Commit Graph

54 Commits

Author SHA1 Message Date
molecule-ai[bot]
9d6c49aa25
Merge pull request #34 from Molecule-AI/docs/hermes-native-tools-644-645
docs(hermes): native tools + structured output shipped (PRs #644 #645)
2026-04-20 08:49:12 -07:00
molecule-ai[bot]
ff5d83ecd2
Merge pull request #32 from Molecule-AI/docs/workspace-budget-limit-541
docs(concepts+api-ref): add workspace spend cap — PATCH /workspaces/:id/budget
2026-04-20 08:49:07 -07:00
molecule-ai[bot]
4b1ce68f61
Merge pull request #30 from Molecule-AI/docs/safe-mcp-advisory-2026-04-17
docs(security): SAFE-MCP advisory — Ed25519 → MCPS Tool Definition Signing, OWASP refs
2026-04-20 08:49:02 -07:00
molecule-ai[bot]
2cdf0ab764
Merge pull request #29 from Molecule-AI/docs/repo-rename-molecule-core
docs(site): update molecule-monorepo → molecule-core across all docs
2026-04-20 08:48:58 -07:00
d11601a0db fix(security): update molecule-monorepo → molecule-core in SAFE-MCP advisory
Terminology fix: all references to the repo now use the correct name
molecule-core (was molecule-monorepo). No content changes beyond the
repo name update.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-19 22:03:25 +00:00
fc1ced14b9 docs(concepts+api-ref): add workspace spend cap — PATCH /workspaces/:id/budget
Pairs with molecule-core PR #611 (merged 2026-04-17). Closes #541.

- concepts.mdx: Workspace budgets section (USD cents, 402 enforcement,
  fail-open, GET+PATCH /budget)
- api-reference.mdx: Budget subsection with GET+PATCH /workspaces/:id/budget,
  full JSON shape, warn/info callouts; PATCH /workspaces/:id row notes
  budget_limit is not accepted there

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-19 12:35:30 +00:00
4341d69cd8 docs(hermes): native tools + structured output shipped (PRs #644 #645)
Mark Phase 2e as shipped — native tools=[] parameter and
response_format=json_schema now on the Anthropic native dispatch path.

- Update intro paragraph: Phase 2d is now stacked messages (#499),
  Phase 2e is tools + structured output (#644, #645)
- Replace Phase 2d roadmap callout with "remaining roadmap" (vision + streaming)
- Update capability table: native tools and response_format now  on
  Anthropic native; 📋 roadmap for Gemini native
- Add two new sections with code examples for tools=[] and response_format
- Remove "not yet shipped" language from capability table header

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-19 12:32:08 +00:00
e2702d02f2 docs(hermes): stacked system messages — system_blocks kwarg (PR #499)
- Add '## Advanced: stacked system messages' section (before Capability table)
  covering: usage, block ordering (persona → tools → reasoning), None/empty
  skip behaviour, system_blocks-vs-system_prompt precedence, backward compat note
- Update shipped capability table to include stacked system messages row and
  note PR #499 alongside Phase 2a/2b/2c

Pairs with monorepo PR #798 (feat(hermes): stacked system messages —
persona + tools + reasoning policy, PR #499).
⚠ Depends on docs PR #9 (hermes.mdx baseline) merging first.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-19 12:32:08 +00:00
451a2cca1a docs(security): add OWASP normative references to SAFE-MCP advisory
Sourced from Research Lead synthesis 2026-04-18 22:52 UTC.

Changes:
- G-02 long-term mitigation: replaced vague "Ed25519" with MCPS
  Tool Definition Signing (ECDSA P-256, schema hash pinning, rug pull
  protection, targeting MCPS L3 trust level)
- Added "Normative References" section citing:
  - MCP04:2025 — Software Supply Chain Attacks & Dependency Tampering
    (signed components, version pinning, SBOM/CBOM, dependency scanning)
  - MCP09:2025 — Shadow MCP Servers
    (central governance, discovery/scanning, baseline configs)
  - MCPS — Cryptographic Security Layer for MCP
    (tool definition signing, trust levels L0–L4)
- Annotated each remediation checklist item with the OWASP control
  that motivates it

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-19 12:31:09 +00:00
b08ca85b2e docs(security): add SAFE-MCP advisory 2026-04-17
Adds content/docs/security/ section:
- security/index.mdx — section landing page
- security/safe-mcp-advisory.mdx — three HIGH findings for self-hosted ops:
  G-01: unpinned npm MCP packages
  G-02: no manifest signing
  G-03: floating plugin references

Updates meta.json with Security nav section.

