@jshookmcp/jshook 0.3.2 → 0.3.4

package/dist/workflow-BdwQmARn.mjs

@@ -1,101 +0,0 @@
-import{t as e}from"./logger-sBC6IdRT.mjs";import{_i as t,bi as n,vi as r,xi as i,yi as a}from"./constants-BYj8Xek8.mjs";import{a as o,i as s,r as c,t as l}from"./parse-args-Bw413PlW.mjs";import{t as u}from"./ResponseBuilder-BfWP-uaT.mjs";import{a as d,s as f}from"./ssrf-policy-CsIJGkpd.mjs";import"./definitions-Ibci7e_L.mjs";import{BlockList as p,isIP as m}from"node:net";import{lookup as h}from"node:dns/promises";const g=[{name:`auth_extract`,description:`Extract auth tokens from localStorage and cookies`,code:`(function(){
-  var keys=['token','active_token','access_token','jwt','auth_token','userRole','id_token','refresh_token'];
-  var r={};
-  for(var i=0;i<keys.length;i++){var v=localStorage.getItem(keys[i]);if(v)r[keys[i]]=v;}
-  r._cookies=document.cookie;
-  return r;
-})()`},{name:`bundle_search`,description:`Fetch a remote JS bundle and search it with regex patterns. params: { url: string, patterns: string[] }`,code:`(async function(){
-  var p=typeof __params__!=='undefined'?__params__:{};
-  if(!p.url)return{error:'params.url required'};
-  var resp=await fetch(p.url);
-  var text=await resp.text();
-  var patterns=p.patterns||[];
-  var results={};
-  for(var i=0;i<patterns.length;i++){
-    var re=new RegExp(patterns[i],'g');
-    var matches=[];var m;
-    while((m=re.exec(text))!==null){
-      var s=Math.max(0,m.index-80),e=Math.min(text.length,m.index+m[0].length+80);
-      matches.push({match:m[0],ctx:text.slice(s,e)});
-      if(matches.length>=10)break;
-    }
-    results[patterns[i]]=matches;
-  }
-  return{size:text.length,results:results};
-})()`},{name:`react_fill_form`,description:`Fill React controlled form inputs using native setter trick. params: { fields: { "selector": "value" } }`,code:`(function(){
-  var p=typeof __params__!=='undefined'?__params__:{};
-  var fields=p.fields||{};
-  var ns=Object.getOwnPropertyDescriptor(window.HTMLInputElement.prototype,'value').set;
-  var r={};
-  var entries=Object.entries(fields);
-  for(var i=0;i<entries.length;i++){
-    var sel=entries[i][0],val=entries[i][1];
-    var el=document.querySelector(sel);
-    if(!el){r[sel]='not found';continue;}
-    ns.call(el,val);
-    el.dispatchEvent(new Event('input',{bubbles:true}));
-    el.dispatchEvent(new Event('change',{bubbles:true}));
-    r[sel]='filled';
-  }
-  return r;
-})()`},{name:`dom_find_upgrade_buttons`,description:`Scan the current page for upgrade/subscription/tier-related UI elements`,code:`(function(){
-  var kw=['upgrade','plus','pro','premium','subscribe','plan','tier','vip','membership'];
-  var r=[];
-  document.querySelectorAll('button,a,[role=button],[class*=upgrade],[class*=premium],[class*=plus]').forEach(function(el){
-    var t=(el.textContent||'').toLowerCase().trim();
-    var c=(el.className||'').toLowerCase();
-    if(kw.some(function(k){return t.includes(k)||c.includes(k);})){
-      r.push({tag:el.tagName,text:t.slice(0,120),cls:c.slice(0,100),href:el.href||null,id:el.id||null});
-    }
-  });
-  return r;
