6079 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Molecule AI Fullstack Engineer	42ccaf2da6	fix(canvas): add focus-visible rings to ScheduleTab, BudgetSection, ChannelsTab buttons ... WCAG 2.1 AA: small icon buttons without borders/backgrounds are invisible when keyboard-focused. Added focus-visible:ring-2 with appropriate ring colors (accent for neutral actions, red-400 for delete) and ring-offset-1 ring-offset-zinc-900 to match the dark canvas background. Buttons updated: - ScheduleTab: Run ▶, Edit ✎, Delete ✕, toggle ○, + Add Schedule - BudgetSection: Save button - ChannelsTab: Connect/Cancel header button, Detect Chats button Refs: #986 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 08:17:43 +00:00
devops-engineer	b25b4fb6ac	Merge pull request '[core-devops-agent] chore: promote main→staging v5 (test panic fix)' (#972) from promote/main-to-staging-v5 into staging	2026-05-14 05:37:47 +00:00
molecule-operator	956c2480d6	chore: promote main→staging v5 (test panic fix + t.Fatal improvements) ... Resolve merge conflict in org_helpers_security_test.go: - Keep staging t.TempDir() fix for TestResolveInsideRoot_DotDotWithIntermediate (a/b/../../c normalizes to c within root — test correctly expects success) - t.Fatal vs t.Fatalf are equivalent; staging version retained	2026-05-14 05:34:35 +00:00
devops-engineer	39c099b48f	Merge pull request 'fix(handlers): fix 3 test regressions + bring PR#956 security tests to staging' (#971) from fix/965-test-panic-resolveInsideRoot into staging	2026-05-14 05:32:24 +00:00
devops-engineer	8026f02050	Merge pull request 'fix(handlers/org_helpers_test): use t.Fatal instead of t.Error in error-path tests' (#970) from fix/org-helpers-test-panic into main	2026-05-14 05:29:38 +00:00
Molecule AI Core-BE	95c62c6fcd	fix(handlers/org_helpers_test): use t.Fatal instead of t.Error in error-path tests ... Six resolveInsideRoot tests called t.Errorf then continued to err.Error() on a potentially-nil error — if err was unexpectedly nil, the subsequent err.Error() call would panic with nil pointer dereference. Fix: use t.Fatalf/t.Fatal in the nil-error branch so execution stops before the err.Error() call. Affects: - TestResolveInsideRoot_EmptyUserPath - TestResolveInsideRoot_AbsolutePathRejected - TestResolveInsideRoot_DotDotTraversal - TestResolveInsideRoot_DotDotWithIntermediate - TestResolveInsideRoot_NestedDotDotEscapes - TestResolveInsideRoot_DotdotAtStart Fixes regression reported in issue #965. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 05:26:38 +00:00
Molecule AI Fullstack Engineer	e908772bcc	fix(handlers): fix 3 test regressions + bring PR#956 security tests to staging ... This PR closes #965 and brings PR#956's org_helpers_security_test.go onto the staging branch, with all conflicts resolved. Fix 1 — TestResolveInsideRoot_DotDotWithIntermediate panic (GH#965): a/b/../../c from /safe/root normalizes to /safe/root/c (valid descendant), so resolveInsideRoot returns nil. The test expected an error and called err.Error() on nil → panic. Fixed by rewriting the test to expect success and verify the resolved path stays within root. Fix 2 — Nil-panic propagation across resolveInsideRoot tests: All resolveInsideRoot tests that checked "err == nil" then called err.Error() on the falling-through path. Changed to t.Fatalf to stop immediately so the nil dereference never fires. Fix 3 — expandWithEnv literal-dollar regression: Re-applied the fix from fix/duplicate-test-declarations: expandWithEnv now skips $VAR keys not starting with [a-zA-Z_], so "cost $100" stays as-is even in environments where $1 could be resolved. Fix 4 — SSH probe tests degrade gracefully: TestHandleDiagnose_RoutesToRemote and TestDiagnoseRemote_StopsAtSSHProbe now t.Skip when ssh-keygen/nc are absent from PATH. Fix 5 — org_helpers_security_test.go duplicate declarations resolved: Removed isSafeRoleName tests (already in org_helpers_pure_test.go). Renamed TestMergeCategoryRouting_* → TestSecureRouting_* to avoid redeclaration with org_helpers_pure_test.go. Added the file from PR#956 (merged to main at 6582c096). Fix 6 — Removed stale duplicate test declarations in org_test.go and plugins_atomic_test.go (walkOrgWorkspaceNames variants, hasUnresolvedVarRef variants, resolveProvisionConcurrency_Default, TestTarWalk_NestedDirs). Closes #965 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 05:26:13 +00:00
