Skip to content

(janitor/dedupe): consolidate constant-time secret comparison onto @kilocode/encryption - #5829

Open
kilo-code-bot[bot] wants to merge 1 commit into
mainfrom
janitor/dedupe/timing-safe-equal
Open

(janitor/dedupe): consolidate constant-time secret comparison onto @kilocode/encryption#5829
kilo-code-bot[bot] wants to merge 1 commit into
mainfrom
janitor/dedupe/timing-safe-equal

Conversation

@kilo-code-bot

@kilo-code-bot kilo-code-bot Bot commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

Summary

Six Cloudflare Worker services each reimplement the same constant-time secret comparison for internal-secret auth. @kilocode/encryption already owns a tested timingSafeEqual and is used by nine other workers, so this PR points the stragglers at it and deletes the local copies.

Changes

  • services/notifications, services/session-ingest — replace the inline TextEncoder + node:crypto length-guard block with timingSafeEqual(provided, expected).
  • services/model-eval-ingest, services/security-sync, services/security-auto-analysis — delete the local SHA-256-digest timingSafeEqual helpers; user-data-export drops the inline digest comparison in authorized.
  • Add @kilocode/encryption to the six services' package.json (all already run nodejs_compat).

No behavior change: comparisons stay constant-time and fail closed on missing/empty input.

Verification

  • tsgo --noEmit passes for all six affected services.
  • oxlint on the six changed source files: 0 warnings, 0 errors.
  • Could not run the Vitest/@cloudflare/vitest-pool-workers or integration suites in this environment (workers test pool + Postgres/Redis unavailable).

…ilocode/encryption

Six Cloudflare Worker services each reimplement the same constant-time
string comparison for internal-secret auth, either via a TextEncoder +
node:crypto timingSafeEqual length-guard or a SHA-256 digest +
timingSafeEqual dance. @kilocode/encryption already owns a tested
timingSafeEqual that performs the length-guard comparison and is used by
nine other workers, so point the stragglers at it and delete the local
copies.

No behavior change: comparisons remain constant-time and fail closed on
missing/empty input. Validated with tsgo typecheck and oxlint on the six
affected services.
@kilo-code-bot kilo-code-bot Bot added the janitor Automated dead-code/duplication cleanup label Sep 2, 2026
@kilo-code-bot

kilo-code-bot Bot commented Sep 2, 2026

Copy link
Copy Markdown
Contributor Author

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Six Workers now call the existing @kilocode/encryption timingSafeEqual helper for internal-secret auth; fail-closed guards, nodejs_compat, and the shared UTF-8/length-guard behavior match the established pattern.

Files Reviewed (13 files)
  • pnpm-lock.yaml
  • services/model-eval-ingest/package.json
  • services/model-eval-ingest/src/index.ts
  • services/notifications/package.json
  • services/notifications/src/index.ts
  • services/security-auto-analysis/package.json
  • services/security-auto-analysis/src/index.ts
  • services/security-sync/package.json
  • services/security-sync/src/index.ts
  • services/session-ingest/package.json
  • services/session-ingest/src/app.ts
  • services/user-data-export/package.json
  • services/user-data-export/src/index.ts

Reviewed by grok-4.6 · Input: 126.9K · Output: 12K · Cached: 441.5K

Review guidance: REVIEW.md from base branch main

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

janitor Automated dead-code/duplication cleanup

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants