- Moved `withTimeout` implementation to `src/lock-utils.mjs` and exported it correctly.
- Removed duplicate local definitions of `withTimeout`, `mergeRelayList`, and `secureRandom` in `src/lock-ops.mjs` and `src/lock-publisher.mjs`.
- Fixed imports in `src/lock-ops.mjs`, `src/lock-publisher.mjs`, and `src/relay-health.mjs` to use `src/lock-utils.mjs` consistently.
- Updated `test/utils.test.mjs` and `test/utils-async.test.mjs` to fix broken imports and test definitions.
- Verified `npm run lock:complete` and `npm run scheduler:daily` execute correctly.
- Updated `src/todo/TODO_2026-02-20T03-00-00Z.md` to mark verification task as completed.
- Verified `src/relay-health.mjs` does not use `MINUTE_MS` locally, despite mysterious CI error. Confirmed imports are correct.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Fixes CI failure in `test/install_dir_validation.test.mjs` where `assert.notMatch` was undefined.
- `assert.doesNotMatch` is the standard Node.js assertion method for negative regex matching.
Co-authored-by: PR0M3TH3AN <[email protected]>
Refactor test/install_dir_validation.test.mjs to use unique temporary directories for each subtest, eliminating shared state and race conditions that caused flakiness.
Update KNOWN_ISSUES.md to mark the issue as resolved.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Added `validateInstallDir` function to `src/ops.mjs` to enforce strict allowlist for directory names (alphanumeric, hyphens, underscores, slashes, periods).
- Integrated validation into `resolveConfiguration` to sanitize both interactive and mock inputs.
- Added comprehensive unit tests in `test/install_dir_validation.test.mjs`.
This fixes a vulnerability where malicious directory names could inject shell commands into `package.json` scripts during initialization.
Co-authored-by: PR0M3TH3AN <[email protected]>