devops-engineer	70bbf5af6c	Merge pull request '[core-devops-agent] chore: promote main→staging v4 (OFFSEC-003 test reversion + sync)' (#969) from promote/main-to-staging-v4 into staging	2026-05-14 05:21:04 +00:00
molecule-operator	6b0dd62a60	chore: promote main→staging v4 (OFFSEC-003 revert + delegation tests)	2026-05-14 05:18:58 +00:00
devops-engineer	2c2b06edbc	Merge pull request 'test(handlers/delegation): add coverage for listDelegationsFromLedger + listDelegationsFromActivityLogs' (#967) from feat/delegation-list-tests into main	2026-05-14 05:18:33 +00:00
Molecule AI Core-BE	41d4da590f	test(handlers/delegation): add coverage for listDelegationsFromLedger + listDelegationsFromActivityLogs ... Add 13 unit tests covering the data-backend methods behind ListDelegations: - listDelegationsFromLedger (7 cases): empty result → nil, single row, multiple rows in order, NULL last_heartbeat/deadline/result_preview/error_detail omitted from map, query error → nil (graceful fallback), rows.Err() mid-stream, scan error on row → row skipped. - listDelegationsFromActivityLogs (6 cases): empty → empty slice, single delegate row, delegate_result row with error+response_preview+delegation_id, query error → empty slice, rows.Err(), scan error → row skipped. Both methods were untested (cf. infra-sre review of PR #942 noting listDelegationsFromLedger had no test coverage). Uses sqlmock, follows existing test patterns in delegation_test.go. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 05:16:52 +00:00
devops-engineer	f6ea5741ce	Merge pull request 'fix(workspace): revert OFFSEC-003 test assertions — original expectations were correct' (#966) from fix/test-a2a-sanitization-v3 into main	2026-05-14 05:11:51 +00:00
devops-engineer	0b55e801bd	Merge pull request '[core-devops-agent] chore: promote main→staging v3 (operational push fix + security tests)' (#964) from promote/main-to-staging-v3 into staging	2026-05-14 05:04:34 +00:00
Molecule AI Core-QA	6a0383bbf8	fix(workspace): revert OFFSEC-003 test assertions — original expectations were correct ... PR #946 incorrectly changed test assertions to expect ZWSP/regex-based stripping behavior that the production code never had. The actual sanitizer uses simple string replacement (e.g. [/A2A_RESULT_FROM_PEER] → [/ /A2A_RESULT_FROM_PEER]) and does NOT strip content after closers. Reverts test file to the correct string-replacement expectations from commit 40ca44aa. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 05:03:36 +00:00
molecule-operator	647dec55e6	chore: promote main→staging v3 (all pending main fixes)	2026-05-14 05:01:45 +00:00
devops-engineer	777b1653dd	Merge pull request 'fix(handlers): remove duplicate test declarations; skip SSH tests gracefully' (#961) from fix/duplicate-test-declarations into staging	2026-05-14 04:59:56 +00:00
