- Imported `randomInt` from `node:crypto` in `src/lock-publisher.mjs` to fix CI failure.
- Centralized `withTimeout` and `mergeRelayList` in `src/utils.mjs`.
- Updated `src/lock-utils.mjs` to re-export them.
- Removed local redefinitions in `src/lock-ops.mjs` and `src/lock-publisher.mjs`.
- Fixed `test/utils.test.mjs` imports.
- Verified all tests pass.
This resolves the N/A documentation task by ensuring the codebase is in a valid state.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Moved `withTimeout` implementation to `src/lock-utils.mjs` and exported it correctly.
- Removed duplicate local definitions of `withTimeout`, `mergeRelayList`, and `secureRandom` in `src/lock-ops.mjs` and `src/lock-publisher.mjs`.
- Fixed imports in `src/lock-ops.mjs`, `src/lock-publisher.mjs`, and `src/relay-health.mjs` to use `src/lock-utils.mjs` consistently.
- Updated `test/utils.test.mjs` and `test/utils-async.test.mjs` to fix broken imports and test definitions.
- Verified `npm run lock:complete` and `npm run scheduler:daily` execute correctly.
- Updated `src/todo/TODO_2026-02-20T03-00-00Z.md` to mark verification task as completed.
- Verified `src/relay-health.mjs` does not use `MINUTE_MS` locally, despite mysterious CI error. Confirmed imports are correct.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Remove unused `manifest` variable from destructuring in `test/cmd-backup.test.mjs` to resolve ESLint error.
- Verified fix with `npm run lint`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Fixes CI failure in `test/install_dir_validation.test.mjs` where `assert.notMatch` was undefined.
- `assert.doesNotMatch` is the standard Node.js assertion method for negative regex matching.
Co-authored-by: PR0M3TH3AN <[email protected]>
Refactor `src/cmd-proposal.mjs` to use dependency injection for testability.
Add `test/cmd-proposal.test.mjs` to verify all subcommands (`create`, `list`, `apply`, `reject`, `show`) and error handling.
Fix indentation in `src/cmd-proposal.mjs`.
Co-authored-by: PR0M3TH3AN <[email protected]>
Replaces aggressive `cache.clear()` with per-agent invalidation in `src/services/memory/index.js` to improve performance.
- Adds `prune(predicate)` to `createMemoryCache`.
- Updates `ingestEvents`, `runPruneCycle`, `pinMemory`, `unpinMemory`, and `markMemoryMerged` to invalidate only the affected agent's cache entries.
- Adds unit test for `prune` in `test/memory-cache.test.mjs`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Refactor `cmdBackup` and `listBackups` in `src/cmd-backup.mjs` to accept `cwd` parameter for dependency injection.
- Add `test/cmd-backup.test.mjs` to test backup creation, missing files handling, output override, and listing functionality.
- Ensure tests run in isolated temporary directories using `fs.mkdtemp`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Extracted `LockPublisher` and `publishLock` to `src/lock-publisher.mjs` (already existed, but cleaned up).
- Refactored `src/lock-publisher.mjs` to import error constants and classification logic from `src/lock-error-classifier.mjs` instead of duplicating them.
- Refactored `src/lock-publisher.mjs` and `src/lock-utils.mjs` to use `mergeRelayList` from `src/utils.mjs`.
- Consolidated and moved publisher tests from `test/lock-ops.test.mjs` and `test/lock-ops-publish-retry.test.mjs` to `test/lock-publisher.test.mjs`.
- Cleaned up `src/lock-utils.mjs` to remove duplicate `mergeRelayList`.
- Verified changes with tests.
Co-authored-by: PR0M3TH3AN <[email protected]>
Refactor cmdRollback to support dependency injection and add comprehensive unit tests covering validation, version listing, and rollback operations.
- Refactor `src/cmd-rollback.mjs` to accept `deps` argument.
- Create `test/cmd-rollback.test.mjs` with test cases for happy paths and error conditions.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Implemented `verifyPassword` helper in `src/dashboard.mjs` to support hashed passwords.
- Added support for `scrypt:<salt>:<hash>` format for storing credentials.
