 'mission'])
+  .timeoutMs(10 * 60_000)
+  .defaultMaxConcurrency(3)
+  .buildGraph((ctx: WorkflowExecutionContext) => {
+    const prefix = 'workflows.electronBridgeMapper';
+    const targetPath = String(ctx.getConfig(`${prefix}.targetPath`, ''));
+    const maxConcurrency = Number(ctx.getConfig(`${prefix}.parallel.maxConcurrency`, 3));
+    const sniffDuration = Number(ctx.getConfig(`${prefix}.sniffDurationMs`, 5000));
+    const extractAsar = Boolean(ctx.getConfig(`${prefix}.extractAsar`, true));
+
+    const root = new SequenceNodeBuilder('electron-bridge-mapper-root');
+
+    // Phase 1: Electron App Inspection
+    root
+      .tool('inspect-app', 'electron_inspect_app', { input: {} })
+      .tool('check-fuses', 'electron_check_fuses', { input: {} })
+
+      // Phase 2: Launch with Debug & Attach
+      .tool('launch-debug', 'electron_launch_debug', {
+        input: { path: targetPath },
+      })
+      .tool('debug-status', 'electron_debug_status', { input: {} })
+
+      // Phase 3: Parallel IPC & Bridge Analysis
+      .parallel('analyse-bridges', (p) => {
+        p.maxConcurrency(maxConcurrency)
+          .failFast(false)
+          .tool('sniff-ipc', 'electron_ipc_sniff', {
+            input: { duration: sniffDuration },
+          })
+          .tool('scan-userdata', 'electron_scan_userdata', { input: {} })
+          .tool('search-preload', 'search_in_scripts', {
+            input: {
+              query: 'contextBridge,exposeInMainWorld,ipcRenderer,ipcMain,remote,nodeIntegration,preload,require',
+              matchType: 'any',
+            },
+          });
+      })
+
+      // Phase 4: Bridge Surface Probe
+      .tool('probe-bridge', 'page_evaluate', {
+        input: {
+          expression: `(function() {
+            const bridge = {};
+            bridge.hasElectron = typeof process !== 'undefined' && !!process.versions?.electron;
+            bridge.electronVersion = process?.versions?.electron || null;
+            bridge.nodeVersion = process?.versions?.node || null;
+            bridge.hasRequire = typeof require !== 'undefined';
+            bridge.contextIsolation = null;
+            bridge.nodeIntegration = typeof process !== 'undefined' && typeof require !== 'undefined';
+            bridge.exposedAPIs = {};
+            try {
+              if (typeof window !== 'undefined') {
+                for (const key of Object.keys(window)) {
+                  const val = window[key];
+                  if (val && typeof val === 'object' && key.startsWith('__') || key.includes('api') || key.includes('bridge') || key.includes('electron')) {
+                    bridge.exposedAPIs[key] = Object.keys(val).slice(0, 20);
+                  }
+                }
+              }
+            } catch(e) {}
+            return bridge;
+          })()`,
+        },
+      });
+
+    // Phase 5: ASAR Extraction (Optional)
+    if (extractAsar) {
+      root
+        .tool('search-asar', 'asar_search', { input: {} })
+        .tool('extract-asar', 'asar_extract', { input: {} });
+    }
+
+    // Phase 6: Evidence Recording
+    root
+      .tool('create-evidence-session', 'instrumentation_session_create', {
+        input: {
+          name: `electron-bridge-${new Date().toISOString().slice(0, 10)}`,
+          metadata: { targetPath, workflowId },
+        },
+      })
+      .tool('record-artifact', 'instrumentation_artifact_record', {
+        input: {
+          type: 'electron_bridge_map',
+          label: `Electron bridge analysis`,
+          metadata: { targetPath, extractAsar },
+        },
+      })
+
+      // Phase 7: Session Insight
+      .tool('emit-insight', 'append_session_insight', {
+        input: {
+          insight: JSON.stringify({
+            status: 'electron_bridge_mapper_complete',
+            workflowId,
+            targetPath,
+            extractAsar,
+          }),
+        },
+      });
+
+    return root;
+  })
+  .onStart((ctx) => {
+    ctx.emitMetric('workflow_runs_total', 1, 'counter', { workflowId, mission: 'electron_bridge_mapper', stage: 'start' });
+  })
+  .onFinish((ctx) => {
+    ctx.emitMetric('workflow_runs_total', 1, 'counter', { workflowId, mission: 'electron_bridge_mapper', stage: 'finish' });
+  })
+  .onError((ctx, error) => {
+    ctx.emitMetric('workflow_errors_total', 1, 'counter', { workflowId, mission: 'electron_bridge_mapper', stage: 'error', error: error.name });
+  })
+  .build();

