This commit addresses the missing authentication vulnerability in the
dashboard server.
Changes:
- Added Basic Authentication support via TORCH_DASHBOARD_AUTH env var
or dashboard.auth config field.
- Defaulted dashboard host binding to 127.0.0.1 for better security.
- Added --host CLI argument to allow overriding the bind address.
- Used crypto.timingSafeEqual for secure credential comparison.
- Fixed a potential crash when parsing malformed Authorization headers.
- Added comprehensive unit tests for dashboard authentication.
- Updated documentation in README.md and torch-config.example.json.
Co-authored-by: PR0M3TH3AN <[email protected]>
This change enables agents to report their execution platform (e.g., Jules, Codex, Goose) and model (e.g., DeepSeek 3.2) in the Nostr lock events.
Key changes:
- Updated `torch-lock` CLI to accept `--platform` and `--model` arguments.
- Implemented `detectPlatform` utility to infer platform from environment variables if not provided.
- Updated `src/lib.mjs` to include these fields in the event content.
- Updated `scripts/agent/run-scheduler-cycle.mjs` to propagate `--model` and `AGENT_MODEL`.
- Updated `dashboard/index.html` to display the model information on the lock card.
- Fixed a regression in `scripts/validate-scheduler-flow-parity.mjs` and `test/scheduler-ratchet.test.mjs` caused by argument string matching.
- Deleted `repro_test.mjs` temporary file.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Extracted `parseArgs` function from `src/lib.mjs` to `src/cli-parser.mjs`.
- Added unit tests for argument parsing logic in `test/cli-parser.test.mjs`.
- Updated `src/lib.mjs` to import `parseArgs`.
- Fixed roster drift in `src/prompts/weekly-scheduler.md` to match `roster.json`.
- Verified with `npm test` and `npm run lint`.
- Completed weekly scheduler task for `refactor-agent`.
Co-authored-by: PR0M3TH3AN <[email protected]>
