6927 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Molecule AI Dev Engineer A (Kimi)	bf276bc25d	fix(ci): add explicit utf-8 encoding to Python open() calls ... Python 3's open() default encoding is platform-dependent (PEP 597). On CI runners it happens to be UTF-8, but being explicit avoids surprises on Windows dev boxes or custom runner images. Files touched: - sop-checklist.py: config loading (YAML + minimal parser) - tests/_review_check_fixture.py: test fixture scenario loader - tests/_refire_fixture.py: test fixture scenario loader Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-27 15:35:36 +00:00
hongming	18fa084510	Merge pull request 'fix(canvas): link provider selection to llm_billing_mode (internal#703 Gap 2)' (#1935) from fix/703-provider-billing-mode-ui into main	2026-05-27 15:33:17 +00:00
hongming	46012b965c	Merge pull request 'fix(llm): byok honors workspace own provider env — emit resolved billing_mode (internal#703)' (#1934) from fix/internal-703-byok-billing-mode-env into main	2026-05-27 15:24:34 +00:00
hongming	1828d15d4f	Merge pull request 'fix(handlers): nil-safe scans + validation hardening (from #1933)' (#1950) from fix/nil-safe-scans-validation-hardening into main	2026-05-27 15:00:24 +00:00
core-be	ea70447599	fix(handlers): nil-safe scans + validation hardening (from #1933) ... Resubmits the independent nil-safe / validation-hardening hunks extracted from closed PR #1933 (closed for scope-creep). Each hunk is self-contained and does not overlap the already-merged #1938/#1939/#1940; the a2a_proxy*, channels, delegation, restart and scheduler hunks from - a2a_queue_status.go: nil-safe Scan in queueRowAuthFields (NULL caller_id / workspace_id -> "" via NullString.Valid checks). - github_token.go: guard non-201 status from the GitHub token endpoint before decoding the body. - mcp_tools.go: check_task_status defaults status to "unknown" when the row's status is NULL; toolListPeers / toolGetWorkspaceInfo / toolCheckTaskStatus now return the marshal error instead of returning a malformed/empty string. - mcp_tools_memory_legacy_shim.go / mcp_tools_memory_v2.go: return the marshal error from the memory tool responses. - registry.go: nil name/role guard before reconcileAgentCardIdentity. - schedules.go: compute next run in the validated location (time.Now().In(loc)) for Create and Update. - workspace_provision.go: case/whitespace-insensitive runtime match via strings.EqualFold. Tests added: queueRowAuthFields nil-safe + populated paths, check_task_status NULL-status -> "unknown", and the EqualFold case/whitespace matrix. Full internal/handlers package passes. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-27 07:38:26 -07:00
hongming	658e033638	Merge pull request 'fix(handlers): return after marshal failure in toolDelegateTaskAsync' (#1949) from fix/delegate-async-return-after-marshal-fail into main	2026-05-27 14:30:11 +00:00
hongming	f70384d375	Merge pull request 'fix(a2a): canvas-user identity bypass without cross-workspace escalation (#1673)' (#1948) from fix/canvas-user-verified-session-1673 into main	2026-05-27 14:19:48 +00:00
core-be	1735f28ca9	fix(handlers): return after marshal failure in toolDelegateTaskAsync ... The detached goroutine in toolDelegateTaskAsync logged a json.Marshal failure for the A2A body but then fell through and called proxyA2ARequest with a nil/empty body, dispatching a malformed A2A request. Add the missing return so the goroutine bails out on marshal failure. Extracted as the real titled fix from closed PR #1933 (the rest of that PR was scope-creep and is being resubmitted separately). A package-level marshalA2ABody seam is added so the otherwise near-impossible marshal-failure path can be exercised by a focused unit test (TestMCPHandler_DelegateTaskAsync_MarshalFailureDoesNotCallProxy), which fails without the return and passes with it. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-27 07:00:07 -07:00
