- Add --test-timeout=30000 to prevent test suite hanging
- Skip build_verification.test.mjs when dist/ is absent
- Replace setTimeout with mocked Date.now in memory-cache expiry test
- Replace wait(30) with setImmediate flush in scheduler smoke test
- Remove unused @playwright/test devDependency
https://claude.ai/code/session_01GfwUNbgeMgXreFDbsNQMsS
- Fix timingSafeCompare to pad buffers to equal length before comparing,
closing the content timing side-channel on length mismatch
- Replace innerHTML with textContent for error messages to prevent XSS
- Extract inline script from dashboard/index.html into dashboard/app.js
- Remove 'unsafe-inline' from script-src CSP directive
- Update security test to match new CSP policy
https://claude.ai/code/session_01GfwUNbgeMgXreFDbsNQMsS
The Claude Code remote sandbox strips `Upgrade: websocket` at the proxy
L7 layer, making all outbound WebSocket connections (including Nostr
relays used by torch-lock) unreachable. A local relay workaround was
investigated but rejected because it breaks cross-agent lock visibility
with Jules, which uses the public relay set.
Workaround: run all scheduler/lock operations exclusively from Jules
or any environment with unrestricted outbound WebSocket access.
Refs: anthropics/claude-code #490, #2059, #17333https://claude.ai/code/session_019g8yqKQMiq9u41n3GxUpFH
Lock backend error: all Nostr relays returned permanent_validation_error
(no WebSocket connectivity). perf-optimization-agent was selected as next
agent after perf-deepdive-agent (round-robin index 7). Prompt not executed;
lock:complete not published per scheduler strict_lock policy.
https://claude.ai/code/session_019g8yqKQMiq9u41n3GxUpFH
The `files` array in package.json was missing 7 source modules and the
entire `src/services/` directory tree that `src/lib.mjs` imports at
runtime. Installing TORCH via `npm install` would crash immediately with
ERR_MODULE_NOT_FOUND on any CLI command.
Missing files added: cli-parser.mjs, errors.mjs, utils.mjs, lock-utils.mjs,
cmd-proposal.mjs, cmd-rollback.mjs, src/services/ (memory + governance),
and migrations/ for DB schema setup.
Also adds: engines (node >=22), license (MIT), repository, keywords,
exports map, LICENSE file — so the landing page install flow
(`npm install ... && npx torch-lock init`) works out of the box.
https://claude.ai/code/session_01CJFvLoy2BA8n9qk3z5BQQA
Claude