thePR0M3TH3ANandClaude Opus 4.8 733cb5937b nostr: sanitize hex-only filter fields (fix relay "from_hex" REQ rejects) ...

Strict relays (primal) reject a whole REQ with "uneven size input to
from_hex" when any ids/authors/#e/#p/#q entry isn't 64-char hex — silently
dropping that subscription's results. One malformed value anywhere in a
filter poisoned the request.

Sanitize at the universal pool choke point (normalizeFilterList, used by
both the shimmed pool.sub and pool.list): lowercase/trim and drop non-
64-hex entries from the hex-only fields; if a once-populated hex field ends
up empty, drop that filter rather than silently broadening the query.
Non-hex fields (#a/#d/#t/kinds/…) are untouched. Dev-logs what it strips
(with the filter's kinds) so the malformed source can be traced.

Also records pre-launch TODO items: NIP-71 inbound ingest is now live
(Phase 2, incl. the resolve-posted-at history-fetch fix), and a new
launch-blocker — channel-profile walls fetch only kind-30078 so a
creator's NIP-71 videos don't show on their profile.

Tests: filter-hex-sanitize (strip/keep/lowercase/drop-empty/leave-non-hex);
mutation-verified. 1244/1245 unit (known UploadModal flake).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

2026-06-22 18:24:05 -04:00

..

app

fix(auth): anonymous view-event session actor no longer reports you as logged out

2026-06-21 21:52:52 -04:00

auth

Add tests for NIP-07 signing adapter factory

2026-02-08 00:33:13 +00:00

compliance

Merge branch 'unstable' into agents/daily/style-agent-1740615175-12694853261144843326

2026-02-26 21:40:23 -05:00

designSystem

Fix lint errors in dynamicStyles.test.mjs

2026-02-08 00:41:34 +00:00

docs

docs: align upload guides with code and add consistency test

2026-02-05 03:00:29 +00:00

e2e

test(e2e): smoke the real upload -> publish -> feed -> delete pipeline

2026-06-17 05:56:38 -04:00

e2e-extension

improved playright integration

2026-02-21 20:45:47 -05:00

feed-engine

Optimize object allocation in kids scoring loop

2026-02-08 03:41:50 +00:00

helpers

fix: Resolve js/app.js syntax error and update test mocks

2026-02-08 01:29:09 +00:00

moderation

refactor(moderation): batch kind-1984 report subs via SubscriptionManager (P2)

2026-06-14 15:04:40 -04:00

nostr

test(feed): update subscribeVideos spec for reserved live defaults

2026-06-20 12:25:27 -04:00

nostr-specs

feat(agents): Execute nip-research-agent (NIP-65 compliance)

2026-02-18 17:07:47 +00:00

performance

perf: Batch video timestamp resolution to reduce N+1 network requests

2026-02-11 12:01:39 +00:00

race

fix: resolve NostrClient initialization race condition

2026-02-14 13:22:43 +00:00

services

[playback] CDN-first for dual-source videos + reliable hosted playback

2026-06-18 12:15:38 -04:00

state

Remove legacy moderation overrides support

2026-02-08 00:33:27 +00:00

test-helpers

fix(test): polyfill synchronous requestIdleCallback for unit tests

2026-02-05 23:04:21 +00:00

torrent

Handle WebTorrent fallback without service worker

2025-10-15 14:54:24 -04:00

ui

[playback] harden WebTorrent streaming + add forced-source test deep links

2026-06-18 12:15:27 -04:00

unit

refactor(ui): extract bindThumbnailFallbacks from app.js

2026-02-23 01:16:32 +00:00

utils

test: add missing tests for LinkPreviewSettings utility

2026-02-26 17:44:51 +00:00

visual

test: harden harness polling and fix dm signer key usage

2026-03-04 12:25:23 -05:00

watchHistory

audit(tests): fix skipped auth tests and produce audit report

2026-02-12 14:36:45 +00:00

admin-list-store.test.mjs

fix(ci): resolve e2e timeouts and add app init safeguards

2026-02-22 18:33:41 +00:00

app-batch-fetch-profiles.test.mjs

refactor(profiles): batch profile fetch through SubscriptionManager (P4)

2026-06-14 16:15:06 -04:00

app-state.test.mjs

test(ai): add unit tests for storageService and appState (agent)