Pairs with: monorepo PRs #808, #809
Deadline: April 22, 2026

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-19 12:31:09 +00:00
3096ecfb3b fix(docs): revert Docker network name to molecule-monorepo-net (confirmed in docker-compose.infra.yml L121)
molecule-core-net was incorrect — docker-compose.infra.yml and docker-compose.yml both
declare the network as molecule-monorepo-net (8+ references confirmed). Repo was renamed
to molecule-core but the network name was not changed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-19 12:14:40 +00:00
3aa6940d27 docs(site): update molecule-monorepo → molecule-core across all docs (launch fix)
Repo was renamed Molecule-AI/molecule-monorepo → Molecule-AI/molecule-core.
Updates git clone URLs, cd commands, and Docker network name references
in quickstart.mdx, self-hosting.mdx, and architecture.mdx.

Note: molecule-core-net Docker network name updated from molecule-monorepo-net —
verify docker-compose.infra.yml network name matches before merging.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-19 12:14:40 +00:00
Hongming Wang
d566b84dcc
Merge pull request #28 from Molecule-AI/docs/smolagents-security-891
docs(architecture): smolagents adapter — env sanitization and safe messaging
2026-04-19 00:52:49 -07:00
Hongming Wang
1e65effe52
Merge pull request #26 from Molecule-AI/docs/default-model-opus47-743
docs(concepts): default model updated to claude-opus-4-7 (core #743)
2026-04-19 00:52:45 -07:00
Hongming Wang
c71efcbd4d
Merge pull request #25 from Molecule-AI/docs/discord-adapter-625
docs(channels): add Discord adapter (core #656, closes #625)
2026-04-19 00:52:43 -07:00
Hongming Wang
8c07966f6d
Merge pull request #24 from Molecule-AI/docs/ag-ui-sse-601
docs(api-ref): AG-UI SSE streaming endpoint (core #601)
2026-04-19 00:52:40 -07:00
Hongming Wang
54a86a3aa1
Merge pull request #22 from Molecule-AI/docs/daily-changelog-2026-04-17
docs(site): daily changelog 2026-04-17
2026-04-19 00:52:37 -07:00
Hongming Wang
a45b3c0911
Merge pull request #19 from Molecule-AI/docs/temporal-checkpoints-797-803
docs(api-ref): Temporal workflow checkpoints — step endpoints, auto-resume behavior
2026-04-19 00:52:31 -07:00
Hongming Wang
28783fe1db
Merge pull request #18 from Molecule-AI/docs/mcp-server-security-808
docs(mcp-server): pin npm version, remove -y flag — SAFE-MCP NEW-003
2026-04-19 00:52:29 -07:00
Hongming Wang
9951c1509d
Merge pull request #17 from Molecule-AI/docs/plugin-supply-chain-775
docs(plugins): plugin supply chain security — pinned refs required, SHA-256 integrity
2026-04-19 00:52:26 -07:00
Hongming Wang
b9e1ad8566
Merge pull request #15 from Molecule-AI/docs/audit-ledger-651
docs(api-ref): molecule-audit-ledger — HMAC chain, /audit endpoint, LedgerHooks, CLI
2026-04-19 00:52:23 -07:00
Hongming Wang
6830e973ba
Merge pull request #13 from Molecule-AI/docs/molecule-medo-plugin-741
docs(plugins): add molecule-medo as opt-in platform plugin
2026-04-19 00:52:19 -07:00
Hongming Wang
018ba293ea
Merge pull request #12 from Molecule-AI/docs/canvas-features-751-759
docs(canvas): A2A topology overlay and audit trail panel
2026-04-19 00:52:16 -07:00
Hongming Wang
80f41619dd
Merge pull request #11 from Molecule-AI/docs/memory-semantic-search-784
docs(api-ref): semantic memory search via ?q= param
2026-04-19 00:52:13 -07:00
Hongming Wang
5d7b2e2528
Merge pull request #10 from Molecule-AI/docs/agents-md-autogen-763
docs(concepts): AGENTS.md auto-generation and role field
2026-04-19 00:52:10 -07:00
Hongming Wang
3b126e1892
Merge pull request #9 from Molecule-AI/docs/hermes-dispatch-513
docs(site): Hermes multi-provider dispatch page
2026-04-19 00:52:08 -07:00
Hongming Wang
3da213daed
Merge pull request #8 from Molecule-AI/docs/google-adk-quickstart-550
docs(site): add Quickstart section to Google ADK page
2026-04-19 00:52:05 -07:00
Hongming Wang
f58938eac9
Merge pull request #5 from Molecule-AI/docs/feat-opus47-effort-taskbudget
docs(site): Workspace config — Claude Opus 4.7 effort levels and task budget
2026-04-19 00:52:02 -07:00
e01eefe169 docs(architecture): smolagents adapter env sanitization + safe messaging (PR #891)
Documents the two security controls landed in workspace-template/adapters/smolagents:
- make_safe_env() strips *_API_KEY/*_TOKEN + SMOLAGENTS_ENV_DENYLIST from child process env
- safe_send_message() prefixes [smolagents], truncates at 2000 chars, HTML-escapes output

