Molecule AI Fullstack Engineer 72a48214ee fix(platform): close CWE-59 symlink-traversal gap in resolveInsideRoot (#380) ... Follow-up to #369. `resolveInsideRoot` used `filepath.Abs` which does NOT resolve symlinks — so "workspaces/dev/leaked" where "leaked" is a symlink to "/etc" would lexically pass the prefix check but resolve outside root. Fix: call `filepath.EvalSymlinks` before the final prefix check. If the resolved path points outside root the function returns "path escapes root". Broken symlinks are also rejected (fail closed). Also add TestResolveInsideRoot_RejectsSymlinkTraversal covering: - Symlink pointing outside → rejected (CWE-59) - Symlink staying inside root → allowed - Broken symlink → rejected		2026-05-11 06:26:56 +00:00
..
artifacts	chore: sync staging to main — 1188 commits, 5 conflicts resolved (#1743)	2026-04-23 18:30:18 +00:00
buildinfo	feat(deploy): verify each tenant /buildinfo matches published SHA after redeploy	2026-04-30 10:55:08 -07:00
bundle	refactor(events): migrate 18 files to typed EventType constants (RFC #2945 PR-B-1)	2026-05-05 19:05:03 -07:00
channels	refactor(events): migrate 18 files to typed EventType constants (RFC #2945 PR-B-1)	2026-05-05 19:05:03 -07:00
crypto	chore: open-source restructure — rename dirs, remove internal files, scrub secrets	2026-04-18 00:24:44 -07:00
db	fix(bundle): markFailed sets last_sample_error + AST gate	2026-05-04 21:08:08 -07:00
envx	chore: open-source restructure — rename dirs, remove internal files, scrub secrets	2026-04-18 00:24:44 -07:00
events	feat(events): typed EventType registry — single source of truth for WS event names (RFC #2945 PR-B)	2026-05-05 16:25:38 -07:00
handlers	fix(platform): close CWE-59 symlink-traversal gap in resolveInsideRoot (#380)	2026-05-11 06:26:56 +00:00
imagewatch	fix(workspace-server): respect MOLECULE_IMAGE_REGISTRY in imagewatch + admin_workspace_images (RFC #229 P2-4)	2026-05-10 04:21:27 -07:00
memory	fix(textutil): SSOT for rune-safe string truncation, fix 3 audit-gap bugs	2026-05-05 23:01:21 -07:00
messagestore	feat(canvas/chat-server): canvas consumes /chat-history + server-side row-aware reverse (RFC #2945 PR-C-2)	2026-05-06 16:55:00 -07:00
metrics	feat(rfc): poll-mode chat upload — phase 3 GC sweep + observability	2026-05-05 05:00:13 -07:00
middleware	docs(ratelimit): tighten dev-mode comment after keyFor refactor	2026-05-07 14:57:21 -07:00
models	refactor(models): consolidate per-runtime model defaults to SSOT (RFC #2873 iter 1)	2026-05-05 04:12:37 -07:00
orgtoken	fix: F1085 rm scope concat + GH#756 ValidateToken terminal guard + CI test fixes	2026-04-24 07:16:54 +00:00
pendinguploads	fix(test): poll error counter to 0 before asserting in RecordsMetricsOnSuccess	2026-05-09 23:27:19 +00:00
plugins	[core-lead-agent] fix(core#228): cascade fixes for PluginResolver — make main compile	2026-05-10 09:46:35 +00:00
provisioner	fix(workspace-server): respect MOLECULE_IMAGE_REGISTRY in imagewatch + admin_workspace_images (RFC #229 P2-4)	2026-05-10 04:21:27 -07:00
provlog	feat(workspace-server): structured logging at provisioning boundaries	2026-05-05 12:30:11 -07:00
registry	chore: reconcile main → staging post-suspension divergence	2026-05-07 14:24:37 -07:00
router	[core-lead-agent] fix(core#228): cascade fixes for PluginResolver — make main compile	2026-05-10 09:46:35 +00:00
scheduler	fix(textutil): SSOT for rune-safe string truncation, fix 3 audit-gap bugs	2026-05-05 23:01:21 -07:00
supervised	chore: open-source restructure — rename dirs, remove internal files, scrub secrets	2026-04-18 00:24:44 -07:00
textutil	fix(textutil): SSOT for rune-safe string truncation, fix 3 audit-gap bugs	2026-05-05 23:01:21 -07:00
ws	chore: open-source restructure — rename dirs, remove internal files, scrub secrets	2026-04-18 00:24:44 -07:00
wsauth	perf(wsauth): in-process cache for platform_inbound_secret reads	2026-05-03 00:04:38 -07:00