2026-01-24 11:44:16 +00:00

auth-service.test.mjs

audit(tests): fix skipped auth tests and produce audit report

2026-02-12 14:36:45 +00:00

authService.test.mjs

chore: add test audit workflow and improve AuthService coverage

2026-02-12 14:42:51 +00:00

benchmark-explore-data.spec.mjs

feat(perf): offload explore data computation to web worker

2026-02-05 17:00:13 +00:00

check_resize_observer.mjs

fix: Ensure ResizeObserver is undefined in global scope for fallback tests

2026-02-08 02:00:10 +00:00

comment-avatar.test.mjs

Add unit tests for commentAvatar.js utility functions

2026-02-26 17:36:00 +00:00

comment-event-builder.test.mjs

Fix CI, environment, linting, and unit test issues

2026-01-13 20:32:06 +00:00

comment-thread-service.test.mjs

[comments] honor NIP-09 deletions in comment threads

2026-06-18 13:55:03 -04:00

csp-policy.test.mjs

[security] add a strict Content-Security-Policy to the HTML entry points

2026-06-18 12:15:14 -04:00

delete-publishes-to-write-relays.test.mjs

fix(delete): publish tombstones to the write relays so deletes propagate

2026-06-20 12:38:51 -04:00

delete-storage-locked.test.mjs

feat(delete): warn when a hosted file is left behind by locked storage

2026-06-20 12:21:49 -04:00

design-system-metrics.test.mjs

Refactor floating panel and metrics styling

2025-10-14 13:31:22 -04:00

discussion-count-service.test.mjs

[comments] align count with displayed kinds + preserve multi-line content

2026-06-18 12:15:46 -04:00

dm-block-filter.test.mjs

update with block list fix

2026-02-21 16:45:16 -05:00

dm-conversation-select.test.mjs

fix(dm): route Actions calls to the correct controller (open conversation, etc.)

2026-06-16 15:07:14 -04:00

dm-db.test.mjs

refactor(dm-db): use singleton IndexedDB connection to avoid N+1 overhead

2026-02-08 03:41:19 +00:00

dm-decrypt-context.test.mjs

fix(dm): can't open conversations + "helpers unavailable" on a working signer

2026-06-16 14:52:11 -04:00

dm-decryptor-order.test.mjs

Refactor decryptLegacyDm to use ordered parallel race for decryptors.

2026-02-26 17:45:31 +00:00

dm-decryptor.test.mjs

Fix DM decryptor to try recipient keys for outgoing messages

2025-10-26 19:23:40 -04:00

dm-normalization.test.mjs

chore(ai): CI health fixes (flaky tests)

2026-01-20 12:39:19 +00:00

edit-modal-submit-state.test.mjs

Fix edit modal magnet hint refresh

2025-10-27 18:19:14 -04:00

edit-modal-upload-field.test.mjs

feat(edit): thumbnail + video file upload in Edit modal (steps 2-3/3)

2026-06-20 09:09:07 -04:00

edit-orphan-cleanup-keys.test.mjs

feat(edit): clean up superseded thumbnail on edit (orphan removal)

2026-06-20 09:32:30 -04:00

embed_playback_check.spec.mjs

Fix embed player crash and prevent duplicate initialization

2026-01-24 21:42:37 +00:00

encrypted-sync.test.mjs

feat(sync): Storage pane UI for encrypted settings sync (opt-in toggle + restore)

2026-06-21 17:17:35 -04:00

ensure-active-signer-refresh.test.mjs

fix(signer): register NIP-07 adapter on refresh restore (storage unlock)

2026-06-20 07:39:05 -04:00

event-schemas.test.mjs

chore(ai): event schema validation tool + fixes

2026-01-23 05:33:57 +00:00

feed-engine.test.mjs

Hydrate feed timestamps before sorting

2025-10-26 12:05:03 -04:00

feed-relay-fallback.test.mjs

fix(feed): always reserve live default relays in the feed set

2026-06-20 12:14:03 -04:00

filter-hex-sanitize.test.mjs

nostr: sanitize hex-only filter fields (fix relay "from_hex" REQ rejects)

