Renamed files in `torch/src/context`, `torch/src/decisions`, `torch/src/test_logs`, and `torch/src/todo` that contained colons in their filenames (e.g., `CONTEXT_2026-02-15T01:03:31Z.md`).
Windows filesystems do not allow colons, causing `git checkout` to fail in CI environments.
Replaced colons with dashes in the timestamp portion of the filenames.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Formatted `torch/scripts/find_dead_code.py` with `black` to pass CI style checks.
- Added `torch/scripts/` and `torch/src/` to `.gitignore` to prevent future untracked files from being accidentally committed, but kept necessary files tracked.
- Addressed user question about CI failures and improved TORCH packaging suggestions.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Formatted `torch/scheduler.py` with `black` to pass CI linting.
- Replaced deprecated `datetime.datetime.utcnow()` with `datetime.datetime.now(datetime.timezone.utc)`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Reformatted `src/tests/helpers.py`, `src/tests/test_generate_test_profile_sync.py`, `src/tests/test_manifest_id_privacy.py`, and `src/tests/test_restore_from_nostr_setup.py` using `black`.
- Refactored `src/tests/helpers.py` to fix dispersed imports and remove unused imports (`time`, `asyncio`), resolving `flake8` warnings.
- Split long lines in `src/tests/helpers.py` to improve readability and compliance with style guides.
- Verified formatting with `black --check .`.
- Verified all tests pass with `pytest`.
- Confirmed `flake8` errors related to line length in `helpers.py` are acceptable as CI does not enforce strict 79-char limit (using `black` defaults).
Co-authored-by: PR0M3TH3AN <[email protected]>
- Restore missing source files in `torch/src/` from `torch-lock` dependency.
- Setup ESLint in `torch/`.
- Fix linting issues in `src/lock-ops.mjs`, `src/lock-utils.mjs`, `src/ops.mjs`, `src/services/memory/embedder.js`.
- Fix missing crypto import in `src/services/memory/schema.js`.
- Rename `torch/src/todo/TODO_2026-02-15T01:03:31Z.md` to `torch/src/todo/TODO_2026-02-15T01-03-31Z.md` to fix Windows CI failure.
- Mark 'Verify with lint' as completed in `src/todo/TODO_2026-02-14T13-30-00Z.md`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Moved `client` and `dummy_nostr_client` fixtures to `src/tests/conftest.py` to fix F811 redefinition errors and improve test organization.
- Introduced `make_dummy_nostr_client` factory fixture to support tests requiring multiple client instances.
- Updated all affected tests to use the new fixture pattern.
- Removed deprecated `is_flag=True` from Typer boolean options in CLI modules.
- Fixed F541 (f-string without placeholders) in `entry_management.py`.
- Fixed F841 (unused variable) in `manager.py`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Restore missing source files in `torch/src/` from `torch-lock` dependency.
- Setup ESLint in `torch/`.
- Fix linting issues in `src/lock-ops.mjs`, `src/lock-utils.mjs`, `src/ops.mjs`, `src/services/memory/embedder.js`.
- Mark 'Verify with lint' as completed in `src/todo/TODO_2026-02-14T13-30-00Z.md`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Rename `torch/src/todo/TODO_2026-02-16T11:47:38Z.md` to `torch/src/todo/TODO_2026-02-16T11-47-38Z.md`
- Removes colons from the filename to fix "invalid path" errors on Windows CI runners
Co-authored-by: PR0M3TH3AN <[email protected]>
The file src/nostr/event_handler.py does not exist in the codebase, and EventHandler is not used in src/nostr/client.py.
However, src/repo-context.txt incorrectly contained references to this file and usage.
This change updates src/repo-context.txt to remove the hallucinated/outdated code references, aligning the documentation with the actual codebase state.
Attempts to remove unused imports in src/nostr/client.py were reverted as tests rely on monkeypatching them.
Co-authored-by: PR0M3TH3AN <[email protected]>
Added `src/tests/test_core_api_services.py` to test public methods of
`VaultService`, `ProfileService`, `SyncService`, `EntryService`,
`ConfigService`, `UtilityService`, and `NostrService` in `src/seedpass/core/api.py`.
These tests ensure proper thread safety (locking) and delegation to
the underlying `PasswordManager` and its components.
Key improvements:
- Verified locking behavior for thread-safe operations.
- Validated delegation logic for all service methods.
- Covered edge cases like default vs. custom password generation policies.
- Mocked external dependencies (pubsub bus, manager components) to isolate service logic.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Implement `escapeHtml` function in `docs/assets/theme.js`
- Update `highlight` function to safely escape content before wrapping matches in `<mark>` tags
- Update `torch/src/todo/TODO_2026-02-16T11:47:38Z.md` to mark task as completed
Co-authored-by: PR0M3TH3AN <[email protected]>
Adds comprehensive tests for `src/utils/imghdr_stub.py` to ensure it correctly identifies image headers, covering all supported formats and edge cases. This is crucial as `imghdr` is removed in Python 3.13 and this stub is used by dependencies like `pgpy`.
