Replaces synchronous `fs.readFileSync` with `fs.promises.readFile` in `loadTorchConfig` to prevent event loop blocking.
Updates all dependent configuration getters and consumers to use async/await.
Includes benchmark proving non-blocking behavior.
Fixes dashboard tests to properly await server listening.
Co-authored-by: PR0M3TH3AN <[email protected]>
Refactor `cmdCheck` in `src/cmd-check.mjs` to support dependency injection for better testability.
Add `test/cmd-check.test.mjs` with comprehensive unit tests for `cmdCheck`, covering happy paths and edge cases.
Verify tests pass with `node --test test/cmd-check.test.mjs`.
Co-authored-by: PR0M3TH3AN <[email protected]>
Moved the large usage help text from `src/lib.mjs` to `src/constants.mjs` to improve readability and maintainability of the library file.
- Added `USAGE_TEXT` to `src/constants.mjs`.
- Updated `src/lib.mjs` to import and use `USAGE_TEXT`.
- Removed unused `DEFAULT_DASHBOARD_PORT` import from `src/lib.mjs`.
Co-authored-by: PR0M3TH3AN <[email protected]>
Introduced a `resolveIntegerConfig` helper function to handle environment variable checking, parsing, validation, and configuration fallback for integer settings. Updated `getQueryTimeoutMs`, `getPublishTimeoutMs`, `getMinSuccessfulRelayPublishes`, and `getMinActiveRelayPool` to use this helper. This improves code maintainability and consistency.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Introduced `parseStringList` helper to handle parsing of string arrays from config.
- Replaced `parseRelayList` and `parseRoster` with `parseStringList`.
- Replaced inline parsing of `relays` and `dashboard.relays` with `parseStringList`.
- Unified behavior: empty lists in config now consistently return `null` instead of `[]`.
- Added unit test verifying consistent `null` return for empty lists.
Co-authored-by: PR0M3TH3AN <[email protected]>
The dashboard previously served the raw `torch-config.json` file, potentially exposing sensitive information like authentication credentials.
This commit modifies the `/torch-config.json` endpoint to:
1. Parse the configuration file.
2. Sanitize the output by removing the `dashboard.auth` field and any unknown fields (using `parseTorchConfig`).
3. Support `TORCH_CONFIG_PATH` environment variable for configuration file location, improving testability and consistency with other components.
Verified with new test `test/dashboard-config-security.test.mjs` and existing auth tests.
Co-authored-by: PR0M3TH3AN <[email protected]>
This patch addresses a security vulnerability where the dashboard server could serve any file from the package root.
Changes:
- Implemented an allowlist in `src/dashboard.mjs` to restrict file access to:
- `dashboard/`
- `assets/`
- `src/docs/`
- `torch-config.json`
- Added `test/dashboard-security.test.mjs` to verify the fix and prevent regressions.
The fix ensures that sensitive files like `package.json` or source code cannot be accessed via the dashboard server.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Update `markMemoryMerged` to accept `options.repository` for better testability.
- Add unit tests in `test/memory-admin.test.mjs` to verify:
- Delegation to repository.
- Cache clearing side effect.
Co-authored-by: PR0M3TH3AN <[email protected]>
Replaced `console.log` with `util.debuglog('torch-memory')` in `src/services/memory/index.js` to prevent stdout pollution. Telemetry and metrics are now logged to stderr only when `NODE_DEBUG=torch-memory` is set, improving library behavior and observability control.
Added regression test `test/memory-telemetry.test.mjs`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Add `test/memory-pinning.test.mjs` to test `pinMemory` happy path and edge cases.
- Update `getRelevantMemories` in `src/services/memory/index.js` to use `repository.listMemories` when available, enabling isolated unit testing.
- Verified all memory tests pass.
Co-authored-by: PR0M3TH3AN <[email protected]>
This commit addresses the missing authentication vulnerability in the
dashboard server.
Changes:
- Added Basic Authentication support via TORCH_DASHBOARD_AUTH env var
or dashboard.auth config field.
- Defaulted dashboard host binding to 127.0.0.1 for better security.
- Added --host CLI argument to allow overriding the bind address.
- Used crypto.timingSafeEqual for secure credential comparison.
- Fixed a potential crash when parsing malformed Authorization headers.
- Added comprehensive unit tests for dashboard authentication.
