@vellumai/credential-executor 0.5.5 → 0.5.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/credential-executor",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "type": "module",
   "exports": {
     ".": "./src/index.ts"

package/src/http/credential-routes.ts

@@ -16,6 +16,8 @@
  * via the environment.
  */
 
+import { timingSafeEqual } from "node:crypto";
+
 import type { SecureKeyBackend } from "@vellumai/credential-storage";
 
 // ---------------------------------------------------------------------------
@@ -43,7 +45,9 @@ function checkAuth(req: Request, serviceToken: string): Response | null {
     );
   }
 
-  if (parts[1] !== serviceToken) {
+  const provided = Buffer.from(parts[1]!);
+  const expected = Buffer.from(serviceToken);
+  if (provided.length !== expected.length || !timingSafeEqual(provided, expected)) {
     return new Response(
       JSON.stringify({ error: "Invalid service token" }),
       { status: 403, headers: { "Content-Type": "application/json" } },

package/src/materializers/local-secure-key-backend.ts

@@ -230,9 +230,9 @@ function readStore(storePath: string): StoreFile | null {
 /**
  * Create a SecureKeyBackend backed by the assistant's encrypted key store.
  *
- * Supports `get` and `set` operations. `set` is needed for persisting
- * refreshed OAuth tokens. `delete` remains unsupported (returns "error")
- * because CES never needs to remove keys.
+ * Supports `get`, `set`, and `delete` operations. `set` is needed for
+ * persisting refreshed OAuth tokens. `delete` removes a key from the
+ * encrypted store.
  *
  * @param vellumRoot - The Vellum root directory (e.g. `~/.vellum`).
  * @param options.entropyOverride - If provided, used instead of local
@@ -310,9 +310,19 @@ export function createLocalSecureKeyBackend(
       }
     },
 
-    // CES never deletes keys — only reads and writes (for token refresh).
-    async delete(_key: string): Promise<SecureKeyDeleteResult> {
-      return "error";
+    async delete(key: string): Promise<SecureKeyDeleteResult> {
+      try {
+        const store = readStore(storePath);
+        if (!store) return "error";
+
+        if (!(key in store.entries)) return "not-found";
+
+        delete store.entries[key];
+        writeStore(store, storePath);
+        return "deleted";
+      } catch {
+        return "error";
+      }
     },
 
     async list(): Promise<string[]> {