@jshookmcp/jshook 0.2.5 → 0.2.7

package/dist/src/server/domains/network/manifest.js

@@ -1,176 +0,0 @@
-import { bindByDepKey, ensureBrowserCore, toolLookup } from '../../domains/shared/registry.js';
-import { advancedTools } from '../../domains/network/definitions.js';
-import { AdvancedToolHandlers } from '../../domains/network/index.js';
-const DOMAIN = 'network';
-const DEP_KEY = 'advancedHandlers';
-const t = toolLookup(advancedTools);
-const b = (invoke) => bindByDepKey(DEP_KEY, invoke);
-function ensure(ctx) {
-    ensureBrowserCore(ctx);
-    if (!ctx.advancedHandlers) {
-        ctx.advancedHandlers = new AdvancedToolHandlers(ctx.collector, ctx.consoleMonitor);
-    }
-    return ctx.advancedHandlers;
-}
-const manifest = {
-    kind: 'domain-manifest',
-    version: 1,
-    domain: DOMAIN,
-    depKey: DEP_KEY,
-    profiles: ['workflow', 'full'],
-    ensure,
-    workflowRule: {
-        patterns: [
-            /(capture|intercept|monitor|hook).*(network|request|response|api|traffic)/i,
-            /(抓包|拦截|监控|hook).*(网络|请求|响应|api|流量)/i,
-        ],
-        priority: 100,
-        tools: ['web_api_capture_session', 'network_enable', 'page_navigate', 'network_get_requests'],
-        hint: 'Network capture workflow: bootstrap browser/page state -> enable capture -> navigate or act -> inspect captured requests',
-    },
-    prerequisites: {
-        network_get_requests: [
-            { condition: 'Browser must be launched', fix: 'Call browser_launch or browser_attach first' },
-            { condition: 'Network monitoring must be enabled', fix: 'Call network_enable first' },
-        ],
-        network_get_response_body: [
-            { condition: 'Browser must be launched', fix: 'Call browser_launch or browser_attach first' },
-            { condition: 'Network monitoring must be enabled', fix: 'Call network_enable first' },
-        ],
-        network_extract_auth: [
-            { condition: 'Network monitoring must be enabled', fix: 'Call network_enable first' },
-        ],
-    },
-    registrations: [
-        { tool: t('network_enable'), domain: DOMAIN, bind: b((h, a) => h.handleNetworkEnable(a)) },
-        { tool: t('network_disable'), domain: DOMAIN, bind: b((h, a) => h.handleNetworkDisable(a)) },
-        {
-            tool: t('network_get_status'),
-            domain: DOMAIN,
-            bind: b((h, a) => h.handleNetworkGetStatus(a)),
-        },
-        {
-            tool: t('network_get_requests'),
-            domain: DOMAIN,
-            bind: b((h, a) => h.handleNetworkGetRequests(a)),
-        },
-        {
-            tool: t('network_get_response_body'),
-            domain: DOMAIN,
-            bind: b((h, a) => h.handleNetworkGetResponseBody(a)),
-        },
-        { tool: t('network_get_stats'), domain: DOMAIN, bind: b((h, a) => h.handleNetworkGetStats(a)) },
-        {
-            tool: t('performance_get_metrics'),
-            domain: DOMAIN,
-            bind: b((h, a) => h.handlePerformanceGetMetrics(a)),
-        },
-        {
-            tool: t('performance_start_coverage'),
-            domain: DOMAIN,
-            bind: b((h, a) => h.handlePerformanceStartCoverage(a)),
-        },
-        {
-            tool: t('performance_stop_coverage'),
-            domain: DOMAIN,
-            bind: b((h, a) => h.handlePerformanceStopCoverage(a)),
-        },
-        {
