sync: auto-sync from HOWARD-HOME at 2026-06-21 18:18:26

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-06-21 18:18:26

session-logs/2026-06/2026-06-21-howard-rmm-bug018-eventlogwatch-ui.md

@@ -0,0 +1,114 @@
+## User
+- **User:** Howard Enos (howard)
+- **Machine:** Howard-Home
+- **Role:** tech
+
+## Session Summary
+
+Continuation after the bitdefender live-integration-test session. Three threads:
+(1) finished the `bitdefender` skill to a done/rule-compliant state, (2) implemented the
+assigned GuruRMM bug BUG-018, and (3) built the Event Log Watch management UI gap. All RMM
+work was done in isolated git worktrees and handed to Mike on branches (merge = deploy on
+gururmm), never touching the shared submodule tree that other sessions were actively editing.
+
+Bitdefender finalization: fixed the one real skill-rule violation — `gz.py` was logging EXPECTED
+GravityZone API responses (validation/not-found/not-configured/rate-limit/`raw`/selftest) to
+errorlog.md; added an `_is_expected_error` classifier + `GZ_SUPPRESS_ERRORLOG` so only genuine
+failures log (verified: selftest + probes leave errorlog unchanged). A full param-shape audit caught
+a 6th doc-vs-live bug (`moveCustomGroup` needs `parentId`, not `newParentId`) on top of the 5 from
+the integration test. Converted all non-ASCII (em-dashes, a U+21D2 arrow) in the scripts to ASCII.
+Final: selftest 75/75, 18/18 read commands rc=0 live, parser builds, committed + synced + deployed.
+
+BUG-018 (assigned by Mike via coord): `DELETE /api/agents/:id` reset the connection (HTTP 000)
+because the synchronous FK-cascade delete of an agent's millions of metrics/logs/events rows ran
+inside the request. Per Mike's decision (fast 202 + background purge), reworked the handler to check
+existence up front (404 preserved), disconnect the live agent, spawn a background tokio task for the
+cascade delete (logged), and return 202 Accepted. cargo check + clippy pass (SQLX_OFFLINE); server-only,
+no new SQL/migration (alert_mutes index already in migration 060). Pushed branch fix/bug-018-fast-delete
+(cea87d4); FEATURE_ROADMAP BUG-018 marked FIXED; coord msg to Mike to merge.
+
+Event Log Watch management UI (UI_GAPS): the `eventLogWatchesApi` already existed in client.ts; only
+the UI was missing. Built a standalone `pages/EventLogWatches.tsx` (route /event-log-watches, added to
+FunctionRail + omnibox) that lists/creates/edits/deletes/enable-toggles watch rules for global and
+per-agent scope. Built as a page (not an AgentDetail panel) deliberately to avoid colliding with the
+active session editing AgentDetail/ContextTree/Logs. tsc -b + vite build pass. Pushed branch
+feat/event-log-watch-ui (91ff6cd); UI_GAPS marked DONE; coord msg to Mike to merge (dashboard -> beta).
+
+Also confirmed from Mike's coord messages: Feature 6 (multi-vendor security RMM_THOUGHTS doc) rode
+the BUG-019 merge to gururmm main; BUG-019 built clean on Linux (v0.6.67 beta); Mail.Send is SETTLED
+(365 suite app b43e7342), fabb3421 deleted/do-not-use; packetdial stays PARKED (no NetSapiens key).
+
+## Key Decisions
+
+- All RMM (gururmm submodule) work in ISOLATED WORKTREES off origin/main, handed to Mike on branches.
+  The shared submodule tree on HOWARD-HOME was detached-HEAD + dirty with another session's work
+  (AgentDetail/ContextTree/Logs/agents.rs/ws/mod.rs); editing it would collide. Worktree = clean room.
+- Event Log Watch UI as a standalone PAGE, not an AgentDetail panel, specifically to avoid the active
+  session's dirty AgentDetail.tsx. Per-agent rules reachable via the page's agent-id filter.
+- bitdefender errorlog fix: classify expected API responses + a suppress env flag, rather than logging
+  everything — honors the CLAUDE.md "do not log expected/handled conditions" rule.
+- Did NOT merge either RMM branch to main: merge = build+deploy on gururmm, which is Mike's call
+  (GuruRMM = Mike approval). Branches + coord handoff = the approval path (same as BUG-019).
