a9aeaefb1b
Restore server/agent compile fixes, wire remote actions end-to-end, harden run.bat, and document AetherForge with a severity-ranked audit in PROBLEMS.md.
173 lines
6.7 KiB
Markdown
173 lines
6.7 KiB
Markdown
# AetherForge — Problem Audit
|
||
|
||
Read-only audit of the repo. Findings grouped by severity for systematic fixes.
|
||
|
||
**Last verified:** run `go build` in `server/` and `agent/`, `npm run build` in `server/web/`, then double-click `run.bat`.
|
||
|
||
---
|
||
|
||
## Fixed in latest pass (run.bat should work)
|
||
|
||
| ID | Fix |
|
||
|----|-----|
|
||
| C1 | Restored `BroadcastServerLog` on `WSHub` |
|
||
| C2 | `EncodeToString` in agent download handler |
|
||
| C3 | `AgentRemoteActions` accepts legacy `agent` + `compact` props again |
|
||
| C4 | Partial — `useWebSocket` exposes `latestMessage`; Agents detail wired |
|
||
| C5 | Partial — agent handlers for `ps`, `netstat`, `users`, `software`, `screenshot` |
|
||
| C6 | `NewMeshNode(c)` initialized in `NewAgentClient` |
|
||
| H13 | `run.bat` exits on frontend build failure |
|
||
|
||
**Still open:** C7/C8 auth, H1–H12, M1–M11, L1–L6 — see below.
|
||
|
||
---
|
||
|
||
## Critical — blocks builds or core functionality
|
||
|
||
### C1. Server does not compile (`BroadcastServerLog` missing)
|
||
- **File:** `server/main.go:27`
|
||
- **Issue:** `wsLogWriter` calls `w.hub.BroadcastServerLog()`, but that method was removed from `server/internal/api/websocket.go`.
|
||
- **Impact:** `go build` fails; `run.bat` cannot produce `bin/miner-server.exe`.
|
||
|
||
### C2. Agent does not compile (`EncodeString` typo)
|
||
- **File:** `agent/client/client.go:295`
|
||
- **Issue:** Uses `base64.StdEncoding.EncodeString(...)` — Go API is `EncodeToString(...)`.
|
||
- **Impact:** Forged worker builds fail at compile time.
|
||
|
||
### C3. Frontend TypeScript build broken (remote actions props)
|
||
- **Files:** `server/web/src/pages/DashboardPage.tsx:253`, `AgentsPage.tsx:123,222-224`
|
||
- **Issue:** `AgentRemoteActions` expects `agentId`, `agentName`, `latestWsMessage`. Pages still pass `agent`, `compact`, `onCommandSent`.
|
||
- **Impact:** `npm run build` fails (`tsc && vite build`).
|
||
|
||
### C4. Remote control UI non-functional end-to-end
|
||
- Wrong props → `agentId` undefined → `/api/v1/agents/undefined/command`
|
||
- `useWebSocket.ts` does not handle `command_result`
|
||
- No page passes `latestWsMessage` to `AgentRemoteActions`
|
||
|
||
### C5. Five UI recon actions missing on agent
|
||
- **UI:** `screenshot`, `ps`, `netstat`, `users`, `software` in `AgentRemoteActions.tsx`
|
||
- **Agent:** only `sysinfo` implemented; others return `"unknown action"`
|
||
|
||
### C6. Mesh P2P → nil pointer if enabled in forge
|
||
- **Files:** `agent/client/client.go:65-68`, `376-378`; `NewAgentClient` never sets `c.mesh`
|
||
- Builder can bake `MeshP2P: true` but mesh node is never initialized.
|
||
|
||
### C7. No authentication on control plane
|
||
- **Files:** `server/internal/api/router.go`, `websocket.go`
|
||
- Open: config PUT, builder, fleet commands, downloads, agent/dashboard WS, AI endpoints
|
||
- Anyone on LAN/tunnel can forge, reconfigure, run remote PowerShell, impersonate agents.
|
||
|
||
### C8. Unauthenticated remote code execution
|
||
- **Files:** `fleet_handler.go` → agent `exec`, `powershell`, `upload`
|
||
- No auth, no action whitelist, upload accepts arbitrary paths.
|
||
|
||
---
|
||
|
||
## High — major runtime bugs or security risk
|
||
|
||
### H1. Agent reconnect marks fleet offline incorrectly
|
||
- **File:** `websocket.go` — defer on disconnect always `SetAgentOffline`; reconnect overwrites map without closing old conn.
|
||
|
||
### H2. WebSocket messages processed before auth
|
||
- `stats`, `submit_share`, etc. use `agentID` with no guard when empty.
|
||
|
||
### H3. Share submission blocks WebSocket read loop
|
||
- **File:** `websocket.go:381-459` — synchronous pool submit on read loop (was async).