-})()`}];function _(e){let t={deps:e,scriptRegistry:new Map,bundleCache:new Map,bundleCacheBytes:0};return y(t.scriptRegistry),t}const v={BUNDLE_CACHE_TTL_MS:r,MAX_SCRIPTS:100,MAX_BUNDLE_CACHE:50,MAX_BUNDLE_CACHE_BYTES:t};function y(e){for(let t of g)e.set(t.name,{code:t.code,description:t.description,source:`core`,protectedFromEviction:!0})}function b(e){let t=Date.now();for(let[n,r]of e.bundleCache)t-r.cachedAt>=v.BUNDLE_CACHE_TTL_MS&&(e.bundleCacheBytes-=r.text.length,e.bundleCache.delete(n));for(;e.bundleCache.size>=v.MAX_BUNDLE_CACHE||e.bundleCacheBytes>v.MAX_BUNDLE_CACHE_BYTES;){let t=e.bundleCache.keys().next().value;if(t!==void 0){let n=e.bundleCache.get(t);n&&(e.bundleCacheBytes-=n.text.length),e.bundleCache.delete(t)}else break}}function x(e){return e.replace(/[<>/\u2028\u2029]/g,e=>{switch(e){case`<`:return`\\u003C`;case`>`:return`\\u003E`;case`/`:return`\\u002F`;case`\u2028`:return`\\u2028`;case`\u2029`:return`\\u2029`;default:return e}})}function S(e){return typeof e==`string`?e:void 0}function C(e){if(!(typeof e!=`object`||!e||Array.isArray(e)))return e}function w(e){return u.raw(e)}var T=class{state;constructor(e){this.state=e}async handlePageScriptRegister(e){let t=S(e.name),n=S(e.code),r=S(e.description)??``;if(!t||!n)return w({success:!1,error:`name and code are required`});let i=this.state.scriptRegistry.has(t);if(!i&&this.state.scriptRegistry.size>=v.MAX_SCRIPTS){for(let[e,t]of this.state.scriptRegistry)if(!t.protectedFromEviction){this.state.scriptRegistry.delete(e);break}}let a=this.state.scriptRegistry.get(t);return this.state.scriptRegistry.set(t,{code:n,description:r,source:a?.source??`user`,protectedFromEviction:a?.protectedFromEviction??!1}),w({success:!0,action:i?`updated`:`registered`,name:t,description:r,totalScripts:this.state.scriptRegistry.size,available:Array.from(this.state.scriptRegistry.keys())})}async handlePageScriptRun(t){let n=S(t.name),r=C(t.params),i=n?this.state.scriptRegistry.get(n):void 0;if(!i){let e=Array.from(this.state.scriptRegistry.keys());return w({success:!1,error:`Script "${n}" not found`,available:e})}let a;a=r===void 0?i.code:`(function(){const __params__=JSON.parse(${x(JSON.stringify(JSON.stringify(r)))});return(${i.code});})()`;try{return await this.state.deps.browserHandlers.handlePageEvaluate({code:a})}catch(t){return e.error(`[page_script_run] Script "${n}" failed:`,t),w({success:!1,script:n,error:t instanceof Error?t.message:String(t)})}}async handleListExtensionWorkflows(){let e=this.state.deps.serverContext;if(!e)return w({success:!1,error:`Extension workflow runtime is unavailable in this handler context`});let{ensureWorkflowsLoaded:t}=await import(`./ExtensionManager-BD724zkO.mjs`).then(e=>e.t);await t(e);let n=[...e.extensionWorkflowsById.values()].filter(e=>e.route?.kind!==`preset`);n.sort((e,t)=>e.id.localeCompare(t.id));let r=n.map(e=>({id:e.id,displayName:e.displayName,description:e.description,tags:e.tags,timeoutMs:e.timeoutMs,defaultMaxConcurrency:e.defaultMaxConcurrency,source:e.source,route:e.route?{kind:e.route.kind,priority:e.route.priority,requiredDomains:e.route.requiredDomains,triggerPatterns:e.route.triggerPatterns.map(e=>e.source),steps:e.route.steps}:void 0}));return w({success:!0,count:r.length,workflows:r})}async handleRunExtensionWorkflow(t){let n=this.state.deps.serverContext;if(!n)return w({success:!1,error:`Extension workflow runtime is unavailable in this handler context`});let r=S(t.workflowId)??S(t.id);if(!r)return w({success:!1,error:`workflowId is required`});let{ensureWorkflowsLoaded:i}=await import(`./ExtensionManager-BD724zkO.mjs`).then(e=>e.t);await i(n);let a=n.extensionWorkflowRuntimeById.get(r);if(!a){let e=[...n.extensionWorkflowsById.values()].filter(e=>e.route?.kind!==`preset`).map(e=>e.id);return e.sort((e,t)=>e.localeCompare(t)),w({success:!1,error:`Extension workflow "${r}" not found`,available:e})}if(a.route?.kind===`preset`)return w({success:!1,workflowId:r,error:`Extension workflow "${r}" is a routing preset and cannot be executed directly. Use route_tool or the suggested preset steps instead.