- Executed torch-garbage-collection-agent (daily)
- Checked for stale logs (> 14 days) in repo root (none found)
- Ran npm test (369 passed, 1 flake documented and verified on retry)
- Created required artifacts (context, test_logs)
- Created completion log in task-logs/daily/
Co-authored-by: PR0M3TH3AN <[email protected]>
- Scanned src/ and dashboard/ for TODO/FIXME/XXX markers.
- Found no actionable TODOs in source code.
- Created required run artifacts (CONTEXT, TODO, DECISIONS, TEST_LOG).
- Stored memory update.
- Published completion to relays.
- Created completion task log.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Executed audit-agent
- Generated audit reports in reports/audit/
- Created run artifacts in src/context, src/todo, src/decisions, src/test_logs
- Created completion log in task-logs/daily/
Co-authored-by: PR0M3TH3AN <[email protected]>
This commit updates TORCH.md with a new "Long-term Memory" section.
It explains how agents can read past learnings from `.scheduler-memory/latest/<cadence>/memories.md` and persist new learnings by creating a `memory-update.md` file. It also provides examples of good and bad memory content.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Executed load-test-agent in dry-run mode.
- Created context, todo, decisions, and test logs.
- Generated load test reports in reports/load-test/.
- Updated agent memory.
- Released lock and logged completion.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Executed `known-issues-agent` as part of daily schedule.
- Verified active issues: `scheduler-preflight-lock`, `memory-telemetry`, and Sandbox EPERM tests pass in Jules environment.
- Updated `KNOWN_ISSUES.md` with verification results.
- Generated `reports/known-issues/known-issues-report-2026-02-23.md`.
- Created scheduler completion log to maintain roster rotation.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Implement `scripts/agent/simple-relay.mjs` for local load testing
- Execute `load-test-agent` prompt via scheduler flow
- Generate load test reports and run artifacts
- Complete daily task for `load-test-agent`
Co-authored-by: PR0M3TH3AN <[email protected]>
Migrated innerHTML usage in landing/index.html to safer DOM APIs.
Reduced innerHTML count from 4 to 1.
One instance of innerHTML (marked.parse) was retained as it parses trusted content.
Verified with lint and Playwright.
Executed prompt: src/prompts/daily/innerhtml-migration-agent.md
Agent: innerhtml-migration-agent
Cadence: daily
Co-authored-by: PR0M3TH3AN <[email protected]>
- Update TORCH.md to include missing scripts (e.g., test:playwright).
- Clarify npm test and validate:scheduler descriptions.
- Execute daily scheduler flow for docs-alignment-agent.
- Create run artifacts and memory updates.
Co-authored-by: PR0M3TH3AN <[email protected]>
Renames the unused catch error variable `e` to `_` in `test/playwright/dashboard.spec.js` to satisfy the ESLint `no-unused-vars` rule. This fixes the CI failure.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Added `@playwright/test` and `c8` dependencies.
- Configured Playwright in `playwright.config.js` to run the dashboard server.
- Added `test/playwright/dashboard.spec.js` to verify dashboard functionality (loading, auth, config) and capture console logs.
- Modified `src/dashboard.mjs` to support graceful shutdown via `/shutdown` endpoint (guarded by `NODE_V8_COVERAGE`) for coverage collection.
- Updated `package.json` with `test:playwright` and `test:playwright:coverage` scripts.
- Updated `.gitignore` to exclude coverage and test artifacts.
- Fixed `host` default value in `src/cli-parser.mjs`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Executed scheduler flow for `docs-agent`.
- Audited `README.md`, `CONTRIBUTING.md`, and `AGENTS.md` against codebase.
- Verified existence of documented commands (`npm test`, `npm run lint`).
- Created run artifacts in `src/context/`, `src/todo/`, `src/decisions/`, `src/test_logs/`.
- Created task completion log in `task-logs/daily/`.
Co-authored-by: PR0M3TH3AN <[email protected]>
Replaced synchronous `execSync` with asynchronous `exec` (promisified) in `test/ops.test.mjs` to allow the parent process's mock WebSocket server to handle connections from the child process.
Added `NOSTR_LOCK_RELAY_FALLBACKS: ''` to the child process environment to prevent `nostr-tools` from attempting to connect to default public relays, which caused hangs in restricted CI environments.
Updated `test/ops.test.mjs` to mock a relay response (EOSE) for robust integration testing without external network dependencies.
