@adiholick/nvstudio-mcp 2.2.2 → 2.3.0

package/studio-plugin/nvstudio_mcp.rbxmx

@@ -10,6 +10,229 @@
 			<int64 name="SourceAssetId">-1</int64>
 			<BinaryString name="Tags"></BinaryString>
 		</Properties>
+		<Item class="ModuleScript" referent="RBX_batch_create_instances">
+			<Properties>
+				<BinaryString name="AttributesSerialize"></BinaryString>
+				<SecurityCapabilities name="Capabilities">0</SecurityCapabilities>
+				<bool name="DefinesCapabilities">false</bool>
+				<bool name="Disabled">false</bool>
+				<Content name="LinkedSource"><null></null></Content>
+				<string name="Name">batch_create_instances</string>
+				<int64 name="SourceAssetId">-1</int64>
+				<BinaryString name="Tags"></BinaryString>
+				<ProtectedString name="Source"><![CDATA[--!strict
+-- ============================================================================
+-- Skill Module: batch_create_instances
+-- Deskripsi: Pembangun Hierarki Instance Massal & Deklaratif (Tree / Batch List)
+-- ============================================================================
+
+local HttpService = game:GetService("HttpService")
+
+return function(targetInstance: Instance?, data: any, ctx: any, targetPath: string?)
+    local success, config = pcall(function()
+        if type(data) == "table" then return data end
+        return HttpService:JSONDecode(tostring(data))
+    end)
+
+    if not success or type(config) ~= "table" then
+        return { status = "error", error = "Format data JSON tidak valid untuk batch_create_instances." }
+    end
+
+    local setPropsFunc = require(script.Parent:WaitForChild("set_properties"))
+    local defaultParent = targetInstance or game.Workspace
+
+    if config.target and ctx and ctx.getInstanceFromPath then
+        local resolved = ctx.getInstanceFromPath(config.target)
+        if resolved then defaultParent = resolved end
+    end
+
+    local createdList = {}
+    local errors = {}
+    local createdCount = 0
+
+    local function applyProps(inst: Instance, props: any)
+        if not props or type(props) ~= "table" or not next(props) then return end
+        local propJson = HttpService:JSONEncode(props)
+        local res = setPropsFunc(inst, propJson, ctx, inst:GetFullName())
+        if res and res.status == "error" then
+            table.insert(errors, string.format("[%s] Error properti: %s", inst.Name, tostring(res.result or res.error)))
+        end
+    end
+
+    -- 1. MODE HIERARCHICAL TREE (Pohon Bersarang)
+    local function buildTreeNode(parentInst: Instance, node: any): Instance?
+        local className = node.className or node.ClassName
+        if not className or type(className) ~= "string" then
+            table.insert(errors, "Node pohon tidak memiliki ClassName yang valid.")
+            return nil
+        end
+
+        local ok, inst = pcall(function()
+            local newObj = Instance.new(className)
+            if node.name or node.Name then
+                newObj.Name = tostring(node.name or node.Name)
+            end
+            newObj.Parent = parentInst
+            return newObj
+        end)
+
+        if not ok or not inst then
+            table.insert(errors, string.format("Gagal membuat instance '%s': %s", className, tostring(inst)))
+            return nil
+        end
+
+        createdCount = createdCount + 1
+        table.insert(createdList, inst:GetFullName())
+
+        -- Terapkan properti
+        applyProps(inst, node.properties or node.Properties)
+
+        -- Rekursif untuk seluruh child
+        local children = node.children or node.Children
+        if children and type(children) == "table" then
+            for _, childNode in ipairs(children) do
+                buildTreeNode(inst, childNode)
+            end
+        end
+
+        return inst
+    end
+
+    -- Eksekusi Mode Tree jika disediakan
+    if config.tree and type(config.tree) == "table" then
+        buildTreeNode(defaultParent, config.tree)
+    end
+
+    -- 2. MODE FLAT ARRAY (Daftar Instance Terpisah)
+    local instancesArray = config.instances or config.items
+    if instancesArray and type(instancesArray) == "table" then
+        for idx, item in ipairs(instancesArray) do
+            local parentInst = defaultParent
+            if item.parent and ctx and ctx.getInstanceFromPath then
+                local resParent = ctx.getInstanceFromPath(item.parent)
+                if resParent then parentInst = resParent end
+            end
+
+            local className = item.className or item.ClassName
+            if className then
+                local ok, inst = pcall(function()
+                    local newObj = Instance.new(className)
+                    if item.name or item.Name then
+                        newObj.Name = tostring(item.name or item.Name)
+                    end
+                    newObj.Parent = parentInst
+                    return newObj
+                end)
+
+                if ok and inst then
+                    createdCount = createdCount + 1
+                    table.insert(createdList, inst:GetFullName())
+                    applyProps(inst, item.properties or item.Properties)
+                else
+                    table.insert(errors, string.format("Item #%d (%s) gagal dibuat: %s", idx, tostring(className), tostring(inst)))
+                end
+            end
+        end
+    end
+
+    local status = (createdCount > 0 or #errors == 0) and "success" or "error"
+    return {
+        status = status,
+        result = {
+            totalCreated = createdCount,
+            created = createdList,
+            hasErrors = (#errors > 0),
+            errors = errors,
+            message = string.format("Berhasil membuat %d instance secara batch.", createdCount)
+        }
+    }
+end
+
+]]></ProtectedString>
+			</Properties>
+		</Item>
+		<Item class="ModuleScript" referent="RBX_batch_set_properties">
+			<Properties>
+				<BinaryString name="AttributesSerialize"></BinaryString>
+				<SecurityCapabilities name="Capabilities">0</SecurityCapabilities>
+				<bool name="DefinesCapabilities">false</bool>
+				<bool name="Disabled">false</bool>
+				<Content name="LinkedSource"><null></null></Content>
+				<string name="Name">batch_set_properties</string>
+				<int64 name="SourceAssetId">-1</int64>
+				<BinaryString name="Tags"></BinaryString>
+				<ProtectedString name="Source"><![CDATA[--!strict
+-- ============================================================================
+-- Skill Module: batch_set_properties
+-- Deskripsi: Modifikasi Properti Massal untuk Beberapa Instance Sekaligus
+-- ============================================================================
+
+local HttpService = game:GetService("HttpService")
+
+return function(targetInstance: Instance?, data: any, ctx: any, targetPath: string?)
+    local success, config = pcall(function()
+        if type(data) == "table" then return data end
+        return HttpService:JSONDecode(tostring(data))
+    end)
+
+    if not success or type(config) ~= "table" then
+        return { status = "error", error = "Format data JSON tidak valid untuk batch_set_properties." }
+    end
+
+    local setPropsFunc = require(script.Parent:WaitForChild("set_properties"))
+    local updates = config.updates or config
+    if type(updates) ~= "table" then
+        return { status = "error", error = "Parameter 'updates' harus berupa array pembaruan properti." }
+    end
+
+    local updatedCount = 0
+    local successfulTargets = {}
+    local errors = {}
+
+    for idx, updateItem in ipairs(updates) do
+        local inst = targetInstance
+        local instPath = updateItem.target or updateItem.path
+        if instPath and ctx and ctx.getInstanceFromPath then
+            local resolved = ctx.getInstanceFromPath(instPath)
+            if resolved then
+                inst = resolved
+            else
+                table.insert(errors, string.format("Item #%d: Target path '%s' tidak ditemukan.", idx, tostring(instPath)))
+                continue
+            end
+        end
+
+        local props = updateItem.properties or updateItem.props
+        if inst and props and type(props) == "table" then
+            local propJson = HttpService:JSONEncode(props)
+            local res = setPropsFunc(inst, propJson, ctx, inst:GetFullName())
+            if res and res.status == "error" then
+                table.insert(errors, string.format("[%s]: %s", inst.Name, tostring(res.result or res.error)))
+            else
+                updatedCount = updatedCount + 1
+                table.insert(successfulTargets, inst:GetFullName())
+            end
+        else
+            table.insert(errors, string.format("Item #%d: Instance atau properties tidak valid.", idx))
+        end
+    end
+
+    local status = (updatedCount > 0 or #errors == 0) and "success" or "error"
+    return {
+        status = status,
+        result = {
+            totalUpdated = updatedCount,
+            updatedInstances = successfulTargets,
+            hasErrors = (#errors > 0),
+            errors = errors,
+            message = string.format("Berhasil memperbarui properti untuk %d instance.", updatedCount)
+        }
+    }
+end
+
+]]></ProtectedString>
+			</Properties>
+		</Item>
 		<Item class="ModuleScript" referent="RBX_create_instance">
 			<Properties>
 				<BinaryString name="AttributesSerialize"></BinaryString>
@@ -407,9 +630,32 @@ end
         tryProp(prop)
     end
     