package/workflows/evidence-pack/.jshook-install.json

@@ -0,0 +1,14 @@
+{
+  "version": 1,
+  "kind": "workflow",
+  "slug": "evidence-pack",
+  "id": "workflow.evidence-pack.v1",
+  "source": {
+    "type": "git",
+    "repo": "https://github.com/vmoranv/jshook_workflow_evidence_pack",
+    "ref": "main",
+    "commit": "c169cbab4db914bb07481342ac27ddad049d85b1",
+    "subpath": ".",
+    "entry": "workflow.ts"
+  }
+}

package/workflows/evidence-pack/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 vmoranv
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/workflows/evidence-pack/README.md

@@ -0,0 +1,105 @@
+# jshook_workflow_template
+
+TypeScript-first template repository for building a reusable `jshook` workflow.
+
+This template focuses on one thing:
+
+- codify an existing built-in tool chain into a reusable workflow contract
+- keep TypeScript source in Git and generated JavaScript out of Git
+
+## Included in the template
+
+- `workflow.ts`: workflow source entrypoint
+- `docs/agent-recipes.md`: recipes for orchestration, parallel reads, and subagent-assisted analysis
+- `dist/workflow.js`: generated locally by `pnpm run build` and ignored by Git
+
+## What the MVP workflow demonstrates
+
+The sample workflow runs this shape:
+
+1. `network_enable`
+2. `page_navigate`
+3. parallel surface collection
+   - `page_get_local_storage`
+   - `page_get_cookies`
+   - `network_get_requests`
+   - `page_get_all_links`
+   - optional `console_get_logs`
+4. `network_extract_auth`
+5. `console_execute` summary output
+
+## Dependency model
+
+This template uses the published npm package:
+
+```json
+{
+  "@jshookmcp/extension-sdk": "^0.1.3"
+}
+```
+
+## Install and build
+
+```bash
+pnpm install
+pnpm run build
+pnpm run check
+```
+
+## Loading behavior
+
+`jshook` discovers both `workflow.ts` and `dist/workflow.js`, but when both exist it prefers the generated JavaScript entry.
+
+Recommended workflow:
+
+1. edit `workflow.ts`
+2. run `pnpm run build`
+3. let `jshook` load `dist/workflow.js`
+
+Do **not** commit `dist/`.
+
+## Load the workflow into jshook
+
+Set:
+
+```bash
+MCP_WORKFLOW_ROOTS=<path-to-cloned-jshook_workflow_template>
+```
+
+Then run inside `jshook`:
+
+1. `extensions_reload`
+2. `extensions_list`
+3. `list_extension_workflows`
+4. `run_extension_workflow`
+
+## Configuration prefix
+
+The template uses:
+
+```text
+workflows.templateCapture.*
+```
+
+Rename that prefix early when adapting the template for real use.
+
+## Git hygiene
+
+Keep this repo focused on source and docs.
+Do not commit:
+
+- `dist/`
+- `node_modules/`
+- `.env`
+- runtime artifacts
+- screenshots
+- local sessions
+- host-specific temp output
+
+## What to change first
+
+1. replace `workflowId` and `displayName`
+2. rename the config prefix
+3. keep state-mutating steps serialized
+4. keep read-only collection steps parallel where safe
+5. validate the workflow through `extensions_reload` and `list_extension_workflows`

