Commit Graph

69 Commits

Author SHA1 Message Date
molecule-ai[bot]
29865bf8dc
Merge pull request #46 from Molecule-AI/fix/bare-url-in-safe-mcp-advisory
fix(docs): MDX bare URL parse error in safe-mcp-advisory.mdx
2026-04-20 21:56:23 +00:00
Molecule AI App & Docs Lead
e2979390b9 fix(docs): convert bare URLs to markdown links in safe-mcp-advisory.mdx
MDX parser (next-mdx-remote or nextra) treats bare URLs as syntax
errors. Convert 3 raw <url> references in the Normative references
section to proper markdown links.

Addresses Molecule-AI/docs issue #45.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-20 21:55:32 +00:00
molecule-ai[bot]
4af2825345
Merge pull request #41 from Molecule-AI/docs/slack-bot-api-844
docs(channels): update Slack adapter for dual-mode Bot Token / webhook
2026-04-20 08:49:33 -07:00
molecule-ai[bot]
6769630378
Merge pull request #40 from Molecule-AI/docs/opencode-mcp-bridge-800
docs(site): add OpenCode MCP Bridge integration page
2026-04-20 08:49:29 -07:00
molecule-ai[bot]
27e3c68fe3
Merge pull request #38 from Molecule-AI/docs/schedule-health-admin-671
docs(schedules): add GET /admin/schedules/health cross-org endpoint (PRs #671 #796)
2026-04-20 08:49:25 -07:00
molecule-ai[bot]
6c4630e0be
Merge pull request #37 from Molecule-AI/docs/per-workspace-token-metrics-602
docs(observability): add per-workspace token metrics section (PRs #602 #627)
2026-04-20 08:49:21 -07:00
molecule-ai[bot]
66e5ed97db
Merge pull request #36 from Molecule-AI/docs/org-plugin-governance-610
docs(plugins): add org-level plugin governance allowlist (PR #610)
2026-04-20 08:49:18 -07:00
molecule-ai[bot]
7e7461a672
Merge pull request #35 from Molecule-AI/docs/memory-inspector-738
docs(concepts): add Memory Inspector panel (canvas PR #738)
2026-04-20 08:49:15 -07:00
molecule-ai[bot]
9d6c49aa25
Merge pull request #34 from Molecule-AI/docs/hermes-native-tools-644-645
docs(hermes): native tools + structured output shipped (PRs #644 #645)
2026-04-20 08:49:12 -07:00
molecule-ai[bot]
ff5d83ecd2
Merge pull request #32 from Molecule-AI/docs/workspace-budget-limit-541
docs(concepts+api-ref): add workspace spend cap — PATCH /workspaces/:id/budget
2026-04-20 08:49:07 -07:00
molecule-ai[bot]
4b1ce68f61
Merge pull request #30 from Molecule-AI/docs/safe-mcp-advisory-2026-04-17
docs(security): SAFE-MCP advisory — Ed25519 → MCPS Tool Definition Signing, OWASP refs
2026-04-20 08:49:02 -07:00
molecule-ai[bot]
2cdf0ab764
Merge pull request #29 from Molecule-AI/docs/repo-rename-molecule-core
docs(site): update molecule-monorepo → molecule-core across all docs
2026-04-20 08:48:58 -07:00
7950730cad docs(channels): update Slack adapter for dual-mode Bot Token / webhook (#844)
PR #844 upgraded slack.go from webhook-only to dual-mode. Documents new
bot_token field, channel/username/icon_emoji config, chat:write.customize
per-agent identity, and required Slack app OAuth scopes.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-20 02:57:52 +00:00
fb4f86a42c docs(site): opencode MCP bridge integration page (#800)
Pairs with monorepo PRs #840 (opencode MCP bridge) and #842 (org-template +
integration guide). Adds opencode.mdx with prerequisites, opencode.json config,
token issuance, available tools, transport options, and SAFE-T1401/T1201
security notes. Adds ---Integrations--- nav section to meta.json.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-20 02:57:52 +00:00
02790dcef5 docs(site): opencode MCP bridge integration page (#800)
Pairs with monorepo PRs #840 (opencode MCP bridge) and #842 (org-template +
integration guide). Adds opencode.mdx with prerequisites, opencode.json config,
token issuance, available tools, transport options, and SAFE-T1401/T1201
security notes. Adds ---Integrations--- nav section to meta.json.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-20 02:56:51 +00:00
d11601a0db fix(security): update molecule-monorepo → molecule-core in SAFE-MCP advisory
Terminology fix: all references to the repo now use the correct name
molecule-core (was molecule-monorepo). No content changes beyond the
repo name update.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-19 22:03:25 +00:00
fc1ced14b9 docs(concepts+api-ref): add workspace spend cap — PATCH /workspaces/:id/budget
Pairs with molecule-core PR #611 (merged 2026-04-17). Closes #541.

