# AetherForge — Problem Audit

Findings grouped by severity. Updated after bug-sweep pass.

**Last verified:** `go test ./...` in `server/` and `agent/`, `npm run build` in `server/web/`, double-click `run.bat`.

---

## Fixed (recent passes)

| ID | Fix |
|----|-----|
| C1 | `BroadcastServerLog` on `WSHub` |
| C2 | `EncodeToString` in agent download handler |
| C3 | `AgentRemoteActions` legacy props (`agent`, `compact`) |
| C4 | `useWebSocket` `latestMessage` + Agents detail wiring |
| C5 | Agent handlers: `ps`, `netstat`, `users`, `software`, `screenshot` |
| C6 | `NewMeshNode(c)` in `NewAgentClient` |
| H1 | WS reconnect: only mark offline if closing conn is still active |
| H2 | WS pre-auth guard on `stats`, `submit_share`, `get_job`, `log_tail`, `command_result` |
| H3 | Share submit via async pool queue + `go proxy.SubmitShare` in read loop |
| H4 | Fleet broadcast `all` fails when zero agents connected |
| H5–H8 | AI: build ID reinstall, uptime, sleep parse, decide HTTP/error field |
| H10 | Download uses `EncodeToString` |
| H13 | `run.bat` fails on frontend build error; kills stale server before bind |
| M3 | `stats_update` includes memory, uptime, shares (server + web hook) |
| M5 | Removed blocking 800ms sleep in `GetAgentLog` |
| M8 | `GetEngine` lock pattern simplified |
| M10 | CORS: `AllowCredentials: false` with `AllowedOrigins: *` |
| M11 | Blueprint delete returns boolean `success` |
| — | Deleted corrupt empty `server/internal/ollama/main.go` and root `main.go` (broke `go build`) |
| — | AI shares wired from agent client stats |
| — | Ollama prompt: `reinstall_miner` uses `build_id` |
| — | Forge types/defaults include `process_hollowing`, `mesh_p2p`, `auto_spread` (default false) |

---

## Still open

### Critical / security

| ID | Issue |
|----|-------|
| C7 | Partial — REST `/api/v1` requires basic auth; dashboard WebSocket + SPA are open. Use **Calibrate → Save session login** so fetch calls authenticate. |
| C8 | Unauthenticated remote code execution (`powershell`, `exec`, `upload`) on agents that connect to your server |

### High (intentional / deploy-time)

| ID | Issue |
|----|-------|
| H9 | `upload_log` returns content in tool report only (no dedicated log ingest API) |
| H11 | `AutoSpread` still runs when baked `true` in forge |
| H12 | Process hollowing available with `-tags hollow` + forge flag |

### Medium / UX

| ID | Issue |
|----|-------|
| M1 | Full tactical panel in agent list cards (compact mode exists but list still busy) |
| M4 | Forge UI has no toggles for hollowing/mesh/spread (types/defaults only) |
| M6 | Remote UI offline guard partial (compact checks `agent.status`) |
| M7 | Row click vs button bubbling (compact uses `stopPropagation`) |
| M9 | Fusion icon needs network for `go-winres` at forge time |

### Low

| ID | Issue |
|----|-------|
| L1 | Dead CSS `.agent-actions` in `FleetPanels.css` |
| L2 | Duplicate CSS imports on Dashboard/Agents |
| L3 | Weak typing on WS payloads (`any`) |
| L4 | No integration tests for remote actions |
| L5 | Mesh P2P requires build tag `p2p` for full libp2p |

---

## Verification

```bat
cd server && go test ./... && go build .
cd ..\agent && go test ./... && go build .
cd ..\server\web && npm test && npm run build
run.bat
```