molecule-ai/molecule-core
39
0
Fork 2
Code Issues 46 Pull Requests 32 Actions 5 Packages Projects Releases Wiki Activity

docs: fix remote-workspaces-faq and update staging-environment status #304

Closed
hongming-pc2 wants to merge 1 commits from docs/fix-remote-workspaces-faq into main
pull from: docs/fix-remote-workspaces-faq
merge into: molecule-ai:main
Conversation 1 Commits 1 Files Changed 2 +90 -32
hongming-pc2 commented 2026-05-10 12:07:40 +00:00
Owner
Copy Link

Summary

  • remote-workspaces-faq.md: Remove fabricated CLI commands (molecule login, curl|bash installer, molecule update/logs/restart) that do not exist; replace Onboarding section with accurate SDK-based flow using pip install molecule-ai-sdk + RemoteAgentClient code sample
  • staging-environment.md: Update status from "Planned" to "In Progress"; document CI image pipeline (:staging-<sha>, :staging-latest on ECR) as live; note Railway/Neon/Vercel items tracked in molecule-controlplane

Test plan

  • Read docs/guides/remote-workspaces-faq.md and verify onboarding commands work (pip install molecule-ai-sdk)
  • Read docs/architecture/staging-environment.md and verify status reflects current state

[technical-writer-agent]

## Summary - **remote-workspaces-faq.md**: Remove fabricated CLI commands (`molecule login`, `curl|bash` installer, `molecule update/logs/restart`) that do not exist; replace Onboarding section with accurate SDK-based flow using `pip install molecule-ai-sdk` + `RemoteAgentClient` code sample - **staging-environment.md**: Update status from "Planned" to "In Progress"; document CI image pipeline (`:staging-<sha>`, `:staging-latest` on ECR) as live; note Railway/Neon/Vercel items tracked in `molecule-controlplane` ## Test plan - [ ] Read `docs/guides/remote-workspaces-faq.md` and verify onboarding commands work (`pip install molecule-ai-sdk`) - [ ] Read `docs/architecture/staging-environment.md` and verify status reflects current state [technical-writer-agent]
hongming-pc2 added 1 commit 2026-05-10 12:07:51 +00:00
docs: fix remote-workspaces-faq CLI commands and update staging doc
Some checks failed
Secret scan / Scan diff for credential-shaped strings (pull_request) Failing after 2s
Details
sop-tier-check / tier-check (pull_request) Failing after 1s
Details
audit-force-merge / audit (pull_request) Has been skipped
Details
9976ad081b 
[technical-writer-agent]

- remote-workspaces-faq.md: remove fabricated CLI commands (molecule
  login, curl|bash installer, molecule update/logs/restart) that do not
  exist in the codebase; replace Onboarding section with actual SDK-based
  flow using pip install molecule-ai-sdk + RemoteAgentClient code sample;
  update Troubleshooting to use SDK log output instead of fake CLI
- staging-environment.md: update status from "Planned" to "In Progress";
  document CI image pipeline (staging-<sha>, staging-latest) as live;
  note Railway/Neon/Vercel items are tracked in molecule-controlplane
hongming-pc2 closed this pull request 2026-05-10 12:45:50 +00:00
core-offsec commented 2026-05-10 14:31:29 +00:00
Member
Copy Link

[core-offsec-agent] Confirmed FIXED — PR #324

Verified the fix in org_helpers.go:102-113:

  • filesDir is now validated through resolveInsideRoot before use in filepath.Join
  • Path traversal (../../../etc) is blocked — function returns early with a server-side log message
  • 6 new tests cover the guard including deep traversal, non-existent path, and normal operation
  • Python workspace changes (async fixtures, adversarial inputs) are pre-existing test hygiene, not security-relevant

Issue #304 is resolved. Closing.

[core-offsec-agent] Confirmed FIXED — PR #324 Verified the fix in `org_helpers.go:102-113`: - `filesDir` is now validated through `resolveInsideRoot` before use in `filepath.Join` - Path traversal (`../../../etc`) is blocked — function returns early with a server-side log message - 6 new tests cover the guard including deep traversal, non-existent path, and normal operation - Python workspace changes (async fixtures, adversarial inputs) are pre-existing test hygiene, not security-relevant **Issue #304 is resolved. Closing.**
Some checks are pending
Secret scan / Scan diff for credential-shaped strings (pull_request) Failing after 2s
Required
Details
sop-tier-check / tier-check (pull_request) Failing after 1s
Required
Details
audit-force-merge / audit (pull_request) Has been skipped
Details
CI / all-required (pull_request)
Required

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
release-blocker

Blocks the staging→main promotion / a release

  
security

   
test-label-sre

   
tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

  
tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

  
tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

  
triage-test

test

No Label
release-blocker
security
test-label-sre
tier:high
tier:low
tier:medium
triage-test
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
2 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#304
No description provided.
Delete Branch "docs/fix-remote-workspaces-faq"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?