core-be	121eb64f24	fix(a2a): canvas-user identity bypass without cross-workspace escalation (#1673) ... #1673: validateCallerToken checked HasAnyLiveToken BEFORE the canvas classification. Once an RFC#637 canvas-user identity workspace acquired live tokens, canvas requests fell into the hasLive=true branch, which demands a bearer the canvas frontend never sends → silent 401 → the message was dropped before logA2AReceiveQueued wrote the activity_logs row, breaking canvas chat (and chat-history) for poll-mode workspaces. Safe mechanism (supersedes #1944): classify canvas users by the HUMAN's NON-FORGEABLE credential, evaluated BEFORE the peer-token contract: - middleware.IsVerifiedCanvasSession — the WorkOS session cookie confirmed upstream as a member of THIS tenant's org (/cp/auth/tenant-member). The production SaaS canvas path. - ADMIN_TOKEN bearer / live org_api_tokens row. A bare same-origin Host/Referer (middleware.IsSameOriginCanvas, documented in-repo as forgeable / cosmetic-only) is honored ONLY as a self-hosted/dev fallback when CP session verification is NOT configured — never in a SaaS combined-tenant image, where a forged Referer + arbitrary X-Workspace-ID would otherwise bypass registry.CanCommunicate and reach cross-workspace A2A. That is the privilege escalation #1944 introduced. Classification keys on the human's credential, not the caller's X-Workspace-ID, so it never trusts an attacker-supplied caller ID and is independent of whether the identity workspace holds peer tokens. Genuine token-holding peer workspaces are unaffected: with no cookie/admin/org credential they fall through to the existing bearer/ValidateToken gate. Tests: - TestProxyA2A_PollMode_CanvasUserWithVerifiedSession — the #1673 regression: poll-mode canvas-user identity WITH live tokens + a CP-verified session → 200 queued + activity_logs row written, with NO SELECT COUNT(*) (proving the canvas check precedes HasAnyLiveToken). Subprocess test with CANVAS_PROXY_URL set at init. - TestProxyA2A_ForgedSameOrigin_CannotBypassCanCommunicate — the security crux: combined-tenant image, forged same-origin Host/Referer + arbitrary X-Workspace-ID, no verified session → must fall through to CanCommunicate, which DENIES (403). Proves the escalation is closed. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-27 06:59:05 -07:00
hongming	38671a35d1	Merge pull request 'fix(handlers): clean up time.After timer in delegation retry on ctx cancel' (#1940) from fix/time-after-single-retry-delegation into main	2026-05-27 13:24:44 +00:00
hongming	e5a39df664	Merge pull request 'fix(handlers): prevent invalid JSONB inserts on json.Marshal failure (2nd pass)' (#1938) from fix/json-marshal-log-continue-2nd-pass into main	2026-05-27 13:24:27 +00:00
hongming	2fb8f2fd40	Merge pull request 'fix(workspace-server): prevent time.After goroutine leaks in long-running loops' (#1939) from fix/time-after-goroutine-leaks into main	2026-05-27 13:24:17 +00:00
hongming	8291a95060	Merge pull request 'watchdog: close stale [main-red] issues when contexts recover on red (mc#1789)' (#1943) from fix/watchdog-close-stale-contexts-on-red into main	2026-05-27 13:22:51 +00:00
hongming	58b098c676	Merge pull request 'fix(ci): remove -race from blocking Platform (Go) gate, add advisory race step (#1184)' (#1945) from fix/ci-remove-race-from-blocking-gate-1184 into main	2026-05-27 13:22:44 +00:00
Molecule AI Dev Engineer A (Kimi)	0a1426e311	fix(ci): remove -race from blocking Platform (Go) gate, add advisory race step (#1184) ... Cold runners compile race-instrumented code in 13-25 min, exceeding the 10m step timeout and causing false failures on unrelated PRs. The blocking gate now runs without -race (reliable on cold runners), while a new non-blocking advisory step still surfaces race conditions on every PR without blocking merge. Fixes #1184	2026-05-27 12:44:26 +00:00
Molecule AI Dev Engineer A (Kimi)	5f0a772f67	main-red-watchdog: add missing close_stale_red_issues mock in test ... test_run_once_failure_does_not_close was not monkeypatching the new close_stale_red_issues function, causing it to hit the real api() helper and fail with URLError in CI. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-27 11:50:09 +00:00
Molecule AI Dev Engineer A (Kimi)	c272eeae94	watchdog: close stale [main-red] issues when contexts recover on red (mc#1789) ... When main stays red across consecutive SHAs for *different* causes, close_open_red_issues_for_other_shas never fires (it only runs when main is green). This leaves stale issues open indefinitely — e.g. #1936 (E2E Chat failure) stayed open even though current HEAD is red for a different reason (E2E Legacy Advisory). Add close_stale_red_issues(): 1. List all open [main-red] issues. 2. For each issue on an OLD SHA, query that SHA's commit status. 3. Compare the old failed contexts against current HEAD. 4. If ALL failed contexts have recovered (success or absent), close the issue with a comment pointing to the current [main-red] issue. 5. If the old SHA is itself now green, close it too. 6. Skip issues with combined-red-no-detail (can't verify recovery). Called from run_once() after file_or_update_red() on the red path. Emits a main_red_stale_closed Loki event when issues are closed. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-27 11:06:06 +00:00
