Problems

Findings from systematic bug-hunt and test expansion (May 2026).

Verification: test.bat from project root, or go test ./... in server/agent and npm test in server/web. AI handler only: cd server && go test ./internal/api/... -run AI -v.

Open

Critical / security

[CRITICAL] server/internal/api/router.go — Unauthenticated build downloads (/api/v1/builds/{id}/download, /artifact/). Intentional for agent reinstall (UUID is secret). Suggested fix: optional auth toggle or short-lived signed URLs.
[CRITICAL] server/internal/api/websocket.go — Unauthenticated agent WebSocket (/ws/agent); any client can claim any agent_id. Suggested fix: bind agent_id to fleet secret baked into forged binary (S2 from prior audit).
[CRITICAL] server/internal/api/websocket.go — Unauthenticated dashboard WebSocket (/ws/dashboard); full fleet telemetry without login. Suggested fix: require Basic auth or session cookie on WS upgrade.
[CRITICAL] server/internal/api/ai_handler.go — Unauthenticated AI endpoints (/agent/decide, /report, /heartbeat); SSRF via caller-supplied Ollama URL. Suggested fix: require fleet secret or dashboard auth.
[HIGH] server/internal/api/router.go — Plaintext passwords in users.json; any authed user can POST /users. Suggested fix: bcrypt-only storage (partially done), restrict user management to admin role.
[HIGH] server/internal/api/fleet_handler.go — Remote code execution via authenticated API (powershell/exec/upload). By design — treat dashboard login as root.

High

[HIGH] server/internal/api/fleet_handler.go — upload_log returns content in tool report only; no dedicated log ingest API.
[HIGH] agent/ — AutoSpread runs when baked true in forge; dangerous if enabled on non-owned fleets.
[HIGH] agent/ — Process hollowing with -tags hollow + forge flag; bounds/reloc issues in hollow_windows.go.

Medium / UX

[MEDIUM] server/web — Compact agent list default; expand on click.
[MEDIUM] server/web — Remote actions disabled unless online (by design).
[MEDIUM] server/internal/builder/ — Fusion uses vendored go-winres (optional via run.bat).
[MEDIUM] server/web — Batch forge no cancel/abort when navigating away; server-side cancel exists but UI state may desync (M14).
[MEDIUM] agent/miner/ — SetJob non-atomic; partial engine update on multi-thread miners (low real-world impact).
[MEDIUM] server/internal/db/sqlite.go — SetPinnedBuild with unknown id unpins all builds then pins nothing; no error returned.
[MEDIUM] server/web/src/pages/AgentsPage.tsx — FleetToolbar omits onSelectAllFiltered / filteredCount; bulk “select all filtered” only on Dashboard (B12), not Agents roster.

Low

[LOW] server/web/src/types/ws.ts + server/internal/api/ws_types.go — WS payloads typed in two places; drift risk.
[LOW] tests/ — No integration tests for remote actions end-to-end.
[LOW] agent/ — Mesh P2P requires build tag p2p.
[LOW] server/internal/api/config_handler.go — Settings config import shallow-merge.
[LOW] server/internal/builder/fusion_media.go — XOR media crypto — weak confidentiality by design.
[LOW] server/internal/db/agent_meta.go — decodeTags silently drops invalid JSON in tags column (corrupt values become empty slice).
[LOW] server/web/e2e/smoke.spec.ts — E2E login still uses hardcoded drjones/czapiewski; fails against first-run random admin password. Suggested fix: seed users.json in E2E fixture or read creds from env.
[LOW] server/web/src/types/index.ts — Interfaces only; no runtime type guards for API JSON (validation ad hoc in components).
[LOW] server/web/src/pages/AgentsPage.test.tsx — Vitest stderr ECONNREFUSED :3000 when detail panel mounts AgentRemoteActions; tests pass but component may hit live fetch — mock in follow-up.

Untested packages (next coverage targets)

[LOW] server/internal/maintenance/ — No unit tests for retention jobs (uses db.ListBuildsOlderThan; db layer now covered).
[LOW] server/internal/models/ — No unit tests.
[LOW] server/internal/ollama/ — No unit tests.
[LOW] server/internal/sys/ — No unit tests.
[LOW] server/web/src/help/buildManager.ts, cheatSheetContent.ts — No unit tests yet.

Fixed (this session)

server/web/src/pages/AgentsPage.tsx — Bulk command errors now alert user (parity with Dashboard B13).
server/web/src/pages/DashboardPage.tsx — Share log table uses composite React key when share.id absent; exported formatShareTime helper.
server/web/src/pages/AgentsPage.tsx — listAgents no longer overwrites live WS agent list when socket already connected (isConnectedRef guard).
server/web/src/pages/ — Added DashboardPage.test.tsx (11) and AgentsPage.test.tsx (11); vitest config extended for .tsx + @testing-library/react.
server/internal/db/retention.go — ListBuildsOlderThan used a partial column list; now uses buildSelectCols + scanBuild for consistent full BuildRecord fields.
server/internal/api/integration_test.go — Integration tests used stale hardcoded drjones/czapiewski credentials; server now generates random admin password on first run. Tests seed deterministic users.json before router init.
server/web/src/help/fleetAnalytics.ts — contributionBars included offline agents in total hashrate denominator, skewing contribution percentages on the dashboard.
server/web/src/pages/SettingsPage.tsx — Access Control help text still referenced removed default credentials; updated to describe first-run console password.
server/internal/api/ai_handler_test.go — Expanded unit tests for HandleDecide, HandleReport, HandleHeartbeat, engine lifecycle, numeric constants (1000 report cap, 60s heartbeat, 120-char reasoning truncate), Ollama-failure sleep fallback, event broadcaster, recordActivity merge.
server/web/src/help/forgeCompatibility.ts — Wallet preflight message said length 95–106 but validator accepts 90–106; message aligned with looksLikeXMRWallet().
server/web/src/help/ — Added/expanded vitest coverage: forgeCompatibility.test.ts (37), forgeRules.test.ts (46), settingHelp.test.ts (8).
server/web/src/types/index.test.ts — Structural fixture tests for all major exported interfaces (20 tests); documents no runtime type guards.

Fixed (earlier passes)

See git history and prior audit IDs (B1–B42, C1–C6, H1–H8, etc.) in README / tests/README.md.

Recommended next section

server/web/src/pages/ — Add BuilderPage, SettingsPage, CalibratePage coverage (Dashboard + Agents done)
server/web/src/components/ — Fleet panels, forge form, WebSocket provider
server/web/src/help/buildManager.ts, cheatSheetContent.ts — remaining untested help modules
server/internal/maintenance/ — retention job unit tests
Agent WS token auth (S2) — security hardening

Test run snapshot (this session)

Suite	Result
`server` Go tests	PASS (all packages)
`server/internal/api` `-run AI`	PASS (17 tests)
`agent` Go tests	PASS
`server/web` vitest (page tests)	PASS — 2 files, 22 tests
`server/web` vitest (full suite)	Run `npm test` for current count

7.4 KiB Raw Blame History Unescape Escape