-            tool: t('performance_take_heap_snapshot'),
-            domain: DOMAIN,
-            bind: b((h, a) => h.handlePerformanceTakeHeapSnapshot(a)),
-        },
-        {
-            tool: t('performance_trace_start'),
-            domain: DOMAIN,
-            bind: b((h, a) => h.handlePerformanceTraceStart(a)),
-        },
-        {
-            tool: t('performance_trace_stop'),
-            domain: DOMAIN,
-            bind: b((h, a) => h.handlePerformanceTraceStop(a)),
-        },
-        {
-            tool: t('profiler_cpu_start'),
-            domain: DOMAIN,
-            bind: b((h, a) => h.handleProfilerCpuStart(a)),
-        },
-        { tool: t('profiler_cpu_stop'), domain: DOMAIN, bind: b((h, a) => h.handleProfilerCpuStop(a)) },
-        {
-            tool: t('profiler_heap_sampling_start'),
-            domain: DOMAIN,
-            bind: b((h, a) => h.handleProfilerHeapSamplingStart(a)),
-        },
-        {
-            tool: t('profiler_heap_sampling_stop'),
-            domain: DOMAIN,
-            bind: b((h, a) => h.handleProfilerHeapSamplingStop(a)),
-        },
-        {
-            tool: t('console_get_exceptions'),
-            domain: DOMAIN,
-            bind: b((h, a) => h.handleConsoleGetExceptions(a)),
-        },
-        {
-            tool: t('console_inject_script_monitor'),
-            domain: DOMAIN,
-            bind: b((h, a) => h.handleConsoleInjectScriptMonitor(a)),
-        },
-        {
-            tool: t('console_inject_xhr_interceptor'),
-            domain: DOMAIN,
-            bind: b((h, a) => h.handleConsoleInjectXhrInterceptor(a)),
-        },
-        {
-            tool: t('console_inject_fetch_interceptor'),
-            domain: DOMAIN,
-            bind: b((h, a) => h.handleConsoleInjectFetchInterceptor(a)),
-        },
-        {
-            tool: t('console_clear_injected_buffers'),
-            domain: DOMAIN,
-            bind: b((h, a) => h.handleConsoleClearInjectedBuffers(a)),
-        },
-        {
-            tool: t('console_reset_injected_interceptors'),
-            domain: DOMAIN,
-            bind: b((h, a) => h.handleConsoleResetInjectedInterceptors(a)),
-        },
-        {
-            tool: t('console_inject_function_tracer'),
-            domain: DOMAIN,
-            bind: b((h, a) => h.handleConsoleInjectFunctionTracer(a)),
-        },
-        {
-            tool: t('network_extract_auth'),
-            domain: DOMAIN,
-            bind: b((h, a) => h.handleNetworkExtractAuth(a)),
-        },
-        {
-            tool: t('network_export_har'),
-            domain: DOMAIN,
-            bind: b((h, a) => h.handleNetworkExportHar(a)),
-        },
-        {
-            tool: t('network_replay_request'),
-            domain: DOMAIN,
-            bind: b((h, a) => h.handleNetworkReplayRequest(a)),
-        },
-        {
-            tool: t('network_intercept_response'),
-            domain: DOMAIN,
-            bind: b((h, a) => h.handleNetworkInterceptResponse(a)),
-        },
-        {
-            tool: t('network_intercept_list'),
-            domain: DOMAIN,
-            bind: b((h, a) => h.handleNetworkInterceptList(a)),
-        },
-        {
-            tool: t('network_intercept_disable'),
-            domain: DOMAIN,
-            bind: b((h, a) => h.handleNetworkInterceptDisable(a)),
-        },
-    ],
-};
-export default manifest;

