The dashboard previously served the raw `torch-config.json` file, potentially exposing sensitive information like authentication credentials.
This commit modifies the `/torch-config.json` endpoint to:
1. Parse the configuration file.
2. Sanitize the output by removing the `dashboard.auth` field and any unknown fields (using `parseTorchConfig`).
3. Support `TORCH_CONFIG_PATH` environment variable for configuration file location, improving testability and consistency with other components.
Verified with new test `test/dashboard-config-security.test.mjs` and existing auth tests.
Co-authored-by: PR0M3TH3AN <[email protected]>
This patch addresses a security vulnerability where the dashboard server could serve any file from the package root.
Changes:
- Implemented an allowlist in `src/dashboard.mjs` to restrict file access to:
- `dashboard/`
- `assets/`
- `src/docs/`
- `torch-config.json`
- Added `test/dashboard-security.test.mjs` to verify the fix and prevent regressions.
The fix ensures that sensitive files like `package.json` or source code cannot be accessed via the dashboard server.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Update `markMemoryMerged` to accept `options.repository` for better testability.
- Add unit tests in `test/memory-admin.test.mjs` to verify:
- Delegation to repository.
- Cache clearing side effect.
Co-authored-by: PR0M3TH3AN <[email protected]>
Replaced `console.log` with `util.debuglog('torch-memory')` in `src/services/memory/index.js` to prevent stdout pollution. Telemetry and metrics are now logged to stderr only when `NODE_DEBUG=torch-memory` is set, improving library behavior and observability control.
Added regression test `test/memory-telemetry.test.mjs`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Add `test/memory-pinning.test.mjs` to test `pinMemory` happy path and edge cases.
- Update `getRelevantMemories` in `src/services/memory/index.js` to use `repository.listMemories` when available, enabling isolated unit testing.
- Verified all memory tests pass.
Co-authored-by: PR0M3TH3AN <[email protected]>
This commit addresses the missing authentication vulnerability in the
dashboard server.
Changes:
- Added Basic Authentication support via TORCH_DASHBOARD_AUTH env var
or dashboard.auth config field.
- Defaulted dashboard host binding to 127.0.0.1 for better security.
- Added --host CLI argument to allow overriding the bind address.
- Used crypto.timingSafeEqual for secure credential comparison.
- Fixed a potential crash when parsing malformed Authorization headers.
- Added comprehensive unit tests for dashboard authentication.
- Updated documentation in README.md and torch-config.example.json.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Added `test/memory-formatter.test.mjs` with comprehensive unit tests for:
- `estimateTokenCount`
- `formatMemoryBlock`
- `formatMemoriesForPrompt`
- `renderPromptWithMemoryContext`
- Verified all tests pass and no regressions in related tests.
- Addressed testing gap in `src/services/memory/formatter.js`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Extracted `syncAppDirectories` and `syncAppFiles` helper functions.
- Updated `cmdInit` and `cmdUpdate` to use the new helpers.
- Improved `cmdInit` to throw an Error instead of warning when the target directory is not empty and not forced.
- Fixed hanging tests in `test/ops.test.mjs` by providing `MOCK_CONFIG`.
- Updated tests to verify strict directory check in `cmdInit`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Updated `build.mjs` to correctly source `TORCH.md` and `docs/` from the project root instead of the non-existent `src/docs/`.
- Ensured `TORCH.md` is copied to `dist/src/docs/TORCH.md` as expected by the dashboard's fetch logic.
- Added `test/build_verification.test.mjs` to prevent regressions by verifying the presence of critical build artifacts (`TORCH.md`, assets, dashboard).
- Verified dashboard functionality (logos, settings modal) using a temporary Playwright script.
Co-authored-by: PR0M3TH3AN <[email protected]>
This change enables agents to report their execution platform (e.g., Jules, Codex, Goose) and model (e.g., DeepSeek 3.2) in the Nostr lock events.
Key changes:
- Updated `torch-lock` CLI to accept `--platform` and `--model` arguments.
- Implemented `detectPlatform` utility to infer platform from environment variables if not provided.
- Updated `src/lib.mjs` to include these fields in the event content.
- Updated `scripts/agent/run-scheduler-cycle.mjs` to propagate `--model` and `AGENT_MODEL`.
- Updated `dashboard/index.html` to display the model information on the lock card.
- Fixed a regression in `scripts/validate-scheduler-flow-parity.mjs` and `test/scheduler-ratchet.test.mjs` caused by argument string matching.
- Deleted `repro_test.mjs` temporary file.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Extracted `parseArgs` function from `src/lib.mjs` to `src/cli-parser.mjs`.
- Added unit tests for argument parsing logic in `test/cli-parser.test.mjs`.
- Updated `src/lib.mjs` to import `parseArgs`.
- Fixed roster drift in `src/prompts/weekly-scheduler.md` to match `roster.json`.
- Verified with `npm test` and `npm run lint`.
- Completed weekly scheduler task for `refactor-agent`.
Co-authored-by: PR0M3TH3AN <[email protected]>
This commit updates the `npx torch-lock init` command to automatically generate a `torch-config.json` file if it doesn't already exist. The generated configuration includes a randomized `nostrLock.namespace` (e.g., `torch-a1b2c3d4`) to ensure unique discovery topics for each installation, preventing message collisions across different repositories.
- Modified `src/ops.mjs` to import `crypto` and implement the config generation logic in `cmdInit`.
- Added a test case in `test/ops.test.mjs` to verify the random namespace generation.
- Uses `torch-config.example.json` as a template.
Co-authored-by: PR0M3TH3AN <[email protected]>
thePR0M3TH3AN