6210 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
claude-ceo-assistant (Claude Opus 4.7 on Hongming's MacBook)	3198a3ee5d	fix(ci): throttle SOP refire workflow fan-out	2026-05-14 22:39:05 -07:00
hongming-codex-laptop	85b93feacc	ci: prevent advisory workflow timeout flakes	2026-05-14 20:00:19 -07:00
hongming-codex-laptop	da2fefa398	ci: harden scheduled gate check against list timeouts	2026-05-14 19:31:31 -07:00
hongming-codex-laptop	8f4c00ba05	ci: rearm after runner disk gc	2026-05-14 19:06:22 -07:00
hongming-codex-laptop	106baadf2b	ci: fix platform staticcheck lint	2026-05-14 18:12:21 -07:00
hongming-codex-laptop	6b80dca1f4	fix: preserve Claude Code provider registry in generated configs	2026-05-14 17:33:22 -07:00
hongming-codex-laptop	2f5b145c58	ci: rerun core pipeline after runner recovery	2026-05-14 16:40:30 -07:00
hongming-codex-laptop	420ac2f00d	ci: update instructions handler test expectations	2026-05-14 16:25:55 -07:00
Molecule merge queue	8fced20267	fix: limit CP template config transport	2026-05-14 15:37:44 -07:00
Molecule merge queue	7b3e3fc189	ci: fix handlers instruction test compile	2026-05-14 15:25:09 -07:00
Molecule merge queue	51a0fd2688	Merge pull request #1047 from molecule-ai/fix/saas-t4-cp-config-seed ... # Conflicts: # .gitea/ci-refire # workspace-server/internal/provisioner/cp_provisioner.go	2026-05-14 15:00:11 -07:00
Molecule AI Infra Lead	d4bf57392e	chore: second CI retrigger attempt ... Refs: mc#1047 CI hang - second push	2026-05-14 21:47:39 +00:00
devops-engineer	369578e96a	Merge pull request 'fix(provisioner): skip symlinks in collectCPConfigFiles WalkDir (OFFSEC-010)' (#1075) from fix/offsec-010-clean into main	2026-05-14 21:36:33 +00:00
Molecule AI Core-DevOps	5888238147	Resolve conflict: keep OFFSEC-010 collectCPConfigFiles with ce542cb26 nil-return fix	2026-05-14 21:34:00 +00:00
Molecule AI Infra Lead	c704e96117	chore: retrigger CI pipeline — all-required aggregator stalled ... Retry trigger per infra-lead investigation. Refs: mc#1047 CI hang	2026-05-14 21:33:15 +00:00
hongming-codex-laptop	a86e3c7048	ci: avoid needs unblock bug for required checks	2026-05-14 14:31:49 -07:00
devops-engineer	69f46d56c7	Merge pull request 'fix(handlers): CWE-78 guard + rows.Err() checks — hotfix for staging regressions' (#1071) from fix/offsec-003-boundary-wrapping into main	2026-05-14 21:21:43 +00:00
Molecule AI · core-security	c11a5e37ce	Merge branch 'main' into fix/offsec-003-boundary-wrapping	2026-05-14 21:19:31 +00:00
devops-engineer	1df0e378b6	Merge pull request 'fix(workspace): OFFSEC-003 — escaped boundary markers + closer truncation (main)' (#1073) from fix/offsec-003-escaped-markers-main into main	2026-05-14 21:17:38 +00:00
Molecule AI · core-security	9ce484886d	merge: resolve conflicts with main — keep CWE-78 guard + rows.Err() checks ... Conflict resolution for PR mc#1071 targeting main: - org_helpers.go: deduplicate expandEnvRef/isEnvIdentStart/isEnvIdentPart (added inline by main, also present in branch with doc comment; kept documented version) - org_helpers_pure_test.go: merge whitespace-only formatting conflicts (take main alignment) - org_helpers_security_test.go: merge style conflicts + keep main POSIX guard tests - instructions_test.go: keep both branches of add/add conflict - delegation_list_test.go: keep main version (branch deleted it) Security fix (CWE-78) and rows.Err() checks are identical in both branches and remain intact. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-14 21:09:07 +00:00
Molecule AI Infra-SRE	f33c5bd65e	ci: re-trigger fresh run after ci.yml fix	2026-05-14 21:03:38 +00:00