- Maintained backward compatibility for plaintext passwords using `timingSafeCompare`.
- Updated `cmdDashboard` to use the new verification logic.
- Added comprehensive tests in `test/dashboard-auth.test.mjs` for hashed credential validation.
This change eliminates the need to store plaintext passwords in `torch-config.json` or environment variables, addressing a security vulnerability.
Co-authored-by: PR0M3TH3AN <[email protected]>
Refactor test/install_dir_validation.test.mjs to use unique temporary directories for each subtest, eliminating shared state and race conditions that caused flakiness.
Update KNOWN_ISSUES.md to mark the issue as resolved.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Fix lint error in `test/verify-example-config-security.test.mjs` (unused var).
- Fix duplicate definitions of `mergeRelayList` and `relayListLabel` in `src/lock-ops.mjs` and `src/lock-publisher.mjs`.
- Fix missing export of `withTimeout` in `src/lock-utils.mjs`.
- Fix broken imports in `test/utils.test.mjs` and `test/utils-async.test.mjs`.
- Centralize `secureRandom` in `src/lock-utils.mjs`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Moved `withTimeout` and `mergeRelayList` to `src/lock-utils.mjs` as the single source of truth.
- Updated `src/lock-ops.mjs` and `src/lock-publisher.mjs` to import from `src/lock-utils.mjs`.
- Fixed lint errors for duplicate declarations.
- Updated tests (`test/utils.test.mjs`, `test/utils-async.test.mjs`) to import from correct modules.
- Added `randomInt` import in `src/lock-publisher.mjs` to fix `no-undef`.
Co-authored-by: PR0M3TH3AN <[email protected]>
Removes the hardcoded `auth: "admin:password"` from `torch-config.example.json` to prevent users from accidentally deploying with insecure defaults.
Adds a regression test `test/verify-example-config-security.test.mjs` to ensure the example config does not contain default credentials in the future.
Co-authored-by: PR0M3TH3AN <[email protected]>
Moved unit tests for `withTimeout` from `test/utils.test.mjs` to `test/utils-async.test.mjs`.
This prevents potential interference from `MockTimers` enabled in `test/utils.test.mjs` which could affect `setTimeout` behavior in async tests.
Increased timeout margins in `withTimeout` tests for better reliability in CI.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Extracted command logic from `src/lib.mjs` `main` function into `COMMAND_HANDLERS` dispatch map.
- Simplified `main` function to perform argument parsing and dispatching.
- Added `test/main-dispatch.test.mjs` to verify dispatch logic and error handling.
- Ensured no regressions in CLI behavior.
Co-authored-by: PR0M3TH3AN <[email protected]>
Consolidated the duplicate `relayListLabel` function from `src/lock-ops.mjs` and `src/lock-publisher.mjs` into `src/utils.mjs`.
- Moved `relayListLabel` to `src/utils.mjs`.
- Updated `src/lock-ops.mjs` and `src/lock-publisher.mjs` to import it.
- Updated `src/lock-utils.mjs` to re-export it from `src/utils.mjs` to maintain backward compatibility.
- Added unit tests in `test/utils.test.mjs`.
- Verified all tests pass.
Co-authored-by: PR0M3TH3AN <[email protected]>
Moved the duplicate `withTimeout` function from `src/lock-ops.mjs`, `src/lock-publisher.mjs`, `src/lock-utils.mjs`, and `src/relay-health.mjs` to a single definition in `src/utils.mjs`.
Updated all references to import from `src/utils.mjs`. `src/lock-utils.mjs` re-exports `withTimeout` for backward compatibility.
Added unit tests for `withTimeout` in `test/utils.test.mjs`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Moved `mergeRelayList` from `src/lock-ops.mjs` and `src/lock-publisher.mjs` to `src/utils.mjs`.
- Updated imports in `src/lock-ops.mjs` and `src/lock-publisher.mjs`.
- Added unit tests for `mergeRelayList` in `test/utils.test.mjs`.
- Restored `torch-config-test.json` which was deleted by the test suite.
Co-authored-by: PR0M3TH3AN <[email protected]>
Added comprehensive unit tests for `withTimeout`, `relayListLabel`, and `mergeRelayList` in `test/lock-utils.test.mjs`.
