c95a4373de
Fusion copies prep icon and version info via go-winres; optional Garble obfuscation, Authenticode signing, and dry-run size estimates. Forge Simple mode with smart defaults; fleet roster gets compact expandable cards, filters, bulk commands, per-agent notes/tags, and typed WebSocket payloads.
84 lines
3.2 KiB
Markdown
84 lines
3.2 KiB
Markdown
# AetherForge — Problem Audit
|
||
|
||
Findings grouped by severity. Updated after bug-sweep pass.
|
||
|
||
**Last verified:** `go test ./...` in `server/` and `agent/`, `npm run build` in `server/web/`, double-click `run.bat`.
|
||
|
||
---
|
||
|
||
## Fixed (recent passes)
|
||
|
||
| ID | Fix |
|
||
|----|-----|
|
||
| C1 | `BroadcastServerLog` on `WSHub` |
|
||
| C2 | `EncodeToString` in agent download handler |
|
||
| C3 | `AgentRemoteActions` legacy props (`agent`, `compact`) |
|
||
| C4 | `useWebSocket` `latestMessage` + Agents detail wiring |
|
||
| C5 | Agent handlers: `ps`, `netstat`, `users`, `software`, `screenshot` |
|
||
| C6 | `NewMeshNode(c)` in `NewAgentClient` |
|
||
| H1 | WS reconnect: only mark offline if closing conn is still active |
|
||
| H2 | WS pre-auth guard on `stats`, `submit_share`, `get_job`, `log_tail`, `command_result` |
|
||
| H3 | Share submit via async pool queue + `go proxy.SubmitShare` in read loop |
|
||
| H4 | Fleet broadcast `all` fails when zero agents connected |
|
||
| H5–H8 | AI: build ID reinstall, uptime, sleep parse, decide HTTP/error field |
|
||
| H10 | Download uses `EncodeToString` |
|
||
| H13 | `run.bat` fails on frontend build error; kills stale server before bind |
|
||
| M3 | `stats_update` includes memory, uptime, shares (server + web hook) |
|
||
| M5 | Removed blocking 800ms sleep in `GetAgentLog` |
|
||
| M8 | `GetEngine` lock pattern simplified |
|
||
| M10 | CORS: `AllowCredentials: false` with `AllowedOrigins: *` |
|
||
| M11 | Blueprint delete returns boolean `success` |
|
||
| — | Deleted corrupt empty `server/internal/ollama/main.go` and root `main.go` (broke `go build`) |
|
||
| — | Fleet filters, bulk commands, per-agent notes/tags (SQLite) |
|
||
| — | Ollama prompt: `reinstall_miner` uses `build_id` |
|
||
| — | Forge types/defaults include `process_hollowing`, `mesh_p2p`, `auto_spread` (default false) |
|
||
|
||
---
|
||
|
||
## Still open
|
||
|
||
### Critical / security
|
||
|
||
| ID | Issue |
|
||
|----|-------|
|
||
| C7 | Partial — REST `/api/v1` requires basic auth; dashboard WebSocket + SPA are open. Use **Calibrate → Save session login** so fetch calls authenticate. |
|
||
| C8 | Unauthenticated remote code execution (`powershell`, `exec`, `upload`) on agents that connect to your server |
|
||
|
||
### High (intentional / deploy-time)
|
||
|
||
| ID | Issue |
|
||
|----|-------|
|
||
| H9 | `upload_log` returns content in tool report only (no dedicated log ingest API) |
|
||
| H11 | `AutoSpread` still runs when baked `true` in forge |
|
||
| H12 | Process hollowing available with `-tags hollow` + forge flag |
|
||
|
||
### Medium / UX
|
||
|
||
| ID | Issue |
|
||
|----|-------|
|
||
| M1 | Compact agent list default — expand on click; full detail panel retained |
|
||
| M6 | Remote actions disabled unless `status === online` (list, detail, dashboard) |
|
||
| M7 | Row click vs button bubbling (compact uses `stopPropagation`) |
|
||
| M9 | Fusion uses vendored `go-winres` (module + optional `go install` via run.bat) |
|
||
|
||
### Low
|
||
|
||
| ID | Issue |
|
||
|----|-------|
|
||
| L1 | Dead CSS `.agent-actions` in `FleetPanels.css` |
|
||
| L2 | Duplicate CSS imports on Dashboard/Agents |
|
||
| L3 | WS payloads typed in `types/ws.ts` + `api/ws_types.go` (partial — not all message types) |
|
||
| L4 | No integration tests for remote actions |
|
||
| L5 | Mesh P2P requires build tag `p2p` for full libp2p |
|
||
|
||
---
|
||
|
||
## Verification
|
||
|
||
```bat
|
||
cd server && go test ./... && go build .
|
||
cd ..\agent && go test ./... && go build .
|
||
cd ..\server\web && npm test && npm run build
|
||
run.bat
|
||
```
|