index.html

<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap" rel="stylesheet">
<style>
.bt-form { font-family: 'Inter', -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; }
@keyframes fadeIn { from { opacity: 0; transform: translateY(5px); } to { opacity: 1; transform: translateY(0); } }
.bt-w-con { animation: fadeIn 0.3s ease-out; }
.mw-header{padding:0 0 14px;margin-bottom:16px;border-bottom:1px solid #f0f0f0;}
.mw-header h2{margin:0;font-size:17px;font-weight:600;color:#111;letter-spacing:-0.4px;}
.mw-header p{margin:4px 0 0;color:#888;font-size:12px;}
.mw-card{background:#fff;border:1px solid #f0f0f0;border-radius:8px;padding:16px;margin-bottom:12px;box-shadow:0 1px 3px rgba(0,0,0,0.04);transition:box-shadow 0.2s;}
.mw-card:hover{box-shadow:0 2px 8px rgba(0,0,0,0.06);}
.mw-card h4{margin:0 0 12px;font-size:11px;font-weight:600;text-transform:uppercase;letter-spacing:0.6px;color:#555;}
.mw-table{width:100%;border-collapse:collapse;font-size:11px;}
.mw-table th{padding:8px 10px;text-align:left;font-weight:600;color:#555;border-bottom:2px solid #f0f0f0;font-size:10px;text-transform:uppercase;letter-spacing:0.4px;}
.mw-table td{padding:7px 10px;border-bottom:1px solid #f8f8f8;color:#333;}
.mw-table tr:hover td{background:#f8fafc;}
.mw-btn{padding:6px 13px;border-radius:6px;border:1px solid #e0e0e0;cursor:pointer;font-size:11px;font-weight:500;background:#fff;color:#333;transition:all 0.15s;}
.mw-btn:hover{border-color:#999;background:#f8f8f8;transform:translateY(-1px);}
.mw-btn:active{transform:translateY(0);}
.mw-btn-primary{background:#1a1b1e;color:#fff;border-color:#1a1b1e;}.mw-btn-primary:hover{background:#2c2e33;border-color:#2c2e33;}
.mw-btn-danger{color:#dc2626;border-color:#e5e7eb;}.mw-btn-danger:hover{background:#fef2f2;border-color:#dc2626;}
.mw-btn-sm{padding:4px 9px;font-size:10px;border-radius:4px;}
.mw-input{padding:7px 11px;border:1px solid #e0e0e0;border-radius:6px;font-size:12px;font-family:'SF Mono',SFMono-Regular,Consolas,monospace;transition:border-color 0.15s,box-shadow 0.15s;}
.mw-input:focus{border-color:#111;outline:none;box-shadow:0 0 0 3px rgba(0,0,0,0.05);}
.mw-select{padding:7px 11px;border:1px solid #e0e0e0;border-radius:6px;font-size:12px;background:#fff;}
.mw-sev{display:inline-block;padding:2px 7px;border-radius:4px;font-size:9px;font-weight:600;text-transform:uppercase;letter-spacing:0.3px;border:1px solid transparent;}
.mw-sev-critical{color:#dc2626;border-color:#fca5a5;}.mw-sev-high{color:#ea580c;border-color:#fdba74;}.mw-sev-medium{color:#ca8a04;border-color:#fde047;}.mw-sev-low{color:#16a34a;border-color:#86efac;}
.mw-cat{display:inline-block;padding:2px 7px;border-radius:4px;font-size:9px;background:#f4f4f5;color:#52525b;font-family:monospace;}
.mw-stats{display:flex;gap:10px;margin-bottom:14px;flex-wrap:wrap;}
.mw-stat{flex:1;min-width:85px;border:1px solid #f0f0f0;border-radius:8px;padding:12px 8px;text-align:center;background:#fafafa;transition:background 0.15s;}
.mw-stat:hover{background:#f4f4f5;}
.mw-stat .num{font-size:20px;font-weight:700;color:#111;font-family:'SF Mono',SFMono-Regular,Consolas,monospace;}
.mw-stat .lbl{font-size:9px;color:#888;text-transform:uppercase;letter-spacing:0.5px;margin-top:3px;}
.mw-progress{height:4px;background:#f0f0f0;border-radius:4px;overflow:hidden;margin:10px 0;}
.mw-progress-bar{height:100%;background:#1a1b1e;transition:width 0.4s ease;border-radius:4px;}
.mw-site-row{padding:9px 0;border-bottom:1px solid #f4f4f5;display:flex;align-items:center;justify-content:space-between;font-size:12px;transition:background 0.1s;}
.mw-site-row:hover{background:#fafafa;margin:0 -8px;padding:9px 8px;border-radius:4px;}
.mw-site-row:last-child{border-bottom:none;}
.mw-snippet{background:#f4f4f5;padding:3px 7px;border-radius:4px;font-size:10px;color:#555;font-family:'SF Mono',SFMono-Regular,Consolas,monospace;max-width:380px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;display:block;margin-top:4px;}
.mw-empty{color:#999;font-size:12px;padding:20px 0;text-align:center;}
.mw-diff-add{background:#f0fdf4;}.mw-diff-del{background:#fef2f2;}.mw-diff-mod{background:#fffbeb;}
</style>
<style id="mw-dark-mode">
[data-theme="dark"] .bt-form, [data-theme="dark"] .bt-w-main { background: #1a1b1e; color: #e5e7eb; }
[data-theme="dark"] .mw-card { background: #25262b; border-color: #373a40; box-shadow: 0 1px 3px rgba(0,0,0,0.2); }
[data-theme="dark"] .mw-header h2 { color: #f8f9fa; }
[data-theme="dark"] .mw-header { border-bottom-color: #373a40; }
[data-theme="dark"] .mw-stat { background: #2c2e33; border-color: #373a40; }
[data-theme="dark"] .mw-stat:hover { background: #373a40; }
[data-theme="dark"] .mw-stat .num { color: #f8f9fa; }
[data-theme="dark"] .mw-table th { color: #a6a7ab; border-bottom-color: #373a40; }
[data-theme="dark"] .mw-table td { color: #c1c2c5; border-bottom-color: #2c2e33; }
[data-theme="dark"] .mw-table tr:hover td { background: #2c2e33; }
[data-theme="dark"] .mw-input, [data-theme="dark"] .mw-select { background: #25262b; color: #c1c2c5; border-color: #373a40; }
[data-theme="dark"] .mw-input:focus { border-color: #5c5f66; }
[data-theme="dark"] .mw-btn { background: #25262b; color: #c1c2c5; border-color: #373a40; }
[data-theme="dark"] .mw-btn:hover { background: #373a40; }
[data-theme="dark"] .mw-btn-primary { background: #3c3f44; color: #fff; border-color: #3c3f44; }
[data-theme="dark"] .bt-w-menu { border-right: 1px solid #373a40; background: #1a1b1e; }
[data-theme="dark"] .bt-w-menu p { color: #a6a7ab; border-bottom: 1px solid #25262b; }
[data-theme="dark"] .bt-w-menu p.bgw { background: #25262b; color: #fff; border-right: 3px solid #6c7075; }
[data-theme="dark"] .mw-site-row:hover { background: #2c2e33; }
[data-theme="dark"] .mw-empty { color: #6c7075; }
</style>
<script src="https://cdn.jsdelivr.net/npm/chart.js"></script>

