fix: deduplicate safeEqual using timingSafeEqual from dispatch-env by itsmiso-ai · Pull Request #256 · misospace/dispatch

itsmiso-ai · 2026-05-28T14:09:35Z

Remove local unsafe safeEqual from middleware (timing leak via early length return)
Import shared safeEqual from @/lib/dispatch-env which uses crypto.timingSafeEqual
Both isBearerAuthorized and isBasicAuthorized now use the timing-safe implementation

Remove local unsafe timing comparison from middleware and import the timing-safe version from @/lib/dispatch-env instead. This eliminates the timing leak from the early length-return and removes code duplication.

its-miso · 2026-05-28T14:10:32Z

✅ Automated recommendation: APPROVE

Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic)

PR Review: fix: deduplicate safeEqual using timingSafeEqual from dispatch-env

Summary

This PR fixes a security vulnerability (timing leak) and removes code duplication by replacing the unsafe safeEqual implementation in middleware with the timing-safe version from dispatch-env.ts.

Change-by-Change Findings

1. src/middleware.ts (+1/-8)

Removed the local unsafe safeEqual function that had a timing leak via early return on length mismatch
Added import: import { safeEqual } from "@/lib/dispatch-env"
Both isBearerAuthorized and isBasicAuthorized now use the imported timing-safe function

2. src/lib/dispatch-env.ts (+1/-1)

Exported the existing safeEqual function (changed from function to export function)
The function uses Buffer.from() + crypto.timingSafeEqual() which is timing-safe

3. eslint.config.mjs (+1/-1)

Added "vitest/dist/**" to ESLint ignore patterns (separate improvement, consistent with issue P2 — Exclude vitest/dist from ESLint scan to fix TypeError crash #247)

Standards Compliance

✅ No agent-specific names in generic docs
✅ Error handling uses proper patterns
✅ No secrets committed
✅ Minimal, focused change following single-responsibility
✅ Code follows TypeScript conventions

Linked Issue Fit: #246

Acceptance Criteria	Status
Middleware uses timing-safe comparison (no early return on length mismatch)	✅ Met
No duplicate implementation of safeEqual	✅ Met
Both `isBearerAuthorized` and `isBasicAuthorized` use the shared function	✅ Met

Evidence Provider Findings

No evidence providers configured.

Tool Harness Findings

No tool harness configured (planning response parse warning is non-blocking).

Repository Impact Scan

Git log confirms: 3ba8810 fix: deduplicate safeEqual by importing from dispatch-env
HEAD merge commit includes main branch updates
No breaking changes detected

Unknowns / Needs Verification

None.

Recommendation

Approve — All three acceptance criteria from issue #246 are fully satisfied. The fix correctly replaces the timing-leaking implementation with the shared crypto.timingSafeEqual-based version, removes duplication, and maintains functionality for both auth methods. The bonus eslint config change aligns with concurrent issue #247 work.

itsmiso-ai · 2026-05-28T14:09:35Z

Fixes#246

Remove local unsafe safeEqual from middleware (timing leak via early length return)
Import shared safeEqual from @/lib/dispatch-env which uses crypto.timingSafeEqual
Both isBearerAuthorized and isBasicAuthorized now use the timing-safe implementation

Remove local unsafe timing comparison from middleware and import the timing-safe version from @/lib/dispatch-env instead. This eliminates the timing leak from the early length-return and removes code duplication.

its-miso · 2026-05-28T14:10:32Z

✅ Automated recommendation: APPROVE

Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic)

PR Review: fix: deduplicate safeEqual using timingSafeEqual from dispatch-env

Summary

This PR fixes a security vulnerability (timing leak) and removes code duplication by replacing the unsafe safeEqual implementation in middleware with the timing-safe version from dispatch-env.ts.