Co-authored-by: PR0M3TH3AN <[email protected]>
Decomposed src/lib.mjs into src/cmd-check.mjs, src/cmd-list.mjs, and src/cmd-complete.mjs to reduce file size.
Extracted logic preserves existing behavior.
Verified with lint and tests.
Reduced src/lib.mjs by 292 lines.
Co-authored-by: PR0M3TH3AN <[email protected]>
Updated `test/test-audit-run-flaky-check.test.mjs` to assert against test names instead of file paths, as `scripts/test-audit/run-flaky-check.mjs` keys the results by test name from the TAP output.
This resolves the CI failure where the test expected keys matching the file paths but received keys matching the test names defined in the fixtures.
Co-authored-by: PR0M3TH3AN <[email protected]>
Added `proposal-triage-agent`, `plan-agent`, `builder-agent`, and `governance-agent` to the landing page `AGENT_ICONS` map. This ensures these agents are correctly displayed with appropriate icons in the Functional Agents section.
Verified that `src/prompts/weekly-scheduler.md` and `src/prompts/roster.json` already correctly list these agents.
Verified frontend changes using Playwright.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Mitigate command injection in `src/services/governance/index.js` by using explicit array arguments with `execFileSync` and adding a security comment.
- Add regression test `test/governance-security.test.mjs` verifying the fix against simulated exploit attempts.
- Fix CI build failures by resolving circular dependencies and duplicate declarations in `src/lock-utils.mjs`, `src/lock-ops.mjs`, `src/lock-publisher.mjs`, and `src/relay-health.mjs`.
- Resolve linting errors in tests and implementation files.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Mitigate command injection in `src/services/governance/index.js` by using explicit array arguments with `execFileSync` and adding a security comment.
- Add regression test `test/governance-security.test.mjs` verifying the fix against simulated exploit attempts.
- Fix CI build failures by resolving circular dependencies and duplicate declarations in `src/lock-utils.mjs`, `src/lock-ops.mjs`, `src/lock-publisher.mjs`, and `src/relay-health.mjs`.
- Resolve linting errors in tests and implementation files.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Rewrote `src/lock-publisher.mjs` to ensure clean imports and no duplicate declarations of `withTimeout`.
- This addresses the lint error `Identifier 'withTimeout' has already been declared` seen in CI.
- Verified lint passes locally.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Fix `SyntaxError: The requested module './lock-utils.mjs' does not provide an export named 'withTimeout'` by refactoring exports in `src/lock-utils.mjs`.
- Explicitly import `relayListLabel` and `mergeRelayList` from `src/utils.mjs` before exporting them to avoid ambiguous export behavior in some environments.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Mitigate command injection in `src/services/governance/index.js` by using explicit array arguments with `execFileSync` and adding a security comment.
- Add regression test `test/governance-security.test.mjs` verifying the fix against simulated exploit attempts.
- Fix CI build failures by resolving circular dependencies and duplicate declarations in `src/lock-utils.mjs`, `src/lock-ops.mjs`, `src/lock-publisher.mjs`, and `src/relay-health.mjs`.
- Resolve linting errors in tests and implementation files.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Removed `randomInt` from `src/lock-publisher.mjs` imports as it is no longer used (replaced by `secureRandom` from `src/lock-utils.mjs`).
- Verified lint passes locally.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Imported `secureRandom` from `src/lock-utils.mjs` in `src/lock-publisher.mjs`.
- Removed duplicate local definition of `secureRandom` in `src/lock-publisher.mjs`.
- Verified lint passes locally.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Mitigate command injection in `src/services/governance/index.js` by using explicit array arguments with `execFileSync` and adding a security comment.
- Add regression test `test/governance-security.test.mjs` verifying the fix against simulated exploit attempts.
- Fix CI build failures by resolving circular dependencies and duplicate declarations in `src/lock-utils.mjs`, `src/lock-ops.mjs`, `src/lock-publisher.mjs`, and `src/relay-health.mjs`.
- Resolve linting errors in tests and implementation files.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Imported `randomInt` from `node:crypto` in `src/lock-publisher.mjs` to fix CI failure.
- Centralized `withTimeout` and `mergeRelayList` in `src/utils.mjs`.
- Updated `src/lock-utils.mjs` to re-export them.
- Removed local redefinitions in `src/lock-ops.mjs` and `src/lock-publisher.mjs`.