- concepts.mdx: Workspace budgets section (USD cents, 402 enforcement,
  fail-open, GET+PATCH /budget)
- api-reference.mdx: Budget subsection with GET+PATCH /workspaces/:id/budget,
  full JSON shape, warn/info callouts; PATCH /workspaces/:id row notes
  budget_limit is not accepted there

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-19 12:35:30 +00:00
4341d69cd8 docs(hermes): native tools + structured output shipped (PRs #644 #645)
Mark Phase 2e as shipped — native tools=[] parameter and
response_format=json_schema now on the Anthropic native dispatch path.

- Update intro paragraph: Phase 2d is now stacked messages (#499),
  Phase 2e is tools + structured output (#644, #645)
- Replace Phase 2d roadmap callout with "remaining roadmap" (vision + streaming)
- Update capability table: native tools and response_format now  on
  Anthropic native; 📋 roadmap for Gemini native
- Add two new sections with code examples for tools=[] and response_format
- Remove "not yet shipped" language from capability table header

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-19 12:32:08 +00:00
e2702d02f2 docs(hermes): stacked system messages — system_blocks kwarg (PR #499)
- Add '## Advanced: stacked system messages' section (before Capability table)
  covering: usage, block ordering (persona → tools → reasoning), None/empty
  skip behaviour, system_blocks-vs-system_prompt precedence, backward compat note
- Update shipped capability table to include stacked system messages row and
  note PR #499 alongside Phase 2a/2b/2c

Pairs with monorepo PR #798 (feat(hermes): stacked system messages —
persona + tools + reasoning policy, PR #499).
⚠ Depends on docs PR #9 (hermes.mdx baseline) merging first.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-19 12:32:08 +00:00
2ff96935d0 docs(concepts): add Memory Inspector panel (canvas PR #738)
Document the canvas Memory Inspector panel — Side Panel → Memory tab.
Covers browse (LOCAL/TEAM scopes), semantic search via ?q= param,
and key expansion. Notes polling cadence (~15s heartbeat cycle).

Pairs with molecule-core PR #738 and builds on the semantic search
docs from origin/docs/memory-semantic-search-784.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-19 12:32:05 +00:00
451a2cca1a docs(security): add OWASP normative references to SAFE-MCP advisory
Sourced from Research Lead synthesis 2026-04-18 22:52 UTC.

Changes:
- G-02 long-term mitigation: replaced vague "Ed25519" with MCPS
  Tool Definition Signing (ECDSA P-256, schema hash pinning, rug pull
  protection, targeting MCPS L3 trust level)
- Added "Normative References" section citing:
  - MCP04:2025 — Software Supply Chain Attacks & Dependency Tampering
    (signed components, version pinning, SBOM/CBOM, dependency scanning)
  - MCP09:2025 — Shadow MCP Servers
    (central governance, discovery/scanning, baseline configs)
  - MCPS — Cryptographic Security Layer for MCP
    (tool definition signing, trust levels L0–L4)
- Annotated each remediation checklist item with the OWASP control
  that motivates it

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-19 12:31:09 +00:00
b08ca85b2e docs(security): add SAFE-MCP advisory 2026-04-17
Adds content/docs/security/ section:
- security/index.mdx — section landing page
- security/safe-mcp-advisory.mdx — three HIGH findings for self-hosted ops:
  G-01: unpinned npm MCP packages
  G-02: no manifest signing
  G-03: floating plugin references

Updates meta.json with Security nav section.

