Three CI-enforced lint scripts to prevent common codebase growth problems:
- lint:file-size — enforces 1000-line max for new JS files, grandfathers
existing oversized files and prevents them from growing further
- lint:innerhtml — tracks innerHTML usage per-file with a baseline count,
blocks new innerHTML additions (guides agents toward safe DOM APIs)
- Relay constants consolidated from duplicate definitions in client.js and
ConnectionManager.js into shared js/nostr/relayConstants.js
- AGENTS.md Section 13: documents all three rules with examples
- docs/scheduled-agent-prompts.md: copy-paste prompts for recurring
file decomposition, innerHTML migration, and constant dedup tasks
https://claude.ai/code/session_01LzErpH9FNw4hAPsjoYb1v9
- Extracted prepareVideoPublishPayload and prepareVideoMirrorOptions to js/nostr/videoPayloadBuilder.js
- Created js/utils/cryptoUtils.js and js/utils/mime.js
- Updated js/nostr/client.js to use new builder and helpers
- Fixed SignerManager permission hydration and session actor logic
- Fixed nostrClientRegistry update logic
- Fixed unit tests: nostr-private-key-signer, integration-remote-flow, dmSignalEvents
Co-authored-by: PR0M3TH3AN <[email protected]>
Replaces pure JS `finalizeEvent` with `nostr-tools/wasm` implementation in `scripts/agent/load-test.mjs`.
This reduces signing time from ~6ms to ~1ms per event (5x-6x speedup), significantly increasing the event generation throughput capacity of the load test agent.
- Adds `nostr-wasm` to devDependencies.
- Updates `scripts/agent/load-test.mjs` to initialize and use WASM crypto.
- Adds `benchmarks/signing_benchmark.mjs` to verify performance gains.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Updated playwright and @playwright/test to 1.58.2.
- Updated dependency tracking issues for nostr-tools, stylelint, and esbuild.
- Included dependency scan artifacts in description.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Added `engines` field to `package.json` to enforce Node.js >=22.
- Updated `CONTRIBUTING.md` to specify prerequisites and clarify build commands.
- Created `ONBOARDING_REPORT.md` with audit findings.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Implements `scripts/agent/load-test.mjs` to simulate N clients publishing mixed events.
- Adds `test:load` script to `package.json`.
- Measures roundtrip latency and client-side signing time.
- Generates JSON report in `artifacts/`.
- Includes `--mock` mode for verification without external relay.
- Enforces guardrails against public relay usage.
Co-authored-by: PR0M3TH3AN <[email protected]>
Updated `NostrClient.subscribeVideos` to accept dynamic tags for filtering.
Integrated `HashtagPreferencesService` into `NostrService` to refresh the video subscription whenever user interests change.
This ensures the main video feed correctly reflects the user's selected hashtags by fetching matching content from relays.
Co-authored-by: PR0M3TH3AN <[email protected]>
Refactored `js/userBlocks.js` to handle NIP-07 decryption timeouts gracefully.
Previously, if a background decryption timed out (common with busy extensions or queues), the user's block list was reset to an empty state, exposing them to blocked content until the next successful retry.
The fix ensures that if a timeout occurs, the existing (stale) block list is preserved while a retry is scheduled in the background.
Also increased the `BACKGROUND_DECRYPT_TIMEOUT_MS` from 2500ms to 5000ms to reduce false positives.
Added `tests/user-blocks-decryption.test.mjs` to verify the fix and audit the decryption flow.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Synced `package-lock.json` with `package.json` to resolve `npm ci` failures.
- Updated `nostr-tools` dependencies to resolve conflicts.
- Fixed `SyntaxError` in `tests/nostr-login-permissions.test.mjs` caused by duplicate code.
- Updated `js/nostr/client.js`, `js/nostr/publishHelpers.js`, `js/nostr/adapters/nsecAdapter.js`, `js/nostr/nip46Client.js` to use `hexToBytes` helper when calling `nostr-tools` functions, as v2+ expects `Uint8Array` instead of hex strings.
- Added `hexToBytes` helper in `js/utils/hex.js`.
- Updated tests (`tests/nostr/dm-direct-message-flow.test.mjs`, `tests/nostr-send-direct-message.test.mjs`, `tests/nostr-private-key-signer.test.mjs`, `tests/nostr/nip46Client.test.js`) to use `Uint8Array` for keys where required.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Move `nostr-tools`, `esbuild`, `cross-env` to `dependencies` to ensure availability in production builds.
- Remove duplicate dependencies (`autoprefixer`, `@noble/hashes`, `@tailwindcss/typography`) to fix potential version conflicts.
- Fix timeout leak in `hashtagPreferencesService.js`.
- Fix test mock in `hashtag-preferences.test.mjs` to prevent timeouts.
