Go to file
rabbitblood f1329fe230 feat: ship GitHub credential-helper inline in runtime (fixes #1933 class)
Lifts the per-template wiring (Dockerfile COPY + entrypoint.sh git config
+ nohup daemon launch) into the Python runtime. Templates that depend
on molecule-ai-workspace-runtime get the behavior automatically — they
no longer need to maintain their own copy of the helper scripts or
remember to write the right git config in their entrypoint.

Background:
- GitHub App installation tokens (ghs_…) expire ~60min after issue
- claude-code-default template shipped without wiring → 39 workspaces
  lost their tokens, three PMs' A2A queues filled with retry-status
  messages, manual fleet restart required (cycle 62-66 incident)

This commit:
- Adds molecule_runtime/scripts/{molecule-git-token-helper.sh,
  molecule-gh-token-refresh.sh} as package data (copies from canonical
  workspace/scripts/ in molecule-monorepo)
- Adds molecule_runtime/credential_helper.py with
  install_credential_helper() that:
    1. Extracts bundled scripts to ~/.molecule-runtime/scripts/
    2. Configures git credential.helper for github.com
    3. Creates ~/.molecule-token-cache/ mode 0700
    4. Spawns refresh daemon under respawn loop (PID file dedup)
    5. Runs initial gh auth login --with-token
- Hooks call site early in main.py (step 0.1, before config load)
- Fails-soft: each step independently fault-tolerant; missing git/gh
  binary doesn't block runtime startup

Bumped to 0.1.10. Templates can drop their entrypoint.sh credential
helper setup once they update the runtime pin (separate PRs per template).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-24 00:41:32 -07:00
.github/workflows fix(CI): remove conflicting bandit flags from security linter step 2026-04-21 00:58:43 +00:00
molecule_runtime feat: ship GitHub credential-helper inline in runtime (fixes #1933 class) 2026-04-24 00:41:32 -07:00
tests feat: migrate a2a-sdk 1.x (KI-009) (#39) 2026-04-24 01:54:33 +00:00
.gitignore chore: gitignore credentials for molecule-ai-workspace-runtime 2026-04-16 09:18:48 -07:00
pyproject.toml feat: ship GitHub credential-helper inline in runtime (fixes #1933 class) 2026-04-24 00:41:32 -07:00
README.md feat: initial release of molecule-ai-workspace-runtime 0.1.0 2026-04-16 04:26:06 -07:00

molecule-ai-workspace-runtime

Shared Python runtime infrastructure for all Molecule AI agent adapters.

This package provides the core machinery that every Molecule AI workspace container needs:

  • A2A server — Registers with the platform, heartbeats, serves A2A JSON-RPC
  • Adapter interfaceBaseAdapter / AdapterConfig / SetupResult
  • Built-in tools — delegation, memory, approvals, sandbox, telemetry
  • Skill loader — loads and hot-reloads skill modules from /configs/skills/
  • Plugin system — per-workspace + shared plugin discovery and install
  • Config / preflight — YAML config loading with validation

Installation

pip install molecule-ai-workspace-runtime

Adapter Discovery

The runtime discovers adapters in two ways:

  1. ADAPTER_MODULE env var (standalone adapter repos):

    ADAPTER_MODULE=my_adapter molecule-runtime
    

    The module must export an Adapter class extending BaseAdapter.

  2. Built-in subdirectory scan (monorepo local dev): Scans molecule_runtime/adapters/ subdirectories for Adapter classes.

Writing an Adapter

from molecule_runtime.adapters.base import BaseAdapter, AdapterConfig
from a2a.server.agent_execution import AgentExecutor

class Adapter(BaseAdapter):
    @staticmethod
    def name() -> str:
        return "my-runtime"

    @staticmethod
    def display_name() -> str:
        return "My Runtime"

    @staticmethod
    def description() -> str:
        return "My custom agent runtime"

    async def setup(self, config: AdapterConfig) -> None:
        result = await self._common_setup(config)
        # Store result attributes for create_executor

    async def create_executor(self, config: AdapterConfig) -> AgentExecutor:
        # Return an AgentExecutor instance
        ...

Set ADAPTER_MODULE=my_package.adapter and run molecule-runtime.

License

BSL-1.1 — see LICENSE for details.