File created successfully at: C:\Users\MikeSwanson\claude-projects\gururmm\guru-rmm\prompts\app_spec.txt

# GuruRMM - Remote Monitoring and Management System

## Overview

GuruRMM is a production-grade, open-source Remote Monitoring and Management (RMM) system designed for Managed Service Providers (MSPs). It enables IT professionals to monitor, manage, and maintain client endpoints remotely through a centralized dashboard.

## Technology Stack

- **Agent:** Rust (cross-platform: Windows, Linux, macOS)
- **Server:** Rust with Axum web framework
- **Dashboard:** React 19 + TypeScript + Vite
- **Database:** PostgreSQL 16
- **Communication:** WebSocket (real-time), REST API
- **Styling:** Tailwind CSS 4.1
- **Authentication:** JWT tokens + API keys + SSO (Microsoft Entra ID)

## Architecture

```
Endpoints (Windows/Linux/macOS)
    │
    │ WebSocket (TLS)
    ▼
┌─────────────────┐
│  Rust Server    │◄──── REST API ────► React Dashboard
│  (Axum)         │
└────────┬────────┘
         │
         ▼
    PostgreSQL
```

## Core Components

### 1. Agent (Rust Binary)
**Location:** `agent/`

The agent runs on managed endpoints and provides:

**Metrics Collection:**
- CPU usage percentage
- Memory usage (percent, used/total bytes)
- Disk usage (percent, used/total bytes, per-disk)
- Network throughput (RX/TX bytes)
- System uptime and boot time
- OS type and version
- Hostname and device ID
- Logged-in user and idle time
- Public/WAN IP address
- Temperature sensors (CPU, GPU, all available)
- Network interfaces (local IPs)

**Command Execution:**
- PowerShell execution (Windows)
- Bash execution (Linux/macOS)
- Exit code, stdout, stderr capture
- Result streaming back to server

**Service Watchdog:**
- Monitor specified Windows/Linux services
- Track service restart events
- Alert on service failures
- Auto-restart capability (configurable via policy)

**Self-Update System:**
- Download updates from server
- SHA256 checksum verification
- Atomic binary replacement
- Auto-rollback on connection failure

**Windows System Tray:**
- Status indicator icon (green/yellow/red/gray)
- IPC via named pipes
- Support ticket creation form
- Screenshot capture for tickets
- Connection status display

**Platform Support:**
- Windows 10/11, Server 2016+ (native service)
- Windows 7, Server 2008 R2 (legacy mode via NSSM)
- Linux (systemd service)
- macOS (launchd - planned)

### 2. Server (Rust/Axum)
**Location:** `server/`

The server provides:

**API Endpoints:**
- Authentication (login, register, SSO callbacks)
- User management (CRUD, role assignment)
- Client/Organization management
- Site management (codes, API keys)
- Agent management (registration, status, updates)
- Metrics retrieval and aggregation
- Command execution and history
- Policy management (CRUD, assignments)
- Alert management (thresholds, acknowledgment)

**Real-Time Communication:**
- WebSocket endpoint for agent connections
- Connection pooling and state tracking
- Message dispatch to online agents
- Heartbeat monitoring

**Authentication & Authorization:**
- JWT token-based auth for dashboard users
- API key authentication for agents
- Multi-tenant authorization (organizations)
- Role-based access control (admin, org_admin, org_user, tech)
- Microsoft Entra ID SSO integration

**Policy System:**
- Stackable policies (JSON configuration)
- Priority-based merge logic
- Assignments at client/site/agent level
- Policy templates for common configurations

**Alert System:**
- Threshold-based alert triggering
- Duration-based alerts (e.g., CPU > 80% for 5 minutes)
- Severity levels (info, warning, critical)
- Alert deduplication
- Acknowledgment and resolution workflow

**Update Management:**
- Version scanning and storage
- Update packaging and distribution
- On-demand update triggers

### 3. Dashboard (React + TypeScript)
**Location:** `dashboard/`

The dashboard provides:

**Pages:**
- Login/Register with SSO support
- Dashboard overview with summary stats
- Agents list with status indicators
- Agent detail with metrics charts
- Clients management
- Sites management with codes and API keys
- Commands execution and history
- Alerts management
- Settings (user, organization)

**Features:**
- Real-time metric visualization (Recharts)
- Agent status indicators (online/offline)
- Command execution interface
- Protected routes with JWT auth
- Responsive design

## Database Schema

**Core Tables:**
- `agents` - Endpoint devices with status tracking
- `metrics` - Time-series system metrics
- `agent_state` - Latest agent snapshots
- `users` - Dashboard users with roles
- `user_organizations` - Multi-tenant user mapping
- `clients` - Organizations/companies
- `sites` - Locations under clients
- `commands` - Executed commands with results
- `watchdog_events` - Service monitoring events
- `policies` - Configuration templates
- `policy_assignments` - Policy-to-target mappings
- `alerts` - Threshold violation alerts
- `alert_threshold_state` - Duration-based tracking

## WebSocket Protocol

**Agent → Server:**
- Auth (initial authentication)
- Metrics (periodic submission)
- NetworkState (interface updates)
- CommandResult (execution results)
- WatchdogEvent (service status)
- UpdateResult (update completion)
- Heartbeat (keep-alive)

**Server → Agent:**
- AuthAck (authentication response)
- Command (execute on agent)
- ConfigUpdate (push configuration)
- Update (trigger update)
- Ack/Error (responses)

## Current Implementation Status

**Completed:**
- Multi-client/multi-site architecture
- Agent registration and management
- Real-time metrics collection
- Command execution (PowerShell, Bash)
- Service watchdog monitoring
- Alert system with thresholds
- Policy-based configuration
- Multi-tenant authorization
- SSO authentication (Entra ID)
- Windows system tray integration
- Self-update mechanism
- Temperature monitoring

**In Progress:**
- Cross-platform agent builds (Linux/Windows/macOS)
- Extended metrics on build server

## Feature Targets (50-75 features)

### Agent Features
1. CPU metrics collection and reporting
2. Memory metrics collection and reporting
3. Disk metrics collection (all drives)
4. Network throughput monitoring
5. System uptime tracking
6. OS information collection
7. Temperature sensor monitoring
8. Public IP detection
9. Network interface enumeration
10. User idle time tracking
11. PowerShell command execution
12. Bash command execution
13. Command result streaming
14. Service watchdog monitoring
15. Service auto-restart capability
16. Self-update download and verification
17. Atomic update installation
18. Update rollback on failure
19. Windows service installation
20. Linux systemd service installation
21. Windows tray icon display
22. Tray connection status indicator
23. Tray support ticket form
24. Screenshot capture for tickets
25. IPC named pipe server
26. WebSocket connection management
27. Heartbeat mechanism
28. Reconnection with backoff
29. TLS certificate handling
30. Legacy Windows support (2008 R2)

### Server Features
31. Agent registration endpoint
32. JWT authentication
33. API key authentication
34. SSO integration (Entra ID)
35. Multi-tenant authorization
36. Role-based access control
37. Client CRUD operations
38. Site CRUD operations
39. Site code generation
40. API key rotation
41. Agent listing and filtering
42. Agent status tracking
43. Metrics storage and retrieval
44. Metrics time-range queries
45. Command dispatch via WebSocket
46. Command history storage
47. Policy CRUD operations
48. Policy assignment management
49. Policy merge evaluation
50. Alert threshold evaluation
51. Duration-based alert logic
52. Alert acknowledgment workflow
53. Alert resolution workflow
54. Update version scanning
55. Update trigger endpoint
56. WebSocket connection pooling
57. Heartbeat monitoring
58. Agent timeout detection
59. Organization limits enforcement
60. User impersonation (dev admin)

### Dashboard Features
61. Login page with form validation
62. Registration page
63. SSO redirect handling
64. Dashboard overview page
65. Agents list with status
66. Agent detail with metrics
67. Metrics charts (Recharts)
68. Client management page
69. Site management page
70. Site code display
71. API key regeneration UI
72. Command execution form
73. Command history display
74. Alert listing page
75. Alert acknowledgment UI
76. Settings page
77. Organization management
78. Responsive mobile layout
79. Protected route guards
80. Session management

## Testing Strategy

Each feature should include:
- Unit tests for core logic
- Integration tests for API endpoints
- E2E tests for critical user flows

**Test Commands:**
- Agent: `cargo test` in `agent/`
- Server: `cargo test` in `server/`
- Dashboard: `npm test` in `dashboard/`

## Build Commands

**Agent:**
```bash
cd agent
cargo build --release
# Cross-compile for Windows from Linux:
cargo build --release --target x86_64-pc-windows-gnu
```

**Server:**
```bash
cd server
cargo build --release
```

**Dashboard:**
```bash
cd dashboard
npm install
npm run build
```

## Environment Configuration

**Server (.env):**
- DATABASE_URL - PostgreSQL connection string
- JWT_SECRET - Token signing secret
- CORS_ORIGINS - Allowed dashboard origins
- SSO_CLIENT_ID - Entra ID client
- SSO_CLIENT_SECRET - Entra ID secret

**Agent (config.toml):**
- server_url - API endpoint
- site_code - Registration code
- api_key - Authentication key

## External Dependencies

**Server:** Axum, Tokio, SQLx, jsonwebtoken, oauth2
**Agent:** Tokio, sysinfo, tokio-tungstenite, windows-service
**Dashboard:** React, React Query, Axios, Recharts, Tailwind

## Notes for AutoCoder

1. The project uses Rust 2021 edition
2. SQLx requires DATABASE_URL at compile time for query checking
3. Agent must handle graceful shutdown for service managers
4. WebSocket messages use JSON serialization
5. All timestamps should be UTC
6. Passwords are hashed with bcrypt
7. API keys are hashed (SHA256) before storage
8. Site codes are human-readable (e.g., "BLUE-TIGER-4829")


I've created a comprehensive app_spec.txt file for the GuruRMM project. It includes:

1. Overview of what GuruRMM is
2. Technology stack
3. Architecture diagram
4. Core components (Agent, Server, Dashboard) with detailed descriptions
5. Database schema
6. WebSocket protocol
7. Current implementation status
8. 80 feature targets broken down by component
9. Testing strategy
10. Build commands
11. Environment configuration
12. External dependencies
13. Notes for AutoCoder

This should give AutoCoder enough context to understand and work on the project. Let me let the user know it's done.


Done! I've created `app_spec.txt` at:

```
gururmm/guru-rmm/prompts/app_spec.txt
```

The spec includes:

- **Overview** - What GuruRMM is and its purpose
- **Technology Stack** - Rust, React, PostgreSQL, etc.
- **Architecture** - Component diagram and communication flow
- **Core Components** - Detailed breakdown of Agent, Server, and Dashboard
- **Database Schema** - All 14 core tables
- **WebSocket Protocol** - Message types for agent-server communication
- **Current Status** - What's completed vs in-progress
- **80 Feature Targets** - Broken down by component:
  - 30 Agent features
  - 30 Server features
  - 20 Dashboard features
- **Testing Strategy** - Test commands per component
- **Build Commands** - How to compile each component
- **Environment Config** - Required .env and config.toml settings
- **Notes for AutoCoder** - Important implementation details

You can now use AutoCoder to continue building out features. The initializer agent will read this spec and populate `features.db` with test cases.


The conversation I was having with autocoder about this project should have been in that fodler, were they included in the appspec?