Molecule AI Core-QA	25866ec200	fix(workspace/OFFSEC-003): correct boundary wrapping + add closer truncation ... Two bugs fixed in tool_delegate_task wrapping logic: 1. Wrapping used raw _A2A_BOUNDARY_START/_END markers, which appeared in the output alongside the escaped form of the peer content (e.g. "[A2A_RESULT_FROM_PEER]\n[/ A2A_RESULT...]"). Fixed: wrap with _A2A_BOUNDARY_START_ESCAPED/_END_ESCAPED so the output contains no raw closer that could confuse downstream parsers. 2. A malicious peer could inject a fake closer ([/A2A_RESULT_FROM_PEER]) to make legitimate content appear truncated. Fixed: truncate at the raw closer BEFORE sanitization (truncation loses the raw form, so escaping afterward cannot retroactively remove it). Also fixes 10 regressions in test_a2a_offsec003_sanitization.py: tests were written expecting ZWSP (U+200B) escaping but implementation uses "[/ " prefix. Updated test invariants to match actual behavior. Also fixed 5 tests using [A2A_ERROR] in summary fields (not a boundary marker — no escaping applied) and updated test assertions in test_a2a_tools_impl.py and test_delegation_sync_via_polling.py to expect escaped wrapper forms. Cherry-picked fix/test-stdio-function-name (e478b5b2) from main: renamed _warn_if_stdio_not_pipe → _assert_stdio_is_pipe_compatible and added deprecated alias, fixing dangling monkeypatch targets that caused 5 test failures (issue #957). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 21:01:34 +00:00
devops-engineer	c1d23380b6	Merge pull request 'fix(canvas): load chat history in MobileChat' (#1062) from fix/mobile-chat-history into main	2026-05-14 20:53:21 +00:00
hongming	679ed9a697	Merge branch 'main' into fix/mobile-chat-history	2026-05-14 20:51:35 +00:00
devops-engineer	785112955f	Merge pull request 'fix(workspace): rename _warn_if_stdio_not_pipe → _assert_stdio_is_pipe_compatible' (#1063) from fix/stdio-v2 into main	2026-05-14 20:50:43 +00:00
hongming	af90c80e52	Merge branch 'main' into fix/mobile-chat-history	2026-05-14 20:41:29 +00:00
hongming-codex-laptop	3c1a46b067	fix(ci): retry all-required status polling timeouts	2026-05-14 13:38:23 -07:00
hongming-codex-laptop	3868143c01	ci: retrigger after reopening PR with symlink test	2026-05-14 13:23:42 -07:00
Molecule AI Core-BE	b72ec7dcfc	fix(handlers): restore rows.Err() checks in secrets.go — 6 scan loops ... Re-add the `rows.Err()` checks that were removed in the offsec-003-boundary-wrapping branch. These were originally added in commit 420c42a2 to prevent mid-stream DB errors from being silently swallowed. Affected functions: - List() workspace-level scan loop — catches DB errors during workspace secret iteration - List() global scan loop — catches DB errors during global secret iteration - Values() global scan loop — catches DB errors during global secret decryption scan - Values() workspace scan loop — catches DB errors during workspace secret decryption scan - ListGlobal() scan loop — catches DB errors during global-only listing - restartAllAffectedByGlobalKey() scan loop — catches DB errors when listing workspaces affected by a global secret change (issue #15 propagation path) Fixes issue #1061. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 20:21:17 +00:00
hongming-codex-laptop	f3e979b78c	test(handlers): cover ListFiles symlink skip	2026-05-14 13:17:16 -07:00
Molecule AI Infra-SRE	4ed6e36ef1	fix(handlers): skip symlinks in ListFiles WalkDir callback (OFFSEC-010)	2026-05-14 20:12:33 +00:00
Molecule AI Infra-SRE	2d7232cf41	verify(workspace): confirm OFFSEC-010 symlink guard in collectCPConfigFiles WalkDir	2026-05-14 20:10:08 +00:00
