@jshookmcp/jshook 0.3.1 → 0.3.3

package/dist/{workflow-CYIXtrWD.mjs → workflow-wkXb3x-U.mjs}

@@ -1,4 +1,4 @@
-import{t as e}from"./logger-sBC6IdRT.mjs";import{Jr as t,Kr as n,Xr as r,Yr as i,qr as a}from"./constants-Cp6hBrrx.mjs";import{a as o,i as s,r as c,t as l}from"./parse-args-Cuk7-xUt.mjs";import{a as u,s as d}from"./ssrf-policy-T96MR3r6.mjs";import{t as f}from"./ResponseBuilder-B2lu4KEl.mjs";import"./definitions-DtE0XLrT.mjs";import{BlockList as p,isIP as m}from"node:net";import{lookup as h}from"node:dns/promises";const g=[{name:`auth_extract`,description:`Extract auth tokens from localStorage and cookies`,code:`(function(){
+import{t as e}from"./logger-CCikqqvj.mjs";import{da as t,fa as n,ha as r,ma as i,pa as a}from"./constants-DMv3svps.mjs";import{a as o,o as s,r as c,t as l}from"./parse-args-ngRrvF9e.mjs";import{t as u}from"./ResponseBuilder-nPXl_khE.mjs";import{a as d,s as f}from"./ssrf-policy-B72vdy23.mjs";import"./definitions-BOvju5t2.mjs";import{BlockList as p,isIP as m}from"node:net";import{lookup as h}from"node:dns/promises";const g=[{name:`auth_extract`,description:`Extract auth tokens from localStorage and cookies`,code:`(function(){
   var keys=['token','active_token','access_token','jwt','auth_token','userRole','id_token','refresh_token'];
   var r={};
   for(var i=0;i<keys.length;i++){var v=localStorage.getItem(keys[i]);if(v)r[keys[i]]=v;}
@@ -49,8 +49,8 @@ import{t as e}from"./logger-sBC6IdRT.mjs";import{Jr as t,Kr as n,Xr as r,Yr as i
     }
   });
   return r;
-})()`}];function _(e){let t={deps:e,scriptRegistry:new Map,bundleCache:new Map,bundleCacheBytes:0};return y(t.scriptRegistry),t}const v={BUNDLE_CACHE_TTL_MS:a,MAX_SCRIPTS:100,MAX_BUNDLE_CACHE:50,MAX_BUNDLE_CACHE_BYTES:n};function y(e){for(let t of g)e.set(t.name,{code:t.code,description:t.description,source:`core`,protectedFromEviction:!0})}function b(e){let t=Date.now();for(let[n,r]of e.bundleCache)t-r.cachedAt>=v.BUNDLE_CACHE_TTL_MS&&(e.bundleCacheBytes-=r.text.length,e.bundleCache.delete(n));for(;e.bundleCache.size>=v.MAX_BUNDLE_CACHE||e.bundleCacheBytes>v.MAX_BUNDLE_CACHE_BYTES;){let t=e.bundleCache.keys().next().value;if(t!==void 0){let n=e.bundleCache.get(t);n&&(e.bundleCacheBytes-=n.text.length),e.bundleCache.delete(t)}else break}}function x(e){return e.replace(/[<>/\u2028\u2029]/g,e=>{switch(e){case`<`:return`\\u003C`;case`>`:return`\\u003E`;case`/`:return`\\u002F`;case`\u2028`:return`\\u2028`;case`\u2029`:return`\\u2029`;default:return e}})}function S(e){return typeof e==`string`?e:void 0}function C(e){if(!(typeof e!=`object`||!e||Array.isArray(e)))return e}function w(e){return f.raw(e)}var T=class{state;constructor(e){this.state=e}async handlePageScriptRegister(e){let t=S(e.name),n=S(e.code),r=S(e.description)??``;if(!t||!n)return w({success:!1,error:`name and code are required`});let i=this.state.scriptRegistry.has(t);if(!i&&this.state.scriptRegistry.size>=v.MAX_SCRIPTS){for(let[e,t]of this.state.scriptRegistry)if(!t.protectedFromEviction){this.state.scriptRegistry.delete(e);break}}let a=this.state.scriptRegistry.get(t);return this.state.scriptRegistry.set(t,{code:n,description:r,source:a?.source??`user`,protectedFromEviction:a?.protectedFromEviction??!1}),w({success:!0,action:i?`updated`:`registered`,name:t,description:r,totalScripts:this.state.scriptRegistry.size,available:Array.from(this.state.scriptRegistry.keys())})}async handlePageScriptRun(t){let n=S(t.name),r=C(t.params),i=n?this.state.scriptRegistry.get(n):void 0;if(!i){let e=Array.from(this.state.scriptRegistry.keys());return w({success:!1,error:`Script "${n}" not found`,available:e})}let a;a=r===void 0?i.code:`(function(){const __params__=JSON.parse(${x(JSON.stringify(JSON.stringify(r)))});return(${i.code});})()`;try{return await this.state.deps.browserHandlers.handlePageEvaluate({code:a})}catch(t){return e.error(`[page_script_run] Script "${n}" failed:`,t),w({success:!1,script:n,error:t instanceof Error?t.message:String(t)})}}async handleListExtensionWorkflows(){let e=this.state.deps.serverContext;if(!e)return w({success:!1,error:`Extension workflow runtime is unavailable in this handler context`});let{ensureWorkflowsLoaded:t}=await import(`./ExtensionManager-erMpqcLk.mjs`).then(e=>e.t);await t(e);let n=[...e.extensionWorkflowsById.values()].filter(e=>e.route?.kind!