memshell-party-cli 0.8.0 → 0.8.1

package/README.en.md

@@ -115,6 +115,23 @@ multiple variants. Combining `-o` with `--json` writes the file and adds
 `outputFile: {destination, size, decoded}` to the JSON document. v3 also supports `--obfuscate`,
 `--obfuscation-options key=value,...`, and `--obfuscation-scope` (memshell only).
 
+For built-in and external plugin fields not covered by a dedicated flag, repeat
+`--tool-option name=value`, or pass `--tool-config <json|path>`. v3.1 `object` fields take JSON
+objects directly. `--tool-config` can be inline JSON or a file path; `--tool-option` overrides
+matching JSON-file keys and legacy convenience flags:
+
+```bash
+memparty gen -s Tomcat -t PluginTool -y Filter -p DefaultBase64 \
+  --tool-option mode=fast \
+  --tool-option 'target={"id":"web-1","name":"Web"}'
+```
+
+The wizard discovers plugin `string`, `enum`, and `object` parameters from the backend. For
+v3.1 `remote-select` fields, it fetches the supplied HTTP(S) JSON endpoint and submits the
+selected ID for a string field or the complete object for an object field. A sole remote field
+selects its first option automatically. Set the environment variable named by `urlQueryParam`
+to avoid entering the endpoint; generation never fetches it again on the backend.
+
 ### Discovering options
 
 ```bash
@@ -124,9 +141,16 @@ memparty config packers          # packer parent/child tree
 memparty config command          # Command encryptors & implementation classes
 memparty config tool-configs     # v3 tool parameters and enum options
 memparty config obfuscation     # v3 obfuscation option reference
+memparty config plugins         # v3.1 plugin metadata, SPI services and load status
+memparty config remote-options PluginTool target --url https://example.com/options --json
 memparty config servers --json   # machine-readable
 ```
 
+`config tool-configs` describes remote metadata as `ui.kind=remote-select`; `config remote-options`
+returns `{label, value}` choices ready to submit. If `--url` is omitted, it reads the environment
+variable named by the field's `urlQueryParam`. Plugin `validate()` errors are returned unchanged
+by the API; the CLI does not hide or retry them.
+
 ### Probe shells
 
 ```bash
@@ -403,7 +427,7 @@ Example Claude Code / Claude Desktop config:
 ```
 
 Exposed tools: `list_servers`, `list_config`, `list_packers`, `list_command_configs`,
-`list_shell_tool_configs`, `list_obfuscation_options`, `generate_memshell`, `generate_probe`, `bytecode_decode`, `bytecode_transform`, `parse_classname`, `server_version`, `connect_test`,
+`list_shell_tool_configs`, `list_plugins`, `list_remote_options`, `list_obfuscation_options`, `generate_memshell`, `generate_probe`, `bytecode_decode`, `bytecode_transform`, `parse_classname`, `server_version`, `connect_test`,
 `exec_command`, `download_file`, `upload_file`, `target_save`, `target_note`, `target_list`,
 `target_remove`, `log_list`.
 
@@ -412,6 +436,11 @@ optional `outputFile` argument to also write it to a local file (base64 auto-dec
 `.class`/`.jar`/`.zip`/`.ser`/`.bin`), and the response gains an `outputFile` field with the
 write result.
 
+`generate_memshell` also accepts `toolOptions`: a map of arbitrary shell-tool names to string
+values or JSON objects, including v3.1 plugin parameters. `toolOptionJson` is the string-encoded
+alternative for object fields. Use `list_shell_tool_configs` to discover fields and
+`list_remote_options` to resolve remote dropdowns before generation.