-    -- Attributes & Tags
+    -- Attributes & Tags (sanitasi tipe non-JSON agar tidak throw error di JSONEncode)
     pcall(function()
-        props.Attributes = targetInstance:GetAttributes()
+        local rawAttrs = targetInstance:GetAttributes()
+        local safeAttrs = {}
+        for k, val in pairs(rawAttrs) do
+            if typeof(val) == "Vector3" then
+                safeAttrs[k] = {math.round(val.X*100)/100, math.round(val.Y*100)/100, math.round(val.Z*100)/100}
+            elseif typeof(val) == "Color3" then
+                safeAttrs[k] = {math.round(val.R * 255), math.round(val.G * 255), math.round(val.B * 255)}
+            elseif typeof(val) == "CFrame" then
+                safeAttrs[k] = tostring(val)
+            elseif typeof(val) == "EnumItem" then
+                safeAttrs[k] = val.Name
+            elseif typeof(val) == "UDim2" then
+                safeAttrs[k] = {val.X.Scale, val.X.Offset, val.Y.Scale, val.Y.Offset}
+            elseif typeof(val) == "Instance" then
+                safeAttrs[k] = val:GetFullName()
+            elseif typeof(val) == "DateTime" then
+                safeAttrs[k] = val:ToIsoDate()
+            elseif typeof(val) == "string" or typeof(val) == "number" or typeof(val) == "boolean" then
+                safeAttrs[k] = val
+            else
+                safeAttrs[k] = tostring(val)
+            end
+        end
+        props.Attributes = safeAttrs
     end)
     pcall(function()
         props.Tags = CollectionService:GetTags(targetInstance)
@@ -450,28 +696,101 @@ end
 				<string name="Name">insert_asset</string>
 				<int64 name="SourceAssetId">-1</int64>
 				<BinaryString name="Tags"></BinaryString>
-				<ProtectedString name="Source"><![CDATA[return function(targetInstance, data, ctx, targetPath)
-    local InsertService = game:GetService("InsertService")
-    local rawId = tostring(data or ""):gsub("rbxassetid://", ""):gsub("%s+", "")
+				<ProtectedString name="Source"><![CDATA[--!strict
+-- ============================================================================
+-- Skill Module: insert_asset (Upgraded with Asset Security Scanner & Script Stripper)
+-- ============================================================================
+
+local HttpService = game:GetService("HttpService")
+local InsertService = game:GetService("InsertService")
+
+local SecurityScanner = require(script.Parent:WaitForChild("security_scanner"))
+
+return function(targetInstance: Instance?, data: any, ctx: any, targetPath: string?)
+    local assetIdStr = ""
+    local stripScripts = true  -- Default TRUE demi keamanan mutlak
+    local scanSecurity = true
+
+    if typeof(data) == "string" then
+        local success, parsed = pcall(function()
+            return HttpService:JSONDecode(data)
+        end)
+        if success and typeof(parsed) == "table" then
+            assetIdStr = tostring(parsed.asset_id or parsed.assetId or "")
+            if parsed.strip_scripts ~= nil then stripScripts = parsed.strip_scripts end
+            if parsed.scan_security ~= nil then scanSecurity = parsed.scan_security end
+        else
+            assetIdStr = data
+        end
+    elseif typeof(data) == "table" then
+        assetIdStr = tostring(data.asset_id or data.assetId or "")
+        if data.strip_scripts ~= nil then stripScripts = data.strip_scripts end
+        if data.scan_security ~= nil then scanSecurity = data.scan_security end
+    end
+
+    local rawId = string.gsub(assetIdStr, "rbxassetid://", "")
+    rawId = string.gsub(rawId, "%s+", "")
     local assetId = tonumber(rawId)
-    if not assetId then
+
+    if not assetId or assetId <= 0 then
         return { status = "error", error = "Asset ID harus berupa angka yang valid." }
     end
-    
+
     local success, model = pcall(function()
         return InsertService:LoadAsset(assetId)
     end)
-    
-    if success and model then
-        if targetInstance == game or targetInstance.ClassName == "DataModel" then
-            model.Parent = game.Workspace
+
+    if not success or not model then
+        return {
+            status = "error",
+            error = "Gagal memuat aset. Pastikan Asset ID benar dan model berstatus publik di Creator Store."
+        }
+    end
+
+    local securityNotes = {}
+    local removedScripts = {}
+
+    -- 1. Scan keamanan jika diaktifkan
+    if scanSecurity then
+        local scanResult = SecurityScanner.scanInstance(model, true)
+        if scanResult.riskLevel == "DANGEROUS" then
+            table.insert(securityNotes, string.format("⚠️ PERINGATAN: Aset ini memiliki %d ancaman BERBAHAYA (Backdoor/Obfuscation/Webhook)!", scanResult.highThreats))
+        end
+    end
+
+    -- 2. Sanitasi: Hapus skrip jika strip_scripts = true
+    if stripScripts then
+        removedScripts = SecurityScanner.stripScripts(model)
+        if #removedScripts > 0 then
+            table.insert(securityNotes, string.format("🛡️ Keamanan: %d skrip bawaan telah dihapus secara otomatis demi keamanan game Anda.", #removedScripts))
         else
-            model.Parent = targetInstance
+            table.insert(securityNotes, "🛡️ Keamanan: Aset bersih, tidak ditemukan skrip berbahaya.")
         end
-        return { status = "success", result = "Aset berhasil dimasukkan ke " .. model.Parent.Name .. "." }
     else
-        return { status = "error", error = "Gagal memuat aset. Pastikan Asset ID benar dan akun/plugin Anda memiliki izin (Ownership/Public)." }
+        table.insert(securityNotes, "ℹ️ Catatan: strip_scripts = false, skrip bawaan model dipertahankan.")
     end
+
+    -- 3. Masukkan model ke target
+    local parentTarget = targetInstance
+    if not parentTarget or parentTarget == game or parentTarget.ClassName == "DataModel" then
+        parentTarget = game.Workspace
+    end
+
+    model.Parent = parentTarget
+
+    return {
+        status = "success",
+        result = {
+            message = string.format("Aset '%s' (ID: %d) berhasil dimasukkan ke %s.", model.Name, assetId, parentTarget.Name),
+            assetName = model.Name,
+            assetId = assetId,
+            parent = parentTarget:GetFullName(),
+            stripScriptsApplied = stripScripts,
+            removedScriptsCount = #removedScripts,
+            removedScripts = removedScripts,
+            securityNotes = table.concat(securityNotes, "\n"),
+        }
+    }
 end
 ]]></ProtectedString>
 			</Properties>
@@ -488,10 +807,10 @@ end
 				<BinaryString name="Tags"></BinaryString>
 				<token name="RunContext">0</token>
 				<ProtectedString name="Source"><![CDATA[-- ══════════════════════════════════════════════════════════════════════
--- NVStudio MCP Plugin v2.1.8
--- Arsitektur: Polling Stream / Local HTTP Bridge (Port 3055)
--- Plugin auto-connect saat dimuat, polling /api/ping lalu /api/stream
--- untuk mendapatkan events (status, request) dari server Node.js.
+-- NVStudio MCP Plugin v2.3.0
+-- Arsitektur: Dual-Mode WebSocket Duplex (Port 3055/ws) + Fallback Long-Polling
+-- Plugin auto-connect saat dimuat via WebSocket native, dengan fallback otomatis
+-- ke HTTP stream jika WebSocket tidak tersedia di environment Roblox Studio ini.
 -- ══════════════════════════════════════════════════════════════════════
 
 local HttpService    = game:GetService("HttpService")
@@ -502,6 +821,8 @@ local BASE_URL       = "http://localhost:3055"
 local STREAM_URL     = BASE_URL .. "/api/stream"      -- SSE long-poll (blocking GET)
 local RESPONSE_URL   = BASE_URL .. "/api/response"
 local PING_URL       = BASE_URL .. "/api/ping"
+local WS_URL         = "ws://localhost:3055/ws"
+local WS_URL_IP      = "ws://127.0.0.1:3055/ws"
 