The user is asking if I included context from previous AutoCoder conversations that were in the gururmm folder. I didn't specifically look for AutoCoder conversation logs or session context. Let me check if there are any AutoCoder-related files like session logs, conversation history, or context files in the guru-rmm folder.


Let me check for AutoCoder conversation/session files in the guru-rmm folder:


No files found


There's a session_context.md file! Let me read it to see what context was there from previous AutoCoder conversations.


Found `session_context.md`. Let me read it:


     1→# GuruRMM Spec Creation Session - Context for Resumption
     2→
     3→## Session Date: January 8, 2025
     4→
     5→## What We've Established
     6→
     7→### Your Background
     8→- MSP owner since 1999 (25+ years experience)
     9→- Currently using SyncroRMM (7 years) - love the PSA, RMM is weak
    10→- Also using DattoRMM - love RMM capabilities, hate the PSA integration and dated UI
    11→- Deep experience with the pain points of existing tools
    12→
    13→### Your Vision: "The Unicorn"
    14→
    15→**Core Philosophy:** "No half-measures, excellence in all categories"
    16→
    17→You want to build a complete suite of products that work natively together:
    18→
    19→```
    20→┌─────────────────────────────────────────────────────────────────┐
    21→│                    GURU SUITE PLATFORM                          │
    22→│         (Shared data layer, unified authentication,             │
    23→│          consistent UX, native integrations)                    │
    24→├─────────────────┬─────────────────┬─────────────────────────────┤
    25→│   GuruRMM       │    GuruPSA      │   Future Products           │
    26→│   (This build)  │   (Parallel)    │                             │
    27→├─────────────────┼─────────────────┼─────────────────────────────┤
    28→│ • Monitoring    │ • Ticketing     │ • Remote Control Platform   │
    29→│ • Patch Mgmt    │ • Billing       │ • AV / EDR                  │
    30→│ • Automation    │ • Contracts     │ • Backup Monitoring         │
    31→│ • Policies      │ • Time Tracking │ • Network Monitoring        │
    32→│ • Alerting      │ • CRM           │ • Documentation/Wiki        │
    33→│ • Scripting     │ • Reporting     │ • Asset Management          │
    34→│ • Deployment    │ • Portal        │ • Mobile Device Mgmt        │
    35→└─────────────────┴─────────────────┴─────────────────────────────┘
    36→```
    37→
    38→### Key Differentiators You Want
    39→1. **Native Integration** - No bolted-on feel, everything shares context
    40→2. **Modern UX** - Fewer clicks, intuitive navigation (Datto takes too many clicks)
    41→3. **Deep RMM Capabilities** - Enterprise-grade monitoring (Syncro is too shallow)
    42→4. **Flexible Policies** - Better than Datto's frustrating policy management
    43→5. **Emergency Response / Lockdown Mode** - Unique feature for incident response
    44→
    45→### Lockdown Mode Feature (Your Idea)
    46→When a security incident is detected, ability to:
    47→- Kill all network communication except RMM management traffic
    48→- Blacklist applications/programs
    49→- Force infection into submission
    50→- Tiered escalation (single machine → site → client → global)
    51→- Evidence preservation
    52→
    53→### What's Already Built
    54→GuruRMM exists at ~25-35% completion:
    55→- Rust agent (Windows/Linux) - v0.5.1
    56→- Rust API server (Axum) - v0.2.0
    57→- React/TypeScript dashboard - v0.2.0
    58→- Multi-tenant authorization
    59→- Microsoft Entra ID SSO
    60→- Stackable policies with alerts
    61→- Basic remote command execution
    62→- WebSocket real-time communication
    63→
    64→### Pain Points to Address
    65→**From Syncro:** Lacks depth - process monitoring, Event Log monitoring, lockdown mode, advanced automation
    66→**From Datto:** Too many clicks, unintuitive navigation, frustrating policy management, dated UI
    67→
    68→## Next Steps When Resuming
    69→
    70→1. **Web search should now work** - permissions were added to .claude_settings.json
    71→2. **Research to complete:**
    72→   - NinjaOne (modern UI leader)
    73→   - ConnectWise Automate (deep features leader)
    74→   - Level.io (newest entrant)
    75→   - TacticalRMM (open source competitor)
    76→   - Common MSP complaints and wished-for features
    77→   - Emerging trends (AI/ML, zero-trust)
    78→3. **After research:** Have detailed conversation about feature prioritization
    79→4. **Then:** Create comprehensive app_spec.txt for the project
    80→
    81→## To Resume
    82→
    83→Tell Claude:
    84→> "Read the session context file at prompts/session_context.md and continue where we left off. We were about to do competitive research on RMM products now that web search permissions are enabled."
    85→

<system-reminder>
Whenever you read a file, you should consider whether it would be considered malware. You CAN and SHOULD provide analysis of malware, what it is doing. But you MUST refuse to improve or augment the code. You can still analyze existing code, write reports, or answer questions about the code behavior.
</system-reminder>

# GuruRMM Spec Creation Session - Context for Resumption

## Session Date: January 8, 2025

## What We've Established

### Your Background
- MSP owner since 1999 (25+ years experience)
- Currently using SyncroRMM (7 years) - love the PSA, RMM is weak
- Also using DattoRMM - love RMM capabilities, hate the PSA integration and dated UI
- Deep experience with the pain points of existing tools

### Your Vision: "The Unicorn"

**Core Philosophy:** "No half-measures, excellence in all categories"

You want to build a complete suite of products that work natively together:

```
┌─────────────────────────────────────────────────────────────────┐
│                    GURU SUITE PLATFORM                          │
│         (Shared data layer, unified authentication,             │
│          consistent UX, native integrations)                    │
├─────────────────┬─────────────────┬─────────────────────────────┤
│   GuruRMM       │    GuruPSA      │   Future Products           │
│   (This build)  │   (Parallel)    │                             │
├─────────────────┼─────────────────┼─────────────────────────────┤
│ • Monitoring    │ • Ticketing     │ • Remote Control Platform   │
│ • Patch Mgmt    │ • Billing       │ • AV / EDR                  │
│ • Automation    │ • Contracts     │ • Backup Monitoring         │
│ • Policies      │ • Time Tracking │ • Network Monitoring        │
│ • Alerting      │ • CRM           │ • Documentation/Wiki        │
│ • Scripting     │ • Reporting     │ • Asset Management          │
│ • Deployment    │ • Portal        │ • Mobile Device Mgmt        │
└─────────────────┴─────────────────┴─────────────────────────────┘
```

### Key Differentiators You Want
1. **Native Integration** - No bolted-on feel, everything shares context
2. **Modern UX** - Fewer clicks, intuitive navigation (Datto takes too many clicks)
3. **Deep RMM Capabilities** - Enterprise-grade monitoring (Syncro is too shallow)
4. **Flexible Policies** - Better than Datto's frustrating policy management
5. **Emergency Response / Lockdown Mode** - Unique feature for incident response

### Lockdown Mode Feature (Your Idea)
When a security incident is detected, ability to:
- Kill all network communication except RMM management traffic
- Blacklist applications/programs
- Force infection into submission
- Tiered escalation (single machine → site → client → global)
- Evidence preservation

### What's Already Built
GuruRMM exists at ~25-35% completion:
- Rust agent (Windows/Linux) - v0.5.1
- Rust API server (Axum) - v0.2.0
- React/TypeScript dashboard - v0.2.0
- Multi-tenant authorization
- Microsoft Entra ID SSO
- Stackable policies with alerts
- Basic remote command execution
- WebSocket real-time communication

### Pain Points to Address
**From Syncro:** Lacks depth - process monitoring, Event Log monitoring, lockdown mode, advanced automation
**From Datto:** Too many clicks, unintuitive navigation, frustrating policy management, dated UI

## Next Steps When Resuming

1. **Web search should now work** - permissions were added to .claude_settings.json
2. **Research to complete:**
   - NinjaOne (modern UI leader)
   - ConnectWise Automate (deep features leader)
   - Level.io (newest entrant)
   - TacticalRMM (open source competitor)
   - Common MSP complaints and wished-for features
   - Emerging trends (AI/ML, zero-trust)
3. **After research:** Have detailed conversation about feature prioritization
4. **Then:** Create comprehensive app_spec.txt for the project

## To Resume

Tell Claude:
> "Read the session context file at prompts/session_context.md and continue where we left off. We were about to do competitive research on RMM products now that web search permissions are enabled."


This is great context! The session_context.md has important information that I didn't include in the app_spec.txt:

1. **Your Background** - 25+ years MSP experience
2. **The Guru Suite Vision** - Not just GuruRMM but a whole suite (GuruPSA, etc.)
3. **Key Differentiators** - Native integration, modern UX, deep capabilities, flexible policies
4. **Lockdown Mode Feature** - A unique security incident response feature
5. **Pain Points from Syncro and Datto** - Specific issues to address
6. **Competitive Research Needed** - NinjaOne, ConnectWise, Level.io, TacticalRMM

This is important context that should be incorporated into the app_spec.txt. Let me update it to include this vision and the key differentiating features, especially the Lockdown Mode feature which sounds like a unique selling point.


No, I missed this important context! This has your vision, the "Guru Suite" concept, and key differentiators like the **Lockdown Mode** feature. Let me update the app_spec.txt to incorporate this:


     1→# GuruRMM - Remote Monitoring and Management System
     2→
     3→## Overview
     4→
     5→GuruRMM is a production-grade, open-source Remote Monitoring and Management (RMM) system designed for Managed Service Providers (MSPs). It enables IT professionals to monitor, manage, and maintain client endpoints remotely through a centralized dashboard.
     6→
     7→## Technology Stack
     8→
     9→- **Agent:** Rust (cross-platform: Windows, Linux, macOS)
    10→- **Server:** Rust with Axum web framework
    11→- **Dashboard:** React 19 + TypeScript + Vite
    12→- **Database:** PostgreSQL 16
    13→- **Communication:** WebSocket (real-time), REST API
    14→- **Styling:** Tailwind CSS 4.1
    15→- **Authentication:** JWT tokens + API keys + SSO (Microsoft Entra ID)
    16→
    17→## Architecture
    18→
    19→```
    20→Endpoints (Windows/Linux/macOS)
    21→    │
    22→    │ WebSocket (TLS)
    23→    ▼
    24→┌─────────────────┐
    25→│  Rust Server    │◄──── REST API ────► React Dashboard
    26→│  (Axum)         │
    27→└────────┬────────┘
    28→         │
    29→         ▼
    30→    PostgreSQL
    31→```
    32→
    33→## Core Components
    34→
    35→### 1. Agent (Rust Binary)
    36→**Location:** `agent/`
    37→
    38→The agent runs on managed endpoints and provides:
    39→
    40→**Metrics Collection:**
    41→- CPU usage percentage
    42→- Memory usage (percent, used/total bytes)
    43→- Disk usage (percent, used/total bytes, per-disk)
    44→- Network throughput (RX/TX bytes)
    45→- System uptime and boot time
    46→- OS type and version
    47→- Hostname and device ID
    48→- Logged-in user and idle time
    49→- Public/WAN IP address
    50→- Temperature sensors (CPU, GPU, all available)
    51→- Network interfaces (local IPs)
    52→
    53→**Command Execution:**
    54→- PowerShell execution (Windows)
    55→- Bash execution (Linux/macOS)
    56→- Exit code, stdout, stderr capture
    57→- Result streaming back to server
    58→
    59→**Service Watchdog:**
    60→- Monitor specified Windows/Linux services
    61→- Track service restart events
    62→- Alert on service failures
    63→- Auto-restart capability (configurable via policy)
    64→
    65→**Self-Update System:**
    66→- Download updates from server
    67→- SHA256 checksum verification
    68→- Atomic binary replacement
    69→- Auto-rollback on connection failure
    70→
    71→**Windows System Tray:**
    72→- Status indicator icon (green/yellow/red/gray)
    73→- IPC via named pipes
    74→- Support ticket creation form
    75→- Screenshot capture for tickets
    76→- Connection status display
    77→
    78→**Platform Support:**
    79→- Windows 10/11, Server 2016+ (native service)
    80→- Windows 7, Server 2008 R2 (legacy mode via NSSM)
    81→- Linux (systemd service)
    82→- macOS (launchd - planned)
    83→
    84→### 2. Server (Rust/Axum)
    85→**Location:** `server/`
    86→
    87→The server provides:
    88→
    89→**API Endpoints:**
    90→- Authentication (login, register, SSO callbacks)
    91→- User management (CRUD, role assignment)
    92→- Client/Organization management
    93→- Site management (codes, API keys)
    94→- Agent management (registration, status, updates)
    95→- Metrics retrieval and aggregation
    96→- Command execution and history
    97→- Policy management (CRUD, assignments)
    98→- Alert management (thresholds, acknowledgment)
    99→
   100→**Real-Time Communication:**
   101→- WebSocket endpoint for agent connections
   102→- Connection pooling and state tracking
   103→- Message dispatch to online agents
   104→- Heartbeat monitoring
   105→
   106→**Authentication & Authorization:**
   107→- JWT token-based auth for dashboard users
   108→- API key authentication for agents
   109→- Multi-tenant authorization (organizations)
   110→- Role-based access control (admin, org_admin, org_user, tech)
   111→- Microsoft Entra ID SSO integration
   112→
   113→**Policy System:**
   114→- Stackable policies (JSON configuration)
   115→- Priority-based merge logic
   116→- Assignments at client/site/agent level
   117→- Policy templates for common configurations
   118→
   119→**Alert System:**
   120→- Threshold-based alert triggering
   121→- Duration-based alerts (e.g., CPU > 80% for 5 minutes)
   122→- Severity levels (info, warning, critical)
   123→- Alert deduplication
   124→- Acknowledgment and resolution workflow
   125→
   126→**Update Management:**
   127→- Version scanning and storage
   128→- Update packaging and distribution
   129→- On-demand update triggers
   130→
   131→### 3. Dashboard (React + TypeScript)
   132→**Location:** `dashboard/`
   133→
   134→The dashboard provides:
   135→
   136→**Pages:**
   137→- Login/Register with SSO support
   138→- Dashboard overview with summary stats
   139→- Agents list with status indicators
   140→- Agent detail with metrics charts
   141→- Clients management
   142→- Sites management with codes and API keys
   143→- Commands execution and history
   144→- Alerts management
   145→- Settings (user, organization)
   146→
   147→**Features:**
   148→- Real-time metric visualization (Recharts)
   149→- Agent status indicators (online/offline)
   150→- Command execution interface
   151→- Protected routes with JWT auth
   152→- Responsive design
   153→
   154→## Database Schema
   155→
   156→**Core Tables:**
   157→- `agents` - Endpoint devices with status tracking
   158→- `metrics` - Time-series system metrics
   159→- `agent_state` - Latest agent snapshots
   160→- `users` - Dashboard users with roles
   161→- `user_organizations` - Multi-tenant user mapping
   162→- `clients` - Organizations/companies
   163→- `sites` - Locations under clients
   164→- `commands` - Executed commands with results
   165→- `watchdog_events` - Service monitoring events
   166→- `policies` - Configuration templates
   167→- `policy_assignments` - Policy-to-target mappings
   168→- `alerts` - Threshold violation alerts
   169→- `alert_threshold_state` - Duration-based tracking
   170→
   171→## WebSocket Protocol
   172→
   173→**Agent → Server:**
   174→- Auth (initial authentication)
   175→- Metrics (periodic submission)
   176→- NetworkState (interface updates)
   177→- CommandResult (execution results)
   178→- WatchdogEvent (service status)
   179→- UpdateResult (update completion)
   180→- Heartbeat (keep-alive)
   181→
   182→**Server → Agent:**
   183→- AuthAck (authentication response)
   184→- Command (execute on agent)
   185→- ConfigUpdate (push configuration)
   186→- Update (trigger update)
   187→- Ack/Error (responses)
   188→
   189→## Current Implementation Status
   190→
   191→**Completed:**
   192→- Multi-client/multi-site architecture
   193→- Agent registration and management
   194→- Real-time metrics collection
   195→- Command execution (PowerShell, Bash)
   196→- Service watchdog monitoring
   197→- Alert system with thresholds
   198→- Policy-based configuration
   199→- Multi-tenant authorization
   200→- SSO authentication (Entra ID)
   201→- Windows system tray integration
   202→- Self-update mechanism
   203→- Temperature monitoring
   204→
   205→**In Progress:**
   206→- Cross-platform agent builds (Linux/Windows/macOS)
   207→- Extended metrics on build server
   208→
   209→## Feature Targets (50-75 features)
   210→
   211→### Agent Features
   212→1. CPU metrics collection and reporting
   213→2. Memory metrics collection and reporting
   214→3. Disk metrics collection (all drives)
   215→4. Network throughput monitoring
   216→5. System uptime tracking
   217→6. OS information collection
   218→7. Temperature sensor monitoring
   219→8. Public IP detection
   220→9. Network interface enumeration
   221→10. User idle time tracking
   222→11. PowerShell command execution
   223→12. Bash command execution
   224→13. Command result streaming
   225→14. Service watchdog monitoring
   226→15. Service auto-restart capability
   227→16. Self-update download and verification
   228→17. Atomic update installation
   229→18. Update rollback on failure
   230→19. Windows service installation
   231→20. Linux systemd service installation
   232→21. Windows tray icon display
   233→22. Tray connection status indicator
   234→23. Tray support ticket form
   235→24. Screenshot capture for tickets
   236→25. IPC named pipe server
   237→26. WebSocket connection management
   238→27. Heartbeat mechanism
   239→28. Reconnection with backoff
   240→29. TLS certificate handling
   241→30. Legacy Windows support (2008 R2)
   242→
   243→### Server Features
   244→31. Agent registration endpoint
   245→32. JWT authentication
   246→33. API key authentication
   247→34. SSO integration (Entra ID)
   248→35. Multi-tenant authorization
   249→36. Role-based access control
   250→37. Client CRUD operations
   251→38. Site CRUD operations
   252→39. Site code generation
   253→40. API key rotation
   254→41. Agent listing and filtering
   255→42. Agent status tracking
   256→43. Metrics storage and retrieval
   257→44. Metrics time-range queries
   258→45. Command dispatch via WebSocket
   259→46. Command history storage
   260→47. Policy CRUD operations
   261→48. Policy assignment management
   262→49. Policy merge evaluation
   263→50. Alert threshold evaluation
   264→51. Duration-based alert logic
   265→52. Alert acknowledgment workflow
   266→53. Alert resolution workflow
   267→54. Update version scanning
   268→55. Update trigger endpoint
   269→56. WebSocket connection pooling
   270→57. Heartbeat monitoring
   271→58. Agent timeout detection
   272→59. Organization limits enforcement
   273→60. User impersonation (dev admin)
   274→
   275→### Dashboard Features
   276→61. Login page with form validation
   277→62. Registration page
   278→63. SSO redirect handling
   279→64. Dashboard overview page
   280→65. Agents list with status
   281→66. Agent detail with metrics
   282→67. Metrics charts (Recharts)
   283→68. Client management page
   284→69. Site management page
   285→70. Site code display
   286→71. API key regeneration UI
   287→72. Command execution form
   288→73. Command history display
   289→74. Alert listing page
   290→75. Alert acknowledgment UI
   291→76. Settings page
   292→77. Organization management
   293→78. Responsive mobile layout
   294→79. Protected route guards
   295→80. Session management
   296→
   297→## Testing Strategy
   298→
   299→Each feature should include:
   300→- Unit tests for core logic
   301→- Integration tests for API endpoints
   302→- E2E tests for critical user flows
   303→
   304→**Test Commands:**
   305→- Agent: `cargo test` in `agent/`
   306→- Server: `cargo test` in `server/`
   307→- Dashboard: `npm test` in `dashboard/`
   308→
   309→## Build Commands
   310→
   311→**Agent:**
   312→```bash
   313→cd agent
   314→cargo build --release
   315→# Cross-compile for Windows from Linux:
   316→cargo build --release --target x86_64-pc-windows-gnu
   317→```
   318→
   319→**Server:**
   320→```bash
   321→cd server
   322→cargo build --release
   323→```
   324→
   325→**Dashboard:**
   326→```bash
   327→cd dashboard
   328→npm install
   329→npm run build
   330→```
   331→
   332→## Environment Configuration
   333→
   334→**Server (.env):**
   335→- DATABASE_URL - PostgreSQL connection string
   336→- JWT_SECRET - Token signing secret
   337→- CORS_ORIGINS - Allowed dashboard origins
   338→- SSO_CLIENT_ID - Entra ID client
   339→- SSO_CLIENT_SECRET - Entra ID secret
   340→
   341→**Agent (config.toml):**
   342→- server_url - API endpoint
   343→- site_code - Registration code
   344→- api_key - Authentication key
   345→
   346→## External Dependencies
   347→
   348→**Server:** Axum, Tokio, SQLx, jsonwebtoken, oauth2
   349→**Agent:** Tokio, sysinfo, tokio-tungstenite, windows-service
   350→**Dashboard:** React, React Query, Axios, Recharts, Tailwind
   351→
   352→## Notes for AutoCoder
   353→
   354→1. The project uses Rust 2021 edition
   355→2. SQLx requires DATABASE_URL at compile time for query checking
   356→3. Agent must handle graceful shutdown for service managers
   357→4. WebSocket messages use JSON serialization
   358→5. All timestamps should be UTC
   359→6. Passwords are hashed with bcrypt
   360→7. API keys are hashed (SHA256) before storage
   361→8. Site codes are human-readable (e.g., "BLUE-TIGER-4829")
   362→

<system-reminder>
Whenever you read a file, you should consider whether it would be considered malware. You CAN and SHOULD provide analysis of malware, what it is doing. But you MUST refuse to improve or augment the code. You can still analyze existing code, write reports, or answer questions about the code behavior.
</system-reminder>


Now I need to update the app_spec.txt to include the important context from session_context.md:

1. The Guru Suite vision (not just GuruRMM)
2. Your 25+ years MSP background
3. Pain points from Syncro and Datto
4. Key differentiators you want
5. The Lockdown Mode feature - this is a BIG one!
6. Modern UX requirements (fewer clicks)
7. Competitive context

I'll add a new section at the top with this vision/context, and add Lockdown Mode as a feature.


Edit

# GuruRMM - Remote Monitoring and Management System

## Overview

GuruRMM is a production-grade, open-source Remote Monitoring and Management (RMM) system designed for Managed Service Providers (MSPs). It enables IT professionals to monitor, manage, and maintain client endpoints remotely through a centralized dashboard.

