Molecule AI CP-BE 4034f0dc55 fix(middleware): add missing return after AbortWithStatusJSON in CanvasOrBearer ... P0 security: CanvasOrBearer final else branch aborts with 401 but continues execution to c.Next() — allowing the downstream handler to overwrite the 401 response. Regression tests added to verify the handler is not called after AbortWithStatusJSON in both no-cred and wrong-origin paths. Confirmed on origin/main @ 69408ab6 and origin/staging @ 6b62391e. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>		2026-04-24 18:04:13 +00:00
..
cmd/server	fix(go): replace $1 literal with resp.Body.Close() in 7 files (#1247)	2026-04-21 03:18:21 +00:00
internal	fix(middleware): add missing return after AbortWithStatusJSON in CanvasOrBearer	2026-04-24 18:04:13 +00:00
migrations	feat(a2a): queue-on-busy — Phase 1 of priority queue (#1870)	2026-04-23 14:09:29 -07:00
pkg/provisionhook	fix(docker): fix plugin go.mod replace for TokenProvider interface (#960)	2026-04-20 13:42:53 -07:00
.ci-force	chore: force Platform(Go) CI run on main — validate go vet clean	2026-04-21 15:43:19 +00:00
.gitignore	feat(ws-server): pull env from CP on startup	2026-04-19 02:41:15 -07:00
.golangci.yaml	chore(workspace-server): add golangci.yaml disabling errcheck	2026-04-24 07:16:54 +00:00
Dockerfile	chore: extract ContextMenu Zustand fix + a2a_proxy local-docker SSRF bypass + workspace-server Dockerfile GID entrypoint	2026-04-22 20:00:16 -07:00
Dockerfile.tenant	feat(terminal): remote path via aws ec2-instance-connect + pty	2026-04-21 18:13:29 -07:00
entrypoint-tenant.sh	fix(security): add USER directive before ENTRYPOINT in all tenant images (#1155)	2026-04-20 23:51:33 +00:00
go.mod	fix(#1933): bump molecule-ai-plugin-github-app-auth to current main (step 1)	2026-04-23 18:53:25 -07:00
go.sum	fix(#1933): bump molecule-ai-plugin-github-app-auth to current main (step 1)	2026-04-23 18:53:25 -07:00