Go to file

root aa9cf0917e fix(auth): O(1) selector+verifier token verification

verifyToken loaded every non-revoked token and bcrypt-compared each (O(n) per
request — auth-latency DoS + linear scaling). New token format
vk_<selector>.<verifier>: the non-secret selector is indexed and locates exactly
one row; only the verifier is bcrypt-hashed. Legacy NULL-selector tokens still
verify via a fallback scan. Dropped the useless idx_agent_tokens_hash.

- migration 010_token_selector.sql (adds selector col + unique partial index)
- createToken/verifyToken reworked; also adds listTokenMeta (read for Yerin's
  token_audit tool)
- tests/repos/token_selector.test.js

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-02 00:17:45 +10:00

deploy

fix(deploy): point deploy targets at CT 311 new IP .216

2026-06-01 17:49:08 +10:00

docs

docs: security sweep, code review, Yerin design, Plan 6 brainstorm brief

2026-06-01 23:26:46 +10:00

lib

fix(auth): O(1) selector+verifier token verification

2026-06-02 00:17:45 +10:00

public

polish(ui): friendly tool-chip labels (strip mcp__void__ prefix)

2026-06-01 22:50:27 +10:00

tests

fix(auth): O(1) selector+verifier token verification

2026-06-02 00:17:45 +10:00

workers

chore: gitignore python build artifacts (untrack pycache/egg-info)

2026-06-01 22:23:06 +10:00

.env.example

chore: initial repo scaffolding

2026-05-31 01:22:10 +10:00

.gitignore

chore: gitignore python build artifacts (untrack pycache/egg-info)

2026-06-01 22:23:06 +10:00

CHANGELOG.md

chore: version 2.0.0-alpha.6 — companion on Claude CLI subprocess (Max subscription)

2026-06-01 22:22:53 +10:00

package-lock.json

feat(companion): Dross persona (Cradle) + migration 008 rename; remove dead API-key path

2026-06-01 22:58:43 +10:00

package.json

feat(companion): Dross persona (Cradle) + migration 008 rename; remove dead API-key path

2026-06-01 22:58:43 +10:00

README.md

chore: initial repo scaffolding

2026-05-31 01:22:10 +10:00

server.js

chore: version 2.0.0-alpha.6 — companion on Claude CLI subprocess (Max subscription)

2026-06-01 22:22:53 +10:00

vitest.config.js

feat(repos): spaces, projects, tasks with audit stub

2026-05-31 02:11:31 +10:00

README.md

Void 2.0

Homelab orchestrator + canonical knowledge store. Cradle-themed. Successor to Void 1.x (CT 301). Spec at /project/docs/superpowers/specs/2026-05-31-void-v2-design.md.

Layout

void-server (this repo) — Node API, MCP, UI, cron, agent runtime
void-workers — Python ingest workers (separate repo, later plan)

Quick start (dev)

Provision void2-db LXC (see deploy/README.md)
Install Postgres + pgvector on void2-db
npm install
cp .env.example .env and edit
npm run migrate
npm start
curl -H "Authorization: Bearer $OWNER_TOKEN" http://localhost:3000/health

Languages

JavaScript 87.5%

CSS 6.4%

Python 5.2%

Shell 0.7%

HTML 0.2%