package/dist/src/server/domains/network/replay.d.ts

@@ -1,39 +0,0 @@
-export declare function isPrivateHost(host: string): boolean;
-export declare function isLoopbackHost(host: string): boolean;
-export declare function isSsrfTarget(url: string): Promise<boolean>;
-export interface ReplayArgs {
-    requestId: string;
-    headerPatch?: Record<string, string>;
-    bodyPatch?: string;
-    methodOverride?: string;
-    urlOverride?: string;
-    timeoutMs?: number;
-    dryRun?: boolean;
-}
-export interface ReplayDryRunResult {
-    dryRun: true;
-    preview: {
-        url: string;
-        method: string;
-        headers: Record<string, string>;
-        body: string | undefined;
-    };
-}
-export interface ReplayLiveResult {
-    dryRun: false;
-    status: number;
-    statusText: string;
-    headers: Record<string, string>;
-    body: string;
-    bodyTruncated: boolean;
-    requestId: string;
-}
-export type ReplayResult = ReplayDryRunResult | ReplayLiveResult;
-interface BaseRequest {
-    url: string;
-    method: string;
-    headers?: Record<string, string>;
-    postData?: string;
-}
-export declare function replayRequest(base: BaseRequest, args: ReplayArgs, maxBodyBytes?: number): Promise<ReplayResult>;
-export {};

