Decomposed src/lib.mjs into src/cmd-check.mjs, src/cmd-list.mjs, and src/cmd-complete.mjs to reduce file size.
Extracted logic preserves existing behavior.
Verified with lint and tests.
Reduced src/lib.mjs by 292 lines.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Moved `withTimeout` implementation to `src/lock-utils.mjs` and exported it correctly.
- Removed duplicate local definitions of `withTimeout`, `mergeRelayList`, and `secureRandom` in `src/lock-ops.mjs` and `src/lock-publisher.mjs`.
- Fixed imports in `src/lock-ops.mjs`, `src/lock-publisher.mjs`, and `src/relay-health.mjs` to use `src/lock-utils.mjs` consistently.
- Updated `test/utils.test.mjs` and `test/utils-async.test.mjs` to fix broken imports and test definitions.
- Verified `npm run lock:complete` and `npm run scheduler:daily` execute correctly.
- Updated `src/todo/TODO_2026-02-20T03-00-00Z.md` to mark verification task as completed.
- Verified `src/relay-health.mjs` does not use `MINUTE_MS` locally, despite mysterious CI error. Confirmed imports are correct.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Removed unused `getTtl` import from `src/torch-config.mjs` in `src/lib.mjs` to fix CI lint failure.
- Verified with `npm run lint` and `npm test test/lib.test.mjs`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Extracted command logic from `src/lib.mjs` `main` function into `COMMAND_HANDLERS` dispatch map.
- Simplified `main` function to perform argument parsing and dispatching.
- Added `test/main-dispatch.test.mjs` to verify dispatch logic and error handling.
- Ensured no regressions in CLI behavior.
Co-authored-by: PR0M3TH3AN <[email protected]>
- governance/index.js: archive filenames now include ISO timestamp for
deterministic sorting (<base>_<ts>_<hash>.md); write .meta.json sidecar
on every archive with proposalId, author, reason, and archivedAt
- governance/index.js: add listPromptVersions(target) — returns archived
versions for a prompt sorted newest-first with sidecar metadata surfaced
- cmd-rollback.mjs: add --list flag to list available versions without
restoring (delegates to listPromptVersions)
- cli-parser.mjs: add --list and --output flags
- lib.mjs: pass list flag to cmdRollback; add backup command dispatch
- cmd-backup.mjs: new torch-lock backup command — snapshots
.scheduler-memory/memory-store.json and scheduler run state to
.torch/backups/<timestamp>/; supports --output override and --list
- docs/prompt-versioning.md: comprehensive guide to the full
proposal → apply → list-versions → rollback workflow, state backup
and restore procedure, and storage location reference
- test/governance.test.mjs: 7 scenario-based tests (SCN-proposal-create,
SCN-proposal-list, SCN-proposal-reject, SCN-archive-naming,
SCN-version-list, SCN-rollback-latest, SCN-rollback-hash)
https://claude.ai/code/session_01Ndq2D72Kp77BYo4owD63uY
Users who installed TORCH via `npm install <tarball> && npx torch-lock init`
had no built-in way to cleanly remove it. This adds a `remove` command that
detects and removes all TORCH artifacts: the torch/ directory, config files,
runtime directories (.torch/, .scheduler-memory/, task-logs/), governance
proposals, host package.json scripts, and the npm package itself.
- Add cmdRemove() in src/ops.mjs with detection, preview, confirmation, and cleanup
- Wire up `remove` command in CLI dispatcher (src/lib.mjs)
- Add TORCH_HOST_SCRIPTS constant in constants.mjs for shared script key list
- Add docs/removal.md with full manual removal instructions
- Add removal section to README.md
- Add 7 scenario tests in test/ops-remove.test.mjs
https://claude.ai/code/session_011Snrxu3iZGLtJ9pnFSajpM
Implement a comprehensive governance system to manage agent prompt changes safely.
Key features:
- **Proposal Workflow:** Prompt changes are now "proposals" stored in `src/proposals/` with metadata and diffs.
- **Governance Agent:** A new `governance-agent` reviews and applies proposals using `scripts/governance/process-proposals.mjs`.
- **Validation:** Strict validation ensures changes are limited to allowed directories (`src/prompts/daily|weekly`) and preserve required headers.
- **Lock Enhancements:** Lock events now include `promptHash`, `promptPath`, and `gitCommit` for full auditability.
