fabc632384
Remove corrupt empty main.go files, harden WebSocket reconnect and pre-auth handling, complete live stats in the dashboard hook, wire AI share counts, and refresh PROBLEMS.md.
85 lines
3.1 KiB
Markdown
85 lines
3.1 KiB
Markdown
# AetherForge — Problem Audit
|
||
|
||
Findings grouped by severity. Updated after bug-sweep pass.
|
||
|
||
**Last verified:** `go test ./...` in `server/` and `agent/`, `npm run build` in `server/web/`, double-click `run.bat`.
|
||
|
||
---
|
||
|
||
## Fixed (recent passes)
|
||
|
||
| ID | Fix |
|
||
|----|-----|
|
||
| C1 | `BroadcastServerLog` on `WSHub` |
|
||
| C2 | `EncodeToString` in agent download handler |
|
||
| C3 | `AgentRemoteActions` legacy props (`agent`, `compact`) |
|
||
| C4 | `useWebSocket` `latestMessage` + Agents detail wiring |
|
||
| C5 | Agent handlers: `ps`, `netstat`, `users`, `software`, `screenshot` |
|
||
| C6 | `NewMeshNode(c)` in `NewAgentClient` |
|
||
| H1 | WS reconnect: only mark offline if closing conn is still active |
|
||
| H2 | WS pre-auth guard on `stats`, `submit_share`, `get_job`, `log_tail`, `command_result` |
|
||
| H3 | Share submit via async pool queue + `go proxy.SubmitShare` in read loop |
|
||
| H4 | Fleet broadcast `all` fails when zero agents connected |
|
||
| H5–H8 | AI: build ID reinstall, uptime, sleep parse, decide HTTP/error field |
|
||
| H10 | Download uses `EncodeToString` |
|
||
| H13 | `run.bat` fails on frontend build error; kills stale server before bind |
|
||
| M3 | `stats_update` includes memory, uptime, shares (server + web hook) |
|
||
| M5 | Removed blocking 800ms sleep in `GetAgentLog` |
|
||
| M8 | `GetEngine` lock pattern simplified |
|
||
| M10 | CORS: `AllowCredentials: false` with `AllowedOrigins: *` |
|
||
| M11 | Blueprint delete returns boolean `success` |
|
||
| — | Deleted corrupt empty `server/internal/ollama/main.go` and root `main.go` (broke `go build`) |
|
||
| — | AI shares wired from agent client stats |
|
||
| — | Ollama prompt: `reinstall_miner` uses `build_id` |
|
||
| — | Forge types/defaults include `process_hollowing`, `mesh_p2p`, `auto_spread` (default false) |
|
||
|
||
---
|
||
|
||
## Still open
|
||
|
||
### Critical / security
|
||
|
||
| ID | Issue |
|
||
|----|-------|
|
||
| C7 | No authentication on control plane (dashboard REST/WS) |
|
||
| C8 | Unauthenticated remote code execution (`powershell`, `exec`, `upload`) |
|
||
|
||
### High (intentional / deploy-time)
|
||
|
||
| ID | Issue |
|
||
|----|-------|
|
||
| H9 | `upload_log` returns content in tool report only (no dedicated log ingest API) |
|
||
| H11 | `AutoSpread` still runs when baked `true` in forge |
|
||
| H12 | Process hollowing available with `-tags hollow` + forge flag |
|
||
|
||
### Medium / UX
|
||
|
||
| ID | Issue |
|
||
|----|-------|
|
||
| M1 | Full tactical panel in agent list cards (compact mode exists but list still busy) |
|
||
| M4 | Forge UI has no toggles for hollowing/mesh/spread (types/defaults only) |
|
||
| M6 | Remote UI offline guard partial (compact checks `agent.status`) |
|
||
| M7 | Row click vs button bubbling (compact uses `stopPropagation`) |
|
||
| M9 | Fusion icon needs network for `go-winres` at forge time |
|
||
|
||
### Low
|
||
|
||
| ID | Issue |
|
||
|----|-------|
|
||
| L1 | Dead CSS `.agent-actions` in `FleetPanels.css` |
|
||
| L2 | Duplicate CSS imports on Dashboard/Agents |
|
||
| L3 | Weak typing on WS payloads (`any`) |
|
||
| L4 | No integration tests for remote actions |
|
||
| L5 | Mesh P2P requires build tag `p2p` for full libp2p |
|
||
|
||
---
|
||
|
||
## Verification
|
||
|
||
```bat
|
||
cd server && go test ./... && go build .
|
||
cd ..\agent && go test ./... && go build .
|
||
cd ..\server\web && npm test && npm run build
|
||
run.bat
|
||
```
|