Shutdown now: stops background fight loop, waits up to 15s for active
fights to drain (polling every 500ms), clears human + poll pending
challenges, clears bet escrow. Added clearEscrow() to betting.ts and
5 tests verifying cleanup functions and correct shutdown order.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Shutdown now: 1) stops background fight loop, 2) waits up to 15s for
active fights to finish, 3) cancels pending human + poll challenges,
4) clears bet escrow. Added clearEscrow() to betting.ts. Tests verify
each cleanup function and shutdown sequence ordering.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add 3 tests for cleanupOrphanedFights: verifies db.update sets
status='cancelled' with endedAt on stale live fights, returns 0
on success, and propagates DB errors correctly.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add sanitizeError() helper that strips file paths, stack traces, SQLite
errors, and system errors from messages before returning them to clients.
Applied to all route-level catch blocks in payments, queue, fights, and
admin routes. Includes 12 tests for the sanitizer and static analysis
test verifying no route files leak raw err.message.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
All individual indexes from plan already existed. Added missing composite
index that covers WHERE is_active=1 ORDER BY elo_rating DESC pattern.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Log timing for each round phase: webhook calls, scoring, DB operations,
and total round time. Also log finalize transaction time. Uses logger
with 'perf' category for easy filtering.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add test confirming disconnect-wallet deletes walletConnections rows
and sets hasWallet=false on the bot record.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Verify random IV (same plaintext encrypts differently), ciphertext
format (iv:authTag:encrypted), auth tag tamper detection, encrypted
data tamper detection, empty string handling, and unicode support.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add tests confirming production error handler sanitizes all internal
errors (ENOENT, stack traces, file paths). Add static analysis test
verifying no route file passes err.stack to c.json() responses.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Test all 7 admin endpoints (stats, bots, deactivate, activate,
reset-elo, fights, backup) reject non-creator pubkeys and missing
pubkeys with 403. Verifies global middleware guard works correctly.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Reduce login and nostr/session rate limits from 30 to 10 requests per
minute per IP to prevent brute-force attacks. Add tests verifying 429
response after exceeding the limit.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace manual XOR loop with Node's native crypto.timingSafeEqual for
constant-time secret comparison. Add tests verifying identical error
messages for wrong secrets and <1ms response time variance across 100
requests.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
X-Forwarded-For, X-Real-IP, and CF-Connecting-IP headers were
blindly trusted, allowing attackers to bypass rate limiting by
spoofing different IPs. Now only trusted when TRUSTED_PROXY env
var is configured. Falls back to Node.js socket remoteAddress.
Add tests verifying proxy headers are ignored without TRUSTED_PROXY
and respected when it is set.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Create server/src/lib/validators.ts with reusable schemas for all API
inputs (auth, fights, bets, payments, tournaments, queue, docs).
Import and use in all route handlers, replacing inline validation.
Add formatZodError helper for user-friendly error messages.
77 test cases in validators.test.ts cover valid, invalid, boundary,
and attack inputs (SQL injection, XSS, prototype pollution).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Remove ^ prefix from all 33 dependencies across root, server, and
frontend package.json files. Lockfile regenerated and verified with
pnpm install --frozen-lockfile.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
14 integration tests covering full fight lifecycle with real in-memory
DB: SSE event ordering, polling bot challenge/response flow, human
player response submission, and 3 concurrent fights without interference.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
8 tests covering: complete fight lifecycle, HP progression, ELO
updates, concurrent fight prevention, round data validity, ELO
conservation, status transitions, and win streak tracking.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Critical finding: when all bots answer correctly, even a 50ms speed
advantage wins 95.4% of fights. At 100ms+ gap it's 100% deterministic.
ELO separation reaches 450+ after just 50 fights. Speed completely
dominates the "all correct" meta.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Simulated 1000 fights with 80% accuracy and equal speed. First-to-lead
wins 60.4% of decided fights, confirming combo system is balanced.
No decay or comeback mechanics needed.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When both bots answer wrong, the one with higher checkAnswer confidence
(closer to correct) gets +1 point advantage. Rewards trying over
timing out. Equally wrong remains a pure draw.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When both bots are correct, the one with higher checkAnswer confidence
(exact match 1.0 vs fuzzy match 0.8) gets up to +1.0 bonus points.
This rewards precise answers over approximate ones, adding another
competitive dimension beyond pure speed.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Both-correct fights could almost never produce critical hits because
max margin at typical speed differences was ~2.2, far below threshold
of 4. Lowering to 3 yields ~15% critical hit rate (target 10-20%),
making speed differences produce more exciting fight dynamics.
Research findings: simulated 1000 fights with both bots answering
correctly. Critical rate went from 0% to 15.3% with new threshold.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Multi-turn simulation, authority impersonation, encoding tricks
(Base64, ROT13), fake JSON system prompts, red team framing,
reward manipulation, inverted instruction logic. All difficulty: hard.
Zero audit failures after addition.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Test roundToDifficulty: rounds 1-2 easy, 3-4 medium, 5+ hard
- Test pickChallenge difficulty filtering works with round numbers
- Audit prompt difficulty tags across all 16 challenge types
- 8 types lack hard prompts, 3 lack medium prompts
- 82.7% of prompts are untagged (no difficulty attribute)
- Report written to loop/difficulty-distribution.md
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- checkAnswer now returns highest score across all accepted answers
instead of first match, fixing 95 false-low-confidence results
- Skip string containment for purely numeric strings to prevent
false positives like "1000" matching inside "10000"
- Preserve decimal points in normalize() (42.0 no longer becomes 420)
- Use word-boundary regex for number matching in responses
- Fix 47 wrong choices scoring too high (comma-formatted numbers,
verbose choices matching terse answers)
- Fix 17 prompts where no choice matched any accepted answer
- Challenge audit now reports zero failures across all 1472 prompts
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
useNostr (9), useFightCache (5), useOnlineStatus (4) composable tests.
Added fake-indexeddb dev dependency for IDB tests.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Only invalidates __alltime__ and current season cache keys on fight completion,
preserving historical season caches. Test verifies selective behavior.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Global app.onError handler already in app.ts catches all unhandled route
exceptions. Production mode returns "Internal server error" only.
Tests verify no stack traces or file paths leak in responses.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Both bots timing out every round: verified draw with zero damage
- Perfect victory (10-0): verified correct ELO calculation
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
blacklistJwt() adds token to in-memory blacklist until its natural expiry.
verifyJwt() checks blacklist before signature verification.
Cleanup interval removes expired entries every 10 minutes.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Documents finding: no replay protection in NIP-98 verification.
Token replay within 120s window succeeds (mitigated by JWT issuance being idempotent).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Tests the actual rateLimit middleware with production mode via dynamic import.
Covers: under-limit allows, over-limit returns 429, window reset, per-IP
isolation, and poll endpoint config (30 req/1s window).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