2026-06-22 18:24:05 -04:00

for-you-scorer.test.mjs

feat(feed): make For You inclusive + ranked by your lists (G1-G5)

2026-06-14 16:57:05 -04:00

grid-health.test.mjs

test: improve gridHealth prioritization testing

2026-02-08 00:22:16 +00:00

hashtag-preferences.test.mjs

fix(nip46): route list decryption by ciphertext format (cut RPC fan-out)

2026-06-17 12:13:58 -04:00

link-preview-settings.test.mjs

test: Add unit tests for linkPreviewSettings.js

2026-02-26 17:38:30 +00:00

login-modal-controller.test.mjs

Refactor clipboard copy to use navigator.clipboard API

2026-02-17 04:52:40 +00:00

magnet-utils.test.mjs

Fix magnet query parsing for values containing '='

2026-02-09 23:22:49 -05:00

media-loader.test.mjs

Remove dynamic style system and tighten inline style checks

2025-10-14 08:48:17 -04:00

minimal-channel-profile.test.mjs

feat(test-audit): run daily test audit and fix zero-assertion test

2026-02-15 20:18:30 +00:00

minimal-webtorrent.test.mjs

Fix nostr-tools v2 compatibility and test quality issues

2026-02-27 03:43:14 +00:00

modal-accessibility.test.mjs

[security] replace innerHTML in RevertModal.js

2026-02-14 18:58:02 +00:00

moderation-service.test.mjs

Migrate user blocks to standard NIP-51 Mute List

2026-02-01 21:47:29 +00:00

moderation-stage.test.mjs

Fix viewer mute blur regression and update modal overrides

2025-10-26 16:06:40 -04:00

more-menu-controller.test.mjs

Migrate user blocks to standard NIP-51 Mute List

2026-02-01 21:47:29 +00:00

multi-webseed.test.mjs

feat(webseed): manage multiple web seeds in the edit modal (slice 3/3)

2026-06-19 08:52:11 -04:00

multipart-empty-file-guard.test.mjs

fix(upload): fail fast on 0-byte files in multipartUpload

2026-06-16 20:15:17 -04:00

my-videos-collapse.test.mjs

feat(my-videos): collapse user events to latest-per-video (Phase 1, step 2)

2026-06-20 14:26:32 -04:00

my-videos-delete-keys.test.mjs

feat(my-videos): delete-by-key primitive for orphan cleanup (Phase 2, step 3a)

2026-06-20 14:58:29 -04:00

my-videos-health.test.mjs

feat(my-videos): add pure video-health classifier (Phase 1, step 1)

2026-06-20 14:24:51 -04:00

my-videos-list-objects.test.mjs

feat(my-videos): bucket object listing for reconciliation (Phase 2, step 2)

2026-06-20 14:55:41 -04:00

my-videos-reconcile.test.mjs

feat(my-videos): storage reconciliation core (Phase 2, step 1)

2026-06-20 14:48:54 -04:00

nip07-concurrency.test.mjs

update

2026-02-21 16:08:33 -05:00

nip07-fair-scheduling.test.mjs

fix(login-perf): kill relay REQ storms and feedback loops

2026-06-14 09:52:33 -04:00

nip46-silent-restore-access-control.test.mjs

[auth] enforce access control on silent NIP-46 session restore

2026-06-18 15:53:56 -04:00

nip71-base-event-tags.test.mjs

Remove nostr shim and retarget imports

2026-01-06 15:32:21 -05:00

nip71-builder.test.mjs

Remove nostr shim and retarget imports

2026-01-06 15:32:21 -05:00

nip71-form-manager.test.mjs

Sanitize NIP-71 hashtag inputs

2025-10-08 16:39:30 -04:00

nip71-ingest-adapter.test.mjs

nip71: fix feed hang — surface published_at so ingest skips history fetch

2026-06-22 16:54:41 -04:00

nip71-ingest-service.test.mjs

nip71: defer ingest until feed renders; diagnose display path

2026-06-22 16:23:45 -04:00

nip71-mirror-flags.test.mjs

nip71: account-level "auto-share new public videos" toggle

2026-06-22 14:06:19 -04:00

nip71-mirror-service.test.mjs

feat(nip71): Phase 1b — mirror teardown (NIP-09 delete + empty-replace tombstone)

