- Added "Clean Repo Standard" to `AGENTS.md` and `CLAUDE.md`, explicitly forbidding root-level logs/artifacts.
- Moved clutter files (`test_output_full.txt`, `benchmark-after.txt`, `dashboard.log`, etc.) to `test_logs/`, `task-logs/`, and `reports/performance/`.
- Moved `INITIAL_BASELINE.md` and other baseline files to `reports/performance/`.
- Updated `src/prompts/daily/perf-agent.md` and `src/prompts/daily/const-refactor-agent.md` to reference the new location of `INITIAL_BASELINE.md`.
- Updated `.gitignore` to ignore logs and temporary artifacts in the new directories.
- Moved `DIAGNOSIS.md` to `reports/performance/`.
- Moved `perf/` data files to `reports/performance/`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Created `reports/` directory with subdirectories for each category (audit, performance, security, etc.).
- Moved existing reports to the new `reports/` structure.
- Updated `AGENTS.md` to define the "Report Location Standard".
- Updated all agent prompts in `src/prompts/` to:
- Output reports to the new locations.
- Fix incorrect script paths (replaced `torch/scripts/` with `scripts/`).
- Updated `load-test-agent.md` to produce a Markdown summary report.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Created `AGENTS.md` and `CLAUDE.md` to define test integrity rules and behavior-based validation.
- Updated `TORCH.md` to include "Scenario-First Tests & Test Integrity" and the "Test Integrity & Scenario Spec Agent" role.
- Updated `src/prompts/daily/test-audit-agent.md` to adopt the new "Enforcer" role, prioritizing test fidelity over CI green state.
- Preserved existing scheduler contract headers in the agent prompt.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Added JSDoc to exported functions and classes in src/lock-ops.mjs
- Added inline comments to complex logic areas
- Created docs/lock-ops-overview.md
- Created task log for daily docs-code-investigator agent
Co-authored-by: PR0M3TH3AN <[email protected]>
- Update `package.json` to include `TORCH.md` and `scripts/memory/` in distribution.
- Update `README.md` to reference `TORCH.md` correctly.
- Update `src/ops.mjs` to robustly handle memory policy paths in `torch-config.json` generation.
- Update `.gitignore` to exclude `.scheduler-memory/`.
- Update `torch-config.example.json` to include memory policy with standard defaults.
Co-authored-by: PR0M3TH3AN <[email protected]>
Optimizes `saveMemoryStore` in `src/services/memory/index.js` to use `fs.promises.writeFile` instead of synchronous `fs.writeFileSync`.
Implements a coalescing mechanism to handle concurrent save requests efficiently, preventing race conditions and reducing I/O operations by batching pending updates into a single write.
Reduces event loop blocking from ~420ms (sync) to ~3ms (async) for large write operations in benchmarks.
Updates all `memoryRepository` methods to await the async save operation.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Implement caching for `rankRelays` to avoid redundant sorting and computations.
- Cache is invalidated on new outcomes or when quarantine status changes.
- Add `_metricsVersion` to track metrics updates.
- Benchmarks show ~3x performance improvement (0.06ms -> 0.02ms per call for 100 relays).
- Add unit tests for caching behavior and invalidation.
- Add `perf/benchmark-lock-ops.mjs`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Use Promise.all to execute memory lifecycle actions concurrently.
- Maintain intra-item dependency order (merged_into before action).
- Update tests to support non-deterministic execution order of independent items.
- Benchmark shows ~65x improvement for 100 items with 10ms latency.
Co-authored-by: PR0M3TH3AN <[email protected]>
Avoids redundant string concatenation and lowercasing in the inner loop of `buildSimilarityIndex`.
Pre-computes query terms and regexes once per query.
Uses RegExp.test for case-insensitive matching without allocation.
Benchmark shows ~2x speedup (99ms vs 191ms for 10k memories).
Co-authored-by: PR0M3TH3AN <[email protected]>
- Replaced brittle regex-based sanitization with `path.resolve` relative to `packageRoot`.
- Added `test/dashboard-path-traversal-fix.test.mjs` to verify robust protection against traversal attacks.
- Verified that legitimate access to allowed paths is maintained.
- Verified that access to restricted files (like package.json) is blocked.
- Updated path handling to correctly handle absolute paths and URL-encoded characters.
This change addresses a potential security vulnerability where the previous sanitization logic could be bypassed in certain environments or with specific edge cases. By using standard path resolution and explicitly checking against a canonical root, the implementation is more secure and maintainable.
Co-authored-by: PR0M3TH3AN <[email protected]>
Refactored `src/cmd-list.mjs` to use a `Set` for roster lookups, reducing complexity from O(M*N) to O(M+N).