`});let o=S(t.profile),l=C(t.config),u=s(t,`nodeInputOverrides`),d=c(t,`timeoutMs`);try{let{executeExtensionWorkflow:e}=await import(`./WorkflowEngine-D876meOO.mjs`).then(e=>e.t);return w({success:!0,...await e(n,a.workflow,{profile:o,config:l,nodeInputOverrides:u,timeoutMs:d})})}catch(t){return e.error(`[run_extension_workflow] Workflow "${r}" failed:`,t),w({success:!1,workflowId:r,error:t instanceof Error?t.message:String(t)})}}};function E(e){return e.trim().replace(/^\[|\]$/g,``).toLowerCase()}function D(e){if(e===void 0)return[];let t=typeof e==`string`?(()=>{try{return JSON.parse(e)}catch{return null}})():e;if(!Array.isArray(t))return null;let n=t.filter(e=>typeof e==`string`);return n.length===t.length?n.map(e=>e.trim()).filter(e=>e.length>0):null}function O(e){let t=e.trim(),n=t.includes(`://`)?t:`http://${t}`;try{let e=new URL(n);return e.port.length>0?{scope:`host`,value:e.host.toLowerCase()}:{scope:`hostname`,value:E(e.hostname)}}catch{return{scope:`hostname`,value:E(t)}}}function k(e,t){return e===void 0?{ok:!0,value:!1}:typeof e==`boolean`?{ok:!0,value:e}:{ok:!1,error:`${t} must be a boolean when provided`}}function A(e){let t=e.networkPolicy;if(t===void 0)return{policy:{allowPrivateNetwork:!1,allowInsecureHttp:!1,allowedHosts:[],allowedRedirectHosts:[],allowedCidrs:[],allowedCidrBlockList:new p}};let n=typeof t==`string`?(()=>{try{return JSON.parse(t)}catch{return null}})():t;if(!n||typeof n!=`object`||Array.isArray(n))return{error:`networkPolicy must be an object or valid JSON object string`};let r=n,i=k(r.allowPrivateNetwork,`networkPolicy.allowPrivateNetwork`);if(!i.ok)return{error:i.error};let a=k(r.allowInsecureHttp,`networkPolicy.allowInsecureHttp`);if(!a.ok)return{error:a.error};let o=D(r.allowedHosts);if(o===null)return{error:`networkPolicy.allowedHosts must be an array of strings`};let s=D(r.allowedRedirectHosts);if(s===null)return{error:`networkPolicy.allowedRedirectHosts must be an array of strings`};let c=D(r.allowedCidrs);if(c===null)return{error:`networkPolicy.allowedCidrs must be an array of strings`};let l=new p;for(let e of c){let[t,n]=e.split(`/`);if(!t||!n)return{error:`Invalid CIDR in networkPolicy.allowedCidrs: "${e}"`};let r=m(t);if(r===0)return{error:`Invalid CIDR base address in networkPolicy.allowedCidrs: "${e}"`};let i=Number(n),a=r===4?32:128;if(!Number.isInteger(i)||i<0||i>a)return{error:`Invalid CIDR prefix in networkPolicy.allowedCidrs: "${e}"`};l.addSubnet(t,i,r===4?`ipv4`:`ipv6`)}return{policy:{allowPrivateNetwork:i.value,allowInsecureHttp:a.value,allowedHosts:o.map(O),allowedRedirectHosts:s.map(O),allowedCidrs:c,allowedCidrBlockList:l}}}async function j(e,t,n){let r;try{r=new URL(e)}catch{throw Error(`Invalid ${n.label}: ${e}`)}if(r.protocol!==`http:`&&r.protocol!==`https:`)throw Error(`Unsupported protocol for ${n.label}: ${r.protocol} — only http/https allowed`);let i=E(r.hostname),a=r.host.toLowerCase(),o=m(i),s=o===0?await h(i).then(e=>e.address).catch(t=>{throw Error(`DNS resolution failed for "${e}"`,{cause:t})}):i,c=m(s),l=c!==0&&t.allowedCidrs.length>0&&t.allowedCidrBlockList.check(s,c===4?`ipv4`:`ipv6`),u=n.allowRedirectHosts&&t.allowedRedirectHosts.length>0?t.allowedRedirectHosts:t.allowedHosts,p=u.some(e=>e.scope===`host`?e.value===a:e.value===i),g=u.length>0||t.allowedCidrs.length>0,_=!g||p||l;if(f(i)||f(s)){if(!t.allowPrivateNetwork)throw Error(`Blocked: ${n.label} "${e}" resolves to a private/reserved address`);if(!g||!