2026-06-22 09:18:31 -04:00

nip71-mirror-sync.test.mjs

nip71: account-level "auto-share new public videos" toggle

2026-06-22 14:06:19 -04:00

nip71-mirror.test.mjs

feat(nip71): mirror carries the video's hashtags (from t tags / nip71 metadata)

2026-06-22 11:30:12 -04:00

nostr-boost-actions.test.mjs

Serialize repost targets when available

2025-11-03 14:35:43 -05:00

nostr-count-fallback.test.mjs

Remove nostr shim and retarget imports

2026-01-06 15:32:21 -05:00

nostr-delete-flow.test.mjs

perf(nostr): verify event signatures off the main thread

2026-06-12 11:16:25 -04:00

nostr-ephemeral-dm-tester.html

Update nostr-tools bundle to restore nip46 handshake

2025-10-22 07:18:25 -04:00

nostr-login-permissions.test.mjs

update

2026-02-21 15:53:09 -05:00

nostr-nip46-queue.test.mjs

test(ai): add unit tests for nip46Queue and moderationActionController (agent)

2026-01-27 11:54:02 +00:00

nostr-private-key-signer.test.mjs

Refactor publishVideo logic and fix signer tests

2026-02-09 21:32:29 +00:00

nostr-publish-array-return.test.mjs

fix(publish): handle nostr-tools array-return; stop uncaught rejection flood

2026-06-20 08:27:21 -04:00

nostr-publish-optimistic.test.mjs

fix(publish): flag + log unconfirmed (optimistic) relay publishes

2026-06-16 20:28:27 -04:00

nostr-publish-rejection.test.mjs

Remove nostr shim and retarget imports

2026-01-06 15:32:21 -05:00

nostr-rebroadcast-guard.test.mjs

Refactor nostr publish helpers into shared module

2025-10-22 15:48:59 -04:00

nostr-send-direct-message.test.mjs

test: harden harness polling and fix dm signer key usage

2026-03-04 12:25:23 -05:00

nostr-service-access-control-ready.test.mjs

perf(feed): don't block fresh load on remote admin-list fetch

2026-06-12 14:31:38 -04:00

nostr-service-access-control.test.mjs

fix(test): resolve hangs in multiple unit tests and harden runner

2026-01-31 10:33:50 +00:00

nostr-session-actor.test.mjs

test(ai): add unit tests for sessionActor and signRequestQueue

2026-01-29 11:53:42 +00:00

nostr-signer-race.test.mjs

Fix CI test failures: signer wiring, permission checks, and missing methods

2026-02-09 15:33:21 +00:00

nostr-view-event-bindings.test.mjs

Add nostr facades for client, view events, and watch history

2025-10-22 22:17:30 -04:00

nostr-view-events.test.mjs

Remove legacy view filter flag

2026-01-06 15:36:37 -05:00

nsec-login.test.mjs

[auth] fix nsec login: enforce access control + working remember/unlock

2026-06-18 15:40:16 -04:00

nwc-client.test.mjs

Add wallet budget enforcement for NWC payments

2025-10-29 06:52:30 -04:00

nwc-settings-service.test.mjs

Add per-profile settings store and mask wallet inputs

2025-10-21 17:46:41 -04:00

playback-forced-source.test.mjs

[playback] harden WebTorrent streaming + add forced-source test deep links

2026-06-18 12:15:27 -04:00

position-floating-panel.test.mjs

Fix unit tests: Expose HTMLStyleElement in JSDOM setup

2026-01-14 03:52:53 +00:00

post-login-watch-history-preload.test.mjs

feat(feed): warm watch history in background after login

2026-06-19 08:04:54 -04:00

profile-cache.test.mjs

perf: Use requestIdleCallback for ProfileCache localStorage writes

2026-02-05 22:59:50 +00:00

profile-modal-controller.test.mjs

fix(exploreData): trigger refresh immediately on visibility change

2026-02-18 15:10:29 +00:00

publish-outcome-message.test.mjs

feat(publish): tell the user how many relays accepted their video

2026-06-20 12:19:09 -04:00

qrcode_table_fallback.test.mjs

Refactor js/utils/qrcode.js to replace innerHTML with DOM manipulation

2026-02-26 17:42:43 +00:00

reaction-event-builder.test.mjs

Include event pointer tags for reactions

2025-10-29 22:14:20 -04:00

relay-insecure-url.test.mjs

feat(relays): clearer relay health UI + fix broken relay operations