+
 ## AI skill
 
 The package ships `skills/memshell-party/SKILL.md` — a workflow guide for agents (server / tool /

package/README.md

@@ -179,6 +179,8 @@ memparty download web1 /etc/passwd -o loot/passwd
 - `-o` 和 `--json` 可以同时用：文件照常写盘，JSON 里多一个 `outputFile` 字段（路径、大小、是否解码）。
 - v3 中 `Base64` 等父项只是 packer 分类，要选具体变体（如 `DefaultBase64`）；旧 v2 后端仍支持聚合 packer，但不能配 `-o`。
 - v3 支持 `--obfuscate`、`--obfuscation-options key=value,...`、`--obfuscation-scope`（仅内存马）和 `--jdk java25`。
+- v3.1 插件参数可用重复的 `--tool-option name=value` 或 `--tool-config <json|path>` 传入；`object` 类型直接写 JSON 对象。`tool-option` 覆盖同名的旧参数及 `tool-config` 字段。
+- 插件的远程下拉字段可用 `memparty config remote-options <tool> <param> --url <endpoint>` 查询；交互向导会拉取选项，`string` 字段提交 ID，`object` 字段提交完整对象。
 - 探测支持 `-m ResponseHeader`；可用 `--resp-header-name` 指定回显头，未知中间件时 `--server Unknown`。
 - 走 MCP 时，`generate_memshell` / `generate_probe` 有个 `outputFile` 参数，效果同上。
 - Agent 加载参数使用 `--agent-args persist=true` 或 `--agent-args restore=true`；它是 attach 参数，不会发送给生成 API。JSON 和终端会给出 `java -jar agent.jar <pid> persist=true`、`jattach <pid> load instrument false agent.jar=persist=true` 示例。
@@ -204,8 +206,20 @@ memparty config tools Tomcat     # 这个中间件支持哪些工具和挂载类
 memparty config packers          # 打包器列表（按投放方式选）
 memparty config tool-configs     # v3 各工具的参数名和枚举值
 memparty config obfuscation     # v3 混淆参数参考
+memparty config plugins         # v3.1 外置插件、SPI 和加载状态
+memparty config remote-options PluginTool target --url https://example.com/options --json
 ```
 
+插件生成示例：
+
+```bash
+memparty gen -s Tomcat -t PluginTool -y Filter -p DefaultBase64 \
+  --tool-option mode=fast \
+  --tool-option 'target={"id":"web-1","name":"Web"}'
+```
+
+`config tool-configs` 的 `ui.kind=remote-select` 表示远程字段，`urlQueryParam` 是同名的环境变量名；没有 `--url` 时会读这个环境变量。后端参数校验错误会原样返回，不会被 CLI 自动重试。
+
 每个命令都能加 `--help` 看详细参数和例子；完整参数参考见 [英文 README](README.en.md)。
 
 ## 后端：真实测试建议自建

package/dist/cli.js

@@ -86,6 +86,14 @@ var MemPartyClient = class {
   getVersion() {
     return this.request("GET", "/api/version");
   }
+  async getPlugins() {
+    try {
+      return await this.request("GET", "/api/plugins");
+    } catch (err) {
+      if (err instanceof ApiError && err.status === 404) return [];
+      throw err;
+    }
+  }
   // ---------- generation ----------
   async generateMemShell(req) {
     const apiVersion = await this.getGenerationApiVersion();
@@ -251,6 +259,127 @@ function reportError(message, argv) {
   }
 }
 
+// src/core/shell-tool-config.ts
+function toolConfigForTool(configs, tool) {
+  return configs.find((config) => config.tool === tool);
+}
+function parseShellToolConfig(assignments, params) {
+  const result = {};
+  for (const assignment of assignments ?? []) {
+    const separator = assignment.indexOf("=");
+    if (separator <= 0) {
+      throw new Error(`Invalid --tool-option "${assignment}". Expected name=value.`);
+    }
+    const name = assignment.slice(0, separator).trim();
+    const rawValue = assignment.slice(separator + 1);
+    if (!name) throw new Error(`Invalid --tool-option "${assignment}". Expected name=value.`);
+    const param = params?.find((candidate) => candidate.name === name);
+    if (params !== void 0 && param === void 0) {
+      throw new Error(
+        `Unknown shell tool option "${name}". Available options: ${params.map((item) => item.name).join(", ") || "(none)"}.`
+      );
+    }
+    if (param?.type === "object") {
+      result[name] = parseJsonObject(rawValue, `--tool-option ${name}`);
+    } else if (rawValue.startsWith("{")) {
+      result[name] = parseJsonObject(rawValue, `--tool-option ${name}`);
+    } else {
+      result[name] = rawValue;
+    }
+  }
+  return result;
+}
+function parseToolConfigFile(source, params) {
+  const parsed = parseJsonObject(source, "--tool-config");
+  const assignments = Object.entries(parsed).map(([name, value]) => {
+    if (typeof value === "string") return `${name}=${value}`;
+    return `${name}=${JSON.stringify(value)}`;
+  });
+  return parseShellToolConfig(assignments, params);
+}
+function validateRequiredRemoteOptions(config, params) {
+  const missing = (params ?? []).filter((param) => param.ui?.kind === "remote-select" && param.ui.required).filter((param) => {
