From 04cf4a77d0ebf1f3a2a925bc2eace4a911a54e74 Mon Sep 17 00:00:00 2001
From: KingKDot <why_are_you_looking_at_this@stoppeeping.com>
Date: Sun, 17 May 2026 15:01:34 -0500
Subject: [PATCH] add view explaining raw mode.

---
 Overlord-Server/public/assets/build.js |  30 ++++++++
 Overlord-Server/public/build.html      | 101 ++++++++++++++++++++++++-
 2 files changed, 127 insertions(+), 4 deletions(-)

diff --git a/Overlord-Server/public/assets/build.js b/Overlord-Server/public/assets/build.js
index 6539695..fa4b5c0 100644
--- a/Overlord-Server/public/assets/build.js
+++ b/Overlord-Server/public/assets/build.js
@@ -614,6 +614,36 @@ if (rawServerListCheckbox && serverUrlInput) {
   });
 }
 
+const rawServerListHelpBtn = document.getElementById("raw-server-list-help");
+const rawServerListModal = document.getElementById("raw-server-list-modal");
+const rawServerListModalClose = document.getElementById("raw-server-list-modal-close");
+const rawServerListModalOk = document.getElementById("raw-server-list-modal-ok");
+
+function showRawServerListModal() {
+  if (!rawServerListModal) return;
+  rawServerListModal.classList.remove("hidden");
+  rawServerListModal.classList.add("flex");
+}
+function hideRawServerListModal() {
+  if (!rawServerListModal) return;
+  rawServerListModal.classList.remove("flex");
+  rawServerListModal.classList.add("hidden");
+}
+
+if (rawServerListHelpBtn) rawServerListHelpBtn.addEventListener("click", showRawServerListModal);
+if (rawServerListModalClose) rawServerListModalClose.addEventListener("click", hideRawServerListModal);
+if (rawServerListModalOk) rawServerListModalOk.addEventListener("click", hideRawServerListModal);
+if (rawServerListModal) {
+  rawServerListModal.addEventListener("click", (e) => {
+    if (e.target === rawServerListModal) hideRawServerListModal();
+  });
+}
+document.addEventListener("keydown", (e) => {
+  if (e.key === "Escape" && rawServerListModal && !rawServerListModal.classList.contains("hidden")) {
+    hideRawServerListModal();
+  }
+});
+
 if (solMemoCheckbox && solSettings) {
   solMemoCheckbox.addEventListener("change", () => {
     const isSol = solMemoCheckbox.checked;
diff --git a/Overlord-Server/public/build.html b/Overlord-Server/public/build.html
index 9af6548..49c0a78 100644
--- a/Overlord-Server/public/build.html
+++ b/Overlord-Server/public/build.html
@@ -192,10 +192,16 @@
                       <p id="server-url-hint" class="text-xs text-slate-500 mt-1">
                         Just enter your domain or IP — no <code class="text-slate-400">wss://</code>, <code class="text-slate-400">https://</code>, or any other prefix.
                       </p>
-                      <label class="mt-2 flex items-center gap-2 text-xs text-slate-400">
-                        <input type="checkbox" id="raw-server-list" name="raw-server-list" class="w-4 h-4" />
-                        Use raw HTTPS server list (fetches multiple wss:// endpoints)
-                      </label>
+                      <div class="mt-2 flex items-center gap-2 text-xs text-slate-400">
+                        <label class="flex items-center gap-2 cursor-pointer">
+                          <input type="checkbox" id="raw-server-list" name="raw-server-list" class="w-4 h-4" />
+                          Use raw HTTPS server list (fetches multiple wss:// endpoints)
+                        </label>
+                        <button type="button" id="raw-server-list-help" aria-label="What is the raw HTTPS server list?"
+                          class="w-5 h-5 inline-flex items-center justify-center rounded-full text-slate-400 hover:text-blue-400 hover:bg-slate-800 transition-colors">
+                          <i class="fa-solid fa-circle-info text-sm"></i>
+                        </button>
+                      </div>
                       <p id="server-url-raw-hint" class="hidden text-xs text-slate-500 mt-1">
                         When enabled, the URL above must be a raw HTTPS link with one wss:// endpoint per line.
                       </p>
@@ -800,6 +806,93 @@
       </div>
     </main>
 
