9e26c4babb
Scope API auth to /api/v1, fix dashboard WebSocket 401s, session login in Calibrate, safe agent naming, reconnect races, and remove corrupt ollama/main.go.
3.2 KiB
3.2 KiB
AetherForge — Problem Audit
Findings grouped by severity. Updated after bug-sweep pass.
Last verified: go test ./... in server/ and agent/, npm run build in server/web/, double-click run.bat.
Fixed (recent passes)
| ID | Fix |
|---|---|
| C1 | BroadcastServerLog on WSHub |
| C2 | EncodeToString in agent download handler |
| C3 | AgentRemoteActions legacy props (agent, compact) |
| C4 | useWebSocket latestMessage + Agents detail wiring |
| C5 | Agent handlers: ps, netstat, users, software, screenshot |
| C6 | NewMeshNode(c) in NewAgentClient |
| H1 | WS reconnect: only mark offline if closing conn is still active |
| H2 | WS pre-auth guard on stats, submit_share, get_job, log_tail, command_result |
| H3 | Share submit via async pool queue + go proxy.SubmitShare in read loop |
| H4 | Fleet broadcast all fails when zero agents connected |
| H5–H8 | AI: build ID reinstall, uptime, sleep parse, decide HTTP/error field |
| H10 | Download uses EncodeToString |
| H13 | run.bat fails on frontend build error; kills stale server before bind |
| M3 | stats_update includes memory, uptime, shares (server + web hook) |
| M5 | Removed blocking 800ms sleep in GetAgentLog |
| M8 | GetEngine lock pattern simplified |
| M10 | CORS: AllowCredentials: false with AllowedOrigins: * |
| M11 | Blueprint delete returns boolean success |
| — | Deleted corrupt empty server/internal/ollama/main.go and root main.go (broke go build) |
| — | AI shares wired from agent client stats |
| — | Ollama prompt: reinstall_miner uses build_id |
| — | Forge types/defaults include process_hollowing, mesh_p2p, auto_spread (default false) |
Still open
Critical / security
| ID | Issue |
|---|---|
| C7 | Partial — REST /api/v1 requires basic auth; dashboard WebSocket + SPA are open. Use Calibrate → Save session login so fetch calls authenticate. |
| C8 | Unauthenticated remote code execution (powershell, exec, upload) on agents that connect to your server |
High (intentional / deploy-time)
| ID | Issue |
|---|---|
| H9 | upload_log returns content in tool report only (no dedicated log ingest API) |
| H11 | AutoSpread still runs when baked true in forge |
| H12 | Process hollowing available with -tags hollow + forge flag |
Medium / UX
| ID | Issue |
|---|---|
| M1 | Full tactical panel in agent list cards (compact mode exists but list still busy) |
| M4 | Forge UI has no toggles for hollowing/mesh/spread (types/defaults only) |
| M6 | Remote UI offline guard partial (compact checks agent.status) |
| M7 | Row click vs button bubbling (compact uses stopPropagation) |
| M9 | Fusion icon needs network for go-winres at forge time |
Low
| ID | Issue |
|---|---|
| L1 | Dead CSS .agent-actions in FleetPanels.css |
| L2 | Duplicate CSS imports on Dashboard/Agents |
| L3 | Weak typing on WS payloads (any) |
| L4 | No integration tests for remote actions |
| L5 | Mesh P2P requires build tag p2p for full libp2p |
Verification
cd server && go test ./... && go build .
cd ..\agent && go test ./... && go build .
cd ..\server\web && npm test && npm run build
run.bat