_)throw Error(`Blocked: ${n.label} "${e}" requires an explicit networkPolicy host or CIDR allow rule`)}else if(g&&!_)throw Error(`Blocked: ${n.label} "${e}" is not authorized by networkPolicy`);let v=d(i)||d(s);if(r.protocol===`http:`&&!v){if(!t.allowInsecureHttp)throw Error(`Blocked: insecure HTTP requires networkPolicy.allowInsecureHttp for "${e}"`);if(!g||!_)throw Error(`Blocked: insecure HTTP target "${e}" requires an explicit networkPolicy host or CIDR allow rule`)}let y={},b=r.toString();if(n.rewriteHttpHostToResolvedIp&&r.protocol===`http:`&&o===0){let e=r.host,t=new URL(r.toString());t.hostname=s.includes(`:`)?`[${s}]`:s,b=t.toString(),y.Host=e}return{parsedUrl:r,resolvedIp:s,fetchUrl:b,headers:y}}var M=class{state;constructor(e){this.state=e}async handleApiProbeBatch(t){let n=typeof t.baseUrl==`string`?t.baseUrl.trim():``;if(n.length===0)return u.fail(`baseUrl is required and must be a non-empty string`).json();let r=A(t);if(!r.policy)return u.fail(r.error).json();let i,a={};try{let e=await j(n,r.policy,{label:`baseUrl`,rewriteHttpHostToResolvedIp:!0});i=e.fetchUrl.replace(/\/$/,``),a=e.headers}catch(e){return u.fail(e).json()}let d=i,f=t.paths,p=Array.isArray(f)?f:typeof f==`string`?(()=>{try{return JSON.parse(f)}catch{return[]}})():[],m=(o(t,`method`)??`GET`).toUpperCase(),h=s(t,`headers`)??{},g=o(t,`bodyTemplate`)??null,_=Array.isArray(t.includeBodyStatuses)?t.includeBodyStatuses.filter(e=>typeof e==`number`):[200,201,204],v=Math.max(0,Math.min(c(t,`maxBodySnippetLength`,500),1e4)),y=l(t,`autoInjectAuth`,!0);if(!p||p.length===0)return u.fail(`paths array is required and must not be empty`).json();let b=`(async function() {
-  var baseUrl = ${JSON.stringify(d)};
-  var paths = ${JSON.stringify(p)};
-  var method = ${JSON.stringify(m)};
-  var extraHeaders = ${JSON.stringify(h)};
-  var includeBodyStatuses = ${JSON.stringify(_)};
-  var maxSnippetLen = ${JSON.stringify(v)};
-  var autoInjectAuth = ${JSON.stringify(y)};
-  var bodyTemplate = ${JSON.stringify(g)};
-  var authHeaders = ${JSON.stringify(a)};
-  var headers = Object.assign({'Content-Type':'application/json'}, extraHeaders, authHeaders);
-  if (autoInjectAuth) {
-    var token = localStorage.getItem('token') || localStorage.getItem('active_token') || localStorage.getItem('access_token');
-    if (token) headers['Authorization'] = 'Bearer ' + token;
-  }
-  var results = {};
-  async function probePath(path) {
-    try {
-      var opts = {method: method, headers: headers, redirect: 'error'};
-      if (bodyTemplate && (method === 'POST' || method === 'PUT' || method === 'PATCH')) {
-        opts.body = bodyTemplate;
-      }
-      var resp = await fetch(baseUrl + path, opts);
-      var ct = resp.headers.get('content-type') || '';
-      var snippet = null;
-      if (includeBodyStatuses.indexOf(resp.status) !== -1) {
-        var text = await resp.text();
-        if (!ct.includes('text/html') && !ct.includes('application/xml')) {
-          snippet = text.length > maxSnippetLen ? text.slice(0, maxSnippetLen) + '...[truncated]' : text;
-        } else {
-          snippet = '[HTML/XML response suppressed]';
-        }
-      }
-      return [path, {status: resp.status, contentType: ct.split(';')[0].trim(), snippet: snippet}];
-    } catch(e) {
-      return [path, {status: -1, error: e instanceof Error ? e.message : String(e)}];
-    }
-  }
-  var nextIndex = 0;
-  var maxConcurrency = Math.min(paths.length, 6);
-  await Promise.all(Array.from({ length: maxConcurrency }, async function() {
-    while (nextIndex < paths.length) {
-      var currentIndex = nextIndex++;