package/dist/src/server/domains/network/replay.js

@@ -1,179 +0,0 @@
-import { lookup } from 'node:dns/promises';
-import { isIP } from 'node:net';
-import { NETWORK_REPLAY_MAX_REDIRECTS } from '../../../constants.js';
-const STRIPPED_HEADERS = new Set([
-    'host',
-    'content-length',
-    'transfer-encoding',
-    'connection',
-    'keep-alive',
-    'proxy-authenticate',
-    'proxy-authorization',
-    'te',
-    'trailers',
-    'upgrade',
-]);
-const SSRF_DENYLIST = [
-    /^127\./,
-    /^10\./,
-    /^172\.(1[6-9]|2[0-9]|3[01])\./,
-    /^192\.168\./,
-    /^169\.254\./,
-    /^0\./,
-    /^::1$/,
-    /^::$/,
-    /^::ffff:/i,
-    /^::ffff:0:/i,
-    /^64:ff9b::/i,
-    /^fc00:/i,
-    /^fd/i,
-    /^fe80:/i,
-    /^100::/i,
-    /^localhost$/i,
-];
-const LOOPBACK_HTTP_URL_RE = /^http:\/\/(localhost|127\.0\.0\.1|\[::1\])(?::\d+)?(\/|$)/i;
-export function isPrivateHost(host) {
-    if (host.startsWith('[') && host.endsWith(']')) {
-        host = host.slice(1, -1);
-    }
-    return SSRF_DENYLIST.some((re) => re.test(host));
-}
-export function isLoopbackHost(host) {
-    const normalized = host.replace(/^\[|\]$/g, '').toLowerCase();
-    return normalized === 'localhost' || normalized === '127.0.0.1' || normalized === '::1';
-}
-export async function isSsrfTarget(url) {
-    try {
-        const parsed = new URL(url);
-        const hostname = parsed.hostname.replace(/^\[|\]$/g, '');
-        if (isPrivateHost(hostname))
-            return true;
-        try {
-            const { address } = await lookup(hostname);
-            if (isPrivateHost(address))
-                return true;
-        }
-        catch {
-            return true;
-        }
-        return false;
-    }
-    catch {
-        return true;
-    }
-}
-const DANGEROUS_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
-function sanitizeHeaders(headers) {
-    const out = Object.create(null);
-    for (const [k, v] of Object.entries(headers)) {
-        if (!STRIPPED_HEADERS.has(k.toLowerCase()) && !DANGEROUS_KEYS.has(k)) {
-            out[k] = v;
-        }
-    }
-    return out;
-}
-export async function replayRequest(base, args, maxBodyBytes = 512_000) {
-    const url = args.urlOverride ?? base.url;
-    const method = (args.methodOverride ?? base.method).toUpperCase();
-    const mergedHeaders = sanitizeHeaders({ ...base.headers, ...args.headerPatch });
-    const body = args.bodyPatch !== undefined ? args.bodyPatch : base.postData;
-    const resolvePinned = async (targetUrl) => {
-        const parsed = new URL(targetUrl);
-        const hostname = parsed.hostname.replace(/^\[|\]$/g, '');
-        if (parsed.protocol === 'http:' && !isLoopbackHost(hostname)) {
-            throw new Error(`Replay blocked: insecure HTTP is only allowed for loopback targets, got "${targetUrl}"`);
-        }
-        if (isPrivateHost(hostname)) {
-            throw new Error(`Replay blocked: target URL "${targetUrl}" resolves to a private/reserved address.`);
-        }
-        const isIpLiteral = isIP(hostname) !== 0;
-        if (isIpLiteral) {
-            return { pinnedUrl: targetUrl, originalHost: parsed.host };
-        }
-        let resolvedIp;
-        try {
-            const result = await lookup(hostname);
-            resolvedIp = result.address;
-        }
-        catch {
-            throw new Error(`Replay blocked: DNS resolution failed for "${targetUrl}"`);
-        }
-        if (isPrivateHost(resolvedIp)) {
-            throw new Error(`Replay blocked: "${targetUrl}" resolved to private IP ${resolvedIp}`);
-        }
-        if (parsed.protocol === 'https:') {
-            return { pinnedUrl: targetUrl, originalHost: parsed.host };
-        }
-        const originalHost = parsed.host;
-        parsed.hostname = resolvedIp.includes(':') ? `[${resolvedIp}]` : resolvedIp;
-        return { pinnedUrl: parsed.toString(), originalHost };
-    };
-    if (args.dryRun !== false) {
-        if (await isSsrfTarget(url)) {
-            throw new Error(`Replay blocked: target URL "${url}" resolves to a private/reserved address.`);
-        }
-        return {
-            dryRun: true,
-            preview: { url, method, headers: mergedHeaders, body },
-        };
-    }
-    const controller = new AbortController();
-    const timeoutId = setTimeout(() => controller.abort(), args.timeoutMs ?? 30_000);
-    const MAX_REDIRECTS = NETWORK_REPLAY_MAX_REDIRECTS;
-    try {
-        let currentUrl = url;
-        let currentMethod = method;
-        let currentBody = body;
-        let resp;
-        for (let hop = 0; hop < MAX_REDIRECTS; hop++) {
-            const { pinnedUrl } = await resolvePinned(currentUrl);
-            if (!pinnedUrl.startsWith('https://') && !LOOPBACK_HTTP_URL_RE.test(pinnedUrl)) {
-                throw new Error(`Replay blocked: insecure HTTP is only allowed for loopback targets, got "${currentUrl}"`);
-            }
-            const hopHeaders = { ...mergedHeaders };
-            resp = await fetch(pinnedUrl, {
-                method: currentMethod,
-                headers: hopHeaders,
-                body: currentMethod !== 'GET' && currentMethod !== 'HEAD' ? currentBody : undefined,
-                signal: controller.signal,
-                redirect: 'manual',
-            });
-            if (resp.status >= 300 && resp.status < 400) {
-                const location = resp.headers.get('location');
-                if (!location)
-                    break;
-                currentUrl = new URL(location, currentUrl).toString();
-                if (resp.status === 301 || resp.status === 302 || resp.status === 303) {
-                    currentMethod = 'GET';
-                    currentBody = undefined;
-                }
-                delete mergedHeaders['Host'];
-                delete mergedHeaders['host'];
-                continue;
-            }
-            break;
-        }
-        if (resp.status >= 300 && resp.status < 400) {
-            throw new Error(`Replay blocked: too many redirects (>${MAX_REDIRECTS})`);
-        }
-        const responseHeaders = {};
-        resp.headers.forEach((v, k) => {
-            responseHeaders[k] = v;
-        });
-        const rawText = await resp.text();
-        const bodyTruncated = rawText.length > maxBodyBytes;
-        const bodyOut = bodyTruncated ? rawText.slice(0, maxBodyBytes) : rawText;
-        return {
-            dryRun: false,
-            status: resp.status,
-            statusText: resp.statusText,
-            headers: responseHeaders,
-            body: bodyOut,
-            bodyTruncated,
-            requestId: args.requestId,
-        };
-    }
-    finally {
-        clearTimeout(timeoutId);
-    }
-}

