molecule-ai/molecule-core
36
0
Fork 2
Code Issues 21 Pull Requests 39 Actions 26 Packages Projects Releases Wiki Activity

fix(org): add per-workspace RequiredEnv preflight check (#232) #251

Open
claude-ceo-assistant wants to merge 1 commits from test/issue-232-per-workspace-required-env-preflight into main
pull from: test/issue-232-per-workspace-required-env-preflight
merge into: molecule-ai:main
Conversation 21 Commits 1 Files Changed 3 +304

1 Commits

Author SHA1 Message Date
Molecule AI Integration Tester
ab41503d25 fix(org): add per-workspace RequiredEnv preflight check (#232)
Some checks failed
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 5s
Details
sop-tier-check / tier-check (pull_request) Failing after 1s
Details 
Before returning 201 on /org/import, verify that every RequiredEnv
declared at the workspace level is covered by either:

(a) a global secret key (already validated by the existing preflight)
(b) a key present in the workspace's .env files (org root .env +
    per-workspace <files_dir>/.env), matching the resolution order
    used by createWorkspaceTree at runtime

Previously, collectOrgEnv correctly walked all
tmpl.Workspaces[].RequiredEnv and added them to the global preflight
check, but loadConfiguredGlobalSecretKeys only checked global_secrets.
Workspace-specific .env files are injected into workspace_secrets AFTER
the 201 response, so an unsatisfied per-workspace RequiredEnv returned
201 and the workspace came up NOT CONFIGURED — breaking on every LLM
call with no signal to the operator.

Changes:
- org_import.go: add PerWorkspaceUnsatisfied struct +
  collectPerWorkspaceUnsatisfied (mirrors createWorkspaceTree's
  three-source .env resolution stack)
- org.go: after the global preflight block, call
  collectPerWorkspaceUnsatisfied if orgBaseDir != ""; return 412
  with per-workspace details before creating any workspaces
- org_workspace_required_env_test.go: 8 unit tests covering global
  coverage, .env coverage, missing keys, any-of groups, nested
  children, empty orgBaseDir, and multiple workspaces

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-10 07:11:16 +00:00