 -- ID unik per sesi Studio
 local STUDIO_ID      = HttpService:GenerateGUID(false)
@@ -523,18 +844,55 @@ local ctx = {
 	getInstanceFromPath = nil -- akan di-bind di bawah
 }
 local MAX_LOGS           = 50
-local isRunning          = false  -- apakah loop aktif
+local isRunning          = false  -- apakah loop/koneksi aktif
 local isManualDisconnect = false
 local isClickDebounce    = false
 local mcpAgentActive     = false  -- apakah Antigravity sedang konek ke MCP
 local serverReachable    = false  -- apakah server Node.js reachable
+local activeWsWrapper    = nil
+local currentTransport   = "none" -- "websocket" | "longpoll" | "none"
 
--- Reconnect config
+-- Reconnect config untuk Long-Polling
 local RECONNECT_DELAY_INITIAL = 1.5
 local RECONNECT_DELAY_MAX     = 1.5
 local reconnectDelay          = RECONNECT_DELAY_INITIAL
 local currentLoopId           = nil
 
+-- Task deduplication state (Bug G)
+local runningTasks   = {} -- taskId -> true
+local completedTasks = {} -- taskId -> os.clock()
+
+local function shouldProcessTask(taskId)
+	if not taskId or taskId == "" then return false end
+	if runningTasks[taskId] then
+		return false
+	end
+	local completedAt = completedTasks[taskId]
+	if completedAt and (os.clock() - completedAt < 60) then
+		return false
+	end
+	runningTasks[taskId] = true
+	return true
+end
+
+local function markTaskDone(taskId)
+	if not taskId then return end
+	runningTasks[taskId] = nil
+	completedTasks[taskId] = os.clock()
+
+	-- Bersihkan entri kedaluwarsa (>60 detik)
+	local now = os.clock()
+	for id, t in pairs(completedTasks) do
+		if now - t > 60 then
+			completedTasks[id] = nil
+		end
+	end
+end
+
+-- Forward declaration
+local startConnectionManager = nil
+local startLongPollingLoop   = nil
+
 -- ── Skills (ModuleScript) ─────────────────────────────────────────────────────
 local skills = {}
 for _, module in ipairs(script.Parent:GetChildren()) do
@@ -577,12 +935,17 @@ if uiModule then
 			reconnectDelay = RECONNECT_DELAY_INITIAL
 			ui:setStatus("waiting")
 			ui:addLog("[System] Menghubungkan ulang ke Server MCP...", Color3.fromRGB(255, 220, 100))
-			task.spawn(startConnectionLoop)
+			task.spawn(startConnectionManager)
 		else
 			isManualDisconnect = true
 			isRunning = false
 			serverReachable = false
 			mcpAgentActive = false
+			if activeWsWrapper then
+				activeWsWrapper:Close()
+				activeWsWrapper = nil
+			end
+			currentTransport = "none"
 			ui:setStatus("disconnected")
 			ui:addLog("[System] Koneksi dihentikan oleh pengguna.", Color3.fromRGB(255, 100, 100))
 		end
@@ -689,31 +1052,325 @@ local function processTask(taskData)
 	return result
 end
 
--- ── Kirim Respons ke Server ───────────────────────────────────────────────────
-local function sendResponse(taskId, resultData)
+-- ── Helper: Sanitize result sebelum JSONEncode (Bug H) ─────────────────────────
+local function sanitizeForJson(val, depth)
+	depth = depth or 0
+	if depth > 5 then return tostring(val) end
+	local t = typeof(val)
+	if t == "string" or t == "number" or t == "boolean" then
+		return val
+	elseif t == "Instance" then
+		return val:GetFullName()
+	elseif t == "Vector3" then
+		return { X = val.X, Y = val.Y, Z = val.Z }
+	elseif t == "CFrame" then
+		return { Position = { X = val.Position.X, Y = val.Position.Y, Z = val.Position.Z } }
+	elseif t == "Color3" then
+		return { R = val.R, G = val.G, B = val.B }
+	elseif t == "table" then
+		local sanitized = {}
+		for k, v in pairs(val) do
+			sanitized[tostring(k)] = sanitizeForJson(v, depth + 1)
+		end
+		return sanitized
+	else
+		return tostring(val)
+	end
+end
+
+-- ── Kirim Respons ke Server (HTTP Fallback) (Bug H) ───────────────────────────
+local function sendResponse(taskId, resultData, attempt)
 	task.spawn(function()
-		local ok, err = pcall(function()
-			local json = HttpService:JSONEncode(resultData)
-			local success = pcall(function()
-				HttpService:PostAsync(
-					RESPONSE_URL .. "/" .. taskId,
-					json,
-					Enum.HttpContentType.ApplicationJson
-				)
-			end)
-			if not success then
+		local payload = {
+			id      = taskId,
+			taskId  = taskId,
+			attempt = attempt,
+			status  = resultData.status or "success",
+			result  = sanitizeForJson(resultData.result),
+			error   = resultData.error and tostring(resultData.error) or nil,
+		}
+
+		local encOk, json = pcall(function()
+			return HttpService:JSONEncode(payload)
+		end)
+
+		if not encOk then
+			payload.result = tostring(payload.result)
+			pcall(function() json = HttpService:JSONEncode(payload) end)
+		end
+
+		if not json then
+			json = string.format('{"id":"%s","taskId":"%s","status":"error","error":"Gagal encode payload JSON"}', taskId, taskId)
+		end
+
+		local postOk = pcall(function()
+			HttpService:PostAsync(
+				RESPONSE_URL .. "/" .. taskId,
+				json,
+				Enum.HttpContentType.ApplicationJson
+			)
+		end)
+
+		if not postOk then
+			-- Backoff sejenak sebelum fallback ke endpoint legacy (Bug H)
+			task.wait(0.2)
+			local fallbackOk = pcall(function()
 				HttpService:PostAsync(RESPONSE_URL, json, Enum.HttpContentType.ApplicationJson)
+			end)
+			if not fallbackOk and ui then
+				ui:addLog("[System] Gagal kirim response HTTP ke server: " .. tostring(taskId), Color3.fromRGB(255, 100, 100))
 			end
-		end)
-		if not ok and ui then
-			ui:addLog("[System] Gagal kirim response: " .. tostring(err), Color3.fromRGB(255, 100, 100))
 		end
 	end)
 end
 