<div class="bt-form">
  <div class="bt-w-main">
    <div class="bt-w-menu">
      <p class="bgw" onclick="mw.dashboard()">Dashboard</p>
      <p onclick="mw.scan()">Scan</p>
      <p onclick="mw.integrity()">Integrity</p>
      <p onclick="mw.quarantine()">Quarantine</p>
      <p onclick="mw.schedule()">Schedule</p>
      <p onclick="mw.reports()">Reports</p>
      <p onclick="mw.whitelist()">Whitelist</p>
      <p onclick="mw.wordpress()">WordPress</p>
      <p onclick="mw.realtime()">Realtime</p>
      <p onclick="mw.mlscan()">ML Scan</p>
      <p onclick="mw.toggleDark()" style="margin-top:20px; font-weight:bold;">🌓 Dark Mode</p>
    </div>
    <div class="bt-w-con" style="padding:14px;">
      <div id="mw_con"></div>
    </div>
  </div>
</div>

<script>
var mw = {
  _tab: function(i){ $('.bt-w-menu p').removeClass('bgw'); $('.bt-w-menu p').eq(i).addClass('bgw'); },
  _sev: function(s){ return '<span class="mw-sev mw-sev-' + s + '">' + s + '</span>'; },
  _cat: function(c){ return '<span class="mw-cat">' + c + '</span>'; },
  _pollTimer: null,
  _currentScan: null,
  
  toggleDark: function() {
    var isDark = $('body').attr('data-theme') === 'dark';
    $('body').attr('data-theme', isDark ? 'light' : 'dark');
    localStorage.setItem('mw_theme', isDark ? 'light' : 'dark');
    if(mw.chartInstance) mw.chartInstance.update();
  },
  
  initTheme: function() {
    if(localStorage.getItem('mw_theme') === 'dark') {
      $('body').attr('data-theme', 'dark');
    }
  },


  // === DASHBOARD ===
  dashboard: function() {
    this._tab(0);
    $('#mw_con').html('<div class="mw-header"><h2>ShieldScan</h2><p>Real-time malware detection engine</p></div><div id="mw_dash"></div>');
    $.post('/plugin?action=a&name=malwarescan&s=get_stats', {}, function(res) {
      if (!res.status) { $('#mw_dash').html('<p class="mw-empty">' + res.msg + '</p>'); return; }
      var html = '<div class="mw-stats">' +
        '<div class="mw-stat"><div class="num">' + res.total_indexed + '</div><div class="lbl">Files Indexed</div></div>' +
        '<div class="mw-stat"><div class="num">' + res.baseline_count + '</div><div class="lbl">Baseline</div></div>' +
        '<div class="mw-stat"><div class="num">' + res.quarantined + '</div><div class="lbl">Quarantined</div></div>' +
        '<div class="mw-stat"><div class="num">' + res.schedules + '</div><div class="lbl">Schedules</div></div>' +
        '<div class="mw-stat"><div class="num">' + res.reports + '</div><div class="lbl">Reports</div></div>' +
        '<div class="mw-stat"><div class="num" style="font-size:12px;">' + (res.signature_version||'1.0') + '</div><div class="lbl">Signatures v' + (res.signature_count||55) + '</div></div></div>';
      if (res.last_scan) {
        var dt = new Date(res.last_scan.date * 1000).toLocaleString();
        var color = res.last_scan.threats > 0 ? 'color:#dc2626;' : 'color:#16a34a;';
        html += '<div class="mw-card"><h4>Last Scan</h4><p style="font-size:12px;margin:0;">' +
          '<span style="font-family:monospace;">' + res.last_scan.path + '</span> &mdash; ' +
          '<span style="' + color + 'font-weight:600;">' + res.last_scan.threats + ' threats</span> &mdash; ' + dt + '</p></div>';
      }
      html += '<div class="mw-card"><h4>Detection Capabilities</h4>' +
        '<p style="font-size:11px;color:#666;margin:0;line-height:1.8;">' +
        'PHP webshells (c99, r57, b374k, WSO, Alfa, IndoXploit) &bull; Backdoors &bull; ' +
        'Obfuscated code (base64, hex, chr, gzinflate chains) &bull; Crypto miners &bull; ' +
        'Spam mailers &bull; Phishing kits &bull; Card skimmers &bull; Keyloggers &bull; ' +
        'WordPress malware &bull; Hidden iframes &bull; .htaccess hijacks &bull; ' +
        'Reverse shells &bull; LFI/RFI &bull; Privilege escalation &bull; ' +
        'Shannon entropy analysis &bull; YARA rules &bull; File hash matching &bull; ' +
        'Integrity monitoring</p></div>';
      html += '<div class="mw-card"><h4>Recent Scans Overview</h4><canvas id="mwChart" height="80"></canvas></div>';
      $('#mw_dash').html(html);
      mw._renderChart();
    });
  },

  _renderChart: function() {
    $.post('/plugin?action=a&name=malwarescan&s=list_reports', {}, function(res) {
      if(!res.reports || !res.reports.length) return;
      var labels = [];
      var dataFiles = [];
      var dataThreats = [];
      var reps = res.reports.slice(0, 10).reverse();
      for(var i=0; i<reps.length; i++) {
        var d = new Date(reps[i].date * 1000);
        labels.push(d.getMonth()+1 + '/' + d.getDate() + ' ' + d.getHours() + ':' + (d.getMinutes()<10?'0':'')+d.getMinutes());
        dataFiles.push(reps[i].total_files);
        dataThreats.push(reps[i].threats);
      }
      var ctx = document.getElementById('mwChart').getContext('2d');
      var isDark = $('body').attr('data-theme') === 'dark';
      var gridColor = isDark ? '#373a40' : '#f0f0f0';
      var textColor = isDark ? '#a6a7ab' : '#666';
      
      var gradient = ctx.createLinearGradient(0, 0, 0, 80);
      gradient.addColorStop(0, isDark ? 'rgba(220,38,38,0.2)' : 'rgba(220,38,38,0.1)');
      gradient.addColorStop(1, 'rgba(220,38,38,0)');

      if(mw.chartInstance) mw.chartInstance.destroy();
      mw.chartInstance = new Chart(ctx, {
        type: 'bar',
        data: {
          labels: labels,
          datasets: [
            { label: 'Scanned Files', data: dataFiles, backgroundColor: isDark ? '#3c3f44' : '#1a1b1e', borderRadius: 4, order: 2 },
            { label: 'Threats', data: dataThreats, backgroundColor: gradient, fill: true, type: 'line', borderColor: '#dc2626', borderWidth: 2, tension: 0.4, pointRadius: 0, pointHitRadius: 10, order: 1 }
          ]
        },
        options: {
          responsive: true,
          interaction: { mode: 'index', intersect: false },
          scales: {
            y: { grid: { color: gridColor, drawBorder: false }, ticks: { color: textColor } },
            x: { grid: { display: false, drawBorder: false }, ticks: { color: textColor } }
          },
          plugins: { legend: { display: false } }
        }
      });
    });
  },

