From b827e19010c76e11dc42fec1b5f14239ff097745 Mon Sep 17 00:00:00 2001 From: Howard Enos Date: Mon, 20 Jul 2026 14:14:48 -0700 Subject: [PATCH] sync: auto-sync from HOWARD-HOME at 2026-07-20 14:14:18 Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-07-20 14:14:18 --- .../2026-07-20-howard-bug-bounty-sweep.md | 90 +++++++++++++++++++ 1 file changed, 90 insertions(+) create mode 100644 session-logs/2026-07/2026-07-20-howard-bug-bounty-sweep.md diff --git a/session-logs/2026-07/2026-07-20-howard-bug-bounty-sweep.md b/session-logs/2026-07/2026-07-20-howard-bug-bounty-sweep.md new file mode 100644 index 00000000..c4b5f6b4 --- /dev/null +++ b/session-logs/2026-07/2026-07-20-howard-bug-bounty-sweep.md @@ -0,0 +1,90 @@ +# Bug Bounty Sweep -- Tracker-Wide Bug Verification and Fixes + +## User +- **User:** Howard Enos (howard) +- **Machine:** Howard-Home +- **Role:** tech + +## Session Summary + +Conducted a full sweep of the Gitea bug tracker across all repos (claudetools, gururmm, guru-connect). The goal was to verify every open bug, fix what could be fixed in-session, close stale/resolved tickets, deduplicate, and reclassify mislabeled issues. Work was tracked under Syncro ticket 114023383 (internal development work). + +Round 1 targeted claudetools harness/skill bugs. Fixed 7 bugs: syncro skill jq parse failure (CT#7, replaced jq with grep for comment ID extraction), coord API todo 422 (CT#9, removed UUID truncation in list output), discord-bot attachment save silent failure (CT#4, widened exception catch), vault credential leak to transcript (CT#1, added allowlist-based redaction filter to vault.sh cmd_get), remediation-tool get-token.sh vault_path resolution (CT#2, added repo-local identity.json lookup + graceful fallback chain), remediation-tool reset-password.sh PAA role cleanup (CT#3, added actionable Graph DELETE + Azure Portal remediation instructions), and unifi-wifi Site Manager API 401 (CT#8, verified working key, deprecated stale vault entry). Closed 4 duplicate tickets (CT#5/#14/#16/#18) and marked CT#6 (msp360 licensing) as blocked on vendor. + +Round 2 targeted GuruRMM bugs. Closed RMM#79 (NUL byte Postgres crash) and RMM#80 (update scanner non-Windows reject) -- both already fixed in commit 519eef2 but tickets were never closed. Closed RMM#104 (update_rollouts dead table) -- the table was wired up during June promotion work, updated stale doc comment. Fixed RMM#123 (Unix rollback watchdog killed by cgroup) -- changed spawn from setsid to systemd-run --scope with setsid fallback. Removed dead WatchdogEvent WS code path for RMM#119 (agent/transport, server/ws, server/db). Reclassified RMM#105 from bug to feature (Mac agent builds are a stub, not a regression). Fixed CT#17 (unifi-wifi JSON truncation at 5000 chars). + +Ran /simplify code review (3 parallel agents: reuse, quality, efficiency). One actionable finding: narrowed the discord-bot exception catch from bare Exception to (HTTPException, OSError). All other findings were cosmetic or false positives. Committed all fixes across 3 repos + vault, pushed to Gitea, posted 4 progress notes to Syncro ticket 114023383. + +## Key Decisions + +- Used grep pattern instead of jq for Syncro comment ID extraction (CT#7) -- jq is what was broken (control chars in response), grep is the documented fix pattern already in the same file. +- Chose allowlist-based redaction for vault cmd_get (CT#1) rather than denylist -- denylist misses new sensitive field names; allowlist is conservative by default. Added VAULT_RAW=1 env var escape hatch for deliberate full reads. +- Used systemd-run --scope for the rollback watchdog (RMM#123) with setsid fallback rather than nohup or daemonize -- systemd-run is the idiomatic way to escape a service cgroup on systemd systems. +- Deprecated the stale vault entry (infrastructure/unifi-site-manager-api) rather than deleting it -- prevents accidental reuse while preserving audit trail. +- Narrowed discord-bot exception from Exception to (HTTPException, OSError) after code review -- aiohttp.ClientError is a transitive dependency not directly importable, but HTTPException covers the