molecule-core/platform
molecule-ai[bot] d08f237de9
fix(platform): reject self-delegation to prevent _run_lock deadlock (#570)
When a workspace delegated a task to itself, it would acquire
_run_lock twice on the same goroutine mutex, blocking permanently.

Add an early-return guard in `DelegationHandler.Delegate` that
returns HTTP 400 {"error": "self-delegation not permitted"} as soon
as sourceID == body.TargetID, before any DB or A2A work is done.

Adds TestDelegate_SelfDelegation_Rejected to delegation_test.go.

Closes #548

Co-authored-by: Molecule AI Backend Engineer <backend-engineer@agents.moleculesai.app>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-17 00:46:20 +00:00
..
cmd/server feat(platform): wire github-app-auth plugin for per-installation tokens 2026-04-16 12:52:20 -07:00
internal fix(platform): reject self-delegation to prevent _run_lock deadlock (#570) 2026-04-17 00:46:20 +00:00
migrations feat(channels): Lark / Feishu adapter (outbound webhook + Events API inbound) 2026-04-16 07:10:58 -07:00
pkg/provisionhook feat(platform): provision-time env mutator hook for plugins 2026-04-16 06:47:09 -07:00
Dockerfile fix: address all code review findings + remove exposed secrets 2026-04-16 05:05:49 -07:00
Dockerfile.tenant fix: address all code review findings + remove exposed secrets 2026-04-16 05:05:49 -07:00
entrypoint-tenant.sh feat(platform): auto-detect SaaS tenant → control plane provisioner 2026-04-16 11:50:52 -07:00
go.mod feat(platform): wire github-app-auth plugin for per-installation tokens 2026-04-16 12:52:20 -07:00
go.sum feat(platform): wire github-app-auth plugin for per-installation tokens 2026-04-16 12:52:20 -07:00