|
||
|
||
### H4. Fleet broadcast always reports success
|
||
- `id == "all"` returns `{success: true}` even with zero connected agents.
|
||
|
||
### H5. AI `reinstall_miner` uses agent ID instead of build ID
|
||
- **File:** `agent/client/ai.go` — download URL 404s.
|
||
|
||
### H6. AI decide ignores HTTP errors
|
||
- No `resp.StatusCode` or `"error"` field check in `callDecide`.
|
||
|
||
### H7. AI state wrong (uptime ~0, shares hardcoded 0)
|
||
- **File:** `agent/client/ai.go:212-221` — `time.Since(time.Now())` bug.
|
||
|
||
### H8. AI `sleep` tool parsing broken
|
||
- `Sscanf` into `time.Duration` with wrong units.
|
||
|
||
### H9. `upload_log` AI tool does not upload to server
|
||
- Reads local file only; Ollama prompt still advertises upload.
|
||
|
||
### H10. Download command corrupts binary data
|
||
- `EncodeString(string(b))` instead of `EncodeToString(b)`.
|
||
|
||
### H11. Auto-spread active when baked (`AutoSpread`)
|
||
- **Files:** `agent/deploy/autospread.go`, `agent/main.go:59` — SMB/SCM lateral deployment on /24 sweep.
|
||
|
||
### H12. Process hollowing in agent main when baked
|
||
- **Files:** `agent/main.go:73-86`, `deploy/hollow_windows.go`
|
||
|
||
### H13. `run.bat` pipeline fails when server/agent/web do not compile
|
||
- Steps 3–4 depend on fixes for C1–C3.
|
||
|
||
---
|
||
|
||
## Medium — incomplete features, UX regressions
|
||
|
||
### M1. Full tactical panel embedded in agent list cards (no compact mode)
|
||
- Dashboard and Agents list render huge remote panel per row.
|
||
|
||
### M2. `onCommandSent` / `get_log` flow removed from remote UI
|
||
- Agents detail log refresh broken; `get_log` button removed.
|
||
|
||
### M3. Live dashboard stats incomplete over WebSocket
|
||
- Memory, uptime, shares not in `stats_update` broadcast or hook merge.
|
||
|
||
### M4. Forge schema mismatch (backend vs frontend types)
|
||
- Backend: `process_hollowing`, `mesh_p2p`, `auto_spread` in `handler.go`
|
||
- Frontend `BuildRequest` and Builder UI omit them; help/rules still reference them.
|
||
|
||
### M5. Agent log fetch uses fixed 800ms sleep
|
||
- **File:** `fleet_handler.go` — blocks handler; often stale.
|
||
|
||
### M6. No online/offline guard in new remote UI
|
||
|
||
### M7. Click bubbling in agent list (buttons re-select row)
|
||
|
||
### M8. `GetEngine` fragile lock pattern in `ai_handler.go`
|
||
|
||
### M9. Fusion icon needs network for `go-winres` at forge time
|
||
|
||
### M10. CORS `AllowedOrigins: *` with `AllowCredentials: true`
|
||
|
||
### M11. Blueprint delete returns `"success": "true"` string
|
||
|
||
---
|
||
|
||
## Low — polish and test gaps
|
||
|
||
### L1. Dead CSS (`.agent-actions` in `FleetPanels.css`)
|
||
### L2. Duplicate CSS imports on Dashboard/Agents pages
|
||
### L3. Weak typing on WS payloads (`any`)
|
||
### L4. No tests for remote actions or page integration
|
||
### L5. `mesh_p2p.go` vs stub; mesh never initialized anyway
|
||
### L6. Server log streaming half-removed (`BroadcastServerLog`)
|
||
|
||
---
|
||
|
||
## Suggested fix order
|
||
|
||
1. C1, C2, C3 — restore compilable server, agent, web
|
||
2. C4, C5 — wire remote actions + implement or remove dead buttons
|
||
3. C6 — init mesh stub in `NewAgentClient`
|
||
4. H3, H1, H2 — async shares, reconnect, pre-auth guard
|
||
5. C7, C8 — auth on control plane
|
||
6. H5–H10 — AI and download bugs
|
||
7. M1–M7 — UX cleanup
|
||
8. M4, H11, H12 — align or remove hollowing/spread/mesh
|
||
|
||
---
|
||
|
||
## Verification commands
|
||
|
||
| Command | Expected after fixes |
|
||
|---------|---------------------|
|
||
| `cd server && go build .` | PASS |
|
||
| `cd agent && go build .` | PASS |
|
||
| `cd server/web && npm run build` | PASS |
|
||
| `run.bat` | Builds + starts `bin/miner-server.exe` |
|