==`preset`);n.sort((e,t)=>e.id.localeCompare(t.id));let r=n.map(e=>({id:e.id,displayName:e.displayName,description:e.description,tags:e.tags,timeoutMs:e.timeoutMs,defaultMaxConcurrency:e.defaultMaxConcurrency,source:e.source,route:e.route?{kind:e.route.kind,priority:e.route.priority,requiredDomains:e.route.requiredDomains,triggerPatterns:e.route.triggerPatterns.map(e=>e.source),steps:e.route.steps}:void 0}));return w({success:!0,count:r.length,workflows:r})}async handleRunExtensionWorkflow(t){let n=this.state.deps.serverContext;if(!n)return w({success:!1,error:`Extension workflow runtime is unavailable in this handler context`});let r=S(t.workflowId)??S(t.id);if(!r)return w({success:!1,error:`workflowId is required`});let{ensureWorkflowsLoaded:i}=await import(`./ExtensionManager-erMpqcLk.mjs`).then(e=>e.t);await i(n);let a=n.extensionWorkflowRuntimeById.get(r);if(!a){let e=[...n.extensionWorkflowsById.values()].filter(e=>e.route?.kind!==`preset`).map(e=>e.id);return e.sort((e,t)=>e.localeCompare(t)),w({success:!1,error:`Extension workflow "${r}" not found`,available:e})}if(a.route?.kind===`preset`)return w({success:!1,workflowId:r,error:`Extension workflow "${r}" is a routing preset and cannot be executed directly. Use route_tool or the suggested preset steps instead.`});let o=S(t.profile),l=C(t.config),u=s(t,`nodeInputOverrides`),d=c(t,`timeoutMs`);try{let{executeExtensionWorkflow:e}=await import(`./WorkflowEngine-CxEp2WXH.mjs`).then(e=>e.t);return w({success:!0,...await e(n,a.workflow,{profile:o,config:l,nodeInputOverrides:u,timeoutMs:d})})}catch(t){return e.error(`[run_extension_workflow] Workflow "${r}" failed:`,t),w({success:!1,workflowId:r,error:t instanceof Error?t.message:String(t)})}}};function E(e){return e.trim().replace(/^\[|\]$/g,``).toLowerCase()}function D(e){if(e===void 0)return[];let t=typeof e==`string`?(()=>{try{return JSON.parse(e)}catch{return null}})():e;if(!Array.isArray(t))return null;let n=t.filter(e=>typeof e==`string`);return n.length===t.length?n.map(e=>e.trim()).filter(e=>e.length>0):null}function O(e){let t=e.trim(),n=t.includes(`://`)?t:`http://${t}`;try{let e=new URL(n);return e.port.length>0?{scope:`host`,value:e.host.toLowerCase()}:{scope:`hostname`,value:E(e.hostname)}}catch{return{scope:`hostname`,value:E(t)}}}function k(e,t){return e===void 0?{ok:!0,value:!1}:typeof e==`boolean`?{ok:!0,value:e}:{ok:!1,error:`${t} must be a boolean when provided`}}function A(e){let t=e.networkPolicy;if(t===void 0)return{policy:{allowPrivateNetwork:!1,allowInsecureHttp:!1,allowedHosts:[],allowedRedirectHosts:[],allowedCidrs:[],allowedCidrBlockList:new p}};let n=typeof t==`string`?(()=>{try{return JSON.parse(t)}catch{return null}})():t;if(!n||typeof n!=`object`||Array.isArray(n))return{error:`networkPolicy must be an object or valid JSON object string`};let r=n,i=k(r.allowPrivateNetwork,`networkPolicy.allowPrivateNetwork`);if(!i.ok)return{error:i.error};let a=k(r.allowInsecureHttp,`networkPolicy.allowInsecureHttp`);if(!a.ok)return{error:a.error};let o=D(r.allowedHosts);if(o===null)return{error:`networkPolicy.allowedHosts must be an array of strings`};let s=D(r.allowedRedirectHosts);if(s===null)return{error:`networkPolicy.allowedRedirectHosts must be an array of strings`};let c=D(r.allowedCidrs);if(c===null)return{error:`networkPolicy.allowedCidrs must be an array of strings`};let l=new p;for(let e of c){let[t,n]=e.split(`/`);if(!t||!n)return{error:`Invalid CIDR in networkPolicy.allowedCidrs: "${e}"`};let r=m(t);if(r===0)return{error:`Invalid CIDR base address in networkPolicy.allowedCidrs: "${e}"`};let i=Number(n),a=r===4?32:128;if(!Number.isInteger(i)||i<0||i>a)return{error:`Invalid CIDR prefix in networkPolicy.allowedCidrs: "${e}"`};l.addSubnet(t,i,r===4?`ipv4`:`ipv6`)}return{policy:{allowPrivateNetwork:i.value,allowInsecureHttp:a.value,allowedHosts:o.map(O),allowedRedirectHosts:s.map(O),allowedCidrs:c,allowedCidrBlockList:l}}}async function j(e,t,n){let r;try{r=new URL(e)}catch{throw Error(`Invalid ${n.label}: ${e}`)}if(r.protocol!==`http:`&&r.protocol!