From 7c1ac608d32b3ccb569f5b395a9f23be6d7bab2f Mon Sep 17 00:00:00 2001 From: devops-engineer Date: Thu, 7 May 2026 13:04:27 -0700 Subject: [PATCH] fix(post-suspension): migrate github.com/Molecule-AI refs to git.moleculesai.app (Class G #168) The GitHub org Molecule-AI was suspended on 2026-05-06; canonical SCM is now Gitea at https://git.moleculesai.app/molecule-ai/. Stale github.com/Molecule-AI/... URLs return 404 and break tooling that clones / pip-installs / curls them. This bundles all non-Go-module URL fixes for this repo into a single PR. Go module path references (in *.go, go.mod, go.sum) are out of scope here -- tracked separately under Task #140. Token-auth clone URLs also flip ${GITHUB_TOKEN} -> ${GITEA_TOKEN} since the GitHub token does not auth against Gitea. Co-Authored-By: Claude Opus 4.7 (1M context) --- .../guides/external-workspace-quickstart.md | 6 +++--- content/docs/guides/mcp-server-setup.md | 2 +- .../docs/guides/molecli-shell-completion.md | 2 +- content/docs/incidents/INCIDENT_LOG.md | 6 +++--- content/docs/plugins/agentskills-compat.md | 10 +++++----- content/docs/security/changelog.md | 18 +++++++++--------- .../docs/tutorials/fly-machines-provisioner.md | 6 +++--- content/docs/tutorials/gemini-cli-runtime.md | 2 +- content/docs/tutorials/google-adk-runtime.md | 2 +- .../hermes-multi-provider-dispatch.md | 8 ++++---- content/docs/tutorials/lark-feishu-channel.md | 2 +- content/docs/tutorials/saas-federation.md | 2 +- content/docs/tutorials/saas-file-writes-eic.md | 2 +- 13 files changed, 34 insertions(+), 34 deletions(-) diff --git a/content/docs/guides/external-workspace-quickstart.md b/content/docs/guides/external-workspace-quickstart.md index b7ee691..25331ae 100644 --- a/content/docs/guides/external-workspace-quickstart.md +++ b/content/docs/guides/external-workspace-quickstart.md @@ -158,7 +158,7 @@ The `id` field is your workspace ID — remember it. |---|---| | "Failed to send message — agent may be unreachable" | The tenant couldn't POST to your URL. Verify `curl https:///health` returns 200 from another machine. | | Response takes > 30s | Canvas times out around 30s. Keep initial implementations simple. For long-running work, return a placeholder and use [polling mode](#next-step-polling-mode-preview) (once available). | -| Agent duplicated in chat | Known canvas bug where WebSocket + HTTP responses both render. Fixed in [molecule-core #1517](https://github.com/Molecule-AI/molecule-core/pull/1517). | +| Agent duplicated in chat | Known canvas bug where WebSocket + HTTP responses both render. Fixed in [molecule-core #1517](https://git.moleculesai.app/molecule-ai/molecule-core/pull/1517). | | Agent replies but canvas shows "Agent unreachable" | Check the tenant can reach your URL. Cloudflare quick tunnels rotate — the URL in your canvas may point at a dead tunnel after restart. | | Getting 404 when POSTing to tenant | Add `X-Molecule-Org-Id` header. The tenant's security layer 404s unmatched origin requests by design. | @@ -260,11 +260,11 @@ If all four pass and canvas still shows your agent as unreachable, see the [remo ## Feedback This is a new path. Tell us what broke: -- Open an issue: https://github.com/Molecule-AI/molecule-core/issues/new?labels=external-workspace +- Open an issue: https://git.moleculesai.app/molecule-ai/molecule-core/issues/new?labels=external-workspace - Submit a PR improving this doc if something tripped you up — the faster we can make the quickstart, the more developers we bring in --- *Last updated 2026-04-23* -(`molecule-core` [#1760](https://github.com/Molecule-AI/molecule-core/pull/1760)) \ No newline at end of file +(`molecule-core` [#1760](https://git.moleculesai.app/molecule-ai/molecule-core/pull/1760)) \ No newline at end of file diff --git a/content/docs/guides/mcp-server-setup.md b/content/docs/guides/mcp-server-setup.md index 215304b..a953d78 100644 --- a/content/docs/guides/mcp-server-setup.md +++ b/content/docs/guides/mcp-server-setup.md @@ -78,7 +78,7 @@ Every log entry automatically includes MCP request context (tool name, request I Set `LOG_LEVEL=debug` (level 20) to trace all tool calls and request IDs. Set `LOG_LEVEL=error` (level 50) in CI to suppress informational output. -See [`molecule-mcp-server` PR #6](https://github.com/Molecule-AI/molecule-mcp-server/pull/6) for implementation details. +See [`molecule-mcp-server` PR #6](https://git.moleculesai.app/molecule-ai/molecule-mcp-server/pull/6) for implementation details. ## Tool Reference diff --git a/content/docs/guides/molecli-shell-completion.md b/content/docs/guides/molecli-shell-completion.md index 34037fb..a60ab6b 100644 --- a/content/docs/guides/molecli-shell-completion.md +++ b/content/docs/guides/molecli-shell-completion.md @@ -90,4 +90,4 @@ molecule completion [bash|zsh|fish|powershell] - `fish` — Fish shell completions (~/.config/fish/completions) - `powershell` — PowerShell completions ($PROFILE) -See [`molecule-cli` PR #5](https://github.com/Molecule-AI/molecule-cli/pull/5) for implementation details. +See [`molecule-cli` PR #5](https://git.moleculesai.app/molecule-ai/molecule-cli/pull/5) for implementation details. diff --git a/content/docs/incidents/INCIDENT_LOG.md b/content/docs/incidents/INCIDENT_LOG.md index 9ef0cd9..8f43bd1 100644 --- a/content/docs/incidents/INCIDENT_LOG.md +++ b/content/docs/incidents/INCIDENT_LOG.md @@ -165,14 +165,14 @@ ticket if a future revival of this BFG procedure is needed. **Step 2 — Clean origin/main:** ```bash -git clone --mirror https://github.com/Molecule-AI/molecule-core /tmp/molecule-main-mirror +git clone --mirror https://git.moleculesai.app/molecule-ai/molecule-core /tmp/molecule-main-mirror java -jar bfgr.jar --replace-text creds.txt --rewrite-not-committed-by-oss --no-blob-protection /tmp/molecule-main-mirror cd /tmp/molecule-main-mirror && git push --mirror ``` **Step 3 — Clean origin/staging:** ```bash -git clone --mirror https://github.com/Molecule-AI/molecule-core /tmp/molecule-staging-mirror +git clone --mirror https://git.moleculesai.app/molecule-ai/molecule-core /tmp/molecule-staging-mirror java -jar bfgr.jar --replace-text creds.txt --rewrite-not-committed-by-oss --no-blob-protection /tmp/molecule-staging-mirror cd /tmp/molecule-staging-mirror && git push --mirror ``` @@ -584,7 +584,7 @@ Core-BE — delegated to Dev Lead (A2A failed). Core-BE sub-team: please pick up ### Fix PR -[PR #1336](https://github.com/Molecule-AI/molecule-core/pull/1336) filed — `fix(orchestrator): fail-fast if WORKSPACE_ID env var is unset/empty`. Targets staging. Labels: bug, needs-work, area:backend-engineer, area:dev-lead. +[PR #1336](https://git.moleculesai.app/molecule-ai/molecule-core/pull/1336) filed — `fix(orchestrator): fail-fast if WORKSPACE_ID env var is unset/empty`. Targets staging. Labels: bug, needs-work, area:backend-engineer, area:dev-lead. --- diff --git a/content/docs/plugins/agentskills-compat.md b/content/docs/plugins/agentskills-compat.md index 486bb4a..d72a0c0 100644 --- a/content/docs/plugins/agentskills-compat.md +++ b/content/docs/plugins/agentskills-compat.md @@ -163,11 +163,11 @@ not expose. | `molecule-skill-update-docs` | `[claude_code]` | `[claude_code, hermes]` | Companion PRs: -- [molecule-ai-plugin-ecc#2](https://github.com/Molecule-AI/molecule-ai-plugin-ecc/pull/2) -- [molecule-ai-plugin-superpowers#2](https://github.com/Molecule-AI/molecule-ai-plugin-superpowers/pull/2) -- [molecule-ai-plugin-molecule-dev#2](https://github.com/Molecule-AI/molecule-ai-plugin-molecule-dev/pull/2) -- [molecule-ai-plugin-molecule-skill-cron-learnings#2](https://github.com/Molecule-AI/molecule-ai-plugin-molecule-skill-cron-learnings/pull/2) -- [molecule-ai-plugin-molecule-skill-update-docs#2](https://github.com/Molecule-AI/molecule-ai-plugin-molecule-skill-update-docs/pull/2) +- [molecule-ai-plugin-ecc#2](https://git.moleculesai.app/molecule-ai/molecule-ai-plugin-ecc/pull/2) +- [molecule-ai-plugin-superpowers#2](https://git.moleculesai.app/molecule-ai/molecule-ai-plugin-superpowers/pull/2) +- [molecule-ai-plugin-molecule-dev#2](https://git.moleculesai.app/molecule-ai/molecule-ai-plugin-molecule-dev/pull/2) +- [molecule-ai-plugin-molecule-skill-cron-learnings#2](https://git.moleculesai.app/molecule-ai/molecule-ai-plugin-molecule-skill-cron-learnings/pull/2) +- [molecule-ai-plugin-molecule-skill-update-docs#2](https://git.moleculesai.app/molecule-ai/molecule-ai-plugin-molecule-skill-update-docs/pull/2) Security note: Security Auditor was offline at time of change. Self-assessed as non-security-impacting — adding `hermes` to a string list in `plugin.yaml` diff --git a/content/docs/security/changelog.md b/content/docs/security/changelog.md index bb50b86..e3d6990 100644 --- a/content/docs/security/changelog.md +++ b/content/docs/security/changelog.md @@ -12,7 +12,7 @@ This page documents security fixes shipped in the Molecule AI platform. Each ent ## 2026-04-20 — CWE-22: Path Traversal in `copyFilesToContainer` **Severity:** High (CWE-22) -**PRs:** [#1271](https://github.com/Molecule-AI/molecule-core/pull/1271), [#1270](https://github.com/Molecule-AI/molecule-core/pull/1270), [#1267](https://github.com/Molecule-AI/molecule-core/pull/1267) +**PRs:** [#1271](https://git.moleculesai.app/molecule-ai/molecule-core/pull/1271), [#1270](https://git.moleculesai.app/molecule-ai/molecule-core/pull/1270), [#1267](https://git.moleculesai.app/molecule-ai/molecule-core/pull/1267) **Affected:** `workspace-server/internal/handlers/container_files.go` — `TemplatesHandler.copyFilesToContainer` ### Vulnerability @@ -37,7 +37,7 @@ File writes to workspace containers now validate all paths before writing to the ## 2026-04-20 — CWE-78: Shell Injection in `deleteViaEphemeral` **Severity:** High (CWE-78) -**PR:** [#1310](https://github.com/Molecule-AI/molecule-core/pull/1310) +**PR:** [#1310](https://git.moleculesai.app/molecule-ai/molecule-core/pull/1310) **Affected:** `workspace-server/internal/handlers/container_files.go` — `TemplatesHandler.deleteViaEphemeral` ### Vulnerability @@ -69,9 +69,9 @@ Workspace file deletion operations now use safe argument-passing and validate al ## 2026-04-21 — CWE-918: SSRF in MCP / A2A Proxy Endpoints (Updated: Regression Fix) **Severity:** High (CWE-918) -**Original PRs:** [#1274](https://github.com/Molecule-AI/molecule-core/pull/1274), [#1302](https://github.com/Molecule-AI/molecule-core/pull/1302) -**Regression Fix PR:** [#1430](https://github.com/Molecule-AI/molecule-core/pull/1430) -**Regression introduced by:** [#1363](https://github.com/Molecule-AI/molecule-core/pull/1363) +**Original PRs:** [#1274](https://git.moleculesai.app/molecule-ai/molecule-core/pull/1274), [#1302](https://git.moleculesai.app/molecule-ai/molecule-core/pull/1302) +**Regression Fix PR:** [#1430](https://git.moleculesai.app/molecule-ai/molecule-core/pull/1430) +**Regression introduced by:** [#1363](https://git.moleculesai.app/molecule-ai/molecule-core/pull/1363) **Affected:** `workspace-server/internal/handlers/mcp.go` — `isSafeURL`, `isPrivateOrMetadataIP`; `workspace-server/internal/handlers/a2a_proxy.go`; `workspace-server/internal/handlers/a2a_proxy_helpers.go` ### Vulnerability @@ -105,9 +105,9 @@ In **SaaS mode** (`saasMode()` returns true), cross-EC2 traffic to RFC-1918 addr ### Regression (2026-04-21) -PR [#1363](https://github.com/Molecule-AI/molecule-core/pull/1363) (handler refactor) moved `isPrivateOrMetadataIP` into `a2a_proxy_helpers.go` but kept a **pre-SaaS version** that unconditionally blocked RFC-1918 addresses, breaking cross-EC2 communication in SaaS. The old version also **returned `false` for all IPv6 inputs**, fully bypassing SSRF protection for IPv6 targets. +PR [#1363](https://git.moleculesai.app/molecule-ai/molecule-core/pull/1363) (handler refactor) moved `isPrivateOrMetadataIP` into `a2a_proxy_helpers.go` but kept a **pre-SaaS version** that unconditionally blocked RFC-1918 addresses, breaking cross-EC2 communication in SaaS. The old version also **returned `false` for all IPv6 inputs**, fully bypassing SSRF protection for IPv6 targets. -PR [#1430](https://github.com/Molecule-AI/molecule-core/pull/1430) restores the correct SaaS-gated logic and adds proper IPv6 coverage to the A2A proxy path. +PR [#1430](https://git.moleculesai.app/molecule-ai/molecule-core/pull/1430) restores the correct SaaS-gated logic and adds proper IPv6 coverage to the A2A proxy path. ### User-facing summary @@ -118,7 +118,7 @@ Platform outbound requests from workspaces (MCP tool calls, A2A proxy routing) v ## 2026-04-21 — Audit Ledger HMAC Chain Guard **Severity:** Low (denial-of-service / data integrity) -**PRs:** [#1339](https://github.com/Molecule-AI/molecule-core/pull/1339), [#1352](https://github.com/Molecule-AI/molecule-core/pull/1352), [#1354](https://github.com/Molecule-AI/molecule-core/pull/1354) (backport to `main`) +**PRs:** [#1339](https://git.moleculesai.app/molecule-ai/molecule-core/pull/1339), [#1352](https://git.moleculesai.app/molecule-ai/molecule-core/pull/1352), [#1354](https://git.moleculesai.app/molecule-ai/molecule-core/pull/1354) (backport to `main`) **Affected:** `workspace-server/internal/handlers/audit.go` ### Vulnerability @@ -144,7 +144,7 @@ Audit chain verification now handles short or malformed HMAC values gracefully, ## 2026-04-21 — Credential Scrub: `err.Error()` Leak Prevention **Severity:** Medium (information