molecule-core/workspace-server/internal
Molecule AI Fullstack Engineer 1a4d012383
Some checks failed
Block internal-flavored paths / Block forbidden paths (pull_request) Successful in 24s
CI / Detect changes (pull_request) Successful in 56s
E2E API Smoke Test / detect-changes (pull_request) Successful in 35s
E2E Staging SaaS (full lifecycle) / E2E Staging SaaS (pull_request) Has been skipped
E2E Staging Canvas (Playwright) / detect-changes (pull_request) Successful in 44s
E2E Staging SaaS (full lifecycle) / pr-validate (pull_request) Successful in 46s
Handlers Postgres Integration / detect-changes (pull_request) Successful in 43s
Harness Replays / detect-changes (pull_request) Successful in 13s
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 15s
Runtime PR-Built Compatibility / detect-changes (pull_request) Successful in 35s
qa-review / approved (pull_request) Failing after 17s
gate-check-v3 / gate-check (pull_request) Successful in 26s
security-review / approved (pull_request) Failing after 16s
sop-checklist / all-items-acked (pull_request) Successful in 18s
sop-tier-check / tier-check (pull_request) Successful in 16s
lint-required-no-paths / lint-required-no-paths (pull_request) Successful in 1m12s
CI / Shellcheck (E2E scripts) (pull_request) Successful in 7s
E2E Staging External Runtime / E2E Staging External Runtime (pull_request) Failing after 2m10s
CI / Python Lint & Test (pull_request) Successful in 8s
CI / Platform (Go) (pull_request) Failing after 24s
E2E API Smoke Test / E2E API Smoke Test (pull_request) Successful in 1m48s
Harness Replays / Harness Replays (pull_request) Successful in 6s
Runtime PR-Built Compatibility / PR-built wheel + import smoke (pull_request) Successful in 8s
CI / Canvas (Next.js) (pull_request) Failing after 5m54s
CI / Canvas Deploy Reminder (pull_request) Has been skipped
E2E Staging Canvas (Playwright) / Canvas tabs E2E (pull_request) Failing after 3m15s
Handlers Postgres Integration / Handlers Postgres Integration (pull_request) Failing after 2m27s
CI / all-required (pull_request) Failing after 5s
fix(provisioner): skip symlinks in CopyTemplateToContainer Walk (OFFSEC-010)
filepath.Walk follows symlinks by default. A malicious org template
containing a symlink (e.g. template/.ssh → /root/.ssh) could escape
the intended directory and include arbitrary host files in the tar
archive copied into workspace containers.

Fix: skip symlinks in the Walk callback. Broken template symlinks
are a silent no-op rather than an error, matching the security-
first posture (no escalation on unexpected input).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-14 18:26:47 +00:00
..
artifacts chore: sync staging to main — 1188 commits, 5 conflicts resolved (#1743) 2026-04-23 18:30:18 +00:00
buildinfo feat(deploy): verify each tenant /buildinfo matches published SHA after redeploy 2026-04-30 10:55:08 -07:00
bundle refactor(events): migrate 18 files to typed EventType constants (RFC #2945 PR-B-1) 2026-05-05 19:05:03 -07:00
channels fix(platform): clear golangci-lint findings 2026-05-12 22:53:22 -07:00
crypto chore: open-source restructure — rename dirs, remove internal files, scrub secrets 2026-04-18 00:24:44 -07:00
db fix(bundle): markFailed sets last_sample_error + AST gate 2026-05-04 21:08:08 -07:00
envx chore: open-source restructure — rename dirs, remove internal files, scrub secrets 2026-04-18 00:24:44 -07:00
events fix(platform): clear golangci-lint findings 2026-05-12 22:53:22 -07:00
handlers fix: harden saas workspace provisioning config 2026-05-14 10:26:27 -07:00
imagewatch fix(workspace-server): respect MOLECULE_IMAGE_REGISTRY in imagewatch + admin_workspace_images (RFC #229 P2-4) 2026-05-10 04:21:27 -07:00
memory fix(go): remove ineffectual pgplugin index increment 2026-05-13 14:32:41 -07:00
messagestore feat(canvas/chat-server): canvas consumes /chat-history + server-side row-aware reverse (RFC #2945 PR-C-2) 2026-05-06 16:55:00 -07:00
metrics feat(rfc): poll-mode chat upload — phase 3 GC sweep + observability 2026-05-05 05:00:13 -07:00
middleware fix(platform): clear golangci-lint findings 2026-05-12 22:53:22 -07:00
models refactor(models): consolidate per-runtime model defaults to SSOT (RFC #2873 iter 1) 2026-05-05 04:12:37 -07:00
orgtoken fix: F1085 rm scope concat + GH#756 ValidateToken terminal guard + CI test fixes 2026-04-24 07:16:54 +00:00
pendinguploads fix(pendinguploads): accept done channel in StartSweeperWithIntervalForTest 2026-05-11 21:15:49 +00:00
plugins fix(platform): clear golangci-lint findings 2026-05-12 22:53:22 -07:00
provisioner fix(provisioner): skip symlinks in CopyTemplateToContainer Walk (OFFSEC-010) 2026-05-14 18:26:47 +00:00
provlog feat(workspace-server): structured logging at provisioning boundaries 2026-05-05 12:30:11 -07:00
registry handlers/internal: fix db.DB pollution in registry and scheduler test helpers 2026-05-14 12:58:03 +00:00
router [core-lead-agent] fix(core#228): cascade fixes for PluginResolver — make main compile 2026-05-10 09:46:35 +00:00
scheduler handlers/internal: fix db.DB pollution in registry and scheduler test helpers 2026-05-14 12:58:03 +00:00
supervised chore: open-source restructure — rename dirs, remove internal files, scrub secrets 2026-04-18 00:24:44 -07:00
textutil fix(textutil): SSOT for rune-safe string truncation, fix 3 audit-gap bugs 2026-05-05 23:01:21 -07:00
ws chore: drop org_layout_test, hub.go, hub_test.go (already in staging with better coverage) 2026-05-13 18:04:00 +00:00
wsauth perf(wsauth): in-process cache for platform_inbound_secret reads 2026-05-03 00:04:38 -07:00