claudetools/session-logs/2026-06-06-mike-mcp-gitauth-reinstall-tailscale.md

User

• User: Mike Swanson (mike)
• Machine: GURU-5070
• Role: admin

Session Summary

Started from a /doctor report flagging the ticktick MCP server as failed ("Connection closed"). Diagnosed it as a missing-dependency crash, not an OAuth issue: the local stdio server mcp-servers/ticktick/ticktick_mcp.py is launched with bare python (Python 3.12) and that interpreter was missing httpx and (behind a try/except) mcp. Installed both into 3.12, created mcp-servers/ticktick/requirements.txt, and verified the server starts clean. The server now shows "Pending approval" (normal trust prompt) instead of crashing.

Mike then stated a hard requirement: git must never sit at an interactive credential prompt — his objection to Git for Windows is the Git Credential Manager popups that hang automation, not the tooling itself. Discovered a live symptom: a backgrounded Gitea Agent push was hung on a GCM prompt (commit unpushed). Stopped it, pushed via the vault Gitea API token, then built a durable, fleet-wide non-interactive auth solution: setup-git-auth.sh (primes the store credential helper from the vault token, scoped per-repo by origin host, only seizing the helper from GCM manager), a backgrounded SessionStart hook, and GIT_TERMINAL_PROMPT=0 / GCM_INTERACTIVE=Never in settings.json env. Corrected an earlier wrong memory (had attributed the dislike to the bash/path-mangling layer). All subsequent pushes this session used native git.exe via PowerShell with zero prompts.

Mike disclosed the machine was recently reinstalled and asked to install anything missing. Found the reinstall installed Python deps into only one of the machine's two interpreters (py/3.14 for vault+scripts vs python/3.12 for MCP servers), which is exactly why ticktick (3.12) and vault get-field (3.14, missing PyYAML) were both broken. Installed PyYAML into py, websocket-client into py (cdp.py), and persisted grok to the User PATH. Ollama list came back empty, but the 5 expected models (47.8 GB) were intact on D:\OllamaModels — the tray app just needed a few seconds to hydrate; restarting it loaded all 5. No 48 GB re-download. Then amended the recovery script windows-bootstrap.ps1 (Phase 7 both interpreters + pyyaml/websocket-client; Phase 3 persist grok PATH; Phase 6 prime git auth; Phase 8 full model set + hydration guard) and documented the gotchas in machines/guru-5070.md.

Finally, Mike asked for help managing Tailscale for a tech-inept two-machine client. Recommended one tailnet per client (never merge into ACG's own), MSP holds Admin, devices enrolled as tagged nodes via pre-auth keys pushed from GuruRMM. Authored wiki/patterns/tailscale-client-management.md + tailscale-client-enroll.ps1 (idempotent unattended Windows MSI install + tagged auth-key join). Scanned GuruRMM for the client (Robert Wolkin): found client Wolkin, Robert/site Main with 3 online Win11 Home agents. Mike clarified scope: connect RSW-Laptop -> front for file + printer sharing; DESKTOP-V1JT1SE is Bob's personal machine (out of scope). Created the robert-wolkin client stub, then added a reusable "files + printer over Tailscale (Windows)" section (SMB over the tailnet, the 445-firewall-on-Tailscale-interface gotcha, local-account auth on Home, MagicDNS FQDN, Point-and-Print via RMM, Taildrive alternative).