==`https:`)throw Error(`Unsupported protocol for ${n.label}: ${r.protocol} — only http/https allowed`);let i=E(r.hostname),a=r.host.toLowerCase(),o=m(i),s=o===0?await h(i).then(e=>e.address).catch(t=>{throw Error(`DNS resolution failed for "${e}"`,{cause:t})}):i,c=m(s),l=c!==0&&t.allowedCidrs.length>0&&t.allowedCidrBlockList.check(s,c===4?`ipv4`:`ipv6`),f=n.allowRedirectHosts&&t.allowedRedirectHosts.length>0?t.allowedRedirectHosts:t.allowedHosts,p=f.some(e=>e.scope===`host`?e.value===a:e.value===i),g=f.length>0||t.allowedCidrs.length>0,_=!g||p||l;if(d(i)||d(s)){if(!t.allowPrivateNetwork)throw Error(`Blocked: ${n.label} "${e}" resolves to a private/reserved address`);if(!g||!_)throw Error(`Blocked: ${n.label} "${e}" requires an explicit networkPolicy host or CIDR allow rule`)}else if(g&&!_)throw Error(`Blocked: ${n.label} "${e}" is not authorized by networkPolicy`);let v=u(i)||u(s);if(r.protocol===`http:`&&!v){if(!t.allowInsecureHttp)throw Error(`Blocked: insecure HTTP requires networkPolicy.allowInsecureHttp for "${e}"`);if(!g||!_)throw Error(`Blocked: insecure HTTP target "${e}" requires an explicit networkPolicy host or CIDR allow rule`)}let y={},b=r.toString();if(n.rewriteHttpHostToResolvedIp&&r.protocol===`http:`&&o===0){let e=r.host,t=new URL(r.toString());t.hostname=s.includes(`:`)?`[${s}]`:s,b=t.toString(),y.Host=e}return{parsedUrl:r,resolvedIp:s,fetchUrl:b,headers:y}}var M=class{state;constructor(e){this.state=e}async handleApiProbeBatch(t){let n=typeof t.baseUrl==`string`?t.baseUrl.trim():``;if(n.length===0)return f.fail(`baseUrl is required and must be a non-empty string`).json();let r=A(t);if(!r.policy)return f.fail(r.error).json();let i,a={};try{let e=await j(n,r.policy,{label:`baseUrl`,rewriteHttpHostToResolvedIp:!0});i=e.fetchUrl.replace(/\/$/,``),a=e.headers}catch(e){return f.fail(e).json()}let u=i,d=t.paths,p=Array.isArray(d)?d:typeof d==`string`?(()=>{try{return JSON.parse(d)}catch{return[]}})():[],m=(o(t,`method`)??`GET`).toUpperCase(),h=s(t,`headers`)??{},g=o(t,`bodyTemplate`)??null,_=Array.isArray(t.includeBodyStatuses)?t.includeBodyStatuses.filter(e=>typeof e==`number`):[200,201,204],v=Math.max(0,Math.min(c(t,`maxBodySnippetLength`,500),1e4)),y=l(t,`autoInjectAuth`,!0);if(!p||p.length===0)return f.fail(`paths array is required and must not be empty`).json();let b=`(async function() {
-  var baseUrl = ${JSON.stringify(u)};
+})()`}];function _(e){let t={deps:e,scriptRegistry:new Map,bundleCache:new Map,bundleCacheBytes:0};return y(t.scriptRegistry),t}const v={BUNDLE_CACHE_TTL_MS:n,MAX_SCRIPTS:100,MAX_BUNDLE_CACHE:50,MAX_BUNDLE_CACHE_BYTES:t};function y(e){for(let t of g)e.set(t.name,{code:t.code,description:t.description,source:`core`,protectedFromEviction:!0})}function b(e){let t=Date.now();for(let[n,r]of e.bundleCache)t-r.cachedAt>=v.BUNDLE_CACHE_TTL_MS&&(e.bundleCacheBytes-=r.text.length,e.bundleCache.delete(n));for(;e.bundleCache.size>=v.MAX_BUNDLE_CACHE||e.bundleCacheBytes>v.MAX_BUNDLE_CACHE_BYTES;){let t=e.bundleCache.keys().next().value;if(t!==void 0){let n=e.bundleCache.get(t);n&&(e.bundleCacheBytes-=n.text.length),e.bundleCache.delete(t)}else break}}function x(e){return e.replace(/[<>/\u2028\u2029]/g,e=>{switch(e){case`<`:return`\\u003C`;case`>`:return`\\u003E`;case`/`:return`\\u002F`;case`\u2028`:return`\\u2028`;case`\u2029`:return`\\u2029`;default:return e}})}function S(e){return typeof e==`string`?e:void 0}function C(e){if(!(typeof e!=`object`||!e||Array.isArray(e)))return e}function w(e){return u.raw(e)}var T=class{state;constructor(e){this.state=e}async handlePageScriptRegister(e){let t=S(e.name),n=S(e.code),r=S(e.description)??``;if(!t||!n)return w({success:!1,error:`name and code are required`});let i=this.state.scriptRegistry.has(t);if(!i&&this.state.scriptRegistry.size>=v.MAX_SCRIPTS){for(let[e,t]of this.state.scriptRegistry)if(!t.protectedFromEviction){this.state.scriptRegistry.delete(e);break}}let a=this.state.scriptRegistry.get(t);return this.state.scriptRegistry.set(t,{code:n,description:r,source:a?.source??`user`,protectedFromEviction:a?.protectedFromEviction??!1}),w({success:!0,action:i?