Pairs with: monorepo PRs #808, #809
Deadline: April 22, 2026

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-19 12:31:09 +00:00
a50ab173b5 docs(schedules): add GET /admin/schedules/health cross-org endpoint (PRs #671 #796)
Document the admin-only cross-org schedule health endpoint returning
last-fired, next-scheduled, consecutive-empty count, and phantom detection
status for every schedule in the org. Complements the per-workspace peer
health endpoint already documented. Pairs with molecule-core PRs #671 and
#796.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-19 12:31:05 +00:00
4b56da1108 docs(observability): add per-workspace token metrics section (PRs #602 #627)
Document GET /workspaces/:id/metrics — WorkspaceAuth-required endpoint
returning input/output/cache-read/cache-write token counts over rolling
1h and 30d windows. Notes the canvas WorkspaceUsage panel as the live
counterpart. Security context: endpoint auth hardened in PR #696.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-19 12:31:05 +00:00
55725a3806 docs(plugins): add org-level plugin governance allowlist (PR #610)
Document POST/DELETE /admin/orgs/:orgId/plugins/allowlist endpoints for
controlling which plugins workspaces in an org may load. Covers allowlist
semantics (empty = all permitted; non-empty = allowlist-only), relationship
to supply-chain pinning, and the two admin API endpoints. Adds both
endpoints to the API Reference table at the bottom of the page.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-19 12:31:05 +00:00
3096ecfb3b fix(docs): revert Docker network name to molecule-monorepo-net (confirmed in docker-compose.infra.yml L121)
molecule-core-net was incorrect — docker-compose.infra.yml and docker-compose.yml both
declare the network as molecule-monorepo-net (8+ references confirmed). Repo was renamed
to molecule-core but the network name was not changed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-19 12:14:40 +00:00
3aa6940d27 docs(site): update molecule-monorepo → molecule-core across all docs (launch fix)
Repo was renamed Molecule-AI/molecule-monorepo → Molecule-AI/molecule-core.
Updates git clone URLs, cd commands, and Docker network name references
in quickstart.mdx, self-hosting.mdx, and architecture.mdx.

Note: molecule-core-net Docker network name updated from molecule-monorepo-net —
verify docker-compose.infra.yml network name matches before merging.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-19 12:14:40 +00:00
Hongming Wang
d566b84dcc
Merge pull request #28 from Molecule-AI/docs/smolagents-security-891
docs(architecture): smolagents adapter — env sanitization and safe messaging
2026-04-19 00:52:49 -07:00
Hongming Wang
1e65effe52
Merge pull request #26 from Molecule-AI/docs/default-model-opus47-743
docs(concepts): default model updated to claude-opus-4-7 (core #743)
2026-04-19 00:52:45 -07:00
Hongming Wang
c71efcbd4d
Merge pull request #25 from Molecule-AI/docs/discord-adapter-625
docs(channels): add Discord adapter (core #656, closes #625)
2026-04-19 00:52:43 -07:00
Hongming Wang
8c07966f6d
Merge pull request #24 from Molecule-AI/docs/ag-ui-sse-601
docs(api-ref): AG-UI SSE streaming endpoint (core #601)
2026-04-19 00:52:40 -07:00
Hongming Wang
54a86a3aa1
Merge pull request #22 from Molecule-AI/docs/daily-changelog-2026-04-17
docs(site): daily changelog 2026-04-17
2026-04-19 00:52:37 -07:00
Hongming Wang
a45b3c0911
Merge pull request #19 from Molecule-AI/docs/temporal-checkpoints-797-803
docs(api-ref): Temporal workflow checkpoints — step endpoints, auto-resume behavior
2026-04-19 00:52:31 -07:00
Hongming Wang
28783fe1db
Merge pull request #18 from Molecule-AI/docs/mcp-server-security-808
docs(mcp-server): pin npm version, remove -y flag — SAFE-MCP NEW-003
2026-04-19 00:52:29 -07:00
Hongming Wang
9951c1509d
Merge pull request #17 from Molecule-AI/docs/plugin-supply-chain-775
docs(plugins): plugin supply chain security — pinned refs required, SHA-256 integrity
2026-04-19 00:52:26 -07:00
Hongming Wang
b9e1ad8566
Merge pull request #15 from Molecule-AI/docs/audit-ledger-651
docs(api-ref): molecule-audit-ledger — HMAC chain, /audit endpoint, LedgerHooks, CLI
2026-04-19 00:52:23 -07:00
Hongming Wang
6830e973ba
Merge pull request #13 from Molecule-AI/docs/molecule-medo-plugin-741
docs(plugins): add molecule-medo as opt-in platform plugin
2026-04-19 00:52:19 -07:00
Hongming Wang
018ba293ea
Merge pull request #12 from Molecule-AI/docs/canvas-features-751-759
docs(canvas): A2A topology overlay and audit trail panel
2026-04-19 00:52:16 -07:00
Hongming Wang
80f41619dd
Merge pull request #11 from Molecule-AI/docs/memory-semantic-search-784
docs(api-ref): semantic memory search via ?q= param
2026-04-19 00:52:13 -07:00
Hongming Wang
5d7b2e2528
Merge pull request #10 from Molecule-AI/docs/agents-md-autogen-763
docs(concepts): AGENTS.md auto-generation and role field
2026-04-19 00:52:10 -07:00
Hongming Wang
3b126e1892
Merge pull request #9 from Molecule-AI/docs/hermes-dispatch-513
docs(site): Hermes multi-provider dispatch page
2026-04-19 00:52:08 -07:00
Hongming Wang
3da213daed
Merge pull request #8 from Molecule-AI/docs/google-adk-quickstart-550
docs(site): add Quickstart section to Google ADK page
2026-04-19 00:52:05 -07:00
Hongming Wang
f58938eac9
Merge pull request #5 from Molecule-AI/docs/feat-opus47-effort-taskbudget
docs(site): Workspace config — Claude Opus 4.7 effort levels and task budget
2026-04-19 00:52:02 -07:00
e01eefe169 docs(architecture): smolagents adapter env sanitization + safe messaging (PR #891)
Documents the two security controls landed in workspace-template/adapters/smolagents:
- make_safe_env() strips *_API_KEY/*_TOKEN + SMOLAGENTS_ENV_DENYLIST from child process env
- safe_send_message() prefixes [smolagents], truncates at 2000 chars, HTML-escapes output

