AetherForge/PROBLEMS.md

AetherForge — Problem Audit

Read-only audit of the repo. Findings grouped by severity for systematic fixes.

Last verified: run go build in server/ and agent/, npm run build in server/web/, then double-click run.bat.

---

Fixed in latest pass (run.bat should work)

ID	Fix
C1	Restored BroadcastServerLog on WSHub
C2	EncodeToString in agent download handler
C3	AgentRemoteActions accepts legacy agent + compact props again
C4	Partial — useWebSocket exposes latestMessage; Agents detail wired
C5	Partial — agent handlers for ps, netstat, users, software, screenshot
C6	NewMeshNode(c) initialized in NewAgentClient
H13	run.bat exits on frontend build failure

Still open: C7/C8 auth, H1–H12, M1–M11, L1–L6 — see below.

---

Critical — blocks builds or core functionality

C1. Server does not compile (BroadcastServerLog missing)

• File: server/main.go:27
• Issue: wsLogWriter calls w.hub.BroadcastServerLog(), but that method was removed from server/internal/api/websocket.go.
• Impact: go build fails; run.bat cannot produce bin/miner-server.exe.

C2. Agent does not compile (EncodeString typo)

• File: agent/client/client.go:295
• Issue: Uses base64.StdEncoding.EncodeString(...) — Go API is EncodeToString(...).
• Impact: Forged worker builds fail at compile time.

C3. Frontend TypeScript build broken (remote actions props)

• Files: server/web/src/pages/DashboardPage.tsx:253, AgentsPage.tsx:123,222-224
• Issue: AgentRemoteActions expects agentId, agentName, latestWsMessage. Pages still pass agent, compact, onCommandSent.
• Impact: npm run build fails (tsc && vite build).

C4. Remote control UI non-functional end-to-end

• Wrong props → agentId undefined → /api/v1/agents/undefined/command
• useWebSocket.ts does not handle command_result
• No page passes latestWsMessage to AgentRemoteActions

C5. Five UI recon actions missing on agent

• UI: screenshot, ps, netstat, users, software in AgentRemoteActions.tsx
• Agent: only sysinfo implemented; others return "unknown action"

C6. Mesh P2P → nil pointer if enabled in forge

• Files: agent/client/client.go:65-68, 376-378; NewAgentClient never sets c.mesh
• Builder can bake MeshP2P: true but mesh node is never initialized.

C7. No authentication on control plane

• Files: server/internal/api/router.go, websocket.go
• Open: config PUT, builder, fleet commands, downloads, agent/dashboard WS, AI endpoints
• Anyone on LAN/tunnel can forge, reconfigure, run remote PowerShell, impersonate agents.

C8. Unauthenticated remote code execution

• Files: fleet_handler.go → agent exec, powershell, upload
• No auth, no action whitelist, upload accepts arbitrary paths.

---

High — major runtime bugs or security risk

H1. Agent reconnect marks fleet offline incorrectly

• File: websocket.go — defer on disconnect always SetAgentOffline; reconnect overwrites map without closing old conn.

H2. WebSocket messages processed before auth

• stats, submit_share, etc. use agentID with no guard when empty.

H3. Share submission blocks WebSocket read loop

• File: websocket.go:381-459 — synchronous pool submit on read loop (was async).

H4. Fleet broadcast always reports success

• id == "all" returns {success: true} even with zero connected agents.

H5. AI reinstall_miner uses agent ID instead of build ID

• File: agent/client/ai.go — download URL 404s.

H6. AI decide ignores HTTP errors

• No resp.StatusCode or "error" field check in callDecide.

H7. AI state wrong (uptime ~0, shares hardcoded 0)

• File: agent/client/ai.go:212-221 — time.Since(time.Now()) bug.

H8. AI sleep tool parsing broken

• Sscanf into time.Duration with wrong units.

H9. upload_log AI tool does not upload to server

• Reads local file only; Ollama prompt still advertises upload.

H10. Download command corrupts binary data

• EncodeString(string(b)) instead of EncodeToString(b).

H11. Auto-spread active when baked (AutoSpread)

• Files: agent/deploy/autospread.go, agent/main.go:59 — SMB/SCM lateral deployment on /24 sweep.

H12. Process hollowing in agent main when baked

• Files: agent/main.go:73-86, deploy/hollow_windows.go

H13. run.bat pipeline fails when server/agent/web do not compile

• Steps 3–4 depend on fixes for C1–C3.

---

Medium — incomplete features, UX regressions

M1. Full tactical panel embedded in agent list cards (no compact mode)

• Dashboard and Agents list render huge remote panel per row.

M2. onCommandSent / get_log flow removed from remote UI

• Agents detail log refresh broken; get_log button removed.

M3. Live dashboard stats incomplete over WebSocket

• Memory, uptime, shares not in stats_update broadcast or hook merge.

M4. Forge schema mismatch (backend vs frontend types)

• Backend: process_hollowing, mesh_p2p, auto_spread in handler.go
• Frontend BuildRequest and Builder UI omit them; help/rules still reference them.

M5. Agent log fetch uses fixed 800ms sleep

• File: fleet_handler.go — blocks handler; often stale.

M6. No online/offline guard in new remote UI

M7. Click bubbling in agent list (buttons re-select row)

M8. GetEngine fragile lock pattern in ai_handler.go

M9. Fusion icon needs network for go-winres at forge time

M10. CORS AllowedOrigins: * with AllowCredentials: true

M11. Blueprint delete returns "success": "true" string

---

Low — polish and test gaps

L1. Dead CSS (.agent-actions in FleetPanels.css)

L2. Duplicate CSS imports on Dashboard/Agents pages

L3. Weak typing on WS payloads (any)

L4. No tests for remote actions or page integration

L5. mesh_p2p.go vs stub; mesh never initialized anyway

L6. Server log streaming half-removed (BroadcastServerLog)

---

Suggested fix order

1. C1, C2, C3 — restore compilable server, agent, web
2. C4, C5 — wire remote actions + implement or remove dead buttons
3. C6 — init mesh stub in NewAgentClient
4. H3, H1, H2 — async shares, reconnect, pre-auth guard
5. C7, C8 — auth on control plane
6. H5–H10 — AI and download bugs
7. M1–M7 — UX cleanup
8. M4, H11, H12 — align or remove hollowing/spread/mesh

---

Verification commands

Command	Expected after fixes
cd server && go build .	PASS
cd agent && go build .	PASS
cd server/web && npm run build	PASS
run.bat	Builds + starts bin/miner-server.exe