`updated`:`registered`,name:t,description:r,totalScripts:this.state.scriptRegistry.size,available:Array.from(this.state.scriptRegistry.keys())})}async handlePageScriptRun(t){let n=S(t.name),r=C(t.params),i=n?this.state.scriptRegistry.get(n):void 0;if(!i){let e=Array.from(this.state.scriptRegistry.keys());return w({success:!1,error:`Script "${n}" not found`,available:e})}let a;a=r===void 0?i.code:`(function(){const __params__=JSON.parse(${x(JSON.stringify(JSON.stringify(r)))});return(${i.code});})()`;try{return await this.state.deps.browserHandlers.handlePageEvaluate({code:a})}catch(t){return e.error(`[page_script_run] Script "${n}" failed:`,t),w({success:!1,script:n,error:t instanceof Error?t.message:String(t)})}}async handleListExtensionWorkflows(){let e=this.state.deps.serverContext;if(!e)return w({success:!1,error:`Extension workflow runtime is unavailable in this handler context`});let{ensureWorkflowsLoaded:t}=await import(`./index.mjs`).then(e=>e.t);await t(e);let n=[...e.extensionWorkflowsById.values()].filter(e=>e.route?.kind!==`preset`);n.sort((e,t)=>e.id.localeCompare(t.id));let r=n.map(e=>({id:e.id,displayName:e.displayName,description:e.description,tags:e.tags,timeoutMs:e.timeoutMs,defaultMaxConcurrency:e.defaultMaxConcurrency,source:e.source,route:e.route?{kind:e.route.kind,priority:e.route.priority,requiredDomains:e.route.requiredDomains,triggerPatterns:e.route.triggerPatterns.map(e=>e.source),steps:e.route.steps}:void 0}));return w({success:!0,count:r.length,workflows:r})}async handleRunExtensionWorkflow(t){let n=this.state.deps.serverContext;if(!n)return w({success:!1,error:`Extension workflow runtime is unavailable in this handler context`});let r=S(t.workflowId)??S(t.id);if(!r)return w({success:!1,error:`workflowId is required`});let{ensureWorkflowsLoaded:i}=await import(`./index.mjs`).then(e=>e.t);await i(n);let a=n.extensionWorkflowRuntimeById.get(r);if(!a){let e=[...n.extensionWorkflowsById.values()].filter(e=>e.route?.kind!==`preset`).map(e=>e.id);return e.sort((e,t)=>e.localeCompare(t)),w({success:!1,error:`Extension workflow "${r}" not found`,available:e})}if(a.route?.kind===`preset`)return w({success:!1,workflowId:r,error:`Extension workflow "${r}" is a routing preset and cannot be executed directly. Use route_tool or the suggested preset steps instead.`});let s=S(t.profile),l=C(t.config),u=o(t,`nodeInputOverrides`),d=c(t,`timeoutMs`);try{let{executeExtensionWorkflow:e}=await import(`./WorkflowEngine-CldHG5b4.mjs`).then(e=>e.t);return w({success:!0,...await e(n,a.workflow,{profile:s,config:l,nodeInputOverrides:u,timeoutMs:d})})}catch(t){return e.error(`[run_extension_workflow] Workflow "${r}" failed:`,t),w({success:!1,workflowId:r,error:t instanceof Error?t.message:String(t)})}}};function E(e){return e.trim().replace(/^\[|\]$/g,``).toLowerCase()}function D(e){if(e===void 0)return[];let t=typeof e==`string`?(()=>{try{return JSON.parse(e)}catch{return null}})():e;if(!Array.isArray(t))return null;let n=t.filter(e=>typeof e==`string`);return n.length===t.length?n.map(e=>e.trim()).filter(e=>e.length>0):null}function O(e){let t=e.trim(),n=t.includes(`://`)?t:`http://${t}`;try{let e=new URL(n);return e.port.length>0?{scope:`host`,value:e.host.toLowerCase()}:{scope:`hostname`,value:E(e.hostname)}}catch{return{scope:`hostname`,value:E(t)}}}function k(e,t){return e===void 0?{ok:!0,value:!1}:typeof e==`boolean`?{ok:!0,value:e}:{ok:!1,error:`${t} must be a boolean when provided`}}function A(e){let t=e.networkPolicy;if(t===void 0)return{policy:{allowPrivateNetwork:!1,allowInsecureHttp:!1,allowedHosts:[],allowedRedirectHosts:[],allowedCidrs:[],allowedCidrBlockList:new p}};let n=typeof t==`string`?(()=>{try{return JSON.parse(t)}catch{return null}})():t;if(!n||typeof n!=`object`||Array.isArray(n))return{error:`networkPolicy must be an object or valid JSON object string`};let r=n,i=k(r.allowPrivateNetwork,`networkPolicy.allowPrivateNetwork`);if(!i.ok)return{error:i.error};let a=k(r.allowInsecureHttp,`networkPolicy.allowInsecureHttp`);if(!a.ok)return{error:a.error};let o=D(r.allowedHosts);if(o===null)return{error:`networkPolicy.allowedHosts must be an array of strings`};let s=D(r.allowedRedirectHosts);if(s===null)return{error:`networkPolicy.allowedRedirectHosts must be an array of strings`};let c=D(r.allowedCidrs);if(c===null)return{error:`networkPolicy.allowedCidrs must be an array of strings`};let l=new p;for(let e of c){let[t,n]=e.split(`/`);if(!t||!n)return{error:`Invalid CIDR in networkPolicy.allowedCidrs: "${e}"`};let r=m(t);if(r===0)return{error:`Invalid CIDR base address in networkPolicy.allowedCidrs: "${e}"`};let i=Number(n),a=r===4?32:128;if(!Number.isInteger(i)||i<0||i>a)return{error:`Invalid CIDR prefix in networkPolicy.allowedCidrs: "${e}"`};l.addSubnet(t,i,r===4?