Added dependency injection to `cmdList` to enable unit testing.
Added `test/cmd-list.test.mjs` to verify functionality.
Co-authored-by: PR0M3TH3AN <[email protected]>
Sorts memories by created_at and uses an early exit condition in the inner loop to avoid checking all pairs. This reduces complexity from O(N^2) to roughly O(N * k) where k is the number of items within the duplicate window.
Measured improvement for 30k items: ~2.1s -> ~0.25s (8x speedup).
Co-authored-by: PR0M3TH3AN <[email protected]>
Restrict the /torch-config.json endpoint to only return fields required by the dashboard frontend (dashboard config excluding auth, and nostrLock namespace/relays). This prevents exposure of sensitive internal configuration such as rosters, scheduler settings, and full relay lists.
- Modify src/dashboard.mjs to sanitize config using an allowlist approach.
- Add test/dashboard-config-exposure.test.mjs to verify sensitive fields are stripped.
Co-authored-by: PR0M3TH3AN <[email protected]>
Adds standard HTTP security headers (CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy) to all dashboard responses to mitigate XSS, clickjacking, and MIME sniffing attacks.
Includes verification tests in test/dashboard-security.test.mjs.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Refactor `src/roster.mjs` to support dependency injection for `fs` and `loadTorchConfig`.
- Add `test/roster.test.mjs` to test roster loading scenarios including file precedence, caching, fallback, and configuration overrides.
- Export `_resetRosterCache` in `src/roster.mjs` for testing purposes.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Added `validateInstallDir` function to `src/ops.mjs` to enforce strict allowlist for directory names (alphanumeric, hyphens, underscores, slashes, periods).
- Integrated validation into `resolveConfiguration` to sanitize both interactive and mock inputs.
- Added comprehensive unit tests in `test/install_dir_validation.test.mjs`.
This fixes a vulnerability where malicious directory names could inject shell commands into `package.json` scripts during initialization.
Co-authored-by: PR0M3TH3AN <[email protected]>
Moved the `ensureDir` utility function from `src/ops.mjs` to `src/utils.mjs` to promote code reuse and centralization.
Updated `src/ops.mjs` and `src/services/memory/index.js` to use the shared utility.
Added unit tests for `ensureDir` in `test/utils.test.mjs`.
Co-authored-by: PR0M3TH3AN <[email protected]>
Verified by:
- Searching the codebase to confirm no imports.
- Running the tests to ensure no regressions.
- Running the build to ensure the process is unaffected.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Remove `src/cmd-check.mjs` as it is not used in the codebase and contains outdated logic.
- Remove `test/cmd-check.test.mjs` as it tests the deleted file.
- Verify that `cmdCheck` in `src/lib.mjs` is covered by `test/lib.test.mjs`.
This improves code health by removing unused and duplicate code.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Executed design-system-audit-agent on daily cadence
- Generated design system audit report (memory-update.md)
- Created run artifacts in src/context, src/todo, src/decisions, src/test_logs
- Published lock completion and final task log
Co-authored-by: PR0M3TH3AN <[email protected]>
- Created `CONTRIBUTING.md` with development instructions.
- Updated `README.md` to include a Development section.
- Added daily scheduler run artifacts.
- Completed scheduler cycle for `docs-agent`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Executed daily scheduler cycle.
- Selected `decompose-agent` (next in roster).
- Decomposed `scripts/agent/run-scheduler-cycle.mjs` (1127 lines) into `scripts/agent/scheduler-utils.mjs` (195 lines) and `scripts/agent/scheduler-lock.mjs` (173 lines).
- Resulting main file size: 788 lines (339 lines reduction).
- Fixed lint warnings.
- Updated `test/scheduler-preflight-lock.e2e.test.mjs`, `test/run-scheduler-cycle-memory-policy.test.mjs`, `test/scheduler-lock-failure-schema.contract.test.mjs` to copy new modules into test fixtures.
- Updated `test/scheduler-ratchet.test.mjs` to verify moved functions in `scheduler-lock.mjs`.
- Note: `scripts/check-file-size.mjs` was not updated as it lacks the baseline feature referenced in the prompt.
- Created artifacts: `src/context/CONTEXT_...`, `src/decisions/DECISIONS_...`, `src/test_logs/TEST_LOG_...`, `src/todo/TODO_...`.
- Created scheduler log: `task-logs/daily/2026-02-17T22-29-00Z__decompose-agent__completed.md`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Audited `/content` directory: Not found.
- Updated `KNOWN_ISSUES.md`.
- Fixed a bug in `src/lock-ops.mjs` where `deps` was undefined in `LockPublisher`.
- Created run artifacts and task logs.
Co-authored-by: PR0M3TH3AN <[email protected]>
