Merge branch 'main' into fix/plugin-uninstall-exec-errors

Plugin uninstall had two sites where execAsRoot errors were discarded:
- Skill directory removal (plugins_install.go:125) — orphaned skill dirs
  if rm -rf failed silently
- CLAUDE.md marker stripping (plugins_install_pipeline.go:326) — stale
  plugin content left in CLAUDE.md if awk script failed

Both now log the error without failing the overall uninstall (best-effort
 cleanup), giving operators visibility into incomplete uninstalls.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

workspace-server/cmd/server/cp_config.go

@@ -61,8 +61,7 @@ func refreshEnvFromCP() error {
 	req.Header.Set("Authorization", "Bearer "+adminToken)
 	req.Header.Set("X-Molecule-Org-Id", orgID)
 
-	client := &http.Client{Timeout: 10 * time.Second}
-	resp, err := client.Do(req)
+	resp, err := http.DefaultClient.Do(req)
 	if err != nil {
 		return fmt.Errorf("do request: %w", err)
 	}

workspace-server/internal/bundle/importer.go

@@ -89,11 +89,6 @@ func Import(
 			// PluginsPath set by caller if available
 		}
 		go func() {
-			defer func() {
-				if r := recover(); r != nil {
-					log.Printf("bundle/importer: PANIC during provision start for %s: %v", wsID, r)
-				}
-			}()
 			provCtx, cancel := context.WithTimeout(context.Background(), provisioner.ProvisionTimeout)
 			defer cancel()
 			url, err := prov.Start(provCtx, cfg)

workspace-server/internal/handlers/a2a_proxy.go

@@ -1035,12 +1035,7 @@ func applyIdleTimeout(parent context.Context, b *events.Broadcaster, workspaceID
 	// completed when t.Cleanup fires. Does NOT read db.DB; idle-timer
 	// management only.
 	go func() {
-		defer func() {
-			if r := recover(); r != nil {
-				log.Printf("a2a_proxy: PANIC in SSE idle watcher for %s: %v", workspaceID, r)
-			}
-			unsub()
-		}()
+		defer unsub()
 		timer := time.NewTimer(idle)
 		defer timer.Stop()
 		for {

workspace-server/internal/handlers/discovery.go

@@ -249,7 +249,7 @@ func (h *DiscoveryHandler) Peers(c *gin.Context) {
 	// parent_id-bound branch enumerates siblings, and that is already scoped to
 	// one parent (one tenant).
 	if parentID.Valid {
-		siblings, _ := queryPeerMaps(ctx, `
+		siblings, _ := queryPeerMaps(`
 			SELECT w.id, w.name, COALESCE(w.role, ''), w.tier, w.status,
 				   COALESCE(w.agent_card, 'null'::jsonb), COALESCE(w.url, ''),
 				   w.parent_id, w.active_tasks
@@ -268,7 +268,7 @@ func (h *DiscoveryHandler) Peers(c *gin.Context) {
 	// self-delegation 400 in a tight loop (#383). The `w.id != $2`
 	// clause makes self-delegation-via-peer-list impossible regardless
 	// of DB state.
-	children, _ := queryPeerMaps(ctx, `
+	children, _ := queryPeerMaps(`
 		SELECT w.id, w.name, COALESCE(w.role, ''), w.tier, w.status,
 			   COALESCE(w.agent_card, 'null'::jsonb), COALESCE(w.url, ''),
 			   w.parent_id, w.active_tasks
@@ -281,7 +281,7 @@ func (h *DiscoveryHandler) Peers(c *gin.Context) {
 	// propagate that corruption back to the agent as a "peer who is also
 	// you" entry.
 	if parentID.Valid {
-		parent, _ := queryPeerMaps(ctx, `
+		parent, _ := queryPeerMaps(`
 			SELECT w.id, w.name, COALESCE(w.role, ''), w.tier, w.status,
 				   COALESCE(w.agent_card, 'null'::jsonb), COALESCE(w.url, ''),
 				   w.parent_id, w.active_tasks
@@ -350,8 +350,8 @@ func filterPeersByQuery(peers []map[string]interface{}, q string) []map[string]i
 }
 