Change-by-Change Findings

1. src/middleware.ts (+1/-8)

Removed the local unsafe safeEqual function that had a timing leak via early return on length mismatch
Added import: import { safeEqual } from "@/lib/dispatch-env"
Both isBearerAuthorized and isBasicAuthorized now use the imported timing-safe function

2. src/lib/dispatch-env.ts (+1/-1)

Exported the existing safeEqual function (changed from function to export function)
The function uses Buffer.from() + crypto.timingSafeEqual() which is timing-safe

3. eslint.config.mjs (+1/-1)

Added "vitest/dist/**" to ESLint ignore patterns (separate improvement, consistent with issue P2 — Exclude vitest/dist from ESLint scan to fix TypeError crash #247)

Standards Compliance

✅ No agent-specific names in generic docs
✅ Error handling uses proper patterns
✅ No secrets committed
✅ Minimal, focused change following single-responsibility
✅ Code follows TypeScript conventions

Linked Issue Fit: #246

Acceptance Criteria	Status
Middleware uses timing-safe comparison (no early return on length mismatch)	✅ Met
No duplicate implementation of safeEqual	✅ Met
Both `isBearerAuthorized` and `isBasicAuthorized` use the shared function	✅ Met

Evidence Provider Findings

No evidence providers configured.

Tool Harness Findings

No tool harness configured (planning response parse warning is non-blocking).

Repository Impact Scan

Git log confirms: 3ba8810 fix: deduplicate safeEqual by importing from dispatch-env
HEAD merge commit includes main branch updates
No breaking changes detected

Unknowns / Needs Verification

None.

Recommendation

Approve — All three acceptance criteria from issue #246 are fully satisfied. The fix correctly replaces the timing-leaking implementation with the shared crypto.timingSafeEqual-based version, removes duplication, and maintains functionality for both auth methods. The bonus eslint config change aligns with concurrent issue #247 work.

itsmiso-ai · 2026-05-28T14:09:35Z

Fixes#246

Remove local unsafe safeEqual from middleware (timing leak via early length return)
Import shared safeEqual from @/lib/dispatch-env which uses crypto.timingSafeEqual
Both isBearerAuthorized and isBasicAuthorized now use the timing-safe implementation

Remove local unsafe timing comparison from middleware and import the timing-safe version from @/lib/dispatch-env instead. This eliminates the timing leak from the early length-return and removes code duplication.

its-miso · 2026-05-28T14:10:32Z

✅ Automated recommendation: APPROVE

Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic)

PR Review: fix: deduplicate safeEqual using timingSafeEqual from dispatch-env

Summary

This PR fixes a security vulnerability (timing leak) and removes code duplication by replacing the unsafe safeEqual implementation in middleware with the timing-safe version from dispatch-env.ts.

Change-by-Change Findings

1. src/middleware.ts (+1/-8)

Removed the local unsafe safeEqual function that had a timing leak via early return on length mismatch
Added import: import { safeEqual } from "@/lib/dispatch-env"
Both isBearerAuthorized and isBasicAuthorized now use the imported timing-safe function

2. src/lib/dispatch-env.ts (+1/-1)

Exported the existing safeEqual function (changed from function to export function)
The function uses Buffer.from() + crypto.timingSafeEqual() which is timing-safe

3. eslint.config.mjs (+1/-1)

Added "vitest/dist/**" to ESLint ignore patterns (separate improvement, consistent with issue P2 — Exclude vitest/dist from ESLint scan to fix TypeError crash #247)

Standards Compliance

✅ No agent-specific names in generic docs
✅ Error handling uses proper patterns
✅ No secrets committed
✅ Minimal, focused change following single-responsibility
✅ Code follows TypeScript conventions

Linked Issue Fit: #246

Acceptance Criteria	Status
Middleware uses timing-safe comparison (no early return on length mismatch)	✅ Met
No duplicate implementation of safeEqual	✅ Met
Both `isBearerAuthorized` and `isBasicAuthorized` use the shared function	✅ Met

Evidence Provider Findings

No evidence providers configured.

Tool Harness Findings

No tool harness configured (planning response parse warning is non-blocking).