- Fixed `test/utils.test.mjs` imports.
- Verified all tests pass.
This resolves the N/A documentation task by ensuring the codebase is in a valid state.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Moved `withTimeout` implementation to `src/lock-utils.mjs` and exported it correctly.
- Removed duplicate local definitions of `withTimeout`, `mergeRelayList`, and `secureRandom` in `src/lock-ops.mjs` and `src/lock-publisher.mjs`.
- Fixed imports in `src/lock-ops.mjs`, `src/lock-publisher.mjs`, and `src/relay-health.mjs` to use `src/lock-utils.mjs` consistently.
- Updated `test/utils.test.mjs` and `test/utils-async.test.mjs` to fix broken imports and test definitions.
- Verified `npm run lock:complete` and `npm run scheduler:daily` execute correctly.
- Updated `src/todo/TODO_2026-02-20T03-00-00Z.md` to mark verification task as completed.
- Verified `src/relay-health.mjs` does not use `MINUTE_MS` locally, despite mysterious CI error. Confirmed imports are correct.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Removes `PUBLISH_ERROR_CODES` from `src/lock-publisher.mjs` imports as it was unused and caused a lint failure in CI.
- Verified with `npm run lint` and relevant tests.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Remove unused `manifest` variable from destructuring in `test/cmd-backup.test.mjs` to resolve ESLint error.
- Verified fix with `npm run lint`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Fixes CI failure in `test/install_dir_validation.test.mjs` where `assert.notMatch` was undefined.
- `assert.doesNotMatch` is the standard Node.js assertion method for negative regex matching.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Removed unused `getTtl` import from `src/torch-config.mjs` in `src/lib.mjs` to fix CI lint failure.
- Verified with `npm run lint` and `npm test test/lib.test.mjs`.
Co-authored-by: PR0M3TH3AN <[email protected]>
Refactor `src/cmd-proposal.mjs` to use dependency injection for testability.
Add `test/cmd-proposal.test.mjs` to verify all subcommands (`create`, `list`, `apply`, `reject`, `show`) and error handling.
Fix indentation in `src/cmd-proposal.mjs`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Replaced manual promise management in `src/services/memory/index.js` with a `CoalescingWorker` class.
- Extracted `performSave` logic into `performSave` function used by the worker (worker function).
- Ensures concurrent calls to `saveMemoryStore` are coalesced into a single pending operation, maintaining data integrity and performance.
- Removed global state variables for promise management.
Co-authored-by: PR0M3TH3AN <[email protected]>
Replaces aggressive `cache.clear()` with per-agent invalidation in `src/services/memory/index.js` to improve performance.
- Adds `prune(predicate)` to `createMemoryCache`.
- Updates `ingestEvents`, `runPruneCycle`, `pinMemory`, `unpinMemory`, and `markMemoryMerged` to invalidate only the affected agent's cache entries.
- Adds unit test for `prune` in `test/memory-cache.test.mjs`.
Co-authored-by: PR0M3TH3AN <[email protected]>
Replaces the unconditional global expiration scan in `setRuntimeEvent` with a scoped expiration check, significantly reducing overhead for cache writes. Global expiration is now only triggered when the cache reaches its capacity limit.
This change improves `setRuntimeEvent` performance by ~3.5x in benchmarks with 5000 active events.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Add rate limiting to prevent brute force attacks on dashboard authentication
- Block IPs for 5 minutes after 5 failed attempts
- Return 429 Too Many Requests when blocked
- Clean up state periodically to prevent memory leaks
Co-authored-by: PR0M3TH3AN <[email protected]>
- Refactor `cmdBackup` and `listBackups` in `src/cmd-backup.mjs` to accept `cwd` parameter for dependency injection.
- Add `test/cmd-backup.test.mjs` to test backup creation, missing files handling, output override, and listing functionality.
- Ensure tests run in isolated temporary directories using `fs.mkdtemp`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Extracted `LockPublisher` and `publishLock` to `src/lock-publisher.mjs` (already existed, but cleaned up).
- Refactored `src/lock-publisher.mjs` to import error constants and classification logic from `src/lock-error-classifier.mjs` instead of duplicating them.
- Refactored `src/lock-publisher.mjs` and `src/lock-utils.mjs` to use `mergeRelayList` from `src/utils.mjs`.