+    const value = config[param.name];
+    return value === void 0 || typeof value === "string" && value.trim() === "";
+  }).map((param) => param.name);
+  if (missing.length > 0) {
+    throw new Error(
+      `Missing required remote shell tool option(s): ${missing.join(", ")}. Provide them with --tool-option or --tool-config.`
+    );
+  }
+}
+function parseJsonObject(source, label) {
+  let parsed;
+  try {
+    parsed = JSON.parse(source);
+  } catch (err) {
+    throw new Error(`${label} must be valid JSON: ${err.message}`);
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error(`${label} must be a JSON object.`);
+  }
+  return parsed;
+}
+function readRemotePath(value, path) {
+  if (!path) return value;
+  let current = value;
+  for (const segment of path.split(".")) {
+    if (!segment || typeof current !== "object" || current === null || Array.isArray(current) || !(segment in current)) {
+      return void 0;
+    }
+    current = current[segment];
+  }
+  return current;
+}
+function normalizeRemoteOptions(payload, hint, objectMode) {
+  const items = readRemotePath(payload, hint.itemsPath);
+  if (!Array.isArray(items)) {
+    throw new Error("Remote options response does not contain an array at itemsPath.");
+  }
+  return items.map((item) => {
+    if (typeof item !== "object" || item === null || Array.isArray(item)) {
+      throw new Error("Remote option items must be objects.");
+    }
+    const rawLabel = readRemotePath(item, hint.labelPath);
+    if (typeof rawLabel !== "string" && typeof rawLabel !== "number") {
+      throw new Error("Remote option labels must be strings or numbers.");
+    }
+    if (objectMode) return { label: String(rawLabel), value: item };
+    if (!hint.valuePath) throw new Error("String remote options require valuePath.");
+    const rawValue = readRemotePath(item, hint.valuePath);
+    if (typeof rawValue !== "string" && typeof rawValue !== "number") {
+      throw new Error("Remote option values must be strings or numbers.");
+    }
+    return { label: String(rawLabel), value: String(rawValue) };
+  });
+}
+function validateRemoteOptionsUrl(value) {
+  const url = new URL(value);
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new Error("Remote options URL must use HTTP or HTTPS.");
+  }
+  return url.toString();
+}
+async function fetchRemoteOptions(sourceUrl, hint, objectMode, fetchImpl = globalThis.fetch, signal) {
+  const url = validateRemoteOptionsUrl(sourceUrl);
+  const response = await fetchImpl(url, {
+    method: "GET",
+    headers: { Accept: "application/json" },
+    redirect: "follow",
+    signal
+  });
+  if (!response.ok) {
+    throw new Error(`Remote options request failed (${response.status} ${response.statusText}).`);
+  }
+  let payload;
+  try {
+    payload = await response.json();
+  } catch {
+    throw new Error("Remote options response must be valid JSON.");
+  }
+  return normalizeRemoteOptions(payload, hint, objectMode);
+}
+
 // src/commands/config.ts
 function printJsonOrLines(data, json, renderLines) {
   if (json) {
@@ -272,6 +401,8 @@ Examples:
   $ memparty config command          # Command-tool encryptors and impl classes
   $ memparty config tool-configs     # v3+ tool parameter names and enum values
   $ memparty config obfuscation     # v3+ obfuscation option reference
+  $ memparty config plugins         # v3.1+ external plugin metadata and load status
+  $ memparty config remote-options PluginTool target --url https://example.com/options
 `
   );
   config.command("servers").description("List supported servers and their shell types").option("--json", "output raw JSON").action(async (opts, cmd) => {
@@ -316,11 +447,47 @@ Examples:
       () => configs.length ? configs.flatMap((config2) => [
         config2.tool,
         ...config2.params.map(
-          (param) => `  ${param.name} (${param.type})${param.options.length ? `: ${param.options.join(", ")}` : ""}`
+          (param) => `  ${param.name} (${param.type})${param.options.length ? `: ${param.options.join(", ")}` : ""}${param.ui?.kind === "remote-select" ? ` [remote: ${param.ui.urlQueryParam}${param.ui.required ? ", required" : ""}]` : ""}`
         )
       ]) : ["No v3 shell-tool config endpoint on this backend."]