Repository Impact Scan

Git log confirms: 3ba8810 fix: deduplicate safeEqual by importing from dispatch-env
HEAD merge commit includes main branch updates
No breaking changes detected

Unknowns / Needs Verification

None.

Recommendation

Approve — All three acceptance criteria from issue #246 are fully satisfied. The fix correctly replaces the timing-leaking implementation with the shared crypto.timingSafeEqual-based version, removes duplication, and maintains functionality for both auth methods. The bonus eslint config change aligns with concurrent issue #247 work.

itsmiso-ai · 2026-05-28T14:09:35Z

Fixes#246

Remove local unsafe safeEqual from middleware (timing leak via early length return)
Import shared safeEqual from @/lib/dispatch-env which uses crypto.timingSafeEqual
Both isBearerAuthorized and isBasicAuthorized now use the timing-safe implementation

Remove local unsafe timing comparison from middleware and import the timing-safe version from @/lib/dispatch-env instead. This eliminates the timing leak from the early length-return and removes code duplication.

its-miso · 2026-05-28T14:10:32Z

✅ Automated recommendation: APPROVE

Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic)

PR Review: fix: deduplicate safeEqual using timingSafeEqual from dispatch-env

Summary

This PR fixes a security vulnerability (timing leak) and removes code duplication by replacing the unsafe safeEqual implementation in middleware with the timing-safe version from dispatch-env.ts.

Change-by-Change Findings

1. src/middleware.ts (+1/-8)

Removed the local unsafe safeEqual function that had a timing leak via early return on length mismatch
Added import: import { safeEqual } from "@/lib/dispatch-env"
Both isBearerAuthorized and isBasicAuthorized now use the imported timing-safe function

2. src/lib/dispatch-env.ts (+1/-1)

Exported the existing safeEqual function (changed from function to export function)
The function uses Buffer.from() + crypto.timingSafeEqual() which is timing-safe

3. eslint.config.mjs (+1/-1)

Added "vitest/dist/**" to ESLint ignore patterns (separate improvement, consistent with issue P2 — Exclude vitest/dist from ESLint scan to fix TypeError crash #247)

Standards Compliance

✅ No agent-specific names in generic docs
✅ Error handling uses proper patterns
✅ No secrets committed
✅ Minimal, focused change following single-responsibility
✅ Code follows TypeScript conventions

Linked Issue Fit: #246

Acceptance Criteria	Status
Middleware uses timing-safe comparison (no early return on length mismatch)	✅ Met
No duplicate implementation of safeEqual	✅ Met
Both `isBearerAuthorized` and `isBasicAuthorized` use the shared function	✅ Met

Evidence Provider Findings

No evidence providers configured.

Tool Harness Findings

No tool harness configured (planning response parse warning is non-blocking).

Repository Impact Scan

Git log confirms: 3ba8810 fix: deduplicate safeEqual by importing from dispatch-env
HEAD merge commit includes main branch updates
No breaking changes detected

Unknowns / Needs Verification

None.

Recommendation

Approve — All three acceptance criteria from issue #246 are fully satisfied. The fix correctly replaces the timing-leaking implementation with the shared crypto.timingSafeEqual-based version, removes duplication, and maintains functionality for both auth methods. The bonus eslint config change aligns with concurrent issue #247 work.

itsmiso-ai · 2026-05-28T14:09:35Z

Fixes#246

Remove local unsafe safeEqual from middleware (timing leak via early length return)
Import shared safeEqual from @/lib/dispatch-env which uses crypto.timingSafeEqual
Both isBearerAuthorized and isBasicAuthorized now use the timing-safe implementation

Remove local unsafe timing comparison from middleware and import the timing-safe version from @/lib/dispatch-env instead. This eliminates the timing leak from the early length-return and removes code duplication.

its-miso · 2026-05-28T14:10:32Z

✅ Automated recommendation: APPROVE

Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic)

PR Review: fix: deduplicate safeEqual using timingSafeEqual from dispatch-env

Summary

This PR fixes a security vulnerability (timing leak) and removes code duplication by replacing the unsafe safeEqual implementation in middleware with the timing-safe version from dispatch-env.ts.