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-18 03:03:13 +00:00
e0cd330980 docs(concepts): update default model to claude-opus-4-7 (PR #743)
- google-adk.mdx: update comparison table LangGraph example from
  anthropic:claude-sonnet-4-6 → anthropic:claude-opus-4-7
- quickstart.mdx: add callout noting claude-opus-4-7 as the new
  default for workspaces that don't pin a model explicitly

Pairs with molecule-core PR #743 / closes #727.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-18 00:17:43 +00:00
c36888d6d3 docs(channels): add Discord adapter documentation (PR #656)
Documents the Discord Incoming Webhook + Interactions adapter:
- Config fields, setup steps (webhook URL + slash-command app),
  inbound interaction types (PING/APPLICATION_COMMAND/MESSAGE_COMPONENT),
  message splitting at the 2000-char limit, and a DISCORD_WEBHOOK_URL
  secret example.
- Updates title/description, Overview, Adapters count, webhook type list,
  and Example Configs sections.

Pairs with molecule-core PR #656 / closes #625.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-18 00:17:17 +00:00
22ebf81828 docs(api-ref): add AG-UI SSE streaming endpoint (PR #601)
Documents GET /workspaces/:id/events/stream — WorkspaceAuth-guarded
Server-Sent Events endpoint compatible with the AG-UI protocol.
Covers envelope format, event types, curl and JS examples.

Pairs with molecule-core PR #601 (closes #590).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-18 00:16:20 +00:00
4a275835e4 docs(site): daily changelog 2026-04-17
Customer-facing CHANGELOG page summarising 80+ merged PRs for 2026-04-17:
new features (opencode MCP bridge, Slack Bot API, AG-UI SSE, A2A topology
canvas overlay, audit trail panel, workspace hibernation, Temporal checkpoints,
semantic memory search, Hermes stacked system messages + native tools + structured
output, AGENTS.md auto-gen, Discord adapter, budget limits, token metrics, Opus 4.7
effort/task_budget, plugin supply-chain hardening, Fly Machines provisioner),
security fixes, and docs PR cross-references.

Adds changelog.mdx and nav entry at top of meta.json pages array.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-17 23:37:34 +00:00
1c8e103b4c docs(api-ref): Temporal workflow checkpoints — persist/resume, step endpoints (PRs #797+#803)
Add '## Workflow Checkpoints' section to api-reference.mdx:
- POST /workspaces/:id/checkpoints — upsert step checkpoint (ON CONFLICT safe)
- GET /workspaces/:id/checkpoints/:wfid — list checkpoints by workflow ID
- DELETE /workspaces/:id/checkpoints/:wfid — clear on clean completion
- Callout explaining automatic resume behavior (runtime: langgraph only):
  checkpoint I/O is non-fatal, resume skips already-completed stages
- Step names/indices table (task_receive=0, llm_call=1, task_complete=2)

Pairs with monorepo PR #797 (persistence layer) + PR #803 (workspace-template
auto-save/resume). Section placed after Activity, before Schedules.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-17 19:02:44 +00:00
06651d5d3e docs(mcp-server): pin npm package version, remove -y flag (SAFE-MCP NEW-003)
- Quick start install example: add @1.0.0 version pin
- .mcp.json Configure example: pin to @1.0.0, remove -y auto-accept flag
- Add Callout warning explaining why pinning is required (unpinned + -y =
  arbitrary code execution on package compromise) with link to npm page
- Troubleshooting: update standalone run example to use pinned version

Addresses SAFE-MCP finding NEW-003 (HIGH) from SAFE-MCP audit (PR #808).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-17 19:01:43 +00:00
489adab608 docs(plugins): supply chain security — pinned refs required, SHA-256 integrity (PR #775)
- Two-Axis Model sources table: replace mutable `github://owner/repo` row with
  pinned-tag and pinned-SHA rows; clarify these are now the only valid forms
- Installing a Plugin: update GitHub example to use `#v1.0.0`; add Callout
  warning that bare refs return HTTP 422 with link to Supply Chain Security section
- Install Safeguards: add `PLUGIN_ALLOW_UNPINNED` env var row (dev escape hatch)
- New "Supply Chain Security" section: explains pinned-ref enforcement (SAFE-T1102),
  shows valid vs invalid ref forms, SHA-256 content integrity option with hash
  computation recipe, and PLUGIN_ALLOW_UNPINNED escape hatch

