From 010b23e3326a4201504e32e7d7407fd936c382c6 Mon Sep 17 00:00:00 2001
From: cschantz <admin@server.local>
Date: Mon, 10 Nov 2025 23:12:13 -0500
Subject: [PATCH] Fix trace eraser for HISTTIMEFORMAT-enabled systems
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Changes:
- Replace grep with awk to handle timestamp lines
- Remove matching commands AND their preceding timestamp lines
- Properly handle history format: #timestamp followed by command

Issue:
- Systems with HISTTIMEFORMAT set store timestamps as #<unix_time>
- Simple grep only removed command lines, left orphaned timestamps
- User's history showed toolkit commands still present (lines 990-1030)

Solution:
- awk script that tracks timestamp lines
- Only prints timestamp if following command is kept
- Removes both timestamp and command together atomically

Tested:
✓ Removes 16 lines (8 commands + 8 timestamps) from 32-line test
✓ Preserves normal commands with their timestamps
✓ No toolkit patterns found after cleaning
---
 tools/erase-toolkit-traces.sh | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/tools/erase-toolkit-traces.sh b/tools/erase-toolkit-traces.sh
index 09d5682..03c8522 100755
--- a/tools/erase-toolkit-traces.sh
+++ b/tools/erase-toolkit-traces.sh
@@ -151,9 +151,27 @@ if [ "$CLEAN_HISTORY" = true ] && [ -f ~/.bash_history ]; then
     # Build single grep pattern for efficiency (single-pass filtering)
     GREP_PATTERN="git\.mull\.lol|linux-server-management-toolkit|server-toolkit|launcher\.sh|erase-toolkit-traces"
 
-    # Backup and clean in one efficient pass
+    # Backup and clean - handle HISTTIMEFORMAT timestamps
     cp ~/.bash_history ~/.bash_history.bak.$$
-    grep -Ev "$GREP_PATTERN" ~/.bash_history.bak.$$ > ~/.bash_history.cleaned.$$ 2>/dev/null || true
+
+    # Use awk to remove matching lines AND their preceding timestamp lines
+    awk -v pattern="$GREP_PATTERN" '
+        /^#[0-9]+$/ {
+            # This is a timestamp line, store it
+            timestamp = $0
+            next
+        }
+        {
+            # This is a command line
+            if ($0 !~ pattern) {
+                # Keep this command - print timestamp (if exists) and command
+                if (timestamp != "") print timestamp
+                print $0
+            }
+            # Reset timestamp for next iteration
+            timestamp = ""
+        }
+    ' ~/.bash_history.bak.$$ > ~/.bash_history.cleaned.$$ 2>/dev/null || true
 
     # Calculate lines removed
     lines_before=$(wc -l < ~/.bash_history.bak.$$ 2>/dev/null || echo 0)