- **Rollback:** New `torch-lock rollback` command restores prompts from local history (`.torch/prompt-history/`) or git.
- **CLI:** Added `proposal` (create, list, show, apply, reject) and `rollback` commands.
This establishes a "Stage -> Evaluate -> Apply" gate for prompt evolution, preventing silent drift and ensuring constitutional stability.
Co-authored-by: PR0M3TH3AN <[email protected]>
Replaces synchronous `fs.readFileSync` with `fs.promises.readFile` in `loadTorchConfig` to prevent event loop blocking.
Updates all dependent configuration getters and consumers to use async/await.
Includes benchmark proving non-blocking behavior.
Fixes dashboard tests to properly await server listening.
Co-authored-by: PR0M3TH3AN <[email protected]>
Moved the large usage help text from `src/lib.mjs` to `src/constants.mjs` to improve readability and maintainability of the library file.
- Added `USAGE_TEXT` to `src/constants.mjs`.
- Updated `src/lib.mjs` to import and use `USAGE_TEXT`.
- Removed unused `DEFAULT_DASHBOARD_PORT` import from `src/lib.mjs`.
Co-authored-by: PR0M3TH3AN <[email protected]>
This commit addresses the missing authentication vulnerability in the
dashboard server.
Changes:
- Added Basic Authentication support via TORCH_DASHBOARD_AUTH env var
or dashboard.auth config field.
- Defaulted dashboard host binding to 127.0.0.1 for better security.
- Added --host CLI argument to allow overriding the bind address.
- Used crypto.timingSafeEqual for secure credential comparison.
- Fixed a potential crash when parsing malformed Authorization headers.
- Added comprehensive unit tests for dashboard authentication.
- Updated documentation in README.md and torch-config.example.json.
Co-authored-by: PR0M3TH3AN <[email protected]>
This change enables agents to report their execution platform (e.g., Jules, Codex, Goose) and model (e.g., DeepSeek 3.2) in the Nostr lock events.
Key changes:
- Updated `torch-lock` CLI to accept `--platform` and `--model` arguments.
- Implemented `detectPlatform` utility to infer platform from environment variables if not provided.
- Updated `src/lib.mjs` to include these fields in the event content.
- Updated `scripts/agent/run-scheduler-cycle.mjs` to propagate `--model` and `AGENT_MODEL`.
- Updated `dashboard/index.html` to display the model information on the lock card.
- Fixed a regression in `scripts/validate-scheduler-flow-parity.mjs` and `test/scheduler-ratchet.test.mjs` caused by argument string matching.
- Deleted `repro_test.mjs` temporary file.
Co-authored-by: PR0M3TH3AN <[email protected]>
This change implements several optimizations to reduce token consumption and improve agent context:
1. **Log Truncation**: `scripts/agent/run-scheduler-cycle.mjs` now truncates the echoed output of spawned processes to 20KB per stream (stdout/stderr). This prevents the scheduler agent's context from being flooded with excessive logs from sub-agents.
2. **Memory Injection**: `torch-config.json`'s `retrieveCommand` has been updated to write retrieved memories to `.scheduler-memory/latest/<cadence>/memories.md`. `scripts/agent/run-selected-prompt.mjs` now checks for this file and injects its content into the agent's prompt, providing immediate context from the memory system.
3. **CLI Optimization**: The `torch-lock list-memories` command now truncates the `content` field of memories to 200 characters by default. A new `--full` flag has been added to `src/cli-parser.mjs` and `src/lib.mjs` to view the full content when needed.
These changes aim to make the agent process more efficient ("error on the side of caution") and leverage the memory system more effectively.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Added `getHashtag` function to `src/torch-config.mjs` to resolve hashtag from `NOSTR_LOCK_HASHTAG` env var, `dashboard.hashtag` config, or default to `${namespace}-agent-lock`.
- Updated `src/lib.mjs` to use `getHashtag()` in `cmdLock` and `cmdComplete` for publishing events.
- Updated `dashboard/index.html` to remove hardcoded `#torch-agent-lock` string and rely on dynamic configuration.
- Updated `src/docs/TORCH.md` and `README.md` to document the new configuration options.
- Verified changes with unit tests and frontend verification script.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Extracted `parseArgs` function from `src/lib.mjs` to `src/cli-parser.mjs`.
