This patch addresses a security vulnerability where the dashboard server could serve any file from the package root.
Changes:
- Implemented an allowlist in `src/dashboard.mjs` to restrict file access to:
- `dashboard/`
- `assets/`
- `src/docs/`
- `torch-config.json`
- Added `test/dashboard-security.test.mjs` to verify the fix and prevent regressions.
The fix ensures that sensitive files like `package.json` or source code cannot be accessed via the dashboard server.
Co-authored-by: PR0M3TH3AN <[email protected]>
This commit addresses the missing authentication vulnerability in the
dashboard server.
Changes:
- Added Basic Authentication support via TORCH_DASHBOARD_AUTH env var
or dashboard.auth config field.
- Defaulted dashboard host binding to 127.0.0.1 for better security.
- Added --host CLI argument to allow overriding the bind address.
- Used crypto.timingSafeEqual for secure credential comparison.
- Fixed a potential crash when parsing malformed Authorization headers.
- Added comprehensive unit tests for dashboard authentication.
- Updated documentation in README.md and torch-config.example.json.
Co-authored-by: PR0M3TH3AN <[email protected]>
Replace inefficient `[...events].reverse().find()` with `events.findLast()`.
This avoids a shallow copy of the array and an in-place reverse,
improving performance from O(N) space/time to O(1) space and O(N) time
(where N is the number of events searched).
In benchmarks with 100,000 events:
- Element near the end: 99.9% improvement (~0.8ms vs ~950ms)
- Element at the beginning: ~42% improvement (~145ms vs ~250ms)
Node.js v18.6.0+ is required for `findLast`, which is supported in the
current environment (v22.22.0).
Co-authored-by: PR0M3TH3AN <[email protected]>
- Added `test/memory-formatter.test.mjs` with comprehensive unit tests for:
- `estimateTokenCount`
- `formatMemoryBlock`
- `formatMemoriesForPrompt`
- `renderPromptWithMemoryContext`
- Verified all tests pass and no regressions in related tests.
- Addressed testing gap in `src/services/memory/formatter.js`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Extracted `syncAppDirectories` and `syncAppFiles` helper functions.
- Updated `cmdInit` and `cmdUpdate` to use the new helpers.
- Improved `cmdInit` to throw an Error instead of warning when the target directory is not empty and not forced.
- Fixed hanging tests in `test/ops.test.mjs` by providing `MOCK_CONFIG`.
- Updated tests to verify strict directory check in `cmdInit`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Updated `src/prompts/daily/test-audit-agent.md` to instruct the agent to run only unit tests during flakiness detection.
- Explicitly excluded composite scripts (e.g. `npm test` with lint/build) and slow integration/E2E tests from the repeated test loop.
- This prevents timeouts caused by running the full test suite (including network-dependent tests) multiple times.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Modified `scripts/agent/run-scheduler-cycle.mjs` to generate a unique `memory-updates/<timestamp>__<agent>.md` path and pass it via `SCHEDULER_MEMORY_FILE` env var.
- Updated `scripts/memory/store.mjs` to prioritize `SCHEDULER_MEMORY_FILE` for ingestion.
- Updated `src/prompts/scheduler-flow.md` to instruct agents to write to the unique memory file.
- Updated `src/prompts/daily/torch-garbage-collection-agent.md` to include `memory-updates/*.md` in the cleanup scope.
- Moved existing `memory-update.md` to `memory-updates/legacy-memory-update-<timestamp>.md` to clear the root.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Modified build.mjs to run npm pack and move tarball to dist/
- Updated landing/index.html with download link and instructions
- Updated TORCH.md with Offline & Air-Gapped Installation guide
Co-authored-by: PR0M3TH3AN <[email protected]>
- Updated `build.mjs` to correctly source `TORCH.md` and `docs/` from the project root instead of the non-existent `src/docs/`.
- Ensured `TORCH.md` is copied to `dist/src/docs/TORCH.md` as expected by the dashboard's fetch logic.
- Added `test/build_verification.test.mjs` to prevent regressions by verifying the presence of critical build artifacts (`TORCH.md`, assets, dashboard).
- Verified dashboard functionality (logos, settings modal) using a temporary Playwright script.
Co-authored-by: PR0M3TH3AN <[email protected]>
Added a settings modal to the dashboard (index.html) to allow configuration of hashtag, namespace, and relays via URL query parameters and localStorage. This enables the dashboard to be hosted as a static site and used by any project.
Also added `docs/architecture/distribution-plan.md` outlining the strategy for NPM, Binary, and Hosted Dashboard distribution.
Co-authored-by: PR0M3TH3AN <[email protected]>
Removes the "Autonomous Improvement Cycle" section, including the HTML block, Mermaid.js script import, and associated CSS styles, to simplify the landing page.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Merged AGENTS.md, CLAUDE.md, and src/docs/TORCH.md into a single TORCH.md in the root.
- Updated src/ops.mjs to copy TORCH.md during init/update and correctly transform path references.
- Updated src/prompts/META_PROMPTS.md and src/prompts/scheduler-flow.md to reference TORCH.md.
- Deleted obsolete AGENTS.md, CLAUDE.md, and src/docs/TORCH.md.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Updated PROTOCOL_INVENTORY.md with NIP-40, NIP-78, and Kind 27235 details.
- Created protocol-report-2026-02-17.md.
- Verified system health with unit tests.
- Completed scheduler cycle (lock, memory, log).
Co-authored-by: PR0M3TH3AN <[email protected]>
