Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

server/web/src/help/reconRisk.test.ts

@@ -0,0 +1,38 @@
+import { describe, expect, it } from 'vitest';
+import { ipToSubnet, joinLaneLabel, riskFromVulnFindings } from './reconRisk';
+
+describe('reconRisk', () => {
+  it('ipToSubnet derives /24 label', () => {
+    expect(ipToSubnet('10.0.1.42')).toBe('10.0.1.x');
+    expect(ipToSubnet('')).toBe('');
+  });
+
+  it('riskFromVulnFindings returns null when empty or all patched', () => {
+    expect(riskFromVulnFindings(undefined)).toBeNull();
+    expect(riskFromVulnFindings([{ cve_id: 'CVE-1', severity: 'critical', patched: true }])).toBeNull();
+  });
+
+  it('riskFromVulnFindings picks highest unpatched severity', () => {
+    const info = riskFromVulnFindings([
+      { cve_id: 'CVE-LOW', severity: 'low', patched: false },
+      { cve_id: 'CVE-HIGH', severity: 'high', patched: false, exploitable_in_fleet_context: true },
+    ]);
+    expect(info?.level).toBe('high');
+    expect(info?.label).toBe('RISK HIGH');
+    expect(info?.count).toBe(2);
+    expect(info?.title).toContain('CVE-HIGH');
+  });
+
+  it('riskFromVulnFindings maps critical severity', () => {
+    const info = riskFromVulnFindings([{ cve_id: 'CVE-X', severity: 'critical', patched: false }]);
+    expect(info?.level).toBe('critical');
+    expect(info?.label).toBe('RISK CRIT');
+  });
+
+  it('joinLaneLabel formats known lanes', () => {
+    expect(joinLaneLabel('winrm')).toBe('WinRM');
+    expect(joinLaneLabel('spread_smb_unc')).toBe('SMB UNC');
+    expect(joinLaneLabel('')).toBeNull();
+    expect(joinLaneLabel('custom_lane')).toBe('custom lane');
+  });
+});