     );
   });
+  config.command("plugins").description("List external plugin metadata and load status (MemShellParty v3.1+)").option("--json", "output raw JSON").action(async (opts, cmd) => {
+    const client = createClient(cmd.optsWithGlobals());
+    const plugins = await client.getPlugins();
+    printJsonOrLines(
+      plugins,
+      opts.json,
+      () => plugins.length ? plugins.flatMap((plugin) => [
+        `${plugin.name}${plugin.version ? ` (${plugin.version})` : ""} [${plugin.loaded ? "loaded" : "not loaded"}]`,
+        `  jar: ${plugin.jarFileName}`,
+        ...plugin.author ? [`  author: ${plugin.author}`] : [],
+        ...plugin.description ? [`  description: ${plugin.description}`] : [],
+        ...plugin.homepage ? [`  homepage: ${plugin.homepage}`] : [],
+        ...plugin.license ? [`  license: ${plugin.license}`] : [],
+        ...plugin.source ? [`  source: ${plugin.source}`] : [],
+        ...plugin.spiServices.length ? [`  SPI: ${plugin.spiServices.join(", ")}`] : [],
+        ...plugin.loadError ? [`  load error: ${plugin.loadError}`] : []
+      ]) : ["No external plugins (or the backend predates v3.1)."]
+    );
+  });
+  config.command("remote-options").description("Resolve a v3.1 remote-select field into string IDs or complete objects").argument("<tool>", "shell tool name").argument("<param>", "remote-select parameter name").option("--url <url>", "remote JSON endpoint (or set the field's urlQueryParam as an env var)").option("--object", "return complete objects instead of using the parameter's declared type").option("--json", "output raw JSON").action(async (tool, paramName, opts, cmd) => {
+    const client = createClient(cmd.optsWithGlobals());
+    const descriptor = (await client.getShellToolConfigs()).find((config2) => config2.tool === tool);
+    const param = descriptor?.params.find((candidate) => candidate.name === paramName);
+    if (!param?.ui || param.ui.kind !== "remote-select") {
+      throw new Error(`${tool}.${paramName} is not a remote-select shell tool option.`);
+    }
+    const sourceUrl = opts.url ?? process.env[param.ui.urlQueryParam];
+    if (!sourceUrl) {
+      throw new Error(`Provide --url or set the ${param.ui.urlQueryParam} environment variable.`);
+    }
+    const options = await fetchRemoteOptions(sourceUrl, param.ui, opts.object ?? param.type === "object");
+    printJsonOrLines(options, opts.json, () => options.map((option, index) => {
+      const value = typeof option.value === "string" ? option.value : JSON.stringify(option.value);
+      return `${index}: ${option.label} => ${value}`;
+    }));
+  });
   config.command("obfuscation").description("List obfuscation options (MemShellParty v3+)").option("--json", "output raw JSON").action(async (opts, cmd) => {
     const client = createClient(cmd.optsWithGlobals());
     const options = await client.getObfuscationOptions();
@@ -3987,6 +4154,7 @@ function generateSpringExpressionInjectorClassName() {
   return `org.springframework.expression.${randomChar(UPPERCASE_LETTERS)}${randomName}Util`;
 }
 function buildMemShellRequest(opts) {
+  validateRequiredRemoteOptions(opts.shellToolConfig ?? {}, opts.shellToolParams);
   const injectorClassName = SPRING_GZIP_JDK17_RELATED_PACKERS.has(opts.packer) ? generateSpringExpressionInjectorClassName() : opts.injectorClassName;
   return {
     shellConfig: {
@@ -4013,7 +4181,8 @@ function buildMemShellRequest(opts) {
       headerValue: opts.headerValue,
       shellClassBase64: opts.shellClassBase64,
       encryptor: opts.encryptor,
-      implementationClass: opts.implementationClass
+      implementationClass: opts.implementationClass,
+      ...opts.shellToolConfig
     },
     injectorConfig: {
       injectorClassName,
@@ -4072,7 +4241,11 @@ var JDK_CHOICES = [
   }))
 ];
 async function runMemShellWizard(client) {
-  const [config, packerTree] = await Promise.all([client.getConfig(), client.getPackerTree()]);
+  const [config, packerTree, toolConfigs] = await Promise.all([
+    client.getConfig(),
+    client.getPackerTree(),
+    client.getShellToolConfigs()
+  ]);
   const server = await select({
     message: "Target server",
     choices: Object.keys(config).map((s) => ({ name: s, value: s }))
@@ -4096,7 +4269,111 @@ async function runMemShellWizard(client) {
     choices: selected.children.map((name) => ({ name, value: name }))
   }) : category;
   const opts = { server, shellTool, shellType, packer };
-  switch (shellTool) {
+  const toolConfig = toolConfigForTool(toolConfigs, shellTool);
+  if (toolConfig) {
