- Add --test-timeout=30000 to prevent test suite hanging
- Skip build_verification.test.mjs when dist/ is absent
- Replace setTimeout with mocked Date.now in memory-cache expiry test
- Replace wait(30) with setImmediate flush in scheduler smoke test
- Remove unused @playwright/test devDependency
https://claude.ai/code/session_01GfwUNbgeMgXreFDbsNQMsS
- Fix timingSafeCompare to pad buffers to equal length before comparing,
closing the content timing side-channel on length mismatch
- Replace innerHTML with textContent for error messages to prevent XSS
- Extract inline script from dashboard/index.html into dashboard/app.js
- Remove 'unsafe-inline' from script-src CSP directive
- Update security test to match new CSP policy
https://claude.ai/code/session_01GfwUNbgeMgXreFDbsNQMsS
- Updates `test/run-scheduler-cycle-memory-policy.test.mjs` to copy `src/utils.mjs`, `src/torch-config.mjs`, `src/constants.mjs`, `src/relay-health.mjs`, and `src/lock-ops.mjs` to the temporary test environment.
- Symlinks `node_modules` into the test environment to resolve external dependencies (e.g., `nostr-tools`).
- Resolves `ERR_MODULE_NOT_FOUND` errors during CI.
- Includes Protocol Research Agent daily run artifacts (Protocol Inventory update and Report).
Co-authored-by: PR0M3TH3AN <[email protected]>
- Explicitly sets `AGENT_PLATFORM: 'codex'` in `test/run-scheduler-cycle-memory-policy.test.mjs` for tests that assert platform-specific output.
- Resolves CI failures where `detectPlatform` was falling back to `'unknown'` or the host environment's platform, causing assertion mismatches.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Addresses `ERR_MODULE_NOT_FOUND` in `test/run-scheduler-cycle-memory-policy.test.mjs` caused by missing dependency in the temporary test environment.
- Ensures `src/utils.mjs` is available for `scripts/agent/run-scheduler-cycle.mjs` during test execution.
Co-authored-by: PR0M3TH3AN <[email protected]>
Resolves `ERR_MODULE_NOT_FOUND` in `run-scheduler-cycle-memory-policy.test.mjs` by explicitly copying `src/utils.mjs` to the temporary test directory structure, satisfying the import dependency of `scripts/agent/run-scheduler-cycle.mjs`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Updated `test/scheduler-preflight-lock.e2e.test.mjs` to expect `detectPlatform() || 'unknown'` instead of hardcoding `'codex'`.
- This ensures the test passes in CI environments where `detectPlatform()` returns `null`, causing the script to default to `'unknown'`, as well as in local environments where it detects a platform like `'jules'`. This aligns with the updated default logic in `run-scheduler-cycle.mjs`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Updated `test/scheduler-preflight-lock.e2e.test.mjs` to expect `detectPlatform() || 'codex'` instead of hardcoding `'codex'`.
- This ensures the test passes when running in environments where the platform is correctly detected (e.g., 'jules'), aligning with the changes made in the previous commit.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Updated `src/utils.mjs` to detect 'claude' platform via `CLAUDE_API_KEY`, `ANTHROPIC_API_KEY`, or `CLAUDE_SESSION_ID`.
- Updated `scripts/agent/scheduler-utils.mjs` `getSafeEnv` to preserve `JULES_`, `CODEX_`, `CLAUDE_`, `ANTHROPIC_`, and `GOOSE_` environment variables when spawning child processes.
- Updated `scripts/agent/run-scheduler-cycle.mjs` to use `detectPlatform()` as a fallback for `AGENT_PLATFORM` instead of hardcoding `'codex'`, ensuring the correct platform is used for lock creation.
- Added unit tests for `detectPlatform` in `test/utils.test.mjs`.
- Fixed `test/scheduler-lock-failure-schema.contract.test.mjs` to include `src/utils.mjs` in the temporary test environment, resolving `ERR_MODULE_NOT_FOUND`.
This resolves the issue where lock cards displayed "Unknown" or incorrect platforms and fixes the resulting CI failure.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Updated `src/utils.mjs` to detect 'claude' platform via `CLAUDE_API_KEY`, `ANTHROPIC_API_KEY`, or `CLAUDE_SESSION_ID`.
- Updated `scripts/agent/scheduler-utils.mjs` `getSafeEnv` to preserve `JULES_`, `CODEX_`, `CLAUDE_`, `ANTHROPIC_`, and `GOOSE_` environment variables when spawning child processes.
- Updated `scripts/agent/run-scheduler-cycle.mjs` to use `detectPlatform()` as a fallback for `AGENT_PLATFORM` instead of hardcoding `'codex'`, ensuring the correct platform is used for lock creation.
- Added unit tests for `detectPlatform` in `test/utils.test.mjs`.
This resolves the issue where lock cards displayed "Unknown" or incorrect platforms.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Refactored `test/memory-scheduler.test.mjs` to use `mock.timers` for deterministic execution, replacing flaky `wait` logic.
- Strengthened `test/lock-ops.test.mjs` with edge case tests for `parseLockEvent` handling invalid JSON and missing fields.
- Fixed a security vulnerability in `src/dashboard.mjs` where sensitive configuration (e.g., rosters, auth) was exposed in `/torch-config.json`.
- Updated `src/prompts/daily/test-audit-agent.md` to comply with the canonical prompt contract.