- Added unit tests for argument parsing logic in `test/cli-parser.test.mjs`.
- Updated `src/lib.mjs` to import `parseArgs`.
- Fixed roster drift in `src/prompts/weekly-scheduler.md` to match `roster.json`.
- Verified with `npm test` and `npm run lint`.
- Completed weekly scheduler task for `refactor-agent`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Added JSDoc to all exported functions in src/lib.mjs
- Added detailed flow comments for cmdLock and cmdComplete
- Created docs/lib-overview.md with high-level architectural documentation
- Created src/context/CONTEXT_2026-02-14T21-30-00Z.md
- Updated task-logs/daily/ with completion record
Co-authored-by: PR0M3TH3AN <[email protected]>
- Update `torch-lock check` to scan `task-logs/<cadence>` for completed tasks.
- Add `--log-dir` and `--ignore-logs` flags to `check` command.
- Implement `getIsoWeekStr` utility for robust weekly cadence checking.
- Ensure completed agents are added to the `excluded` list, enabling the scheduler to skip them.
- Add comprehensive tests for log checking and date utilities.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Fix multiple syntax errors in `src/lib.mjs` (redundant declarations, broken loops, missing imports).
- Fix syntax error in `src/dashboard.mjs` (invalid catch block).
- Remove redundant local function definitions in `src/lib.mjs` in favor of imports from `src/torch-config.mjs` and `src/utils.mjs`.
- Update `landing/index.html` installation command to include `npx torch-lock init` step.
- Verify `torch-lock init` works correctly.
- Ensure all tests pass and linting is clean for `src/lib.mjs`.
Co-authored-by: PR0M3TH3AN <[email protected]>
Optimized `cmdCheck` and `cmdList` in `src/lib.mjs` by replacing O(N*M) linear scans with O(N) Set lookups.
- Introduced `rosterSet` and `excludedAgentsSet` to replace `Array.includes()` calls with `Set.has()`.
- Benchmark showed ~99% performance improvement (from ~280ms to ~2ms for 10k agents and 2k locks).
- Verified with existing tests and custom benchmark.
Co-authored-by: PR0M3TH3AN <[email protected]>
Refactor src/lib.mjs to support dependency injection for cmdCheck, cmdLock, and cmdList.
This allows unit testing without heavy mocking frameworks or side effects.
Add test/lib.test.mjs covering:
- cmdCheck: happy path, paused/excluded agents, unknown agents.
- cmdLock: success, roster check, existing lock check, race check (lost), dry run.
- cmdList: listing locks, empty state.
Coverage for src/lib.mjs is now significantly improved.
Verification: Ran `npm test` and verified all tests pass.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Added KIND_APP_DATA to src/constants.mjs
- Updated src/lib.mjs, src/lock-ops.mjs, and dashboard/index.html to use the constant
- Added missing src files to package.json files list
- Updated build.mjs to copy src/constants.mjs to dist/src/
Co-authored-by: PR0M3TH3AN <[email protected]>
Converted the dashboard HTTP request handler to an async function and replaced synchronous `fs.existsSync` and `fs.statSync` calls with non-blocking `fs.promises.stat`. This improves server responsiveness and concurrency by ensuring the event loop is not blocked during file system checks.
Also added robust error handling to the asynchronous handler to prevent unhandled promise rejections and ensure consistent 500 responses on internal errors.
Co-authored-by: PR0M3TH3AN <[email protected]>
Replaced empty catch blocks in `loadCanonicalRoster` and `parseLockEvent`
with `console.debug` statements that log the error message. This
improves observability of failures while maintaining the graceful
fallback behavior.
Co-authored-by: PR0M3TH3AN <[email protected]>
Explicitly bind the dashboard server to the local loopback interface
to prevent external access. This addresses a vulnerability where
the server was binding to all network interfaces by default.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Modified `src/lib.mjs` to execute `queryLocks` for all cadences in parallel.
- Added `scripts/perf-benchmark.mjs` for measuring CLI performance.
- Added `weekly-perf-report-2026-02-14.md` with baseline and verification data.
- Added `task-logs/weekly/2026-02-14T13-14-38Z__perf-deepdive-agent__completed.md`.
Co-authored-by: PR0M3TH3AN <[email protected]>