`ipv4`:`ipv6`)}return{policy:{allowPrivateNetwork:i.value,allowInsecureHttp:a.value,allowedHosts:o.map(O),allowedRedirectHosts:s.map(O),allowedCidrs:c,allowedCidrBlockList:l}}}async function j(e,t,n){let r;try{r=new URL(e)}catch{throw Error(`Invalid ${n.label}: ${e}`)}if(r.protocol!==`http:`&&r.protocol!==`https:`)throw Error(`Unsupported protocol for ${n.label}: ${r.protocol} — only http/https allowed`);let i=E(r.hostname),a=r.host.toLowerCase(),o=m(i),s=o===0?await h(i).then(e=>e.address).catch(t=>{throw Error(`DNS resolution failed for "${e}"`,{cause:t})}):i,c=m(s),l=c!==0&&t.allowedCidrs.length>0&&t.allowedCidrBlockList.check(s,c===4?`ipv4`:`ipv6`),u=n.allowRedirectHosts&&t.allowedRedirectHosts.length>0?t.allowedRedirectHosts:t.allowedHosts,p=u.some(e=>e.scope===`host`?e.value===a:e.value===i),g=u.length>0||t.allowedCidrs.length>0,_=!g||p||l;if(f(i)||f(s)){if(!t.allowPrivateNetwork)throw Error(`Blocked: ${n.label} "${e}" resolves to a private/reserved address`);if(!g||!_)throw Error(`Blocked: ${n.label} "${e}" requires an explicit networkPolicy host or CIDR allow rule`)}else if(g&&!_)throw Error(`Blocked: ${n.label} "${e}" is not authorized by networkPolicy`);let v=d(i)||d(s);if(r.protocol===`http:`&&!v){if(!t.allowInsecureHttp)throw Error(`Blocked: insecure HTTP requires networkPolicy.allowInsecureHttp for "${e}"`);if(!g||!_)throw Error(`Blocked: insecure HTTP target "${e}" requires an explicit networkPolicy host or CIDR allow rule`)}let y={},b=r.toString();if(n.rewriteHttpHostToResolvedIp&&r.protocol===`http:`&&o===0){let e=r.host,t=new URL(r.toString());t.hostname=s.includes(`:`)?`[${s}]`:s,b=t.toString(),y.Host=e}return{parsedUrl:r,resolvedIp:s,fetchUrl:b,headers:y}}var M=class{state;constructor(e){this.state=e}async handleApiProbeBatch(t){let n=typeof t.baseUrl==`string`?t.baseUrl.trim():``;if(n.length===0)return u.fail(`baseUrl is required and must be a non-empty string`).json();let r=A(t);if(!r.policy)return u.fail(r.error).json();let i,a={};try{let e=await j(n,r.policy,{label:`baseUrl`,rewriteHttpHostToResolvedIp:!0});i=e.fetchUrl.replace(/\/$/,``),a=e.headers}catch(e){return u.fail(e).json()}let d=i,f=t.paths,p=Array.isArray(f)?f:typeof f==`string`?(()=>{try{return JSON.parse(f)}catch{return[]}})():[],m=(s(t,`method`)??`GET`).toUpperCase(),h=o(t,`headers`)??{},g=s(t,`bodyTemplate`)??null,_=Array.isArray(t.includeBodyStatuses)?t.includeBodyStatuses.filter(e=>typeof e==`number`):[200,201,204],v=Math.max(0,Math.min(c(t,`maxBodySnippetLength`,500),1e4)),y=l(t,`autoInjectAuth`,!0);if(!p||p.length===0)return u.fail(`paths array is required and must not be empty`).json();let b=`(async function() {
+  var baseUrl = ${JSON.stringify(d)};
   var paths = ${JSON.stringify(p)};
   var method = ${JSON.stringify(m)};
   var extraHeaders = ${JSON.stringify(h)};
@@ -98,4 +98,4 @@ import{t as e}from"./logger-sBC6IdRT.mjs";import{Jr as t,Kr as n,Xr as r,Yr as i
     }
   }));
   return {probed: paths.length, method: method, baseUrl: baseUrl, results: results};
-})()`;try{let e=await this.state.deps.browserHandlers.handlePageEvaluate({code:b}),t=f.parse(e);return f.ok().merge(t).json()}catch(t){return e.error(`[api_probe_batch] Error:`,t),f.fail(t).json()}}},N=class{state;constructor(e){this.state=e}async handleJsBundleSearch(e){let n=o(e,`url`,``),a=e.patterns,s=Array.isArray(a)?a:typeof a==`string`?(()=>{try{return JSON.parse(a)}catch{return[]}})():[],u=l(e,`cacheBundle`,!0),d=l(e,`stripNoise`,!0),p=c(e,`maxMatches`,10),m=A(e);if(!n||!s||s.length===0)return f.fail(`url and patterns are required`).json();if(!m.policy)return f.fail(m.error).json();let h=m.policy,g=r,_=i,y=async(e,t)=>{let n=e;for(let e=0;e<_;e++){let r=await j(n,h,{label:e===0?