Key Decisions

• ticktick fix is dependency install, not OAuth. "Connection closed" on a local stdio MCP server = process crash before handshake. /mcp authenticate would not have helped.
• Non-interactive git auth via repo-local store helper, not global change. Kept global GCM untouched for other repos; scoped the credential to each repo's actual origin host. GIT_TERMINAL_PROMPT=0 enforced via committed settings.json so even an unprimed machine fails fast instead of hanging.
• Conservative helper override. setup-git-auth.sh only switches the helper to store when it is empty or GCM manager, so a Mac osxkeychain setup is left alone — safe to run fleet-wide via SessionStart hook.
• Two-interpreter Python installs in bootstrap. Root cause of the reinstall breakage; de-dupe by sys.executable so a single install isn't run twice.
• Did not re-download Ollama models. Confirmed manifests + 47.8 GB on D:\OllamaModels; an empty ollama list right after login is a hydration-timing artifact, not "models gone."
• One tailnet per client. Isolation, billing, offboarding, IdP blast radius. Never merge a client into ACG's tailnet or share one tailnet across clients.
• SMB over Tailscale for Wolkin (not Taildrive). A shared printer forces SMB regardless, so use SMB for both files and printer; no subnet router because files/printer live on a node.
• Session log to root (session-logs/) — multi-topic (machine maintenance + git infra + a client), no single article implied; wiki articles were hand-authored inline during the session.

Problems Encountered

• ticktick MCP "Connection closed": missing httpx then mcp in Python 3.12. Installed both; server starts clean.
• Gitea Agent background push hung: GCM credential prompt invisible in background. Stopped the agent (TaskStop), pushed with the vault API token, then made auth non-interactive permanently.
• git credential approve rejected input: PowerShell piping mangled the multiline credential ("missing protocol field"). Wrote directly to ~/.git-credentials idempotently instead.
• PowerShell commit failed on embedded double quotes: "see each other" in a commit message split into stray pathspecs (PS 5.1 native-arg quoting bug). Used git commit -F <msgfile> / avoided embedded quotes.
• vault get-field returned empty: yaml-query.py (run via py/3.14) missing PyYAML. Installed pyyaml; added a get+grep fallback to setup-git-auth.sh.
• Ollama list empty despite 47.8 GB on disk: tray app server hydration delay (also the app vs CLI env). Restarted; all 5 models loaded. Documented as a bootstrap Phase 8 guard.
• GuruRMM showed 3 agents, Mike expected 2: clarified DESKTOP-V1JT1SE is Bob's personal machine, out of Tailscale scope.

Configuration Changes

Created:

• mcp-servers/ticktick/requirements.txt — httpx>=0.28, mcp>=1.27
• .claude/scripts/setup-git-auth.sh — non-interactive git auth primer
• .claude/memory/feedback_git_noninteractive_auth.md — feedback memory (replaced the deleted feedback_avoid_git_for_windows.md)
• wiki/patterns/tailscale-client-management.md — MSP Tailscale pattern
• wiki/patterns/tailscale-client-enroll.ps1 — GuruRMM enrollment script
• wiki/clients/robert-wolkin.md — client stub

Modified:

• .claude/agents/gitea.md — "Non-interactive auth" guidance block
• .claude/settings.json — env (GIT_TERMINAL_PROMPT=0, GCM_INTERACTIVE=Never) + SessionStart hook for setup-git-auth.sh
• .claude/bootstrap/windows-bootstrap.ps1 — Phases 3, 6, 7, 8 amended
• .claude/machines/guru-5070.md — Known issues (interpreter split, ollama hydration, grok PATH, git auth)
• .claude/memory/MEMORY.md — index pointer
• wiki/index.md — Patterns + Clients rows

Deleted:

• .claude/memory/feedback_avoid_git_for_windows.md (superseded, never committed)

Machine state (not in repo):

• Python 3.12 (python): installed httpx, mcp
• Python 3.14 (py): installed pyyaml, websocket-client
• User PATH: appended ~\.grok\bin (also ~\.local\bin, %APPDATA%\npm)
• ~/.git-credentials: two store entries (internal + public Gitea hosts); stale %3a3000 entry removed
• Ollama: restarted; 5 models loaded from D:\OllamaModels

Credentials & Secrets

• Gitea shared push account: azcomputerguru, API token used for non-interactive push. Vault: services/gitea.sops.yaml field credentials.api.api-token (also credentials.password). Token cached locally in C:\Users\guru\.git-credentials (plaintext, local-only, scoped to 172.16.3.20:3000 + git.azcomputerguru.com).
• GuruRMM API admin: vault infrastructure/gururmm-server.sops.yaml fields credentials.gururmm-api.admin-email / admin-password.
• No new secrets created. Tailscale auth key for Wolkin not yet generated (pending Mike standing up the tailnet).

