molecule-ai/molecule-core
35
0
Fork 2
Code Issues 16 Pull Requests 2 Actions 49 Packages Projects Releases Wiki Activity
28bf11fb85
molecule-core/docs/infra/workspace-terminal.md
Hongming Wang 28bf11fb85 docs(security): move sensitive runbooks to private internal repo 
Three changes to stop ferrying sensitive content through our public
monorepo. All content already imported to Molecule-AI/internal (private)
— see linked PRs below.

Contained full security audit cycle records with CWE references,
file:line pointers to historical vulnerabilities, and severity
ratings. None of that belongs in a public repo.

→ Moved to Molecule-AI/internal/security/incident-log.md (PR #20).
  Monorepo file becomes a 17-line stub pointing at the internal
  location. Future incidents land in the internal file only.

Had AWS account ID `004947743811` and IAM role name
`MoleculeStagingProvisioner` embedded. Even though the fleet
described isn't actually running (see state note), these
identifiers are account-specific and don't belong in public git.

→ Removed both values, replaced with generic references + a pointer
  to Molecule-AI/internal/runbooks/canary-fleet.md (PR #21) where
  the actual identifiers live. Any future rotation touches the
  internal file, no public-git-history rewrite needed.

Contained the full ops runbook: bootstrap script output, per-tenant
SG backfill loop with live SG IDs, customer slug names
(hongmingwang). Useful content but too specific for a public repo.

→ Moved to Molecule-AI/internal/runbooks/workspace-terminal.md
  (PR #22). Monorepo file becomes a 30-line public summary of what
  the feature does + pointers to code, so external readers /
  self-hosters still get the design story.

Marketing briefs, SEO plans, campaign copy, research dossiers, and
internal product designs (hermes-adapter-plan, medo-integration,
cognee-*) are the next batches. See docs policy doc coming next to
set team expectations.

Net removal: ~820 lines from public git going forward.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-22 22:39:23 +00:00

1.6 KiB
Raw Blame History

Workspace Terminal

Full runbook moved to the internal repo on 2026-04-22.

The implementation-level content (EIC bootstrap script output, per-tenant SG backfill commands, tenant-specific identifiers) now lives at Molecule-AI/internal/runbooks/workspace-terminal.md (private — Molecule AI org members only).

What this feature is (public summary)

The canvas Terminal tab opens an interactive shell on a workspace's compute — locally this is a docker exec into the container; in the SaaS tenant path it's an SSH session into the tenant EC2 (or the workspace container running on it) over an EC2 Instance Connect Endpoint. End users see a terminal; no direct public SSH ingress is required.

Tracking: molecule-core#1528 (resolved 2026-04-22).

Where things are

  • Go handler: workspace-server/internal/handlers/terminal.go
  • CP provisioner (EIC endpoint, per-tenant SG): Molecule-AI/molecule-controlplane/internal/provisioner/ec2.go — EICEndpointSGID field
  • Bootstrap script: Molecule-AI/molecule-controlplane/scripts/bootstrap-eic-terminal.sh
  • Detailed ops runbook (internal): Molecule-AI/internal/runbooks/workspace-terminal.md

Why the split: the bootstrap-script output + per-tenant SG ingress backfill commands include AWS resource IDs and tenant slugs that don't belong in a public repo, but the high-level design is useful for external readers + self-hosters.