sync: auto-sync from GURU-5070 at 2026-07-20 20:12:47

Author: Mike Swanson
Machine: GURU-5070
Timestamp: 2026-07-20 20:12:47

.claude/skills/remediation-tool/scripts/get-token.sh

@@ -191,7 +191,12 @@ trap 'rm -f "$PLAINTEXT_FILE"' EXIT
 # If that fails (e.g. PyYAML missing on this host), do a raw sops decrypt.
 SOPS_OK=0
 if [[ -f "$VAULT_ROOT/scripts/vault.sh" ]]; then
-  if bash "$VAULT_ROOT/scripts/vault.sh" get "$VAULT_PATH" > "$PLAINTEXT_FILE" 2>/dev/null && [[ -s "$PLAINTEXT_FILE" ]]; then
+  # vault.sh `get` redacts sensitive values (2026-07-20 hardening, _redact_get) — its
+  # output is unusable for cert/secret material (cert_private_key_pem_b64 comes back as
+  # "[REDACTED]", breaking cert-JWT signing). Only accept it when NOT redacted; otherwise
+  # fall through to the raw `sops -d` path below, which returns the real values.
+  if bash "$VAULT_ROOT/scripts/vault.sh" get "$VAULT_PATH" > "$PLAINTEXT_FILE" 2>/dev/null \
+     && [[ -s "$PLAINTEXT_FILE" ]] && ! grep -q '\[REDACTED' "$PLAINTEXT_FILE"; then
     SOPS_OK=1
   fi
 fi

errorlog.md

@@ -32,6 +32,13 @@ Categories (the `[type]` tag): _(none)_ = skill/command execution failure ·
 2026-07-20 | Howard-Home | gururmm-agent | installer fails on Server 2008 SP2 (6.0.6002) -- api-ms-win-core-synch-l1-2-0.dll missing. UCRT/VC++ redist also fails (VersionNT64 condition false -- likely 32-bit OS). No legacy build exists yet (gururmm#88). [ctx: host=LAB-SERVER client=lens-auto os=server2008sp2]
 
 2026-07-20 | Howard-Home | remediation-tool | get-token: token request failed (no access_token) [ctx: tenant=207fa277-e9d8-4eb7-ada1-1064d2221498 tier=investigator auth=secret err=7000215]
+2026-07-21 | GURU-5070 | cloudlinux/cagefs | [correction] After moving the MySQL datadir (or changing its socket) on a CloudLinux CageFS server, you MUST run 'cagefsctl --remount-all' — otherwise caged web users get 'mysqli_connect(): (HY000/2002): No such file or directory' even though root + the raw socket are fine (root isn't jailed, so root-shell php connects but the sites don't). This was the REAL cause of the IX site outages during the MySQL SSD datadir move; missing it sent me down a phantom auth rabbit hole. [ctx: host=ix ref=ix-mysql-ssd-move-postmortem]
+
+2026-07-21 | GURU-5070 | grok | grok returned no text [ctx: mode=text stopReason=] (x2)
+
+2026-07-21 | GURU-5070 | bash/mysql-testing | [friction] Wasted a LONG production incident chasing a phantom 'grant management broken' MariaDB bug (blamed the datadir move, Aria corruption, auth_socket, governor) — root cause was MY test method: /root/.my.cnf has a password, which OVERRIDES MYSQL_PWD env, so 'MYSQL_PWD=x mysql -u testuser' silently sent ROOT's password with the test username -> always Access denied. ALWAYS use 'mysql --no-defaults -u USER -pPASS' (or an explicit --defaults-file) when testing a NON-root user's auth. Caused multiple unnecessary prod restarts + a datadir rollback. [ctx: host=ix ref=my.cnf-overrides-MYSQL_PWD]
+
+2026-07-20 | GURU-5070 | remediation-tool/vault | vault.sh update (HOWARD-HOME 2026-07-20 ae5a836) redacts cert_private_key_pem_b64 at READ time -> get-token cert-JWT signing fails ('did not decode to valid PEM', MalformedFraming), breaking ALL remediation-tool M365 tenant access fleet-wide. Encrypted data intact (raw sops = real 2312-char key). Over-redaction hit the programmatic get path, not just display. [ctx: ref=vault_redaction_leak_fix commit=ae5a836]
 
 2026-07-20 | Howard-Home | rmm | [correction] Misidentified Datto AV kernel drivers (rtp1/rtp2/rtp_elam/BdNet/BdSentry/netprotection_network_filter*) as orphan Avira/Bitdefender leftovers. Datto AV uses the Bitdefender Endpoint Protection SDK under the hood, so these drivers are signed by Avira Operations GmbH but belong to Datto AV. Disabled and deleted them, breaking Datto AV. Had to restore from the SDK backup dir. Always check C:Program Filesinfocytegentdattoav before assuming BD/Avira drivers are orphans. [ctx: ref=maintenance-pc-cascades machine=MAINTENANCE-PC]