feat: extract encryption into @kilocode/encryption package#697
Merged
feat: extract encryption into @kilocode/encryption package#697
Conversation
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
Contributor
Code Review SummaryStatus: 1 Issue Found | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
Other Observations (not in diff)Issues found in unchanged code that cannot receive inline comments:
Files Reviewed (28 files)
|
iscekic
force-pushed
the
chore/worker-utils-encryption
branch
from
de2f062 to
d2a9c63
Compare
iscekic
changed the title
jeanduplessis
approved these changes
Mar 1, 2026
iscekic
added a commit
that referenced
this pull request
Mar 1, 2026
…ow-up PR Restore local timingSafeEqual implementations in cloudflare-db-proxy, cloudflare-webhook-agent-ingest, and kiloclaw to keep this PR focused on non-crypto utilities. The shared extraction will land in PR #697.
Copy existing node:crypto encryption code into a new shared package
at packages/encryption/. No API changes — all functions remain
synchronous, wire format is identical, PKCS#1 keys keep working.
- New @kilocode/encryption package with RSA envelope + symmetric encryption
- Lifts decryptSecrets and mergeEnvVarsWithSecrets from cloud-agent wrappers
- src/lib/encryption.ts becomes a thin re-export layer
- cloud-agent{,-next} wrappers re-export from @kilocode/encryption
- cloudflare-deploy-infra/builder imports from @kilocode/encryption
- 19 tests in the package covering RSA, symmetric, batch helpers
- Remove consumer-specific AGENT_ENV_VARS_PRIVATE_KEY from shared package error message - Remove redundant bare EncryptedEnvelope type export from cloud-agent wrappers - Fix lint: use import type instead of inline import() annotation
All test cases are covered by packages/encryption/src/encryption.test.ts. The deleted files tested the same functions through re-export layers.
Add a unified timingSafeEqual using node:crypto (works in both Node.js and Cloudflare Workers with nodejs_compat). Replace local implementations in cloudflare-db-proxy, cloudflare-webhook-agent-ingest, and kiloclaw.
iscekic
force-pushed
the
chore/worker-utils-encryption
branch
from
85907e5 to
c3b13cf
Compare
Remove .js extensions from index.ts imports (webpack can't resolve them) and replace inline import() type annotations with proper import type statements to satisfy consistent-type-imports lint rule.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
node:cryptoencryption code into a new@kilocode/encryptionworkspace packageChanges
packages/encryption/— new@kilocode/encryptionpackage containing:encryptWithPublicKey,decryptWithPrivateKey(RSA-OAEP + AES-256-GCM envelope)encryptWithSymmetricKey,decryptWithSymmetricKey(AES-256-GCM symmetric)decryptSecrets,mergeEnvVarsWithSecrets(batch helpers, lifted from cloud-agent wrappers)EncryptionConfigurationError,EncryptionFormatErrorConsumer updates (all thin re-export layers, no logic changes):
src/lib/encryption.ts— re-exports from@kilocode/encryptioncloud-agent{,-next}/src/utils/encryption.ts— re-exports with aliases (DecryptionConfigurationError, etc.)cloudflare-deploy-infra/builder/src/env-decryptor.ts— imports from@kilocode/encryptioncloud-agent{,-next}/src/utils/encryption.test.ts— importsencryptWithPublicKeyfrom packageInfrastructure: workspace registration,
@kilocode/encryptiondep in root + cloud-agent + cloud-agent-next + deploy-infra/builder, tsconfig path aliasWhat does NOT change
awaitchanges at call sites)Base:
chore/worker-utils(PR #683)