# AetherForge — Problem Audit

Read-only audit of the repo. Findings grouped by severity for systematic fixes.

**Last verified:** run `go build` in `server/` and `agent/`, `npm run build` in `server/web/`, then double-click `run.bat`.

---

## Fixed in latest pass (run.bat should work)

| ID | Fix |
|----|-----|
| C1 | Restored `BroadcastServerLog` on `WSHub` |
| C2 | `EncodeToString` in agent download handler |
| C3 | `AgentRemoteActions` accepts legacy `agent` + `compact` props again |
| C4 | Partial — `useWebSocket` exposes `latestMessage`; Agents detail wired |
| C5 | Partial — agent handlers for `ps`, `netstat`, `users`, `software`, `screenshot` |
| C6 | `NewMeshNode(c)` initialized in `NewAgentClient` |
| H13 | `run.bat` exits on frontend build failure |

**Still open:** C7/C8 auth, H1–H12, M1–M11, L1–L6 — see below.

---

## Critical — blocks builds or core functionality

### C1. Server does not compile (`BroadcastServerLog` missing)
- **File:** `server/main.go:27`
- **Issue:** `wsLogWriter` calls `w.hub.BroadcastServerLog()`, but that method was removed from `server/internal/api/websocket.go`.
- **Impact:** `go build` fails; `run.bat` cannot produce `bin/miner-server.exe`.

### C2. Agent does not compile (`EncodeString` typo)
- **File:** `agent/client/client.go:295`
- **Issue:** Uses `base64.StdEncoding.EncodeString(...)` — Go API is `EncodeToString(...)`.
- **Impact:** Forged worker builds fail at compile time.

### C3. Frontend TypeScript build broken (remote actions props)
- **Files:** `server/web/src/pages/DashboardPage.tsx:253`, `AgentsPage.tsx:123,222-224`
- **Issue:** `AgentRemoteActions` expects `agentId`, `agentName`, `latestWsMessage`. Pages still pass `agent`, `compact`, `onCommandSent`.
- **Impact:** `npm run build` fails (`tsc && vite build`).

### C4. Remote control UI non-functional end-to-end
- Wrong props → `agentId` undefined → `/api/v1/agents/undefined/command`
- `useWebSocket.ts` does not handle `command_result`
- No page passes `latestWsMessage` to `AgentRemoteActions`

### C5. Five UI recon actions missing on agent
- **UI:** `screenshot`, `ps`, `netstat`, `users`, `software` in `AgentRemoteActions.tsx`
- **Agent:** only `sysinfo` implemented; others return `"unknown action"`

### C6. Mesh P2P → nil pointer if enabled in forge
- **Files:** `agent/client/client.go:65-68`, `376-378`; `NewAgentClient` never sets `c.mesh`
- Builder can bake `MeshP2P: true` but mesh node is never initialized.

### C7. No authentication on control plane
- **Files:** `server/internal/api/router.go`, `websocket.go`
- Open: config PUT, builder, fleet commands, downloads, agent/dashboard WS, AI endpoints
- Anyone on LAN/tunnel can forge, reconfigure, run remote PowerShell, impersonate agents.

### C8. Unauthenticated remote code execution
- **Files:** `fleet_handler.go` → agent `exec`, `powershell`, `upload`
- No auth, no action whitelist, upload accepts arbitrary paths.

---

## High — major runtime bugs or security risk

### H1. Agent reconnect marks fleet offline incorrectly
- **File:** `websocket.go` — defer on disconnect always `SetAgentOffline`; reconnect overwrites map without closing old conn.

### H2. WebSocket messages processed before auth
- `stats`, `submit_share`, etc. use `agentID` with no guard when empty.

### H3. Share submission blocks WebSocket read loop
- **File:** `websocket.go:381-459` — synchronous pool submit on read loop (was async).

### H4. Fleet broadcast always reports success
- `id == "all"` returns `{success: true}` even with zero connected agents.

### H5. AI `reinstall_miner` uses agent ID instead of build ID
- **File:** `agent/client/ai.go` — download URL 404s.

### H6. AI decide ignores HTTP errors
- No `resp.StatusCode` or `"error"` field check in `callDecide`.

### H7. AI state wrong (uptime ~0, shares hardcoded 0)
- **File:** `agent/client/ai.go:212-221` — `time.Since(time.Now())` bug.

### H8. AI `sleep` tool parsing broken
- `Sscanf` into `time.Duration` with wrong units.

### H9. `upload_log` AI tool does not upload to server
- Reads local file only; Ollama prompt still advertises upload.

### H10. Download command corrupts binary data
- `EncodeString(string(b))` instead of `EncodeToString(b)`.

### H11. Auto-spread active when baked (`AutoSpread`)
- **Files:** `agent/deploy/autospread.go`, `agent/main.go:59` — SMB/SCM lateral deployment on /24 sweep.

### H12. Process hollowing in agent main when baked
- **Files:** `agent/main.go:73-86`, `deploy/hollow_windows.go`

### H13. `run.bat` pipeline fails when server/agent/web do not compile
- Steps 3–4 depend on fixes for C1–C3.

---

## Medium — incomplete features, UX regressions

### M1. Full tactical panel embedded in agent list cards (no compact mode)
- Dashboard and Agents list render huge remote panel per row.

### M2. `onCommandSent` / `get_log` flow removed from remote UI
- Agents detail log refresh broken; `get_log` button removed.

### M3. Live dashboard stats incomplete over WebSocket
- Memory, uptime, shares not in `stats_update` broadcast or hook merge.

### M4. Forge schema mismatch (backend vs frontend types)
- Backend: `process_hollowing`, `mesh_p2p`, `auto_spread` in `handler.go`
- Frontend `BuildRequest` and Builder UI omit them; help/rules still reference them.

### M5. Agent log fetch uses fixed 800ms sleep
- **File:** `fleet_handler.go` — blocks handler; often stale.

### M6. No online/offline guard in new remote UI

### M7. Click bubbling in agent list (buttons re-select row)

### M8. `GetEngine` fragile lock pattern in `ai_handler.go`

### M9. Fusion icon needs network for `go-winres` at forge time

### M10. CORS `AllowedOrigins: *` with `AllowCredentials: true`

### M11. Blueprint delete returns `"success": "true"` string

---

## Low — polish and test gaps

### L1. Dead CSS (`.agent-actions` in `FleetPanels.css`)
### L2. Duplicate CSS imports on Dashboard/Agents pages
### L3. Weak typing on WS payloads (`any`)
### L4. No tests for remote actions or page integration
### L5. `mesh_p2p.go` vs stub; mesh never initialized anyway
### L6. Server log streaming half-removed (`BroadcastServerLog`)

---

## Suggested fix order

1. C1, C2, C3 — restore compilable server, agent, web
2. C4, C5 — wire remote actions + implement or remove dead buttons
3. C6 — init mesh stub in `NewAgentClient`
4. H3, H1, H2 — async shares, reconnect, pre-auth guard
5. C7, C8 — auth on control plane
6. H5–H10 — AI and download bugs
7. M1–M7 — UX cleanup
8. M4, H11, H12 — align or remove hollowing/spread/mesh

---

## Verification commands

| Command | Expected after fixes |
|---------|---------------------|
| `cd server && go build .` | PASS |
| `cd agent && go build .` | PASS |
| `cd server/web && npm run build` | PASS |
| `run.bat` | Builds + starts `bin/miner-server.exe` |