discord.py network path and OSError covers disk/permissions. + +## Problems Encountered + +- SOPS encryption of the deprecated vault entry required working from the vault root directory (D:/vault) with the correct .sops.yaml creation rules. Initial attempts from the claudetools repo or with non-.sops.yaml temp filenames failed with "no matching creation rules found". Resolved by copying to a .sops.yaml-named temp file in the vault dir, encrypting in-place, then moving. +- CWD changed to guru-rmm submodule during git log investigation, causing tracker.py calls to fail (wrong relative path). Resolved by using absolute paths back to C:/claudetools for tracker operations. + +## Configuration Changes + +### Files Modified +- `.claude/commands/syncro.md` -- jq -> grep for comment ID extraction (2 locations) +- `.claude/skills/coord/scripts/coord.py` -- removed UUID truncation in todo list +- `.claude/skills/remediation-tool/scripts/get-token.sh` -- identity.json multi-location search + vault_path fallback chain +- `.claude/skills/remediation-tool/scripts/reset-password.sh` -- expanded PAA role cleanup warning block +- `.claude/skills/unifi-wifi/scripts/gw-sitemanager.sh` -- removed [:5000] JSON truncation +- `projects/discord-bot/bot/handlers/message_handler.py` -- exception catch narrowing +- `projects/msp-tools/guru-rmm/agent/src/updater/mod.rs` -- systemd-run --scope watchdog spawn +- `projects/msp-tools/guru-rmm/agent/src/transport/mod.rs` -- removed WatchdogEvent types +- `projects/msp-tools/guru-rmm/server/src/ws/mod.rs` -- removed WatchdogEvent handler +- `projects/msp-tools/guru-rmm/server/src/db/watchdog_events.rs` -- removed insert function +- `projects/msp-tools/guru-rmm/server/src/db/mod.rs` -- removed watchdog_events re-export +- `projects/msp-tools/guru-rmm/server/src/db/updates.rs` -- updated stale scaffolding comment +- `D:/vault/scripts/vault.sh` -- added _redact_get() allowlist filter + VAULT_RAW bypass +- `D:/vault/infrastructure/unifi-site-manager-api.sops.yaml` -- deprecated stale entry + +## Credentials & Secrets + +- Stale UniFi Site Manager API key in `infrastructure/unifi-site-manager-api` (returns 401) deprecated and replaced with "REVOKED-use-services-unifi-site-manager". Canonical working key remains at `services/unifi-site-manager`. + +## Infrastructure & Servers + +- No infrastructure changes. + +## Commands & Outputs + +- `vault get services/gitea` -- verified allowlist redaction filter works (credentials redacted, metadata visible) +- `curl -H "X-API-Key: $KEY" https://api.ui.com/ea/sites` -- verified services/unifi-site-manager key returns 200 +- Same call with infrastructure/unifi-site-manager-api key -- confirmed 401 (stale) + +## Pending / Incomplete Tasks + +- CT#6 (msp360 licensing API) -- blocked on MSP360 enabling licensing API on our account. Not a code fix. +- GuruRMM submodule commits pushed but not yet build-verified (merge-to-main is the build trigger). The RMM changes (watchdog cgroup fix + dead code removal) should be build-checked before the next deploy. +- Identity.json resolution pattern in get-token.sh duplicates get-identity.sh -- consolidation opportunity for a future session. + +## Reference Information + +### Commits +- claudetools `b33edb6` -- bug bounty session main commit +- claudetools `3d36b47` -- code review exception narrowing +- claudetools `b86b0bd` -- sync (current HEAD after rebase) +- guru-rmm `3897131` -- cgroup watchdog + dead code removal + stale doc +- discord-bot `bd6009c` -- attachment save fix +- discord-bot `120dea9` -- exception narrowing per code review +- vault `ae5a836` -- allowlist filter + deprecated entry + +### Tracker Tickets Resolved (19 total) +- **Fixed (code):** CT#1, CT#2, CT#3, CT#4, CT#7, CT#8, CT#9, CT#17, RMM#119, RMM#123 +- **Closed (already fixed):** RMM#79, RMM#80, RMM#104 +- **Dupes closed:** CT#5, CT#14, CT#16, CT#18 +- **Triaged/reclassified:** CT#6 (blocked), RMM#105 (bug->feature) + +### Syncro +- Ticket 114023383 -- 4 internal progress notes posted (Round 1, Round 2, Commits, Code Review) + +### Dashboard +- tracker.azcomputerguru.com -- live bug tracker dashboard