Change-by-Change Findings

1. src/middleware.ts (+1/-8)

Removed the local unsafe safeEqual function that had a timing leak via early return on length mismatch
Added import: import { safeEqual } from "@/lib/dispatch-env"
Both isBearerAuthorized and isBasicAuthorized now use the imported timing-safe function

2. src/lib/dispatch-env.ts (+1/-1)

Exported the existing safeEqual function (changed from function to export function)
The function uses Buffer.from() + crypto.timingSafeEqual() which is timing-safe

3. eslint.config.mjs (+1/-1)

Added "vitest/dist/**" to ESLint ignore patterns (separate improvement, consistent with issue P2 — Exclude vitest/dist from ESLint scan to fix TypeError crash #247)

Standards Compliance

✅ No agent-specific names in generic docs
✅ Error handling uses proper patterns
✅ No secrets committed
✅ Minimal, focused change following single-responsibility
✅ Code follows TypeScript conventions

Linked Issue Fit: #246

Acceptance Criteria	Status
Middleware uses timing-safe comparison (no early return on length mismatch)	✅ Met
No duplicate implementation of safeEqual	✅ Met
Both `isBearerAuthorized` and `isBasicAuthorized` use the shared function	✅ Met

Evidence Provider Findings

No evidence providers configured.

Tool Harness Findings

No tool harness configured (planning response parse warning is non-blocking).

Repository Impact Scan

Git log confirms: 3ba8810 fix: deduplicate safeEqual by importing from dispatch-env
HEAD merge commit includes main branch updates
No breaking changes detected

Unknowns / Needs Verification

None.

Recommendation

Approve — All three acceptance criteria from issue #246 are fully satisfied. The fix correctly replaces the timing-leaking implementation with the shared crypto.timingSafeEqual-based version, removes duplication, and maintains functionality for both auth methods. The bonus eslint config change aligns with concurrent issue #247 work.

itsmiso-ai · 2026-05-28T14:09:35Z

Fixes#246

Remove local unsafe safeEqual from middleware (timing leak via early length return)
Import shared safeEqual from @/lib/dispatch-env which uses crypto.timingSafeEqual
Both isBearerAuthorized and isBasicAuthorized now use the timing-safe implementation

Remove local unsafe timing comparison from middleware and import the timing-safe version from @/lib/dispatch-env instead. This eliminates the timing leak from the early length-return and removes code duplication.

its-miso · 2026-05-28T14:10:32Z

✅ Automated recommendation: APPROVE

Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic)

PR Review: fix: deduplicate safeEqual using timingSafeEqual from dispatch-env

Summary

This PR fixes a security vulnerability (timing leak) and removes code duplication by replacing the unsafe safeEqual implementation in middleware with the timing-safe version from dispatch-env.ts.

Change-by-Change Findings

1. src/middleware.ts (+1/-8)

Removed the local unsafe safeEqual function that had a timing leak via early return on length mismatch
Added import: import { safeEqual } from "@/lib/dispatch-env"
Both isBearerAuthorized and isBasicAuthorized now use the imported timing-safe function

2. src/lib/dispatch-env.ts (+1/-1)

Exported the existing safeEqual function (changed from function to export function)
The function uses Buffer.from() + crypto.timingSafeEqual() which is timing-safe

3. eslint.config.mjs (+1/-1)

Added "vitest/dist/**" to ESLint ignore patterns (separate improvement, consistent with issue P2 — Exclude vitest/dist from ESLint scan to fix TypeError crash #247)

Standards Compliance

✅ No agent-specific names in generic docs
✅ Error handling uses proper patterns
✅ No secrets committed
✅ Minimal, focused change following single-responsibility
✅ Code follows TypeScript conventions

Linked Issue Fit: #246

Acceptance Criteria	Status
Middleware uses timing-safe comparison (no early return on length mismatch)	✅ Met
No duplicate implementation of safeEqual	✅ Met
Both `isBearerAuthorized` and `isBasicAuthorized` use the shared function	✅ Met

Evidence Provider Findings

No evidence providers configured.

