Go to file

root 459a7749c9 fix(auth): constant-time owner-token comparison

Owner bearer token was compared with === / !==, which short-circuits on the
first differing byte and leaks token length+prefix via response timing
(security-sweep-2026-06-01.md). New timingSafeStrEqual (crypto.timingSafeEqual
with a length pre-check so it never throws on length mismatch); wired into both
owner.js and agent_auth.js.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-01 23:26:46 +10:00

deploy

fix(deploy): point deploy targets at CT 311 new IP .216

2026-06-01 17:49:08 +10:00

docs

fix(pending): allow suggest-tier 'upsert' drafts; make dependency wiring owner-only

2026-06-01 23:19:44 +10:00

lib

fix(auth): constant-time owner-token comparison

2026-06-01 23:26:46 +10:00

public

polish(ui): friendly tool-chip labels (strip mcp__void__ prefix)

2026-06-01 22:50:27 +10:00

tests

fix(auth): constant-time owner-token comparison

2026-06-01 23:26:46 +10:00

workers

chore: gitignore python build artifacts (untrack pycache/egg-info)

2026-06-01 22:23:06 +10:00

.env.example

chore: initial repo scaffolding

2026-05-31 01:22:10 +10:00

.gitignore

chore: gitignore python build artifacts (untrack pycache/egg-info)

2026-06-01 22:23:06 +10:00

CHANGELOG.md

chore: version 2.0.0-alpha.6 — companion on Claude CLI subprocess (Max subscription)

2026-06-01 22:22:53 +10:00

package-lock.json

feat(companion): Dross persona (Cradle) + migration 008 rename; remove dead API-key path

2026-06-01 22:58:43 +10:00

package.json

feat(companion): Dross persona (Cradle) + migration 008 rename; remove dead API-key path

2026-06-01 22:58:43 +10:00

README.md

chore: initial repo scaffolding

2026-05-31 01:22:10 +10:00

server.js

chore: version 2.0.0-alpha.6 — companion on Claude CLI subprocess (Max subscription)

2026-06-01 22:22:53 +10:00

vitest.config.js

feat(repos): spaces, projects, tasks with audit stub

2026-05-31 02:11:31 +10:00

README.md

Void 2.0

Homelab orchestrator + canonical knowledge store. Cradle-themed. Successor to Void 1.x (CT 301). Spec at /project/docs/superpowers/specs/2026-05-31-void-v2-design.md.

Layout

void-server (this repo) — Node API, MCP, UI, cron, agent runtime
void-workers — Python ingest workers (separate repo, later plan)

Quick start (dev)

Provision void2-db LXC (see deploy/README.md)
Install Postgres + pgvector on void2-db
npm install
cp .env.example .env and edit
npm run migrate
npm start
curl -H "Authorization: Bearer $OWNER_TOKEN" http://localhost:3000/health

Languages

JavaScript 87.5%

CSS 6.4%

Python 5.2%

Shell 0.7%

HTML 0.2%