  // === SCAN ===
  scan: function() {
    this._tab(1);
    var html = '<div class="mw-header"><h2>Scan</h2><p>Full malware scan with signature + entropy + YARA detection</p></div>' +
      '<div class="mw-card"><h4>Path</h4>' +
      '<div style="display:flex;gap:8px;"><input type="text" id="mw_path" class="mw-input" style="width:340px;" placeholder="/www/wwwroot/site.com" />' +
      '<button class="mw-btn mw-btn-primary" onclick="mw.startScan()">Start Scan</button></div></div>' +
      '<div class="mw-card"><h4>Sites</h4><div id="mw_sites"><p class="mw-empty">Loading...</p></div></div>' +
      '<div id="mw_progress"></div><div id="mw_threats"></div>';
    $('#mw_con').html(html);
    $.post('/plugin?action=a&name=malwarescan&s=get_sites', {}, function(res) {
      if (!res.status || !res.sites.length) { $('#mw_sites').html('<p class="mw-empty">No sites</p>'); return; }
      var h = '';
      for (var i = 0; i < res.sites.length; i++) {
        var s = res.sites[i];
        h += '<div class="mw-site-row"><span style="font-family:monospace;">' + s.name + ' <span style="color:#999;">' + s.path + '</span></span>' +
          '<button class="mw-btn mw-btn-sm" onclick="$(\'#mw_path\').val(\'' + s.path + '\');mw.startScan();">Scan</button></div>';
      }
      $('#mw_sites').html(h);
    });
  },

  startScan: function() {
    var path = $('#mw_path').val().trim();
    if (!path) { layer.msg('Enter path'); return; }
    $.post('/plugin?action=a&name=malwarescan&s=scan_path', {path: path}, function(res) {
      if (!res.status) { layer.msg(res.msg, {icon: 2}); return; }
      mw._currentScan = res.scan_id;
      $('#mw_progress').html('<div class="mw-card"><h4>Scanning</h4>' +
        '<div class="mw-progress"><div class="mw-progress-bar" id="mw_pbar" style="width:1%;"></div></div>' +
        '<p id="mw_info" style="font-size:11px;color:#666;margin:0;">Collecting files...</p></div>');
      mw._poll();
    });
  },

  _poll: function() {
    if (mw._pollTimer) clearTimeout(mw._pollTimer);
    $.post('/plugin?action=a&name=malwarescan&s=scan_status', {scan_id: mw._currentScan}, function(res) {
      if (!res.status) return;
      var pct = res.scan_status === 'complete' ? 100 : (res.total_files > 0 ? Math.min(95, (res.scanned / res.total_files) * 100) : Math.min(95, res.scanned / 3));
      $('#mw_pbar').css('width', pct.toFixed(1) + '%');
      if (res.scan_status === 'complete') {
        $('#mw_info').text('Complete — ' + res.total_files + ' files / ' + res.elapsed + 's / ' + res.threats_found + ' threats');
        mw._renderThreats(res.threats, res.total_files, res.high_entropy);
      } else {
        var eta = res.eta_seconds > 0 ? ' — ETA: ' + (res.eta_seconds > 60 ? Math.ceil(res.eta_seconds/60) + 'min' : res.eta_seconds + 's') : '';
        var progress = res.total_files > 0 ? res.scanned + '/' + res.total_files : res.scanned + ' files';
        $('#mw_info').text('Scanning... ' + progress + ' (' + res.threats_found + ' threats)' + eta);
        mw._pollTimer = setTimeout(mw._poll, 800);
      }
    });
  },

  _renderThreats: function(threats, total, entropy) {
    var crit = threats.filter(function(t){return t.severity==='critical';}).length;
    var high = threats.filter(function(t){return t.severity==='high';}).length;
    var med = threats.filter(function(t){return t.severity==='medium';}).length;
    var html = '<div class="mw-stats">' +
      '<div class="mw-stat"><div class="num">' + total + '</div><div class="lbl">Scanned</div></div>' +
      '<div class="mw-stat"><div class="num" style="color:#dc2626;">' + crit + '</div><div class="lbl">Critical</div></div>' +
      '<div class="mw-stat"><div class="num" style="color:#ea580c;">' + high + '</div><div class="lbl">High</div></div>' +
      '<div class="mw-stat"><div class="num" style="color:#ca8a04;">' + med + '</div><div class="lbl">Medium</div></div>' +
      '<div class="mw-stat"><div class="num">' + (entropy||0) + '</div><div class="lbl">High Entropy</div></div></div>';
    if (!threats.length) {
      html += '<div class="mw-card"><p class="mw-empty">Clean — no threats detected</p></div>';
    } else {
      html += '<div class="mw-card"><h4>Threats (' + threats.length + ')</h4><table class="mw-table"><thead><tr><th>File</th><th>L</th><th>Sev</th><th>Category</th><th>Detail</th><th>Act</th></tr></thead><tbody>';
      for (var i = 0; i < threats.length; i++) {
        var t = threats[i];
        var fname = t.file.split('/').slice(-2).join('/');
        html += '<tr><td title="' + t.file + '" style="font-family:monospace;font-size:10px;max-width:160px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap;">' + fname + '</td>' +
          '<td>' + t.line + '</td><td>' + mw._sev(t.severity) + '</td><td>' + mw._cat(t.category) + '</td>' +
          '<td style="max-width:250px;"><span style="font-size:10px;">' + t.description + '</span><span class="mw-snippet">' + (t.snippet||'').replace(/</g,'&lt;').substring(0,100) + '</span></td>' +
          '<td style="white-space:nowrap;"><button class="mw-btn mw-btn-danger mw-btn-sm" onclick="mw._quarantine(\'' + t.file.replace(/'/g,"\\'") + '\')">Q</button> ' +
          '<button class="mw-btn mw-btn-sm" style="color:#16a34a;border-color:#16a34a;" onclick="mw._clean(\'' + t.file.replace(/'/g,"\\'") + '\')">Clean</button> ' +
          '<button class="mw-btn mw-btn-sm" onclick="mw._wl(\'' + t.file.replace(/'/g,"\\'") + '\')">WL</button></td></tr>';
      }
      html += '</tbody></table></div>';
    }
    $('#mw_threats').html(html);
  },

