sync: auto-sync from HOWARD-HOME at 2026-07-20 14:14:18

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-20 14:14:18

session-logs/2026-07/2026-07-20-howard-bug-bounty-sweep.md

@@ -0,0 +1,90 @@
+# Bug Bounty Sweep -- Tracker-Wide Bug Verification and Fixes
+
+## User
+- **User:** Howard Enos (howard)
+- **Machine:** Howard-Home
+- **Role:** tech
+
+## Session Summary
+
+Conducted a full sweep of the Gitea bug tracker across all repos (claudetools, gururmm, guru-connect). The goal was to verify every open bug, fix what could be fixed in-session, close stale/resolved tickets, deduplicate, and reclassify mislabeled issues. Work was tracked under Syncro ticket 114023383 (internal development work).
+
+Round 1 targeted claudetools harness/skill bugs. Fixed 7 bugs: syncro skill jq parse failure (CT#7, replaced jq with grep for comment ID extraction), coord API todo 422 (CT#9, removed UUID truncation in list output), discord-bot attachment save silent failure (CT#4, widened exception catch), vault credential leak to transcript (CT#1, added allowlist-based redaction filter to vault.sh cmd_get), remediation-tool get-token.sh vault_path resolution (CT#2, added repo-local identity.json lookup + graceful fallback chain), remediation-tool reset-password.sh PAA role cleanup (CT#3, added actionable Graph DELETE + Azure Portal remediation instructions), and unifi-wifi Site Manager API 401 (CT#8, verified working key, deprecated stale vault entry). Closed 4 duplicate tickets (CT#5/#14/#16/#18) and marked CT#6 (msp360 licensing) as blocked on vendor.
+
+Round 2 targeted GuruRMM bugs. Closed RMM#79 (NUL byte Postgres crash) and RMM#80 (update scanner non-Windows reject) -- both already fixed in commit 519eef2 but tickets were never closed. Closed RMM#104 (update_rollouts dead table) -- the table was wired up during June promotion work, updated stale doc comment. Fixed RMM#123 (Unix rollback watchdog killed by cgroup) -- changed spawn from setsid to systemd-run --scope with setsid fallback. Removed dead WatchdogEvent WS code path for RMM#119 (agent/transport, server/ws, server/db). Reclassified RMM#105 from bug to feature (Mac agent builds are a stub, not a regression). Fixed CT#17 (unifi-wifi JSON truncation at 5000 chars).
+
+Ran /simplify code review (3 parallel agents: reuse, quality, efficiency). One actionable finding: narrowed the discord-bot exception catch from bare Exception to (HTTPException, OSError). All other findings were cosmetic or false positives. Committed all fixes across 3 repos + vault, pushed to Gitea, posted 4 progress notes to Syncro ticket 114023383.
+
+## Key Decisions
+
+- Used grep pattern instead of jq for Syncro comment ID extraction (CT#7) -- jq is what was broken (control chars in response), grep is the documented fix pattern already in the same file.
+- Chose allowlist-based redaction for vault cmd_get (CT#1) rather than denylist -- denylist misses new sensitive field names; allowlist is conservative by default. Added VAULT_RAW=1 env var escape hatch for deliberate full reads.
+- Used systemd-run --scope for the rollback watchdog (RMM#123) with setsid fallback rather than nohup or daemonize -- systemd-run is the idiomatic way to escape a service cgroup on systemd systems.
+- Deprecated the stale vault entry (infrastructure/unifi-site-manager-api) rather than deleting it -- prevents accidental reuse while preserving audit trail.
+- Narrowed discord-bot exception from Exception to (HTTPException, OSError) after code review -- aiohttp.ClientError is a transitive dependency not directly importable, but HTTPException covers the discord.py network path and OSError covers disk/permissions.
+
+## Problems Encountered
+
