molecule-ai/molecule-core
41
0
Fork 2
Code Issues 44 Pull Requests 8 Actions 674 Packages Projects Releases Wiki Activity

fix(workspace): restore _sanitize_for_external and stderr parameter (CWE-117, closes #471) #517

Closed
core-lead wants to merge 2 commits from fix/471-cwe117-stderr-scrubbing into main
pull from: fix/471-cwe117-stderr-scrubbing
merge into: molecule-ai:main
Conversation 11 Commits 2 Files Changed 4 +155 -9

2 Commits

Author SHA1 Message Date
Molecule AI Core-DevOps
8a740933c5 fix(tests): correct test_sanitize_agent_error_stderr_and_exc assertion
Some checks failed
audit-force-merge / audit (pull_request) Has been skipped
Details
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 19s
Details
E2E Staging SaaS (full lifecycle) / E2E Staging SaaS (pull_request) Has been skipped
Details
Harness Replays / detect-changes (pull_request) Successful in 20s
Details
Lint curl status-code capture / Scan workflows for curl status-capture pollution (pull_request) Successful in 16s
Details
publish-runtime-autobump / bump-and-tag (pull_request) Has been skipped
Details
CI / Detect changes (pull_request) Successful in 1m1s
Details
E2E API Smoke Test / detect-changes (pull_request) Successful in 56s
Details
E2E Staging SaaS (full lifecycle) / pr-validate (pull_request) Successful in 1m0s
Details
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 1m3s
Details
Handlers Postgres Integration / detect-changes (pull_request) Successful in 1m1s
Details
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 26s
Details
publish-runtime-autobump / pr-validate (pull_request) Successful in 59s
Details
qa-review / approved (pull_request) Failing after 27s
Details
security-review / approved (pull_request) Failing after 25s
Details
gate-check-v3 / gate-check (pull_request) Successful in 38s
Details
sop-tier-check / tier-check (pull_request) Successful in 25s
Details
Runtime PR-Built Compatibility / detect-changes (pull_request) Successful in 1m14s
Details
Harness Replays / Harness Replays (pull_request) Successful in 10s
Details
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Successful in 10s
Details
CI / Shellcheck (E2E scripts) (pull_request) Successful in 25s
Details
Runtime PR-Built Compatibility / PR-built wheel + import smoke (pull_request) Successful in 3m24s
Details
E2E API Smoke Test / E2E API Smoke Test (pull_request) Failing after 6m14s
Details
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Successful in 7m19s
Details
CI / Python Lint & Test (pull_request) Successful in 8m10s
Details
CI / Platform (Go) (pull_request) Failing after 13m48s
Details
CI / Canvas (Next.js) (pull_request) Failing after 13m47s
Details
CI / Canvas Deploy Reminder (pull_request) Has been skipped
Details 
The test expected the exception class to be hidden when stderr is provided,
but the implementation always uses the exc type as the tag. Fix the
assertion to match actual (correct) behavior: ValueError is in the tag,
stderr is the body. Also add a check that we don't fall back to the
generic "workspace logs" form.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-11 18:21:47 +00:00
Molecule AI Fullstack Engineer
712d71aced fix(workspace): include ~1KB sanitized stderr in A2A error responses 
Adds an optional `stderr` parameter to sanitize_agent_error(). When
provided, up to 1 KB of stderr text is included in the A2A error
response after sanitization (API keys / bearer tokens ≥20 chars /
long paths redacted). The existing generic form is preserved when
stderr is absent. Updates both the main a2a_executor and the google-adk
adapter.

Closes: roadmap item — SDK executor stderr swallowing.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
 2026-05-11 18:21:47 +00:00