  _quarantine: function(fp) {
    layer.confirm('Quarantine ' + fp.split('/').pop() + '?', function(idx) {
      layer.close(idx);
      $.post('/plugin?action=a&name=malwarescan&s=quarantine_file', {filepath: fp}, function(res) { layer.msg(res.msg); });
    });
  },
  _clean: function(fp) {
    layer.confirm('Attempt smart cleaning on ' + fp.split('/').pop() + '?<br><br><span style="font-size:11px;color:#888;">This will try to safely extract and remove the malicious code. A backup will be saved.</span>', function(idx) {
      layer.close(idx);
      var l = layer.load();
      $.post('/plugin?action=a&name=malwarescan&s=clean_file', {filepath: fp}, function(res) { 
        layer.close(l);
        if(res.status) { layer.msg(res.msg, {icon:1}); } else { layer.msg(res.msg, {icon:2, time: 3000}); }
      });
    });
  },
  _wl: function(fp) {
    $.post('/plugin?action=a&name=malwarescan&s=add_whitelist', {filepath: fp}, function(res) { layer.msg(res.msg); });
  },


  // === INTEGRITY ===
  integrity: function() {
    this._tab(2);
    var html = '<div class="mw-header"><h2>File Integrity</h2><p>Detect unauthorized file changes</p></div>' +
      '<div class="mw-card"><h4>Baseline</h4>' +
      '<div style="display:flex;gap:8px;align-items:center;">' +
      '<input type="text" id="mw_int_path" class="mw-input" style="width:300px;" placeholder="/www/wwwroot/site.com" />' +
      '<button class="mw-btn mw-btn-primary mw-btn-sm" onclick="mw.createBaseline()">Create Baseline</button>' +
      '<button class="mw-btn mw-btn-sm" onclick="mw.checkIntegrity()">Check Now</button></div></div>' +
      '<div id="mw_int_results"></div>';
    $('#mw_con').html(html);
  },

  createBaseline: function() {
    var path = $('#mw_int_path').val().trim();
    if (!path) { layer.msg('Enter path'); return; }
    var l = layer.load();
    $.post('/plugin?action=a&name=malwarescan&s=integrity_create_baseline', {path: path}, function(res) {
      layer.close(l); layer.msg(res.msg);
    });
  },

  checkIntegrity: function() {
    var path = $('#mw_int_path').val().trim();
    var l = layer.load();
    $.post('/plugin?action=a&name=malwarescan&s=integrity_check', {path: path}, function(res) {
      layer.close(l);
      if (!res.status) { layer.msg(res.msg); return; }
      var c = res.changes;
      var html = '<div class="mw-stats">' +
        '<div class="mw-stat"><div class="num">' + res.baseline_files + '</div><div class="lbl">Baseline</div></div>' +
        '<div class="mw-stat"><div class="num" style="color:#ea580c;">' + c.modified.length + '</div><div class="lbl">Modified</div></div>' +
        '<div class="mw-stat"><div class="num" style="color:#dc2626;">' + c.deleted.length + '</div><div class="lbl">Deleted</div></div>' +
        '<div class="mw-stat"><div class="num" style="color:#ca8a04;">' + c.new.length + '</div><div class="lbl">New</div></div></div>';
      if (!res.total_changes) {
        html += '<div class="mw-card"><p class="mw-empty">No changes detected</p></div>';
      } else {
        html += '<div class="mw-card"><h4>Changes (' + res.total_changes + ')</h4><table class="mw-table"><thead><tr><th>Status</th><th>File</th><th>Details</th></tr></thead><tbody>';
        for (var i = 0; i < c.modified.length; i++) {
          var m = c.modified[i];
          html += '<tr class="mw-diff-mod"><td>MODIFIED</td><td style="font-family:monospace;font-size:10px;">' + m.path + '</td><td style="font-size:10px;">' + m.old_md5.substring(0,8) + ' → ' + m.new_md5.substring(0,8) + '</td></tr>';
        }
        for (var i = 0; i < c.deleted.length; i++) {
          html += '<tr class="mw-diff-del"><td>DELETED</td><td style="font-family:monospace;font-size:10px;">' + c.deleted[i].path + '</td><td></td></tr>';
        }
        for (var i = 0; i < c.new.length; i++) {
          html += '<tr class="mw-diff-add"><td>NEW</td><td style="font-family:monospace;font-size:10px;">' + c.new[i].path + '</td><td style="font-size:10px;">' + (c.new[i].size/1024).toFixed(1) + 'KB</td></tr>';
        }
        html += '</tbody></table></div>';
      }
      $('#mw_int_results').html(html);
    });
  },

  // === QUARANTINE ===
  quarantine: function() {
    this._tab(3);
    var html = '<div class="mw-header"><h2>Quarantine</h2><p>Isolated threats</p></div><div id="mw_qlist"></div>';
    $('#mw_con').html(html);
    $.post('/plugin?action=a&name=malwarescan&s=list_quarantine', {}, function(res) {
      if (!res.items.length) { $('#mw_qlist').html('<div class="mw-card"><p class="mw-empty">Empty</p></div>'); return; }
      var html = '<div class="mw-card"><table class="mw-table"><thead><tr><th>Original Path</th><th>Size</th><th>MD5</th><th>Date</th><th>Act</th></tr></thead><tbody>';
      for (var i = 0; i < res.items.length; i++) {
        var q = res.items[i];
        var dt = new Date(q.quarantined_at * 1000).toLocaleString();
        html += '<tr><td style="font-family:monospace;font-size:10px;">' + q.original_path + '</td><td>' + (q.size/1024).toFixed(1) + 'K</td><td style="font-size:10px;">' + q.md5.substring(0,12) + '</td><td style="font-size:10px;">' + dt + '</td>' +
          '<td style="white-space:nowrap;"><button class="mw-btn mw-btn-sm" onclick="mw._restore(\'' + q.filename + '\')">Restore</button> ' +
          '<button class="mw-btn mw-btn-danger mw-btn-sm" onclick="mw._delQ(\'' + q.filename + '\')">Delete</button></td></tr>';
      }
      html += '</tbody></table></div>';
      $('#mw_qlist').html(html);
    });
  },

  _restore: function(f) {
    layer.confirm('Restore file to original location?', function(idx) {
      layer.close(idx);
      $.post('/plugin?action=a&name=malwarescan&s=restore_file', {filename: f}, function(res) { layer.msg(res.msg); mw.quarantine(); });
    });
  },
  _delQ: function(f) {
    layer.confirm('Permanently delete?', function(idx) {
      layer.close(idx);
      $.post('/plugin?action=a&name=malwarescan&s=delete_quarantined', {filename: f}, function(res) { layer.msg(res.msg); mw.quarantine(); });
    });
  },

  // === SCHEDULE ===
  schedule: function() {
    this._tab(4);
    var html = '<div class="mw-header"><h2>Scheduled Scans</h2><p>Automated recurring scans</p></div>' +
      '<div class="mw-card"><h4>Add Schedule</h4>' +
      '<div style="display:flex;gap:8px;align-items:center;">' +
      '<input type="text" id="mw_sch_path" class="mw-input" style="width:280px;" placeholder="/www/wwwroot/site.com" />' +
      '<select id="mw_sch_hours" class="mw-select"><option value="6">Every 6h</option><option value="12">Every 12h</option><option value="24" selected>Daily</option><option value="168">Weekly</option></select>' +
      '<button class="mw-btn mw-btn-primary mw-btn-sm" onclick="mw.addSchedule()">Add</button></div></div>' +
      '<div id="mw_sch_list"></div>';
    $('#mw_con').html(html);
    this._loadSchedules();
  },

