Merge branch 'main' into fix/governance-command-injection-10151244085139343159

src/cmd-rollback.mjs

@@ -1,18 +1,31 @@
-import { rollbackPrompt, listPromptVersions } from './services/governance/index.js';
+import {
+  rollbackPrompt as _rollbackPrompt,
+  listPromptVersions as _listPromptVersions
+} from './services/governance/index.js';
 import { ExitError } from './errors.mjs';
 
-export async function cmdRollback(target, strategy, { list = false } = {}) {
+export async function cmdRollback(target, strategy, options = {}, deps = {}) {
+  // Backwards compatibility: if options is destructured directly
+  const { list = false } = options;
+
+  const {
+    rollbackPrompt = _rollbackPrompt,
+    listPromptVersions = _listPromptVersions,
+    log = console.log,
+    error = console.error
+  } = deps;
+
   if (!target) {
-    console.error('Usage: torch-lock rollback --target <path> [--strategy <hash|latest>] [--list]');
+    error('Usage: torch-lock rollback --target <path> [--strategy <hash|latest>] [--list]');
     throw new ExitError(1, 'Missing target');
   }
 
   if (list) {
     try {
       const versions = await listPromptVersions(target);
-      console.log(JSON.stringify(versions, null, 2));
+      log(JSON.stringify(versions, null, 2));
     } catch (e) {
-      console.error(`Failed to list versions: ${e.message}`);
+      error(`Failed to list versions: ${e.message}`);
       throw new ExitError(1, 'List versions failed');
     }
     return;
@@ -22,9 +35,9 @@ export async function cmdRollback(target, strategy, { list = false } = {}) {
 
   try {
     const result = await rollbackPrompt(target, effectiveStrategy);
-    console.log(JSON.stringify(result, null, 2));
+    log(JSON.stringify(result, null, 2));
   } catch (e) {
-    console.error(`Rollback failed: ${e.message}`);
+    error(`Rollback failed: ${e.message}`);
     throw new ExitError(1, 'Rollback failed');
   }
 }

src/lock-publisher.mjs

@@ -101,11 +101,7 @@ function isTransientPublishCategory(category) {
   ].includes(category);
 }
 
-const MAX_RANDOM = 281474976710655; // 2**48 - 1
-
-export function secureRandom() {
-  return randomInt(0, MAX_RANDOM) / MAX_RANDOM;
-}
+export { secureRandom };
 
 function calculateBackoffDelayMs(attemptNumber, baseMs, capMs, randomFn = secureRandom) {
   const maxDelay = Math.min(capMs, baseMs * (2 ** Math.max(0, attemptNumber - 1)));

src/todo/TODO_2026-02-20T03-00-00Z.md

@@ -9,6 +9,7 @@
 - [x] Update `README.md` to include `scheduler:daily`, `scheduler:weekly`, and `lock:complete`.
 - [x] Update `TORCH.md` to include `scheduler:daily`, `scheduler:weekly`, and `lock:complete`.
 - [x] Verify updated commands run correctly (where applicable/safe).
+  - Fixed syntax errors and circular dependencies in `src/lock-ops.mjs`, `src/lock-utils.mjs`, `src/lock-publisher.mjs`, and `src/relay-health.mjs` that were preventing commands from running.
 
 ## Blocked
 - None.