Molecule AI Dev Engineer A (Kimi)	2335156ad3	fix(handlers): clean up time.After timer in delegation retry on ctx cancel ... Even though this is a bounded single-retry per request, using time.NewTimer + timer.Stop() on ctx.Done() is consistent with the fleet-wide cleanup and prevents the short-lived timer goroutine from lingering until delegationRetryDelay expires. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-27 09:49:22 +00:00
Molecule AI Dev Engineer A (Kimi)	02a3de7c0e	fix(workspace-server): replace time.After with time.NewTimer to prevent goroutine leaks ... Inside loops, time.After creates a new timer goroutine each iteration that cannot be GC'd until it fires. In long-running loops (supervisor restart backoff, Telegram polling, restart-context polling, CP stop retry) this leaks goroutines proportional to iteration count. Replace with time.NewTimer + timer.Stop() on ctx cancellation so the timer is cleaned up immediately when the goroutine exits. Affected files: - supervised/supervised.go (RunWithRecover backoff) - channels/telegram.go (429 retry + poll error sleep) - handlers/restart_context.go (online + heartbeat polling) - handlers/workspace_restart.go (cpStop retry backoff) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-27 09:45:31 +00:00
Molecule AI Dev Engineer A (Kimi)	f1beec8767	fix(channels,scheduler): prevent nil/empty payloads on json.Marshal failure ... Second sweep found additional log-and-continue instances in channels and scheduler where a marshal error was logged but the nil result was still used downstream: - channels/slack: nil body sent to Slack API → return marshal error - channels/manager: nil a2aBody passed to ProxyA2ARequest → return error - channels/manager: empty string pushed to Redis history → skip push - scheduler/fireSchedule: nil a2aBody passed to ProxyA2ARequest → return early - scheduler/cronMeta insert (2×): empty string ::jsonb → skip DB insert Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-27 09:25:38 +00:00
Molecule AI Dev Engineer A (Kimi)	94ca997d43	fix(handlers): prevent invalid JSONB inserts on json.Marshal failure (2nd pass) ... PR #1933 fixed the fleet-wide json.Marshal error-log-but-continue pattern in the first pass. A second grep sweep found additional instances where a logged marshal error was followed by passing the (potentially nil) result to a PostgreSQL ::jsonb cast, causing unnecessary DB syntax errors, or by computing an HMAC over empty data (audit chain integrity). Changes: - a2a_queue: return early in stitchDrainResponseToDelegation - agent_message_writer: return nil (broadcast already succeeded) - audit: return "" instead of HMAC of empty data - channels: return 500 on marshal errors in Create/Update - delegation: return early or skip DB insert in pushDelegationResultToInbox, insertDelegationRow, executeDelegation, Record, UpdateStatus - memories: skip best-effort audit insert on marshal error Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-27 09:14:37 +00:00
hongming	bad9a52aac	Merge pull request 'fix(workspace-server): retire 12288-byte config-files user-data cap (cp#329)' (#1937) from fix/cp329-retire-config-files-userdata-cap into main	2026-05-27 08:31:10 +00:00