Infrastructure & Servers

• Gitea (internal): http://172.16.3.20:3000 (origin for claudetools push this session). Public: https://git.azcomputerguru.com (vault repo origin).
• GuruRMM API: http://172.16.3.30:3001 (JWT auth).
• MariaDB: 172.16.3.30:3306 (firewall opened to 172.16.0.0/22 per incoming coord message; not exercised this session).
• GURU-5070 interpreters: py -> Python 3.14 (C:\Users\guru\AppData\Local\Programs\Python\...); python -> Python 3.12.
• Ollama: OLLAMA_MODELS=D:\OllamaModels, OLLAMA_HOST=0.0.0.0:11434. Models: nomic-embed-text, qwen3:8b, qwen3:14b, codestral:22b, qwen3.6:latest.

Robert Wolkin (GuruRMM)

• Client: Wolkin, Robert | Site: Main | site_id 2bb05f85-9fc8-4a7e-a5e5-ffe0c46431ac
• Agents (Win 11 Home 25H2 build 26200, agent v0.6.57, all online 2026-06-06):
  • DESKTOP-V1JT1SE — 30f6af79-ab19-4ed3-9ebc-71b2bffc2d27 — Bob's personal machine (OUT of Tailscale scope)
  • RSW-Laptop — 043fd673-35a2-4d3d-8f91-ed73ce70cc1e — Tailscale node (connects to front)
  • front — 877d311a-4b24-462c-97b1-d2a0f7730a71 — Tailscale node (file + printer host)

Commands & Outputs

• ticktick crash: python ticktick_mcp.py -> ModuleNotFoundError: No module named 'httpx', then [ERROR] MCP package not installed.
• Installs: python -m pip install httpx; python -m pip install mcp; py -m pip install pyyaml; py -m pip install websocket-client.
• Non-interactive push pattern: $env:GIT_TERMINAL_PROMPT='0'; git -C D:\ClaudeTools push origin main (succeeds silently; PS 5.1 wraps git stderr as NativeCommandError on success — trust $LASTEXITCODE).
• Prime creds: append http://azcomputerguru:<token>@172.16.3.20:3000 to ~/.git-credentials + repo-local credential.helper=store.
• Ollama fix: stop ollama/ollama app, start ollama app.exe, wait ~10s -> ollama list shows 5 models.
• GuruRMM lookup: POST /api/auth/login then GET /api/agents, filter .client_name=="Wolkin, Robert".
• Firewall rule (planned for front): New-NetFirewallRule -DisplayName "Tailscale SMB (files+print)" -Direction Inbound -Action Allow -Protocol TCP -LocalPort 445 -RemoteAddress 100.64.0.0/10.

Pending / Incomplete Tasks

• ticktick MCP: restart session or /mcp reconnect to approve (currently "Pending approval"). Crash resolved.
• grok: on persistent User PATH but not callable in THIS already-running session; fine in new shells.
• Tailscale (Wolkin): Mike to stand up the tailnet on Robert's account, assign himself Admin, enable MagicDNS, set tag:wolkin ACL, generate reusable+pre-approved tagged auth key. Then: vault the key at clients/robert-wolkin/tailscale-authkey.sops.yaml, enroll RSW-Laptop + front via the enroll script, push post-connect SMB config.
• OPEN ITEM (blocks printer step): confirm whether the printer is USB-attached to front (Windows print share over SMB) or a separate network printer (install by IP on laptop, or subnet router on front).
• Offered, not yet done: stage the 4 RMM jobs (firewall + share/account on front; drive map + printer on laptop); wire enroll script into a GuruRMM script library vs ad-hoc.
• Pre-existing WIP (not from this session): .claude/bootstrap/backup-to-bundle.ps1, restore-at-risk-work.ps1 (modified), projects/msp-tools/guru-connect (untracked) — swept by sync.sh add -A.