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-18 03:03:13 +00:00
e0cd330980 docs(concepts): update default model to claude-opus-4-7 (PR #743)
- google-adk.mdx: update comparison table LangGraph example from
  anthropic:claude-sonnet-4-6 → anthropic:claude-opus-4-7
- quickstart.mdx: add callout noting claude-opus-4-7 as the new
  default for workspaces that don't pin a model explicitly

Pairs with molecule-core PR #743 / closes #727.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-18 00:17:43 +00:00
c36888d6d3 docs(channels): add Discord adapter documentation (PR #656)
Documents the Discord Incoming Webhook + Interactions adapter:
- Config fields, setup steps (webhook URL + slash-command app),
  inbound interaction types (PING/APPLICATION_COMMAND/MESSAGE_COMPONENT),
  message splitting at the 2000-char limit, and a DISCORD_WEBHOOK_URL
  secret example.
- Updates title/description, Overview, Adapters count, webhook type list,
  and Example Configs sections.

Pairs with molecule-core PR #656 / closes #625.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-18 00:17:17 +00:00
22ebf81828 docs(api-ref): add AG-UI SSE streaming endpoint (PR #601)
Documents GET /workspaces/:id/events/stream — WorkspaceAuth-guarded
Server-Sent Events endpoint compatible with the AG-UI protocol.
Covers envelope format, event types, curl and JS examples.

Pairs with molecule-core PR #601 (closes #590).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-18 00:16:20 +00:00
4a275835e4 docs(site): daily changelog 2026-04-17
Customer-facing CHANGELOG page summarising 80+ merged PRs for 2026-04-17:
new features (opencode MCP bridge, Slack Bot API, AG-UI SSE, A2A topology
canvas overlay, audit trail panel, workspace hibernation, Temporal checkpoints,
semantic memory search, Hermes stacked system messages + native tools + structured
output, AGENTS.md auto-gen, Discord adapter, budget limits, token metrics, Opus 4.7
effort/task_budget, plugin supply-chain hardening, Fly Machines provisioner),
security fixes, and docs PR cross-references.

Adds changelog.mdx and nav entry at top of meta.json pages array.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-17 23:37:34 +00:00
1c8e103b4c docs(api-ref): Temporal workflow checkpoints — persist/resume, step endpoints (PRs #797+#803)
Add '## Workflow Checkpoints' section to api-reference.mdx:
- POST /workspaces/:id/checkpoints — upsert step checkpoint (ON CONFLICT safe)
- GET /workspaces/:id/checkpoints/:wfid — list checkpoints by workflow ID
- DELETE /workspaces/:id/checkpoints/:wfid — clear on clean completion
- Callout explaining automatic resume behavior (runtime: langgraph only):
  checkpoint I/O is non-fatal, resume skips already-completed stages
- Step names/indices table (task_receive=0, llm_call=1, task_complete=2)

Pairs with monorepo PR #797 (persistence layer) + PR #803 (workspace-template
auto-save/resume). Section placed after Activity, before Schedules.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-17 19:02:44 +00:00
06651d5d3e docs(mcp-server): pin npm package version, remove -y flag (SAFE-MCP NEW-003)
- Quick start install example: add @1.0.0 version pin
- .mcp.json Configure example: pin to @1.0.0, remove -y auto-accept flag
- Add Callout warning explaining why pinning is required (unpinned + -y =
  arbitrary code execution on package compromise) with link to npm page
- Troubleshooting: update standalone run example to use pinned version

Addresses SAFE-MCP finding NEW-003 (HIGH) from SAFE-MCP audit (PR #808).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-17 19:01:43 +00:00