hongming-ceo-delegated	8c48bc9474	fix(workspace-server): retire 12288-byte config-files user-data cap (cp#329) ... CPProvisioner.collectCPConfigFiles hard-capped the config bundle (config.yaml + prompts/*) at 12 KiB because the control plane embedded it in EC2 user-data (16 KiB AWS ceiling). That failed a paying customer: the jrs-auto SEO Agent's config exceeds 12 KiB, so Start() rejected it client-side with "cp provisioner: collect config files: config files exceed 12288 bytes" — the workspace could never provision. The control plane now delivers config OFF user-data (stages to Secrets Manager, the workspace fetches it into /configs at boot — see molecule-controlplane cp#329). The bundle travels here only inside the JSON HTTP body to CP, which has no 16 KiB limit, so the 12 KiB ceiling is obsolete. Raise cpConfigFilesMaxBytes from 12 KiB to 256 KiB: it becomes a pure transport-DoS guard (a buggy/hostile tenant can't stream an unbounded body and OOM the CP provision path), not the old user-data ceiling. Legitimate growth — more schedules, longer prompts, more skills — never re-hits a wall. TDD: TestStart_OversizedConfigBundleProvisions reproduces the exact failure (>12288-byte SEO-shaped bundle) and proves it now reaches the CP request body intact; TestCollectCPConfigFiles_DoSGuardStillBounds proves the guard still rejects an oversized (>256 KiB) bundle. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-27 00:52:17 -07:00
hongming-ceo-delegated	46bb1eb7b4	fix(canvas): link provider selection to llm_billing_mode (internal#703 Gap 2) ... Selecting a non-Platform provider in the workspace Config tab previously wrote only the credential env (CLAUDE_CODE_OAUTH_TOKEN / vendor key) and left llm_billing_mode at its resolved default (platform_managed). CP's tenant_config then kept injecting the platform proxy base URLs, so the OAuth token / vendor key was never used and BYOK silently no-op'd (the live jrs-auto SEO-Agent symptom in #703). The workspace-server even hard-blocks vendor-key writes on platform_managed workspaces, pointing the user at this exact billing-mode switch. ConfigTab.handleSave now derives the implied billing_mode from the selected provider (Platform / empty -> platform_managed; any other vendor -> byok) and, when the provider changed and the implied mode differs, PUTs it to /admin/workspaces/:id/llm-billing-mode (the same per-tenant endpoint the LLM Billing section uses). The write is gated on the provider PUT succeeding and on the mode actually changing, so a BYOK->BYOK vendor swap or an unrelated Save does not issue a redundant PUT or trigger a needless restart. A failed billing-mode write is surfaced as a partial-save warning so the user knows BYOK may not take. This is the UI half of #703; the CP/workspace-server env-injection half (Gap 1) lands in parallel (workspace_provision.go), composing cleanly. Refs: internal#703, internal#691. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-27 06:28:21 +00:00
hongming-ceo-delegated	b11d2b6d90	fix(llm): emit resolved per-workspace billing_mode into container env (internal#703) ... byok end-to-end fix. The per-workspace resolver (internal#691) already skips proxy injection + key-strip for byok/disabled, but applyPlatformManagedLLMEnv only emitted MOLECULE_LLM_BILLING_MODE on the platform_managed strip path, hardcoded to the literal "platform_managed". A byok/disabled container therefore never carried a truthful MOLECULE_LLM_BILLING_MODE value — only MOLECULE_LLM_BILLING_MODE_RESOLVED. Emit MOLECULE_LLM_BILLING_MODE = res.ResolvedMode (resolver-driven, not a hardcode) for every resolved mode, alongside the existing _RESOLVED emit. On the platform_managed path the value is identical to before; on the byok/disabled early-return path the container now reflects the real mode. No vendor strings; the proxy-skip / no-strip byok behavior is unchanged. Tests: - TestApplyPlatformManagedLLMEnv_ClaudeCodeByokKeepsOwnProviderEnv: a per-workspace byok override (org floor = platform_managed) keeps its own CLAUDE_CODE_OAUTH_TOKEN, gets NO proxy ANTHROPIC_BASE_URL/key, and reads MOLECULE_LLM_BILLING_MODE=byok. Verified failing without the fix. - TestApplyPlatformManagedLLMEnv_PlatformManagedStillEmitsResolvedMode: no-regression — platform_managed still strips + forces proxy + emits MOLECULE_LLM_BILLING_MODE=platform_managed. Refs internal#703, internal#691. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-27 06:20:53 +00:00
hongming	fdd3f52bc8	fix(workspace-server): retry EC2 terminate on delete (#1932) ... Delete-path cpProv.Stop now uses bounded retry (cpStopWithRetryErr) like the restart path; durable workspace.delete.terminate_retry_exhausted event on exhaustion so the cp-orphan-sweeper/reaper backstop has a signal. Closes the un-retried single-shot Stop that leaked EC2s. Approved by core-qa + core-security.	2026-05-27 06:14:20 +00:00