- Consolidated and moved publisher tests from `test/lock-ops.test.mjs` and `test/lock-ops-publish-retry.test.mjs` to `test/lock-publisher.test.mjs`.
- Cleaned up `src/lock-utils.mjs` to remove duplicate `mergeRelayList`.
- Verified changes with tests.
Co-authored-by: PR0M3TH3AN <[email protected]>
Verified that ajv (6.14.0) and minimatch (10.2.2) are at secure versions in the repository.
Ran npm audit to confirm 0 vulnerabilities.
Marked investigation tasks as completed in src/todo/TODO_2026-02-20T01-13-24Z.md.
Co-authored-by: PR0M3TH3AN <[email protected]>
Refactor cmdRollback to support dependency injection and add comprehensive unit tests covering validation, version listing, and rollback operations.
- Refactor `src/cmd-rollback.mjs` to accept `deps` argument.
- Create `test/cmd-rollback.test.mjs` with test cases for happy paths and error conditions.
Co-authored-by: PR0M3TH3AN <[email protected]>
`assert.notMatch` is not a valid function in Node.js `node:assert` module. The correct function is `assert.doesNotMatch`. This caused `test/install_dir_validation.test.mjs` to fail.
This commit replaces the incorrect usage to fix the test failure.
Co-authored-by: PR0M3TH3AN <[email protected]>
This change confirms the decomposition of `src/lock-ops.mjs` into `src/relay-health-manager.mjs` and `src/lock-publisher.mjs`.
- `RelayHealthManager` is now imported from `src/relay-health-manager.mjs`.
- `LockPublisher` is now imported from `src/lock-publisher.mjs`.
- `src/lock-ops.mjs` acts as an entry point re-exporting these classes.
- Tests in `test/lock-ops.test.mjs` pass.
- The TODO file `src/todo/TODO_2026-02-20T02-28-25Z.md` is deleted as all tasks are completed.
- A comment was added to `src/lock-ops.mjs` to document the refactoring.
Co-authored-by: PR0M3TH3AN <[email protected]>
The `perf-agent` prompt contained detailed instructions to audit `/content` upload documentation and features. Since no such features or documentation exist in the repository (as confirmed by `content-audit-agent`), these instructions were causing confusion and wasted effort.
This change removes:
- The "Docs audit" sub-workflow and its associated steps.
- References to `/content` and upload/contribution docs in the Mission, Focus, and Goals.
- The "docs: `/content` upload alignment" PR template.
This aligns the agent's instructions with the actual codebase capabilities.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Implemented `verifyPassword` helper in `src/dashboard.mjs` to support hashed passwords.
- Added support for `scrypt:<salt>:<hash>` format for storing credentials.
- Maintained backward compatibility for plaintext passwords using `timingSafeCompare`.
- Updated `cmdDashboard` to use the new verification logic.
- Added comprehensive tests in `test/dashboard-auth.test.mjs` for hashed credential validation.
This change eliminates the need to store plaintext passwords in `torch-config.json` or environment variables, addressing a security vulnerability.
Co-authored-by: PR0M3TH3AN <[email protected]>
Upgraded `eslint` to `^10.0.1` which updated `minimatch` to `10.2.2` (resolving ReDoS vulnerability).
Ran `npm audit fix` which updated `ajv` to `6.14.0` (resolving ReDoS vulnerability).
Verified with `npm test` and `npm run lint`.
Marked tasks as completed in `src/todo/TODO_2026-02-20T01-13-24Z.md`.
Co-authored-by: PR0M3TH3AN <[email protected]>
Refactor test/install_dir_validation.test.mjs to use unique temporary directories for each subtest, eliminating shared state and race conditions that caused flakiness.
Update KNOWN_ISSUES.md to mark the issue as resolved.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Executed test-audit-agent prompt
- Ran static analysis and flakiness check
- Identified and reported consistent failures in load-test.mjs and smoke-test.mjs
- Updated KNOWN_ISSUES.md
- Created run artifacts (Context, Todo, Decisions, Test Logs)
- Completed lock cycle
Co-authored-by: PR0M3TH3AN <[email protected]>
- Centralized `withTimeout` and `mergeRelayList` in `src/utils.mjs`.
- Updated `src/lock-utils.mjs` to re-export them.
- Removed local redefinitions in `src/lock-ops.mjs` and `src/lock-publisher.mjs`.
