memshell-party-cli 0.5.0 → 0.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "memshell-party-cli",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Command-line client and MCP server for MemShellParty (party.mem.mk) — generate Java memory shells and probes from the terminal.",
   "keywords": [
     "memshell",

package/skills/memshell-party/SKILL.md

@@ -26,7 +26,7 @@ The CLI is the source of truth for examples below; MCP tool args mirror the CLI
 
 ## Step 0 — Discover, don't guess
 
-The backend supports ~17 servers, 9 shell tools, dozens of shell types, and 60+ packers. **Never
+The backend supports ~19 servers, 9 shell tools, dozens of shell types, and 60+ packers. **Never
 hard-code a server/packer name from memory.** Always enumerate first:
 
 ```bash
@@ -142,6 +142,13 @@ Output:
 - payload → **stdout** by default.
 - `-o shell.class` / `-o shell.jar` → auto base64-decodes and writes binary.
 - `--json` → full response (class names, sizes, base64 bytes, config echo) for downstream tooling.
+- `-o` + `--json` together → the file is still written and the JSON gains an
+  `outputFile: {destination, size, decoded}` field — the recommended combo for agents
+  (metadata via JSON, payload on disk).
+- `-o` refuses aggregate packers (several variants in `allPackResults`) with an error
+  telling you to pick a leaf packer.
+- MCP: `generate_memshell` / `generate_probe` accept an `outputFile` arg with the same
+  behavior (auto-decode by extension, write result echoed back as `outputFile`).
 
 ## Step 4 — Verify the shell is alive
 
@@ -237,10 +244,12 @@ regex crawler cannot.
    the site's **dominant traffic** looks like: a content site serves mostly HTML documents,
    an SPA serves mostly JSON XHR, an admin console serves mostly form POSTs.
 2. **Match the dominant traffic first.** Blending in is a statistics game: your requests
-   should be the same *shape* as what the site already serves all day. Today mimic speaks
-   HTML pages only — so on a content site mimic the high-traffic documents (homepage, list
-   pages); on an SPA/API site an HTML skin is the wrong shape (a JSON envelope skin is the
-   planned follow-up), and forcing it makes you *more* visible, not less.
+   should be the same *shape* as what the site already serves all day. A content site
+   serves HTML documents; an SPA serves JSON XHR; an AI product streams SSE — mimic
+   covers all of them: HTML pages (marker injected) or **any text response with a
+   `{{payload}}` placeholder** (JSON envelope, XML, JS, SSE chunks…) served with its
+   own contentType (a `text/event-stream` skin is flushed chunk by chunk, not as a
+   one-shot body), and form, JSON, or **fully templated request bodies**.
 3. **Scaffold + hand-write the profile:**
 
    ```bash
@@ -270,6 +279,15 @@ regex crawler cannot.
      `{{hex:N}}` (N hex), `{{b64:N}}` (N base64url), `{{uuid}}`, `{{ts}}` (unix seconds),
      `{{int:A:B}}`. Never ship the default `pass=<cipher>` single-field body — a lone
      `pass=` parameter is a textbook webshell signature.
+   - `request.bodyTemplate` (optional, secretIn=body only): a **full request body** with
+     `{{payload}}` where the ciphertext goes — for traffic a flat form/JSON body can't
+     imitate: an OpenAI-style chat completion (`{"model":…,"messages":[{"role":"user",
+     "content":"{{payload}}"}]}`, pair with an SSE skin), a GraphQL envelope, an XML/SOAP
+     message, or a multipart/form-data upload (write the boundary literally in the
+     template — the Content-Type boundary is inferred from its first delimiter line, or
+     set it explicitly in `headers`). Decoy macros render per request. The filter
+     extracts the field from any raw body (JSON / multipart / XML anchors), so no
+     server-side change is needed per format.
    - `cipher` (optional): the wire codec. Fields (all optional, defaults = the legacy
      format `aes-ecb` + `base64` + `js-var` + no tail):
      - `algorithm`: `"aes-ecb"` (fixed blocks — same plaintext ⇒ same ciphertext),
@@ -459,6 +477,7 @@ actions before repeating them, or to answer "what did we run on this host?".
   `--injector-class-name` for these.
 - **Shrink is on by default** (smaller bytecode). Use `--no-shrink` only if a stripped payload misbehaves.
 - **Aggregate packers** return multiple variants — pick a leaf for a single payload (see Step 1).
+  `-o`/`outputFile` refuses them outright (error tells you to pick a leaf packer).
 - **Agent memshells** (`Agent*` types) require the `AgentJar*` packer family and a JVM attach; they
   aren't class-byte payloads.
 - **Backend override.** Default is the public `https://party.mem.mk` (good for trying things, but