Molecule AI Fullstack Engineer	5106552288	fix(handlers): remove duplicate test declarations; skip SSH tests gracefully ... - org_test.go: removed 5 duplicate test functions that also existed in org_helpers_pure_test.go (hasUnresolvedVarRef variants) and org_helpers_walk_test.go (walkOrgWorkspaceNames variants) and plugins_atomic_tar_test.go (TestTarWalk_NestedDirs) and org_helpers_walk_test.go (TestResolveProvisionConcurrency_Default). The _pure_test.go and _walk_test.go versions use testify assertions and are more comprehensive; they take precedence. - org_helpers.go: expandWithEnv now skips $VAR keys that don't start with [a-zA-Z_], so that "cost $100" stays as-is (fixes TestExpandWithEnv_LiteralDollar in go1.25 where os.Expand handles $1 as a variable reference differently than older Go versions). - terminal_diagnose_test.go: added t.Skip when ssh-keygen/nc are not in PATH so tests degrade gracefully instead of failing with "exec: not found" in container/CI environments that lack OpenSSH. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 04:56:19 +00:00
devops-engineer	ecee16f233	Merge pull request 'chore: promote main→staging v2 (BP context fix + Docker healthcheck fix)' (#960) from promote/main-to-staging-v2 into staging	2026-05-14 04:49:33 +00:00
devops-engineer	6582c0964a	Merge pull request 'test(handlers/org_helpers): add security-critical test coverage for resolveInsideRoot, isSafeRoleName, mergeCategoryRouting' (#956) from feat/org-helpers-security-tests into main	2026-05-14 04:47:05 +00:00
Molecule AI Core-BE	9cd76919af	test(handlers/org_helpers): add security-critical test coverage ... Add 25 unit tests for three previously-uncovered pure helpers in org_helpers.go: - resolveInsideRoot (10 cases): empty path, absolute path, dotdot traversal, dotdot with intermediate, valid relative, exact root match, dot path component, nested dotdot escapes, dotdot at start, sibling directory (the filepath.Separator guard is exercised). - isSafeRoleName (7 cases): valid names, empty, dot, dotdot, path traversal attempts, special characters (colon/space/tab/newline/null/ @/#/$). Defense-in-depth for the persona env loader (OFFSEC-006 class). - mergeCategoryRouting (9 cases): both nil, default only, ws only, merge no overlap, ws override drops default, empty list drops category, empty key skipped, empty roles skipped, original maps unmodified after call. Go not available in container; CI runs the suite.	2026-05-14 04:45:13 +00:00
devops-engineer	0e549dfc55	Merge pull request 'ci: stop operational push jobs painting main red' (#962) from fix/main-push-operational-red into main	2026-05-14 04:44:43 +00:00
hongming-codex-laptop	dec1be237d	ci: preserve sop checklist concurrency update	2026-05-13 21:42:26 -07:00
hongming-codex-laptop	4491b07add	ci: narrow status reaper soft skip to commit listing	2026-05-13 21:41:58 -07:00
hongming-codex-laptop	3b47c974ee	ci: stop operational push jobs painting main red	2026-05-14 04:41:10 +00:00
Molecule AI Core-DevOps	4454871924	Merge remote-tracking branch 'origin/staging' into promote/main-to-staging-v2	2026-05-14 04:34:51 +00:00
devops-engineer	81f042c875	Merge pull request 'fix(ci): add concurrency block to sop-checklist workflow (cancel stale runs)' (#963) from fix-sop-concurrency-v2 into main	2026-05-14 04:34:11 +00:00
molecule-operator	725869834e	fix(ci): add concurrency block to sop-checklist workflow (cancel stale runs)	2026-05-14 04:30:57 +00:00
devops-engineer	38d12c6d41	Merge pull request 'ci: fix publish Docker healthcheck pipefail' (#952) from fix/publish-healthcheck-pipefail into main	2026-05-14 04:12:45 +00:00
hongming-codex-laptop	7250ebbed8	ci: fix publish docker healthcheck pipefail	2026-05-14 04:11:40 +00:00
devops-engineer	d1171a7337	Merge pull request 'fix(ci): rename sop-checklist-gate→sop-checklist (mc#948 BP→emitter drift fix)' (#951) from fix/sop-checklist-workflow-rename into main	2026-05-14 04:10:24 +00:00
Molecule AI Core-DevOps	10dc98112c	fix(ci): rename sop-checklist-gate→sop-checklist to match BP context ... mc#948 (BP→emitter drift): `sop-checklist / all-items-acked (pull_request)` was required by branch protection but the workflow was named `sop-checklist-gate`, so it emitted the misnamed context `sop-checklist-gate / gate (pull_request)` instead. Rename to align the workflow's `name:` field with the context that BP requires: sop-checklist-gate.yml → sop-checklist.yml sop-checklist-gate.py → sop-checklist.py test_sop_checklist_gate.py → test_sop_checklist.py New context emitted: `sop-checklist / all-items-acked (pull_request)`. Added `# bp-required: yes` directive to the workflow header per Tier 2g lint convention (mc#774). All 52 script tests pass. Closes #948. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 04:05:38 +00:00