--- ── Proses satu event dari SSE stream ────────────────────────────────────────
+-- ── WebSocket API Abstraction ────────────────────────────────────────────────
+local function detectWebSocketCapability()
+	-- 1. Check HttpService:CreateWebStreamClient (Roblox Studio native API)
+	local hasWebStream = false
+	pcall(function()
+		hasWebStream = (typeof(HttpService.CreateWebStreamClient) == "function")
+			and (Enum.WebStreamClientType and Enum.WebStreamClientType.WebSocket ~= nil)
+	end)
+	if hasWebStream then
+		return "WebStreamClient"
+	end
+
+	-- 2. Check global WebSocket API jika tersedia
+	local wsGlobal = rawget(_G, "WebSocket") or rawget(_G, "websocket")
+	if not wsGlobal then
+		pcall(function() wsGlobal = WebSocket end)
+	end
+	if wsGlobal and typeof(wsGlobal.connect) == "function" then
+		return "WebSocketGlobal"
+	end
+
+	return nil
+end
+
+local function createWsClient(url)
+	local cap = detectWebSocketCapability()
+	if not cap then
+		return nil, "WebSocket API not available"
+	end
+
+	if cap == "WebStreamClient" then
+		local ok, client = pcall(function()
+			return HttpService:CreateWebStreamClient(Enum.WebStreamClientType.WebSocket, {
+				Url = url
+			})
+		end)
+		if not ok or not client then
+			return nil, tostring(client or "CreateWebStreamClient failed")
+		end
+
+		local wrapper = {
+			raw = client,
+			cap = "WebStreamClient",
+			closed = false,
+			connections = {},
+		}
+
+		function wrapper:Send(data)
+			if self.closed then return false, "Closed" end
+			return pcall(function()
+				self.raw:Send(data)
+			end)
+		end
+
+		function wrapper:Close()
+			if self.closed then return end
+			self.closed = true
+			pcall(function() self.raw:Close() end)
+			for _, conn in ipairs(self.connections) do
+				pcall(function() conn:Disconnect() end)
+			end
+			table.clear(self.connections)
+		end
+
+		function wrapper:BindEvents(onMessage, onClose)
+			if self.raw.MessageReceived and typeof(self.raw.MessageReceived.Connect) == "function" then
+				local ok, conn = pcall(function()
+					return self.raw.MessageReceived:Connect(onMessage)
+				end)
+				if ok and conn then table.insert(self.connections, conn) end
+			end
+
+			if self.raw.Closed and typeof(self.raw.Closed.Connect) == "function" then
+				local ok, conn = pcall(function()
+					return self.raw.Closed:Connect(onClose)
+				end)
+				if ok and conn then table.insert(self.connections, conn) end
+			end
+		end
+
+		return wrapper, nil
+
+	elseif cap == "WebSocketGlobal" then
+		local wsGlobal = rawget(_G, "WebSocket") or rawget(_G, "websocket") or WebSocket
+		local ok, client = pcall(function()
+			return wsGlobal.connect(url)
+		end)
+		if not ok or not client then
+			return nil, tostring(client or "WebSocket.connect failed")
+		end
+
+		local wrapper = {
+			raw = client,
+			cap = "WebSocketGlobal",
+			closed = false,
+			connections = {},
+		}
+
+		function wrapper:Send(data)
+			if self.closed then return false, "Closed" end
+			return pcall(function()
+				if typeof(self.raw.Send) == "function" then
+					self.raw:Send(data)
+				elseif typeof(self.raw.send) == "function" then
+					self.raw:send(data)
+				end
+			end)
+		end
+
+		function wrapper:Close()
+			if self.closed then return end
+			self.closed = true
+			pcall(function()
+				if typeof(self.raw.Close) == "function" then
+					self.raw:Close()
+				elseif typeof(self.raw.close) == "function" then
+					self.raw:close()
+				end
+			end)
+			for _, conn in ipairs(self.connections) do
+				pcall(function() conn:Disconnect() end)
+			end
+			table.clear(self.connections)
+		end
+
+		function wrapper:BindEvents(onMessage, onClose)
+			if self.raw.MessageReceived and typeof(self.raw.MessageReceived.Connect) == "function" then
+				local ok, conn = pcall(function() return self.raw.MessageReceived:Connect(onMessage) end)
+				if ok and conn then table.insert(self.connections, conn) end
+			elseif self.raw.OnMessage then
+				if typeof(self.raw.OnMessage) == "RBXScriptSignal" or (typeof(self.raw.OnMessage) == "userdata" and self.raw.OnMessage.Connect) then
+					local ok, conn = pcall(function() return self.raw.OnMessage:Connect(onMessage) end)
+					if ok and conn then table.insert(self.connections, conn) end
+				else
+					pcall(function() self.raw.OnMessage = onMessage end)
+				end
+			end
+
+			if self.raw.Closed and typeof(self.raw.Closed.Connect) == "function" then
+				local ok, conn = pcall(function() return self.raw.Closed:Connect(onClose) end)
+				if ok and conn then table.insert(self.connections, conn) end
+			elseif self.raw.OnClose then
+				if typeof(self.raw.OnClose) == "RBXScriptSignal" or (typeof(self.raw.OnClose) == "userdata" and self.raw.OnClose.Connect) then
+					local ok, conn = pcall(function() return self.raw.OnClose:Connect(onClose) end)
+					if ok and conn then table.insert(self.connections, conn) end
+				else
+					pcall(function() self.raw.OnClose = onClose end)
+				end
+			end
+		end
+
+		return wrapper, nil
+	end
+
+	return nil, "Unsupported"
+end
+
+-- ── WebSocket Message Dispatcher ─────────────────────────────────────────────
+local function handleWsMessage(wrapper, rawMessage)
+	if type(rawMessage) ~= "string" or rawMessage == "" then return end
+	local ok, decoded = pcall(function() return HttpService:JSONDecode(rawMessage) end)
+	if not ok or type(decoded) ~= "table" then return end
+
+	local kind = decoded.kind
+
+	-- Heartbeat ping -> balas pong
+	if kind == "ping" then
+		pcall(function()
+			wrapper:Send(HttpService:JSONEncode({ kind = "pong", ts = os.time() }))
+		end)
+		return
+	end
+
+	if kind == "pong" then
+		return
+	end
+
+	-- Update status koneksi MCP / Studio
+	if kind == "status" then
+		local newActive = decoded.mcpConnected == true
+		local changed = (mcpAgentActive ~= newActive)
+		mcpAgentActive = newActive
+		if ui then
+			if mcpAgentActive then
+				ui:setStatus("connected")
+			else
+				ui:setStatus("server_connected")
+			end
+			if newActive and changed then
+				ui:addLog("[System] ✅ IDE Agent (Antigravity) aktif ⚡", Color3.fromRGB(100, 255, 100))
+			elseif not newActive and changed then
+				ui:addLog("[System] ⚠️ IDE Agent terputus.", Color3.fromRGB(255, 150, 50))
+			end
+		end
+		return
+	end
+
+	-- Eksekusi perintah AI
+	if kind == "request" then
+		local taskId  = decoded.taskId or decoded.requestId
+		local attempt = decoded.attempt
+		local command = decoded.command
+		local target  = decoded.target
+		local data    = decoded.data
+
+		if not taskId or not command then return end
+		if not shouldProcessTask(taskId) then return end -- Bug G: Dedup!
+
+		task.spawn(function()
+			local resultData = processTask({
+				id      = taskId,
+				command = command,
+				target  = target or "",
+				data    = data,
+			})
+			markTaskDone(taskId) -- Bug G: Tandai selesai
+			if resultData then
+				-- Push respons instan kembali via WebSocket (Zero-Delay)
+				local responseEnvelope = {
+					kind    = "response",
+					taskId  = taskId,
+					id      = taskId,
+					attempt = attempt,
+					status  = resultData.status,
+					result  = sanitizeForJson(resultData.result),
+					error   = resultData.error and tostring(resultData.error) or nil,
+				}
+				local encOk, encoded = pcall(function()
+					return HttpService:JSONEncode(responseEnvelope)
+				end)
+				local sent = false
+				if encOk then
+					local sendOk, _ = wrapper:Send(encoded)
+					sent = (sendOk == true)
+				end
+				if not sent then
+					-- Jika serialisasi atau pengiriman via WS gagal, fallback ke HTTP POST
+					sendResponse(taskId, resultData, attempt)
+				end
+			end
+		end)
+		return
+	end
+end
+
+-- ── Proses satu event dari SSE stream (Long-Polling fallback) ────────────────
 local function handleSSELine(line)
-	-- Format SSE: "data: {...json...}"
 	local payload = line
 	if line:sub(1, 6) == "event:" then return end
 	if line:sub(1, 5) == "data:" then
@@ -726,12 +1383,10 @@ local function handleSSELine(line)
 
 	local kind = decoded.kind
 
-	-- heartbeat: server masih hidup
 	if kind == "heartbeat" then
 		return
 	end
 
-	-- status: update mcpConnected
 	if kind == "status" then
 		local newActive = decoded.mcpConnected == true
 		local changed = (mcpAgentActive ~= newActive)
@@ -752,14 +1407,15 @@ local function handleSSELine(line)
 		return
 	end
 