Pairs with monorepo PR #775 (fix(security): plugin supply chain hardening).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-17 19:00:40 +00:00
e9d81f3b1c docs(api-ref): molecule-audit-ledger — HMAC chain, /audit endpoint, CLI (PR #651)
Add Audit Ledger section to api-reference.mdx:
- GET /workspaces/:id/audit with all query params (agent_id, session_id,
  from/to RFC 3339, limit cap 500, offset)
- Response shape including chain_valid tri-state (true/false/null)
- AUDIT_LEDGER_SALT callout (platform + workspace envs must match)
- LedgerHooks Python usage snippet for workspace templates
- molecule_audit.verify CLI exit codes

Pairs with monorepo PR #651 (feat: molecule-audit-ledger — EU AI Act
Art. 12/13 compliance, HMAC-SHA256-chained agent event log).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-17 18:46:28 +00:00
48849933e7 docs(plugins): add molecule-medo as opt-in platform plugin
PR #760 extracted medo.py from builtin_tools (where it was dead code) into
a proper agentskills.io plugin at plugins/molecule-medo/. It is now an
explicit opt-in via local://molecule-medo rather than being silently shipped
in every workspace image.

- Add Platform Opt-in Plugins table with molecule-medo
- Document the three exposed tools: create/update/publish_medo_app
- Show install flow: set MEDO_API_KEY secret, then POST to /plugins
- Show org.yaml example for declarative deployment

Pairs with monorepo PR #760 / closes #741.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-17 18:36:42 +00:00
2324b3ee10 docs(canvas): A2A topology overlay and audit trail panel
Two Canvas features merged today:
- PR #751: A2A topology overlay — animated delegation edges (violet <5 min,
  blue otherwise), toolbar toggle, localStorage-persisted, polls every 60s
- PR #759: Audit trail panel — Side Panel Audit tab, tamper-evident chain,
  event-type filters, cursor pagination, chain_valid tamper indicator

Changes:
- concepts.mdx: expand The Canvas section with overlay + audit panel docs
- api-reference.mdx: add GET /workspaces/:id/audit with full entry schema;
  update activity row to document ?type=delegation filter

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-17 18:36:20 +00:00
545d6c37a9 docs(api-ref): document semantic memory search via ?q= param
PR #784 added pgvector-backed semantic search to GET /workspaces/:id/memories.
When ?q= is supplied and an embedding function is configured, results are
ordered by cosine similarity and include a similarity_score field.

Documents the query parameter, response shape, and graceful FTS fallback
so callers know the endpoint is backwards-compatible.

Pairs with monorepo PR #784 (feat: pgvector semantic search, closes #776).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-17 18:35:35 +00:00
9600e08b25 docs(concepts): document AGENTS.md auto-generation and role field
Workspace config.yaml now supports a `role` field which drives
AGENTS.md generation at startup (PR #763). Every workspace publishes
an AAIF-standard /workspace/AGENTS.md so peers can discover name,
role, description, A2A endpoint, and MCP tools.

- Expand Workspaces section with AGENTS.md auto-generation details
- Add table of AGENTS.md sections and their config.yaml sources
- Add role field to all workspaces in the org definition example
- Document fallback (role → description) and non-fatal startup behaviour

Pairs with monorepo PRs #763 and #794.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-17 18:35:11 +00:00
molecule-ai[bot]
dadb6d41cd
Merge pull request #6 from Molecule-AI/docs/fix-auth-701
docs(api-ref): PATCH auth + templates AdminAuth + validation — PR #701 breaking changes
2026-04-17 12:48:54 +00:00
molecule-ai[bot]
5b0190a788
docs(api-ref): auth + validation breaking changes from PR #701
Updates content/docs/api-reference.mdx:
- Add breaking-changes Callout (PATCH auth, templates AdminAuth, UUID validation)
- PATCH /workspaces/🆔 remove old field-level authz caveat; add full validation
  constraints (name ≤255, role ≤1000, model/runtime ≤100, no newlines/YAML-special)
- GET /templates: None → AdminAuth
- GET /org/templates: None → AdminAuth