package/workflows/evidence-pack/docs/agent-recipes.md

@@ -0,0 +1,44 @@
+# Agent Recipes for `jshook_workflow_template`
+
+## Core rule
+
+- parallelize reads, not shared page state mutations
+- let the main agent keep the active browser session
+- use subagents for sidecar analysis and report drafting
+
+## Recipe 1: run workflow, then delegate analysis
+
+Recommended split:
+
+- main agent
+  - `run_extension_workflow`
+  - optional `network_get_response_body`
+- subagent
+  - classify endpoints
+  - summarize auth and session artifacts
+  - draft report output
+
+## Recipe 2: main agent navigates, subagent reviews outputs
+
+Recommended split:
+
+- main agent
+  - `page_navigate`
+  - page actions
+  - `network_get_requests`
+- subagent
+  - endpoint matrix
+  - auth header and signature review
+  - next-step probing suggestions
+
+## Recipe 3: when to use parallel tool calls
+
+Good read-only candidates:
+
+- `extensions_list`
+- `search_tools`
+- `page_get_local_storage`
+- `page_get_cookies`
+- `console_get_logs`
+
+Avoid parallelizing any action that changes the current page state.

package/workflows/evidence-pack/meta.yaml

@@ -0,0 +1,6 @@
+name: evidence-pack
+description: JSHook workflow for evidence-pack
+author: vmoranv
+tags:
+  - workflow
+  - evidence-pack

package/workflows/evidence-pack/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "jshook-workflow-template",
+  "private": true,
+  "version": "0.1.0",
+  "description": "Standalone template repository for building jshook workflows.",
+  "type": "module",
+  "packageManager": "pnpm@10.28.2",
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "check": "tsc -p tsconfig.json --noEmit"
+  },
+  "dependencies": {
+    "@jshookmcp/extension-sdk": "^0.3.0"
+  },
+  "devDependencies": {
+    "@types/node": "^25.3.0",
+    "typescript": "^5.9.3"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  }
+}

package/workflows/evidence-pack/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "noEmit": false,
+    "outDir": "dist",
+    "rootDir": ".",
+    "strict": true,
+    "skipLibCheck": true,
+    "types": ["node"]
+  },
+  "include": ["workflow.ts"],
+  "exclude": ["dist", "node_modules"]
+}

