- Expand fuzzing coverage for `js/nostrEventSchemas.js` to include all builder functions.
- Fix a crash in `buildAdminListEvent` where non-array `hexPubkeys` caused a TypeError.
- Update `scripts/agent/fuzz-dmDecryptor.mjs` and `scripts/agent/fuzz-magnetUtils.mjs` iterations.
- Add reproducer for the `buildAdminListEvent` crash.
- Generate fuzz reports in `artifacts/`.
Co-authored-by: PR0M3TH3AN <[email protected]>
Renamed scripts/agent/validate-events.mjs to scripts/agent/validate-events.test.mjs to prevent potential deployment issues with Netlify or other CI tools treating it as a production asset. Also added shebang.
Co-authored-by: PR0M3TH3AN <[email protected]>
Added scripts/agent/validate-events.mjs to validate event builders against schemas. Verified consistency and added a regression test for event schemas.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Move NIP-07 extension login logic from `js/services/authProviders/nip07.js` to `NostrClient.loginWithExtension`.
- Add `validator` support to `NostrClient` login methods (`loginWithExtension`, `connectRemoteSigner`, `useStoredRemoteSigner`, `registerPrivateKeySigner`) to allow pre-session security checks.
- Update `nip07.js`, `nip46.js`, and `nsec.js` providers to inject `accessControl` checks via the new validator hook, ensuring consistent enforcement of whitelists/blacklists before activating the signer.
- This creates a unified "harness" for all signing methods within `NostrClient` while keeping business logic (access control) in the service layer.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Update `scripts/automated-pr-review.mjs` to include missing sensitive paths (`js/auth/`, `js/magnetUtils.js`, `js/nostr/adapters/nip07Adapter.js`) and improve commit messaging for automated fixes.
- Add release channel guidance checks for `unstable` branch in `automated-pr-review.mjs`.
- Create `scripts/agent/review-open-prs.mjs` to robustly batch process open PRs using the updated review script.
- Remove redundant scripts `scripts/agent/automated-pr-review.mjs` and `scripts/agent/review-pr.mjs`.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Refactoring `scripts/check-hex.js` to use git's native search instead of `ripgrep` for better portability and dependency reduction.
- Updating `tests/ui/uploadModal-integration.test.mjs` to ensure DOM isolation between tests using `beforeEach` cleanup, resolving state pollution issues.
Co-authored-by: PR0M3TH3AN <[email protected]>
Added scripts/agent/smoke-test.mjs to verify login, relay connection, video publishing, and DM decryption flows using a headless Node.js client.
The script polyfills the necessary browser environment for NostrClient and uses local relay/server resources.
Co-authored-by: PR0M3TH3AN <[email protected]>
Currently, if the automated PR review script encounters failures (lint/test errors), it exits with code 1, but the failure details are only visible in the posted PR comment. In CI environments where the comment might not be immediately accessible or if posting fails, the logs are unhelpful.
This change unconditionally prints the generated review report (including failure details) to `stdout` at the end of the script execution. This ensures that failure reasons are always visible in the CI logs.
Co-authored-by: PR0M3TH3AN <[email protected]>
Implemented fuzz testing harnesses and fixed a circular reference crash in nostrEventSchemas.js. Improved robustness of magnetUtils and dmDecryptor.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Implements `scripts/agent/interop-test.mjs` to validate VIDEO_POST, VIEW_EVENT, and DM flows.
- Uses ephemeral keys generated via `nostr-tools`.
- Targets public relays `wss://relay.damus.io` and `wss://nos.lol` for verification.
- Includes retry logic for event propagation verification.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Updated `scripts/agent/telemetry-aggregator.mjs` to dynamically search for `test_unit*.log` and `test_output.log` files in both the root and `artifacts/` directories, instead of using a hardcoded list.
- Verified the aggregator script with a test log containing PII (email, IP, hex key) to ensure sensitive information is correctly redacted in the generated reports.
- Confirmed that the script operates only when `ENABLE_TELEMETRY=true` is set.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Created `scripts/agent/validate-events.mjs` to validate event builders against schemas.
- Refactored `buildVideoPostEvent` in `js/nostrEventSchemas.js` to automatically generate the required `s` (storage pointer) tag if missing, using `infoHash`, `url`, or `videoRootId`.
- Verified that `js/utils/storagePointer.js` exists and is imported correctly.
- Updated `docs/nostr-event-schemas.md` to reflect the auto-generation behavior.
- Verified fixes with `scripts/agent/validate-events.mjs` and existing unit tests.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Wrap `main` execution in try-catch block to ensure process exits with code 1 on failure.
- Update `runCommand` to throw meaningful errors on spawn failure (e.g. command not found).
- Add explicit check for `gh` CLI availability in CI environment.
- Improve git command error logging in `getChangedFiles` to capture stderr (e.g. "no merge base").
Co-authored-by: PR0M3TH3AN <[email protected]>
- Updated `scripts/agent/load-test.mjs` to simulate realistic video publishing flows by generating Video Post (Kind 30078), Video Mirror (Kind 1063), and NIP-71 Metadata (Kind 21/22) events for "heavy" load scenarios.
- Refactored the load generation loop to strictly separate cryptographic signing time from network transmission time, ensuring accurate performance metrics.