2026-06-20 08:27:41 -04:00

relay-operation-routing.test.mjs

feat(relays): clearer relay health UI + fix broken relay operations

2026-06-20 08:27:41 -04:00

relay-subscribe-cap.test.mjs

fix(nostr): bound read/subscribe relay set to stop cold-login REQ storm

2026-06-14 22:51:36 -04:00

revert-modal-controller.test.mjs

refactor(ai): extract handleRevertVideo from js/app.js (agent)

2026-01-27 03:20:08 +00:00

safe-decode.test.mjs

refactor: centralize safe decode helpers

2025-10-02 12:48:24 -04:00

settings-restore-prompt.test.mjs

feat(sync): offer-to-pull encrypted settings on login (one-time, non-blocking)

2026-06-21 18:08:43 -04:00

share-event-builder.test.mjs

Document and test share note events

2026-01-22 22:50:00 -05:00

shareNostrController.test.mjs

refactor(ai): extract ShareNostrController from js/app.js (agent)

2026-01-25 03:34:10 +00:00

sign-request-queue.test.mjs

test(ai): add unit tests for sessionActor and signRequestQueue

2026-01-29 11:53:42 +00:00

signer-health-notice.test.mjs

feat(signer): surface an actionable notice when the signer goes unresponsive

2026-06-16 14:18:46 -04:00

static-modal-accessibility.test.mjs

Add tests for staticModalAccessibility.js

2026-02-26 17:42:07 +00:00

storage-key-collection.test.mjs

feat(r2): delete the underlying storage objects when a video is deleted

2026-06-16 22:09:57 -04:00

storage-key-collision.test.mjs

fix(upload): content-address storage keys to stop URL-first overwrites

2026-06-16 16:56:12 -04:00

storage-service.test.mjs

test(storage): assert credentials never persist in plaintext at rest

2026-06-17 05:35:02 -04:00

storage-sync-service.test.mjs

feat(sync): warn before overwriting a newer remote copy (conflict guard)

2026-06-21 21:21:54 -04:00

subscriptions-feed.test.mjs

Normalize subscription authors to fix empty feed

2025-10-20 21:15:47 -04:00

subscriptions-manager.test.mjs

fix(subscriptions): guard the subscription-list refresh loop

2026-06-16 09:53:52 -04:00

sync-conflict.test.mjs

feat(sync): warn before overwriting a newer remote copy (conflict guard)

2026-06-21 21:21:54 -04:00

test-setup.mjs

test: fix video modal tests and add missing polyfills

2026-01-27 02:09:22 +00:00

user-blocks.test.mjs

fix(nostr): bound read/subscribe relay set to stop cold-login REQ storm

2026-06-14 22:51:36 -04:00

validate-config.test.mjs

test: add comprehensive tests for config validation

2026-02-08 03:34:20 +00:00

video-card-source-visibility.test.mjs

Stop closing menus from refocusing unrelated cards

2025-10-16 16:43:58 -04:00

video-dimensions.test.mjs

feat(video): capture & persist dimensions/duration at upload (enables shorts)

2026-06-22 11:44:02 -04:00

video-hashtags.test.mjs

feat(nip71): mirror carries the video's hashtags (from t tags / nip71 metadata)

2026-06-22 11:30:12 -04:00

video-menu-renderers.test.mjs

Add unit tests for video menu renderers

2026-02-26 17:41:34 +00:00

video-modal-accessibility.test.mjs

refactor(app): Move heavy initialization from constructor to setup()

2026-02-08 03:44:38 +00:00

video-modal-comments.test.mjs

chore(torch): execute daily agent run for ci-health-agent

2026-02-28 19:48:57 +00:00

video-modal-controller.test.mjs

refactor(ai): extract VideoModalController from js/app.js (agent)

2026-01-30 03:40:36 +00:00

video-modal-controllers.test.mjs

test: update VideoModal tag expectations to include hash prefix

2026-01-27 03:54:41 +00:00

video-modal-moderation.test.mjs

test: fix video modal tests and add missing polyfills

2026-01-27 02:09:22 +00:00

video-modal-tags.test.mjs

Add VideoModal tag rendering tests

2025-10-23 13:43:05 -04:00

video-modal-zap.test.mjs

refactor(app): Move heavy initialization from constructor to setup()