package/workflows/evidence-pack/workflow.ts

@@ -0,0 +1,154 @@
+import {
+  createWorkflow,
+  type WorkflowExecutionContext,
+  SequenceNodeBuilder,
+} from '@jshookmcp/extension-sdk/workflow';
+
+const workflowId = 'workflow.evidence-pack.v1';
+
+/**
+ * Evidence Pack — Reverse Mission Workflow
+ *
+ * One-click export of the current reverse engineering session:
+ *   1. Queries the full evidence graph
+ *   2. Exports HAR from network capture
+ *   3. Takes a page screenshot
+ *   4. Collects session insights
+ *   5. Gathers instrumentation session data
+ *   6. Captures console logs and local storage state
+ *   7. Packages everything into a structured evidence bundle
+ */
+export default createWorkflow(workflowId, 'Evidence Pack')
+  .description(
+    'One-click export of the current reverse session: evidence graph, HAR, screenshot, console logs, storage, instrumentation sessions, and session insights — packaged as a replayable evidence bundle.',
+  )
+  .tags([
+    'reverse',
+    'evidence',
+    'export',
+    'report',
+    'har',
+    'screenshot',
+    'session',
+    'mission',
+  ])
+  .timeoutMs(5 * 60_000)
+  .defaultMaxConcurrency(6)
+  .buildGraph((ctx: WorkflowExecutionContext) => {
+    const prefix = 'workflows.evidencePack';
+
+    // ── Config ──────────────────────────────────────────────────────
+    const includeHar = Boolean(ctx.getConfig(`${prefix}.includeHar`, true));
+    const includeScreenshot = Boolean(ctx.getConfig(`${prefix}.includeScreenshot`, true));
+    const includeConsoleLogs = Boolean(ctx.getConfig(`${prefix}.includeConsoleLogs`, true));
+    const includeStorage = Boolean(ctx.getConfig(`${prefix}.includeStorage`, true));
+    const consoleLogLimit = Number(ctx.getConfig(`${prefix}.consoleLogLimit`, 100));
+    const maxConcurrency = Number(ctx.getConfig(`${prefix}.parallel.maxConcurrency`, 6));
+    const exportFormat = String(ctx.getConfig(`${prefix}.exportFormat`, 'json'));
+    const requestTail = Number(ctx.getConfig(`${prefix}.requestTail`, 100));
+
+    const root = new SequenceNodeBuilder('evidence-pack-root');
+
+    root
+      // ── Phase 1: Parallel Collection ──────────────────────────────
+      .parallel('collect-evidence', (p) => {
+        p.maxConcurrency(maxConcurrency)
+          .failFast(false)
+          // Evidence graph
+          .tool('query-evidence-graph', 'evidence_query', {
+            input: { format: exportFormat },
+          })
+          // Session insights
+          .tool('get-session-insights', 'get_session_insights', {
+            input: {},
+          })
+          // Instrumentation sessions
+          .tool('list-sessions', 'instrumentation_session_list', {
+            input: {},
+          })
+          // Network requests
+          .tool('get-requests', 'network_get_requests', {
+            input: { tail: requestTail },
+          })
+          // Cookies
+          .tool('get-cookies', 'page_get_cookies');
+
+        // Optional collectors
+        if (includeHar) {
+          p.tool('export-har', 'network_export_har', {
+            input: {},
+          });
+        }
+
+        if (includeScreenshot) {
+          p.tool('take-screenshot', 'page_screenshot', {
+            input: { fullPage: true },
+          });
+        }
+
+        if (includeConsoleLogs) {
+          p.tool('get-console-logs', 'console_get_logs', {
+            input: { limit: consoleLogLimit },
+          });
+        }
+
+        if (includeStorage) {
+          p.tool('get-local-storage', 'page_get_local_storage');
+        }
+      })
+
+      // ── Phase 2: Auth Surface ─────────────────────────────────────
+      .tool('extract-auth', 'network_extract_auth', {
+        input: { minConfidence: 0.2 },
+      })
+
+      // ── Phase 3: Page Snapshot (Coordination) ─────────────────────
+      .tool('save-page-snapshot', 'save_page_snapshot', {
+        input: {},
+      })
+
+      // ── Phase 4: Evidence Export ──────────────────────────────────
+      .tool('export-evidence', 'evidence_export', {
+        input: { format: exportFormat },
+      })
+
+      // ── Phase 5: Summary Insight ──────────────────────────────────
+      .tool('emit-insight', 'append_session_insight', {
+        input: {
+          insight: JSON.stringify({
+            status: 'evidence_pack_complete',
+            workflowId,
+            includeHar,
+            includeScreenshot,
+            includeConsoleLogs,
+            includeStorage,
+            exportFormat,
+          }),
+        },
+      });
+
+    return root;
+  })
+  .onStart((ctx) => {
+    ctx.emitMetric('workflow_runs_total', 1, 'counter', {
+      workflowId,
+      mission: 'evidence_pack',
+      stage: 'start',
+    });
+  })
+  .onFinish((ctx) => {
+    ctx.emitMetric('workflow_runs_total', 1, 'counter', {
+      workflowId,
+      mission: 'evidence_pack',
+      stage: 'finish',
+    });
+  })
+  .onError((ctx, error) => {
+    ctx.emitMetric('workflow_errors_total', 1, 'counter', {
+      workflowId,
+      mission: 'evidence_pack',
+      stage: 'error',
+      error: error.name,
+    });
+  })
+  .build();

