6178 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
devops-engineer	76609f4129	Merge pull request 'feat(workspace): broadcast and talk-to-user platform abilities' (#1121) from feat/workspace-abilities-broadcast-talk-to-user into staging	2026-05-15 07:42:19 +00:00
hongming-codex-laptop	8439a066b6	fix(mcp): add broadcast_message dispatch arm to a2a_mcp_server ... test_dispatcher_schema_drift caught that broadcast_message was registered in platform_tools.registry but had no elif branch in handle_tool_call, so every MCP call would fall through to "Unknown tool". Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-15 00:19:44 -07:00
hongming-codex-laptop	d7d376118d	test(e2e): workspace broadcast and talk-to-user abilities ... 20-assertion shell E2E covering the full abilities contract: - talk_to_user_enabled=true (default) → POST /notify succeeds - PATCH /abilities to disable → /notify returns 403 with error code and delegate_task hint; re-enabling restores delivery - broadcast_enabled=false (default) → POST /broadcast returns 403 - PATCH /abilities to enable → fan-out succeeds, delivered count >= 1 - Receiver activity log has broadcast_receive row (activity_type) with correct summary and source_id pointing at sender workspace - Sender activity log has broadcast_sent row; sender has no self-receive - Empty broadcast message returns 400 - Partial PATCH leaves unmentioned flags unchanged Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-15 00:19:44 -07:00
hongming-codex-laptop	026d1c5fae	feat(workspace): add broadcast and talk-to-user platform abilities ... Two new workspace-level ability flags (broadcast_enabled, talk_to_user_enabled) with full backend enforcement, MCP tool, and canvas UI: - Migration: adds broadcast_enabled (default false) and talk_to_user_enabled (default true) columns to workspaces table - PATCH /workspaces/:id/abilities (AdminAuth) toggles either flag independently - POST /workspaces/:id/broadcast (WorkspaceAuth) fans out a broadcast_receive activity_log entry + WS BROADCAST_MESSAGE event to all non-removed peers; requires broadcast_enabled=true on the sender - AgentMessageWriter checks talk_to_user_enabled; returns ErrTalkToUserDisabled which surfaces as HTTP 403 on /notify and the send_message_to_user MCP tool - broadcast_message MCP tool added to registry + a2a_tools_messaging.py - Canvas ChatTab shows "Agent is not enabled to chat with you" banner with Enable button when talkToUserEnabled=false on the workspace node Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-15 00:19:44 -07:00
devops-engineer	48ad38e795	Merge pull request 'feat(adapter-base): ProviderRegistry type + resolve_provider_routing utility' (#1138) from feat/provider-routing-base-v2 into staging	2026-05-15 06:52:15 +00:00
core-devops	4bdb10b5e2	feat(adapter-base): add ProviderRegistry type + resolve_provider_routing utility ... Adds a shared resolver that maps `provider:model` strings to (api_key, base_url, model_id). Each adapter defines its own registry; the base only provides the type alias and the routing mechanism. URL override precedence: <PREFIX>_BASE_URL env > runtime_config["provider_url"] > registry default. Unknown prefixes fall back to OpenAI credentials. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-14 23:02:09 -07:00
devops-engineer	6452456f75	Merge pull request 'fix(ci): needs-based all-required sentinel (fixes #1083)' (#1096) from fix/ci-allrequired-needs-v2 into staging	2026-05-15 04:03:53 +00:00
core-devops	4978601032	fix(sop-checklist): update parse_directives return type to (directives, na_directives) ... Tests in test_sop_checklist.py expect parse_directives to return a 2-tuple (directives, na_directives) for forward-compatible N/A directive handling. Update the return type and fix the internal call site to match. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-14 20:29:45 -07:00