- Updated documentation in README.md and torch-config.example.json.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Extracted `syncAppDirectories` and `syncAppFiles` helper functions.
- Updated `cmdInit` and `cmdUpdate` to use the new helpers.
- Improved `cmdInit` to throw an Error instead of warning when the target directory is not empty and not forced.
- Fixed hanging tests in `test/ops.test.mjs` by providing `MOCK_CONFIG`.
- Updated tests to verify strict directory check in `cmdInit`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Updated `src/prompts/daily/test-audit-agent.md` to instruct the agent to run only unit tests during flakiness detection.
- Explicitly excluded composite scripts (e.g. `npm test` with lint/build) and slow integration/E2E tests from the repeated test loop.
- This prevents timeouts caused by running the full test suite (including network-dependent tests) multiple times.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Modified `scripts/agent/run-scheduler-cycle.mjs` to generate a unique `memory-updates/<timestamp>__<agent>.md` path and pass it via `SCHEDULER_MEMORY_FILE` env var.
- Updated `scripts/memory/store.mjs` to prioritize `SCHEDULER_MEMORY_FILE` for ingestion.
- Updated `src/prompts/scheduler-flow.md` to instruct agents to write to the unique memory file.
- Updated `src/prompts/daily/torch-garbage-collection-agent.md` to include `memory-updates/*.md` in the cleanup scope.
- Moved existing `memory-update.md` to `memory-updates/legacy-memory-update-<timestamp>.md` to clear the root.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Merged AGENTS.md, CLAUDE.md, and src/docs/TORCH.md into a single TORCH.md in the root.
- Updated src/ops.mjs to copy TORCH.md during init/update and correctly transform path references.
- Updated src/prompts/META_PROMPTS.md and src/prompts/scheduler-flow.md to reference TORCH.md.
- Deleted obsolete AGENTS.md, CLAUDE.md, and src/docs/TORCH.md.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Replaced fragile inline Node.js scripts in `torch-config.json` with dedicated modules: `scripts/memory/retrieve.mjs` and `scripts/memory/store.mjs`.
- Updated `src/ops.mjs` initialization logic to dynamically configure `scheduler.memoryPolicyByCadence` with correct paths based on the installation directory.
- Added default memory policy configuration to `torch-config.example.json` to guide users.
- Injected `torch:memory:list` and `torch:memory:inspect` convenience scripts into the host `package.json` during `init`.
- Removed legacy shell scripts (`run-memory-retrieval.sh`, `run-memory-store.sh`).
- Verified memory scripts function correctly and pass linting.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Modified `init` to be interactive, asking for install directory, namespace, and relays.
- Added automatic injection of convenience scripts (`torch:check`, `torch:lock`, etc.) into the host `package.json`.
- Increased default network timeouts (30s query, 15s publish) to reduce failure rate.
- Added visual feedback (logs) during relay connection and querying.
- Refactored `src/ops.mjs` to support flexible installation paths.
- Updated `src/torch-config.mjs` to support config resolution from parent directories (e.g., when running via `npm run --prefix`).
Co-authored-by: PR0M3TH3AN <[email protected]>
- Modified `src/ops.mjs` to create `torch-config.json` in `paths.root` instead of `paths.torchDir` during `cmdInit`.
- This aligns the initialization behavior with the documentation (`README.md`) and resolves a discrepancy found by `test/ops.test.mjs`.
- Verified with `npm test`.
- Included `docs-agent` run artifact `src/context/CONTEXT_2026-02-16T00-33-39Z.md`.
- Included `task-logs/daily/2026-02-16T00-35-14Z__docs-agent__completed.md`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Modify `src/ops.mjs` to copy all critical application directories (`src`, `bin`, `dashboard`, `scripts`, etc.) and files (`package.json`, `build.mjs`) to the `torch/` directory during `init` and `update`.
- Update `src/ops.mjs` to generate `torch-config.json` inside the `torch/` directory (if missing) instead of only in the project root, supporting self-contained execution.
- Update `src/roster.mjs` to fallback to checking for `roster.json` in the current working directory, enabling `npm run` commands to work correctly when executed from within the `torch/` directory.
- This allows `torch/` to function as a standalone sub-package within a project, where users can `cd torch`, `npm install`, and `npm run build` as expected.
Co-authored-by: PR0M3TH3AN <[email protected]>