`bundle URL`:`redirect target`,allowRedirectHosts:e>0,rewriteHttpHostToResolvedIp:!0}),i=await fetch(r.fetchUrl,{signal:t,redirect:`manual`,headers:r.headers});if(i.status>=300&&i.status<400){let e=i.headers.get(`location`);if(!e)throw Error(`Redirect ${i.status} without Location header`);n=new URL(e,n).toString();continue}return i}throw Error(`Too many redirects (>${_})`)},x,S=!1;try{if(u){let e=this.state.bundleCache.get(n);if(e&&Date.now()-e.cachedAt<v.BUNDLE_CACHE_TTL_MS)x=e.text,S=!0;else{let e=new AbortController,r=setTimeout(()=>e.abort(),t);try{let t=await y(n,e.signal);if(!t.ok)return f.fail(`Fetch failed: ${t.status} ${t.statusText}`).merge({url:n}).json();if(x=await t.text(),x.length>g)return f.fail(`Response too large: ${x.length} bytes exceeds ${g} limit`).merge({url:n}).json();b(this.state),this.state.bundleCache.set(n,{text:x,cachedAt:Date.now()}),this.state.bundleCacheBytes+=x.length}finally{clearTimeout(r)}}}else{let e=new AbortController,t=setTimeout(()=>e.abort(),3e4);try{let t=await y(n,e.signal);if(!t.ok)return f.fail(`Fetch failed: ${t.status} ${t.statusText}`).merge({url:n}).json();if(x=await t.text(),x.length>g)return f.fail(`Response too large: ${x.length} bytes exceeds ${g} limit`).merge({url:n}).json()}finally{clearTimeout(t)}}}catch(e){return f.fail(e).merge({url:n}).json()}let C={};for(let e of s){let t=e.contextBefore??80,n=e.contextAfter??80,r;try{r=new RegExp(e.regex,`g`)}catch(t){C[e.name]=[{match:``,index:-1,context:`Invalid regex: ${t instanceof Error?t.message:String(t)}`}];continue}let i=[],a;for(;(a=r.exec(x))!==null;){let e=Math.max(0,a.index-t),r=Math.min(x.length,a.index+a[0].length+n),o=x.slice(e,r);if(!(d&&(/[Mm]\d{1,6}(?:\.\d+)?[, ]\d{1,6}(?:\.\d+)?[CLHVSQTAZclhvsqtaz]/.test(o)||/data:[a-z+-]+\/[a-z+-]+;base64,/i.test(o)||o.replace(/[^A-Za-z0-9+/=]/g,``).length>o.length*.85&&o.length>200))&&(i.push({match:a[0],index:a.index,context:o}),i.length>=p))break}C[e.name]=i}return f.ok().merge({bundleUrl:n,bundleSize:x.length,cached:S,patternsSearched:s.length,results:C}).json()}},P=class{scripts;api;account;constructor(e){let t=_(e);this.scripts=new T(t),this.api=new M(t),this.account=new N(t)}handlePageScriptRegister(e){return this.scripts.handlePageScriptRegister(e)}handlePageScriptRun(e){return this.scripts.handlePageScriptRun(e)}handleListExtensionWorkflows(){return this.scripts.handleListExtensionWorkflows()}handleRunExtensionWorkflow(e){return this.scripts.handleRunExtensionWorkflow(e)}handleApiProbeBatch(e){return this.api.handleApiProbeBatch(e)}handleJsBundleSearch(e){return this.account.handleJsBundleSearch(e)}};export{P as WorkflowHandlers};
+})()`;try{let e=await this.state.deps.browserHandlers.handlePageEvaluate({code:b}),t=u.parse(e);return u.ok().merge(t).json()}catch(t){return e.error(`[api_probe_batch] Error:`,t),u.fail(t).json()}}},N=class{state;constructor(e){this.state=e}async handleJsBundleSearch(e){let t=s(e,`url`,``),n=e.patterns,o=Array.isArray(n)?n:typeof n==`string`?(()=>{try{return JSON.parse(n)}catch{return[]}})():[],d=l(e,`cacheBundle`,!0),f=l(e,`stripNoise`,!0),p=c(e,`maxMatches`,10),m=A(e);if(!t||!o||o.length===0)return u.fail(`url and patterns are required`).json();if(!m.policy)return u.fail(m.error).json();let h=m.policy,g=r,_=i,y=async(e,t)=>{let n=e;for(let e=0;e<_;e++){let r=await j(n,h,{label:e===0?`bundle URL`:`redirect target`,allowRedirectHosts:e>0,rewriteHttpHostToResolvedIp:!0}),i=await fetch(r.fetchUrl,{signal:t,redirect:`manual`,headers:r.headers});if(i.status>=300&&i.status<400){let e=i.headers.get(`location`);if(!e)throw Error(`Redirect ${i.status} without Location header`);n=new URL(e,n).toString();continue}return i}throw Error(`Too many redirects (>${_})`)},x,S=!1;try{if(d){let e=this.state.bundleCache.get(t);if(e&&Date.now()-e.cachedAt<v.BUNDLE_CACHE_TTL_MS)x=e.text,S=!0;else{let e=new AbortController,n=setTimeout(()=>e.abort(),a);try{let n=await y(t,e.signal);if(!n.ok)return u.fail(`Fetch failed: ${n.status} ${n.statusText}`).merge({url:t}).json();if(x=await n.text(),x.length>g)return u.fail(`Response too large: ${x.length} bytes exceeds ${g} limit`).merge({url:t}).json();b(this.state),this.state.bundleCache.set(t,{text:x,cachedAt:Date.now()}),this.state.bundleCacheBytes+=x.length}finally{clearTimeout(n)}}}else{let