Sorts memories by created_at and uses an early exit condition in the inner loop to avoid checking all pairs. This reduces complexity from O(N^2) to roughly O(N * k) where k is the number of items within the duplicate window.
Measured improvement for 30k items: ~2.1s -> ~0.25s (8x speedup).
Co-authored-by: PR0M3TH3AN <[email protected]>
Restrict the /torch-config.json endpoint to only return fields required by the dashboard frontend (dashboard config excluding auth, and nostrLock namespace/relays). This prevents exposure of sensitive internal configuration such as rosters, scheduler settings, and full relay lists.
- Modify src/dashboard.mjs to sanitize config using an allowlist approach.
- Add test/dashboard-config-exposure.test.mjs to verify sensitive fields are stripped.
Co-authored-by: PR0M3TH3AN <[email protected]>
Adds standard HTTP security headers (CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy) to all dashboard responses to mitigate XSS, clickjacking, and MIME sniffing attacks.
Includes verification tests in test/dashboard-security.test.mjs.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Refactor `src/roster.mjs` to support dependency injection for `fs` and `loadTorchConfig`.
- Add `test/roster.test.mjs` to test roster loading scenarios including file precedence, caching, fallback, and configuration overrides.
- Export `_resetRosterCache` in `src/roster.mjs` for testing purposes.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Added `validateInstallDir` function to `src/ops.mjs` to enforce strict allowlist for directory names (alphanumeric, hyphens, underscores, slashes, periods).
- Integrated validation into `resolveConfiguration` to sanitize both interactive and mock inputs.
- Added comprehensive unit tests in `test/install_dir_validation.test.mjs`.
This fixes a vulnerability where malicious directory names could inject shell commands into `package.json` scripts during initialization.
Co-authored-by: PR0M3TH3AN <[email protected]>
Moved the `ensureDir` utility function from `src/ops.mjs` to `src/utils.mjs` to promote code reuse and centralization.
Updated `src/ops.mjs` and `src/services/memory/index.js` to use the shared utility.
Added unit tests for `ensureDir` in `test/utils.test.mjs`.
Co-authored-by: PR0M3TH3AN <[email protected]>
Verified by:
- Searching the codebase to confirm no imports.
- Running the tests to ensure no regressions.
- Running the build to ensure the process is unaffected.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Remove `src/cmd-check.mjs` as it is not used in the codebase and contains outdated logic.
- Remove `test/cmd-check.test.mjs` as it tests the deleted file.
- Verify that `cmdCheck` in `src/lib.mjs` is covered by `test/lib.test.mjs`.
This improves code health by removing unused and duplicate code.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Executed design-system-audit-agent on daily cadence
- Generated design system audit report (memory-update.md)
- Created run artifacts in src/context, src/todo, src/decisions, src/test_logs
- Published lock completion and final task log
Co-authored-by: PR0M3TH3AN <[email protected]>
- Created `CONTRIBUTING.md` with development instructions.
- Updated `README.md` to include a Development section.
- Added daily scheduler run artifacts.
- Completed scheduler cycle for `docs-agent`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Executed daily scheduler cycle.
- Selected `decompose-agent` (next in roster).
- Decomposed `scripts/agent/run-scheduler-cycle.mjs` (1127 lines) into `scripts/agent/scheduler-utils.mjs` (195 lines) and `scripts/agent/scheduler-lock.mjs` (173 lines).
- Resulting main file size: 788 lines (339 lines reduction).
- Fixed lint warnings.
- Updated `test/scheduler-preflight-lock.e2e.test.mjs`, `test/run-scheduler-cycle-memory-policy.test.mjs`, `test/scheduler-lock-failure-schema.contract.test.mjs` to copy new modules into test fixtures.
- Updated `test/scheduler-ratchet.test.mjs` to verify moved functions in `scheduler-lock.mjs`.
- Note: `scripts/check-file-size.mjs` was not updated as it lacks the baseline feature referenced in the prompt.
- Created artifacts: `src/context/CONTEXT_...`, `src/decisions/DECISIONS_...`, `src/test_logs/TEST_LOG_...`, `src/todo/TODO_...`.
- Created scheduler log: `task-logs/daily/2026-02-17T22-29-00Z__decompose-agent__completed.md`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Audited `/content` directory: Not found.
- Updated `KNOWN_ISSUES.md`.
- Fixed a bug in `src/lock-ops.mjs` where `deps` was undefined in `LockPublisher`.
- Created run artifacts and task logs.
Co-authored-by: PR0M3TH3AN <[email protected]>
`frontend-console-debug-agent` run:
- Fixed a 403 Forbidden error in `src/dashboard.mjs` preventing `src/constants.mjs` from loading by adding it to the `allowedPaths` whitelist.
- Refactored `src/lock-ops.mjs` to fix a critical syntax error in `LockPublisher` class.
- Fixed a typo in `src/cmd-check.mjs` (`queryLocksFn` -> `queryLocks`).
- Added `@playwright/test` for frontend debugging.
