molecule-core

core-lead/molecule-core

Fork 0

forked from molecule-ai/molecule-core

Commit Graph

Author	SHA1	Message	Date
Backend Engineer	d8c670a687	fix(security): N1 — add auth headers to all platform calls in Python callers IMPACT WITHOUT THIS FIX: deploying PR #31 (WorkspaceAuth middleware on /workspaces/*) without this patch causes EVERY delegation cycle to silently break — the heartbeat poll returns 401, the self-message A2A POST returns 401, agents never wake up after task completion, and memory consolidation stops. The entire multi-agent coordination system degrades to single-shot interactions with no result delivery. Changes (all using the existing platform_auth.auth_headers() pattern already used for POST /registry/heartbeat): heartbeat.py — 5 calls fixed: - GET /workspaces/:id/delegations (delegation poll) - GET /workspaces/:id (self workspace info for parent lookup) - GET /workspaces/{parent_id} (parent workspace name lookup) - POST /workspaces/:id/a2a (self-message to wake agent on results) - POST /workspaces/:id/notify (canvas delegation result notification) Also moved `from platform_auth import auth_headers` from inline (per-call) to module-level import so _check_delegations() can use it without re-importing. consolidation.py — 4 calls fixed: - GET /workspaces/:id/memories (fetch memories for consolidation) - POST /workspaces/:id/memories (write consolidated summary — agent path) - DELETE /workspaces/:id/memories/:id (delete original memories post-consolidation) - POST /workspaces/:id/memories (write consolidated summary — fallback path) a2a_client.py — 1 call fixed: - GET /workspaces/:id (get_workspace_info()) ⚠️ DEPLOYMENT NOTE: This PR MUST be merged and deployed at the same time as PR #31 (WorkspaceAuth middleware). Deploying #31 without this fix will immediately break all delegation result delivery. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-14 08:37:50 +00:00
Hongming Wang	24fec62d7f	initial commit — Molecule AI platform Forked clean from public hackathon repo (Starfire-AgentTeam, BSL 1.1) with full rebrand to Molecule AI under github.com/Molecule-AI/molecule-monorepo. Brand: Starfire → Molecule AI. Slug: starfire / agent-molecule → molecule. Env vars: STARFIRE_* → MOLECULE_*. Go module: github.com/agent-molecule/platform → github.com/Molecule-AI/molecule-monorepo/platform. Python packages: starfire_plugin → molecule_plugin, starfire_agent → molecule_agent. DB: agentmolecule → molecule. History truncated; see public repo for prior commits and contributor attribution. Verified green: go test -race ./... (platform), pytest (workspace-template 1129 + sdk 132), vitest (canvas 352), build (mcp). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-13 11:55:37 -07:00

Author

SHA1

Message

Date

Backend Engineer

d8c670a687

fix(security): N1 — add auth headers to all platform calls in Python callers

IMPACT WITHOUT THIS FIX: deploying PR #31 (WorkspaceAuth middleware on
/workspaces/*) without this patch causes EVERY delegation cycle to silently
break — the heartbeat poll returns 401, the self-message A2A POST returns
401, agents never wake up after task completion, and memory consolidation
stops. The entire multi-agent coordination system degrades to single-shot
interactions with no result delivery.

Changes (all using the existing platform_auth.auth_headers() pattern
already used for POST /registry/heartbeat):

heartbeat.py — 5 calls fixed:
  - GET  /workspaces/:id/delegations     (delegation poll)
  - GET  /workspaces/:id                 (self workspace info for parent lookup)
  - GET  /workspaces/{parent_id}         (parent workspace name lookup)
  - POST /workspaces/:id/a2a             (self-message to wake agent on results)
  - POST /workspaces/:id/notify          (canvas delegation result notification)
  Also moved `from platform_auth import auth_headers` from inline (per-call)
  to module-level import so _check_delegations() can use it without re-importing.

consolidation.py — 4 calls fixed:
  - GET    /workspaces/:id/memories      (fetch memories for consolidation)
  - POST   /workspaces/:id/memories      (write consolidated summary — agent path)
  - DELETE /workspaces/:id/memories/:id  (delete original memories post-consolidation)
  - POST   /workspaces/:id/memories      (write consolidated summary — fallback path)

a2a_client.py — 1 call fixed:
  - GET /workspaces/:id                  (get_workspace_info())

⚠️  DEPLOYMENT NOTE: This PR MUST be merged and deployed at the same time as
PR #31 (WorkspaceAuth middleware). Deploying #31 without this fix will
immediately break all delegation result delivery.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-14 08:37:50 +00:00

Hongming Wang

24fec62d7f

initial commit — Molecule AI platform

Forked clean from public hackathon repo (Starfire-AgentTeam, BSL 1.1)
with full rebrand to Molecule AI under github.com/Molecule-AI/molecule-monorepo.

Brand: Starfire → Molecule AI.
Slug: starfire / agent-molecule → molecule.
Env vars: STARFIRE_* → MOLECULE_*.
Go module: github.com/agent-molecule/platform → github.com/Molecule-AI/molecule-monorepo/platform.
Python packages: starfire_plugin → molecule_plugin, starfire_agent → molecule_agent.
DB: agentmolecule → molecule.

History truncated; see public repo for prior commits and contributor
attribution. Verified green: go test -race ./... (platform), pytest
(workspace-template 1129 + sdk 132), vitest (canvas 352), build (mcp).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-13 11:55:37 -07:00

2 Commits