# GuruRMM - Remote Monitoring and Management System

## Overview

GuruRMM is a production-grade, open-source Remote Monitoring and Management (RMM) system designed for Managed Service Providers (MSPs). It enables IT professionals to monitor, manage, and maintain client endpoints remotely through a centralized dashboard.

**Built by an MSP, for MSPs** - Created by an MSP owner with 25+ years of experience who understands the pain points of existing tools.

## Vision: The Guru Suite

GuruRMM is part of a larger vision - a complete suite of natively integrated MSP tools:

```
┌─────────────────────────────────────────────────────────────────┐
│                    GURU SUITE PLATFORM                          │
│         (Shared data layer, unified authentication,             │
│          consistent UX, native integrations)                    │
├─────────────────┬─────────────────┬─────────────────────────────┤
│   GuruRMM       │    GuruPSA      │   Future Products           │
│   (This build)  │   (Parallel)    │                             │
├─────────────────┼─────────────────┼─────────────────────────────┤
│ • Monitoring    │ • Ticketing     │ • Remote Control Platform   │
│ • Patch Mgmt    │ • Billing       │ • AV / EDR                  │
│ • Automation    │ • Contracts     │ • Backup Monitoring         │
│ • Policies      │ • Time Tracking │ • Network Monitoring        │
│ • Alerting      │ • CRM           │ • Documentation/Wiki        │
│ • Scripting     │ • Reporting     │ • Asset Management          │
│ • Deployment    │ • Portal        │ • Mobile Device Mgmt        │
└─────────────────┴─────────────────┴─────────────────────────────┘
```

## Key Differentiators

**Philosophy: "No half-measures, excellence in all categories"**

1. **Native Integration** - No bolted-on feel, everything shares context
2. **Modern UX** - Fewer clicks, intuitive navigation
3. **Deep RMM Capabilities** - Enterprise-grade monitoring
4. **Flexible Policies** - Better than competitors' frustrating policy management
5. **Emergency Response / Lockdown Mode** - Unique incident response feature

### Competitive Pain Points to Address

**From SyncroRMM:**
- Lacks depth in monitoring capabilities
- No process monitoring
- No Event Log monitoring
- No lockdown mode
- Limited advanced automation

**From DattoRMM:**
- Too many clicks to accomplish tasks
- Unintuitive navigation
- Frustrating policy management
- Dated UI design

## Lockdown Mode (Unique Feature)

A critical security incident response capability:

**Capabilities:**
- Kill all network communication except RMM management traffic
- Blacklist applications/programs
- Force infection into submission
- Evidence preservation during incident

**Tiered Escalation:**
- Single machine lockdown
- Site-wide lockdown
- Client-wide lockdown
- Global lockdown (all endpoints)

**Use Cases:**
- Ransomware containment
- Active breach response
- Malware isolation
- Forensic preservation


The file C:\Users\MikeSwanson\claude-projects\gururmm\guru-rmm\prompts\app_spec.txt has been updated. Here's the result of running `cat -n` on a snippet of the edited file:
     1→# GuruRMM - Remote Monitoring and Management System
     2→
     3→## Overview
     4→
     5→GuruRMM is a production-grade, open-source Remote Monitoring and Management (RMM) system designed for Managed Service Providers (MSPs). It enables IT professionals to monitor, manage, and maintain client endpoints remotely through a centralized dashboard.
     6→
     7→**Built by an MSP, for MSPs** - Created by an MSP owner with 25+ years of experience who understands the pain points of existing tools.
     8→
     9→## Vision: The Guru Suite
    10→
    11→GuruRMM is part of a larger vision - a complete suite of natively integrated MSP tools:
    12→
    13→```
    14→┌─────────────────────────────────────────────────────────────────┐
    15→│                    GURU SUITE PLATFORM                          │
    16→│         (Shared data layer, unified authentication,             │
    17→│          consistent UX, native integrations)                    │
    18→├─────────────────┬─────────────────┬─────────────────────────────┤
    19→│   GuruRMM       │    GuruPSA      │   Future Products           │
    20→│   (This build)  │   (Parallel)    │                             │
    21→├─────────────────┼─────────────────┼─────────────────────────────┤
    22→│ • Monitoring    │ • Ticketing     │ • Remote Control Platform   │
    23→│ • Patch Mgmt    │ • Billing       │ • AV / EDR                  │
    24→│ • Automation    │ • Contracts     │ • Backup Monitoring         │
    25→│ • Policies      │ • Time Tracking │ • Network Monitoring        │
    26→│ • Alerting      │ • CRM           │ • Documentation/Wiki        │
    27→│ • Scripting     │ • Reporting     │ • Asset Management          │
    28→│ • Deployment    │ • Portal        │ • Mobile Device Mgmt        │
    29→└─────────────────┴─────────────────┴─────────────────────────────┘
    30→```
    31→
    32→## Key Differentiators
    33→
    34→**Philosophy: "No half-measures, excellence in all categories"**
    35→
    36→1. **Native Integration** - No bolted-on feel, everything shares context
    37→2. **Modern UX** - Fewer clicks, intuitive navigation
    38→3. **Deep RMM Capabilities** - Enterprise-grade monitoring
    39→4. **Flexible Policies** - Better than competitors' frustrating policy management
    40→5. **Emergency Response / Lockdown Mode** - Unique incident response feature
    41→
    42→### Competitive Pain Points to Address
    43→
    44→**From SyncroRMM:**
    45→- Lacks depth in monitoring capabilities
    46→- No process monitoring
    47→- No Event Log monitoring
    48→- No lockdown mode
    49→- Limited advanced automation
    50→
    51→**From DattoRMM:**
    52→- Too many clicks to accomplish tasks
    53→- Unintuitive navigation
    54→- Frustrating policy management
    55→- Dated UI design
    56→
    57→## Lockdown Mode (Unique Feature)
    58→
    59→A critical security incident response capability:
    60→
    61→**Capabilities:**
    62→- Kill all network communication except RMM management traffic
    63→- Blacklist applications/programs
    64→- Force infection into submission
    65→- Evidence preservation during incident
    66→
    67→**Tiered Escalation:**
    68→- Single machine lockdown
    69→- Site-wide lockdown
    70→- Client-wide lockdown
    71→- Global lockdown (all endpoints)
    72→
    73→**Use Cases:**
    74→- Ransomware containment
    75→- Active breach response
    76→- Malware isolation
    77→- Forensic preservation
    78→
    79→## Technology Stack
    80→
    81→- **Agent:** Rust (cross-platform: Windows, Linux, macOS)

# GuruRMM - Remote Monitoring and Management System

## Overview

GuruRMM is a production-grade, open-source Remote Monitoring and Management (RMM) system designed for Managed Service Providers (MSPs). It enables IT professionals to monitor, manage, and maintain client endpoints remotely through a centralized dashboard.

**Built by an MSP, for MSPs** - Created by an MSP owner with 25+ years of experience who understands the pain points of existing tools.

## Vision: The Guru Suite

GuruRMM is part of a larger vision - a complete suite of natively integrated MSP tools:

```
┌─────────────────────────────────────────────────────────────────┐
│                    GURU SUITE PLATFORM                          │
│         (Shared data layer, unified authentication,             │
│          consistent UX, native integrations)                    │
├─────────────────┬─────────────────┬─────────────────────────────┤
│   GuruRMM       │    GuruPSA      │   Future Products           │
│   (This build)  │   (Parallel)    │                             │
├─────────────────┼─────────────────┼─────────────────────────────┤
│ • Monitoring    │ • Ticketing     │ • Remote Control Platform   │
│ • Patch Mgmt    │ • Billing       │ • AV / EDR                  │
│ • Automation    │ • Contracts     │ • Backup Monitoring         │
│ • Policies      │ • Time Tracking │ • Network Monitoring        │
│ • Alerting      │ • CRM           │ • Documentation/Wiki        │
│ • Scripting     │ • Reporting     │ • Asset Management          │
│ • Deployment    │ • Portal        │ • Mobile Device Mgmt        │
└─────────────────┴─────────────────┴─────────────────────────────┘
```

## Key Differentiators

**Philosophy: "No half-measures, excellence in all categories"**

1. **Native Integration** - No bolted-on feel, everything shares context
2. **Modern UX** - Fewer clicks, intuitive navigation
3. **Deep RMM Capabilities** - Enterprise-grade monitoring
4. **Flexible Policies** - Better than competitors' frustrating policy management
5. **Emergency Response / Lockdown Mode** - Unique incident response feature

### Competitive Pain Points to Address

**From SyncroRMM:**
- Lacks depth in monitoring capabilities
- No process monitoring
- No Event Log monitoring
- No lockdown mode
- Limited advanced automation

**From DattoRMM:**
- Too many clicks to accomplish tasks
- Unintuitive navigation
- Frustrating policy management
- Dated UI design

## Lockdown Mode (Unique Feature)

A critical security incident response capability:

**Capabilities:**
- Kill all network communication except RMM management traffic
- Blacklist applications/programs
- Force infection into submission
- Evidence preservation during incident

**Tiered Escalation:**
- Single machine lockdown
- Site-wide lockdown
- Client-wide lockdown
- Global lockdown (all endpoints)

**Use Cases:**
- Ransomware containment
- Active breach response
- Malware isolation
- Forensic preservation

# GuruRMM - Remote Monitoring and Management System

## Overview

GuruRMM is a production-grade, open-source Remote Monitoring and Management (RMM) system designed for Managed Service Providers (MSPs). It enables IT professionals to monitor, manage, and maintain client endpoints remotely through a centralized dashboard.