- Fixed `test/utils.test.mjs` imports.
- Verified all tests pass.
This resolves the N/A documentation task by ensuring the codebase is in a valid state.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Fix lint error in `test/verify-example-config-security.test.mjs` (unused var).
- Fix duplicate definitions of `mergeRelayList` and `relayListLabel` in `src/lock-ops.mjs` and `src/lock-publisher.mjs`.
- Fix missing export of `withTimeout` in `src/lock-utils.mjs`.
- Fix broken imports in `test/utils.test.mjs` and `test/utils-async.test.mjs`.
- Centralize `secureRandom` in `src/lock-utils.mjs`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Add regression test `test/governance-security.test.mjs` to verify `applyProposal` is secure against command injection.
- Fix broken imports and duplicates in `src/lock-utils.mjs`, `src/lock-ops.mjs`, `src/lock-publisher.mjs`, and `src/relay-health.mjs` to resolve test failures.
- Verify all tests pass.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Moved `withTimeout` and `mergeRelayList` to `src/lock-utils.mjs` as the single source of truth.
- Updated `src/lock-ops.mjs` and `src/lock-publisher.mjs` to import from `src/lock-utils.mjs`.
- Fixed lint errors for duplicate declarations.
- Updated tests (`test/utils.test.mjs`, `test/utils-async.test.mjs`) to import from correct modules.
- Added `randomInt` import in `src/lock-publisher.mjs` to fix `no-undef`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Moved `withTimeout` to `src/utils.mjs` and exported it.
- Updated `src/lock-utils.mjs` to re-export `withTimeout` and `mergeRelayList` from `src/utils.mjs`.
- Removed duplicate local definitions of `withTimeout` and `mergeRelayList` in `src/lock-ops.mjs` and `src/lock-publisher.mjs`.
- Fixed `test/utils.test.mjs` to import `mergeRelayList`.
- Verified all tests pass with `npm test`.
Co-authored-by: PR0M3TH3AN <[email protected]>
Removes the hardcoded `auth: "admin:password"` from `torch-config.example.json` to prevent users from accidentally deploying with insecure defaults.
Adds a regression test `test/verify-example-config-security.test.mjs` to ensure the example config does not contain default credentials in the future.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Moved `withTimeout` implementation to `src/lock-utils.mjs` and exported it correctly.
- Removed duplicate local definitions of `withTimeout`, `mergeRelayList`, and `secureRandom` in `src/lock-ops.mjs` and `src/lock-publisher.mjs`.
- Fixed imports in `src/lock-ops.mjs`, `src/lock-publisher.mjs`, and `src/relay-health.mjs` to use `src/lock-utils.mjs` consistently.
- Updated `test/utils.test.mjs` and `test/utils-async.test.mjs` to fix broken imports and test definitions.
- Verified `npm run lock:complete` and `npm run scheduler:daily` execute correctly.
- Updated `src/todo/TODO_2026-02-20T03-00-00Z.md` to mark verification task as completed.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Scanned codebase for `setInterval`, `Promise.all`, and other async patterns.
- Generated `reports/performance/hits-2026-02-20.json`.
- Identified potential unbounded concurrency in `src/services/memory`.
- Created daily performance report.
- Updated run artifacts and memory.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Implemented throttling in `performSave` to limit disk writes to max 1 per second.
- Refactored `updateMemoryUsage` to use non-blocking (fire-and-forget) save calls, eliminating latency for memory reads.
- Added atomic write strategy using unique temporary files and `fs.rename` to prevent data corruption.
- Verified with benchmarks: `getRelevantMemories` latency reduced from ~100ms to ~30ms for 10k items.
Co-authored-by: PR0M3TH3AN <[email protected]>
Moved unit tests for `withTimeout` from `test/utils.test.mjs` to `test/utils-async.test.mjs`.
This prevents potential interference from `MockTimers` enabled in `test/utils.test.mjs` which could affect `setTimeout` behavior in async tests.
Increased timeout margins in `withTimeout` tests for better reliability in CI.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Extracted command logic from `src/lib.mjs` `main` function into `COMMAND_HANDLERS` dispatch map.
- Simplified `main` function to perform argument parsing and dispatching.
- Added `test/main-dispatch.test.mjs` to verify dispatch logic and error handling.
- Ensured no regressions in CLI behavior.
Co-authored-by: PR0M3TH3AN <[email protected]>