-	-- request: ada task dari AI agent
 	if kind == "request" then
-		local taskId  = decoded.requestId
+		local taskId  = decoded.requestId or decoded.taskId
+		local attempt = decoded.attempt
 		local command = decoded.command
 		local target  = decoded.target
 		local data    = decoded.data
 
 		if not taskId or not command then return end
+		if not shouldProcessTask(taskId) then return end -- Bug G: Dedup!
 
 		task.spawn(function()
 			local resultData = processTask({
@@ -768,39 +1424,34 @@ local function handleSSELine(line)
 				target  = target or "",
 				data    = data,
 			})
+			markTaskDone(taskId) -- Bug G: Tandai selesai
 			if resultData then
-				sendResponse(taskId, resultData)
+				sendResponse(taskId, resultData, attempt)
 			end
 		end)
 		return
 	end
 end
 
--- ── Loop Utama: Ping → Stream → Parse SSE lines ───────────────────────────────
--- Roblox HttpService:GetAsync() tidak mendukung streaming, jadi kita
--- menggunakan strategi: GET /api/stream dengan waktu hold singkat (5 detik).
--- Server mengirim semua events yang tertunda lalu tutup koneksi.
--- Plugin reconnect langsung untuk sesi berikutnya.
-function startConnectionLoop()
-	if isRunning then return end
-	isRunning = true
-	isManualDisconnect = false
+-- ── Fallback Loop: Long-Polling (/api/stream) ─────────────────────────────────
+function startLongPollingLoop()
+	if not isRunning or isManualDisconnect then return end
+	currentTransport = "longpoll"
 	reconnectDelay = RECONNECT_DELAY_INITIAL
 
 	local loopId = HttpService:GenerateGUID(false)
 	currentLoopId = loopId
 
 	if ui then
-		ui:addLog("[System] NVStudio MCP v2.1.8 — Menghubungkan ke server...", Color3.fromRGB(200, 200, 200))
+		ui:addLog("[System] Mode Long-Polling aktif (Port 3055)...", Color3.fromRGB(200, 200, 200))
 	end
 
 	local consecutiveErrors = 0
 
-	while isRunning and not isManualDisconnect and currentLoopId == loopId do
-		-- Stream / polling snapshot dari server
+	while isRunning and not isManualDisconnect and currentLoopId == loopId and currentTransport == "longpoll" do
 		local streamOk, streamRaw = pcall(function()
 			return HttpService:GetAsync(
-				STREAM_URL .. "?studioId=" .. HttpService:UrlEncode(STUDIO_ID),
+				STREAM_URL .. "?studioId=" .. HttpService:UrlEncode(STUDIO_ID) .. "&placeId=" .. tostring(game.PlaceId),
 				false
 			)
 		end)
@@ -813,28 +1464,26 @@ function startConnectionLoop()
 				serverReachable = true
 				if ui then
 					ui:setStatus(mcpAgentActive and "connected" or "server_connected")
-					ui:addLog("[System] ✅ Server MCP terhubung & siap.", Color3.fromRGB(100, 255, 150))
+					ui:addLog("[System] ✅ Server MCP terhubung via Long-Polling.", Color3.fromRGB(100, 255, 150))
 				end
 			end
 
-			-- Parse baris-baris SSE
 			for line in (streamRaw .. "\n"):gmatch("([^\n]*)\n") do
 				line = line:gsub("\r", "")
 				if line ~= "" then
 					handleSSELine(line)
 				end
 			end
-			task.wait(0.05) -- Instant loop: server menahan request (hanging GET) saat idle
+			task.wait()
 		else
 			consecutiveErrors = consecutiveErrors + 1
-			-- Toleransi 2x gagal sebelum menandai server unreachable
 			if consecutiveErrors >= 2 then
 				if serverReachable then
 					serverReachable = false
 					mcpAgentActive = false
 					if ui then
 						ui:setStatus("waiting")
-						ui:addLog("[System] ⚠️ Server MCP tidak dapat dijangkau. Mencoba menghubungkan ulang...", Color3.fromRGB(255, 150, 50))
+						ui:addLog("[System] ⚠️ Server MCP tidak dapat dijangkau. Menghubungkan ulang...", Color3.fromRGB(255, 150, 50))
 					end
 				end
 			end
@@ -844,24 +1493,125 @@ function startConnectionLoop()
 		end
 	end
 
-	isRunning = false
-	serverReachable = false
-	mcpAgentActive  = false
-	if ui then ui:setStatus("disconnected") end
+	if currentTransport == "longpoll" and (not isRunning or isManualDisconnect) then
+		isRunning = false
+		serverReachable = false
+		mcpAgentActive  = false
+		if ui then ui:setStatus("disconnected") end
+	end
+end
+
+-- ── Connection Manager: WebSocket Utama + Fallback Long-Polling ──────────────
+function startConnectionManager()
+	if isRunning then return end
+	isRunning = true
+	isManualDisconnect = false
+
+	local cap = detectWebSocketCapability()
+	if cap then
+		task.spawn(function()
+			local wsFailures = 0
+			local backoff = 0.5
+
+			while isRunning and not isManualDisconnect and wsFailures < 3 do
+				currentTransport = "websocket"
+				if ui then
+					ui:setStatus("waiting")
+					ui:addLog("[System] Menghubungkan via WebSocket (Port 3055)...", Color3.fromRGB(200, 200, 255))
+				end
+
+				local wrapper, err = createWsClient(WS_URL)
+				if not wrapper then
+					-- Coba fallback ke IP 127.0.0.1
+					wrapper, err = createWsClient(WS_URL_IP)
+				end
+
+				if wrapper then
+					activeWsWrapper = wrapper
+					serverReachable = true
+					if ui then
+						ui:setStatus(mcpAgentActive and "connected" or "server_connected")
+						ui:addLog("[System] ⚡ WebSocket Terhubung! (Ultra Low-Latency <1ms)", Color3.fromRGB(100, 255, 150))
+					end
+
+					-- Kirim pesan registrasi awal
+					local regOk = wrapper:Send(HttpService:JSONEncode({
+						kind = "register",
+						studioId = STUDIO_ID,
+						placeId = game.PlaceId,
+						pluginsVersion = 2,
+					}))
+
+					if regOk then
+						wsFailures = 0
+						backoff = 0.5
+
+						local closedSignal = Instance.new("BindableEvent")
+						wrapper:BindEvents(
+							function(msg)
+								handleWsMessage(wrapper, msg)
+							end,
+							function()
+								closedSignal:Fire()
+							end
+						)
+
+						closedSignal.Event:Wait()
+						closedSignal:Destroy()
+					end
+
+					if activeWsWrapper == wrapper then
+						activeWsWrapper = nil
+					end
+					wrapper:Close()
+				end
+
+				if isManualDisconnect or not isRunning then break end
+
+				wsFailures = wsFailures + 1
+				if wsFailures < 3 then
+					if ui then
+						ui:setStatus("waiting")
+						ui:addLog("[System] ⚠️ WebSocket terputus. Reconnect dalam " .. string.format("%.1f", backoff) .. "s...", Color3.fromRGB(255, 180, 50))
+					end
+					task.wait(backoff)
+					backoff = math.min(backoff * 2, 5.0)
+				end
+			end
+
+			-- Jika WS gagal 3x berturut-turut dan plugin masih aktif -> Beralih ke Long-Polling!
+			if isRunning and not isManualDisconnect then
+				if ui then
+					ui:addLog("[System] ℹ️ Mengalihkan ke Mode Fallback Long-Polling...", Color3.fromRGB(255, 200, 100))
+				end
+				startLongPollingLoop()
+			end
+		end)
+	else
+		-- WebSocket tidak didukung di environment Studio ini -> langsung Long-Polling
+		if ui then
+			ui:addLog("[System] ℹ️ WebSocket tidak terdeteksi. Menggunakan Long-Polling.", Color3.fromRGB(200, 200, 200))
+		end
+		startLongPollingLoop()
+	end
 end
 
 -- ── Plugin Unloading ──────────────────────────────────────────────────────────
 plugin.Unloading:Connect(function()
 	isManualDisconnect = true
 	isRunning = false
+	if activeWsWrapper then
+		activeWsWrapper:Close()
+		activeWsWrapper = nil
+	end
 end)
 