Reference Information

• Commits (origin/main, pushed): f3a175e ticktick requirements; 9ff5a9f0 gitea agent auth docs; 162145b5 git-auth automation; fd30af6a bootstrap amendments + machine doc; 8d7e3805 tailscale pattern + script; 5c7e196b wolkin stub; 32e71a13 wolkin RMM detail + scope; f7540550 SMB files+printer pattern.
• Vault paths: services/gitea.sops.yaml (credentials.api.api-token), infrastructure/gururmm-server.sops.yaml (credentials.gururmm-api.*).
• Tailscale docs: subnet routers tailscale.com/docs/features/subnet-routers; kernel-vs-netstack /docs/reference/kernel-vs-userspace-routers; Windows MSI /docs/install/windows/msi; run unattended /docs/how-to/run-unattended; auth keys /kb/1085/auth-keys; firewall ports /kb/1082/firewall-ports; Taildrive /docs/features/taildrive.
• Tailscale MSI silent props: TS_UNATTENDEDMODE=always, TS_NOLAUNCH, TS_LOGINURL, INSTALLDIR (no auth-key property — use tailscale up --authkey).
• Wiki: wiki/patterns/tailscale-client-management.md, wiki/patterns/tailscale-client-enroll.ps1, wiki/clients/robert-wolkin.md.

---

Update: 20:26 PDT — GuruRMM beta dashboard (spine hitbox + pin feature, 3-way reviewed) + Antigravity/agy dead-end

Summary

Picked up the "RMM Beta Dashboard" project. Recovered context across the 2026-06-05 and 2026-06-06 GuruRMM logs: the dashboard redesign (Phases 1-5 — Shell&Spine, Omnibox, Triage, AgentDetail, design-system — plus ClientDetail reprioritization A/B/C and SPEC-016/025/026/027) is essentially complete and live on beta v0.2.52. The only pending dashboard action is promoting beta -> prod, which Mike deferred ("still polishing"). Confirmed no coord locks/messages on gururmm. Fast-forwarded the submodule from the pinned 226ba9f (39 behind) to origin/main ae025aa to work on current code.

Mike flagged a polish issue: infra spine row hitboxes too small, dead zones "between" items. Diagnosed in dashboard/src/components/ContextTree.tsx: the nav <Link> only wrapped the label (row padding/gaps not clickable) and mb-0.5/mt-0.5 left literal gaps. Fixed (Fitts's Law) by stretching the link to fill the row (absolute inset-0 z-0), making label/icon/status pointer-events-none, removing gaps, py-1.5->py-2. Committed 980152e.

Mike then requested pinning spine items so they stay visible when a client is collapsed. Chose Option B (inline-retain) via an AskUserQuestion mockup: a collapsed client hoists its pinned descendants (pinned sites + agents) flat one indent under it; a collapsed site shows its pinned agents. Built via a Coding Agent: new usePinnedSpineItems localStorage hook (gururmm.spine.pins) + ContextTree render logic. Committed 5bd8589.

Detoured on the Gemini-CLI deprecation banner (June 18). Installed the Antigravity CLI (agy.exe v1.0.6, official antigravity.google/cli/install.ps1, verified Google-domain + Cloud Run source before running). Re-confirmed the 2026-06-05 finding: agy.exe is the IDE embedded agent, NOT a headless CLI — produces zero stdout and hangs when invoked non-interactively (writes to a SQLite conversation store). The agy SKILL already routes to @google/gemini-cli (the real headless tool), which works. Mike has a paid Gemini account, so the plan is to stay on gemini-cli (defer any API-key hardening). Saved memory reference_antigravity_agy_not_headless.md. Verified both second-models authed: grok (OK) and gemini (OK).