hongming	e058137fbf	fix(workspace-server): bounded retry on delete-path EC2 stop + durable leak event ... The DELETE path's StopWorkspaceAuto → cpProv.Stop had no retry, while the restart path used cpStopWithRetry (bounded exp backoff). A transient CP/AWS hiccup on delete left the workspace row at status='removed' with instance_id populated, returned a 500, and relied entirely on the 60s CP-orphan-sweeper to re-drive the terminate. For a cascade *descendant* the "client retries → replays terminate" recovery is defeated by CascadeDelete's status != 'removed' CTE filter — so the only inline recovery is a bounded retry. This extracts the retry loop into cpStopWithRetryErr (cpStopWithRetry keeps its void contract for the restart paths) and adds stopWorkspaceForDelete, which retries the CP terminate and, on exhaustion, persists a durable workspace.delete.terminate_retry_exhausted row to structure_events (the §Persistent structured logging gate) so the leak/pending decision is queryable. The row deliberately stays status='removed' + instance_id so the existing CP-orphan-sweeper backstop still re-drives it; the error is still returned so the HTTP Delete surfaces the retryable 500. Test-first, fail-direction proof: CPRetriesTransientThenSucceeds (3 calls, no event) vs CPExhausts (event + error) discriminate the new behavior from the pre-fix bare Stop. AST gate updated to recognize cpStopWithRetryErr as the relocated home of the retry loop. Refs task #15 (workspace-ec2-leak). Paired with the controlplane workspace- EC2 reaper PR for the row-gone leak class. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-26 21:50:48 -07:00
hongming	9bcf9d1dfe	feat(workspace-server): seed schedules from workspace-template config.yaml (#1929) ... Adds template_schedules.go helper: parses workspace-template config.yaml schedules: block + INSERTs into workspace_schedules with source='template'. Hooked into WorkspaceHandler.Create AFTER provisionWorkspaceAuto succeeds (so failed-backend workspaces never end up with orphan schedules). Reuses canonical orgImportScheduleSQL — Issue #24 contract (additive/idempotent/preserve-runtime-rows/never-DELETE) preserved. Hostile-template defenses: 1 MiB LimitReader on config.yaml; maxTemplateSchedules=100; cron_expr ≤ 128; resolved prompt ≤ 16 KiB; ctx.Err() check inside seed loop; %q on schedule names in logs. 7 parser unit tests; full handlers suite green locally. Reviews: APPROVED by core-qa + core-security after a two-axis subagent review + fix cycle (REQUEST_CHANGES → fixes in b9a3ef4 → APPROVE). Companion SEO template PR: molecule-ai-workspace-template-seo-agent#12.	2026-05-26 23:50:42 +00:00
hongming	b9a3ef4294	fix(template-schedules): apply review findings (ordering + bounds) ... Addresses both review subagents' REQUEST_CHANGES verdicts on PR #1929: Code review (correctness) - #1: Move schedule seeding to AFTER provisionWorkspaceAuto succeeds so the scheduler never fires cron rows against a workspace whose backend never wired. Failed-backend workspaces no longer end up with orphan template_schedules rows. - #2: seedTemplateSchedules now returns (seeded, skipped int) so the caller can observe partial-seed states; workspace.go Create logs the (seeded, skipped) pair when skipped > 0, surfacing silent partial-loss that the prior (int) return masked. Security review (hostile-template defenses) - #3 / #4: parseTemplateSchedules reads config.yaml through an io.LimitReader bounded by maxTemplateConfigYAMLBytes (1 MiB) and rejects files over the cap before yaml.Unmarshal runs. Defends against billion-laughs / anchor-explosion DoS. - #3: schedules slice length capped at maxTemplateSchedules (100, 10x the largest current production grid). Hostile template with 50k schedules now rejected at parse time, not after 50k inserts. - #3: cron_expr length capped at maxScheduleCronExprLen (128) per schedule; resolved prompt body capped at maxSchedulePromptBytes (16 KiB) per schedule. Oversized entries are skipped (counted as `skipped`) so one bad row doesn't break the rest. - #3: Seed loop honours ctx.Err() so an aborted Create request stops further inserts rather than running to completion on a dead goroutine. - #8: Schedule names quoted via %q in all log lines so CRLF in a hostile name can't injection-pollute stdout/Loki. Tests - TestParseTemplateSchedules_RejectsOversizeFile — gate against the LimitReader cap (1 MiB + 1 byte of '#'). - TestParseTemplateSchedules_RejectsTooManySchedules — gate against the schedule-count