  _loadSchedules: function() {
    $.post('/plugin?action=a&name=malwarescan&s=schedule_list', {}, function(res) {
      if (!res.schedules.length) { $('#mw_sch_list').html('<div class="mw-card"><p class="mw-empty">No schedules</p></div>'); return; }
      var html = '<div class="mw-card"><table class="mw-table"><thead><tr><th>Path</th><th>Interval</th><th>Last Run</th><th>Status</th><th>Act</th></tr></thead><tbody>';
      for (var i = 0; i < res.schedules.length; i++) {
        var s = res.schedules[i];
        var lr = s.last_run ? new Date(s.last_run * 1000).toLocaleString() : 'Never';
        var st = s.enabled ? '<span style="color:#16a34a;">Active</span>' : '<span style="color:#999;">Paused</span>';
        html += '<tr><td style="font-family:monospace;font-size:10px;">' + s.path + '</td><td>' + s.hours + 'h</td><td style="font-size:10px;">' + lr + '</td><td>' + st + '</td>' +
          '<td style="white-space:nowrap;"><button class="mw-btn mw-btn-sm" onclick="mw._toggleSch(' + s.id + ')">' + (s.enabled ? 'Pause' : 'Enable') + '</button> ' +
          '<button class="mw-btn mw-btn-danger mw-btn-sm" onclick="mw._delSch(' + s.id + ')">Del</button></td></tr>';
      }
      html += '</tbody></table></div>';
      $('#mw_sch_list').html(html);
    });
  },

  addSchedule: function() {
    var path = $('#mw_sch_path').val().trim(), hours = $('#mw_sch_hours').val();
    if (!path) { layer.msg('Enter path'); return; }
    $.post('/plugin?action=a&name=malwarescan&s=schedule_add', {path: path, hours: hours}, function(res) { layer.msg(res.msg); mw._loadSchedules(); });
  },
  _toggleSch: function(id) {
    $.post('/plugin?action=a&name=malwarescan&s=schedule_toggle', {id: id}, function(res) { layer.msg(res.msg); mw._loadSchedules(); });
  },
  _delSch: function(id) {
    $.post('/plugin?action=a&name=malwarescan&s=schedule_remove', {id: id}, function(res) { layer.msg(res.msg); mw._loadSchedules(); });
  },


  // === REPORTS ===
  reports: function() {
    this._tab(5);
    var html = '<div class="mw-header"><h2>Reports</h2><p>Scan history</p></div><div id="mw_rlist"></div>';
    $('#mw_con').html(html);
    $.post('/plugin?action=a&name=malwarescan&s=list_reports', {}, function(res) {
      if (!res.reports.length) { $('#mw_rlist').html('<div class="mw-card"><p class="mw-empty">No reports</p></div>'); return; }
      var html = '<div class="mw-card"><table class="mw-table"><thead><tr><th>Path</th><th>Files</th><th>Threats</th><th>Critical</th><th>Time</th><th>Date</th><th>Act</th></tr></thead><tbody>';
      for (var i = 0; i < res.reports.length; i++) {
        var r = res.reports[i];
        var dt = new Date(r.date * 1000).toLocaleString();
        var tc = r.threats > 0 ? 'color:#dc2626;font-weight:600;' : 'color:#16a34a;';
        html += '<tr><td style="font-family:monospace;font-size:10px;max-width:200px;overflow:hidden;text-overflow:ellipsis;">' + r.path + '</td>' +
          '<td>' + r.total_files + '</td><td style="' + tc + '">' + r.threats + '</td><td style="color:#dc2626;">' + r.critical + '</td>' +
          '<td>' + r.elapsed + 's</td><td style="font-size:10px;">' + dt + '</td>' +
          '<td style="white-space:nowrap;"><button class="mw-btn mw-btn-sm" onclick="mw._viewReport(\'' + r.id + '\')">View</button> ' +
          '<button class="mw-btn mw-btn-danger mw-btn-sm" onclick="mw._delReport(\'' + r.id + '\')">Del</button></td></tr>';
      }
      html += '</tbody></table></div><div id="mw_threats"></div>';
      $('#mw_rlist').html(html);
    });
  },

  _viewReport: function(id) {
    var l = layer.load();
    $.post('/plugin?action=a&name=malwarescan&s=scan_status', {scan_id: id}, function(res) {
      layer.close(l);
      if (!res.status) { layer.msg(res.msg); return; }
      mw._renderThreats(res.threats, res.total_files, res.high_entropy);
    });
  },
  _delReport: function(id) {
    $.post('/plugin?action=a&name=malwarescan&s=delete_report', {report_id: id}, function(res) { layer.msg(res.msg); mw.reports(); });
  },

  // === WHITELIST ===
  whitelist: function() {
    this._tab(6);
    var html = '<div class="mw-header"><h2>Whitelist</h2><p>Excluded paths</p></div>' +
      '<div class="mw-card"><h4>Add</h4><div style="display:flex;gap:8px;">' +
      '<input type="text" id="mw_wl_path" class="mw-input" style="width:350px;" placeholder="/www/wwwroot/site/file.php or /www/wwwroot/site/dir/" />' +
      '<button class="mw-btn mw-btn-primary mw-btn-sm" onclick="mw._addWl()">Add</button></div></div>' +
      '<div id="mw_wl_list"></div>';
    $('#mw_con').html(html);
    this._loadWl();
  },

  _loadWl: function() {
    $.post('/plugin?action=a&name=malwarescan&s=get_whitelist', {}, function(res) {
      if (!res.whitelist.length) { $('#mw_wl_list').html('<div class="mw-card"><p class="mw-empty">Empty</p></div>'); return; }
      var html = '<div class="mw-card"><table class="mw-table"><thead><tr><th>Path</th><th></th></tr></thead><tbody>';
      for (var i = 0; i < res.whitelist.length; i++) {
        html += '<tr><td style="font-family:monospace;">' + res.whitelist[i] + '</td>' +
          '<td><button class="mw-btn mw-btn-danger mw-btn-sm" onclick="mw._rmWl(\'' + res.whitelist[i].replace(/'/g,"\\'") + '\')">Remove</button></td></tr>';
      }
      html += '</tbody></table></div>';
      $('#mw_wl_list').html(html);
    });
  },

  _addWl: function() {
    var p = $('#mw_wl_path').val().trim();
    if (!p) return;
    $.post('/plugin?action=a&name=malwarescan&s=add_whitelist', {filepath: p}, function(res) { layer.msg(res.msg); mw._loadWl(); $('#mw_wl_path').val(''); });
  },
  _rmWl: function(p) {
    $.post('/plugin?action=a&name=malwarescan&s=remove_whitelist', {filepath: p}, function(res) { layer.msg(res.msg); mw._loadWl(); });
  },