- Update `nostrClient` permission request to use correct constant.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Fix flaky `tests/hashtag-preferences.test.mjs` by correcting mock implementation for `fetchListIncrementally`.
- Fix `tests/nostr-login-permissions.test.mjs` failure by requesting correct permissions in `js/nostr/client.js` (ReferenceError fix).
- Fix 90s timeout in `HashtagPreferencesService` by clearing the timeout timer upon successful decryption.
- Correct `package.json` dependency classification:
- Remove duplicate devDependencies (`autoprefixer`, `@tailwindcss/typography`) that are already in `dependencies`.
- Ensure build-critical tools (`tailwindcss`, etc.) are in `dependencies` to survive `npm prune --production` on Netlify.
- Install `esbuild` and `cross-env` as devDependencies.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Updated `cross-env` to latest version.
- Updated `package-lock.json` to resolve build warnings and potential CI cache issues.
- Includes previous test fixes and onboarding report.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Move `@tailwindcss/typography` from `devDependencies` to `dependencies`.
- This ensures it is available during Netlify's production build, which prunes `devDependencies` but requires this plugin for `tailwind.config.cjs`.
- Fixes "Deploy failed" errors related to build script failures.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Move `tailwindcss`, `autoprefixer`, and `postcss` to `dependencies` to ensure they are available during Netlify build (which defaults to production environment).
- Keep version compatibility with v3.
- (Implicit) Includes the `package-lock.json` update.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Add `audit` script to `package.json` to run `scripts/daily-design-system-audit.mjs`.
- Update `lint:css` to include `css/docs.css` for better coverage.
- Improve `scripts/daily-design-system-audit.mjs` parsing logic for Hex and CSS violations to better handle output formats.
- Generate `REMEDIATION_REPORT.md` with current audit results (No violations).
Co-authored-by: PR0M3TH3AN <[email protected]>
Explicitly adds @noble/[email protected] to devDependencies to satisfy the peer dependency of @exodus/bytes (used by jsdom), resolving the conflict with nostr-tools which requires version 1.3.1. Regenerates package-lock.json to include the correct versions.
Co-authored-by: PR0M3TH3AN <[email protected]>
Explicitly adds `@noble/[email protected]` to `package.json` dependencies.
This resolves a `peerDependencies` conflict where `@exodus/bytes` (a dependency
of `jsdom`) requires `@noble/hashes` ^1.8.0 || ^2.0.0, but `nostr-tools`
requires version 1.3.1.
By adding it to the root project, `npm` can correctly hoist version 2.0.1 for
`@exodus/bytes` while keeping version 1.3.1 nested for `nostr-tools`.
This fixes `npm ci` failures in CI environments that strictly validate the lockfile.
Co-authored-by: PR0M3TH3AN <[email protected]>
The profile modal was slow to open (~100ms+ delay) when a user has many trusted contacts, blocked users, or moderation reports, because `refreshModerationSettingsUi` and `populateBlockedList` were called synchronously before making the modal visible.
This change refactors `ProfileModalController.show()` to:
1. Render the header synchronously (fast).
2. Call `open()` immediately to make the modal visible.
3. Defer expensive data population (`refreshModerationSettingsUi`, `populateBlockedList`, `refreshWalletPaneState`) to the next animation frame using `requestAnimationFrame`.
This significantly improves the perceived responsiveness of the profile button.
Co-authored-by: PR0M3TH3AN <[email protected]>
The documentation system relied on external CDNs for `marked` and `highlight.js`. This caused content loading failures ("Error loading content") when CDNs were blocked or unreachable.
This change:
- Adds `marked` and `highlight.js` to `package.json` dependencies.
- Vendors `marked.min.js` (from UMD build) and `highlight.min.js` (downloaded) into `vendor/`.
- Updates `index.html` to load these libraries from local `vendor/` path instead of CDN.
Verified with Playwright script ensuring docs content loads successfully.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Added `http-server` and `serve` to `devDependencies`.
- This resolves CI failures where `npx` commands for `http-server` (used in Playwright) and `serve` (used in start scripts) would fail or block due to implicit installation restrictions.
- `package-lock.json` updated to reflect new dependencies.
Co-authored-by: PR0M3TH3AN <[email protected]>
- Upgraded @playwright/test and playwright to ^1.58.0
- Generated dependency scan artifacts (npm-audit, npm-outdated)
- Documented issues for nostr-tools version mismatch and webtorrent upgrade
Moves and enhances the telemetry aggregator script to `scripts/agent/telemetry-aggregator.mjs`.
Updates `package.json` to point to the new location.
Implements robust parsing for smoke test summaries and fuzz reports.
Adds PII sanitization (IPs, emails, keys, paths).
Enforces opt-in via `ENABLE_TELEMETRY` environment variable.
Adds `ai/reports/` to `.gitignore`.