- Added `reports/test-audit/test-integrity-note-2025-02-14.yaml` detailing test changes and anti-cheat measures.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Implement caching for `rankRelays` to avoid redundant sorting and computations.
- Cache is invalidated on new outcomes or when quarantine status changes.
- Add `_metricsVersion` to track metrics updates.
- Benchmarks show ~3x performance improvement (0.06ms -> 0.02ms per call for 100 relays).
- Add unit tests for caching behavior and invalidation.
- Add `perf/benchmark-lock-ops.mjs`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Use Promise.all to execute memory lifecycle actions concurrently.
- Maintain intra-item dependency order (merged_into before action).
- Update tests to support non-deterministic execution order of independent items.
- Benchmark shows ~65x improvement for 100 items with 10ms latency.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Replaced brittle regex-based sanitization with `path.resolve` relative to `packageRoot`.
- Added `test/dashboard-path-traversal-fix.test.mjs` to verify robust protection against traversal attacks.
- Verified that legitimate access to allowed paths is maintained.
- Verified that access to restricted files (like package.json) is blocked.
- Updated path handling to correctly handle absolute paths and URL-encoded characters.
This change addresses a potential security vulnerability where the previous sanitization logic could be bypassed in certain environments or with specific edge cases. By using standard path resolution and explicitly checking against a canonical root, the implementation is more secure and maintainable.
Co-authored-by: PR0M3TH3AN <[email protected]>
Refactored `src/cmd-list.mjs` to use a `Set` for roster lookups, reducing complexity from O(M*N) to O(M+N).
Added dependency injection to `cmdList` to enable unit testing.
Added `test/cmd-list.test.mjs` to verify functionality.
Co-authored-by: PR0M3TH3AN <[email protected]>
Restrict the /torch-config.json endpoint to only return fields required by the dashboard frontend (dashboard config excluding auth, and nostrLock namespace/relays). This prevents exposure of sensitive internal configuration such as rosters, scheduler settings, and full relay lists.
- Modify src/dashboard.mjs to sanitize config using an allowlist approach.
- Add test/dashboard-config-exposure.test.mjs to verify sensitive fields are stripped.
Co-authored-by: PR0M3TH3AN <[email protected]>
Adds standard HTTP security headers (CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy) to all dashboard responses to mitigate XSS, clickjacking, and MIME sniffing attacks.
Includes verification tests in test/dashboard-security.test.mjs.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Refactor `src/roster.mjs` to support dependency injection for `fs` and `loadTorchConfig`.
- Add `test/roster.test.mjs` to test roster loading scenarios including file precedence, caching, fallback, and configuration overrides.
- Export `_resetRosterCache` in `src/roster.mjs` for testing purposes.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Added `validateInstallDir` function to `src/ops.mjs` to enforce strict allowlist for directory names (alphanumeric, hyphens, underscores, slashes, periods).
- Integrated validation into `resolveConfiguration` to sanitize both interactive and mock inputs.
- Added comprehensive unit tests in `test/install_dir_validation.test.mjs`.
This fixes a vulnerability where malicious directory names could inject shell commands into `package.json` scripts during initialization.
Co-authored-by: PR0M3TH3AN <[email protected]>
Moved the `ensureDir` utility function from `src/ops.mjs` to `src/utils.mjs` to promote code reuse and centralization.
Updated `src/ops.mjs` and `src/services/memory/index.js` to use the shared utility.
Added unit tests for `ensureDir` in `test/utils.test.mjs`.
Co-authored-by: PR0M3TH3AN <[email protected]>
Add comprehensive unit tests for `todayDateStr` and `nowUnix` in `src/utils.mjs`.
These tests use `node:test`'s mock timers to ensure deterministic execution, verifying
that the date formatting and timestamp generation behave as expected.
- `todayDateStr`: verified correct YYYY-MM-DD format
- `nowUnix`: verified correct integer timestamp generation
Co-authored-by: PR0M3TH3AN <[email protected]>
- Remove `src/cmd-check.mjs` as it is not used in the codebase and contains outdated logic.
- Remove `test/cmd-check.test.mjs` as it tests the deleted file.
- Verify that `cmdCheck` in `src/lib.mjs` is covered by `test/lib.test.mjs`.
This improves code health by removing unused and duplicate code.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Executed daily scheduler cycle.
- Selected `decompose-agent` (next in roster).
- Decomposed `scripts/agent/run-scheduler-cycle.mjs` (1127 lines) into `scripts/agent/scheduler-utils.mjs` (195 lines) and `scripts/agent/scheduler-lock.mjs` (173 lines).
- Resulting main file size: 788 lines (339 lines reduction).
- Fixed lint warnings.
- Updated `test/scheduler-preflight-lock.e2e.test.mjs`, `test/run-scheduler-cycle-memory-policy.test.mjs`, `test/scheduler-lock-failure-schema.contract.test.mjs` to copy new modules into test fixtures.
- Updated `test/scheduler-ratchet.test.mjs` to verify moved functions in `scheduler-lock.mjs`.
- Note: `scripts/check-file-size.mjs` was not updated as it lacks the baseline feature referenced in the prompt.
- Created artifacts: `src/context/CONTEXT_...`, `src/decisions/DECISIONS_...`, `src/test_logs/TEST_LOG_...`, `src/todo/TODO_...`.
- Created scheduler log: `task-logs/daily/2026-02-17T22-29-00Z__decompose-agent__completed.md`.
Co-authored-by: PR0M3TH3AN <[email protected]>