+- SOPS encryption of the deprecated vault entry required working from the vault root directory (D:/vault) with the correct .sops.yaml creation rules. Initial attempts from the claudetools repo or with non-.sops.yaml temp filenames failed with "no matching creation rules found". Resolved by copying to a .sops.yaml-named temp file in the vault dir, encrypting in-place, then moving.
+- CWD changed to guru-rmm submodule during git log investigation, causing tracker.py calls to fail (wrong relative path). Resolved by using absolute paths back to C:/claudetools for tracker operations.
+
+## Configuration Changes
+
+### Files Modified
+- `.claude/commands/syncro.md` -- jq -> grep for comment ID extraction (2 locations)
+- `.claude/skills/coord/scripts/coord.py` -- removed UUID truncation in todo list
+- `.claude/skills/remediation-tool/scripts/get-token.sh` -- identity.json multi-location search + vault_path fallback chain
+- `.claude/skills/remediation-tool/scripts/reset-password.sh` -- expanded PAA role cleanup warning block
+- `.claude/skills/unifi-wifi/scripts/gw-sitemanager.sh` -- removed [:5000] JSON truncation
+- `projects/discord-bot/bot/handlers/message_handler.py` -- exception catch narrowing
+- `projects/msp-tools/guru-rmm/agent/src/updater/mod.rs` -- systemd-run --scope watchdog spawn
+- `projects/msp-tools/guru-rmm/agent/src/transport/mod.rs` -- removed WatchdogEvent types
+- `projects/msp-tools/guru-rmm/server/src/ws/mod.rs` -- removed WatchdogEvent handler
+- `projects/msp-tools/guru-rmm/server/src/db/watchdog_events.rs` -- removed insert function
+- `projects/msp-tools/guru-rmm/server/src/db/mod.rs` -- removed watchdog_events re-export
+- `projects/msp-tools/guru-rmm/server/src/db/updates.rs` -- updated stale scaffolding comment
+- `D:/vault/scripts/vault.sh` -- added _redact_get() allowlist filter + VAULT_RAW bypass
+- `D:/vault/infrastructure/unifi-site-manager-api.sops.yaml` -- deprecated stale entry
+
+## Credentials & Secrets
+
+- Stale UniFi Site Manager API key in `infrastructure/unifi-site-manager-api` (returns 401) deprecated and replaced with "REVOKED-use-services-unifi-site-manager". Canonical working key remains at `services/unifi-site-manager`.
+
+## Infrastructure & Servers
+
+- No infrastructure changes.
+
+## Commands & Outputs
+
+- `vault get services/gitea` -- verified allowlist redaction filter works (credentials redacted, metadata visible)
+- `curl -H "X-API-Key: $KEY" https://api.ui.com/ea/sites` -- verified services/unifi-site-manager key returns 200
+- Same call with infrastructure/unifi-site-manager-api key -- confirmed 401 (stale)
+
+## Pending / Incomplete Tasks
+
+- CT#6 (msp360 licensing API) -- blocked on MSP360 enabling licensing API on our account. Not a code fix.
+- GuruRMM submodule commits pushed but not yet build-verified (merge-to-main is the build trigger). The RMM changes (watchdog cgroup fix + dead code removal) should be build-checked before the next deploy.
+- Identity.json resolution pattern in get-token.sh duplicates get-identity.sh -- consolidation opportunity for a future session.
+
+## Reference Information
+
+### Commits
+- claudetools `b33edb6` -- bug bounty session main commit
+- claudetools `3d36b47` -- code review exception narrowing
+- claudetools `b86b0bd` -- sync (current HEAD after rebase)
+- guru-rmm `3897131` -- cgroup watchdog + dead code removal + stale doc
+- discord-bot `bd6009c` -- attachment save fix
+- discord-bot `120dea9` -- exception narrowing per code review
+- vault `ae5a836` -- allowlist filter + deprecated entry
+
+### Tracker Tickets Resolved (19 total)
+- **Fixed (code):** CT#1, CT#2, CT#3, CT#4, CT#7, CT#8, CT#9, CT#17, RMM#119, RMM#123
+- **Closed (already fixed):** RMM#79, RMM#80, RMM#104
+- **Dupes closed:** CT#5, CT#14, CT#16, CT#18
+- **Triaged/reclassified:** CT#6 (blocked), RMM#105 (bug->feature)
+
+### Syncro
+- Ticket 114023383 -- 4 internal progress notes posted (Round 1, Round 2, Commits, Code Review)
+
+### Dashboard
+- tracker.azcomputerguru.com -- live bug tracker dashboard