+    opts.shellToolParams = toolConfig.params;
+    opts.shellToolConfig = {};
+    const visibleParams = toolConfig.params.filter((param) => param.ui?.kind === "remote-select" || !useRandomDefaults(toolConfig));
+    const singleRemoteParam = visibleParams.length === 1 && visibleParams[0]?.ui?.kind === "remote-select" ? visibleParams[0] : void 0;
+    for (const param of visibleParams) {
+      const value = await promptToolParam(param, param.name === singleRemoteParam?.name);
+      if (value !== void 0 && value !== "") opts.shellToolConfig[param.name] = value;
+    }
+  } else {
+    await promptLegacyToolConfig(opts, client);
+  }
+  const shellClassName = await input({ message: "Shell class name (optional, random if empty)", default: "" });
+  if (shellClassName) opts.shellClassName = shellClassName;
+  opts.urlPattern = await input({ message: "URL pattern", default: "/*" });
+  const jdk = await select({ message: "Target JDK", choices: JDK_CHOICES });
+  if (jdk) opts.jdk = jdk;
+  const toggles = await checkbox({
+    message: "Options",
+    choices: [
+      { name: "shrink bytecode", value: "shrink", checked: true },
+      { name: "static initialize", value: "staticInitialize", checked: true },
+      { name: "bypass Java module", value: "byPassJavaModule" },
+      { name: "lambda suffix", value: "lambdaSuffix" },
+      { name: "debug", value: "debug" },
+      { name: "class obfuscation (v3+)", value: "obfuscate" }
+    ]
+  });
+  opts.shrink = toggles.includes("shrink");
+  opts.staticInitialize = toggles.includes("staticInitialize");
+  opts.byPassJavaModule = toggles.includes("byPassJavaModule");
+  opts.lambdaSuffix = toggles.includes("lambdaSuffix");
+  opts.debug = toggles.includes("debug");
+  opts.obfuscate = toggles.includes("obfuscate");
+  const confirmed = await confirm({ message: `Generate ${shellTool} ${shellType} for ${server} (${packer})?` });
+  if (!confirmed) {
+    throw new Error("Cancelled by user.");
+  }
+  return opts;
+}
+async function promptToolParam(param, autoSelectFirst = false) {
+  const label = param.label || param.name;
+  if (param.ui?.kind === "remote-select") {
+    const defaultSource = process.env[param.ui.urlQueryParam] ?? "";
+    const sourceUrl = defaultSource || await input({
+      message: `${label}: remote options URL (${param.ui.urlQueryParam})${param.ui.required ? "" : " (optional)"}`,
+      default: defaultSource
+    });
+    if (!sourceUrl) return void 0;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 3e4);
+    try {
+      const options = await fetchRemoteOptions(
+        sourceUrl,
+        param.ui,
+        param.type === "object",
+        globalThis.fetch,
+        controller.signal
+      );
+      if (options.length === 0) throw new Error(`No remote options returned for ${param.name}.`);
+      if (autoSelectFirst) return options[0].value;
+      const selected = await select({
+        message: label,
+        choices: options.map((option, index) => ({ name: option.label, value: String(index) }))
+      });
+      return options[Number(selected)].value;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  if (param.type === "object") {
+    const raw = await input({ message: `${label} (JSON object, optional)`, default: "" });
+    if (!raw) return void 0;
+    let value;
+    try {
+      value = JSON.parse(raw);
+    } catch (err) {
+      throw new Error(`${param.name} must be valid JSON: ${err.message}`);
+    }
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+      throw new Error(`${param.name} must be a JSON object.`);
+    }
+    return value;
+  }
+  if (param.type === "enum") {
+    return select({
+      message: label,
+      choices: [
+        { name: `backend default${param.placeholder ? ` (${param.placeholder})` : ""}`, value: "" },
+        ...param.options.map((option) => ({ name: option, value: option }))
+      ]
+    });
+  }
+  if (param.name === "shellClassBase64") {
+    const file = await input({ message: "Path to custom .class file" });
+    return file ? readFileSync7(file).toString("base64") : void 0;
+  }
+  return input({ message: label, default: "", ...param.placeholder ? { placeholder: param.placeholder } : {} });
+}
+function useRandomDefaults(config) {
+  return ["Godzilla", "GodzillaSession", "Behinder", "AntSword"].includes(config.tool);
+}
+async function promptLegacyToolConfig(opts, client) {
+  switch (opts.shellTool) {
     case "Godzilla":
     case "GodzillaSession":
       opts.godzillaPass = await input({ message: "Godzilla pass", default: "pass" });
@@ -4110,14 +4387,14 @@ async function runMemShellWizard(client) {