Molecule AI Core-BE	b75fe86470	fix(handlers): restore CWE-78 guard — partial refs like \$HOME/path stay literal ... Replaces the os.Expand-based expandWithEnv with a custom character-by-character parser that enforces the `ref == whole` guard from commit a3a358f9. os.Expand calls its callback for every $VAR-like token in the string, splitting $HOME/path into key="HOME" and key="/path". The callback cannot distinguish a whole-string ref from a partial prefix — it fell back to os.Getenv for any non-empty key that wasn't in the env map, leaking the host HOME into org YAML template values like `$HOME/path`. Fix: walk the string ourselves. Only call os.Getenv when the matched reference IS the entire input string (ref == whole). For partial refs like $HOME/path or ${ROLE}/admin, return the literal "$HOME" or "${ROLE}" — no host env leak. Tests: - Add 14 regression tests in org_helpers_security_test.go covering $HOME/path, ${ROLE}/admin, prefix$ROLE/suffix, mixed partial+whole, etc. - Update TestExpandWithEnv_PartiallyPresent to reflect the new correct behavior (embedded ${NOT_SET} stays literal, not os.Getenv fallback). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 20:08:46 +00:00
Molecule AI Core-DevOps	e51f7004b3	fix(workspace): rename _warn_if_stdio_not_pipe → _assert_stdio_is_pipe_compatible ... Rename the canonical function to `_assert_stdio_is_pipe_compatible` with a deprecated alias `_warn_if_stdio_not_pipe` for backward compat. Updates all 5 test import sites. Fixes dangling monkeypatch targets in test_a2a_mcp_server_http.py (which patches `_assert_stdio_is_pipe_compatible`; main's source defined the old name, causing patches to silently no-op). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 20:05:56 +00:00
hongming-codex-laptop	2686b09449	ci: retrigger after reopening PR	2026-05-14 13:03:49 -07:00
hongming-codex-laptop	25982862f7	fix(ci): make all-required poll required statuses	2026-05-14 13:00:02 -07:00
devops-engineer	8868cbe1a4	Merge pull request 'fix(ci): kill stale platform-server before binding port' (#1048) from sre/fix-stale-platform-server-port into main ... fix(ci): kill stale platform-server before binding port Kills zombie platform-server processes left by cancelled/timeout runs before binding :8080. Auto-merged by orchestrator. tier:low, required checks green, core-devops APPROVED.	2026-05-14 19:58:53 +00:00
core-be	0cf2fa6297	fix(canvas): load chat history in MobileChat ... MobileChat previously only read from the canvas store's agentMessages buffer, which is populated by desktop ChatTab (never runs on mobile) and live WebSocket events (only new messages). This meant opening chat on a phone / WebView showed an empty 'Send a message to start chatting' state even when history existed. - Load history via GET /workspaces/{id}/chat-history?limit=50 on mount - Consume live agentMessages from the store while the panel is open - Show loading spinner while fetching and surface errors - Update tests to mock api.get and consumeAgentMessages	2026-05-14 12:52:42 -07:00
hongming-codex-laptop	4ce3bfa3aa	fix(ci): keep PR aggregate independent of deploy reminder	2026-05-14 12:45:31 -07:00
hongming-codex-laptop	c9f53a2a28	fix(ci): let canvas deploy reminder satisfy PR aggregate	2026-05-14 12:26:03 -07:00