core-devops	ec3e27a4ec	fix(ci): needs-based all-required sentinel + remove needs:changes from build jobs (fixes #1083) ... - platform-build: drop `needs: changes`; change per-step `if:` conditions from `needs.changes.outputs.platform == 'true'` to `if: always()` and the skip step from `!= 'true'` to `if: false`. Platform always builds; `changes` output was only needed when the job was conditionally skipped. - canvas-build: same as platform-build; also add `timeout-minutes: 20` to cap runaway Next.js builds. - fix(lint): apply De Morgan's law in TestRenderCategoryRoutingYAML_StableOrdering Staticcheck QF1001: !(ai < mi && mi < zi) → ai >= mi || mi >= zi. Rebased on staging 4cc0e32a. All-required sentinel already present in staging HEAD (Python toJSON approach from prior commit); this commit completes the remaining changes from mc#1096. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-14 20:10:51 -07:00
devops-engineer	4cc0e32a53	Merge pull request 'fix(staging): wire OFFSEC-010 CP config + CWE-78 rows.Err fixes' (#1078) from fix/staging-offsec010-cp-wiring into staging	2026-05-15 00:05:36 +00:00
Molecule AI Core-BE	e9693e12ff	fix(handlers): add rows.Err() checks across approvals, tokens, instructions ... Standard CWE-78 pattern (same class as CWE-78-rows-err hotfix #1071): iterating over sql.Rows without checking rows.Err() after the loop silently ignores connection errors. Add the deferred Err() check to: - approvals.go: ListPendingApprovals (GET /approvals) - approvals.go: List (GET /workspaces/:id/approvals) - tokens.go: List (GET /workspaces/:id/tokens) - instructions.go: Resolve handler (GET /workspaces/:id/instructions/resolve) - instructions.go: scanInstructions helper (used by List handler) 🤖 Generated with [Claude Code](https://claude.com/claude-code)	2026-05-14 23:22:18 +00:00
Molecule AI Core-BE	bcca139caa	fix(handlers): add rows.Err() checks to loadWorkspaceSecrets ... loadWorkspaceSecrets() iterates over global_secrets and workspace_secrets rows without checking rows.Err() after the loop. If the connection is interrupted mid-iteration, the error is silently ignored. Add the standard deferred Err() check (pattern from secrets.go, org_helpers.go) to both loops. 🤖 Generated with [Claude Code](https://claude.com/claude-code)	2026-05-14 23:18:12 +00:00
Molecule AI Core-BE	6cf6e608d8	fix(staging): add isCPTemplateConfigFile filter to collectCPConfigFiles ... Cherry-picks the filter from main commit 8fced202: only transport config.yaml and files under prompts/ from the template directory to the control plane. Arbitrary template files (adapter.py, Dockerfile, etc.) are now excluded regardless of size, reducing the transport surface. Also adds a test case verifying adapter.py is excluded even when within the size limit. 🤖 Generated with [Claude Code](https://claude.com/claude-code)	2026-05-14 23:18:12 +00:00
Molecule AI Core-BE	6947774e1b	fix(staging): wire collectCPConfigFiles into CPProvisioner.Start ... collectCPConfigFiles was added in PR #1075 (OFFSEC-010) but never called — the symlink guards were dead code. This patch wires the function into CPProvisioner.Start so the guards actually protect the CP request path. Changes: 1. cpProvisionRequest gains ConfigFiles map[string]string field (base64-encoded, same shape as Docker provisioner's WriteFilesToContainer) 2. Start calls collectCPConfigFiles(cfg) before building the request; errors propagate as hard failures (a workspace without its config files is not usable) 3. Two new tests: - TestStart_CollectsConfigFiles: verifies TemplatePath files AND ConfigFiles map appear in the CP request body, base64-encoded - TestStart_SymlinkTemplatePathError: verifies a symlink TemplatePath causes Start to fail, exercising the OFFSEC-010 root-symlink guard Without this wiring, a malicious operator could bypass the WalkDir symlink guards by passing TemplatePath as a symlink to the CP. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 23:18:12 +00:00