 -- ══════════════════════════════════════════════════════════════════════
--- STARTUP: Langsung mulai connection loop
+-- STARTUP: Langsung mulai connection manager
 -- ══════════════════════════════════════════════════════════════════════
 task.spawn(function()
 	task.wait(0.5) -- Tunggu UI siap
-	startConnectionLoop()
+	startConnectionManager()
 end)
 ]]></ProtectedString>
 			</Properties>
@@ -993,6 +1743,118 @@ return function(targetInstance, data, ctx, targetPath)
         affected_lines = affectedLines
     }
 end
+]]></ProtectedString>
+			</Properties>
+		</Item>
+		<Item class="ModuleScript" referent="RBX_preview_asset">
+			<Properties>
+				<BinaryString name="AttributesSerialize"></BinaryString>
+				<SecurityCapabilities name="Capabilities">0</SecurityCapabilities>
+				<bool name="DefinesCapabilities">false</bool>
+				<bool name="Disabled">false</bool>
+				<Content name="LinkedSource"><null></null></Content>
+				<string name="Name">preview_asset</string>
+				<int64 name="SourceAssetId">-1</int64>
+				<BinaryString name="Tags"></BinaryString>
+				<ProtectedString name="Source"><![CDATA[--!strict
+-- ============================================================================
+-- Skill Module: preview_asset
+-- Deskripsi: Pratinjau & Pemindaian Keamanan Aset Creator Store Secara Terisolasi
+-- ============================================================================
+
+local HttpService = game:GetService("HttpService")
+local InsertService = game:GetService("InsertService")
+
+local SecurityScanner = require(script.Parent:WaitForChild("security_scanner"))
+
+return function(targetInstance: Instance?, data: any, ctx: any, targetPath: string?)
+    local assetIdStr = ""
+    local deepScan = true
+
+    if typeof(data) == "string" then
+        local success, parsed = pcall(function()
+            return HttpService:JSONDecode(data)
+        end)
+        if success and typeof(parsed) == "table" then
+            assetIdStr = tostring(parsed.asset_id or parsed.assetId or "")
+            if parsed.deep_scan ~= nil then deepScan = parsed.deep_scan end
+        else
+            assetIdStr = data
+        end
+    elseif typeof(data) == "table" then
+        assetIdStr = tostring(data.asset_id or data.assetId or "")
+        if data.deep_scan ~= nil then deepScan = data.deep_scan end
+    end
+
+    local cleanIdStr = string.gsub(assetIdStr, "rbxassetid://", "")
+    cleanIdStr = string.gsub(cleanIdStr, "%s+", "")
+    local assetId = tonumber(cleanIdStr)
+
+    if not assetId or assetId <= 0 then
+        return { status = "error", error = "Asset ID tidak valid. Berikan Asset ID angka (contoh: 123456789)." }
+    end
+
+    -- Muat Aset secara terisolasi (unparented / memory only)
+    local ok, model = pcall(function()
+        return InsertService:LoadAsset(assetId)
+    end)
+
+    if not ok or not model then
+        return {
+            status = "error",
+            error = string.format("Gagal memuat aset ID %d. Pastikan Asset ID publik dan terdaftar di Creator Store.", assetId)
+        }
+    end
+
+    local scanResult
+    local scanOk, err = pcall(function()
+        scanResult = SecurityScanner.scanInstance(model, deepScan)
+    end)
+
+    local rootName = model.Name
+    local childrenOverview = {}
+    for _, child in ipairs(model:GetChildren()) do
+        table.insert(childrenOverview, {
+            name = child.Name,
+            className = child.ClassName,
+        })
+    end
+
+    -- Hancurkan model sementara dari memori (Cleanup Mutlak)
+    pcall(function()
+        model:Destroy()
+    end)
+
+    if not scanOk or not scanResult then
+        return {
+            status = "error",
+            error = "Gagal memindai aset: " .. tostring(err)
+        }
+    end
+
+    local recommendation = "Aman untuk dimasukkan langsung menggunakan insert_asset."
+    if scanResult.riskLevel == "DANGEROUS" then
+        recommendation = "PERINGATAN: Aset ini memiliki ancaman BERBAHAYA! Wajib gunakan 'insert_asset' dengan strip_scripts = true, atau hindari aset ini."
+    elseif scanResult.riskLevel == "WARNING" then
+        recommendation = "Perhatian: Aset mengandung skrip atau peringatan moderat. Periksa kembali atau gunakan strip_scripts = true jika skrip tidak diperlukan."
+    end
+
+    return {
+        status = "success",
+        result = {
+            assetId = assetId,
+            assetName = rootName,
+            riskLevel = scanResult.riskLevel,
+            recommendation = recommendation,
+            stats = scanResult.stats,
+            highThreatsCount = scanResult.highThreats,
+            mediumThreatsCount = scanResult.mediumThreats,
+            threats = scanResult.threats,
+            topLevelChildren = childrenOverview,
+        }
+    }
+end
+
 ]]></ProtectedString>
 			</Properties>
 		</Item>
@@ -1025,6 +1887,100 @@ end
         return { status = "error", error = "Target BUKAN Script (ClassName: " .. targetInstance.ClassName .. ")." }
     end
 end
+]]></ProtectedString>
+			</Properties>
+		</Item>
+		<Item class="ModuleScript" referent="RBX_scan_security">
+			<Properties>
+				<BinaryString name="AttributesSerialize"></BinaryString>
+				<SecurityCapabilities name="Capabilities">0</SecurityCapabilities>
+				<bool name="DefinesCapabilities">false</bool>
+				<bool name="Disabled">false</bool>
+				<Content name="LinkedSource"><null></null></Content>
+				<string name="Name">scan_security</string>
+				<int64 name="SourceAssetId">-1</int64>
+				<BinaryString name="Tags"></BinaryString>
+				<ProtectedString name="Source"><![CDATA[--!strict
+-- ============================================================================
+-- Skill Module: scan_security
+-- Deskripsi: Audit Keamanan Instance/Model yang Sudah Ada di Tempat Kerja Studio
+-- ============================================================================
+
+local HttpService = game:GetService("HttpService")
+local SecurityScanner = require(script.Parent:WaitForChild("security_scanner"))
+
+return function(targetInstance: Instance?, data: any, ctx: any, targetPath: string?)
+    local target = targetInstance or game.Workspace
+    local deepScan = true
+    local cleanThreats = false
+
+    if typeof(data) == "string" and #data > 0 then
+        local success, parsed = pcall(function()
+            return HttpService:JSONDecode(data)
+        end)
+        if success and typeof(parsed) == "table" then
+            if parsed.deep_scan ~= nil then deepScan = parsed.deep_scan end
+            if parsed.clean_threats ~= nil then cleanThreats = parsed.clean_threats end
+        end
+    elseif typeof(data) == "table" then
+        if data.deep_scan ~= nil then deepScan = data.deep_scan end
+        if data.clean_threats ~= nil then cleanThreats = data.clean_threats end
+    end
+
+    local scanResult
+    local ok, err = pcall(function()
+        scanResult = SecurityScanner.scanInstance(target, deepScan)
+    end)
+
+    if not ok or not scanResult then
+        return {
+            status = "error",
+            error = "Gagal memindai target: " .. tostring(err)
+        }
+    end
+
+    local cleanedScripts = {}
+    if cleanThreats and #scanResult.threats > 0 then
+        -- Hapus skrip yang terdeteksi bahaya (HIGH severity)
+        local scriptsToDestroy = {}
+        for _, threat in ipairs(scanResult.threats) do
+            if threat.severity == "HIGH" and threat.scriptPath then
+                scriptsToDestroy[threat.scriptPath] = true
+            end
+        end
+
+        local function purge(instance: Instance)
+            for _, desc in ipairs(instance:GetDescendants()) do
+                if desc:IsA("LuaSourceContainer") and scriptsToDestroy[desc:GetFullName()] then
+                    table.insert(cleanedScripts, {
+                        name = desc.Name,
+                        className = desc.ClassName,