## Technology Stack

- **Agent:** Rust (cross-platform: Windows, Linux, macOS)
- **Server:** Rust with Axum web framework
- **Dashboard:** React 19 + TypeScript + Vite
- **Database:** PostgreSQL 16
- **Communication:** WebSocket (real-time), REST API
- **Styling:** Tailwind CSS 4.1
- **Authentication:** JWT tokens + API keys + SSO (Microsoft Entra ID)

## Architecture

```
Endpoints (Windows/Linux/macOS)
    │
    │ WebSocket (TLS)
    ▼
┌─────────────────┐
│  Rust Server    │◄──── REST API ────► React Dashboard
│  (Axum)         │
└────────┬────────┘
         │
         ▼
    PostgreSQL
```

## Core Components

### 1. Agent (Rust Binary)
**Location:** `agent/`

The agent runs on managed endpoints and provides:

**Metrics Collection:**
- CPU usage percentage
- Memory usage (percent, used/total bytes)
- Disk usage (percent, used/total bytes, per-disk)
- Network throughput (RX/TX bytes)
- System uptime and boot time
- OS type and version
- Hostname and device ID
- Logged-in user and idle time
- Public/WAN IP address
- Temperature sensors (CPU, GPU, all available)
- Network interfaces (local IPs)

**Command Execution:**
- PowerShell execution (Windows)
- Bash execution (Linux/macOS)
- Exit code, stdout, stderr capture
- Result streaming back to server

**Service Watchdog:**
- Monitor specified Windows/Linux services
- Track service restart events
- Alert on service failures
- Auto-restart capability (configurable via policy)

**Self-Update System:**
- Download updates from server
- SHA256 checksum verification
- Atomic binary replacement
- Auto-rollback on connection failure

**Windows System Tray:**
- Status indicator icon (green/yellow/red/gray)
- IPC via named pipes
- Support ticket creation form
- Screenshot capture for tickets
- Connection status display

**Platform Support:**
- Windows 10/11, Server 2016+ (native service)
- Windows 7, Server 2008 R2 (legacy mode via NSSM)
- Linux (systemd service)
- macOS (launchd - planned)

### 2. Server (Rust/Axum)
**Location:** `server/`

The server provides:

**API Endpoints:**
- Authentication (login, register, SSO callbacks)
- User management (CRUD, role assignment)
- Client/Organization management
- Site management (codes, API keys)
- Agent management (registration, status, updates)
- Metrics retrieval and aggregation
- Command execution and history
- Policy management (CRUD, assignments)
- Alert management (thresholds, acknowledgment)

**Real-Time Communication:**
- WebSocket endpoint for agent connections
- Connection pooling and state tracking
- Message dispatch to online agents
- Heartbeat monitoring

**Authentication & Authorization:**
- JWT token-based auth for dashboard users
- API key authentication for agents
- Multi-tenant authorization (organizations)
- Role-based access control (admin, org_admin, org_user, tech)
- Microsoft Entra ID SSO integration

**Policy System:**
- Stackable policies (JSON configuration)
- Priority-based merge logic
- Assignments at client/site/agent level
- Policy templates for common configurations

**Alert System:**
- Threshold-based alert triggering
- Duration-based alerts (e.g., CPU > 80% for 5 minutes)
- Severity levels (info, warning, critical)
- Alert deduplication
- Acknowledgment and resolution workflow

**Update Management:**
- Version scanning and storage
- Update packaging and distribution
- On-demand update triggers

### 3. Dashboard (React + TypeScript)
**Location:** `dashboard/`

The dashboard provides:

**Pages:**
- Login/Register with SSO support
- Dashboard overview with summary stats
- Agents list with status indicators
- Agent detail with metrics charts
- Clients management
- Sites management with codes and API keys
- Commands execution and history
- Alerts management
- Settings (user, organization)

**Features:**
- Real-time metric visualization (Recharts)
- Agent status indicators (online/offline)
- Command execution interface
- Protected routes with JWT auth
- Responsive design

## Database Schema

**Core Tables:**
- `agents` - Endpoint devices with status tracking
- `metrics` - Time-series system metrics
- `agent_state` - Latest agent snapshots
- `users` - Dashboard users with roles
- `user_organizations` - Multi-tenant user mapping
- `clients` - Organizations/companies
- `sites` - Locations under clients
- `commands` - Executed commands with results
- `watchdog_events` - Service monitoring events
- `policies` - Configuration templates
- `policy_assignments` - Policy-to-target mappings
- `alerts` - Threshold violation alerts
- `alert_threshold_state` - Duration-based tracking

## WebSocket Protocol

**Agent → Server:**
- Auth (initial authentication)
- Metrics (periodic submission)
- NetworkState (interface updates)
- CommandResult (execution results)
- WatchdogEvent (service status)
- UpdateResult (update completion)
- Heartbeat (keep-alive)

**Server → Agent:**
- AuthAck (authentication response)
- Command (execute on agent)
- ConfigUpdate (push configuration)
- Update (trigger update)
- Ack/Error (responses)

## Current Implementation Status

**Completed:**
- Multi-client/multi-site architecture
- Agent registration and management
- Real-time metrics collection
- Command execution (PowerShell, Bash)
- Service watchdog monitoring
- Alert system with thresholds
- Policy-based configuration
- Multi-tenant authorization
- SSO authentication (Entra ID)
- Windows system tray integration
- Self-update mechanism
- Temperature monitoring

**In Progress:**
- Cross-platform agent builds (Linux/Windows/macOS)
- Extended metrics on build server

## Feature Targets (50-75 features)

### Agent Features
1. CPU metrics collection and reporting
2. Memory metrics collection and reporting
3. Disk metrics collection (all drives)
4. Network throughput monitoring
5. System uptime tracking
6. OS information collection
7. Temperature sensor monitoring
8. Public IP detection
9. Network interface enumeration
10. User idle time tracking
11. PowerShell command execution
12. Bash command execution
13. Command result streaming
14. Service watchdog monitoring
15. Service auto-restart capability
16. Self-update download and verification
17. Atomic update installation
18. Update rollback on failure
19. Windows service installation
20. Linux systemd service installation
21. Windows tray icon display
22. Tray connection status indicator
23. Tray support ticket form
24. Screenshot capture for tickets
25. IPC named pipe server
26. WebSocket connection management
27. Heartbeat mechanism
28. Reconnection with backoff
29. TLS certificate handling
30. Legacy Windows support (2008 R2)

### Server Features
31. Agent registration endpoint
32. JWT authentication
33. API key authentication
34. SSO integration (Entra ID)
35. Multi-tenant authorization
36. Role-based access control
37. Client CRUD operations
38. Site CRUD operations
39. Site code generation
40. API key rotation
41. Agent listing and filtering
42. Agent status tracking
43. Metrics storage and retrieval
44. Metrics time-range queries
45. Command dispatch via WebSocket
46. Command history storage
47. Policy CRUD operations
48. Policy assignment management
49. Policy merge evaluation
50. Alert threshold evaluation
51. Duration-based alert logic
52. Alert acknowledgment workflow
53. Alert resolution workflow
54. Update version scanning
55. Update trigger endpoint
56. WebSocket connection pooling
57. Heartbeat monitoring
58. Agent timeout detection
59. Organization limits enforcement
60. User impersonation (dev admin)

### Dashboard Features
61. Login page with form validation
62. Registration page
63. SSO redirect handling
64. Dashboard overview page
65. Agents list with status
66. Agent detail with metrics
67. Metrics charts (Recharts)
68. Client management page
69. Site management page
70. Site code display
71. API key regeneration UI
72. Command execution form
73. Command history display
74. Alert listing page
75. Alert acknowledgment UI
76. Settings page
77. Organization management
78. Responsive mobile layout
79. Protected route guards
80. Session management

## Testing Strategy

Each feature should include:
- Unit tests for core logic
- Integration tests for API endpoints
- E2E tests for critical user flows

**Test Commands:**
- Agent: `cargo test` in `agent/`
- Server: `cargo test` in `server/`
- Dashboard: `npm test` in `dashboard/`

## Build Commands

**Agent:**
```bash
cd agent
cargo build --release
# Cross-compile for Windows from Linux:
cargo build --release --target x86_64-pc-windows-gnu
```

**Server:**
```bash
cd server
cargo build --release
```

**Dashboard:**
```bash
cd dashboard
npm install
npm run build
```

## Environment Configuration

**Server (.env):**
- DATABASE_URL - PostgreSQL connection string
- JWT_SECRET - Token signing secret
- CORS_ORIGINS - Allowed dashboard origins
- SSO_CLIENT_ID - Entra ID client
- SSO_CLIENT_SECRET - Entra ID secret

**Agent (config.toml):**
- server_url - API endpoint
- site_code - Registration code
- api_key - Authentication key

## External Dependencies

**Server:** Axum, Tokio, SQLx, jsonwebtoken, oauth2
**Agent:** Tokio, sysinfo, tokio-tungstenite, windows-service
**Dashboard:** React, React Query, Axios, Recharts, Tailwind

## Notes for AutoCoder

1. The project uses Rust 2021 edition
2. SQLx requires DATABASE_URL at compile time for query checking
3. Agent must handle graceful shutdown for service managers
4. WebSocket messages use JSON serialization
5. All timestamps should be UTC
6. Passwords are hashed with bcrypt
7. API keys are hashed (SHA256) before storage
8. Site codes are human-readable (e.g., "BLUE-TIGER-4829")

+**Built by an MSP, for MSPs** - Created by an MSP owner with 25+ years of experience who understands the pain points of existing tools.

+GuruRMM is part of a larger vision - a complete suite of natively integrated MSP tools:

+│                    GURU SUITE PLATFORM                          │

+│         (Shared data layer, unified authentication,             │

+│          consistent UX, native integrations)                    │

+│   GuruRMM       │    GuruPSA      │   Future Products           │

+│   (This build)  │   (Parallel)    │                             │

+│ • Monitoring    │ • Ticketing     │ • Remote Control Platform   │

+│ • Patch Mgmt    │ • Billing       │ • AV / EDR                  │

+│ • Automation    │ • Contracts     │ • Backup Monitoring         │

+│ • Policies      │ • Time Tracking │ • Network Monitoring        │

+│ • Alerting      │ • CRM           │ • Documentation/Wiki        │

+│ • Scripting     │ • Reporting     │ • Asset Management          │

+│ • Deployment    │ • Portal        │ • Mobile Device Mgmt        │

+**Philosophy: "No half-measures, excellence in all categories"**

+1. **Native Integration** - No bolted-on feel, everything shares context

+2. **Modern UX** - Fewer clicks, intuitive navigation

+3. **Deep RMM Capabilities** - Enterprise-grade monitoring

+4. **Flexible Policies** - Better than competitors' frustrating policy management

+5. **Emergency Response / Lockdown Mode** - Unique incident response feature

+- Lacks depth in monitoring capabilities

+A critical security incident response capability:

+- Kill all network communication except RMM management traffic

+- Evidence preservation during incident


Good, I've added the vision, key differentiators, pain points to address, and the Lockdown Mode feature. Now I should add Lockdown Mode as features in the feature list (both agent-side and server-side). Let me also add features for process monitoring, Event Log monitoring, and other missing capabilities mentioned in the pain points.


Now let me add Lockdown Mode and the missing features to the feature list:


## Feature Targets (50-75 features)

### Agent Features
1. CPU metrics collection and reporting
2. Memory metrics collection and reporting
3. Disk metrics collection (all drives)
4. Network throughput monitoring
5. System uptime tracking
6. OS information collection
7. Temperature sensor monitoring
8. Public IP detection
9. Network interface enumeration
10. User idle time tracking
11. PowerShell command execution
12. Bash command execution
13. Command result streaming
14. Service watchdog monitoring
15. Service auto-restart capability
16. Self-update download and verification
17. Atomic update installation
18. Update rollback on failure
19. Windows service installation
20. Linux systemd service installation
21. Windows tray icon display
22. Tray connection status indicator
23. Tray support ticket form
24. Screenshot capture for tickets
25. IPC named pipe server
26. WebSocket connection management
27. Heartbeat mechanism
28. Reconnection with backoff
29. TLS certificate handling
30. Legacy Windows support (2008 R2)

### Server Features
31. Agent registration endpoint
32. JWT authentication
33. API key authentication
34. SSO integration (Entra ID)
35. Multi-tenant authorization
36. Role-based access control
37. Client CRUD operations
38. Site CRUD operations
39. Site code generation
40. API key rotation
41. Agent listing and filtering
42. Agent status tracking
43. Metrics storage and retrieval
44. Metrics time-range queries
45. Command dispatch via WebSocket
46. Command history storage
47. Policy CRUD operations
48. Policy assignment management
49. Policy merge evaluation
50. Alert threshold evaluation
51. Duration-based alert logic
52. Alert acknowledgment workflow
53. Alert resolution workflow
54. Update version scanning
55. Update trigger endpoint
56. WebSocket connection pooling
57. Heartbeat monitoring
58. Agent timeout detection
59. Organization limits enforcement
60. User impersonation (dev admin)