Ran the 3-way Multi-AI review (Gemini via agy + Grok + Claude Code Review Agent) on branch polish/infra-tree-hitbox. All three approved; core (mouse hitbox layering, hoist logic, hook re-render) confirmed correct. Applied the 5 agreed fixes (committed 679b919, tsc --noEmit clean). Branch has 3 local commits, NOT merged/pushed — awaiting Mike's go to merge to main (which auto-builds beta). Finished by checking the ff.py Firefox driver to view Mike's tab — daemon not running, and clarified ff.py drives its own Playwright Firefox (can't attach to his regular Firefox window).

Key Decisions

• Append to this session's existing log (same continuous session) rather than a new file, per /save rules.
• Stay on gemini-cli; abandon Antigravity. Paid Gemini account avoids the June 18 free-tier sunset; agy.exe is a confirmed non-headless dead-end. API-key hardening deferred ("cross that bridge later").
• Pin layout = Option B (inline-retain on collapse), Mike's choice over a top "Pinned" tray.
• Did the hitbox fix directly (surgical, 1 file) but delegated the pin feature build to a Coding Agent and ran the full 3-way review before any merge, matching the dashboard's review culture.
• Type-prefixed React keys in the hoist branch (Grok was right: two .maps in one parent share a key namespace; Gemini/Claude were wrong that arrays auto-namespace).
• Hook persistence moved to a useEffect (pure updater) + cross-tab storage listener.

Problems Encountered

• agy.exe no stdout / hangs when run from the Bash/PowerShell tools (exit 0, 0 bytes, or foreground hang). Root cause was already documented in the 2026-06-05 platform-day log (line 35) — the reinstall erased the machine-state knowledge so I re-walked it. Resolved: use @google/gemini-cli; recorded a memory to prevent the next rediscovery. Killed the hung agy.exe processes.
• Submodule working tree 39 commits behind origin/main (pinned). Fast-forwarded via git checkout main && git pull --ff-only.
• Web docs for Antigravity were JS-rendered (WebFetch returned nothing) and search results were polluted with spam npm packages. Resolved by verifying the install vector directly: .google gTLD domain + inspecting the install.ps1 (pulls from Google Cloud Run) before executing.

Configuration Changes (this segment)

• New memory: .claude/memory/reference_antigravity_agy_not_headless.md + MEMORY.md index line.
• Installed agy.exe to C:\Users\guru\AppData\Local\agy\bin and the installer added that dir to the User PATH (dead-end binary; offered to remove, awaiting Mike).
• Submodule projects/msp-tools/guru-rmm (separate repo azcomputerguru/gururmm, NOT the claudetools repo): branch polish/infra-tree-hitbox with commits 980152e, 5bd8589, 679b919. Files: dashboard/src/components/ContextTree.tsx (+~190/-36), new dashboard/src/hooks/usePinnedSpineItems.ts. Local only — not pushed, not merged. The claudetools sync does NOT touch this (different repo); the branch lives in the submodule working tree until Mike merges it.

Pending / Incomplete Tasks (this segment)

• Merge polish/infra-tree-hitbox -> gururmm main when Mike approves -> webhook auto-builds beta. Then optionally promote beta -> prod (whole redesign still beta-only).
• Remove the dead agy.exe install + its User PATH entry (offered).
• API-key hardening for gemini-cli (paid account) deferred — the robust path past June 18 is GEMINI_API_KEY, not Antigravity. Not urgent.
• ff.py: to view a page, launch the daemon + nav (it can't see Mike's own Firefox window).
• Carried from earlier: promote dashboard beta->prod, Mike/Howard re-login for dev_admin reveal, confirm Robert Wolkin printer type (USB vs network), vault GuruRMM Postgres DATABASE_URL, SPEC-018 errors, rotate MSP360 key.