devops-engineer	d5760ef4fc	Merge pull request 'chore: promote main→staging (sync 3 commits, close workflow drift #940)' (#947) from promote/main-to-staging into staging	2026-05-14 04:04:29 +00:00
molecule-operator	15a7542530	Merge remote-tracking branch origin/main into promote/main-to-staging	2026-05-14 04:02:27 +00:00
devops-engineer	065a709e37	Merge pull request 'fix(canvas): remove opacity from error/success text — WCAG AA contrast' (#949) from design/wcag-contrast-round4-2026-05-14 into main	2026-05-14 04:01:17 +00:00
Molecule AI Core-DevOps	d3c671d77c	Merge remote-tracking branch 'origin/staging' into promote/main-to-staging ... # Conflicts: # .gitea/scripts/sop-checklist-gate.py	2026-05-14 04:00:16 +00:00
Molecule AI Core-UIUX	38c8702934	fix(canvas): remove opacity from error/success text — WCAG AA contrast ... Fixes 6 instances of text-bad/text-good with opacity reducing contrast: - ConversationTraceModal: error detail (text-bad/80 → text-bad) - ConversationTraceModal: Response label (text-good/60 → text-good) - ActivityTab: error detail inline (text-bad/80 → text-bad) - ActivityTab: A2AErrorPreview label+hint (text-bad/80 → text-bad, text-bad/70 → text-bad) - ScheduleTab: last_error display (text-bad/70 → text-bad) - SkillsTab: registry error detail (text-bad/80 → text-bad) Note: text-bad (#d27773) on bg-surface-card (zinc-800) is 2.1:1 — below AA for body text. The text color itself needs design review to raise contrast to meet 4.5:1 on zinc-800 surfaces. This PR removes opacity (which only made things worse) as a step 1; a follow-up should consider warmer/muted zinc-safe alternatives for bad/good status colors. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 03:59:25 +00:00
devops-engineer	f3fb7cbae4	Merge pull request 'fix(handlers): update executeDelegation integration test calls (staging PR #916 follow-up)' (#945) from fix/staging-integration-test-ctx into staging	2026-05-14 03:56:02 +00:00
devops-engineer	12899f2a07	Merge pull request 'test(handlers/org): add unit tests for walkOrgWorkspaceNames, resolveProvisionConcurrency, errString' (#941) from fix/org-helper-tests into main	2026-05-14 03:54:58 +00:00
Molecule AI Core-BE	424ffbdb43	test(handlers/org): add unit tests for walkOrgWorkspaceNames, resolveProvisionConcurrency, errString ... Issue #741: three pure helpers in org.go had no unit tests. Added 13 new test cases: - walkOrgWorkspaceNames (6): empty, single node, nested children, skips empty names, deeply nested (5 levels), multiple roots. - resolveProvisionConcurrency (6): default, valid positive int, zero (unlimited semantics), negative (falls back), non-integer (falls back), whitespace-trimmed. - errString (3): nil error, non-nil error, wrapped error (%w). Closes: molecule-ai/molecule-core#741 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 03:53:40 +00:00
devops-engineer	349efe6793	Merge pull request 'fix(workspace): correct OFFSEC-003 test assertions to match ZWSP-escaping behavior' (#946) from fix/test-a2a-sanitization-main into main	2026-05-14 03:52:22 +00:00