package/dist/src/server/domains/platform/definitions.d.ts

@@ -1,2 +0,0 @@
-import type { Tool } from '@modelcontextprotocol/sdk/types.js';
-export declare const platformTools: Tool[];

package/dist/src/server/domains/platform/definitions.js

@@ -1,123 +0,0 @@
-import { tool } from '../../registry/tool-builder.js';
-export const platformTools = [
-    tool('miniapp_pkg_scan')
-        .desc('扫描本地小程序缓存目录，列出所有 小程序包文件。默认扫描常见 Windows 路径。')
-        .string('searchPath', '可选。指定扫描根目录；不提供时使用默认路径（MiniApp/Cache 与 MiniApp/Plugin）。')
-        .build(),
-    tool('miniapp_pkg_unpack')
-        .desc('解包 小程序包文件。优先调用外部 外部解包工具，失败时自动降级为纯 Node.js 解析。')
-        .string('inputPath', '必填。小程序包文件路径。')
-        .string('outputDir', '可选。输出目录；不提供时自动生成 artifacts 临时目录。')
-        .required('inputPath')
-        .build(),
-    tool('miniapp_pkg_analyze')
-        .desc('分析解包后的小程序结构，提取 pages/subPackages/components/jsFiles/totalSize/appId。')
-        .string('unpackedDir', '必填。已解包目录路径。')
-        .required('unpackedDir')
-        .build(),
-    tool('asar_extract')
-        .desc('提取 Electron app.asar（纯 Node.js 实现，不依赖 @electron/asar）。支持仅列文件模式。')
-        .string('inputPath', '必填。asar 文件路径。')
-        .string('outputDir', '可选。提取目录；不提供时自动生成 artifacts 临时目录。')
-        .boolean('listOnly', '可选。默认 false；true 时仅列出文件清单，不执行提取。', {
-        default: false,
-    })
-        .required('inputPath')
-        .build(),
-    tool('electron_inspect_app')
-        .desc('分析 Electron 应用结构（.exe 或 app 目录）：package.json、main、preload、dependencies、devToolsEnabled。')
-        .string('appPath', '必填。Electron .exe 路径或应用目录路径。')
-        .required('appPath')
-        .build(),
-    tool('electron_scan_userdata')
-        .desc('扫描指定目录中的所有 JSON 文件，返回 raw 内容。适用于 Electron 应用的用户数据目录（Windows: %APPDATA%, macOS: ~/Library/Application Support, Linux: ~/.config）。Agent 自行解读数据。')
-        .string('dirPath', '必填。要扫描的目录绝对路径（任意平台）。')
-        .number('maxFiles', '可选。最多读取的 JSON 文件数量。默认 20。', { default: 20 })
-        .number('maxFileSizeKB', '可选。单个文件大小上限（KB）。超限文件跳过。默认 1024。', {
-        default: 1024,
-    })
-        .required('dirPath')
-        .readOnly()
-        .idempotent()
-        .build(),
-    tool('asar_search')
-        .desc('在 ASAR 归档内执行正则搜索。Agent 提供 pattern，工具返回匹配文件路径和行内容。')
-        .string('inputPath', '必填。ASAR 文件路径。')
-        .string('pattern', '必填。正则表达式字符串。')
-        .string('fileGlob', '可选。文件扩展名过滤。默认 *.js。', { default: '*.js' })
-        .number('maxResults', '可选。最大返回匹配数。默认 100。', { default: 100 })
-        .required('inputPath', 'pattern')
-        .readOnly()
-        .idempotent()
-        .build(),
-    tool('electron_check_fuses')
-        .desc('检测 Electron 可执行文件中的 fuse 配置状态（ASAR 完整性校验、RunAsNode 等）。')
-        .string('exePath', '必填。Electron .exe 文件路径。')
-        .required('exePath')
-        .readOnly()
-        .idempotent()
-        .build(),
-    tool('electron_patch_fuses')
-        .desc('Patch Electron binary fuses to enable/disable debug capabilities. Creates backup before patching. Use profile="debug" to enable RunAsNode, NodeOptions, InspectArguments and disable OnlyLoadAppFromAsar.')
-        .string('exePath', 'Required. Path to the Electron .exe file to patch.')
-        .enum('profile', ['debug', 'custom'], 'Patch profile. "debug" enables debug-related fuses. "custom" requires a fuses object.', { default: 'debug' })
-        .object('fuses', {}, 'For profile="custom". Map of fuse names to ENABLE/DISABLE. E.g. {"RunAsNode": "ENABLE"}.')
-        .boolean('createBackup', 'Create a .exe.bak backup before patching.', { default: true })
-        .required('exePath')
-        .destructive()
-        .build(),
-    tool('v8_bytecode_decompile')
-        .desc('Decompile V8 bytecode (.jsc / bytenode) files. Uses view8 Python package for full decompilation (preferred), falls back to built-in constant pool extraction. Returns pseudocode or extracted strings for LLM analysis.')
-        .string('filePath', 'Required. Path to the .jsc or V8 bytecode file.')
-        .required('filePath')
-        .readOnly()
-        .idempotent()
-        .build(),
-    tool('electron_launch_debug')