e=new AbortController,n=setTimeout(()=>e.abort(),3e4);try{let n=await y(t,e.signal);if(!n.ok)return u.fail(`Fetch failed: ${n.status} ${n.statusText}`).merge({url:t}).json();if(x=await n.text(),x.length>g)return u.fail(`Response too large: ${x.length} bytes exceeds ${g} limit`).merge({url:t}).json()}finally{clearTimeout(n)}}}catch(e){return u.fail(e).merge({url:t}).json()}let C={};for(let e of o){let t=e.contextBefore??80,n=e.contextAfter??80,r;try{r=new RegExp(e.regex,`g`)}catch(t){C[e.name]=[{match:``,index:-1,context:`Invalid regex: ${t instanceof Error?t.message:String(t)}`}];continue}let i=[],a;for(;(a=r.exec(x))!==null;){let e=Math.max(0,a.index-t),r=Math.min(x.length,a.index+a[0].length+n),o=x.slice(e,r);if(!(f&&(/[Mm]\d{1,6}(?:\.\d+)?[, ]\d{1,6}(?:\.\d+)?[CLHVSQTAZclhvsqtaz]/.test(o)||/data:[a-z+-]+\/[a-z+-]+;base64,/i.test(o)||o.replace(/[^A-Za-z0-9+/=]/g,``).length>o.length*.85&&o.length>200))&&(i.push({match:a[0],index:a.index,context:o}),i.length>=p))break}C[e.name]=i}return u.ok().merge({bundleUrl:t,bundleSize:x.length,cached:S,patternsSearched:o.length,results:C}).json()}},P=class{scripts;api;account;constructor(e){let t=_(e);this.scripts=new T(t),this.api=new M(t),this.account=new N(t)}handlePageScriptRegister(e){return this.scripts.handlePageScriptRegister(e)}handlePageScriptRun(e){return this.scripts.handlePageScriptRun(e)}handleListExtensionWorkflows(){return this.scripts.handleListExtensionWorkflows()}handleRunExtensionWorkflow(e){return this.scripts.handleRunExtensionWorkflow(e)}handleApiProbeBatch(e){return this.api.handleApiProbeBatch(e)}handleJsBundleSearch(e){return this.account.handleJsBundleSearch(e)}};export{P as WorkflowHandlers};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jshookmcp/jshook",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "MCP server with built-in tools across multiple domains for AI-assisted JavaScript analysis and security analysis — browser automation, CDP debugging, network monitoring, JS hooks, code analysis, and workflow orchestration",
   "keywords": [
     "ai",
@@ -74,40 +74,41 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "dotenv": "^17.4.1",
     "jsdom": "^29.0.2",
-    "koffi": "^2.15.6",
-    "mockttp": "^4.3.1",
+    "koffi": "^3.0.1",
+    "mockttp": "^4.4.2",
     "quickjs-emscripten": "^0.32.0",
     "rebrowser-puppeteer-core": "^24.8.1",
-    "tinyglobby": "^0.2.16",
+    "yauzl": "^3.3.1",
     "zod": "^4.3.6"
   },
   "devDependencies": {
     "@types/babel__generator": "^7.27.0",
     "@types/babel__traverse": "^7.28.0",
     "@types/better-sqlite3": "^7.6.13",
-    "@types/jsdom": "^28.0.1",
-    "@types/node": "^25.5.2",
-    "@vitest/coverage-v8": "^4.1.4",
+    "@types/jsdom": "^28.0.3",
+    "@types/node": "^25.9.1",
+    "@vitest/coverage-v8": "^4.1.7",
     "cross-env": "^10.1.0",
-    "lefthook": "^2.1.5",
+    "lefthook": "^2.1.8",
     "medium-zoom": "^1.1.0",
-    "oxfmt": "^0.48.0",
-    "oxlint": "^1.59.0",
+    "oxfmt": "^0.53.0",
+    "oxlint": "^1.66.0",
     "rollup-plugin-visualizer": "^7.0.1",
+    "tinyglobby": "^0.2.16",
     "tsdown": "^0.22.0",
-    "tsx": "^4.21.0",
+    "tsx": "^4.22.3",
     "typescript": "^6.0.2",
-    "vite": "^8.0.8",
+    "vite": "^8.0.14",
     "vitepress": "1.6.4",
-    "vitest": "^4.1.4",
+    "vitest": "^4.1.7",
     "vue": "^3.5.32"
   },
   "optionalDependencies": {
     "@devicefarmer/adbkit": "^3.3.8",
     "@huggingface/transformers": "^4.0.1",
-    "better-sqlite3": "12.9.0",
+    "better-sqlite3": "12.10.0",
     "camoufox-js": "^0.10.2",
-    "playwright-core": "^1.59.1",
+    "playwright-core": "^1.60.0",
     "webcrack": "2.16.0"
   },
   "engines": {

package/src/native/scripts/linux/enum-windows.sh

@@ -1,12 +1,12 @@
-#!/bin/bash
-# enum-windows.sh
-# Linux window enumeration script (placeholder)
-
-TARGET_PID=$1
-
-# Use xdotool or wmctrl for window enumeration
-# This is a placeholder for future implementation
-
-if command -v xdotool &> /dev/null; then
-    xdotool search --pid "$TARGET_PID" --name "" get-window-name
-fi
+#!/bin/bash
+# enum-windows.sh
+# Linux window enumeration script (placeholder)