Tool Harness Findings

No tool harness configured (planning response parse warning is non-blocking).

Repository Impact Scan

Git log confirms: 3ba8810 fix: deduplicate safeEqual by importing from dispatch-env
HEAD merge commit includes main branch updates
No breaking changes detected

Unknowns / Needs Verification

None.

Recommendation

Approve — All three acceptance criteria from issue #246 are fully satisfied. The fix correctly replaces the timing-leaking implementation with the shared crypto.timingSafeEqual-based version, removes duplication, and maintains functionality for both auth methods. The bonus eslint config change aligns with concurrent issue #247 work.

itsmiso-ai · 2026-05-28T14:09:35Z

Fixes#246

Remove local unsafe safeEqual from middleware (timing leak via early length return)
Import shared safeEqual from @/lib/dispatch-env which uses crypto.timingSafeEqual
Both isBearerAuthorized and isBasicAuthorized now use the timing-safe implementation

Remove local unsafe timing comparison from middleware and import the timing-safe version from @/lib/dispatch-env instead. This eliminates the timing leak from the early length-return and removes code duplication.

its-miso · 2026-05-28T14:10:32Z

✅ Automated recommendation: APPROVE

Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic)

PR Review: fix: deduplicate safeEqual using timingSafeEqual from dispatch-env

Summary

This PR fixes a security vulnerability (timing leak) and removes code duplication by replacing the unsafe safeEqual implementation in middleware with the timing-safe version from dispatch-env.ts.

Change-by-Change Findings

1. src/middleware.ts (+1/-8)

Removed the local unsafe safeEqual function that had a timing leak via early return on length mismatch
Added import: import { safeEqual } from "@/lib/dispatch-env"
Both isBearerAuthorized and isBasicAuthorized now use the imported timing-safe function

2. src/lib/dispatch-env.ts (+1/-1)

Exported the existing safeEqual function (changed from function to export function)
The function uses Buffer.from() + crypto.timingSafeEqual() which is timing-safe

3. eslint.config.mjs (+1/-1)

Added "vitest/dist/**" to ESLint ignore patterns (separate improvement, consistent with issue P2 — Exclude vitest/dist from ESLint scan to fix TypeError crash #247)

Standards Compliance

✅ No agent-specific names in generic docs
✅ Error handling uses proper patterns
✅ No secrets committed
✅ Minimal, focused change following single-responsibility
✅ Code follows TypeScript conventions

Linked Issue Fit: #246

Acceptance Criteria	Status
Middleware uses timing-safe comparison (no early return on length mismatch)	✅ Met
No duplicate implementation of safeEqual	✅ Met
Both `isBearerAuthorized` and `isBasicAuthorized` use the shared function	✅ Met

Evidence Provider Findings

No evidence providers configured.

Tool Harness Findings

No tool harness configured (planning response parse warning is non-blocking).

Repository Impact Scan

Git log confirms: 3ba8810 fix: deduplicate safeEqual by importing from dispatch-env
HEAD merge commit includes main branch updates
No breaking changes detected

Unknowns / Needs Verification

None.

Recommendation

Approve — All three acceptance criteria from issue #246 are fully satisfied. The fix correctly replaces the timing-leaking implementation with the shared crypto.timingSafeEqual-based version, removes duplication, and maintains functionality for both auth methods. The bonus eslint config change aligns with concurrent issue #247 work.

itsmiso-ai · 2026-05-28T14:09:35Z

Fixes#246

Remove local unsafe safeEqual from middleware (timing leak via early length return)
Import shared safeEqual from @/lib/dispatch-env which uses crypto.timingSafeEqual
Both isBearerAuthorized and isBasicAuthorized now use the timing-safe implementation

Remove local unsafe timing comparison from middleware and import the timing-safe version from @/lib/dispatch-env instead. This eliminates the timing leak from the early length-return and removes code duplication.

its-miso · 2026-05-28T14:10:32Z

✅ Automated recommendation: APPROVE

Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic)

PR Review: fix: deduplicate safeEqual using timingSafeEqual from dispatch-env

Summary

This PR fixes a security vulnerability (timing leak) and removes code duplication by replacing the unsafe safeEqual implementation in middleware with the timing-safe version from dispatch-env.ts.