Molecule AI Core-DevOps	9afecfdfc7	Resolve conflict: keep OFFSEC-010 collectCPConfigFiles with ce542cb26 nil-return fix	2026-05-14 23:18:12 +00:00
devops-engineer	220ee57d0c	Merge pull request 'fix(staging): restore goAsync tracking in 5 dispatch calls + move config seeding pre-Start' (#1076) from fix/staging-goasync-configseed into staging ... Merge pull request #1076: fix(staging): restore goAsync tracking + config seeding order	2026-05-14 23:15:19 +00:00
Molecule AI Core-BE	2751861b04	fix(staging): add goAsync method + asyncWG field to WorkspaceHandler ... Cherry-picks the goAsync definition from main commit 1c3b4ff3 so that PR #1076's 5 goAsync(...) call sites compile on staging. core-devops correctly identified that h.goAsync was called at 5 sites but never defined on the staging branch. Without this, the build fails. fixes #1076 review feedback Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 22:37:56 +00:00
Molecule AI Core-BE	da416caeca	fix(staging): restore goAsync tracking in 5 dispatch calls + move config seeding pre-Start ... Investigation of issue #1058 confirmed 3 regressions on staging (introduced by the OFFSEC-003 promotion PR #1059): 1. workspace_dispatchers.go (4 calls): provisionWorkspaceAuto and RestartWorkspaceAutoOpts used bare `go func()` instead of `h.goAsync(func() { ... })`, losing goroutine WaitGroup tracking. Restored h.goAsync on all 4 dispatch sites. 2. a2a_proxy.go (1 call): resolveAgentURL used bare `go h.RestartByID()` when waking a hibernated workspace. Restored h.goAsync wrapper. 3. provisioner.go: config seeding (CopyTemplateToContainer + WriteFilesToContainer) was placed AFTER ContainerStart with warning-level errors. Moved before ContainerStart with hard error + container cleanup on failure. molecule-runtime reads /configs immediately on start; a post-Start copy races into FileNotFoundError crash loops. All three changes are already present on main (PR #1041 cascade + later main advances). This PR brings staging to parity. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 21:27:52 +00:00
devops-engineer	250af4df36	Merge pull request 'fix(canvas): load chat history in MobileChat (closes #1062)' (#1069) from fix/1062-mobilechat-history into staging	2026-05-14 21:01:52 +00:00
devops-engineer	884bb8c09f	Merge pull request 'fix(handlers): restore CWE-78 guard in expandWithEnv (staging)' (#1072) from fix/staging-CWE-78-rows-err into staging	2026-05-14 20:58:34 +00:00
Molecule AI Core-BE	0c152a24d2	fix(handlers): restore CWE-78 guard — partial refs like \$HOME/path stay literal ... Replaces the os.Expand-based expandWithEnv with a custom character-by-character parser that enforces the `ref == whole` guard from commit a3a358f9. os.Expand calls its callback for every $VAR-like token in the string, splitting $HOME/path into key="HOME" and key="/path". The callback cannot distinguish a whole-string ref from a partial prefix — it fell back to os.Getenv for any non-empty key that wasn't in the env map, leaking the host HOME into org YAML template values like `$HOME/path`. Fix: walk the string ourselves. Only call os.Getenv when the matched reference IS the entire input string (ref == whole). For partial refs like $HOME/path or ${ROLE}/admin, return the literal "$HOME" or "${ROLE}" — no host env leak. Tests: - Add 14 regression tests in org_helpers_security_test.go covering $HOME/path, ${ROLE}/admin, prefix$ROLE/suffix, mixed partial+whole, etc. - Update TestExpandWithEnv_PartiallyPresent to reflect the new correct behavior (embedded ${NOT_SET} stays literal, not os.Getenv fallback). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 20:49:33 +00:00