  // === WORDPRESS ===
  wordpress: function() {
    this._tab(7);
    var html = '<div class="mw-header"><h2>WordPress Scanner</h2><p>Deep scan for WP-specific threats, backdoors, and misconfigurations</p></div>' +
      '<div id="mw_wp_sites"><p class="mw-empty">Detecting WordPress installations...</p></div><div id="mw_wp_results"></div>';
    $('#mw_con').html(html);
    $.post('/plugin?action=a&name=malwarescan&s=wp_detect_sites', {}, function(res) {
      if (!res.sites.length) { $('#mw_wp_sites').html('<div class="mw-card"><p class="mw-empty">No WordPress sites found</p></div>'); return; }
      var html = '<div class="mw-card"><h4>WordPress Installations (' + res.sites.length + ')</h4>';
      for (var i = 0; i < res.sites.length; i++) {
        var s = res.sites[i];
        html += '<div class="mw-site-row"><span style="font-family:monospace;">' + s.name + ' <span style="color:#999;">v' + s.version + '</span> <span style="color:#bbb;font-size:10px;">' + s.path + '</span></span>' +
          '<button class="mw-btn mw-btn-primary mw-btn-sm" onclick="mw.wpScan(\'' + s.path + '\')">WP Scan</button></div>';
      }
      html += '</div>';
      $('#mw_wp_sites').html(html);
    });
  },

  wpScan: function(path) {
    var l = layer.load();
    $.post('/plugin?action=a&name=malwarescan&s=wp_scan', {path: path}, function(res) {
      layer.close(l);
      if (!res.status) { layer.msg(res.msg); return; }
      var r = res.results;
      var html = '<div class="mw-stats">' +
        '<div class="mw-stat"><div class="num">' + r.version + '</div><div class="lbl">WP Version</div></div>' +
        '<div class="mw-stat"><div class="num">' + r.plugins.length + '</div><div class="lbl">Plugins</div></div>' +
        '<div class="mw-stat"><div class="num">' + r.themes.length + '</div><div class="lbl">Themes</div></div>' +
        '<div class="mw-stat"><div class="num" style="color:#dc2626;">' + r.total_issues + '</div><div class="lbl">Issues</div></div>' +
        '<div class="mw-stat"><div class="num" style="color:#ea580c;">' + r.core_modified.length + '</div><div class="lbl">Core Modified</div></div></div>';

      // Advanced WP actions
      html += '<div class="mw-card"><h4>Advanced Actions</h4><div style="display:flex;gap:6px;flex-wrap:wrap;">' +
        '<button class="mw-btn mw-btn-sm" onclick="mw.wpChecksums(\'' + path + '\')">Verify Core Checksums</button>' +
        '<button class="mw-btn mw-btn-sm" onclick="mw.wpVulns(\'' + path + '\')">Check Plugin CVEs</button>' +
        '<button class="mw-btn mw-btn-sm" onclick="mw.wpDbScan(\'' + path + '\')">Scan Database</button>' +
        '<button class="mw-btn mw-btn-primary mw-btn-sm" onclick="mw.wpAutoUpdate(\'' + path + '\')">Auto-Update Plugins</button>' +
        '<button class="mw-btn mw-btn-sm" onclick="mw.wpPdfReport(\'' + path + '\')">PDF Report</button></div></div>';

      // Config issues
      if (r.config_issues.length) {
        html += '<div class="mw-card"><h4>Configuration Issues</h4><table class="mw-table"><tbody>';
        for (var i = 0; i < r.config_issues.length; i++) {
          html += '<tr><td>' + mw._sev(r.config_issues[i].severity) + '</td><td>' + r.config_issues[i].issue + '</td></tr>';
        }
        html += '</tbody></table></div>';
      }

      // Security issues
      if (r.issues.length) {
        html += '<div class="mw-card"><h4>Security Issues (' + r.issues.length + ')</h4><table class="mw-table"><thead><tr><th>Sev</th><th>Type</th><th>File</th><th>Description</th><th>Act</th></tr></thead><tbody>';
        for (var i = 0; i < r.issues.length; i++) {
          var issue = r.issues[i];
          var fname = issue.file ? issue.file.split('/').slice(-3).join('/') : '';
          html += '<tr><td>' + mw._sev(issue.severity) + '</td><td>' + mw._cat(issue.type) + '</td>' +
            '<td style="font-family:monospace;font-size:10px;max-width:180px;overflow:hidden;text-overflow:ellipsis;" title="' + (issue.file||'') + '">' + fname + '</td>' +
            '<td style="font-size:10px;">' + issue.description + '</td>' +
            '<td>' + (issue.file ? '<button class="mw-btn mw-btn-danger mw-btn-sm" onclick="mw._quarantine(\'' + issue.file.replace(/'/g,"\\'") + '\')">Q</button>' : '') + '</td></tr>';
        }
        html += '</tbody></table></div>';
      } else {
        html += '<div class="mw-card"><p class="mw-empty" style="color:#16a34a;">No security issues found</p></div>';
      }

      // Plugins list
      if (r.plugins.length) {
        html += '<div class="mw-card"><h4>Installed Plugins</h4><table class="mw-table"><thead><tr><th>Plugin</th><th>Version</th><th>Slug</th></tr></thead><tbody>';
        for (var i = 0; i < r.plugins.length; i++) {
          html += '<tr><td>' + r.plugins[i].name + '</td><td>' + r.plugins[i].version + '</td><td style="font-family:monospace;font-size:10px;">' + r.plugins[i].slug + '</td></tr>';
        }
        html += '</tbody></table></div>';
      }

      $('#mw_wp_results').html(html);
    });
  },

  wpChecksums: function(path) {
    var l = layer.load();
    $.post('/plugin?action=a&name=malwarescan&s=wp_verify_checksums', {path: path}, function(res) {
      layer.close(l);
      if (!res.status) { layer.msg(res.msg); return; }
      var r = res.results;
      var html = '<div class="mw-card"><h4>Core Checksum Verification (WP ' + r.version + ')</h4>' +
        '<div class="mw-stats"><div class="mw-stat"><div class="num" style="color:#16a34a;">' + r.verified + '</div><div class="lbl">Verified</div></div>' +
        '<div class="mw-stat"><div class="num" style="color:#dc2626;">' + r.modified.length + '</div><div class="lbl">Modified</div></div>' +
        '<div class="mw-stat"><div class="num" style="color:#ea580c;">' + r.missing.length + '</div><div class="lbl">Missing</div></div>' +
        '<div class="mw-stat"><div class="num" style="color:#ca8a04;">' + r.extra.length + '</div><div class="lbl">Extra Files</div></div></div>';
      if (r.modified.length) {
        html += '<table class="mw-table"><thead><tr><th>File</th><th>Expected</th><th>Actual</th></tr></thead><tbody>';
        for (var i = 0; i < r.modified.length; i++) {
          var m = r.modified[i];
          html += '<tr><td style="font-family:monospace;font-size:10px;">' + m.file + '</td><td style="font-size:9px;">' + m.expected.substring(0,12) + '...</td><td style="font-size:9px;color:#dc2626;">' + m.actual.substring(0,12) + '...</td></tr>';
        }
        html += '</tbody></table>';
      }
      if (r.extra.length) {
        html += '<p style="margin-top:8px;font-size:11px;"><b>Extra files in core dirs:</b> ' + r.extra.slice(0,10).join(', ') + (r.extra.length > 10 ? '...' : '') + '</p>';
      }
      html += '</div>';
      $('#mw_wp_results').append(html);
    });
  },

