- Refactored `tests/auth-service.test.mjs` to use `node:test` API so it is detected by the runner.
- Removed console noise from `tests/watchHistory/watch-history-telemetry.test.mjs`.
- Generated daily audit report `test-audit-report-2026-02-12.md`.
- Updated test logs and tracking artifacts.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Extracted `CommentTargetNormalizer` and related helpers to `js/nostr/commentTargetNormalizer.js`.
- Refactored `js/nostr/commentEvents.js` to import from the new module.
- Compacted helper functions in `js/nostr/commentTargetNormalizer.js` to ensure it stays under the 1000-line limit for new files.
- Verified with `npm run lint:file-size` and `tests/nostr/comment-events.test.mjs`.
Co-authored-by: PR0M3TH3AN <[email protected]>
Refactored `js/searchView.js` to use safe DOM APIs (`document.createElement`, `replaceChildren`, `textContent`) instead of `innerHTML`.
This reduces the attack surface for XSS vulnerabilities.
Updated `scripts/check-innerhtml.mjs` baseline.
Verified with unit tests and a frontend verification script.
Co-authored-by: PR0M3TH3AN <[email protected]>
Updates `content/docs/guides/upload-content.md` to reflect the actual
implementation of the upload and playback workflows:
- Clarifies the 2GB file size limit as a client-side memory constraint.
- Explicitly instructs self-hosters to configure CORS with their instance domain.
- Adds the "External Link" flow to the upload lifecycle.
- Notes that playback priority (URL vs Torrent) depends on instance settings.
- Updates Advanced Options to mention IMETA variants.
Co-authored-by: PR0M3TH3AN <[email protected]>
Fix flaky test in `tests/hashtag-preferences.test.mjs` by using `waitFor` to handle async decryption timing. The previous implementation relied on direct assertion after a promise resolution, which was prone to microtask timing issues with `runNip07WithRetry`.
Also ran `npm audit` and `npm install` to ensure environment health, but no lockfile changes were needed.
Ref: https://github.com/bitvid/bitvid/issues/CI-HEALTH
Co-authored-by: PR0M3TH3AN <[email protected]>
Replaces unbounded `Promise.all(relays.map(...))` calls with `pMap` using a concurrency limit of 3 for background operations like history hydration, metadata fetching, and DM sending.
This prevents network saturation and potential main-thread jank when many relays are configured.
Includes benchmark verification script `benchmarks/relay_concurrency_repro.mjs`.
Audited upload docs and confirmed accuracy.
Co-authored-by: PR0M3TH3AN <[email protected]>
Extracted ProfileDirectMessageController (split into Controller, Actions, Renderer, Helper) and ProfileRelayController from ProfileModalController to reduce file size and improve maintainability.
ProfileModalController.js size reduced from ~12000 lines to ~8750 lines.
Updated unit tests to reflect the new structure.
Co-authored-by: PR0M3TH3AN <[email protected]>
The NIP-07 adapter uses type "nip07" but all permission pre-granting
checks only matched type "extension", causing NIP-07 browser extension
users to fail decryption for block/mute lists, subscriptions, DMs, and
watch history. Hashtag preferences appeared to work because their read
path had a separate fix, masking the systemic issue.
Changes:
- shouldRequestExtensionPermissions() now matches both "extension" and
"nip07" signer types (central fix affecting DM signals, comments,
publish helpers, and watch history fetch)
- buildDmDecryptContext() pre-grants extension permissions for NIP-07
- userBlocks.js: remove capabilities-gated decryptor check that failed
with lazy NIP-07 module injection (same fix already in subscriptions.js);
always resolve signer regardless of allowPermissionPrompt; increase
fast-path relay timeout from 6s to 10s
- watchHistoryService: recognize NIP-07 type and always resolve signer
- All publish paths (blocks, subscriptions, hashtags, relays, uploads,
sharing, moderation) now pre-grant permissions for NIP-07 signers
https://claude.ai/code/session_01PipsdaTQmw7wBTJ1LmJjkk
Executed the `scripts/agent/load-test.mjs` script with 1000 clients for 60 seconds against a local relay. The test passed successfully with ~86 events/sec throughput and <2ms latency.
Attached the generated load report: `artifacts/load-report-20260211.json`.
No cryptographic bottlenecks were identified (avg signing time 0.74ms).
Note: Added `!artifacts/load-report-*.json` to `.gitignore` to allow tracking of load reports.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Implements `toLightweightVideo` helper in `js/services/exploreDataService.js` to strip large fields (content, signatures, etc.) from video objects before sending to the worker.
- Updates `buildWatchHistoryTagCounts` and `buildTagIdf` to use lightweight objects.
- Adds `tests/services/exploreDataService.optimization.test.mjs` to verify correctness.
- Adds `benchmarks/worker_transfer_lightweight_bench.js` demonstrating ~40% improvement in transfer time.
Co-authored-by: PR0M3TH3AN <[email protected]>
Updates AGENTS.md and README.md to reflect the configurable hybrid playback strategy (URL vs. WebTorrent) instead of asserting a strict "URL-First" rule, which contradicted the default configuration.
- Updated "Mission" in AGENTS.md to "Hybrid Playback Strategy".
- Clarified that `DEFAULT_PLAYBACK_SOURCE` controls priority.
- Updated README.md "How playback works" section.
- Adjusted QA checklists to focus on "configured priority" rather than "URL-first".
Co-authored-by: PR0M3TH3AN <[email protected]>
Explicitly injects the GITHUB_TOKEN into the upstream remote URL in the agent-pr-review workflow. This prevents authentication failures when fetching the upstream repository in CI environments where plain HTTPS URLs trigger interactive credential prompts.
Co-authored-by: PR0M3TH3AN <[email protected]>
Introduces `CommentTargetNormalizer` class to decompose the complex `normalizeCommentTarget` function into smaller, state-managed methods. This improves readability and maintainability without changing the external API or behavior.
- Extracted logic into `extractPointers`, `resolveEventsAndTags`, `extractInitialValues`, `enrichFromTags`, and `applyDefaults`.
- Preserved all fallback logic and tag parsing rules.
- Ensured strict string normalization in `extractInitialValues` to match original behavior.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Refactor `S3UploadService` to accept dependencies in constructor
- Move `resolveUploadIdentifier` to class method for mocking
- Add comprehensive unit tests for `S3UploadService` covering event emitter, validation, and upload logic
- Ensure `WebTorrent` dependency is mocked or polyfilled in test environment
Co-authored-by: PR0M3TH3AN <[email protected]>
