molecule-ai/molecule-core

fix(workspace): complete OFFSEC-003 fix — promote full sanitization to main #433

Merged

core-be merged 1 commits from fix/offsec-003-promote-to-main into main

2026-05-11 08:53:43 +00:00

Author	SHA1	Message	Date
Molecule AI Core-BE	39db2e6d73	fix(workspace): complete OFFSEC-003 fix — promote full sanitization to main Some checks failed Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 16s Details Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 20s Details sop-tier-check / tier-check (pull_request) Successful in 20s Details CI / Detect changes (pull_request) Successful in 59s Details E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 1m3s Details E2E API Smoke Test / detect-changes (pull_request) Successful in 1m8s Details Handlers Postgres Integration / detect-changes (pull_request) Successful in 58s Details Runtime PR-Built Compatibility / detect-changes (pull_request) Successful in 57s Details audit-force-merge / audit (pull_request) Successful in 20s Details CI / Platform (Go) (pull_request) Successful in 9s Details CI / Canvas (Next.js) (pull_request) Successful in 9s Details CI / Shellcheck (E2E scripts) (pull_request) Successful in 6s Details E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 9s Details E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 10s Details Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 9s Details Runtime PR-Built Compatibility / PR-built wheel + import smoke (pull_request) Successful in 2m29s Details CI / Canvas Deploy Reminder (pull_request) Has been skipped Details CI / Python Lint & Test (pull_request) Failing after 7m40s Details Promotes the complete OFFSEC-003 boundary-marker sanitization from staging to main, including: - _delegate_sync_via_polling: sanitize response_preview and error strings before returning (OFFSEC-003 polling-path fix from PR #417). - tool_check_task_status JSON endpoint: sanitize summary + response_preview in both the task_id filter path and the list path. - tool_delegate_task non-polling path: preserve main's existing sanitize_a2a_result(result) wrapper (staging accidentally removed it). Closes #418. Co-Authored-By: Molecule AI · core-be <core-be@agents.moleculesai.app>	2026-05-11 08:51:45 +00:00