-      var currentPath = paths[currentIndex];
-      var entry = await probePath(currentPath);
-      results[entry[0]] = entry[1];
-    }
-  }));
-  return {probed: paths.length, method: method, baseUrl: baseUrl, results: results};
-})()`;try{let e=await this.state.deps.browserHandlers.handlePageEvaluate({code:b}),t=u.parse(e);return u.ok().merge(t).json()}catch(t){return e.error(`[api_probe_batch] Error:`,t),u.fail(t).json()}}},N=class{state;constructor(e){this.state=e}async handleJsBundleSearch(e){let t=o(e,`url`,``),r=e.patterns,s=Array.isArray(r)?r:typeof r==`string`?(()=>{try{return JSON.parse(r)}catch{return[]}})():[],d=l(e,`cacheBundle`,!0),f=l(e,`stripNoise`,!0),p=c(e,`maxMatches`,10),m=A(e);if(!t||!s||s.length===0)return u.fail(`url and patterns are required`).json();if(!m.policy)return u.fail(m.error).json();let h=m.policy,g=i,_=n,y=async(e,t)=>{let n=e;for(let e=0;e<_;e++){let r=await j(n,h,{label:e===0?`bundle URL`:`redirect target`,allowRedirectHosts:e>0,rewriteHttpHostToResolvedIp:!0}),i=await fetch(r.fetchUrl,{signal:t,redirect:`manual`,headers:r.headers});if(i.status>=300&&i.status<400){let e=i.headers.get(`location`);if(!e)throw Error(`Redirect ${i.status} without Location header`);n=new URL(e,n).toString();continue}return i}throw Error(`Too many redirects (>${_})`)},x,S=!1;try{if(d){let e=this.state.bundleCache.get(t);if(e&&Date.now()-e.cachedAt<v.BUNDLE_CACHE_TTL_MS)x=e.text,S=!0;else{let e=new AbortController,n=setTimeout(()=>e.abort(),a);try{let n=await y(t,e.signal);if(!n.ok)return u.fail(`Fetch failed: ${n.status} ${n.statusText}`).merge({url:t}).json();if(x=await n.text(),x.length>g)return u.fail(`Response too large: ${x.length} bytes exceeds ${g} limit`).merge({url:t}).json();b(this.state),this.state.bundleCache.set(t,{text:x,cachedAt:Date.now()}),this.state.bundleCacheBytes+=x.length}finally{clearTimeout(n)}}}else{let e=new AbortController,n=setTimeout(()=>e.abort(),3e4);try{let n=await y(t,e.signal);if(!n.ok)return u.fail(`Fetch failed: ${n.status} ${n.statusText}`).merge({url:t}).json();if(x=await n.text(),x.length>g)return u.fail(`Response too large: ${x.length} bytes exceeds ${g} limit`).merge({url:t}).json()}finally{clearTimeout(n)}}}catch(e){return u.fail(e).merge({url:t}).json()}let C={};for(let e of s){let t=e.contextBefore??80,n=e.contextAfter??80,r;try{r=new RegExp(e.regex,`g`)}catch(t){C[e.name]=[{match:``,index:-1,context:`Invalid regex: ${t instanceof Error?t.message:String(t)}`}];continue}let i=[],a;for(;(a=r.exec(x))!==null;){let e=Math.max(0,a.index-t),r=Math.min(x.length,a.index+a[0].length+n),o=x.slice(e,r);if(!(f&&(/[Mm]\d{1,6}(?:\.\d+)?[, ]\d{1,6}(?:\.\d+)?[CLHVSQTAZclhvsqtaz]/.test(o)||/data:[a-z+-]+\/[a-z+-]+;base64,/i.test(o)||o.replace(/[^A-Za-z0-9+/=]/g,``).length>o.length*.85&&o.length>200))&&(i.push({match:a[0],index:a.index,context:o}),i.length>=p))break}C[e.name]=i}return u.ok().merge({bundleUrl:t,bundleSize:x.length,cached:S,patternsSearched:s.length,results:C}).json()}},P=class{scripts;api;account;constructor(e){let t=_(e);this.scripts=new T(t),this.api=new M(t),this.account=new N(t)}handlePageScriptRegister(e){return this.scripts.handlePageScriptRegister(e)}handlePageScriptRun(e){return this.scripts.handlePageScriptRun(e)}handleListExtensionWorkflows(){return this.scripts.handleListExtensionWorkflows()}handleRunExtensionWorkflow(e){return this.scripts.handleRunExtensionWorkflow(e)}handleApiProbeBatch(e){return this.api.handleApiProbeBatch(e)}handleJsBundleSearch(e){return this.account.handleJsBundleSearch(e)}};export{P as WorkflowHandlers};