- Added `scripts/agent/debug_frontend.mjs` for reproduction.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Extracted hardcoded retry/health constants from `src/lock-ops.mjs` to `src/constants.mjs`.
- Refactored `src/lock-ops.mjs` to use `LockPublisher` class pattern and shared constants.
- Fixed `SyntaxError` in `src/lock-ops.mjs` (function inside function).
- Fixed `ReferenceError` in `src/cmd-check.mjs` (`queryLocksFn` -> `queryLocks`).
- Verified with unit tests (`test:unit:lock-backend`) and linting.
- Completed daily scheduler cycle for `const-refactor-agent`.
Co-authored-by: PR0M3TH3AN <[email protected]>
Replaces synchronous `fs.readFileSync` with `fs.promises.readFile` in `loadTorchConfig` to prevent event loop blocking.
Updates all dependent configuration getters and consumers to use async/await.
Includes benchmark proving non-blocking behavior.
Fixes dashboard tests to properly await server listening.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Replaces module-level mutable state (`metricsByRelay`, `lastSnapshotAt`) with `RelayHealthManager` class.
- Moves state-dependent functions (`ensureRelayMetrics`, `rankRelaysByHealth`, etc.) to class methods.
- Updates `queryLocks` and `publishLock` to support dependency injection for `healthManager`.
- Maintains backward compatibility via `defaultHealthManager` singleton.
- Adds `test/relay-health-manager.test.mjs` to verify state isolation and functionality.
Co-authored-by: PR0M3TH3AN <[email protected]>
Replaced `Math.random` with a cryptographically secure random number generator using `node:crypto.randomInt` in `src/lock-ops.mjs` to prevent potential timing attacks or predictability in backoff delays.
Added `test/secure-random.test.mjs` to verify the secure random generator.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Extracted complex retry logic from `publishLock` into `LockPublisher` class.
- Decomposed `publishLock` into `executePublishCycle`, `attemptPhase`, `analyzeFailures`, `determineFailureCategory`, and logging helpers.
- Preserved existing functionality and behavior including telemetry, health management, and error handling.
- Verified with existing tests.
Co-authored-by: PR0M3TH3AN <[email protected]>
Refactor `cmdCheck` in `src/cmd-check.mjs` to support dependency injection for better testability.
Add `test/cmd-check.test.mjs` with comprehensive unit tests for `cmdCheck`, covering happy paths and edge cases.
Verify tests pass with `node --test test/cmd-check.test.mjs`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Modified `getRelevantMemories` in `src/services/memory/index.js` to accept optional `ranker` and `cache` parameters for dependency injection.
- Added `test/memory-index.test.mjs` with comprehensive unit tests for `getRelevantMemories` using `node:test` mocks.
- Verified that existing behavior is preserved via default parameters.
Co-authored-by: PR0M3TH3AN <[email protected]>
Moved the large usage help text from `src/lib.mjs` to `src/constants.mjs` to improve readability and maintainability of the library file.
- Added `USAGE_TEXT` to `src/constants.mjs`.
- Updated `src/lib.mjs` to import and use `USAGE_TEXT`.
- Removed unused `DEFAULT_DASHBOARD_PORT` import from `src/lib.mjs`.
Co-authored-by: PR0M3TH3AN <[email protected]>
Introduced a `resolveIntegerConfig` helper function to handle environment variable checking, parsing, validation, and configuration fallback for integer settings. Updated `getQueryTimeoutMs`, `getPublishTimeoutMs`, `getMinSuccessfulRelayPublishes`, and `getMinActiveRelayPool` to use this helper. This improves code maintainability and consistency.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Introduced `parseStringList` helper to handle parsing of string arrays from config.
- Replaced `parseRelayList` and `parseRoster` with `parseStringList`.
- Replaced inline parsing of `relays` and `dashboard.relays` with `parseStringList`.
- Unified behavior: empty lists in config now consistently return `null` instead of `[]`.
- Added unit test verifying consistent `null` return for empty lists.
Co-authored-by: PR0M3TH3AN <[email protected]>
The dashboard previously served the raw `torch-config.json` file, potentially exposing sensitive information like authentication credentials.
This commit modifies the `/torch-config.json` endpoint to:
1. Parse the configuration file.
2. Sanitize the output by removing the `dashboard.auth` field and any unknown fields (using `parseTorchConfig`).
3. Support `TORCH_CONFIG_PATH` environment variable for configuration file location, improving testability and consistency with other components.
Verified with new test `test/dashboard-config-security.test.mjs` and existing auth tests.
Co-authored-by: PR0M3TH3AN <[email protected]>
This patch addresses a security vulnerability where the dashboard server could serve any file from the package root.
Changes:
- Implemented an allowlist in `src/dashboard.mjs` to restrict file access to:
- `dashboard/`
- `assets/`
- `src/docs/`
- `torch-config.json`
- Added `test/dashboard-security.test.mjs` to verify the fix and prevent regressions.
The fix ensures that sensitive files like `package.json` or source code cannot be accessed via the dashboard server.
Co-authored-by: PR0M3TH3AN <[email protected]>