Molecule AI Fullstack Engineer	3345544921	fix(canvas): load chat history in MobileChat (closes #1062) ... MobileChat previously only read from the canvas store's agentMessages buffer, which is populated by desktop ChatTab (never runs on mobile) and live WebSocket events (only new messages). Opening chat on a phone/WebView showed an empty state even when history existed. Changes: - Fetch history via GET /workspaces/{id}/chat-history?limit=50 on mount - Show loading spinner during fetch, surface errors with Retry button - Merge live agentMessages from the store while the panel is open - Subscribe to store updates after bootstrap so new pushes are visible - Fix TypeScript strict-mode issue in effect cleanup (Promise vs. sync fn) Test coverage (canvas): - New MobileChat history tests: mount call, loading state, empty state, message rendering, user role mapping, error state, retry button flow - All 26 MobileChat tests pass; 3293 total canvas tests pass Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 20:38:24 +00:00
devops-engineer	8e2597c877	Merge pull request 'fix(workspace/OFFSEC-003): correct boundary wrapping + add closer truncation' (#1059) from fix/offsec-003-boundary-v2 into staging	2026-05-14 20:26:35 +00:00
Molecule AI Core-QA	d241dd7f9e	fix(workspace/OFFSEC-003): correct boundary wrapping + add closer truncation ... Two bugs fixed in tool_delegate_task wrapping logic: 1. Wrapping used raw _A2A_BOUNDARY_START/_END markers, which appeared alongside the escaped form of peer content. Fixed: wrap with _A2A_BOUNDARY_START_ESCAPED/_END_ESCAPED so output contains no raw closer that could confuse downstream parsers. 2. A malicious peer could inject a fake closer ([/A2A_RESULT_FROM_PEER]) to make legitimate content appear truncated. Fixed: truncate at the raw closer BEFORE sanitization (truncation loses the raw form). Updated test assertions across 3 test files to match new escaped wrapper form (previous tests expected raw markers in output). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 19:48:55 +00:00
devops-engineer	d437c31da4	Merge pull request 'fix(handlers): resolve schedules_handler_test compile errors + workspace_crud_test routing' (#1044) from fix/1040-schedules-handler-test-compile into staging	2026-05-14 16:54:04 +00:00
Molecule AI Fullstack Engineer	ca7665f573	fix(handlers): workspace_crud_test.go compile errors + routing fixes ... PR #942 added 12 test functions that referenced `r` and `mock` without capturing them from setupWorkspaceCrudTest, plus called r.ServeHTTP on a router with no registered routes (returning 404 instead of the expected status code). Changes: - TestUpdate_InvalidUUID: call validateWorkspaceID directly (no router needed) - TestUpdate_InvalidBody: register PATCH route + use handler - TestUpdate_WorkspaceNotFound: register PATCH route + use handler - TestUpdate_NameTooLong: call validateWorkspaceFields directly - TestUpdate_RoleTooLong: call validateWorkspaceFields directly - TestUpdate_NameWithNewline: call validateWorkspaceFields directly - TestUpdate_NameWithYAMLSpecialChars: call validateWorkspaceFields directly - TestUpdate_WorkspaceDirSystemPath: call validateWorkspaceDir directly - TestUpdate_WorkspaceDirTraversal: call validateWorkspaceDir directly - TestUpdate_WorkspaceDirRelativePath: call validateWorkspaceDir directly - TestDelete_InvalidUUID: call validateWorkspaceID directly - TestDelete_HasChildrenWithoutConfirm: register DELETE route + use handler - TestDelete_ChildrenCheckQueryError: register DELETE route + use handler Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 16:42:59 +00:00
Molecule AI Fullstack Engineer	11d4b398b7	fix(handlers): resolveInsideRoot dot-clean + nil-db defensive guards ... 1. org_helpers.go: filepath.Clean after filepath.Join to strip "." path components (./subdir/./file.txt → subdir/file.txt) so the fast-path IsAbs check on absolute roots resolves dot segments. 2. org_helpers_security_test.go: fix hardcoded suffix length (14→16 chars) using strings.HasSuffix instead of slice arithmetic. 3. Add nil-db.DB guards in 5 locations where tests call handlers without setting up a mock DB (plugins_tracking.go, org_plugin_allowlist.go, terminal.go ×2, workspace_provision.go). No-op in production (db.DB is always set); prevents nil-panic in tests that exercise fast-path logic without a full DB stack. All 47 schedule tests pass. Full handlers test suite passes (45s). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 16:35:32 +00:00