Molecule AI Core-QA	99df6504de	fix(workspace/OFFSEC-003): correct boundary wrapping + add closer truncation ... Two bugs fixed in tool_delegate_task wrapping logic: 1. Wrapping used raw _A2A_BOUNDARY_START/_END markers, which appeared in the output alongside the escaped form of the peer content (e.g. "[A2A_RESULT_FROM_PEER]\n[/ A2A_RESULT...]"). Fixed: wrap with _A2A_BOUNDARY_START_ESCAPED/_END_ESCAPED so the output contains no raw closer that could confuse downstream parsers. 2. A malicious peer could inject a fake closer ([/A2A_RESULT_FROM_PEER]) to make legitimate content appear truncated. Fixed: truncate at the raw closer BEFORE sanitization (truncation loses the raw form, so escaping afterward cannot retroactively remove it). Also fixes 10 regressions in test_a2a_offsec003_sanitization.py: tests were written expecting ZWSP (U+200B) escaping but implementation uses "[/ " prefix. Updated test invariants to match actual behavior. Also fixed 5 tests using [A2A_ERROR] in summary fields (not a boundary marker — no escaping applied) and updated test assertions in test_a2a_tools_impl.py and test_delegation_sync_via_polling.py to expect escaped wrapper forms. Cherry-picked fix/test-stdio-function-name (e478b5b2) from main: renamed _warn_if_stdio_not_pipe → _assert_stdio_is_pipe_compatible and added deprecated alias, fixing dangling monkeypatch targets that caused 5 test failures (issue #957). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 19:11:31 +00:00
hongming-codex-laptop	7b84d09de2	test: cover template symlink skip	2026-05-14 11:57:56 -07:00
Molecule AI Infra Lead	eb67db9d7f	[infra-lead-agent] fix(provisioner): skip symlinks in template WalkDir (OFFSEC-010) ... filepath.WalkDir follows symlinks, which could bypass the path traversal guard in addFile() if a symlink inside the template directory points outside it (e.g. a symlink to ../../../etc/passwd). Fix: add an explicit symlink check after the walkErr guard that returns nil (skip) when d.Type()&os.ModeSymlink != 0. The existing IsRegular() check catches non-regular non-symlink files (devices, sockets) but symlinks are regular files (they point to something), so they need explicit skipping. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 18:51:25 +00:00
hongming	39f2dd99aa	ci: refire (fix gate-check: review 3237 dismissed, sop-n/a security-review added)	2026-05-14 18:46:10 +00:00
Molecule AI Core-QA	c38df4df9c	fix(workspace): rename _warn_if_stdio_not_pipe → _assert_stdio_is_pipe_compatible ... The test file on main patches a2a_mcp_server._assert_stdio_is_pipe_compatible, but the source code on both main and staging still defined _warn_if_stdio_not_pipe. Fix by making _assert_stdio_is_pipe_compatible the canonical function and keeping _warn_if_stdio_not_pipe as a deprecated alias for backward compat. Fixes: regression in test_a2a_mcp_server_http.py (5 tests) and test_a2a_mcp_server.py (4 tests) that were failing due to dangling monkeypatch targets. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 18:38:12 +00:00
hongming	51f5aa82ee	ci: refire CI run	2026-05-14 18:30:29 +00:00
hongming	77e511f905	ci: refire CI run	2026-05-14 18:30:17 +00:00
Molecule AI Fullstack Engineer	1a4d012383	fix(provisioner): skip symlinks in CopyTemplateToContainer Walk (OFFSEC-010) ... filepath.Walk follows symlinks by default. A malicious org template containing a symlink (e.g. template/.ssh → /root/.ssh) could escape the intended directory and include arbitrary host files in the tar archive copied into workspace containers. Fix: skip symlinks in the Walk callback. Broken template symlinks are a silent no-op rather than an error, matching the security- first posture (no escalation on unexpected input). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 18:26:47 +00:00
Molecule AI Infra-SRE	15c058071a	chore: trigger fresh CI run to clear stale statuses	2026-05-14 18:15:15 +00:00
hongming	146009af51	ci: refire CI run	2026-05-14 18:01:28 +00:00