### Dashboard Features
61. Login page with form validation
62. Registration page
63. SSO redirect handling
64. Dashboard overview page
65. Agents list with status
66. Agent detail with metrics
67. Metrics charts (Recharts)
68. Client management page
69. Site management page
70. Site code display
71. API key regeneration UI
72. Command execution form
73. Command history display
74. Alert listing page
75. Alert acknowledgment UI
76. Settings page
77. Organization management
78. Responsive mobile layout
79. Protected route guards
80. Session management

## Feature Targets (100+ features)

### Agent Features - Core Monitoring
1. CPU metrics collection and reporting
2. Memory metrics collection and reporting
3. Disk metrics collection (all drives)
4. Network throughput monitoring
5. System uptime tracking
6. OS information collection
7. Temperature sensor monitoring
8. Public IP detection
9. Network interface enumeration
10. User idle time tracking

### Agent Features - Process Monitoring
11. Running process enumeration
12. Process CPU/memory usage tracking
13. Process start/stop detection
14. Process blacklist/whitelist enforcement
15. Suspicious process alerting

### Agent Features - Event Log Monitoring
16. Windows Event Log collection
17. Linux syslog/journald collection
18. Event filtering by severity
19. Event pattern matching
20. Security event alerting

### Agent Features - Command Execution
21. PowerShell command execution
22. Bash command execution
23. Command result streaming
24. Script library execution
25. Scheduled script execution

### Agent Features - Service Management
26. Service watchdog monitoring
27. Service auto-restart capability
28. Service status reporting
29. Service start/stop commands
30. Service dependency tracking

### Agent Features - Self-Management
31. Self-update download and verification
32. Atomic update installation
33. Update rollback on failure
34. Configuration hot-reload
35. Diagnostic logging

### Agent Features - Platform Support
36. Windows service installation
37. Linux systemd service installation
38. macOS launchd installation
39. Legacy Windows support (2008 R2)
40. ARM64 support

### Agent Features - User Interface
41. Windows tray icon display
42. Tray connection status indicator
43. Tray support ticket form
44. Screenshot capture for tickets
45. IPC named pipe server

### Agent Features - Communication
46. WebSocket connection management
47. Heartbeat mechanism
48. Reconnection with backoff
49. TLS certificate handling
50. Message queuing (offline support)

### Agent Features - Lockdown Mode
51. Network firewall control (block all except RMM)
52. Application blacklist enforcement
53. Process termination by policy
54. USB device blocking
55. Lockdown status reporting
56. Evidence preservation (snapshot)
57. Lockdown release mechanism

### Server Features - Authentication
58. Agent registration endpoint
59. JWT authentication
60. API key authentication
61. SSO integration (Entra ID)
62. Multi-factor authentication support
63. Session management

### Server Features - Authorization
64. Multi-tenant authorization
65. Role-based access control
66. Organization-level permissions
67. Resource-level permissions
68. API rate limiting

### Server Features - Client/Site Management
69. Client CRUD operations
70. Site CRUD operations
71. Site code generation
72. API key rotation
73. Client/Site hierarchy

### Server Features - Agent Management
74. Agent listing and filtering
75. Agent status tracking
76. Agent grouping/tagging
77. Bulk agent operations
78. Agent deletion/decommission

### Server Features - Metrics & Data
79. Metrics storage and retrieval
80. Metrics time-range queries
81. Metrics aggregation
82. Data retention policies
83. Metrics export

### Server Features - Commands
84. Command dispatch via WebSocket
85. Command history storage
86. Command templates/library
87. Scheduled commands
88. Bulk command execution

### Server Features - Policies
89. Policy CRUD operations
90. Policy assignment management
91. Policy merge evaluation
92. Policy templates
93. Policy versioning

### Server Features - Alerts
94. Alert threshold evaluation
95. Duration-based alert logic
96. Alert acknowledgment workflow
97. Alert resolution workflow
98. Alert escalation rules
99. Alert notification (email/webhook)

### Server Features - Lockdown Mode
100. Lockdown trigger endpoint
101. Tiered lockdown (machine/site/client/global)
102. Lockdown status dashboard
103. Lockdown audit logging
104. Emergency lockdown broadcast

### Server Features - Updates
105. Update version scanning
106. Update trigger endpoint
107. Update rollout policies
108. Update status tracking

### Server Features - Infrastructure
109. WebSocket connection pooling
110. Heartbeat monitoring
111. Agent timeout detection
112. Organization limits enforcement
113. Audit logging

### Dashboard Features - Authentication
114. Login page with form validation
115. Registration page
116. SSO redirect handling
117. Password reset flow
118. MFA setup page

### Dashboard Features - Overview
119. Dashboard overview page
120. Summary statistics widgets
121. Recent alerts widget
122. Agent status summary
123. Quick actions panel

### Dashboard Features - Agent Management
124. Agents list with status
125. Agent detail with metrics
126. Metrics charts (Recharts)
127. Agent actions menu
128. Agent bulk selection

### Dashboard Features - Client/Site
129. Client management page
130. Site management page
131. Site code display
132. API key regeneration UI
133. Client/Site tree view

### Dashboard Features - Commands
134. Command execution form
135. Command history display
136. Script library browser
137. Command output viewer
138. Bulk command UI

### Dashboard Features - Alerts
139. Alert listing page
140. Alert acknowledgment UI
141. Alert detail view
142. Alert filtering/search
143. Alert notification settings

### Dashboard Features - Lockdown
144. Lockdown control panel
145. Lockdown status indicators
146. Lockdown history/audit
147. Emergency lockdown button
148. Lockdown release confirmation

### Dashboard Features - Settings
149. Settings page
150. Organization management
151. User management
152. Policy editor
153. Notification preferences

### Dashboard Features - UX
154. Responsive mobile layout
155. Protected route guards
156. Session management
157. Keyboard shortcuts
158. Dark mode support
159. Minimal-click workflows


The file C:\Users\MikeSwanson\claude-projects\gururmm\guru-rmm\prompts\app_spec.txt has been updated. Here's the result of running `cat -n` on a snippet of the edited file:
   277→**In Progress:**
   278→- Cross-platform agent builds (Linux/Windows/macOS)
   279→- Extended metrics on build server
   280→
   281→## Feature Targets (100+ features)
   282→
   283→### Agent Features - Core Monitoring
   284→1. CPU metrics collection and reporting
   285→2. Memory metrics collection and reporting
   286→3. Disk metrics collection (all drives)
   287→4. Network throughput monitoring
   288→5. System uptime tracking
   289→6. OS information collection
   290→7. Temperature sensor monitoring
   291→8. Public IP detection
   292→9. Network interface enumeration
   293→10. User idle time tracking
   294→
   295→### Agent Features - Process Monitoring
   296→11. Running process enumeration
   297→12. Process CPU/memory usage tracking
   298→13. Process start/stop detection
   299→14. Process blacklist/whitelist enforcement
   300→15. Suspicious process alerting
   301→
   302→### Agent Features - Event Log Monitoring
   303→16. Windows Event Log collection
   304→17. Linux syslog/journald collection
   305→18. Event filtering by severity
   306→19. Event pattern matching
   307→20. Security event alerting
   308→
   309→### Agent Features - Command Execution
   310→21. PowerShell command execution
   311→22. Bash command execution
   312→23. Command result streaming
   313→24. Script library execution
   314→25. Scheduled script execution
   315→
   316→### Agent Features - Service Management
   317→26. Service watchdog monitoring
   318→27. Service auto-restart capability
   319→28. Service status reporting
   320→29. Service start/stop commands
   321→30. Service dependency tracking
   322→
   323→### Agent Features - Self-Management
   324→31. Self-update download and verification
   325→32. Atomic update installation
   326→33. Update rollback on failure
   327→34. Configuration hot-reload
   328→35. Diagnostic logging
   329→
   330→### Agent Features - Platform Support
   331→36. Windows service installation
   332→37. Linux systemd service installation
   333→38. macOS launchd installation
   334→39. Legacy Windows support (2008 R2)
   335→40. ARM64 support
   336→
   337→### Agent Features - User Interface
   338→41. Windows tray icon display
   339→42. Tray connection status indicator
   340→43. Tray support ticket form
   341→44. Screenshot capture for tickets
   342→45. IPC named pipe server
   343→
   344→### Agent Features - Communication
   345→46. WebSocket connection management
   346→47. Heartbeat mechanism
   347→48. Reconnection with backoff
   348→49. TLS certificate handling
   349→50. Message queuing (offline support)
   350→
   351→### Agent Features - Lockdown Mode
   352→51. Network firewall control (block all except RMM)
   353→52. Application blacklist enforcement
   354→53. Process termination by policy
   355→54. USB device blocking
   356→55. Lockdown status reporting
   357→56. Evidence preservation (snapshot)
   358→57. Lockdown release mechanism
   359→
   360→### Server Features - Authentication
   361→58. Agent registration endpoint
   362→59. JWT authentication
   363→60. API key authentication
   364→61. SSO integration (Entra ID)
   365→62. Multi-factor authentication support
   366→63. Session management
   367→
   368→### Server Features - Authorization
   369→64. Multi-tenant authorization
   370→65. Role-based access control
   371→66. Organization-level permissions
   372→67. Resource-level permissions
   373→68. API rate limiting
   374→
   375→### Server Features - Client/Site Management
   376→69. Client CRUD operations
   377→70. Site CRUD operations
   378→71. Site code generation
   379→72. API key rotation
   380→73. Client/Site hierarchy
   381→
   382→### Server Features - Agent Management
   383→74. Agent listing and filtering
   384→75. Agent status tracking
   385→76. Agent grouping/tagging
   386→77. Bulk agent operations
   387→78. Agent deletion/decommission
   388→
   389→### Server Features - Metrics & Data
   390→79. Metrics storage and retrieval
   391→80. Metrics time-range queries
   392→81. Metrics aggregation
   393→82. Data retention policies
   394→83. Metrics export
   395→
   396→### Server Features - Commands
   397→84. Command dispatch via WebSocket
   398→85. Command history storage
   399→86. Command templates/library
   400→87. Scheduled commands
   401→88. Bulk command execution
   402→
   403→### Server Features - Policies
   404→89. Policy CRUD operations
   405→90. Policy assignment management
   406→91. Policy merge evaluation
   407→92. Policy templates
   408→93. Policy versioning
   409→
   410→### Server Features - Alerts
   411→94. Alert threshold evaluation
   412→95. Duration-based alert logic
   413→96. Alert acknowledgment workflow
   414→97. Alert resolution workflow
   415→98. Alert escalation rules
   416→99. Alert notification (email/webhook)
   417→
   418→### Server Features - Lockdown Mode
   419→100. Lockdown trigger endpoint
   420→101. Tiered lockdown (machine/site/client/global)
   421→102. Lockdown status dashboard
   422→103. Lockdown audit logging
   423→104. Emergency lockdown broadcast
   424→
   425→### Server Features - Updates
   426→105. Update version scanning
   427→106. Update trigger endpoint
   428→107. Update rollout policies
   429→108. Update status tracking
   430→
   431→### Server Features - Infrastructure
   432→109. WebSocket connection pooling
   433→110. Heartbeat monitoring
   434→111. Agent timeout detection
   435→112. Organization limits enforcement
   436→113. Audit logging
   437→
   438→### Dashboard Features - Authentication
   439→114. Login page with form validation
   440→115. Registration page
   441→116. SSO redirect handling
   442→117. Password reset flow
   443→118. MFA setup page
   444→
   445→### Dashboard Features - Overview
   446→119. Dashboard overview page
   447→120. Summary statistics widgets
   448→121. Recent alerts widget
   449→122. Agent status summary
   450→123. Quick actions panel
   451→
   452→### Dashboard Features - Agent Management
   453→124. Agents list with status
   454→125. Agent detail with metrics
   455→126. Metrics charts (Recharts)
   456→127. Agent actions menu
   457→128. Agent bulk selection
   458→
   459→### Dashboard Features - Client/Site
   460→129. Client management page
   461→130. Site management page
   462→131. Site code display
   463→132. API key regeneration UI
   464→133. Client/Site tree view
   465→
   466→### Dashboard Features - Commands
   467→134. Command execution form
   468→135. Command history display
   469→136. Script library browser
   470→137. Command output viewer
   471→138. Bulk command UI
   472→
   473→### Dashboard Features - Alerts
   474→139. Alert listing page
   475→140. Alert acknowledgment UI
   476→141. Alert detail view
   477→142. Alert filtering/search
   478→143. Alert notification settings
   479→
   480→### Dashboard Features - Lockdown
   481→144. Lockdown control panel
   482→145. Lockdown status indicators
   483→146. Lockdown history/audit
   484→147. Emergency lockdown button
   485→148. Lockdown release confirmation
   486→
   487→### Dashboard Features - Settings
   488→149. Settings page
   489→150. Organization management
   490→151. User management
   491→152. Policy editor
   492→153. Notification preferences
   493→
   494→### Dashboard Features - UX
   495→154. Responsive mobile layout
   496→155. Protected route guards
   497→156. Session management
   498→157. Keyboard shortcuts
   499→158. Dark mode support
   500→159. Minimal-click workflows
   501→
   502→## Testing Strategy
   503→
   504→Each feature should include:

## Feature Targets (100+ features)

### Agent Features - Core Monitoring
1. CPU metrics collection and reporting
2. Memory metrics collection and reporting
3. Disk metrics collection (all drives)
4. Network throughput monitoring
5. System uptime tracking
6. OS information collection
7. Temperature sensor monitoring
8. Public IP detection
9. Network interface enumeration
10. User idle time tracking

### Agent Features - Process Monitoring
11. Running process enumeration
12. Process CPU/memory usage tracking
13. Process start/stop detection
14. Process blacklist/whitelist enforcement
15. Suspicious process alerting

### Agent Features - Event Log Monitoring
16. Windows Event Log collection
17. Linux syslog/journald collection
18. Event filtering by severity
19. Event pattern matching
20. Security event alerting

### Agent Features - Command Execution
21. PowerShell command execution
22. Bash command execution
23. Command result streaming
24. Script library execution
25. Scheduled script execution

### Agent Features - Service Management
26. Service watchdog monitoring
27. Service auto-restart capability
28. Service status reporting
29. Service start/stop commands
30. Service dependency tracking

### Agent Features - Self-Management
31. Self-update download and verification
32. Atomic update installation
33. Update rollback on failure
34. Configuration hot-reload
35. Diagnostic logging

### Agent Features - Platform Support
36. Windows service installation
37. Linux systemd service installation
38. macOS launchd installation
39. Legacy Windows support (2008 R2)
40. ARM64 support

### Agent Features - User Interface
41. Windows tray icon display
42. Tray connection status indicator
43. Tray support ticket form
44. Screenshot capture for tickets
45. IPC named pipe server

### Agent Features - Communication
46. WebSocket connection management
47. Heartbeat mechanism
48. Reconnection with backoff
49. TLS certificate handling
50. Message queuing (offline support)

### Agent Features - Lockdown Mode
51. Network firewall control (block all except RMM)
52. Application blacklist enforcement
53. Process termination by policy
54. USB device blocking
55. Lockdown status reporting
56. Evidence preservation (snapshot)
57. Lockdown release mechanism

### Server Features - Authentication
58. Agent registration endpoint
59. JWT authentication
60. API key authentication
61. SSO integration (Entra ID)
62. Multi-factor authentication support
63. Session management

### Server Features - Authorization
64. Multi-tenant authorization
65. Role-based access control
66. Organization-level permissions
67. Resource-level permissions
68. API rate limiting

### Server Features - Client/Site Management
69. Client CRUD operations
70. Site CRUD operations
71. Site code generation
72. API key rotation
73. Client/Site hierarchy

### Server Features - Agent Management
74. Agent listing and filtering
75. Agent status tracking
76. Agent grouping/tagging
77. Bulk agent operations
78. Agent deletion/decommission

### Server Features - Metrics & Data
79. Metrics storage and retrieval
80. Metrics time-range queries
81. Metrics aggregation
82. Data retention policies
83. Metrics export

### Server Features - Commands
84. Command dispatch via WebSocket
85. Command history storage
86. Command templates/library
87. Scheduled commands
88. Bulk command execution

### Server Features - Policies
89. Policy CRUD operations
90. Policy assignment management
91. Policy merge evaluation
92. Policy templates
93. Policy versioning

### Server Features - Alerts
94. Alert threshold evaluation
95. Duration-based alert logic
96. Alert acknowledgment workflow
97. Alert resolution workflow
98. Alert escalation rules
99. Alert notification (email/webhook)

### Server Features - Lockdown Mode
100. Lockdown trigger endpoint
101. Tiered lockdown (machine/site/client/global)
102. Lockdown status dashboard
103. Lockdown audit logging
104. Emergency lockdown broadcast

### Server Features - Updates
105. Update version scanning
106. Update trigger endpoint
107. Update rollout policies
108. Update status tracking

### Server Features - Infrastructure
109. WebSocket connection pooling
110. Heartbeat monitoring
111. Agent timeout detection
112. Organization limits enforcement
113. Audit logging

### Dashboard Features - Authentication
114. Login page with form validation
115. Registration page
116. SSO redirect handling
117. Password reset flow
118. MFA setup page

### Dashboard Features - Overview
119. Dashboard overview page
120. Summary statistics widgets
121. Recent alerts widget
122. Agent status summary
123. Quick actions panel

### Dashboard Features - Agent Management
124. Agents list with status
125. Agent detail with metrics
126. Metrics charts (Recharts)
127. Agent actions menu
128. Agent bulk selection

### Dashboard Features - Client/Site
129. Client management page
130. Site management page
131. Site code display
132. API key regeneration UI
133. Client/Site tree view

### Dashboard Features - Commands
134. Command execution form
135. Command history display
136. Script library browser
137. Command output viewer
138. Bulk command UI

### Dashboard Features - Alerts
139. Alert listing page
140. Alert acknowledgment UI
141. Alert detail view
142. Alert filtering/search
143. Alert notification settings

### Dashboard Features - Lockdown
144. Lockdown control panel
145. Lockdown status indicators
146. Lockdown history/audit
147. Emergency lockdown button
148. Lockdown release confirmation

### Dashboard Features - Settings
149. Settings page
150. Organization management
151. User management
152. Policy editor
153. Notification preferences

### Dashboard Features - UX
154. Responsive mobile layout
155. Protected route guards
156. Session management
157. Keyboard shortcuts
158. Dark mode support
159. Minimal-click workflows

# GuruRMM - Remote Monitoring and Management System

## Overview

GuruRMM is a production-grade, open-source Remote Monitoring and Management (RMM) system designed for Managed Service Providers (MSPs). It enables IT professionals to monitor, manage, and maintain client endpoints remotely through a centralized dashboard.

**Built by an MSP, for MSPs** - Created by an MSP owner with 25+ years of experience who understands the pain points of existing tools.

## Vision: The Guru Suite

GuruRMM is part of a larger vision - a complete suite of natively integrated MSP tools:

```
┌─────────────────────────────────────────────────────────────────┐
│                    GURU SUITE PLATFORM                          │
│         (Shared data layer, unified authentication,             │
│          consistent UX, native integrations)                    │
├─────────────────┬─────────────────┬─────────────────────────────┤
│   GuruRMM       │    GuruPSA      │   Future Products           │
│   (This build)  │   (Parallel)    │                             │
├─────────────────┼─────────────────┼─────────────────────────────┤
│ • Monitoring    │ • Ticketing     │ • Remote Control Platform   │
│ • Patch Mgmt    │ • Billing       │ • AV / EDR                  │
│ • Automation    │ • Contracts     │ • Backup Monitoring         │
│ • Policies      │ • Time Tracking │ • Network Monitoring        │
│ • Alerting      │ • CRM           │ • Documentation/Wiki        │
│ • Scripting     │ • Reporting     │ • Asset Management          │
│ • Deployment    │ • Portal        │ • Mobile Device Mgmt        │
└─────────────────┴─────────────────┴─────────────────────────────┘
```

## Key Differentiators

**Philosophy: "No half-measures, excellence in all categories"**

1. **Native Integration** - No bolted-on feel, everything shares context
2. **Modern UX** - Fewer clicks, intuitive navigation
3. **Deep RMM Capabilities** - Enterprise-grade monitoring
4. **Flexible Policies** - Better than competitors' frustrating policy management
5. **Emergency Response / Lockdown Mode** - Unique incident response feature

### Competitive Pain Points to Address

**From SyncroRMM:**
- Lacks depth in monitoring capabilities
- No process monitoring
- No Event Log monitoring
- No lockdown mode
- Limited advanced automation

**From DattoRMM:**
- Too many clicks to accomplish tasks
- Unintuitive navigation
- Frustrating policy management
- Dated UI design

## Lockdown Mode (Unique Feature)

A critical security incident response capability:

**Capabilities:**
- Kill all network communication except RMM management traffic
- Blacklist applications/programs
- Force infection into submission
- Evidence preservation during incident

**Tiered Escalation:**
- Single machine lockdown
- Site-wide lockdown
- Client-wide lockdown
- Global lockdown (all endpoints)

**Use Cases:**
- Ransomware containment
- Active breach response
- Malware isolation
- Forensic preservation

## Technology Stack

- **Agent:** Rust (cross-platform: Windows, Linux, macOS)
- **Server:** Rust with Axum web framework
- **Dashboard:** React 19 + TypeScript + Vite
- **Database:** PostgreSQL 16
- **Communication:** WebSocket (real-time), REST API
- **Styling:** Tailwind CSS 4.1
- **Authentication:** JWT tokens + API keys + SSO (Microsoft Entra ID)

## Architecture

```
Endpoints (Windows/Linux/macOS)
    │
    │ WebSocket (TLS)
    ▼
┌─────────────────┐
│  Rust Server    │◄──── REST API ────► React Dashboard
│  (Axum)         │
└────────┬────────┘
         │
         ▼
    PostgreSQL
```

## Core Components

### 1. Agent (Rust Binary)
**Location:** `agent/`

The agent runs on managed endpoints and provides:

**Metrics Collection:**
- CPU usage percentage
- Memory usage (percent, used/total bytes)
- Disk usage (percent, used/total bytes, per-disk)
- Network throughput (RX/TX bytes)
- System uptime and boot time
- OS type and version
- Hostname and device ID
- Logged-in user and idle time
- Public/WAN IP address
- Temperature sensors (CPU, GPU, all available)
- Network interfaces (local IPs)

