sync: auto-sync from HOWARD-HOME at 2026-07-07 20:31:16

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-07 20:31:16

.claude/skills/ask-forum/SKILL.md

@@ -77,8 +77,25 @@ replies — then you surface the answer to the user **unprompted**. See
   the bot explicitly allowed; Mike sees it as owner. To let someone else answer, they need
   **View Channel** on #ct-forum (grant a role like Techs, or the person). Winter/Rob are not
   in by default.
-- **Deleting threads** needs the bot to have **Manage Threads** on #ct-forum (owner grants
-  it). Without it, `DELETE /channels/<thread>` returns 403.
+
+### Bot capability map — the limit of control (tested 2026-07-08)
+What the bot can do in #ct-forum with its current permissions, and where the wall is:
+
+| Bot CAN (no grant needed) | Bot CANNOT (needs a permission grant) |
+|---|---|
+| Read messages / thread / members / guild channels | **Pin** a message → 403 (needs *Manage Messages*) |
+| Create a forum post (thread), post follow-up messages | **Delete** a thread → 403 (needs *Manage Threads*) |
+| Edit its OWN messages; add/remove reactions; typing | **Archive** a thread → 403 (needs *Manage Threads*) |
+| Rename / lock a thread it owns (see trap below) | **Unlock** a thread once locked → 403 (needs *Manage Threads*) |
+
+- **One-way trap:** as thread owner the bot can *lock* a thread (200) but then **cannot
+  unlock or rename it** (403) — locking without *Manage Threads* is irreversible. So the
+  skill does NOT lock/rename threads; treat thread lifecycle as off-limits until granted.
+- **To enable cleanup:** owner grants the ClaudeTools bot **Manage Threads** on #ct-forum
+  (Edit Channel → Permissions → bot → Manage Threads → Allow). Then delete/archive/unlock
+  work. **Manage Messages** additionally enables pin.
+- Reactions + own-message edits DO work with no grant — usable for lightweight
+  acknowledgement (react to a reply, or edit the question to "[answered]") if ever wanted.
 
 ## Exit codes
 `0` answered · `1` usage · `2` no token · `3` Discord API error · `4` timeout (thread stays

.claude/skills/datto-edr/SKILL.md

@@ -130,6 +130,16 @@ erroring `a value is required for '--url'`. Push via **GuruRMM** (`/rmm`) or any
 remote-exec channel. `RegKey` auto-approves + adds to the key's target group; without
 it the agent registers but awaits manual approval.
 
+**Offline endpoint whose GuruRMM agent is down but ScreenConnect is up:** the one-liner
+is a single self-contained command, so queue it via the `screenconnect` skill's
+`send-command --session <id> --command "powershell -NoProfile -ExecutionPolicy Bypass
+-Command \"...Install-EDR...\"" --confirm` — SC holds it in the session's one command slot
+and runs it on reconnect (verify by `agents --org` / `sweep` afterward; SC returns no
+output). Used 2026-07-08 to stage REPAIRADMIN (IMC) while it was offline overnight.
+**AV-swap ordering:** when replacing another AV (e.g. Bitdefender), install + verify EDR
+live FIRST, then remove the old AV — never leave an unprotected window. Note Bitdefender's
+API has NO uninstall (console-only); pull it via its local uninstall tool over `/rmm`.
+
 ## Safety gating
 
 - Reads never mutate and run without confirmation.

.claude/skills/screenconnect/SKILL.md

@@ -58,6 +58,37 @@ This is the headline use case - set a device for SC and have it land correctly:
 VERIFIED end-to-end on RMM-TEST-MACHINE 2026-06-22 (installed, self-tagged
 Company/Site/Tag, ran a command, re-tagged via set-properties).
 
+### Deploying the GuruRMM agent via SC (verified 2026-07-08)
+
+Different from the SC-installer push above: to enroll a box that is in SC but NOT in GuruRMM,
+`send-command` the server's own site-preconfigured one-liner. The site code is baked into the
+downloaded signed binary (GRMM_CFG trailer) so it self-enrolls straight into that site — no
+Staging, no reassign:
+
+```bash
+# site_code from GET /api/sites/<id>/install-info (e.g. Main = INNER-BRIDGE-8354)
+CMD='powershell -NoProfile -ExecutionPolicy Bypass -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12; iex (irm '\''https://rmm.azcomputerguru.com/install/<SITE_CODE>/windows'\'')"'
+$SC send-command --session <sessionID> --command "$CMD" --confirm
+```
+
+The install script auto-relaunches into native 64-bit PowerShell (handles SC's 32-bit command
+runner via Sysnative). Verified: DESKTOP-NFU17AJ enrolled into IMC → Main this way 2026-07-08.
+
+- **`send-command` returns `{}`** — SC gives no command output via the API (documented below).
+  It is queued, not confirmed. **Verify by enrollment**, not by the send response: poll
+  `rmm-search.sh -c <client>` for the new agent (pipe `--json` with `2>/dev/null` — the `[OK]
+  Authenticated` banner is on stderr; `2>&1 | jq` breaks jq).
+- **Offline targets:** the one-liner is a single self-contained command, so it queues in the
+  session's one event slot and runs on reconnect. It will NOT run until the box is online.
+- **Gotcha:** the install script calls `Get-CimInstance Win32_Processor`; a box with corrupt
+  WMI dies there (bit CP-QB). A box that black-holes outbound TLS installs but never connects
+  (bit IMC-PRINTSERVER) — SC still works because its relay is not TLS.
+- **CP values are under `.CustomProperties.CustomPropertyN` / `.CustomPropertyValues[]`** on the
+  raw session object (CP1=Company, CP2=Site, ...). `--company "X"` matches CP1 **exactly**, so
+  pass the full tagged value (IMC's CP1 is `IMC - Instrumental Music Center`, not `Instrumental
+  Music Center`) or enumerate with `--like` / a raw `CustomProperty1 = '...'` filter first.
+  SC truncates session Name to 15 chars — `IMC-M-EDSERVICE` (SC) is `IMC-M-EdServices1` (RMM).
+
 ## Method surface (probed live 2026-06-22)
 
 **Available (CLI-exposed):**