Change-by-Change Findings

1. src/middleware.ts (+1/-8)

Removed the local unsafe safeEqual function that had a timing leak via early return on length mismatch
Added import: import { safeEqual } from "@/lib/dispatch-env"
Both isBearerAuthorized and isBasicAuthorized now use the imported timing-safe function

2. src/lib/dispatch-env.ts (+1/-1)

Exported the existing safeEqual function (changed from function to export function)
The function uses Buffer.from() + crypto.timingSafeEqual() which is timing-safe

3. eslint.config.mjs (+1/-1)

Added "vitest/dist/**" to ESLint ignore patterns (separate improvement, consistent with issue P2 — Exclude vitest/dist from ESLint scan to fix TypeError crash #247)

Standards Compliance

✅ No agent-specific names in generic docs
✅ Error handling uses proper patterns
✅ No secrets committed
✅ Minimal, focused change following single-responsibility
✅ Code follows TypeScript conventions

Linked Issue Fit: #246

Acceptance Criteria	Status
Middleware uses timing-safe comparison (no early return on length mismatch)	✅ Met
No duplicate implementation of safeEqual	✅ Met
Both `isBearerAuthorized` and `isBasicAuthorized` use the shared function	✅ Met

Evidence Provider Findings

No evidence providers configured.

Tool Harness Findings

No tool harness configured (planning response parse warning is non-blocking).

Repository Impact Scan

Git log confirms: 3ba8810 fix: deduplicate safeEqual by importing from dispatch-env
HEAD merge commit includes main branch updates
No breaking changes detected

Unknowns / Needs Verification

None.

Recommendation

Approve — All three acceptance criteria from issue #246 are fully satisfied. The fix correctly replaces the timing-leaking implementation with the shared crypto.timingSafeEqual-based version, removes duplication, and maintains functionality for both auth methods. The bonus eslint config change aligns with concurrent issue #247 work.

itsmiso-ai added 2 commits May 28, 2026 06:06

fix: exclude vitest/dist from ESLint scan to fix TypeError crash (#247)
927ce80

fix: deduplicate safeEqual by importing from dispatch-env
3ba8810
Remove local unsafe timing comparison from middleware and import the timing-safe version from @/lib/dispatch-env instead. This eliminates the timing leak from the early length-return and removes code duplication.

Merge branch 'main' into fix/issue-246-deduplicate-safeequal
a009766

joryirving merged commit d5caa96 into mainMay 29, 2026
3 checks passed

joryirving deleted the fix/issue-246-deduplicate-safeequal branch May 29, 2026 16:15

its-saffronBot mentioned this pull request May 29, 2026
fix: deduplicate safeEqual in auth.ts by importing from dispatch-env #277
Merged

joryirving mentioned this pull request Jul 9, 2026
fix(pr-followup): detect merge conflicts in scheduled sync #600
Merged

itsmiso-ai added 2 commits May 28, 2026 06:06

fix: exclude vitest/dist from ESLint scan to fix TypeError crash (#247)
927ce80

fix: deduplicate safeEqual by importing from dispatch-env
3ba8810
Remove local unsafe timing comparison from middleware and import the timing-safe version from @/lib/dispatch-env instead. This eliminates the timing leak from the early length-return and removes code duplication.