disclosure) -**PRs:** [#1282](https://github.com/Molecule-AI/molecule-core/pull/1282), [#1355](https://github.com/Molecule-AI/molecule-core/pull/1355), [#1359](https://github.com/Molecule-AI/molecule-core/pull/1359) +**PRs:** [#1282](https://git.moleculesai.app/molecule-ai/molecule-core/pull/1282), [#1355](https://git.moleculesai.app/molecule-ai/molecule-core/pull/1355), [#1359](https://git.moleculesai.app/molecule-ai/molecule-core/pull/1359) **Affected:** `workspace-server/internal/handlers/plugins_install_pipeline.go`, `workspace-server/internal/handlers/workspace_provision.go`, `content/docs/incidents/INCIDENT_LOG.md` ### Vulnerability diff --git a/content/docs/tutorials/fly-machines-provisioner.md b/content/docs/tutorials/fly-machines-provisioner.md index 9d1acab..b2ea297 100644 --- a/content/docs/tutorials/fly-machines-provisioner.md +++ b/content/docs/tutorials/fly-machines-provisioner.md @@ -88,8 +88,8 @@ Fly Machines start in milliseconds and run in 35+ regions. Provisioning agent wo ## Related -- PR #501: [feat(platform): Fly Machines provisioner](https://github.com/Molecule-AI/molecule-core/pull/501) -- PR #481: [feat(ci): deploy to Fly after image push](https://github.com/Molecule-AI/molecule-core/pull/481) +- PR #501: [feat(platform): Fly Machines provisioner](https://git.moleculesai.app/molecule-ai/molecule-core/pull/501) +- PR #481: [feat(ci): deploy to Fly after image push](https://git.moleculesai.app/molecule-ai/molecule-core/pull/481) - [Fly Machines API docs](https://fly.io/docs/machines/api/) - [Platform API reference](../api-reference.md) -- Issue [#525](https://github.com/Molecule-AI/molecule-core/issues/525) +- Issue [#525](https://git.moleculesai.app/molecule-ai/molecule-core/issues/525) diff --git a/content/docs/tutorials/gemini-cli-runtime.md b/content/docs/tutorials/gemini-cli-runtime.md index a0d75e1..8397e92 100644 --- a/content/docs/tutorials/gemini-cli-runtime.md +++ b/content/docs/tutorials/gemini-cli-runtime.md @@ -64,6 +64,6 @@ The real power surfaces when you mix runtimes on the same Molecule AI tenant. Yo ## Related -- PR #379: [feat(adapters): add gemini-cli runtime adapter](https://github.com/Molecule-AI/molecule-core/pull/379) +- PR #379: [feat(adapters): add gemini-cli runtime adapter](https://git.moleculesai.app/molecule-ai/molecule-core/pull/379) - [Multi-provider Hermes docs](../architecture/hermes.md) - [Workspace runtimes reference](../reference/runtimes.md) diff --git a/content/docs/tutorials/google-adk-runtime.md b/content/docs/tutorials/google-adk-runtime.md index 83e29c3..04abcc5 100644 --- a/content/docs/tutorials/google-adk-runtime.md +++ b/content/docs/tutorials/google-adk-runtime.md @@ -71,7 +71,7 @@ ADK workspaces participate in the same A2A network as Claude Code, Gemini CLI, H ## Related -- PR #550: [feat(adapters): add google-adk runtime adapter](https://github.com/Molecule-AI/molecule-core/pull/550) +- PR #550: [feat(adapters): add google-adk runtime adapter](https://git.moleculesai.app/molecule-ai/molecule-core/pull/550) - [Google ADK (adk-python)](https://github.com/google/adk-python) - [Gemini CLI runtime tutorial](./gemini-cli-runtime.md) - [Platform API reference](../api-reference.md) diff --git a/content/docs/tutorials/hermes-multi-provider-dispatch.md b/content/docs/tutorials/hermes-multi-provider-dispatch.md index 28511ce..05ad897 100644 --- a/content/docs/tutorials/hermes-multi-provider-dispatch.md +++ b/content/docs/tutorials/hermes-multi-provider-dispatch.md @@ -179,9 +179,9 @@ What is on the roadmap for Phase 2d (not yet shipped): ## Related -- PR #240: [Phase 2a — native Anthropic dispatch](https://github.com/Molecule-AI/molecule-core/pull/240) -- PR #255: [Phase 2b — native Gemini dispatch](https://github.com/Molecule-AI/molecule-core/pull/255) -- PR #267: [Phase 2c — multi-turn history on all paths](https://github.com/Molecule-AI/molecule-core/pull/267) +- PR #240: [Phase 2a — native Anthropic dispatch](https://git.moleculesai.app/molecule-ai/molecule-core/pull/240) +- PR #255: [Phase 2b — native Gemini dispatch](https://git.moleculesai.app/molecule-ai/molecule-core/pull/255) +- PR #267: [Phase 2c — multi-turn history on all paths](https://git.moleculesai.app/molecule-ai/molecule-core/pull/267) - [Hermes adapter design](../adapters/hermes-adapter-design.md) - [Platform API reference](../api-reference.md) -- Issue [#513](https://github.com/Molecule-AI/molecule-core/issues/513) +- Issue [#513](https://git.moleculesai.app/molecule-ai/molecule-core/issues/513) diff --git a/content/docs/tutorials/lark-feishu-channel.md b/content/docs/tutorials/lark-feishu-channel.md index b7dc65b..7c8cd51 100644 --- a/content/docs/tutorials/lark-feishu-channel.md +++ b/content/docs/tutorials/lark-feishu-channel.md @@ -93,6 +93,6 @@ Molecule AI canvas without code changes. ## Related -- PR #480: [feat(channels): Lark / Feishu channel adapter](https://github.com/Molecule-AI/molecule-core/pull/480) +- PR #480: [feat(channels): Lark / Feishu channel adapter](https://git.moleculesai.app/molecule-ai/molecule-core/pull/480) - [Social channels architecture](../agent-runtime/social-channels.md) - [Channel adapter reference](../api-reference.md#channels) \ No newline at end of file diff --git a/content/docs/tutorials/saas-federation.md b/content/docs/tutorials/saas-federation.md index 26ab6e7..ee312be 100644 --- a/content/docs/tutorials/saas-federation.md +++ b/content/docs/tutorials/saas-federation.md @@ -246,4 +246,4 @@ For the API reference, see [`docs/api-reference`](/docs/api-reference) — the ` *SaaS federation is available for all Molecule AI platform operators. Contact the Molecule AI team to enable federation on your control plane.* -(`molecule-core` [#1700](https://github.com/Molecule-AI/molecule-core/pull/1700)) \ No newline at end of file +(`molecule-core` [#1700](https://git.moleculesai.app/molecule-ai/molecule-core/pull/1700)) \ No newline at end of file diff --git a/content/docs/tutorials/saas-file-writes-eic.md b/content/docs/tutorials/saas-file-writes-eic.md index b904567..95c8fd6 100644 --- a/content/docs/tutorials/saas-file-writes-eic.md +++ b/content/docs/tutorials/saas-file-writes-eic.md @@ -145,7 +145,7 @@ Key push + tunnel + write took longer than 30 s. Common causes: slow AWS EIC in ## Source PR -PR [#1702](https://github.com/Molecule-AI/molecule-core/pull/1702) — `feat(files-api): SSH-backed write for SaaS workspaces (fixes 500 docker not available)` +PR [#1702](https://git.moleculesai.app/molecule-ai/molecule-core/pull/1702) — `feat(files-api): SSH-backed write for SaaS workspaces (fixes 500 docker not available)` Key files in `molecule-core`: - `workspace-server/internal/handlers/template_files_eic.go` — EIC write logic