       break;
     case "Command": {
       opts.commandParamName = await input({ message: "Command param name", default: "cmd" });
-      const cc = await client.getCommandConfigs();
+      const commandConfig = await client.getCommandConfigs();
       opts.encryptor = await select({
         message: "Encryptor",
-        choices: cc.encryptors.map((e) => ({ name: e, value: e }))
+        choices: commandConfig.encryptors.map((value) => ({ name: value, value }))
       });
       opts.implementationClass = await select({
         message: "Implementation class",
-        choices: cc.implementationClasses.map((e) => ({ name: e, value: e }))
+        choices: commandConfig.implementationClasses.map((value) => ({ name: value, value }))
       });
       const template = await input({ message: "Command template (optional, {command} placeholder)", default: "" });
       if (template) opts.commandTemplate = template;
@@ -4128,48 +4405,30 @@ async function runMemShellWizard(client) {
       opts.shellClassBase64 = readFileSync7(file).toString("base64");
       break;
     }
-    default:
-      break;
   }
   opts.headerName = await input({ message: "Header name", default: "User-Agent" });
   const headerValue = await input({ message: "Header value (optional)", default: "" });
   if (headerValue) opts.headerValue = headerValue;
-  const shellClassName = await input({ message: "Shell class name (optional, random if empty)", default: "" });
-  if (shellClassName) opts.shellClassName = shellClassName;
-  opts.urlPattern = await input({ message: "URL pattern", default: "/*" });
-  const jdk = await select({ message: "Target JDK", choices: JDK_CHOICES });
-  if (jdk) opts.jdk = jdk;
-  const toggles = await checkbox({
-    message: "Options",
-    choices: [
-      { name: "shrink bytecode", value: "shrink", checked: true },
-      { name: "static initialize", value: "staticInitialize", checked: true },
-      { name: "bypass Java module", value: "byPassJavaModule" },
-      { name: "lambda suffix", value: "lambdaSuffix" },
-      { name: "debug", value: "debug" },
-      { name: "class obfuscation (v3+)", value: "obfuscate" }
-    ]
-  });
-  opts.shrink = toggles.includes("shrink");
-  opts.staticInitialize = toggles.includes("staticInitialize");
-  opts.byPassJavaModule = toggles.includes("byPassJavaModule");
-  opts.lambdaSuffix = toggles.includes("lambdaSuffix");
-  opts.debug = toggles.includes("debug");
-  opts.obfuscate = toggles.includes("obfuscate");
-  const confirmed = await confirm({ message: `Generate ${shellTool} ${shellType} for ${server} (${packer})?` });
-  if (!confirmed) {
-    throw new Error("Cancelled by user.");
-  }
-  return opts;
 }
 
 // src/commands/gen.ts
 var REQUIRED = ["server", "tool", "type", "packer"];
-function toOptions(o) {
+async function toOptions(o, client) {
   let shellClassBase64 = o.shellClassBase64;
   if (o.shellClassFile) {
     shellClassBase64 = readFileSync8(o.shellClassFile).toString("base64");
   }
+  const hasPluginOptions = (o.toolOption?.length ?? 0) > 0 || o.toolConfig !== void 0;
+  const toolConfigs = hasPluginOptions ? await client.getShellToolConfigs() : [];
+  const shellToolParams = hasPluginOptions ? toolConfigs.find((config) => config.tool === o.tool)?.params : void 0;
+  const fromFile = o.toolConfig === void 0 ? {} : parseToolConfigFile(
+    o.toolConfig.trimStart().startsWith("{") ? o.toolConfig : readFileSync8(o.toolConfig, "utf8"),
+    shellToolParams
+  );
+  const shellToolConfig = {
+    ...fromFile,
+    ...parseShellToolConfig(o.toolOption, shellToolParams)
+  };
   return {
     server: o.server,
     serverVersion: o.serverVersion,
@@ -4186,6 +4445,8 @@ function toOptions(o) {
     obfuscationOptions: parseObfuscationOptions(o.obfuscationOptions),
     obfuscationScope: o.obfuscationScope,
     shellClassName: o.shellClassName,
+    shellToolConfig: hasPluginOptions ? shellToolConfig : void 0,
+    shellToolParams,
     godzillaPass: o.godzillaPass,
     godzillaKey: o.godzillaKey,
     behinderPass: o.behinderPass,
@@ -4210,7 +4471,12 @@ function registerGenCommand(program) {
       "INJECTOR",
       "MEMSHELL"
     ])