 // queryPeerMaps returns clean JSON-serializable maps instead of Workspace structs.
-func queryPeerMaps(ctx context.Context, query string, args ...interface{}) ([]map[string]interface{}, error) {
-	rows, err := db.DB.QueryContext(ctx, query, args...)
+func queryPeerMaps(query string, args ...interface{}) ([]map[string]interface{}, error) {
+	rows, err := db.DB.Query(query, args...)
 	if err != nil {
 		log.Printf("queryPeerMaps error: %v", err)
 		return nil, err

workspace-server/internal/handlers/plugins_install.go

@@ -161,7 +161,7 @@ func (h *PluginsHandler) uninstallViaDocker(ctx context.Context, c *gin.Context,
 	// 1. Strip plugin's rule/fragment markers from CLAUDE.md (mirrors
 	//    AgentskillsAdaptor.uninstall lines 184-188). Best-effort: if
 	//    the user edited CLAUDE.md, our marker stays untouched.
-	h.stripPluginMarkersFromMemory(ctx, containerName, pluginName)
+	h.stripPluginMarkersFromMemory(ctx, workspaceID, containerName, pluginName)
 
 	// 2. Remove copied skill dirs declared in the plugin's plugin.yaml.
 	for _, skill := range skillNames {
@@ -171,9 +171,11 @@ func (h *PluginsHandler) uninstallViaDocker(ctx context.Context, c *gin.Context,
 			log.Printf("Plugin uninstall: skipping invalid skill name %q in %s: %v", skill, pluginName, err)
 			continue
 		}
-		_, _ = h.execAsRoot(ctx, containerName, []string{
+		if _, rmErr := h.execAsRoot(ctx, containerName, []string{
 			"rm", "-rf", "/configs/skills/" + skill,
-		})
+		}); rmErr != nil {
+			log.Printf("Plugin uninstall: failed to remove skill %s from %s: %v", skill, workspaceID, rmErr)
+		}
 	}
 
 	// 3. Delete the plugin directory itself (as root to handle file ownership).

workspace-server/internal/handlers/plugins_install_pipeline.go

@@ -393,7 +393,7 @@ func (h *PluginsHandler) readPluginSkillsFromContainer(ctx context.Context, cont
 // `# Plugin: <name> /` — mirrors AgentskillsAdaptor.uninstall's stripping
 // logic so install/uninstall are symmetric. Best-effort: silent on read or
 // write failure, since the rest of uninstall must still succeed.
-func (h *PluginsHandler) stripPluginMarkersFromMemory(ctx context.Context, containerName, pluginName string) {
+func (h *PluginsHandler) stripPluginMarkersFromMemory(ctx context.Context, workspaceID, containerName, pluginName string) {
 	// Use sed via bash -c for atomic in-place delete: drop the marker line
 	// and the blank line that follows it (install adds a leading blank line
 	// before the marker via append_to_memory). Three sed passes mirror the
@@ -417,7 +417,9 @@ func (h *PluginsHandler) stripPluginMarkersFromMemory(ctx context.Context, conta
 		`awk 'BEGIN{skip=0; blanks=0} /^%s/{skip=1; blanks=0; next} skip==1 && /^[[:space:]]*$/{blanks++; if(blanks>=2){skip=0; print; next} next} /^# Plugin: /{if(skip==1)skip=0} skip==1{next} {print}' /configs/CLAUDE.md > /tmp/claude.new && mv /tmp/claude.new /configs/CLAUDE.md`,
 		regexpEscapeForAwk(marker),
 	)
-	_, _ = h.execAsRoot(ctx, containerName, []string{"bash", "-c", script})
+	if _, awkErr := h.execAsRoot(ctx, containerName, []string{"bash", "-c", script}); awkErr != nil {
+		log.Printf("Plugin uninstall: failed to strip markers from CLAUDE.md for %s in %s: %v", pluginName, workspaceID, awkErr)
+	}
 }
 