+
+TARGET_PID=$1
+
+# Use xdotool or wmctrl for window enumeration
+# This is a placeholder for future implementation
+
+if command -v xdotool &> /dev/null; then
+    xdotool search --pid "$TARGET_PID" --name "" get-window-name
+fi

package/src/native/scripts/macos/enum-windows.applescript

@@ -1,22 +1,22 @@
--- enum-windows.applescript
--- macOS window enumeration script (placeholder)
-
-param TargetPid
-
--- AppleScript implementation for window enumeration
--- This is a placeholder for future implementation
-
-tell application "System Events"
-    set windowList to {}
-    repeat with proc in (every process whose unix id is TargetPid)
-        repeat with win in windows of proc
-            set end of windowList to {¬
-                title: name of win, ¬
-                position: position of win, ¬
-                size: size of win ¬
-            }
-        end repeat
-    end repeat
-end tell
-
-return windowList
+-- enum-windows.applescript
+-- macOS window enumeration script (placeholder)
+
+param TargetPid
+
+-- AppleScript implementation for window enumeration
+-- This is a placeholder for future implementation
+
+tell application "System Events"
+    set windowList to {}
+    repeat with proc in (every process whose unix id is TargetPid)
+        repeat with win in windows of proc
+            set end of windowList to {¬
+                title: name of win, ¬
+                position: position of win, ¬
+                size: size of win ¬
+            }
+        end repeat
+    end repeat
+end tell
+
+return windowList

package/dist/CodeInjector-BlgyqTOk.mjs

@@ -1 +0,0 @@
-import{A as e}from"./constants-Cp6hBrrx.mjs";import{t}from"./ToolError-DWU_z7gp.mjs";import{_ as n,b as r,d as i,f as a,h as o,l as s,m as c,p as l,t as u,u as d}from"./Win32API-Bhi5xFBe.mjs";import{l as f}from"./Win32Debug-CQteFL4F.mjs";import{n as p}from"./NativeMemoryManager.utils-DM4NC3FE.mjs";import{t as m}from"./NativeMemoryManager.impl-CI554XbY.mjs";import{randomUUID as h}from"node:crypto";var g=class{patches=new Map;async patchBytes(e,t,a){let o=BigInt(t.startsWith(`0x`)?t:`0x${t}`),s=Buffer.from(a),l=r(e,!0);try{let t=i(l,o,s.length),{success:r,oldProtect:u}=c(l,o,s.length,d.EXECUTE_READWRITE);n(l,o,s),f(l,o,s.length),r&&c(l,o,s.length,u);let p={id:h(),pid:e,address:`0x${o.toString(16).toUpperCase()}`,originalBytes:Array.from(t),patchBytes:a,isApplied:!0,timestamp:Date.now()};return this.patches.set(p.id,p),p}finally{u(l)}}async unpatch(e){let t=this.patches.get(e);if(!t?.isApplied)return!1;let i=BigInt(t.address),a=Buffer.from(t.originalBytes),o=r(t.pid,!0);try{let{oldProtect:e}=c(o,i,a.length,d.EXECUTE_READWRITE);return n(o,i,a),f(o,i,a.length),c(o,i,a.length,e),t.isApplied=!1,!0}finally{u(o)}}async nopBytes(e,t,n){let r=Array.from({length:n},()=>144);return this.patchBytes(e,t,r)}async findCodeCaves(t,n){let a=n??e,s=[],c=r(t,!1);try{let e=await m.enumerateModules(t);if(!e.success||!e.modules)return s;for(let t of e.modules){let e=BigInt(t.baseAddress.startsWith(`0x`)?t.baseAddress:`0x${t.baseAddress}`),n=e,r=e+BigInt(t.size);for(;n<r;){let{success:e,info:r}=o(c,n);if(!e||r.RegionSize===0n)break;let l=Number(r.RegionSize);if(p(r.Protect)&&l>0)try{let e=i(c,r.BaseAddress,Math.min(l,4*1024*1024)),n=-1;for(let i=0;i<e.length;i++){let o=e[i];if(o===0||o===204)n===-1&&(n=i);else if(n!==-1){let e=i-n;if(e>=a){let i=r.BaseAddress+BigInt(n);s.push({address:`0x${i.toString(16).toUpperCase()}`,size:e,module:t.name,section:`.text`})}n=-1}}if(n!==-1){let i=e.length-n;if(i>=a){let e=r.BaseAddress+BigInt(n);s.push({address:`0x${e.toString(16).toUpperCase()}`,size:i,module:t.name,section:`.text`})}}}catch{}n=r.BaseAddress+r.RegionSize}}}finally{u(c)}return s.toSorted((e,t)=>t.size-e.size)}async allocateRemote(e,n){let i=r(e,!0);try{let e=a(i,0n,n,s.COMMIT|s.RESERVE,d.EXECUTE_READWRITE);if(e===0n)throw new t(`RUNTIME`,`VirtualAllocEx failed`);return`0x${e.toString(16).toUpperCase()}`}finally{u(i)}}async freeRemote(e,t,n){let i=BigInt(t.startsWith(`0x`)?t:`0x${t}`),a=r(e,!0);try{return l(a,i,0,s.RELEASE)}finally{u(a)}}listPatches(){return Array.from(this.patches.values())}};const _=new g;export{g as CodeInjector,_ as codeInjector};