**Command Execution:**
- PowerShell execution (Windows)
- Bash execution (Linux/macOS)
- Exit code, stdout, stderr capture
- Result streaming back to server

**Service Watchdog:**
- Monitor specified Windows/Linux services
- Track service restart events
- Alert on service failures
- Auto-restart capability (configurable via policy)

**Self-Update System:**
- Download updates from server
- SHA256 checksum verification
- Atomic binary replacement
- Auto-rollback on connection failure

**Windows System Tray:**
- Status indicator icon (green/yellow/red/gray)
- IPC via named pipes
- Support ticket creation form
- Screenshot capture for tickets
- Connection status display

**Platform Support:**
- Windows 10/11, Server 2016+ (native service)
- Windows 7, Server 2008 R2 (legacy mode via NSSM)
- Linux (systemd service)
- macOS (launchd - planned)

### 2. Server (Rust/Axum)
**Location:** `server/`

The server provides:

**API Endpoints:**
- Authentication (login, register, SSO callbacks)
- User management (CRUD, role assignment)
- Client/Organization management
- Site management (codes, API keys)
- Agent management (registration, status, updates)
- Metrics retrieval and aggregation
- Command execution and history
- Policy management (CRUD, assignments)
- Alert management (thresholds, acknowledgment)

**Real-Time Communication:**
- WebSocket endpoint for agent connections
- Connection pooling and state tracking
- Message dispatch to online agents
- Heartbeat monitoring

**Authentication & Authorization:**
- JWT token-based auth for dashboard users
- API key authentication for agents
- Multi-tenant authorization (organizations)
- Role-based access control (admin, org_admin, org_user, tech)
- Microsoft Entra ID SSO integration

**Policy System:**
- Stackable policies (JSON configuration)
- Priority-based merge logic
- Assignments at client/site/agent level
- Policy templates for common configurations

**Alert System:**
- Threshold-based alert triggering
- Duration-based alerts (e.g., CPU > 80% for 5 minutes)
- Severity levels (info, warning, critical)
- Alert deduplication
- Acknowledgment and resolution workflow

**Update Management:**
- Version scanning and storage
- Update packaging and distribution
- On-demand update triggers

### 3. Dashboard (React + TypeScript)
**Location:** `dashboard/`

The dashboard provides:

**Pages:**
- Login/Register with SSO support
- Dashboard overview with summary stats
- Agents list with status indicators
- Agent detail with metrics charts
- Clients management
- Sites management with codes and API keys
- Commands execution and history
- Alerts management
- Settings (user, organization)

**Features:**
- Real-time metric visualization (Recharts)
- Agent status indicators (online/offline)
- Command execution interface
- Protected routes with JWT auth
- Responsive design

## Database Schema

**Core Tables:**
- `agents` - Endpoint devices with status tracking
- `metrics` - Time-series system metrics
- `agent_state` - Latest agent snapshots
- `users` - Dashboard users with roles
- `user_organizations` - Multi-tenant user mapping
- `clients` - Organizations/companies
- `sites` - Locations under clients
- `commands` - Executed commands with results
- `watchdog_events` - Service monitoring events
- `policies` - Configuration templates
- `policy_assignments` - Policy-to-target mappings
- `alerts` - Threshold violation alerts
- `alert_threshold_state` - Duration-based tracking

## WebSocket Protocol

**Agent → Server:**
- Auth (initial authentication)
- Metrics (periodic submission)
- NetworkState (interface updates)
- CommandResult (execution results)
- WatchdogEvent (service status)
- UpdateResult (update completion)
- Heartbeat (keep-alive)

**Server → Agent:**
- AuthAck (authentication response)
- Command (execute on agent)
- ConfigUpdate (push configuration)
- Update (trigger update)
- Ack/Error (responses)

## Current Implementation Status

**Completed:**
- Multi-client/multi-site architecture
- Agent registration and management
- Real-time metrics collection
- Command execution (PowerShell, Bash)
- Service watchdog monitoring
- Alert system with thresholds
- Policy-based configuration
- Multi-tenant authorization
- SSO authentication (Entra ID)
- Windows system tray integration
- Self-update mechanism
- Temperature monitoring

**In Progress:**
- Cross-platform agent builds (Linux/Windows/macOS)
- Extended metrics on build server

## Feature Targets (50-75 features)

### Agent Features
1. CPU metrics collection and reporting
2. Memory metrics collection and reporting
3. Disk metrics collection (all drives)
4. Network throughput monitoring
5. System uptime tracking
6. OS information collection
7. Temperature sensor monitoring
8. Public IP detection
9. Network interface enumeration
10. User idle time tracking
11. PowerShell command execution
12. Bash command execution
13. Command result streaming
14. Service watchdog monitoring
15. Service auto-restart capability
16. Self-update download and verification
17. Atomic update installation
18. Update rollback on failure
19. Windows service installation
20. Linux systemd service installation
21. Windows tray icon display
22. Tray connection status indicator
23. Tray support ticket form
24. Screenshot capture for tickets
25. IPC named pipe server
26. WebSocket connection management
27. Heartbeat mechanism
28. Reconnection with backoff
29. TLS certificate handling
30. Legacy Windows support (2008 R2)

### Server Features
31. Agent registration endpoint
32. JWT authentication
33. API key authentication
34. SSO integration (Entra ID)
35. Multi-tenant authorization
36. Role-based access control
37. Client CRUD operations
38. Site CRUD operations
39. Site code generation
40. API key rotation
41. Agent listing and filtering
42. Agent status tracking
43. Metrics storage and retrieval
44. Metrics time-range queries
45. Command dispatch via WebSocket
46. Command history storage
47. Policy CRUD operations
48. Policy assignment management
49. Policy merge evaluation
50. Alert threshold evaluation
51. Duration-based alert logic
52. Alert acknowledgment workflow
53. Alert resolution workflow
54. Update version scanning
55. Update trigger endpoint
56. WebSocket connection pooling
57. Heartbeat monitoring
58. Agent timeout detection
59. Organization limits enforcement
60. User impersonation (dev admin)

### Dashboard Features
61. Login page with form validation
62. Registration page
63. SSO redirect handling
64. Dashboard overview page
65. Agents list with status
66. Agent detail with metrics
67. Metrics charts (Recharts)
68. Client management page
69. Site management page
70. Site code display
71. API key regeneration UI
72. Command execution form
73. Command history display
74. Alert listing page
75. Alert acknowledgment UI
76. Settings page
77. Organization management
78. Responsive mobile layout
79. Protected route guards
80. Session management

## Testing Strategy

Each feature should include:
- Unit tests for core logic
- Integration tests for API endpoints
- E2E tests for critical user flows

**Test Commands:**
- Agent: `cargo test` in `agent/`
- Server: `cargo test` in `server/`
- Dashboard: `npm test` in `dashboard/`

## Build Commands

**Agent:**
```bash
cd agent
cargo build --release
# Cross-compile for Windows from Linux:
cargo build --release --target x86_64-pc-windows-gnu
```

**Server:**
```bash
cd server
cargo build --release
```

**Dashboard:**
```bash
cd dashboard
npm install
npm run build
```

## Environment Configuration

**Server (.env):**
- DATABASE_URL - PostgreSQL connection string
- JWT_SECRET - Token signing secret
- CORS_ORIGINS - Allowed dashboard origins
- SSO_CLIENT_ID - Entra ID client
- SSO_CLIENT_SECRET - Entra ID secret

**Agent (config.toml):**
- server_url - API endpoint
- site_code - Registration code
- api_key - Authentication key

## External Dependencies

**Server:** Axum, Tokio, SQLx, jsonwebtoken, oauth2
**Agent:** Tokio, sysinfo, tokio-tungstenite, windows-service
**Dashboard:** React, React Query, Axios, Recharts, Tailwind

## Notes for AutoCoder

1. The project uses Rust 2021 edition
2. SQLx requires DATABASE_URL at compile time for query checking
3. Agent must handle graceful shutdown for service managers
4. WebSocket messages use JSON serialization
5. All timestamps should be UTC
6. Passwords are hashed with bcrypt
7. API keys are hashed (SHA256) before storage
8. Site codes are human-readable (e.g., "BLUE-TIGER-4829")

-16. Self-update download and verification

+### Agent Features - Process Monitoring

+14. Process blacklist/whitelist enforcement

+### Agent Features - Event Log Monitoring

+### Agent Features - Service Management

+31. Self-update download and verification

+51. Network firewall control (block all except RMM)

+62. Multi-factor authentication support

+### Server Features - Client/Site Management

+101. Tiered lockdown (machine/site/client/global)

+### Dashboard Features - Authentication

+### Dashboard Features - Agent Management


I've updated the app_spec.txt with:
1. The Guru Suite vision
2. Key differentiators and philosophy
3. Competitive pain points to address
4. The Lockdown Mode feature (detailed)
5. Expanded feature list from 80 to 159 features, including:
   - Process monitoring (addresses Syncro weakness)
   - Event Log monitoring (addresses Syncro weakness)
   - Lockdown Mode features (agent-side, server-side, dashboard)
   - Better organized categories
   - UX features like minimal-click workflows (addresses Datto weakness)

The app_spec.txt is now much more comprehensive and includes the context from the session_context.md file.


Done! I've updated `app_spec.txt` to include:

**Added from your session context:**
- Your 25+ years MSP background
- The Guru Suite vision diagram
- Key differentiators and philosophy
- Competitive pain points (Syncro, Datto)
- **Lockdown Mode** - fully detailed with capabilities and tiered escalation

**Expanded feature list from 80 → 159 features:**

| Category | Features |
|----------|----------|
| Agent - Core Monitoring | 1-10 |
| Agent - Process Monitoring | 11-15 (addresses Syncro gap) |
| Agent - Event Log Monitoring | 16-20 (addresses Syncro gap) |
| Agent - Command Execution | 21-25 |
| Agent - Service Management | 26-30 |
| Agent - Self-Management | 31-35 |
| Agent - Platform Support | 36-40 |
| Agent - User Interface | 41-45 |
| Agent - Communication | 46-50 |
| **Agent - Lockdown Mode** | 51-57 |
| Server - Authentication | 58-63 |
| Server - Authorization | 64-68 |
| Server - Client/Site | 69-73 |
| Server - Agent Management | 74-78 |
| Server - Metrics & Data | 79-83 |
| Server - Commands | 84-88 |
| Server - Policies | 89-93 |
| Server - Alerts | 94-99 |
| **Server - Lockdown Mode** | 100-104 |
| Server - Updates | 105-108 |
| Server - Infrastructure | 109-113 |
| Dashboard - Authentication | 114-118 |
| Dashboard - Overview | 119-123 |
| Dashboard - Agent Management | 124-128 |
| Dashboard - Client/Site | 129-133 |
| Dashboard - Commands | 134-138 |
| Dashboard - Alerts | 139-143 |
| **Dashboard - Lockdown** | 144-148 |
| Dashboard - Settings | 149-153 |
| Dashboard - UX | 154-159 (addresses Datto "too many clicks") |

The spec is now ready for AutoCoder's initializer agent.


Using the prompt that autocoder uses to initially create the appspec file, is there anything else we should discuss about it?


The user wants to see the AutoCoder prompt that's used to create the app_spec file, so we can compare and see if there's anything missing or that should be discussed. Let me find and read that prompt file.