+                        path = desc:GetFullName(),
+                    })
+                    pcall(function() desc:Destroy() end)
+                end
+            end
+        end
+
+        purge(target)
+    end
+
+    return {
+        status = "success",
+        result = {
+            target = target:GetFullName(),
+            riskLevel = scanResult.riskLevel,
+            stats = scanResult.stats,
+            highThreatsCount = scanResult.highThreats,
+            mediumThreatsCount = scanResult.mediumThreats,
+            threats = scanResult.threats,
+            cleanedThreatsCount = #cleanedScripts,
+            cleanedScripts = cleanedScripts,
+            isCleaned = cleanThreats,
+        }
+    }
+end
+
 ]]></ProtectedString>
 			</Properties>
 		</Item>
@@ -1170,6 +2126,365 @@ end
         return { status = "success", result = "Tidak ditemukan instance dengan nama: " .. searchName }
     end
 end
+]]></ProtectedString>
+			</Properties>
+		</Item>
+		<Item class="ModuleScript" referent="RBX_security_scanner">
+			<Properties>
+				<BinaryString name="AttributesSerialize"></BinaryString>
+				<SecurityCapabilities name="Capabilities">0</SecurityCapabilities>
+				<bool name="DefinesCapabilities">false</bool>
+				<bool name="Disabled">false</bool>
+				<Content name="LinkedSource"><null></null></Content>
+				<string name="Name">security_scanner</string>
+				<int64 name="SourceAssetId">-1</int64>
+				<BinaryString name="Tags"></BinaryString>
+				<ProtectedString name="Source"><![CDATA[--!strict
+-- ============================================================================
+-- Module: security_scanner
+-- Deskripsi: Engine Heuristik Pemindaian Keamanan & Backdoor Detection
+-- Standar: Business-Grade, Zero-Execution Isolation, Comprehensive Threat Rules
+-- ============================================================================
+
+local SecurityScanner = {}
+
+-- Daftar nama skrip yang sering digunakan oleh virus/backdoor klasik Roblox
+local SUSPICIOUS_SCRIPT_NAMES = {
+    "[Vv]accine",
+    "[Aa]nti[Ll]ag",
+    "[Ff]ix[Ll]ag",
+    "[Ii]nfection",
+    "[Ff]ire",
+    "[Cc]lean",
+    "[Vv]irus",
+    "4[Dd]",
+    "4[Dd]_[Pp]lugin",
+    "[Ss]pread",
+    "[Ll]ag[Ff]ixer",
+    "[Dd]up",
+}
+
+-- Aturan Pola Heuristik Kode Berbahaya
+local THREAT_PATTERNS = {
+    {
+        id = "BACKDOOR_REQUIRE",
+        pattern = "require%s*%(%s*%d+%s*%)",
+        severity = "HIGH",
+        name = "Backdoor Numeric Require",
+        description = "Memanggil modul eksternal pihak ketiga via Asset ID numerik (indikasi backdoor/remote loader).",
+    },
+    {
+        id = "LOADSTRING_EXEC",
+        pattern = "loadstring%s*%(",
+        severity = "HIGH",
+        name = "Dynamic Code Execution (loadstring)",
+        description = "Mengeksekusi string kode dinamis yang tidak dapat diaudit.",
+    },
+    {
+        id = "GETFENV_SETFENV",
+        pattern = "[gs]etfenv%s*%(",
+        severity = "HIGH",
+        name = "Environment Manipulation (getfenv/setfenv)",
+        description = "Memanipulasi environment global Luau untuk mengelabui analisis statis.",
+    },
+    {
+        id = "DISCORD_WEBHOOK",
+        pattern = "discord[a-z]*%.com/api/webhooks",
+        severity = "HIGH",
+        name = "Discord Webhook Exfiltration",
+        description = "Mencoba mengirimkan data game atau informasi pemain ke webhook eksternal Discord.",
+    },
+    {
+        id = "IP_LOGGER",
+        pattern = "webhook%.site|grabify%.link|iplogger|blasze",
+        severity = "HIGH",
+        name = "External IP/Data Logger",
+        description = "Menghubungi domain pencatat IP atau data capture pihak ketiga.",
+    },
+    {
+        id = "FORCED_PURCHASE",
+        pattern = "MarketplaceService%s*:%s*Prompt[A-Za-z]*Purchase",
+        severity = "MEDIUM",
+        name = "Forced Robux/Product Purchase",
+        description = "Memicu dialog pembelian paksa Gamepass atau Developer Product.",
+    },
+    {
+        id = "FORCED_TELEPORT",
+        pattern = "TeleportService%s*:%s*Teleport",
+        severity = "MEDIUM",
+        name = "Forced Game Teleportation",
+        description = "Memindahkan pemain secara paksa ke game/place lain.",
+    },
+    {
+        id = "CHAR_TABLE_OBFUSCATION",
+        pattern = "string%.char%s*%(%s*%d+%s*,%s*%d+%s*,%s*%d+",
+        severity = "HIGH",
+        name = "Obfuscated string.char Array",
+        description = "Menyusun kode rahasia tersembunyi menggunakan deretan kode karakter ASCII.",
+    },
+}
+
+-- Helper: Pengecekan nama script mencurigakan
+local function checkSuspiciousName(name: string): boolean
+    for _, pattern in ipairs(SUSPICIOUS_SCRIPT_NAMES) do
+        if string.find(name, pattern) then
+            return true
+        end
+    end
+    return false
+end
+
+-- Helper: Deteksi obfuscation byte escape (\108\111\97\100) atau hex (\x6c\x6f)
+local function checkByteObfuscation(source: string): (boolean, string?)
+    local byteCount = 0
+    for _ in string.gmatch(source, "\\[0-9][0-9][0-9]") do
+        byteCount = byteCount + 1
+        if byteCount >= 4 then
+            return true, "Terdeteksi deretan escape byte ASCII (\\ddd) berulang."
+        end
+    end
+
+    local hexCount = 0
+    for _ in string.gmatch(source, "\\x[0-9a-fA-F][0-9a-fA-F]") do
+        hexCount = hexCount + 1
+        if hexCount >= 4 then
+            return true, "Terdeteksi deretan escape hex (\\xHH) berulang."
+        end
+    end
+
+    return false, nil
+end
+
+-- Helper: Deteksi kode yang sengaja disembunyikan dengan spasi/baris kosong berlebih
+local function checkOffscreenHiding(source: string): (boolean, string?)
+    -- Cek spasi horizontal masif (> 80 spasi berturut-turut)
+    if string.find(source, "   " .. string.rep(" ", 80)) then
+        return true, "Kode sengaja didorong ke kanan dengan lebih dari 80 spasi agar tersembunyi dari layar Studio."
+    end
+
+    -- Cek baris kosong masif di awal skrip (> 15 baris kosong)
+    local leadingNewlines = 0
+    for line in string.gmatch(source, "([^\r\n]*)\r?\n") do
+        if string.gsub(line, "%s+", "") == "" then
+            leadingNewlines = leadingNewlines + 1
+            if leadingNewlines >= 15 then
+                return true, "Terdapat lebih dari 15 baris kosong di awal skrip untuk menyembunyikan payload di baris bawah."
+            end
+        else
+            break
+        end
+    end
+
+    return false, nil
+end
+
+-- Analisis Source Code dari sebuah Script
+local function scanScriptSource(scriptInstance: Instance, source: string): { any }
+    local threats = {}
+    local lines = string.split(source, "\n")
+
+    -- 1. Scan pola heuristik baris per baris
+    for lineIdx, line in ipairs(lines) do
+        -- Skip baris komentar murni
+        local trimmed = string.match(line, "^%s*(.-)%s*$") or ""
+        if not string.sub(trimmed, 1, 2) == "--" then
+            for _, rule in ipairs(THREAT_PATTERNS) do
+                local s, e = string.find(line, rule.pattern)
+                if s then
+                    local snippet = string.sub(line, math.max(1, s - 30), math.min(#line, e + 30))
+                    table.insert(threats, {
+                        severity = rule.severity,
+                        ruleId = rule.id,
+                        name = rule.name,
+                        scriptName = scriptInstance.Name,
+                        scriptPath = scriptInstance:GetFullName(),
+                        scriptClass = scriptInstance.ClassName,
+                        line = lineIdx,
+                        snippet = string.match(snippet, "^%s*(.-)%s*$") or snippet,
+                        description = rule.description,
+                    })
+                end
+            end
+        end
+    end
+
+    -- 2. Cek Obfuscation
+    local isObf, obfReason = checkByteObfuscation(source)
+    if isObf then
+        table.insert(threats, {