- Added `src/tests/test_imghdr_stub.py` covering:
- `what()` function with file paths, Path objects, file-like objects, and bytes.
- All supported image formats (JPEG, PNG, GIF, TIFF, etc.).
- Edge cases (empty file, short file, unknown type).
- Verified tests pass locally.
Co-authored-by: PR0M3TH3AN <[email protected]>
Replaced insecure string comparison with `secrets.compare_digest` in `_check_token` to prevent timing attacks.
Added a test case for missing token to ensure robust error handling.
Co-authored-by: PR0M3TH3AN <[email protected]>
Refactored `_fetch_chunks_with_retry` in `src/nostr/client.py` to fetch snapshot chunks concurrently using `asyncio.gather`.
Introduced a `asyncio.Semaphore(10)` to limit concurrency and prevent overwhelming relays.
Extracted single chunk fetch logic into `_fetch_single_chunk` helper method.
Added `sys.path` fix to `src/tests/test_nostr_snapshot.py` to enable running tests.
Performance improvement: ~10x speedup for 10 chunks (1.0s -> 0.1s in local reproduction).
Co-authored-by: PR0M3TH3AN <[email protected]>
Extracts common logic for path preparation and lock acquisition into a private helper function `_get_portalocker_lock`. This simplifies `exclusive_lock` and `shared_lock` implementations.
Also updates the docstring for `exclusive_lock` to correctly describe the file mode as "binary read/write mode" (r+b) instead of "binary append mode".
Co-authored-by: PR0M3TH3AN <[email protected]>
- Add `get_totp_secret` to `EntryManager` and `EntryService` to allow retrieving the secret (derived or imported) without calculating the code.
- Update `TotpViewerWindow` in GUI to cache TOTP secrets locally. This prevents expensive PBKDF2/BIP39 derivation on every UI refresh (every second).
- Clean up unused imports and f-strings in `entry_management.py`.
Benchmarks show a ~9x speedup for 10 frames (50 entries) and >100x speedup for steady state.
Co-authored-by: PR0M3TH3AN <[email protected]>
Introduced a random salt to key derivation for parent seed encryption to prevent rainbow table attacks. The salt is now stored in the `parent_seed.enc` file header (V3 format).
* Modified `src/utils/key_derivation.py` to accept optional `salt` argument.
* Modified `src/seedpass/core/encryption.py` to read/write salt in `parent_seed.enc` using V3 format (V3:salt:nonce:ciphertext).
* Modified `src/seedpass/core/manager.py` to generate salt for new seeds and read salt for existing ones.
* Added auto-upgrade logic for legacy (no salt) seeds upon access.
* Updated tests to verify salt usage and backward compatibility.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Updated `InMemorySecret.get_bytes()` in `src/utils/memory_protection.py` to raise a `RuntimeError` if the secret has been wiped, replacing the previous `AttributeError`.
- Added `test_access_after_wipe_raises_error` to `src/tests/test_memory_protection.py` to verify this behavior.
Co-authored-by: PR0M3TH3AN <[email protected]>
The `backup_parent_seed` API endpoint was vulnerable to arbitrary file write via path traversal.
The `path` parameter was used directly to create a `Path` object, which was then passed to `_pm.handle_backup_reveal_parent_seed`.
This allowed an attacker to specify an arbitrary path (e.g., `../../evil_file`), which would be used by `encrypt_and_save_file` to write the encrypted seed to that location.
This commit fixes the vulnerability by validating that the `path` parameter is a valid filename (i.e., does not contain path separators or parent directory references) before processing it. This ensures that the backup file is always created within the intended fingerprint directory.
Co-authored-by: PR0M3TH3AN <[email protected]>
Removed the `print` statement in `src/seedpass/api.py` that leaked the
API token to stdout.
Enhanced the API server and CLI to support secure token management:
- Added `SEEDPASS_API_TOKEN` environment variable support in both
`api.py` and `cli.py`.
- Added a `--token` option to the `api start` CLI command.
- Redirected the auto-generated token output to stderr instead of stdout.
- Updated `api stop` to respect the `SEEDPASS_API_TOKEN` environment
variable.
These changes prevent the API token from being easily logged in insecure
environments where stdout is captured.
Co-authored-by: PR0M3TH3AN <[email protected]>
Removed the `test()` and `testall()` functions and the `if __name__ == "__main__":` block which were used for manual testing and are not needed by the codebase.
This improves maintainability and readability by focusing the module on its core functionality.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Added `torch/` directory with `package.json` and `package-lock.json`.
- Ran `npx torch-lock init` to generate `torch-config.json`.
- Updated `.gitignore` to exclude `torch/node_modules` and `torch/torch/`.
- Documented findings and recommendations for improving the installation process.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Initialize Node.js environment with `package.json`
- Install `torch-lock` from GitHub
- Initialize `torch/` configuration and prompts
- Add `node_modules` to `.gitignore`
- Add `lock:*` scripts to `package.json` for scheduler integration
- Update `check-file-size.mjs` and `check-innerhtml.mjs` to support `--update` and `BASELINE` logic required by prompts
Co-authored-by: PR0M3TH3AN <[email protected]>