2026-02-08 03:44:38 +00:00

video-note-monotonic-created-at.test.mjs

[nostr] make video edit/delete reliably replace prior versions

2026-06-18 20:32:50 -04:00

video-note-payload.test.mjs

Support per-variant duration and bitrate in NIP-71 metadata

2025-10-29 17:06:19 -04:00

video-probe.test.mjs

feat(video): capture & persist dimensions/duration at upload (enables shorts)

2026-06-22 11:44:02 -04:00

video-schema-and-conversion.test.mjs

Remove nostr shim and retarget imports

2026-01-06 15:32:21 -05:00

video-settings-menu-controller.test.mjs

refactor(ai): extract videoSettingsMenuController from js/app.js (agent)

2026-01-29 03:19:06 +00:00

view-count-batching.test.mjs

refactor(views): batch kind-30079 view counts via SubscriptionManager (P3)

2026-06-14 15:49:50 -04:00

view-counter.test.mjs

Ensure view counts are monotonic during hydration

2026-01-07 00:43:18 +00:00

wallet-sync-no-clobber.test.mjs

fix(sync): empty wallet save must not wipe the synced copy on relays

2026-06-21 20:52:20 -04:00

wallet-sync-service.test.mjs

feat(sync): warn before overwriting a newer remote copy (conflict guard)

2026-06-21 21:21:54 -04:00

wallet-test-preserves-input.test.mjs

fix(wallet): testing the connection no longer wipes an unsaved typed URI

2026-06-21 21:07:00 -04:00

watch-history-clear-month.test.mjs

fix(watch-history): publish empty month events so clears propagate

2026-06-20 17:47:21 -04:00

watch-history-cold-load-backfill.test.mjs

[watch-history] activate fast cold-load render + background chunk backfill

2026-06-17 18:23:10 -04:00

watch-history-controller-local-remove.test.mjs

fix(watch-history): allow logged-out (local) removal instead of "disabled"

2026-06-20 19:00:51 -04:00

watch-history-dedup.test.mjs

fix(watch-history): take newest version per month on read (delete sticks)

2026-06-20 17:29:35 -04:00

watch-history-feed.test.mjs

Add watch history feed adapter and update renderer

2025-10-04 17:25:43 -04:00

watch-history-hydration-cache.test.mjs

fix(watch-history): resolve freshly-watched videos from cache (default video kind in address lookup)

2026-06-21 14:10:21 -04:00

watch-history-local-remove.test.mjs

fix(watch-history): logged-out (local) delete now rewrites the local queue

2026-06-20 18:45:42 -04:00

watch-history-partial-accept.test.mjs

fix(watch-history): a snapshot succeeds if ANY relay accepts (not all)

2026-06-20 19:13:32 -04:00

watch-history-records-under-login.test.mjs

fix(watch-history): record new watches under the logged-in identity, not the anonymous session actor

2026-06-21 10:55:27 -04:00

watch-history-remove-snapshot.test.mjs

fix(watch-history): removal must replace the list, not merge it back

2026-06-20 12:52:15 -04:00

watch-history.test.mjs

test(watch-history): rely on aggregated items from publishRecords

2026-02-26 18:02:18 +00:00

watchHistoryFingerprintEmit.test.mjs

test(watch-history): regression test for fingerprint emit-on-change

2026-06-13 08:00:28 -04:00

webtorrent-handlers.test.mjs

[playback] stop the WebTorrent webseed flood on multi-file torrents

2026-06-18 16:05:54 -04:00

webtorrent-regression.test.mjs

docs: add detailed webtorrent architecture and regression prevention comments

2026-02-01 19:35:02 +00:00

zap-receipt-pool.test.mjs

fix(zap): receipt validation works with nostr-tools 2.x SimplePool

2026-06-21 22:11:46 -04:00

zap-shared-state.test.mjs

Fix zap fee parsing for split calculations

2025-10-05 22:03:07 -04:00

zap-split.test.mjs

Remove nostr shim and retarget imports

2026-01-06 15:32:21 -05:00