+            severity = "HIGH",
+            ruleId = "BYTE_OBFUSCATION",
+            name = "Byte / Hex Obfuscation Payload",
+            scriptName = scriptInstance.Name,
+            scriptPath = scriptInstance:GetFullName(),
+            scriptClass = scriptInstance.ClassName,
+            line = 1,
+            snippet = string.sub(source, 1, 60) .. "...",
+            description = obfReason or "Payload kode disamarkan menggunakan escape bytes.",
+        })
+    end
+
+    -- 3. Cek Off-screen Code Hiding
+    local isHidden, hideReason = checkOffscreenHiding(source)
+    if isHidden then
+        table.insert(threats, {
+            severity = "HIGH",
+            ruleId = "OFFSCREEN_HIDING",
+            name = "Off-Screen Hidden Code",
+            scriptName = scriptInstance.Name,
+            scriptPath = scriptInstance:GetFullName(),
+            scriptClass = scriptInstance.ClassName,
+            line = 1,
+            snippet = "[Whitespace Padding Terdeteksi]",
+            description = hideReason or "Kode disembunyikan menggunakan whitespace ekstrem.",
+        })
+    end
+
+    return threats
+end
+
+-- ============================================================================
+-- PUBLIC API
+-- ============================================================================
+
+-- Memindai Instance secara rekursif
+function SecurityScanner.scanInstance(rootInstance: Instance, deepScan: boolean?)
+    local shouldDeepScan = (deepScan ~= false)
+    local allThreats = {}
+    local stats = {
+        totalInstances = 1,
+        models = 0,
+        parts = 0,
+        meshParts = 0,
+        textures = 0,
+        scripts = {
+            total = 0,
+            server = 0,
+            localScript = 0,
+            module = 0,
+        },
+    }
+
+    local function inspectItem(item: Instance)
+        stats.totalInstances = stats.totalInstances + 1
+
+        if item:IsA("Model") then
+            stats.models = stats.models + 1
+        elseif item:IsA("MeshPart") then
+            stats.meshParts = stats.meshParts + 1
+            stats.parts = stats.parts + 1
+        elseif item:IsA("BasePart") then
+            stats.parts = stats.parts + 1
+        elseif item:IsA("Texture") or item:IsA("Decal") or item:IsA("SurfaceAppearance") then
+            stats.textures = stats.textures + 1
+        end
+
+        if item:IsA("LuaSourceContainer") then
+            stats.scripts.total = stats.scripts.total + 1
+            if item:IsA("Script") then
+                stats.scripts.server = stats.scripts.server + 1
+            elseif item:IsA("LocalScript") then
+                stats.scripts.localScript = stats.scripts.localScript + 1
+            elseif item:IsA("ModuleScript") then
+                stats.scripts.module = stats.scripts.module + 1
+            end
+
+            -- Cek nama mencurigakan
+            if checkSuspiciousName(item.Name) then
+                table.insert(allThreats, {
+                    severity = "HIGH",
+                    ruleId = "SUSPICIOUS_SCRIPT_NAME",
+                    name = "Known Malicious Script Name Pattern",
+                    scriptName = item.Name,
+                    scriptPath = item:GetFullName(),
+                    scriptClass = item.ClassName,
+                    line = 0,
+                    snippet = item.Name,
+                    description = string.format("Nama skrip '%s' cocok dengan pola nama virus/backdoor klasik.", item.Name),
+                })
+            end
+
+            -- Deep scan isi source code
+            if shouldDeepScan then
+                local success, source = pcall(function()
+                    return (item :: any).Source
+                end)
+                if success and typeof(source) == "string" and #source > 0 then
+                    local scriptThreats = scanScriptSource(item, source)
+                    for _, t in ipairs(scriptThreats) do
+                        table.insert(allThreats, t)
+                    end
+                end
+            end
+        end
+    end
+
+    inspectItem(rootInstance)
+    for _, desc in ipairs(rootInstance:GetDescendants()) do
+        inspectItem(desc)
+    end
+
+    -- Hitung Level Risiko
+    local riskLevel = "SAFE"
+    local highCount = 0
+    local medCount = 0
+
+    for _, t in ipairs(allThreats) do
+        if t.severity == "HIGH" then
+            highCount = highCount + 1
+        elseif t.severity == "MEDIUM" then
+            medCount = medCount + 1
+        end
+    end
+
+    if highCount > 0 then
+        riskLevel = "DANGEROUS"
+    elseif medCount > 0 or stats.scripts.total > 0 then
+        riskLevel = "WARNING"
+    end
+
+    return {
+        riskLevel = riskLevel,
+        threats = allThreats,
+        stats = stats,
+        highThreats = highCount,
+        mediumThreats = medCount,
+    }
+end
+
+-- Menghapus seluruh skrip dari sebuah instance (Sanitasi Total)
+function SecurityScanner.stripScripts(rootInstance: Instance): { any }
+    local removed = {}
+
+    for _, desc in ipairs(rootInstance:GetDescendants()) do
+        if desc:IsA("LuaSourceContainer") then
+            table.insert(removed, {
+                name = desc.Name,
+                className = desc.ClassName,
+                path = desc:GetFullName(),
+            })
+            pcall(function()
+                desc:Destroy()
+            end)
+        end
+    end
+
+    if rootInstance:IsA("LuaSourceContainer") then
+        table.insert(removed, {
+            name = rootInstance.Name,
+            className = rootInstance.ClassName,
+            path = rootInstance:GetFullName(),
+        })
+        pcall(function()
+            rootInstance:Destroy()
+        end)
+    end
+
+    return removed
+end
+
+return SecurityScanner
+
 ]]></ProtectedString>
 			</Properties>
 		</Item>
@@ -1197,6 +2512,10 @@ end
             local currentVal = targetInstance[prop]
             if typeof(currentVal) == "Vector3" and type(val) == "table" and #val == 3 then
                 targetInstance[prop] = Vector3.new(val[1], val[2], val[3])
+            elseif typeof(currentVal) == "Vector2" and type(val) == "table" and #val >= 2 then
+                targetInstance[prop] = Vector2.new(val[1], val[2])
+            elseif typeof(currentVal) == "UDim" and type(val) == "table" and #val >= 2 then
+                targetInstance[prop] = UDim.new(val[1], val[2])
             elseif typeof(currentVal) == "Color3" and type(val) == "table" and #val == 3 then
                 local r, g, b = val[1], val[2], val[3]
                 if r > 1 or g > 1 or b > 1 then
@@ -1206,6 +2525,12 @@ end
                 end
             elseif typeof(currentVal) == "UDim2" and type(val) == "table" and #val == 4 then
                 targetInstance[prop] = UDim2.new(val[1], val[2], val[3], val[4])
+            elseif typeof(currentVal) == "NumberRange" and type(val) == "table" then
+                targetInstance[prop] = NumberRange.new(val[1], val[2] or val[1])
+            elseif typeof(currentVal) == "Rect" and type(val) == "table" and #val >= 4 then
+                targetInstance[prop] = Rect.new(val[1], val[2], val[3], val[4])
+            elseif typeof(currentVal) == "BrickColor" and type(val) == "string" then
+                targetInstance[prop] = BrickColor.new(val)
             elseif typeof(currentVal) == "CFrame" and type(val) == "table" then
                 targetInstance[prop] = CFrame.new(unpack(val))
             elseif typeof(currentVal) == "EnumItem" and type(val) == "string" then
@@ -1366,7 +2691,7 @@ function UIManager.init(pluginInstance, studioId)
 
     -- Version
     local versionLabel = Instance.new("TextLabel")
-    versionLabel.Text = "v2.2.0"
+    versionLabel.Text = "v2.3.0"
     versionLabel.Font = Enum.Font.Gotham
     versionLabel.TextSize = 11
     versionLabel.TextColor3 = Color3.fromRGB(120, 120, 130)