Merge branch 'main' into fix/issue-246-deduplicate-safeequal
a009766

joryirving merged commit d5caa96 into mainMay 29, 2026
3 checks passed

joryirving deleted the fix/issue-246-deduplicate-safeequal branch May 29, 2026 16:15

its-saffronBot mentioned this pull request May 29, 2026
fix: deduplicate safeEqual in auth.ts by importing from dispatch-env #277
Merged

joryirving mentioned this pull request Jul 9, 2026
fix(pr-followup): detect merge conflicts in scheduled sync #600
Merged

itsmiso-ai added 2 commits May 28, 2026 06:06

fix: exclude vitest/dist from ESLint scan to fix TypeError crash (#247)
927ce80

fix: deduplicate safeEqual by importing from dispatch-env
3ba8810
Remove local unsafe timing comparison from middleware and import the timing-safe version from @/lib/dispatch-env instead. This eliminates the timing leak from the early length-return and removes code duplication.

Merge branch 'main' into fix/issue-246-deduplicate-safeequal
a009766

joryirving merged commit d5caa96 into mainMay 29, 2026
3 checks passed

joryirving deleted the fix/issue-246-deduplicate-safeequal branch May 29, 2026 16:15

its-saffronBot mentioned this pull request May 29, 2026
fix: deduplicate safeEqual in auth.ts by importing from dispatch-env #277
Merged

joryirving mentioned this pull request Jul 9, 2026
fix(pr-followup): detect merge conflicts in scheduled sync #600
Merged

itsmiso-ai added 2 commits May 28, 2026 06:06

fix: exclude vitest/dist from ESLint scan to fix TypeError crash (#247)
927ce80

fix: deduplicate safeEqual by importing from dispatch-env
3ba8810
Remove local unsafe timing comparison from middleware and import the timing-safe version from @/lib/dispatch-env instead. This eliminates the timing leak from the early length-return and removes code duplication.

Merge branch 'main' into fix/issue-246-deduplicate-safeequal
a009766

joryirving merged commit d5caa96 into mainMay 29, 2026
3 checks passed

joryirving deleted the fix/issue-246-deduplicate-safeequal branch May 29, 2026 16:15

its-saffronBot mentioned this pull request May 29, 2026
fix: deduplicate safeEqual in auth.ts by importing from dispatch-env #277
Merged

joryirving mentioned this pull request Jul 9, 2026
fix(pr-followup): detect merge conflicts in scheduled sync #600
Merged

itsmiso-ai added 2 commits May 28, 2026 06:06

fix: exclude vitest/dist from ESLint scan to fix TypeError crash (#247)
927ce80

fix: deduplicate safeEqual by importing from dispatch-env
3ba8810
Remove local unsafe timing comparison from middleware and import the timing-safe version from @/lib/dispatch-env instead. This eliminates the timing leak from the early length-return and removes code duplication.

Merge branch 'main' into fix/issue-246-deduplicate-safeequal
a009766

joryirving merged commit d5caa96 into mainMay 29, 2026
3 checks passed

joryirving deleted the fix/issue-246-deduplicate-safeequal branch May 29, 2026 16:15

its-saffronBot mentioned this pull request May 29, 2026
fix: deduplicate safeEqual in auth.ts by importing from dispatch-env #277
Merged

joryirving mentioned this pull request Jul 9, 2026
fix(pr-followup): detect merge conflicts in scheduled sync #600
Merged

itsmiso-ai added 2 commits May 28, 2026 06:06

fix: exclude vitest/dist from ESLint scan to fix TypeError crash (#247)
927ce80

fix: deduplicate safeEqual by importing from dispatch-env
3ba8810
Remove local unsafe timing comparison from middleware and import the timing-safe version from @/lib/dispatch-env instead. This eliminates the timing leak from the early length-return and removes code duplication.