cap (maxTemplateSchedules + 1 minimal entries). - Full handlers test suite still green (17.4s). Non-fix surface - Code-review #3 (runtime-default fallback also seeds): runtime- default templates do not currently ship a schedules: block so this is benign in practice; documented behavior in the comment. - Code-review #4 (files_dir in workspace-template config.yaml): not part of the current template_registry schema; flagged for follow-up if templates start declaring files_dir. - Security-review #7 (cron prompt as agent self-message escalation vector): out of scope per security reviewer's own note; tracked separately. Will file an issue. Verified locally: go vet ./... → clean go build ./... → clean gofmt -d <changed files> → clean go test ./internal/handlers/ → PASS (7 unit tests for parser, full suite 17.4s) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-26 16:31:52 -07:00
hongming	d8b409f1bc	feat(workspace-server): seed schedules from workspace-template config.yaml ... Adds a new template_schedules.go helper that parses a workspace template's config.yaml for its `schedules:` block and INSERTs each entry into workspace_schedules with source='template'. Mirrors the org/import path (org_import.go) so a workspace created directly from a workspace template lands with the same schedule grid the org/import path would have produced. Closes the gap the SEO Agent template hit: the template documented a "comprehensive schedule" (in source/.../recommended-schedule.md and the matching config.yaml schedules: block from molecule-ai-workspace-template-seo-agent#12), but the workspace- server provisioner never consumed `schedules:` from a workspace template — only the org/import path seeded workspace_schedules. Wiring: - New: handlers/template_schedules.go * parseTemplateSchedules(templatePath) — minimal YAML parse of `schedules:` only; returns (nil, nil) when config.yaml is absent or the block is empty. Errors only on read/parse failure of a present file. * seedTemplateSchedules(ctx, workspaceID, templatePath, schedules) — per-entry resolve+insert via the canonical orgImportScheduleSQL constant from org.go. Reuses the existing resolvePromptRef + scheduler.ComputeNextRun helpers. Per-row failures are logged and skipped; never fatal. - Modified: handlers/workspace.go * WorkspaceHandler.Create calls parseTemplateSchedules + seedTemplateSchedules after the templatePath resolves and before provisionWorkspaceAuto runs. Non-fatal — a broken schedules: block can never block workspace provisioning. * Schedules are seeded once at workspace creation; Restart does not re-seed (so user-deleted template rows stay deleted). - New: handlers/template_schedules_test.go * Table-driven coverage for parseTemplateSchedules: absent file, empty path, no schedules block, happy path (3 entries inc. explicit enabled: false), malformed YAML. Issue #24 contract preserved (additive, idempotent, runtime-row preservation, never-DELETE) because both the new path and the existing org/import path execute the same orgImportScheduleSQL constant — and TestImport_OrgScheduleSQLShape already gates that SQL's shape against regression. Verified locally: go vet ./... → clean go build ./... → clean gofmt -d <changed files> → clean go test ./internal/handlers/ → PASS (incl. 5 new tests) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-26 16:10:29 -07:00
hongming	821ccffeb0	feat(canvas): LLM Billing section in Config tab (internal#691) (#1928) ... Co-authored-by: hongming <hongmingwang@moleculesai.app> Co-committed-by: hongming <hongmingwang@moleculesai.app>	2026-05-26 22:57:31 +00:00
hongming	db5ffed2b5	feat(workspace-server): per-workspace llm_billing_mode override (internal#691) (#1927) ... Co-authored-by: hongming <hongmingwang@moleculesai.app> Co-committed-by: hongming <hongmingwang@moleculesai.app>	2026-05-26 22:57:22 +00:00
hongming	cffe4bec43	fix(canvas): derive create-dialog provider models from templates (#1926)	2026-05-26 21:54:18 +00:00
hongming	12319f1ffd	Fix workspace auth forged same-origin bypass	2026-05-26 18:20:16 +00:00
claude-ceo-assistant	51ca06447b	Fix workspace auth referer bypass	2026-05-26 11:12:35 -07:00
hongming	c2a08f6a6d	fix(workspace): strip provider keys in platform-managed LLM mode (#1922)	2026-05-26 17:51:51 +00:00
claude-ceo-assistant	6c7ac12631	fix(workspace): strip provider keys in platform-managed LLM mode	2026-05-26 10:39:35 -07:00