 // regexpEscapeForAwk escapes characters that have special meaning inside an

workspace-server/internal/handlers/terminal.go

@@ -217,12 +217,7 @@ func (h *TerminalHandler) handleLocalConnect(c *gin.Context, workspaceID string)
 	// synchronously. No db.DB access on this path.
 	done := make(chan struct{})
 	go func() {
-		defer func() {
-			if r := recover(); r != nil {
-				log.Printf("Terminal: PANIC in stdout bridge: %v", r)
-			}
-			close(done)
-		}()
+		defer close(done)
 		buf := make([]byte, 4096)
 		for {
 			n, err := resp.Reader.Read(buf)
@@ -445,12 +440,7 @@ func (h *TerminalHandler) handleRemoteConnect(c *gin.Context, workspaceID, insta
 	// goAsync-exempt (RFC internal#524 Layer 2.2): WebSocket-lifetime
 	// I/O bridge; handler blocks on `done` below. No db.DB access.
 	go func() {
-		defer func() {
-			if r := recover(); r != nil {
-				log.Printf("Terminal: PANIC in PTY bridge: %v", r)
-			}
-			close(done)
-		}()
+		defer close(done)
 		buf := make([]byte, 4096)
 		for {
 			n, err := ptmx.Read(buf)
@@ -473,11 +463,6 @@ func (h *TerminalHandler) handleRemoteConnect(c *gin.Context, workspaceID, insta
 	// WebSocket → PTY (stdin)
 	// goAsync-exempt (RFC internal#524 Layer 2.2): see above.
 	go func() {
-		defer func() {
-			if r := recover(); r != nil {
-				log.Printf("Terminal: PANIC in stdin loop: %v", r)
-			}
-		}()
 		for {
 			_, msg, rErr := conn.ReadMessage()
 			if rErr != nil {

workspace-server/internal/handlers/workspace.go

@@ -556,7 +556,6 @@ func (h *WorkspaceHandler) Create(c *gin.Context) {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to create workspace"})
 		return
 	}
-	defer func() { _ = tx.Rollback() }()
 
 	maxConcurrent := payload.MaxConcurrentTasks
 	if maxConcurrent <= 0 {

workspace-server/internal/middleware/mcp_ratelimit.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"crypto/sha256"
 	"fmt"
-	"log"
 	"net/http"
 	"strconv"
 	"strings"
@@ -42,11 +41,6 @@ func NewMCPRateLimiter(rate int, interval time.Duration, ctx context.Context) *M
 		interval: interval,
 	}
 	go func() {
-		defer func() {
-			if r := recover(); r != nil {
-				log.Printf("mcp_ratelimit: PANIC in bucket cleanup: %v", r)
-			}
-		}()
 		ticker := time.NewTicker(5 * time.Minute)
 		defer ticker.Stop()
 		for {

workspace-server/internal/middleware/ratelimit.go

@@ -3,7 +3,6 @@ package middleware
 
 import (
 	"context"
-	"log"
 	"net/http"
 	"strconv"
 	"strings"
@@ -36,11 +35,6 @@ func NewRateLimiter(rate int, interval time.Duration, ctx context.Context) *Rate
 		interval: interval,
 	}
 	go func() {
-		defer func() {
-			if r := recover(); r != nil {
-				log.Printf("ratelimit: PANIC in bucket cleanup: %v", r)
-			}
-		}()
 		ticker := time.NewTicker(5 * time.Minute)
 		defer ticker.Stop()
 		for {

workspace-server/internal/middleware/session_auth.go

@@ -116,11 +116,6 @@ func sessionCachePut(key string, ok bool) {
 
 func init() {
 	go func() {
-		defer func() {
-			if r := recover(); r != nil {
-				log.Printf("session_auth: PANIC in cache sweeper: %v", r)
-			}
-		}()
 		// Jitter startup so restarts don't align sweeps.
 		time.Sleep(time.Duration(rand.Int64N(int64(sessionCacheSweepEvery))))
 		t := time.NewTicker(sessionCacheSweepEvery)