+
+## Problems Encountered
+
+- gururmm submodule detached-HEAD + dirty with concurrent session work -> isolated worktrees per task.
+- 6th doc-vs-live param bug (moveCustomGroup parentId) -> caught by a deliberate full param-shape audit.
+- npm install in the dashboard worktree drifted package-lock.json -> excluded it from the commit
+  (BUILD.md uses `npm install` not `ci` precisely to tolerate the auto-version-bump skew).
+- coord lock-claim/release + worktree add/remove worked cleanly; shell cwd resets after `git worktree`
+  (used absolute paths / re-cd each call).
+
+## Configuration Changes
+
+bitdefender skill (`.claude/skills/bitdefender/`, committed + synced to claudetools main):
+- `scripts/gz.py` — errorlog classifier (`_is_expected_error`/`_should_log_error`) + GZ_SUPPRESS_ERRORLOG;
+  ASCII-cleaned; delete-package --id.
+- `scripts/gz_client.py` — moveCustomGroup parentId fix; ASCII-cleaned.
+- `scripts/selftest.py` — GZ_SUPPRESS_ERRORLOG in env; arg-shape updates. 75/75.
+- `references/api-reference.md` — moveCustomGroup + prior live-verified shapes.
+
+gururmm submodule (on branches, pushed to gururmm origin — NOT in claudetools):
+- branch `fix/bug-018-fast-delete` (cea87d4): `server/src/api/agents.rs` delete_agent (202+bg), FEATURE_ROADMAP.
+- branch `feat/event-log-watch-ui` (91ff6cd): `dashboard/src/pages/EventLogWatches.tsx` (new), App.tsx,
+  components/FunctionRail.tsx, components/omnibox/providers/NavigationProvider.ts, docs/UI_GAPS.md.
+
+## Credentials & Secrets
+
+- No new credentials. (Prior session's GravityZone key handling already scrubbed; nothing new here.)
+- gururmm-server SSH/DB creds (vault `infrastructure/gururmm-server.sops.yaml`) used only read-side
+  earlier; not touched this session.
+
+## Infrastructure & Servers
+
+- gururmm submodule origin: git.azcomputerguru.com/azcomputerguru/gururmm. origin/main = 572435f.
+  Branches pushed: fix/bug-018-fast-delete, feat/event-log-watch-ui.
+- Merge = build+deploy (per docs/BUILD.md): server auto-rolls-back on bad binary; dashboard lands on
+  beta (rmm-beta.azcomputerguru.com), promoted to prod via /opt/gururmm/promote-dashboard.sh --confirm.
+- coord API 172.16.3.30:8001 used for locks + messages to GURU-5070 (Mike).
+
+## Commands & Outputs
+
+- Worktree pattern: `git -C <submodule> worktree add -b <branch> /c/<path> origin/main` -> work ->
+  `git worktree remove <path> --force`. Shell cwd resets after worktree ops.
+- Server verify: `cd server && SQLX_OFFLINE=true cargo check/clippy` (EXIT 0).
+- Dashboard verify: `cd dashboard && npm install --no-audit --no-fund && npm run build` (tsc -b + vite, dist/index.html).
+- bitdefender errorlog fix verified: selftest + raw probe left errorlog.md at the same line count.
+
+## Pending / Incomplete Tasks
+
+- BUG-018 + Event Log Watch UI: awaiting Mike's merge on their gururmm branches (coord msgs sent:
+  875e6262, 88174f68). Once merged + pointer bumped, parent claudetools picks up the submodule SHA.
+- Event Log Watch: optional AgentDetail-embedded per-agent panel as a follow-up once the active
+  dashboard session's branch lands.
+- BUG-018 follow-ups (optional): bulk-delete endpoint; dashboard optimistic-remove/poll for the 202.
+- packetdial: still PARKED (no NetSapiens key). Entra SSO login UI: clean next UI gap if wanted.
+- Gitea SSH .20:2222 had a transient refusal earlier; flag Mike if it recurs on a real merge.
+
+## Reference Information
+
+- Branches: `fix/bug-018-fast-delete` (cea87d4), `feat/event-log-watch-ui` (91ff6cd) on gururmm origin.
+- bitdefender commits on claudetools main (auto-synced): errorlog/ASCII/moveCustomGroup fixes (603773c + later).
+- docs/BUILD.md (gururmm) = pre-merge verification guide; `gururmm-build` skill wraps it.
+- UI_GAPS.md "Event Log Watch management UI" -> DONE. FEATURE_ROADMAP BUG-018 -> FIXED (on branch).
+- Prior session logs today: 2026-06-21-howard-bitdefender-api-buildout.md, -bitdefender-live-integration-test.md.