Reference Information (this segment)

• Submodule branch polish/infra-tree-hitbox @ 679b919 (base origin/main ae025aa), repo azcomputerguru/gururmm, dir projects/msp-tools/guru-rmm.
• Dashboard beta v0.2.52; prod promote: sudo /opt/gururmm/promote-dashboard.sh --confirm on 172.16.3.30.
• agy.exe: C:\Users\guru\AppData\Local\agy\bin\agy.exe v1.0.6 (Antigravity CLI; NOT headless). Installer: https://antigravity.google/cli/install.ps1.
• Real second-model backends: @google/gemini-cli (gemini npm, v0.45.2, Google OAuth) via ask-gemini.sh; grok 0.2.22 via ask-grok.sh. Both verified OK.
• Memory added: reference_antigravity_agy_not_headless.md.
• ff.py: .claude/scripts/ff.py, daemon localhost:9333, profile ~/.claude/ff-profile.

---

Update: 2026-06-07 08:13 PDT — GuruRMM beta dashboard: alert-count fix (prod) + 3 sidebar features (rail expand, light-mode theming, resizable spine)

Summary

Merged the prior session's infra-spine hitbox + pin branch to gururmm main (auto-built to beta). Mike then reported the Alerts page summary chips disagreed with the lists they open. Diagnosed TWO predicate mismatches making the list >= the chip: (1) the Critical/Warning chips counted status != 'resolved' but clicked status:"" (all statuses incl. resolved), and (2) get_alert_summary scoped counts to the last 7 days while the alert list has NO time window. Fixed both — chips now click status:"unresolved", and dropped the 7-day window from the summary SQL so all four chips deterministically equal their lists. Code Review APPROVED. Merged 6b4cee4: the dashboard half to beta, the server get_alert_summary change to the SHARED API (= prod immediately).

Mike reported Warning still wrong post-deploy. Diagnosed via the live API + a gururmm RMM-agent tail of /var/log/gururmm-build.log as DEPLOY TIMING, not a bug: the fast Vite dashboard deployed first while the slow Rust server didn't restart with the dropped window until 14:31:33 UTC (after he looked). Confirmed corrected: summary.warning 2->4, total 104->152 (the 2 "missing" warnings were just >7 days old; 0 resolved).

Built three sidebar features (Howard/Mike requests), each Coding-Agent-built + reviewed, each on its own branch -> build-verify -> merge to beta:

• Rail expand (a6d355f): the far-left FunctionRail gets a persistent toggle (localStorage gururmm.rail.expanded, cross-tab) widening it w-12->w-52 with inline labels; expanded mode inlines the "More" items; collapsed unchanged. Code Review APPROVED.
• Sidebar light-mode theming (d2c9236): the left panes were hardcoded always-dark. Gave the light theme a soft-grey --sidebar-bg (95%) / border (88%) and swapped sidebar-surface text-white/N -> text-foreground/N (1:1 opacity) across FunctionRail/InfrastructureSpine/ContextTree, PRESERVING the white-on-red alert badges + the dark hover tooltip. Dark mode unchanged.
• Resizable spine (3c210e0): drag the spine's right edge (180-480px, persisted gururmm.spine.width); width via inline style, transition off mid-drag; setPointerCapture + a teardown ref close the release-outside-window and unmount-mid-drag edge cases; keyboard arrows on the handle. Code Review APPROVED + the 2 robustness fixes applied.

Key Decisions

• Alert fix Part 2 = Option B (drop the 7-day window), Mike-approved despite prod impact (the summary SQL is on the shared API; there is no separate beta API server). status:"unresolved" == the summary's status != 'resolved' because only 3 statuses exist (active/acknowledged/resolved — verified against schema + every write path).
• Each sidebar feature is self-contained in its component (FunctionRail/InfrastructureSpine self-manage state; no Layout.tsx change), reflowing via the existing flex row.
• Theming preserves white-on-colored (badge, tooltip) — only sidebar-surface text/bg/border became foreground tokens.
• Did NOT promote beta -> prod (Mike still reviewing); only the unavoidable server alert-count change is live on prod.
• Deferred the review's FunctionRail DRY (hoist PRIMARY_ITEMS) + aria-current nits to a future sidebar touch.

