fix: 6 bugs (timeline path value, seer SSE cursor, erasure checksum, subtle compare, build status code, dead WorkerName branch)

internal/fleet/atlas.go

@@ -51,6 +51,47 @@ type SeerEvent struct {
 	CreatedAt   string `json:"created_at"`
 }
 
+// ListSeerEventsSince returns events newer than the given SQLite timestamp string (exclusive).
+func (s *Store) ListSeerEventsSince(since string, limit int) ([]SeerEvent, error) {
+	if limit <= 0 {
+		limit = 50
+	}
+	var rows interface {
+		Close() error
+		Next() bool
+		Scan(dest ...any) error
+		Err() error
+	}
+	var err error
+	if since == "" {
+		rows, err = s.db.Query(`
+			SELECT id, host_id, event_type, payload_json, created_at
+			FROM seer_events ORDER BY created_at ASC LIMIT ?`, limit)
+	} else {
+		rows, err = s.db.Query(`
+			SELECT id, host_id, event_type, payload_json, created_at
+			FROM seer_events WHERE created_at > ? ORDER BY created_at ASC LIMIT ?`, since, limit)
+	}
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var events []SeerEvent
+	for rows.Next() {
+		var e SeerEvent
+		var hostID sql.NullString
+		if err := rows.Scan(&e.ID, &hostID, &e.EventType, &e.PayloadJSON, &e.CreatedAt); err != nil {
+			return nil, err
+		}
+		if hostID.Valid {
+			e.HostID = hostID.String
+		}
+		events = append(events, e)
+	}
+	return events, rows.Err()
+}
+
 func nullString(s string) sql.NullString {
 	if s == "" {
 		return sql.NullString{}

internal/fleet/hub.go

@@ -1,6 +1,7 @@
 package fleet
 
 import (
+	"crypto/subtle"
 	"encoding/json"
 	"log"
 	"net/http"
@@ -329,14 +330,7 @@ func (h *Hub) HandleBeacon(store *Store) http.HandlerFunc {
 }
 
 func constantTimeEqual(a, b string) bool {
-	if len(a) != len(b) {
-		return false
-	}
-	var v byte
-	for i := 0; i < len(a); i++ {
-		v |= a[i] ^ b[i]
-	}
-	return v == 0
+	return subtle.ConstantTimeCompare([]byte(a), []byte(b)) == 1
 }
 
 func coalesce(values ...string) string {