agent-dev-a	a176900e7c	Merge pull request 'fix(handlers): add $6 placeholder for pending in insertMCPDelegationRow' (#1365) from fix/mcp-tools-sql-fix into main	2026-05-26 16:53:36 +00:00
agent-dev-a	a82a7a577c	Merge pull request 'fix(canvas/settings): WCAG 2.4.7 focus-visible on settings panel disabled buttons' (#1406) from fix/settings-panel-focus-visible into main	2026-05-26 16:52:09 +00:00
agent-dev-a	dea9324b7e	Merge pull request 'test(handlers): add validateWorkspaceID pure function coverage' (#1382) from test/workspace-crud-validators into main	2026-05-26 16:51:58 +00:00
agent-dev-a	54ff15c471	Merge pull request 'fix: handle ignored http.NewRequest errors in production code' (#1919) from fix/http-newrequest-ignored-errors into main	2026-05-26 16:45:17 +00:00
agent-dev-a	e531003a2d	Merge pull request 'fix(ci): shellcheck-arm64-pilot runs-on label matches Mac mini's actual registration' (#1679) from fix-shellcheck-arm64-pilot-runner-label into main	2026-05-26 16:39:45 +00:00
agent-dev-a	b5fa1457f4	Merge pull request 'fix(handlers,channels,scheduler): log ignored json.Marshal errors' (#1918) from fix/json-marshal-ignored-errors into main	2026-05-26 16:37:20 +00:00
Molecule AI Dev Engineer A (Kimi)	951ba85b35	fix: handle ignored http.NewRequest errors in production code ... - github_token.go:158: check error from http.NewRequest in generateAppInstallationToken - cp_provisioner.go:401: check error from http.NewRequestWithContext in Terminate - cp_provisioner.go:519: check error from http.NewRequestWithContext in IsRunning - cp_provisioner.go:553: check error from http.NewRequestWithContext in GetConsoleOutput These are the last ignored http.NewRequest errors outside test files. Ignoring the error is unsafe because a nil request would panic on the next line (header mutation or client.Do). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-26 16:36:40 +00:00
Molecule AI Dev Engineer A (Kimi)	3c5d90c117	fix(handlers,channels,scheduler): log ignored json.Marshal errors ... Systematic audit found ~35 instances of `out, _ := json.Marshal(...)` across 15 production files. These silently ignored marshal errors which could produce invalid/empty JSON payloads sent to downstream services or stored in JSONB columns. Fix by logging errors with log.Printf pattern (no functional behavior change). Two files needed `log` import added (slack.go, mcp_tools_memory_legacy_shim.go). Files touched: - handlers/delegation.go - handlers/mcp_tools.go - handlers/mcp_tools_memory_v2.go - handlers/channels.go - scheduler/scheduler.go - channels/manager.go - handlers/a2a_queue.go - handlers/agent_message_writer.go - handlers/restart_signals.go - handlers/approvals.go - handlers/audit.go - channels/slack.go - handlers/a2a_proxy_helpers.go - handlers/memories.go - handlers/mcp_tools_memory_legacy_shim.go Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-26 16:23:36 +00:00
agent-dev-a	9d9a1395a6	Merge pull request 'fix(handlers): log ignored descendant query errors in pause/resume' (#1917) from fix/restart-querycontext-errors into main	2026-05-26 16:06:19 +00:00
Molecule AI Dev Engineer A (Kimi)	e960586bb5	fix(handlers): log ignored descendant query errors in pause/resume ... workspace_restart.go Pause and Resume handlers were silently ignoring QueryContext errors when fetching descendant workspaces. Log the errors without changing behavior (rows != nil guard already prevents panic). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-26 15:56:41 +00:00
agent-dev-a	ca9fe8dbfc	Merge pull request 'fix(orgtoken,wsauth): log ignored last_used_at update errors' (#1916) from fix/token-last-used-ignored-errors into main	2026-05-26 15:54:16 +00:00
Molecule AI Dev Engineer A (Kimi)	ceda71a1f6	fix(orgtoken,wsauth): log ignored last_used_at update errors ... Best-effort last_used_at bumps in token validation paths were silently ignoring DB errors. Log them without changing the non-failing behavior. - orgtoken/tokens.go: log org_api_tokens last_used_at bump error - wsauth/tokens.go: log workspace_auth_tokens last_used_at bump errors (two call sites) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-26 15:45:14 +00:00
agent-dev-a	6ed8ea1c7d	Merge pull request 'fix(handlers): reject malformed JSON in org token create' (#1915) from fix/org-tokens-invalid-json-guard into main	2026-05-26 15:42:09 +00:00