-  ).option("--shell-class-name <name>", "explicit shell class name (random if omitted)").option("--godzilla-pass <pass>", "Godzilla / GodzillaSession password").option("--godzilla-key <key>", "Godzilla / GodzillaSession key").option("--behinder-pass <pass>", "Behinder password").option("--antsword-pass <pass>", "AntSword password").option("--command-param-name <name>", "Command tool parameter name").option("--command-template <tpl>", "Command template ({command} placeholder)").option("--encryptor <name>", "Command encryptor").option("--implementation-class <name>", "Command implementation class").option("--header-name <name>", "auth header name").option("--header-value <value>", "auth header value").option("--shell-class-base64 <b64>", "custom shell class (base64) for the Custom tool").option("--shell-class-file <path>", "custom shell .class file for the Custom tool").option("--url-pattern <pattern>", "injector URL pattern").option("--injector-class-name <name>", "explicit injector class name").option("--no-static-initialize", "disable injector static initialization (enabled by default)").option("--agent-args <args>", "Agent load-time arguments, e.g. persist=true or restore=true (not sent to the generate API)").option("-o, --output <file>", "write payload to a file instead of stdout").addOption(new Option4("--decode", "base64-decode the payload before writing")).addOption(new Option4("--no-decode", "do not base64-decode the payload")).option("--json", "print the full JSON response instead of just the payload (with -o the file is still written and the JSON gains an outputFile field)").option("-i, --interactive", "force the interactive wizard").option("--no-interactive", "never launch the wizard; error on missing flags").addHelpText(
+  ).option("--shell-class-name <name>", "explicit shell class name (random if omitted)").option(
+    "--tool-option <name=value>",
+    "shell-tool-specific option; repeat for multiple fields; object values use JSON (v3.1+)",
+    (value, previous = []) => [...previous, value],
+    []
+  ).option("--tool-config <json|path>", "shell-tool options as a JSON object or a JSON file path").option("--godzilla-pass <pass>", "Godzilla / GodzillaSession password").option("--godzilla-key <key>", "Godzilla / GodzillaSession key").option("--behinder-pass <pass>", "Behinder password").option("--antsword-pass <pass>", "AntSword password").option("--command-param-name <name>", "Command tool parameter name").option("--command-template <tpl>", "Command template ({command} placeholder)").option("--encryptor <name>", "Command encryptor").option("--implementation-class <name>", "Command implementation class").option("--header-name <name>", "auth header name").option("--header-value <value>", "auth header value").option("--shell-class-base64 <b64>", "custom shell class (base64) for the Custom tool").option("--shell-class-file <path>", "custom shell .class file for the Custom tool").option("--url-pattern <pattern>", "injector URL pattern").option("--injector-class-name <name>", "explicit injector class name").option("--no-static-initialize", "disable injector static initialization (enabled by default)").option("--agent-args <args>", "Agent load-time arguments, e.g. persist=true or restore=true (not sent to the generate API)").option("-o, --output <file>", "write payload to a file instead of stdout").addOption(new Option4("--decode", "base64-decode the payload before writing")).addOption(new Option4("--no-decode", "do not base64-decode the payload")).option("--json", "print the full JSON response instead of just the payload (with -o the file is still written and the JSON gains an outputFile field)").option("-i, --interactive", "force the interactive wizard").option("--no-interactive", "never launch the wizard; error on missing flags").addHelpText(
     "after",
     `
 Examples:
@@ -4223,6 +4489,8 @@ Examples:
       --command-param-name cmd --encryptor RAW --implementation-class RuntimeExec
   $ memparty gen -s Tomcat -t Godzilla -y Listener -p DefaultBase64 --json
   $ memparty gen -s Tomcat -t Godzilla -y AgentFilterChain -p AgentJar --agent-args persist=true
+  $ memparty gen -s Tomcat -t PluginTool -y Filter -p DefaultBase64 \\
+      --tool-option profile='{"id":"web-1","name":"Web"}' --tool-option mode=fast
 
 Note: run 'memparty config' to list the available servers, tools, shell
 types and packers. On v3, parent packers are categories \u2014 pick a concrete
@@ -4230,6 +4498,9 @@ variant (e.g. DefaultBase64 instead of Base64). Legacy v2 backends still
 support aggregate packers, but -o cannot write several variants to one file.
 The --json output includes the gate header (shellToolConfig) you need for
 'memparty connect' / 'memparty exec'.
+Use 'memparty config tool-configs' to discover plugin string, enum and object
+fields. --tool-config can be an inline JSON object or a path to a JSON file.
+Repeated --tool-option values override matching keys from --tool-config.