+    <!-- Raw HTTPS server list help modal -->
+    <div id="raw-server-list-modal" class="fixed inset-0 z-50 hidden items-center justify-center bg-black/60 backdrop-blur-sm">
+      <div class="bg-slate-900 border border-slate-700 rounded-xl shadow-2xl max-w-2xl w-full mx-4 p-6 max-h-[90vh] overflow-y-auto">
+        <div class="flex items-start justify-between mb-4">
+          <div class="flex items-center gap-3">
+            <div class="w-10 h-10 rounded-full bg-blue-900/50 border border-blue-700 flex items-center justify-center shrink-0">
+              <i class="fa-solid fa-list text-blue-400"></i>
+            </div>
+            <h3 class="text-lg font-semibold text-white">Raw HTTPS Server List</h3>
+          </div>
+          <button type="button" id="raw-server-list-modal-close" aria-label="Close"
+            class="text-slate-400 hover:text-white p-1 -mr-1">
+            <i class="fa-solid fa-xmark"></i>
+          </button>
+        </div>
+        <div class="text-slate-300 text-sm space-y-4">
+          <p>
+            Instead of baking a single server address into the agent, point it at a
+            plain-text file you host somewhere. The agent fetches that file every
+            time it starts, parses the lines, and uses the URLs inside as its
+            actual C2 endpoints.
+          </p>
+          <p class="text-slate-400">
+            This lets you rotate, retire, or add C2 hosts without rebuilding and
+            redeploying agents — just edit the file.
+          </p>
+
+          <div>
+            <h4 class="text-slate-200 font-medium mb-2 flex items-center gap-2">
+              <i class="fa-solid fa-file-lines text-green-400"></i> File format
+            </h4>
+            <ul class="list-disc list-inside text-slate-400 space-y-1 ml-1">
+              <li>One server per line</li>
+              <li>Bare domain (<code class="text-slate-300">example.com:5173</code>) or full <code class="text-slate-300">wss://</code> URL</li>
+              <li>Lines starting with <code class="text-slate-300">#</code> are comments</li>
+              <li>Blank lines are ignored</li>
+              <li>Must contain at least one valid line, otherwise the agent gives up</li>
+            </ul>
+            <pre class="mt-3 p-3 bg-slate-950 border border-slate-800 rounded text-xs text-slate-300 overflow-x-auto"><code># Primary
+c2-us-east.example.com:5173
+
+# Backups
+wss://c2-eu.example.com:5173
+1.2.3.4:5173</code></pre>
+          </div>
+
+          <div>
+            <h4 class="text-slate-200 font-medium mb-2 flex items-center gap-2">
+              <i class="fa-solid fa-triangle-exclamation text-amber-400"></i> The URL must serve raw text
+            </h4>
+            <p class="text-slate-400">
+              The agent does a plain HTTP GET and reads the response body line by
+              line. If the URL returns an HTML page (the GitHub web view, the
+              Pastebin web view, a Notion page, etc.) the agent will try to parse
+              the HTML as server URLs and fail.
+            </p>
+            <p class="text-slate-400 mt-2">Good sources:</p>
+            <ul class="list-disc list-inside text-slate-400 space-y-1 ml-1">
+              <li>GitHub: use the <code class="text-slate-300">raw.githubusercontent.com/&hellip;</code> URL, not the <code class="text-slate-300">github.com/&hellip;/blob/&hellip;</code> page</li>
+              <li>Gist: click <em>Raw</em>, copy that URL</li>
+              <li>Pastebin: <code class="text-slate-300">pastebin.com/raw/&lt;id&gt;</code>, not <code class="text-slate-300">pastebin.com/&lt;id&gt;</code></li>
+              <li>S3 / R2 / any object storage serving the file as <code class="text-slate-300">text/plain</code></li>
+              <li>Any web server returning the raw file body</li>
+            </ul>
+          </div>
+
+          <div>
+            <h4 class="text-slate-200 font-medium mb-2 flex items-center gap-2">
+              <i class="fa-solid fa-lock text-blue-400"></i> Use HTTPS
+            </h4>
+            <p class="text-slate-400">
+              Use an <code class="text-slate-300">https://</code> URL so the list itself
+              can't be tampered with in transit. <code class="text-slate-300">http://</code>
+              is accepted but anyone on the network path can rewrite the response
+              and redirect your agents.
+            </p>
+          </div>
+        </div>
+        <div class="flex items-center justify-end mt-6">
+          <button type="button" id="raw-server-list-modal-ok"
+            class="px-4 py-2 rounded-lg bg-blue-600 hover:bg-blue-700 text-white transition-colors text-sm font-medium">
+            Got it
+          </button>
+        </div>
+      </div>
+    </div>
+
     <!-- Build & Update All Confirmation Modal -->
     <div id="update-all-modal" class="fixed inset-0 z-50 hidden items-center justify-center bg-black/60 backdrop-blur-sm">
       <div class="bg-slate-900 border border-slate-700 rounded-xl shadow-2xl max-w-md w-full mx-4 p-6">