- `withTimeout`: Verified resolution, timeout rejection, and promise rejection.
- `relayListLabel`: Verified list joining and edge cases.
- `mergeRelayList`: Verified merging, deduplication, and empty list handling.
This improves code coverage and reliability for these utility functions.
Co-authored-by: PR0M3TH3AN <[email protected]>
The unequal-length branch of timingSafeCompare called
crypto.timingSafeEqual(paddedA, paddedB) but did not capture the return
value, unconditionally returning false and leaving the timing-safe
comparison as dead code.
Adds a regression test covering shorter, longer, and exact-match
credential lengths to lock in the correct behaviour.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
Adds a cadence-aware time-window check that runs after the Nostr relay lock
check to exclude agents that already ran within the current window (24h daily,
7d weekly). This closes the cross-midnight edge case where the relay's
date-scoped d-tag rolls over but the agent ran minutes ago.
Changes:
- scheduler-utils.mjs: export log-parsing helpers (parseDateValue,
parseTimestampFromFilename, parseAgentFromFilename, isStrictSchedulerLogFilename,
parseFrontmatterCreatedAt, parseFrontmatterAgent, parseFrontmatterValue) plus
CADENCE_WINDOW_MS constant and buildRecentlyRunExclusionSet(). Helpers are
exported so they can be unit-tested independently. Adds 'node:path' import.
- run-scheduler-cycle.mjs: import the moved helpers from utils (removes ~45 lines
of duplicate definitions), call buildRecentlyRunExclusionSet after excludedSet
is built from relay data, merge results, log newly-excluded agents. Adds cycle
saturation detection: when all roster agents are covered by the time-window
guard, exit 0 with a clear "Cycle complete" message instead of a failure.
- test/scheduler-time-window.test.mjs: 30 new scenario-first unit tests covering
SCN-TWG-01..11 (in-window exclusion, out-of-window pass-through, cross-midnight,
frontmatter precedence, weekly threshold, empty dir, missing dir, deferred
log passthrough, mixed rosters, anti-cheat for non-log files).
All 30 new tests pass. Existing scheduler-ratchet tests (7) still pass.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
Extracted duplicated target path resolution and allowlist validation logic
into a shared `resolveAndValidateTarget` helper function in
`src/services/governance/index.js`.
Updated `createProposal`, `validateProposal`, `applyProposal`, and
`rollbackPrompt` to use the new helper, ensuring consistent validation
and path handling across the service.
Added `test/governance-health.test.mjs` to verify validation logic.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Added `test/errors.test.mjs` with comprehensive tests for the `ExitError` class.
- Updated `src/errors.mjs` to set `this.name = 'ExitError'` in the constructor for better error reporting.
- Verified that all new tests pass and no regressions were introduced to the existing test suite.
Co-authored-by: PR0M3TH3AN <[email protected]>
- governance/index.js: archive filenames now include ISO timestamp for
deterministic sorting (<base>_<ts>_<hash>.md); write .meta.json sidecar
on every archive with proposalId, author, reason, and archivedAt
- governance/index.js: add listPromptVersions(target) — returns archived
versions for a prompt sorted newest-first with sidecar metadata surfaced
- cmd-rollback.mjs: add --list flag to list available versions without
restoring (delegates to listPromptVersions)
- cli-parser.mjs: add --list and --output flags
- lib.mjs: pass list flag to cmdRollback; add backup command dispatch
- cmd-backup.mjs: new torch-lock backup command — snapshots
.scheduler-memory/memory-store.json and scheduler run state to
.torch/backups/<timestamp>/; supports --output override and --list
- docs/prompt-versioning.md: comprehensive guide to the full
proposal → apply → list-versions → rollback workflow, state backup
and restore procedure, and storage location reference
- test/governance.test.mjs: 7 scenario-based tests (SCN-proposal-create,
SCN-proposal-list, SCN-proposal-reject, SCN-archive-naming,
SCN-version-list, SCN-rollback-latest, SCN-rollback-hash)
https://claude.ai/code/session_01Ndq2D72Kp77BYo4owD63uY