Molecule AI Core-QA	fa81626b71	fix(workspace): correct OFFSEC-003 test assertions to match ZWSP-escaping behavior ... Corrects 12 broken test assertions in test_a2a_sanitization.py that were introduced by the PR #916 merge. Assertions mischaracterized the sanitizer's ZWSP-escaping behavior, especially around the (?<=\\n) lookbehind in _strip_closed_blocks. Key corrections: - test_escape_close_marker: closer preceded by \\n IS stripped (matches the (?<=\\n) lookbehind); injected closer + all content after removed - test_escape_open_marker: opener at start-of-line IS ZWSP-escaped (ZWSP inserted between \\n and [) - test_escape_full_fake_boundary_pair: opener ZWSP-escaped, closer stripped - test_empty_string_returns_empty: None coerced by first if-check → "" - All TestInjectionPatternDefenseInDepth tests: use bracketed [SYSTEM] form matching _CONTROL_PATTERNS regex, not colon-prefixed form - test_check_task_status_*: JSON fields have no boundary markers (no wrapping) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 03:39:34 +00:00
devops-engineer	210fcc0ea4	Merge pull request 'ci: publish deploy images on every main push' (#939) from fix/publish-image-on-every-main-push into main	2026-05-14 03:36:54 +00:00
hongming-codex-laptop	e7a0e4ba9e	ci: publish deploy images on every main push	2026-05-14 03:36:04 +00:00
devops-engineer	de175de44f	Merge pull request 'ci: remove canvas-deploy-reminder from all-required.needs (mc#923 deadlock fix)' (#938) from fix/remove-canvas-reminder-from-all-required into main	2026-05-14 03:35:20 +00:00
Molecule AI Core-DevOps	1a1d45464e	ci: remove canvas-deploy-reminder from all-required.needs ... canvas-deploy-reminder needs canvas-build, which is skipped on CI-only PRs (canvas=false). Adding it to all-required.needs causes all-required to hang forever on every PR that only touches CI/workflow files. canvas-deploy-reminder stays in CI with its own needs: [changes, canvas-build] and step-level if: gate — it still runs on canvas pushes to main, but is no longer a required gate. Refs: mc#922, mc#923, mc#929, PR #927 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 03:33:34 +00:00
Molecule AI Infra-Runtime-BE	265bd49f3a	fix(handlers): update executeDelegation calls in integration tests ... executeDelegation signature changed from 5 params to 4 params on staging (ctx removed). Update all 5 integration test call sites in delegation_executor_integration_test.go to match. Companion fix for PR #916 (fix/904-handler-test-blockers). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 03:28:28 +00:00
devops-engineer	b0180fe4b2	Merge pull request 'fix(canvas): WCAG AA contrast round 3 + focus-visible rings + aria fixes' (#936) from design/wcag-a11y-round3-2026-05-14 into main	2026-05-14 03:24:42 +00:00
Molecule AI Core-UIUX	4929824c27	fix(canvas): WCAG AA contrast round 3 + focus-visible rings + aria fixes ... Contrast: - FilesTab: Delete All + Delete buttons bg-red-600→bg-red-700 hover→bg-red-600 (AA trap fixed: hover goes darker, 3.9:1→4.6:1). - ErrorBoundary: error message text-bad/80 → text-bad (4.5:1→4.5:1, removes opacity that dropped below AA). - ExternalConnectModal: Copy button bg-accent-strong/80→bg-accent hover→bg-accent-strong (visual consistency; no contrast change but cleaner pattern). - ConversationTraceModal: SEND badge bg-cyan-950/50→bg-cyan-950 text-cyan-400→text-cyan-300. Focus-visible rings: - MissingKeysModal: Save + Deploy buttons gain focus-visible ring. - FilesToolbar: directory select outline-none→focus-visible ring. - ProviderModelSelector: model input focus ring upgraded to 2px visible ring. ARIA: - ScheduleTab: toggle status dot gains aria-label describing last run status. - ThemeToggle: arrow-key focus uses direct-child query (> [role=radio]) to avoid accidentally focusing unrelated radio elements in the React Flow canvas. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 03:23:54 +00:00
devops-engineer	363905d358	Merge pull request 'fix(ci): use GITHUB_EVENT_BEFORE in handlers-pg-integ detect-changes' (#937) from fix/handlers-pg-integ-event-before into main	2026-05-14 03:18:29 +00:00
devops-engineer	6b7321635f	Merge pull request 'fix(ci): add canvas-deploy-reminder to all-required.needs (mc#923)' (#927) from fix/staging-ci-drift-canvas-reminder into staging	2026-05-14 03:08:22 +00:00