Molecule AI Fullstack Engineer	48f65bc456	fix(handlers): resolve all sqlmock v1.5.2 API errors in schedules_handler_test.go ... Fix 6 compile errors and 2 runtime mismatches: 1. Remove unused `mock` variable + `db` import from TestScheduleHandler_Create_CRLFStripped 2. Replace non-existent `sqlmock.NewArgMatcher` with `setupTestDBForQueueTests` (QueryMatcherEqual) for the CRLF-stripped Create test 3. Replace `regexp.MustCompile(...)` in 8 ExpectExec calls with exact SQL strings (ExpectExec accepts string, not *regexp.Regexp) 4. Fix `\$1`-escaped SELECT queries → unescaped `$1` for QueryMatcherEqual 5. Correct UPDATE args: NotFound/DBError tests pass {"name":...} → name=$2 is non-nil 6. Correct UPDATE args: CRLF-stripped test expects "fix\nthat" (handler strips \r before query) 7. Fix UPDATE Exec string: use actual multi-line COALESCE format from handler All 47 schedule tests now pass. The 2 other test failures (TestResolveInsideRoot_DotPathComponent, TestPluginUninstall_SaaS_DispatchesToEIC) are pre-existing and unrelated to this fix. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 16:35:32 +00:00
devops-engineer	408dd452df	Merge pull request 'fix(canvas+handlers): Zustand selector anti-patterns + Go handler test blockers' (#942) from fix/917-zustand-selector-anti-patterns into staging	2026-05-14 16:28:57 +00:00
devops-engineer	29d735e431	Merge pull request 'fix(canvas): fix permanently-disabled Deploy button when runtime has no required env vars (closes #1022)' (#1038) from fix/1022-missing-keys-modal-allSaved into staging	2026-05-14 16:19:13 +00:00
devops-engineer	a921851124	Merge pull request 'fix(ci): add missing push status to gitea-merge-queue test mocks (mc#1031 regression)' (#1035) from fix/1031-staging-test-fix into staging	2026-05-14 15:42:00 +00:00
devops-engineer	3c982587cc	Merge pull request 'fix(ci): add job-level if: to canvas-deploy-reminder on staging (mc#959)' (#1029) from sre/staging-canvas-reminder-skip into staging	2026-05-14 15:41:05 +00:00
devops-engineer	d59daf87c9	Merge pull request 'fix(handlers): add rows.Err() checks after secrets scan loops (closes #1016)' (#1021) from fix/1016-secrets-rows-err-checks into staging	2026-05-14 15:40:26 +00:00
Molecule AI Fullstack Engineer	301d84f616	fix(canvas): resolve Zustand selector anti-patterns causing React #185 re-render loops ... - WorkspaceNode: useHasChildren and useDescendantCount now select nodes stably first, then derive with useMemo to avoid new boolean/number on every store push (React error #185 / Zustand + React 19 Object.is). - DropTargetBadge: targetName and childCount select nodes once, derive inside IIFEs to avoid new return value on every platform push. - useCanvasViewport: provisioningCount selects nodes stably, uses useMemo for the filter().length derivation. - MobileDetail / MobileChat: node selector split into stable nodes select + useMemo derivation of the .find() result. - ConfigTab: preserved existing s.nodes?.find?.() pattern (test mocks omit nodes; the defensive optional chaining is the correct approach there). Fixes: React error #185 (Zustand + React 19 Object.is strictness). --- fix(handlers): resolve Go handler test blockers - org_helpers.go: custom envVarRefPattern regexp for ${VAR}/$VAR expansion so $100 is left as-is (not expanded to empty) while $FOO is expanded. - org.go: add missing collectPerWorkspaceUnsatisfied and perWorkspaceUnsatisfied (required by the EnvRequirements checking path in org import). - workspace_crud_test.go: escape \$1 in sqlmock COUNT patterns (Go regex interprets bare $1 as end-anchor+literal-1, not a literal