molecule-core

molecule-ai/molecule-core

Fork 2

Commit Graph

Author	SHA1	Message	Date
molecule-ai[bot]	d3a9bc841e	fix(security): plugin supply chain hardening — SAFE-T1102 (#768 ) Add two defenses against malicious plugins from uncontrolled sources: 1. Pinned-ref enforcement (resolveAndStage): github:// install/download specs without a #<tag/sha> suffix are now rejected with HTTP 422. A mutable default-branch tip could change between audit and install, silently swapping in untrusted code. Override via PLUGIN_ALLOW_UNPINNED=true. 2. SHA-256 content integrity (installRequest.sha256): callers may supply the expected hex SHA-256 of the fetched plugin.yaml. When present, resolveAndStage verifies the digest after staging; a mismatch aborts the install with HTTP 422 and cleans up the staging dir. Updated TestPluginDownload_GithubSchemeStreamsTarball to use a pinned ref (#v1.0.0) so it reflects the new security requirement. Tests: 4 new (TestPluginInstall_SHA256Mismatch_AbortsInstall, TestPluginInstall_SHA256Match_Succeeds, TestPluginInstall_UnpinnedRef_Rejected, TestPluginInstall_PinnedRef_Accepted). All 15 packages green. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-17 16:37:45 +00:00
Hongming Wang	24fec62d7f	initial commit — Molecule AI platform Forked clean from public hackathon repo (Starfire-AgentTeam, BSL 1.1) with full rebrand to Molecule AI under github.com/Molecule-AI/molecule-monorepo. Brand: Starfire → Molecule AI. Slug: starfire / agent-molecule → molecule. Env vars: STARFIRE_* → MOLECULE_*. Go module: github.com/agent-molecule/platform → github.com/Molecule-AI/molecule-monorepo/platform. Python packages: starfire_plugin → molecule_plugin, starfire_agent → molecule_agent. DB: agentmolecule → molecule. History truncated; see public repo for prior commits and contributor attribution. Verified green: go test -race ./... (platform), pytest (workspace-template 1129 + sdk 132), vitest (canvas 352), build (mcp). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-13 11:55:37 -07:00

Author

SHA1

Message

Date

molecule-ai[bot]

d3a9bc841e

fix(security): plugin supply chain hardening — SAFE-T1102 (#768 )

Add two defenses against malicious plugins from uncontrolled sources:

1. **Pinned-ref enforcement** (resolveAndStage): github:// install/download
   specs without a #<tag/sha> suffix are now rejected with HTTP 422. A
   mutable default-branch tip could change between audit and install,
   silently swapping in untrusted code. Override via PLUGIN_ALLOW_UNPINNED=true.

2. **SHA-256 content integrity** (installRequest.sha256): callers may
   supply the expected hex SHA-256 of the fetched plugin.yaml. When present,
   resolveAndStage verifies the digest after staging; a mismatch aborts the
   install with HTTP 422 and cleans up the staging dir.

Updated TestPluginDownload_GithubSchemeStreamsTarball to use a pinned ref
(#v1.0.0) so it reflects the new security requirement.

Tests: 4 new (TestPluginInstall_SHA256Mismatch_AbortsInstall,
TestPluginInstall_SHA256Match_Succeeds, TestPluginInstall_UnpinnedRef_Rejected,
TestPluginInstall_PinnedRef_Accepted). All 15 packages green.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-17 16:37:45 +00:00

Hongming Wang

24fec62d7f

initial commit — Molecule AI platform

Forked clean from public hackathon repo (Starfire-AgentTeam, BSL 1.1)
with full rebrand to Molecule AI under github.com/Molecule-AI/molecule-monorepo.

Brand: Starfire → Molecule AI.
Slug: starfire / agent-molecule → molecule.
Env vars: STARFIRE_* → MOLECULE_*.
Go module: github.com/agent-molecule/platform → github.com/Molecule-AI/molecule-monorepo/platform.
Python packages: starfire_plugin → molecule_plugin, starfire_agent → molecule_agent.
DB: agentmolecule → molecule.

History truncated; see public repo for prior commits and contributor
attribution. Verified green: go test -race ./... (platform), pytest
(workspace-template 1129 + sdk 132), vitest (canvas 352), build (mcp).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-13 11:55:37 -07:00

2 Commits