227787bbbd
The Python adapter audit (test_adapter_logging.py) pins the adapter.py side, but the entrypoint shell function fires earlier and twice (pre-gosu + post-gosu). When the SDK import wedge keeps the adapter from running at all, the shell emission is the operator's only visibility into the boot env. Eight new tests cover: - env NAME=set / env NAME=unset shape for every audited var - value-leak guard: secret strings never appear in output - WORKSPACE_ID + PLATFORM_URL passthrough by value (not secret) - <unset> fallback for missing platform identifiers - uid/gid line shape (used to verify the privilege drop) - dated boot banner shape (used to count restarts in a crash loop) - cross-file gate: shell for-loop names == fixture tuple, mirroring test_audit_env_list_matches_entrypoint_sh's adapter.py↔shell gate Strategy: regex-extract the function body from entrypoint.sh and run it in a fresh /bin/sh with controlled env. We never source the whole entrypoint because it would chown /workspace and exec molecule-runtime. Closes the gap from task #251 (follow-up to PR #32 boot-debug logging). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .claude | ||
| .github/workflows | ||
| .molecule-ci/scripts | ||
| runbooks | ||
| scripts | ||
| tests | ||
| __init__.py | ||
| .gitattributes | ||
| .gitignore | ||
| adapter.py | ||
| claude_sdk_executor.py | ||
| CLAUDE.md | ||
| config.yaml | ||
| Dockerfile | ||
| entrypoint.sh | ||
| known-issues.md | ||
| README.md | ||
| requirements.txt | ||
template-claude-code-default
Molecule AI workspace template for the claude-code-default runtime.
Usage
In Molecule AI canvas
Select this template when creating a new workspace — it appears in the template picker automatically.
From a URL (community install)
Paste this URL when creating a workspace:
github://Molecule-AI/template-claude-code-default
Files
config.yaml— workspace configuration (runtime, model, skills, etc.)system-prompt.md— agent system prompt (if present)
Auth paths
| Path | Env var(s) | Where to get the key |
|---|---|---|
| OAuth (Claude Code subscription) | CLAUDE_CODE_OAUTH_TOKEN |
claude login |
| Anthropic API (direct) | ANTHROPIC_API_KEY |
console.anthropic.com |
| Third-party Anthropic-compat (e.g. Xiaomi MiMo pay-as-you-go) | ANTHROPIC_API_KEY (provider's key) |
provider console |
| Xiaomi MiMo Token Plan | ANTHROPIC_API_KEY (Token Plan key), ANTHROPIC_BASE_URL (Token Plan endpoint) |
token-plan dashboard |
For third-party providers, entrypoint.sh rewrites ANTHROPIC_BASE_URL based on the selected MODEL so the claude CLI routes there. Currently auto-routes mimo-* models to https://api.xiaomimimo.com/anthropic (pay-as-you-go). Token Plan users should set ANTHROPIC_BASE_URL=https://token-plan-sgp.xiaomimimo.com/anthropic as a workspace or org-level secret — the shell mapping is the fallback and operator-set values always win. Other Token Plan endpoints (e.g. token-plan-hk.xiaomimimo.com) can be used by setting the secret explicitly.
Schema version
template_schema_version: 1 — compatible with Molecule AI platform v1.x.
License
Business Source License 1.1 — © Molecule AI.