config/.claude/memory/blockers.md

Blockers

Friction + root cause + status. Caveman + English.

BLK-001 — vimrc GenerateClassC bare name var — OPEN

2026-05-27. vim/vimrc func GenerateClassC uses name instead of a:name → vimscript E121 undefined variable on :ClassC Foo. GenerateClassH correct (uses a:name). Not fixed — vim domain, out of onboard scope (user said fix install.sh only). Fix: prefix all with a:. Status: open, logged in TODO P2.

BLK-002 — hardcoded OpenRouter key in claude-provider — RESOLVED (key rotation pending user)

2026-05-27. ~/.local/bin/claude-provider had live sk-or-v1-... key in heredoc. Adding to repo (remote git.bchanot.fr) would leak it. Root cause: key inlined in write_openrouter. Fix: repo copy bin/claude-provider reads ${OPENROUTER_API_KEY:?...} from env; key never in repo. Verified git grep sk-or clean. Status: resolved in repo. ACTION user: revoke old key at openrouter.ai (compromised — was in plaintext + exposed in chat).

BLK-003 — xrdp block: systemctl enable xrdb typo aborted installer — RESOLVED

2026-06-23. Uncommitted install.sh xrdp block had sudo systemctl enable xrdb (typo: xrdb = X resource-DB tool, no such systemd service). Returns non-zero → under set -euo pipefail aborts whole installer. Also apt-get install xrdp missing -y → hangs non-interactive run. Root cause: one-letter typo xrdp→xrdb + missing -y. Fix: idempotent install_xrdp() (apt -y, adduser xrdp ssl-cert, polkit .rules, conditional ufw 3389, enable+restart). shellcheck + bash -n CLEAN. Status: SUPERSEDED by BLK-004 (xrdp dropped for gnome-remote-desktop) — was resolved in repo, never run live.

BLK-004 — RDP Win→Linux 0x904/0x7: empty gate creds on g-r-d --system — RESOLVED

2026-06-23. After xrdp dropped for gnome-remote-desktop (Wayland), mstsc fails 0x904 / 0x7 despite: daemon LISTEN *:3389, ufw inactive, TLS cert readable, service active. Root cause: grdctl --system status → Username: (empty) / Password: (empty). System "Remote Login" = 2-layer auth: shared gate creds (grdctl --system rdp set-credentials) unlock GDM, then per-user PAM login at GDM. Empty gate creds → RDP nego refused before GDM → 0x904. Fix: set-credentials, connect (gate creds → GDM bchanot). Connection CONFIRMED live. Automated in install.sh via ensure_rdp_credentials (prompt, TTY-guarded, idempotent). Supersedes BLK-003 (xrdp). Status: resolved.

BLK-005 — secrets still on NAS share: /mnt/cloudpex/transfert/root/ — OPEN (user action)

2026-09-22. RECOVERY checklist 06 + doc 04: delete CloudPex/transfert/root/ (root ssh keys, .smbcredentials, .acme.sh copied 21/09 01:41) then regenerate. Still present 2026-09-22. Claude never deletes on the NAS (destructive-tools rule). User: delete on NAS, rotate root/bchanot SSH keys, SMB password, acme account.

BLK-006 — permission layer denies read-only diagnostics (systemctl cat/is-enabled, sudo -n, /tmp globs) — OPEN

2026-09-22. Compound Bash calls holding systemctl cat tmp.mount, systemctl is-enabled, sudo -n du, du /tmp/*, find -exec were denied ("Permission to use Bash ... denied"), even read-only. Cause not identified (guard-bash hook vs auto-mode classifier). Workaround: read unit files under /usr/lib/systemd + /etc/systemd directly, ls/du on literal paths, no find -exec, no sudo. Cost ≈ 5 retries. Candidate fix: allowlist systemctl {cat,show,is-enabled,is-active,status} wherever the denial comes from.