Source PR: Molecule-AI/molecule-core#701

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-17 12:44:10 +00:00
molecule-ai[bot]
7287e31bb2
docs(site): workspace config — Opus 4.7 effort levels and task budget (#608)
Adds content/docs/workspace-config.mdx covering:
- Config tab overview (how to open, form vs raw YAML mode)
- Claude Settings panel: gating condition, where to find it in the UI
- Effort levels table: low / medium / high / xhigh (extended thinking) / max
  with descriptions, use-case guidance, cost/latency/quality tradeoffs
- Task budget: token ceiling, 20k minimum, when it applies, sizing guidance
- config.yaml reference with three annotated examples
- Beta header note: task-budgets-2026-03-13 added automatically by executor
- Executor wiring callout: config stored today, executor wiring ships next release
Updates meta.json: adds workspace-config after concepts in the nav.

Closes #608 (docs portion)
Source PRs: molecule-monorepo#639 (effort + task_budget UI), #654 (max level)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-17 07:14:41 +00:00
54b659fd6e docs(site): add Hermes multi-provider dispatch page (pairs with monorepo PR #555)
Adds content/docs/hermes.mdx — full reference for Hermes Phases 2a/2b/2c:
dispatch table (key priority order), secrets setup, quickstart for native
Anthropic + Gemini paths, multi-turn history demo, multi-provider fan-out
example, capability table (shipped vs Phase 2d roadmap), and troubleshooting.
Updates meta.json to add hermes to the Runtimes nav section.

Pairs with: Molecule-AI/molecule-monorepo#555 (docs/devrel-feat-hermes-multimodel)
Source PRs: molecule-core#240 (Phase 2a), #255 (Phase 2b), #267 (Phase 2c)
Closes #513

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-17 00:51:45 +00:00
621c340a1e docs(site): add Quickstart section to google-adk page (pairs with monorepo PR #569)
Inserts a hands-on ## Quickstart section between Secrets and Basic usage
in content/docs/google-adk.mdx. Covers workspace creation via REST API,
ready-state polling, first A2A task, multi-turn session state demo, and
Vertex AI alternative. Explains context_id → InMemorySessionService mapping
and google: model prefix stripping — gaps not covered by the reference docs.

Pairs with: Molecule-AI/molecule-monorepo#569 (docs/devrel-feat-550)
Existing docs: Docs PR #4 (google-adk.mdx reference page, already merged)
Source PR: Molecule-AI/molecule-core#550

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-17 00:50:44 +00:00
molecule-ai[bot]
0a4b8119c4
docs: add Google ADK runtime adapter documentation (#4)
Pre-draft docs for the google-adk workspace adapter (issue #542, PR #550).
Covers installation, secrets, config reference, A2A compatibility, plugin
support, and troubleshooting. Also adds google-adk to the runtimes table
in architecture.mdx and the runtime list in concepts.mdx.

Closes #542

Co-authored-by: Molecule AI Documentation Specialist <documentation-specialist@agents.moleculesai.app>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-17 00:36:27 +00:00
Hongming Wang
e2a772d561
Merge pull request #3 from Molecule-AI/feat/external-agents-tokens-mcp
docs: comprehensive content for all 15 pages
2026-04-16 10:11:54 -07:00
Hongming Wang
a620e5a7a3 docs: comprehensive content for all 15 documentation pages
Previously 7 pages were stubs ("Coming soon"). Now all 15 have full content:

- index.mdx: SaaS subdomain table, runtime adapters, MCP/SDK links
- quickstart.mdx: 3 setup options (dev-start.sh, docker-compose, manual), SaaS alternative
- concepts.mdx: added external agents, Lark channel, tokens, MCP integration
- architecture.mdx: system diagram, 4 components, infra services, health detection, deployment modes
- api-reference.mdx: all 80+ routes across 19 categories with auth requirements
- channels.mdx: Telegram, Slack, Lark/Feishu adapters with config examples
- plugins.mdx: two-axis model, 12 built-in plugins, install safeguards
- schedules.mdx: cron syntax, concurrency handling, supervision, org template examples
- org-template.mdx: YAML structure, defaults layer, plugin UNION, template registry
- self-hosting.mdx: dev-start.sh, docker-compose, env vars, production deployment
- observability.mdx: activity logs, Langfuse, Prometheus, liveness, WebSocket events
- troubleshooting.mdx: 10 common issues with fixes

Build verified: 19/19 static pages generated.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-16 10:05:12 -07:00
Hongming Wang
ebb56f9b8c
Merge pull request #1 from Molecule-AI/feat/external-agents-tokens-mcp
feat: External Agents, Token Management, MCP Server docs
2026-04-16 09:31:12 -07:00