placeholder). - workspace_crud.go: move workspace_dir validation before the existence check so invalid paths return 400 instead of 404 — consistent with name/role field validation ordering. - a2a_queue.go: use float64 for expires_in_seconds JSON field; float values are truncated (90.7 → 90) per the documented contract. - a2a_queue_test.go: update float-value test expectation from 0 to 30 to match the truncation contract. - org_helpers_pure_test.go: fix TestAppendYAMLBlock_BothEmpty (assert.Nil not assert.Equal("", nil)). - plugins_atomic_test.go: remove duplicate TestTarWalk_NestedDirs. - org_layout_test.go: delete (tests non-existent childSlot function). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 15:29:04 +00:00
Molecule AI Fullstack Engineer	53ac6444c7	fix(canvas): fix permanently-disabled Deploy button when runtime has no required env vars (closes #1022) ... When a runtime declares no required_env (e.g. Openclaw), the MissingKeysModal Deploy button was permanently disabled because: allSaved = entries.length > 0 && entries.every(...) With entries=[], JavaScript evaluates this as false (due to short-circuit on entries.length), making the button disabled forever. Fix: remove the length guard. [].every(fn) is vacuously true per the JS spec, so "nothing required" correctly means "all requirements satisfied". Affected components: - ProviderPickerModal (line 347) - AllKeysModal (line 619) Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 15:19:23 +00:00
Molecule AI Core-DevOps	447016e652	fix(ci): add missing push status to gitea-merge-queue test mocks ... Cherry-pick from main commit 0b47f951 (fix/1031-staging-test-fix): evaluate_merge_readiness() now requires "CI / all-required (push)" context in main_status.statuses[] before approving merge. The test mocks were still using empty statuses[], causing two tests to assert "merge" or "update" but get "pause" instead. Fixes the 2 failing tests on staging: - test_merge_decision_requires_main_green_pr_green_and_current_base - test_merge_decision_updates_stale_pr_before_merge Closes mc#1031. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 15:07:08 +00:00
Molecule AI Infra-SRE	c6a222904e	chore: force CI re-run with SOP declarations ... Trivial comment added to trigger a new CI run so that the SOP declarations posted by infra-sre-agent are picked up. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 14:53:31 +00:00
Molecule AI Infra-SRE	f5c476f0c0	fix(ci): add job-level if: to canvas-deploy-reminder on staging (mc#959) ... canvas-deploy-reminder had step-level gating but no job-level `if:` on staging. ci-required-drift.py ci_job_names() only detects job-level `github.ref` gates, so canvas-deploy-reminder was flagged as F1 (missing from all-required.needs) — same false positive as mc#958 on main. Fix: - Added job-level `if: github.ref == 'refs/heads/staging'` so ci-required-drift.py correctly skips it from F1 - Added canvas-deploy-reminder to all-required.needs (sentinel handles skipped job result correctly) - Removed stale continue-on-error: true (was mc#774 interim mask) Closes mc#959 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 14:47:52 +00:00
Molecule AI Fullstack Engineer	858af52d6f	fix(handlers): add rows.Err() checks after secrets scan loops (closes #1016) ... Regression from audit #109: rows.Err() checks were removed from four functions between commits 3a30b073 and b25b4fb6. Without these checks, a mid-stream query error (e.g. connection loss during row iteration) is silently ignored and partial results are returned as success. Added rows.Err() checks after every for rows.Next() loop: - List: workspace secrets loop + global secrets loop - Values: global secrets loop + workspace secrets loop - ListGlobal: single loop - restartAllAffectedByGlobalKey: affected workspaces loop Each check logs the iteration error and continues (non-fatal, matching the existing log.Printf pattern used elsewhere in the file). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 14:12:35 +00:00