  wpVulns: function(path) {
    var l = layer.load();
    $.post('/plugin?action=a&name=malwarescan&s=wp_check_vulns', {path: path}, function(res) {
      layer.close(l);
      if (!res.status) { layer.msg(res.msg); return; }
      var html = '<div class="mw-card"><h4>Plugin Vulnerabilities (' + res.vulnerable + '/' + res.plugins_checked + ' vulnerable)</h4>';
      if (!res.results.length) { html += '<p class="mw-empty" style="color:#16a34a;">No known vulnerabilities</p>'; }
      else {
        html += '<table class="mw-table"><thead><tr><th>Plugin</th><th>Version</th><th>Vulnerability</th><th>Severity</th></tr></thead><tbody>';
        for (var i = 0; i < res.results.length; i++) {
          var p = res.results[i];
          for (var j = 0; j < p.vulnerabilities.length; j++) {
            var v = p.vulnerabilities[j];
            html += '<tr><td>' + p.plugin + '</td><td>' + p.installed_version + '</td><td style="font-size:10px;">' + v.title + '</td><td>' + mw._sev(v.severity) + '</td></tr>';
          }
        }
        html += '</tbody></table>';
      }
      html += '</div>';
      $('#mw_wp_results').append(html);
    });
  },

  wpDbScan: function(path) {
    var l = layer.load();
    $.post('/plugin?action=a&name=malwarescan&s=wp_scan_database', {path: path}, function(res) {
      layer.close(l);
      if (!res.status) { layer.msg(res.msg); return; }
      var html = '<div class="mw-card"><h4>Database Scan (' + res.total_threats + ' threats, ' + res.total_admins + ' admins)</h4>';
      if (res.threats.length) {
        html += '<table class="mw-table"><thead><tr><th>Table</th><th>Key</th><th>Type</th><th>Snippet</th></tr></thead><tbody>';
        for (var i = 0; i < res.threats.length; i++) {
          var t = res.threats[i];
          html += '<tr><td style="font-family:monospace;font-size:10px;">' + t.table + '</td><td style="font-size:10px;">' + t.key + '</td><td>' + mw._cat(t.type) + '</td><td class="mw-snippet">' + (t.snippet||'').replace(/</g,'&lt;').substring(0,80) + '</td></tr>';
        }
        html += '</tbody></table>';
      } else { html += '<p class="mw-empty" style="color:#16a34a;">Database clean</p>'; }
      if (res.admin_users && res.admin_users.length) {
        html += '<h4 style="margin-top:10px;">Admin Users</h4><table class="mw-table"><thead><tr><th>ID</th><th>Login</th><th>Registered</th></tr></thead><tbody>';
        for (var i = 0; i < res.admin_users.length; i++) {
          var u = res.admin_users[i];
          html += '<tr><td>' + u.id + '</td><td style="font-family:monospace;">' + u.login + '</td><td style="font-size:10px;">' + u.registered + '</td></tr>';
        }
        html += '</tbody></table>';
      }
      html += '</div>';
      $('#mw_wp_results').append(html);
    });
  },

  wpAutoUpdate: function(path) {
    layer.confirm('Auto-update all outdated plugins?', function(idx) {
      layer.close(idx);
      var l = layer.load();
      $.post('/plugin?action=a&name=malwarescan&s=wp_auto_update', {path: path}, function(res) {
        layer.close(l);
        if (!res.status) { layer.msg(res.msg); return; }
        layer.msg('Updated ' + res.updated + ' plugins');
      });
    });
  },

  wpPdfReport: function(path) {
    // First run a scan, then generate PDF
    layer.msg('Generating report...');
    $.post('/plugin?action=a&name=malwarescan&s=scan_path', {path: path}, function(res) {
      if (!res.status) { layer.msg(res.msg); return; }
      // Wait for scan to complete then generate PDF
      var checkDone = setInterval(function() {
        $.post('/plugin?action=a&name=malwarescan&s=scan_status', {scan_id: res.scan_id}, function(sr) {
          if (sr.scan_status === 'complete') {
            clearInterval(checkDone);
            $.post('/plugin?action=a&name=malwarescan&s=generate_pdf_report', {scan_id: res.scan_id}, function(pr) {
              if (pr.status) { layer.msg('PDF ready: ' + pr.filename); }
              else { layer.msg(pr.msg); }
            });
          }
        });
      }, 2000);
    });
  },

  // === REALTIME WATCHER TAB ===
  realtime: function() {
    this._tab(8);
    var html = '<div class="mw-header"><h2>Real-time Protection</h2><p>Inotify-based file monitoring with auto-quarantine</p></div>' +
      '<div id="mw_rt_status"></div>' +
      '<div class="mw-card"><h4>Configuration</h4>' +
      '<div style="display:flex;flex-direction:column;gap:8px;">' +
      '<div><label style="font-size:10px;color:#999;text-transform:uppercase;">Watch Paths (one per line)</label>' +
      '<textarea id="mw_rt_paths" class="mw-input" style="width:100%;height:60px;resize:vertical;" placeholder="/www/wwwroot/site1.com&#10;/www/wwwroot/site2.com"></textarea></div>' +
      '<div style="display:flex;gap:12px;align-items:center;">' +
      '<label style="font-size:11px;"><input type="checkbox" id="mw_rt_autoq"> Auto-quarantine threats</label>' +
      '</div>' +
      '<div><label style="font-size:10px;color:#999;text-transform:uppercase;">Alert Webhook (Telegram/Discord/Slack)</label>' +
      '<input type="text" id="mw_rt_webhook" class="mw-input" style="width:100%;" placeholder="https://hooks.slack.com/..." /></div>' +
      '<div style="display:flex;gap:6px;">' +
      '<button class="mw-btn mw-btn-primary mw-btn-sm" onclick="mw.rtSaveConfig()">Save Config</button>' +
      '<button class="mw-btn mw-btn-sm" style="background:#16a34a;color:#fff;border-color:#16a34a;" onclick="mw.rtStart()">Start</button>' +
      '<button class="mw-btn mw-btn-danger mw-btn-sm" onclick="mw.rtStop()">Stop</button></div></div></div>' +
      '<div class="mw-card"><h4>Events <button class="mw-btn mw-btn-sm" onclick="mw.rtLoadEvents()" style="float:right;">Refresh</button></h4><div id="mw_rt_events"></div></div>';
    $('#mw_con').html(html);
    this.rtLoadStatus();
    this.rtLoadEvents();
  },

