v0.2.0 — worker hooks, binding transport, real CLI

webcrypto-interceptor v0.2.0

The capture engine grew real worker visibility, a structured event transport, and a proper CLI. Six commits of fixes, architecture, and packaging since the initial public state.

✨ New features

Real worker hooks — dedicated, shared, and service workers are now attached as CDP targets (Target.setAutoAttach, flatten mode), so crypto.subtle breakpoints and in-page hooks run inside worker scopes. OOPIFs get their own sessions too. Previously, any site doing crypto in a worker was a blind spot — a common pattern for key derivation.

Structured event transport — in-page hooks now emit through Runtime.addBinding instead of console.log tunneling. Events are JSON, chunked automatically for large payloads (WASM hex reassembly), deduplicated by uid, and the legacy console path is kept as a fallback for older Chrome builds.

Real CLI — node capture_server.js parses arguments properly:

node capture_server.js --gui https://example.com   # visible browser
node capture_server.js --full https://example.com  # frontend extraction
node capture_server.js --out ./sessions --timeout 120000 \
     --ua "Mozilla/5.0 ..." --proxy http://127.0.0.1:8080 --all-traffic

--help works before npm install (puppeteer is required lazily).

Session summary — stopping a capture with Ctrl+C now prints and saves a markdown summary: capture counts per tag, extracted keys, WASM dumps, secrets found.

🐞 Fixes

• HLS .key files captured again — application/octet-stream responses were filtered out before the RAW-AES-KEY detector ran; key/manifest URLs are now exempt from the content-type filter.
• Breakpoint/context leak — long SPA sessions added 12 debugger breakpoints per execution context without ever removing them; per-context bookkeeping now cleans up on executionContextDestroyed and releases remote object IDs.
• --full file collisions — URLs differing only in query string no longer overwrite each other (query-hash suffix); Windows reserved device names (CON, NUL, ...) are sanitized; output paths stay inside the target directory.
• No more data loss on Ctrl+C — the JSONL session log is flushed and closed before exit instead of process.exit(0) cutting the stream tail.
• Invalid openssl invocation in extract-keys.js — cipher is now selected from the detected key length (aes-128/192/256-cbc).
• _rendered.html snapshot on navigation timeout — moved to a finally block so a slow site still yields its DOM.

📦 Packaging & docs

• MIT LICENSE (the repo previously had none) with a responsible-use notice.
• 45 tests (node:test, zero dependencies, no Chrome): decoders, secrets scanner, key extraction, path traversal safety, CLI parsing, event transport.
• CI — GitHub Actions, 3 OS × Node 18/20/22, syntax-check on every source file.
• ESLint flat config; npm run lint.
• package.json full metadata + bin field (future npx webcrypto-interceptor).
• README rewritten: accurate Node requirement (18+, was 16), full tag table, CLI reference, architecture notes.

⬆️ Upgrading

No API to break yet — pull and run. Node 18+ is required.

git clone https://github.com/AmitHaina/webcrypto-interceptor.git
cd webcrypto-interceptor && npm install
node capture_server.js --help

Full Changelog

e6af729...v0.2.0