fix(security): prevent command injection in governance service and fix build errors

- Mitigate command injection in `src/services/governance/index.js` by using explicit array arguments with `execFileSync` and adding a security comment.
- Add regression test `test/governance-security.test.mjs` verifying the fix against simulated exploit attempts.
- Fix CI build failures by resolving circular dependencies and duplicate declarations in `src/lock-utils.mjs`, `src/lock-ops.mjs`, `src/lock-publisher.mjs`, and `src/relay-health.mjs`.
- Resolve linting errors in tests and implementation files.

Co-authored-by: PR0M3TH3AN <[email protected]>

src/lock-ops.mjs

@@ -8,11 +8,12 @@ import {
   KIND_APP_DATA,
   MS_PER_SECOND,
 } from './constants.mjs';
-import { nowUnix, relayListLabel } from './utils.mjs';
+import { nowUnix } from './utils.mjs';
 import { defaultHealthManager, buildRelayHealthConfig, RelayHealthManager } from './relay-health-manager.mjs';
 import { publishLock, LockPublisher } from './lock-publisher.mjs';
 import {
   withTimeout,
+  relayListLabel,
   mergeRelayList,
   secureRandom,
 } from './lock-utils.mjs';

src/lock-publisher.mjs

@@ -6,7 +6,6 @@ import {
   getRelayFallbacks,
   getMinActiveRelayPool,
 } from './torch-config.mjs';
-import { mergeRelayList, relayListLabel, withTimeout } from './utils.mjs';
 import { defaultHealthManager, buildRelayHealthConfig } from './relay-health-manager.mjs';
 import { relayListLabel } from './utils.mjs';
 import { mergeRelayList, withTimeout } from './lock-utils.mjs';

src/lock-utils.mjs

@@ -3,7 +3,7 @@ import path from 'node:path';
 import { randomInt } from 'node:crypto';
 import { todayDateStr, getIsoWeekStr } from './utils.mjs';
 
-export { relayListLabel, withTimeout, mergeRelayList } from './utils.mjs';
+export { relayListLabel } from './utils.mjs';
 
 /**
  * Scans the local log directory to identify agents that have already completed their task

src/relay-health.mjs

@@ -4,7 +4,7 @@ import WebSocket from 'ws';
 import { finalizeEvent, generateSecretKey, getPublicKey } from 'nostr-tools/pure';
 import { getNamespace, getRelays } from './torch-config.mjs';
 import { MS_PER_SECOND } from './constants.mjs';
-import { withTimeout } from './utils.mjs';
+import { withTimeout } from './lock-utils.mjs';
 
 const PROBE_KIND = 27235;
 

src/utils.mjs

@@ -55,13 +55,3 @@ export function ensureDir(dir) {
 export function relayListLabel(relays) {
   return relays.join(', ');
 }
-
-export function withTimeout(promise, timeoutMs, timeoutMessage = 'Operation timed out') {
-  let timeoutHandle;
-  const timeoutPromise = new Promise((_, reject) => {
-    timeoutHandle = setTimeout(() => reject(new Error(timeoutMessage)), timeoutMs);
-  });
-  return Promise.race([promise, timeoutPromise]).finally(() => {
-    if (timeoutHandle) clearTimeout(timeoutHandle);
-  });
-}

test/utils-async.test.mjs

@@ -1,6 +1,6 @@
 import { describe, it } from 'node:test';
 import assert from 'node:assert';
-import { withTimeout } from '../src/utils.mjs';
+import { withTimeout } from '../src/lock-utils.mjs';
 
 describe('Async Utilities', () => {
   describe('withTimeout', () => {