-        .desc('Launch Electron app with dual CDP debugging: --inspect for main process (Node.js) and --remote-debugging-port for renderer (Chromium). Auto-checks fuse status.')
-        .string('exePath', 'Required. Path to the Electron .exe file.')
-        .number('mainPort', 'Main process inspect port.', { default: 9229 })
-        .number('rendererPort', 'Renderer remote debugging port.', { default: 9222 })
-        .array('args', { type: 'string' }, 'Extra command-line arguments.')
-        .boolean('skipFuseCheck', 'Skip fuse status check.', { default: false })
-        .number('waitMs', 'Milliseconds to wait for CDP ports.', { default: 8000 })
-        .required('exePath')
-        .openWorld()
-        .build(),
-    tool('electron_debug_status')
-        .desc('Check status of dual-CDP debug sessions launched by electron_launch_debug.')
-        .string('sessionId', 'Optional. Check specific session. Omit to list all.')
-        .readOnly()
-        .idempotent()
-        .build(),
-    tool('frida_bridge')
-        .desc('Dynamic instrumentation bridge via Frida. Actions: check_env (verify frida installed), generate_script (hook template), attach (live-attach to process), run_script (inject script), detach (disconnect), list_sessions, guide (usage help).')
-        .enum('action', ['check_env', 'generate_script', 'attach', 'run_script', 'detach', 'list_sessions', 'guide'], 'Action to perform.', { default: 'guide' })
-        .number('pid', 'Process ID for attach/run_script.')
-        .string('processName', 'Process name for attach (alternative to pid).')
-        .string('sessionId', 'Session ID for run_script/detach.')
-        .string('script', 'Frida JS script to inject (for run_script).')
-        .enum('hookType', ['intercept', 'replace', 'stalker', 'module_export'], 'Hook template type (for generate_script).', { default: 'intercept' })
-        .string('functionName', 'Target function name (for generate_script).')
-        .string('target', 'Target process name (for generate_script usage hint).')
-        .openWorld()
-        .build(),
-    tool('electron_ipc_sniff')
-        .desc('Sniff Electron IPC messages by injecting hooks into ipcRenderer via CDP. Captures invoke/send/sendSync with channel names and arguments. Actions: start (inject hooks), dump (retrieve captured messages), stop (end session), list (show sessions), guide.')
-        .enum('action', ['start', 'dump', 'stop', 'list', 'guide'], 'Action to perform.', {
-        default: 'guide',
-    })
-        .number('port', 'Renderer CDP port (--remote-debugging-port).', { default: 9222 })
-        .string('sessionId', 'Session ID for dump/stop.')
-        .boolean('clear', 'Clear captured messages after dump.', { default: true })
-        .openWorld()
-        .build(),
-    tool('jadx_bridge')
-        .desc('JADX decompiler bridge for Android APK/DEX/AAR files. Actions: check_env (verify jadx installed), decompile (run jadx on input), guide (usage help).')
-        .enum('action', ['check_env', 'decompile', 'guide'], 'Action to perform.', { default: 'guide' })
-        .string('inputPath', 'Required for decompile. Path to APK/DEX/AAR file.')
-        .string('outputDir', 'Optional. Output directory for decompiled sources.')
-        .array('extraArgs', { type: 'string' }, 'Extra jadx CLI arguments (e.g. ["--deobf", "--show-bad-code"]).')
-        .openWorld()
-        .build(),
-];

package/dist/src/server/domains/platform/handlers/bridge-handlers.d.ts

@@ -1,21 +0,0 @@
-import { type ExternalToolRunner } from '../../../domains/shared/modules.js';
-export declare class BridgeHandlers {
-    private runner;
-    constructor(runner: ExternalToolRunner);
-    handleFridaBridge(args: Record<string, unknown>): Promise<{
-        content: {
-            type: "text";
-            text: string;
-        }[];
-    }>;
-    private _handleFridaAttach;
-    private _handleFridaRunScript;
-    private _handleFridaDetach;
-    private _handleFridaListSessions;
-    handleJadxBridge(args: Record<string, unknown>): Promise<{
-        content: {
-            type: "text";
-            text: string;
-        }[];
-    }>;
-}