devops-engineer	4e8b40d1ea	Merge pull request 'fix(canvas): remove invalid CSS child-combinator from ThemeToggle querySelectorAll (closes #1008)' (#1012) from fix/1008-themetoggle-css-selector into staging	2026-05-14 13:53:04 +00:00
Molecule AI Fullstack Engineer	d5e362690f	fix(canvas): remove invalid CSS child-combinator from ThemeToggle querySelectorAll (closes #1008) ... The `> [role=radio]` selector is malformed — the `>` combinator requires a parent selector to its left. In a browser, element.querySelectorAll() accepts this implicitly but jsdom's parser rejects it with: SyntaxError: Invalid selector > [role=radio] This caused 5 uncaught exceptions per test run in ThemeToggle.test.tsx. Fix: remove the `>` since the query is already scoped to radiogroup. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 13:15:56 +00:00
devops-engineer	9f7b87de21	Merge pull request 'fix(handlers): remove 3 duplicate test declarations blocking CI build (closes #968)' (#1002) from fix/968-remove-duplicate-test-declarations into staging	2026-05-14 13:09:37 +00:00
Molecule AI Fullstack Engineer	686c330708	fix(handlers): remove 3 duplicate test declarations blocking CI build (closes #968) ... PR #961 only partially removed duplicate test declarations. Remove the remaining 3 from org_helpers_security_test.go that already exist in org_helpers_pure_test.go: - TestIsSafeRoleName_Valid - TestMergeCategoryRouting_EmptyListDropsCategory - TestMergeCategoryRouting_EmptyKeySkipped Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 12:54:20 +00:00
devops-engineer	d021272558	Merge pull request '[core-devops-agent] chore: promote main→staging v6 (test fix)' (#979) from staging-v6 into staging	2026-05-14 12:43:05 +00:00
molecule-operator	36e85c1950	chore: promote main→staging v6 (sync all main fixes)	2026-05-14 12:41:58 +00:00
devops-engineer	74ae043a8c	Merge pull request 'test(handlers): add HTTP handler coverage for ScheduleHandler — 28 cases' (#999) from fix/980-schedules-handler-test-coverage into staging	2026-05-14 12:40:37 +00:00
Molecule AI Fullstack Engineer	dd5b1a823f	test(handlers): add HTTP handler coverage for ScheduleHandler — 28 cases ... Covers all untested HTTP handler paths on ScheduleHandler: List: - empty result → 200 [] - query error → 500 Create: - missing cron_expr → 400 - missing prompt → 400 - invalid timezone → 400 - invalid cron → 400 - CRLF stripped from prompt (#958) - default enabled=true (absent field) - default timezone=UTC (absent field) - explicit enabled=false - INSERT DB error → 500 - next_run_at returned in 201 response Update: - cron change → SELECT current + UPDATE with recomputed next_run_at - timezone change → SELECT current + UPDATE with recomputed next_run_at - invalid timezone → 400 - invalid cron → 400 - schedule not found → 404 - UPDATE DB error → 500 - prompt CRLF stripped on update (#958) Delete: - success → 200 - not found (IDOR) → 404 - DELETE DB error → 500 RunNow: - success → 200 with workspace_id + prompt - not found → 404 - SELECT DB error → 500 History: - empty result → 200 [] - query error → 500 - multiple entries with error_detail (#152) Closes #980 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-14 12:39:57 +00:00
devops-engineer	5b554f8afe	Merge pull request 'fix(canvas): add focus-visible rings to icon/text buttons — WCAG 2.1 AA' (#988) from fix/986-canvas-wcag-focus-rings into staging	2026-05-14 12:39:03 +00:00
devops-engineer	8b1c867ff0	Merge pull request 'channels: add SendAdapter injection + handler test coverage for Test and Send' (#994) from fix/993-agent-handler-test-coverage into staging	2026-05-14 12:36:15 +00:00
devops-engineer	591d166179	Merge pull request 'fix(handlers): remove duplicate test declarations — same fixes as PR #971' (#983) from fix/982-expand-posix-identifier-guard into staging	2026-05-14 12:35:32 +00:00