Merge branch 'main' into fix/issue-246-deduplicate-safeequal
a009766

joryirving merged commit d5caa96 into mainMay 29, 2026
3 checks passed

joryirving deleted the fix/issue-246-deduplicate-safeequal branch May 29, 2026 16:15

its-saffronBot mentioned this pull request May 29, 2026
fix: deduplicate safeEqual in auth.ts by importing from dispatch-env #277
Merged

joryirving mentioned this pull request Jul 9, 2026
fix(pr-followup): detect merge conflicts in scheduled sync #600
Merged

itsmiso-ai added 2 commits May 28, 2026 06:06

fix: exclude vitest/dist from ESLint scan to fix TypeError crash (#247)
927ce80

fix: deduplicate safeEqual by importing from dispatch-env
3ba8810
Remove local unsafe timing comparison from middleware and import the timing-safe version from @/lib/dispatch-env instead. This eliminates the timing leak from the early length-return and removes code duplication.

Merge branch 'main' into fix/issue-246-deduplicate-safeequal
a009766

joryirving merged commit d5caa96 into mainMay 29, 2026
3 checks passed

joryirving deleted the fix/issue-246-deduplicate-safeequal branch May 29, 2026 16:15

its-saffronBot mentioned this pull request May 29, 2026
fix: deduplicate safeEqual in auth.ts by importing from dispatch-env #277
Merged

joryirving mentioned this pull request Jul 9, 2026
fix(pr-followup): detect merge conflicts in scheduled sync #600
Merged

itsmiso-ai added 2 commits May 28, 2026 06:06

fix: exclude vitest/dist from ESLint scan to fix TypeError crash (#247)
927ce80

fix: deduplicate safeEqual by importing from dispatch-env
3ba8810
Remove local unsafe timing comparison from middleware and import the timing-safe version from @/lib/dispatch-env instead. This eliminates the timing leak from the early length-return and removes code duplication.

Merge branch 'main' into fix/issue-246-deduplicate-safeequal
a009766

joryirving merged commit d5caa96 into mainMay 29, 2026
3 checks passed

joryirving deleted the fix/issue-246-deduplicate-safeequal branch May 29, 2026 16:15

its-saffronBot mentioned this pull request May 29, 2026
fix: deduplicate safeEqual in auth.ts by importing from dispatch-env #277
Merged

joryirving mentioned this pull request Jul 9, 2026
fix(pr-followup): detect merge conflicts in scheduled sync #600
Merged

Uh oh!

Conversation

itsmiso-ai commented May 28, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

its-misoBot commented May 28, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review: fix: deduplicate safeEqual using timingSafeEqual from dispatch-env

Summary

Change-by-Change Findings

Standards Compliance

Linked Issue Fit: #246

Evidence Provider Findings

Tool Harness Findings

Repository Impact Scan

Unknowns / Needs Verification

Recommendation

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

itsmiso-ai commented May 28, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

its-misoBot commented May 28, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review: fix: deduplicate safeEqual using timingSafeEqual from dispatch-env

Summary

Change-by-Change Findings

Standards Compliance

Linked Issue Fit: #246

Evidence Provider Findings

Tool Harness Findings

Repository Impact Scan

Unknowns / Needs Verification

Recommendation

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

itsmiso-ai commented May 28, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

its-misoBot commented May 28, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review: fix: deduplicate safeEqual using timingSafeEqual from dispatch-env

Summary

Change-by-Change Findings

Standards Compliance

Linked Issue Fit: #246

Evidence Provider Findings

Tool Harness Findings

Repository Impact Scan

Unknowns / Needs Verification

Recommendation

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

itsmiso-ai commented May 28, 2026•
edited
Loading

its-misoBot commented May 28, 2026•
edited
Loading

itsmiso-ai commented May 28, 2026•
edited
Loading

its-misoBot commented May 28, 2026•
edited
Loading

itsmiso-ai commented May 28, 2026•
edited
Loading

its-misoBot commented May 28, 2026•
edited
Loading

itsmiso-ai commented May 28, 2026•
edited
Loading

its-misoBot commented May 28, 2026•
edited
Loading

itsmiso-ai commented May 28, 2026•
edited
Loading

its-misoBot commented May 28, 2026•
edited
Loading