 `
   ).action(async (opts, cmd) => {
     const client = createClient(cmd.optsWithGlobals());
@@ -4245,7 +4516,7 @@ The --json output includes the gate header (shellToolConfig) you need for
           `Missing required option(s): ${missing.map((m) => `--${m}`).join(", ")}. Run in a terminal for the wizard, or pass -i.`
         );
       }
-      memOpts = toOptions(opts);
+      memOpts = await toOptions(opts, client);
     }
     const request = buildMemShellRequest(memOpts);
     const { agentArgs } = opts;
@@ -4484,6 +4755,10 @@ var memShellInput = {
   obfuscationOptions: z.string().optional().describe("obfuscation overrides: key=value, comma-separated"),
   obfuscationScope: z.enum(["ALL", "MEMSHELL_INJECTOR", "INJECTOR", "MEMSHELL"]).optional(),
   shellClassName: z.string().optional(),
+  toolOptions: z.record(z.union([z.string(), z.record(z.unknown())])).optional().describe(
+    "Additional shell-tool fields from list_shell_tool_configs, including plugin fields. String/enum fields use strings; v3.1+ object fields use JSON objects. These override matching built-in convenience arguments."
+  ),
+  toolOptionJson: z.record(z.string()).optional().describe("String-encoded shell-tool fields (name -> value); object fields contain JSON text."),
   godzillaPass: z.string().optional(),
   godzillaKey: z.string().optional(),
   behinderPass: z.string().optional(),
@@ -4758,6 +5033,50 @@ function createMcpServer(client) {
       }
     }
   );
+  server.registerTool(
+    "list_plugins",
+    {
+      title: "List external plugins",
+      description: "List v3.1+ external plugin metadata, SPI services, load status and load errors. An empty list means no plugins or a backend older than v3.1."
+    },
+    async () => {
+      try {
+        return jsonContent(await client.getPlugins());
+      } catch (err) {
+        return errorContent(err);
+      }
+    }
+  );
+  server.registerTool(
+    "list_remote_options",
+    {
+      title: "Resolve remote shell tool options",
+      description: "Fetch and normalize a v3.1 remote-select field. Returns labels and string IDs or complete objects ready to pass to generate_memshell toolOptions.",
+      inputSchema: {
+        tool: z.string(),
+        param: z.string(),
+        url: z.string().optional().describe("Remote HTTP(S) endpoint; falls back to the urlQueryParam environment variable."),
+        object: z.boolean().optional().describe("Override object mode; normally inferred from the field type.")
+      }
+    },
+    async (args) => {
+      try {
+        const descriptor = (await client.getShellToolConfigs()).find((config) => config.tool === args.tool);
+        const param = descriptor?.params.find((candidate) => candidate.name === args.param);
+        if (!param?.ui || param.ui.kind !== "remote-select") {
+          throw new Error(`${args.tool}.${args.param} is not a remote-select shell tool option.`);
+        }
+        const sourceUrl = args.url ?? process.env[param.ui.urlQueryParam];
+        if (!sourceUrl) {
+          throw new Error(`Provide url or set the ${param.ui.urlQueryParam} environment variable.`);
+        }
+        const options = await fetchRemoteOptions(sourceUrl, param.ui, args.object ?? param.type === "object");
+        return jsonContent({ tool: args.tool, param: args.param, sourceUrl, options });
+      } catch (err) {
+        return errorContent(err);
+      }
+    }
+  );
   server.registerTool(
     "list_obfuscation_options",
     {
@@ -4795,9 +5114,21 @@ function createMcpServer(client) {
             "agentArgs requires an Agent* shell type and an AgentJar, AgentJarWithJDKAttacher, or AgentJarWithJREAttacher packer."
           );
         }
+        const hasPluginOptions = args.toolOptions !== void 0 || args.toolOptionJson !== void 0;
+        const toolConfigs = hasPluginOptions ? await client.getShellToolConfigs() : [];
+        const shellToolParams = hasPluginOptions ? toolConfigs.find((config) => config.tool === args.shellTool)?.params : void 0;
+        const shellToolConfig = {
+          ...args.toolOptions,
+          ...parseShellToolConfig(
+            Object.entries(args.toolOptionJson ?? {}).map(([name, value]) => `${name}=${value}`),
+            shellToolParams
+          )
+        };
         const response = await client.generateMemShell(
           buildMemShellRequest({
             ...args,
+            shellToolConfig: hasPluginOptions ? shellToolConfig : void 0,
+            shellToolParams,
             obfuscationOptions: parseObfuscationOptions(args.obfuscationOptions)
           })
         );