Problems Encountered

• Warning chip stale post-deploy — deploy timing (slow Rust server restart at 14:31:33 UTC after the fast dashboard), not a logic bug. Confirmed via live API + RMM build-log tail.
• First RMM dispatch failed (jq: Invalid numeric literal) from nested JSON escaping in the command payload; rebuilt with jq -n --arg per the /rmm skill.
• Every feature branch needed a rebase onto main (CI version-bump commits advance main after each merge); each was a clean ff/rebase.

Configuration Changes (submodule projects/msp-tools/guru-rmm, repo azcomputerguru/gururmm — NOT the claudetools repo)

• dashboard/src/pages/Alerts.tsx + server/src/db/alerts.rs — 6b4cee4 (alert chips + drop 7-day window)
• dashboard/src/components/FunctionRail.tsx — a6d355f (rail expand)
• dashboard/src/index.css + FunctionRail.tsx/InfrastructureSpine.tsx/ContextTree.tsx — d2c9236 (theming)
• dashboard/src/components/InfrastructureSpine.tsx — 3c210e0 (resizable)
• All on origin/main (gururmm), deployed to beta; the alerts.rs change also on prod. The claudetools submodule pointer is left at pinned 226ba9f (lagging — expected; not bumped).

Infrastructure & Servers

• gururmm server 172.16.3.30:3001; webhook build pipeline -> version bumps -> dashboard (beta web root /var/www/gururmm/dashboard-beta) + server (shared API restart). Server restarted 14:31:33 UTC for the alert fix.
• gururmm RMM agent id 5e5a7ebc-95ea-40c8-b965-6ec15d63e157 (the server's own agent; used to tail the build log with no SSH).
• Alert data snapshot (2026-06-07): total 152, critical 23, warning 4 (3 active + 1 acknowledged), 0 resolved warnings.

Commands & Outputs

• Alert diag: GET /api/alerts/summary, GET /api/alerts?severity=warning&status=unresolved&limit=500 (JWT from vault infrastructure/gururmm-server.sops.yaml credentials.gururmm-api.*).
• RMM build-log tail: POST /api/agents/<id>/command with a jq -n --arg-built shell payload, then poll /api/commands/<id>.
• Per feature: git checkout -b -> Coding Agent -> Code Review Agent -> npm run build (exit 0) -> git push origin <branch>:main (ff) -> beta.

Pending / Incomplete Tasks

• Promote dashboard beta -> prod (sudo /opt/gururmm/promote-dashboard.sh --confirm on .30) when Mike's happy — ships the whole redesign + these 4 dashboard changes. The server alert-count change is already on prod.
• FunctionRail DRY refactor (hoist PRIMARY_ITEMS) + aria-current (deferred review nits).
• Light-sidebar shade (95%) is a default — tweak after Mike's visual review on beta.
• ff.py visual verification of the light-mode sidebar offered (needs that Firefox profile logged into beta).
• Alert list limit:200 pagination edge (a bucket >200 would show a chip number larger than the visible list) — pre-existing, noted.
• Carried: dev_admin re-login for credential reveal; Robert Wolkin printer type; vault GuruRMM DATABASE_URL; SPEC-018 errors; rotate MSP360 key.

Reference Information

• gururmm origin/main this segment: 6b4cee4 alerts, a6d355f rail expand, d2c9236 theming, 3c210e0 resizable spine (on top of prior fa495ed/82e91c8 spine pin/hitbox, also merged this segment).
• New localStorage keys: gururmm.rail.expanded, gururmm.spine.width (+ gururmm.spine.pins from prior).
• beta https://rmm-beta.azcomputerguru.com; prod https://rmm.azcomputerguru.com.