Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

agent/vulnprobe/scan_test.go

@@ -0,0 +1,60 @@
+package vulnprobe
+
+import "testing"
+
+func TestCorrelateExchangeExposed(t *testing.T) {
+	ctx := HostContext{
+		Platform:          "windows",
+		ExchangeInstalled: true,
+		LastPatchDays:     120,
+		ListeningPorts:    map[int]bool{443: true},
+	}
+	r := Run(ctx)
+	var proxy *VulnFinding
+	for i := range r.Findings {
+		if r.Findings[i].CVEID == "CVE-2021-26855" {
+			proxy = &r.Findings[i]
+			break
+		}
+	}
+	if proxy == nil {
+		t.Fatal("missing CVE-2021-26855 finding")
+	}
+	if proxy.Patched {
+		t.Fatalf("expected unpatched exchange exposure, got %+v", proxy)
+	}
+	if !proxy.ExploitableInFleetContext {
+		t.Fatalf("expected fleet-context exploitability with 443 open, got %+v", proxy)
+	}
+}
+
+func TestCorrelateKBMitigatesZerologon(t *testing.T) {
+	ctx := HostContext{
+		Platform:           "windows",
+		IsDomainController: true,
+		InstalledKBs:       []string{"KB4577015"},
+		LastPatchDays:      10,
+	}
+	r := Run(ctx)
+	for _, f := range r.Findings {
+		if f.CVEID == "CVE-2020-1472" && !f.Patched {
+			t.Fatalf("expected patched after KB4577015, got %+v", f)
+		}
+	}
+}
+
+func TestRiskScoreFromMockedFindings(t *testing.T) {
+	r := finalize([]VulnFinding{
+		{CVEID: "CVE-2021-26855", Severity: "critical", ExploitableInFleetContext: true},
+		{CVEID: "CVE-2021-44228", Severity: "critical", Patched: false},
+	}, HostContext{})
+	if r.RiskScore < 25 {
+		t.Fatalf("expected elevated risk score, got %d", r.RiskScore)
+	}
+}
+
+func TestCatalogNotEmpty(t *testing.T) {
+	if len(Catalog) < 10 {
+		t.Fatalf("expected catalog entries, got %d", len(Catalog))
+	}
+}