- Generated a baseline `artifacts/load-report.json` demonstrating ~100 events/sec throughput and sub-10ms signing latency.
- Verified execution against a local relay to prevent public network stress.
Co-authored-by: PR0M3TH3AN <[email protected]>
Implements `scripts/agent/interop-test.mjs` to validate Nostr event schemas and client publishing against public relays.
- Uses ephemeral keys (generated via `nostr-tools`) for safety.
- Connects to `wss://relay.damus.io` and `wss://nos.lol` for testing.
- Verifies:
- Video Post creation (via `buildVideoPostEvent`) and publishing.
- View Event creation (via `buildViewEvent`) and publishing.
- Direct Message sending and decryption (using client's encrypted DM logic).
- Includes necessary Node.js polyfills (`WebSocket`, `crypto`, `localStorage`, `window`) to run browser-targeted client code.
- Update smoke-test.mjs to output structured summary with logs
- Update telemetry-aggregator.mjs to collect from unit, smoke, and load tests
- Update run-unit-tests.mjs to log output to artifacts/test_unit.log
- Ensure PII sanitization in telemetry reports
- Added `scripts/agent/validate-events.mjs` to validate event builders.
- Added `GENERIC_REPOST` (kind 16) to `js/nostrEventSchemas.js` and `docs/nostr-event-schemas.md`.
- Updated `buildRepostEvent` to validate against `GENERIC_REPOST` when producing kind 16 events.
- Updated `scripts/automated-pr-review.mjs` to align with specific prompt requirements for formatting fixes and guardrails.
- Added `js/utils/storage.js` to sensitive paths for security review flagging.
- Created `scripts/agent/review-open-prs.mjs` to iterate over open PRs and run the review script using `gh` CLI.
Added `scripts/agent/smoke-test.mjs` to verify key application flows:
- Local Relay & Web Server availability.
- Protocol flows via `NostrClient` in Node.js (Video Publish, View Publish, DM Send & Decrypt).
- UI availability via Playwright (Headless Browser).
This script generates `artifacts/smoke-report.json` and logs for verification.
- Created `scripts/agent/fuzz-utils.mjs` with shared random data generators.
- Created `scripts/agent/fuzz-nostrEventSchemas.mjs` to fuzz event builders and validators, including `sanitizeAdditionalTags`.
- Created `scripts/agent/fuzz-dmDecryptor.mjs` to fuzz DM decryption with mocked decryptors and custom reproducer generation.
- Created `scripts/agent/fuzz-magnetUtils.mjs` to fuzz magnet URI normalization.
- Verified that all fuzz targets run without crashes.
- Saved execution reports to `artifacts/`.
- Updated README.md to state bitvid is a static client.
- Added supported S3 upload modes to README.md and docs/storage-tab-design.md.
- Added security warnings about browser-held keys.
- Updated docs/storage-r2.md to contextually place R2 integration.
- Updated scripts/check-hex.js to ignore ai/** to fix lint failure.
- Implements `scripts/agent/interop-test.mjs` to validate Nostr protocol interoperability.
- Uses `simple-relay.mjs` to spin up a local test relay (no public relay spam).
- Generates ephemeral keys for each run using `nostr-tools`.
- Verifies `VIDEO_POST` (Video Note) publishing and fetching.
- Verifies `VIEW_EVENT` publishing.
- Verifies Direct Message (DM) sending and listing (decryption).
- Polyfills browser globals (WebSocket, crypto, localStorage, IndexedDB) for Node.js execution.
- Enhance `scripts/agent/telemetry-aggregator.mjs` to parse TAP formatted unit test logs (e.g., `test_unit_debug.log`).
- Add logic to identify and group errors by stack trace fingerprint.
- Implement PII sanitization for IPs, emails, and keys.
- Generate a Markdown report in `ai/reports/` with prioritized issues.
- Generate a JSON artifact in `artifacts/` for machine consumption.
- Ensure telemetry is opt-in via `ENABLE_TELEMETRY` env var.
- Produce initial telemetry report `ai/reports/telemetry-20260125.md`.
- Created `scripts/agent/validate-events.mjs` to validate all event builders.
- Fixed `buildViewEvent` to generate a fallback `d` tag for kind 30079 compliance.
- Relaxed `REPOST` schema validation to allow empty content (blind reposts), per NIP-18.
- Updated `docs/nostr-event-schemas.md` to reflect schema changes.
- Update `scripts/agent/review-pr.mjs` to use `runCommand` wrapper for all command executions.
- Increase `maxBuffer` to 10MB to prevent crashes during large test/lint outputs.
- Ensure consistent logging and option handling.
This commit ensures the existence and correctness of `scripts/agent/smoke-test.mjs`, a Playwright-based regression test suite.
The script:
- Starts a local web server (npx serve) and a local relay (simple-relay.mjs).
- Launches a headless browser to interact with the application.
- Verifies key flows:
- Ephemeral login.
- Video publishing (Kind 30078).
- Direct Message (DM) sending and decryption (Kind 4/1059).
- Generates execution logs and summaries in `artifacts/`.
Also ensures `scripts/agent/simple-relay.mjs` is present as a dependency.