  rtLoadStatus: function() {
    $.post('/plugin?action=a&name=malwarescan&s=watcher_status', {}, function(res) {
      if (!res.status) return;
      var st = res.running ? '<span style="color:#16a34a;">● Running</span>' : '<span style="color:#999;">○ Stopped</span>';
      var html = '<div class="mw-card" style="display:flex;justify-content:space-between;align-items:center;">' +
        '<span>Status: ' + st + ' &mdash; ' + res.events_count + ' events' + (res.has_inotify ? '' : ' <span style="color:#dc2626;">(inotify not installed)</span>') + '</span></div>';
      $('#mw_rt_status').html(html);
      if (res.watch_paths.length) { $('#mw_rt_paths').val(res.watch_paths.join('\n')); }
      $('#mw_rt_autoq').prop('checked', res.auto_quarantine);
    });
  },

  rtSaveConfig: function() {
    var paths = $('#mw_rt_paths').val();
    var autoq = $('#mw_rt_autoq').is(':checked') ? '1' : '0';
    var webhook = $('#mw_rt_webhook').val();
    $.post('/plugin?action=a&name=malwarescan&s=watcher_config', {watch_paths: paths, auto_quarantine: autoq, webhook: webhook}, function(res) { layer.msg(res.msg); });
  },

  rtStart: function() {
    $.post('/plugin?action=a&name=malwarescan&s=watcher_start', {}, function(res) { layer.msg(res.msg); mw.rtLoadStatus(); });
  },
  rtStop: function() {
    $.post('/plugin?action=a&name=malwarescan&s=watcher_stop', {}, function(res) { layer.msg(res.msg); mw.rtLoadStatus(); });
  },

  rtLoadEvents: function() {
    $.post('/plugin?action=a&name=malwarescan&s=watcher_events', {}, function(res) {
      if (!res.events || !res.events.length) { $('#mw_rt_events').html('<p class="mw-empty">No events</p>'); return; }
      var html = '<table class="mw-table"><thead><tr><th>Time</th><th>File</th><th>Threat</th><th>Action</th></tr></thead><tbody>';
      for (var i = 0; i < Math.min(res.events.length, 50); i++) {
        var e = res.events[i];
        var dt = new Date(e.time * 1000).toLocaleString();
        var act = e.action === 'quarantined' ? '<span style="color:#16a34a;">quarantined</span>' : '<span style="color:#dc2626;">detected</span>';
        html += '<tr><td style="font-size:10px;">' + dt + '</td><td style="font-family:monospace;font-size:10px;">' + e.file.split('/').slice(-2).join('/') + '</td><td style="font-size:10px;">' + e.threat + '</td><td>' + act + '</td></tr>';
      }
      html += '</tbody></table>';
      $('#mw_rt_events').html(html);
    });
  },

  // === ML SCAN TAB ===
  mlscan: function() {
    this._tab(9);
    var html = '<div class="mw-header"><h2>ML Classifier</h2><p>Machine learning entropy analysis — distinguishes legitimate obfuscation from malware</p></div>' +
      '<div class="mw-card"><h4>Classify Path</h4>' +
      '<div style="display:flex;gap:8px;"><input type="text" id="mw_ml_path" class="mw-input" style="width:340px;" placeholder="/www/wwwroot/site.com" />' +
      '<button class="mw-btn mw-btn-primary" onclick="mw.mlRun()">Analyze</button></div></div>' +
      '<div class="mw-card"><h4>Single File</h4>' +
      '<div style="display:flex;gap:8px;"><input type="text" id="mw_ml_file" class="mw-input" style="width:340px;" placeholder="/path/to/file.php" />' +
      '<button class="mw-btn mw-btn-sm" onclick="mw.mlFile()">Classify</button></div></div>' +
      '<div id="mw_ml_results"></div>';
    $('#mw_con').html(html);
  },

  mlRun: function() {
    var path = $('#mw_ml_path').val().trim();
    if (!path) { layer.msg('Enter path'); return; }
    var l = layer.load();
    $.post('/plugin?action=a&name=malwarescan&s=ml_classify_path', {path: path}, function(res) {
      layer.close(l);
      if (!res.status) { layer.msg(res.msg); return; }
      var html = '<div class="mw-card"><h4>ML Results — ' + res.total_flagged + ' flagged files</h4>';
      if (!res.results.length) { html += '<p class="mw-empty" style="color:#16a34a;">All files appear clean</p>'; }
      else {
        html += '<table class="mw-table"><thead><tr><th>File</th><th>Label</th><th>Confidence</th><th>Entropy</th><th>Reason</th></tr></thead><tbody>';
        for (var i = 0; i < res.results.length; i++) {
          var r = res.results[i];
          var color = r.label === 'malicious' ? '#dc2626' : '#ea580c';
          html += '<tr><td style="font-family:monospace;font-size:10px;">' + r.file.split('/').slice(-2).join('/') + '</td>' +
            '<td style="color:' + color + ';font-weight:600;font-size:10px;">' + r.label.toUpperCase() + '</td>' +
            '<td>' + (r.confidence * 100).toFixed(0) + '%</td>' +
            '<td>' + (r.features.entropy || 0) + '</td>' +
            '<td style="font-size:10px;">' + r.reason + '</td></tr>';
        }
        html += '</tbody></table>';
      }
      html += '</div>';
      $('#mw_ml_results').html(html);
    });
  },

  mlFile: function() {
    var fp = $('#mw_ml_file').val().trim();
    if (!fp) { layer.msg('Enter file path'); return; }
    var l = layer.load();
    $.post('/plugin?action=a&name=malwarescan&s=ml_classify_file', {filepath: fp}, function(res) {
      layer.close(l);
      if (!res.status) { layer.msg(res.msg); return; }
      var color = res.label === 'malicious' ? '#dc2626' : res.label === 'suspicious' ? '#ea580c' : '#16a34a';
      var html = '<div class="mw-card"><h4>Classification Result</h4>' +
        '<p style="font-size:14px;color:' + color + ';font-weight:600;">' + res.label.toUpperCase() + ' (' + (res.confidence * 100).toFixed(0) + '% confidence)</p>' +
        '<p style="font-size:11px;color:#666;">' + res.reason + '</p>' +
        '<table class="mw-table" style="margin-top:8px;"><tbody>';
      var f = res.features;
      html += '<tr><td>Entropy</td><td>' + f.entropy + '</td></tr>';
      html += '<tr><td>Chi-Square</td><td>' + f.chi_square + '</td></tr>';
      html += '<tr><td>ASCII Ratio</td><td>' + (f.ascii_ratio * 100).toFixed(1) + '%</td></tr>';
      html += '<tr><td>Longest Line</td><td>' + f.longest_line + ' chars</td></tr>';
      html += '<tr><td>Keyword Density</td><td>' + f.keyword_density + '</td></tr>';
      html += '<tr><td>File Size</td><td>' + f.file_size + ' bytes</td></tr>';
      html += '</tbody></table></div>';
      $('#mw_ml_results').html(html);
    });
  }
};
mw.initTheme();
mw.dashboard();
</script>