package/workflows/js-bundle-search/.jshook-install.json

@@ -0,0 +1,14 @@
+{
+  "version": 1,
+  "kind": "workflow",
+  "slug": "js-bundle-search",
+  "id": "workflow.js-bundle-search.v1",
+  "source": {
+    "type": "git",
+    "repo": "https://github.com/vmoranv/jshook_workflow_js_bundle_search",
+    "ref": "main",
+    "commit": "2c1cdd2",
+    "subpath": ".",
+    "entry": "workflow.ts"
+  }
+}

package/workflows/js-bundle-search/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 vmoranv
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/workflows/js-bundle-search/README.md

@@ -0,0 +1,46 @@
+# js-bundle-search workflow
+
+Declarative workflow for remote JavaScript bundle analysis. It optionally extracts local auth context, runs multi-pattern bundle search, and emits a compact summary step for downstream tooling.
+
+## Entry File
+
+- `workflow.ts`
+
+## Workflow ID
+
+- `workflow.js-bundle-search.v1`
+
+## Structure
+
+This workflow wraps the built-in `js_bundle_search` tool in a small but reusable declarative graph:
+
+- Optional `page_script_run(auth_extract)` pre-step for context collection
+- Core `js_bundle_search` step with configurable regex patterns
+- `console_execute` summary step to expose search intent and expected follow-up
+- `BranchNode` guard so the auth-extract step can be toggled safely
+
+## Tools Used
+
+- `page_script_run`
+- `js_bundle_search`
+- `console_execute`
+
+## Config
+
+- `workflows.jsBundleSearch.bundleUrl`
+- `workflows.jsBundleSearch.cacheBundle`
+- `workflows.jsBundleSearch.stripNoise`
+- `workflows.jsBundleSearch.maxMatches`
+- `workflows.jsBundleSearch.patterns`
+- `workflows.jsBundleSearch.enableAuthExtract`
+
+Default example patterns cover payment endpoints, subscription-tier signals, and feature-flag markers.
+
+## Local Validation
+
+1. Run `pnpm install`.
+2. Run `pnpm typecheck`.
+3. Put this repo under a configured `workflows/` extension root.
+4. Run `extensions_reload` in `jshookmcp`.
+5. Confirm the workflow appears in `extensions_list`.
+6. Execute the workflow and verify optional auth extraction, bundle match results, and summary output.

package/workflows/js-bundle-search/meta.yaml

@@ -0,0 +1,4 @@
+name: js-bundle-search
+description: Declarative workflow for searching remote JavaScript bundles with cached fetch and multi-pattern analysis.
+author: vmoranv
+source_repo: https://github.com/vmoranv/jshook_workflow_js_bundle_search

package/workflows/js-bundle-search/package.json

@@ -0,0 +1,23 @@
+{
+  "name": "@jshookmcpextension/workflow-js-bundle-search",
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc --noEmit -p tsconfig.json"
+  },
+  "type": "module",
+  "dependencies": {
+"@jshookmcp/extension-sdk": "^0.3.0",
+    "@modelcontextprotocol/sdk": "^1.27.1",
+    "dotenv": "^17.3.1"
+  },
+  "version": "0.1.0",
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^25.3.0",
+    "typescript": "^5.9.3"
+  },
+  "private": true,
+  "packageManager": "pnpm@10.28.2"
+}

package/workflows/js-bundle-search/tsconfig.json

@@ -0,0 +1,16 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "lib": ["ES2022"],
+    "strict": true,
+    "skipLibCheck": true,
+    "esModuleInterop": true,
+    "resolveJsonModule": true,
+    "rootDir": ".",
+    "outDir": "dist"
+  },
+  "include": ["workflow.ts"],
+  "exclude": ["dist", "node_modules"]
+}