molecule-ai/molecule-core
41
0
Fork 2
Code Issues 103 Pull Requests 157 Actions 208 Packages Projects Releases Wiki Activity
7f3274391e
molecule-core/workspace-template/tests
History
Dev Lead Agent 7f3274391e fix(security): H1 — replace MD5 with SHA-256 in config/skill watchers 
Both watcher.py (ConfigWatcher) and skill_loader/watcher.py
(SkillsWatcher) used hashlib.md5() for file-integrity change detection.
MD5 is collision-prone: a crafted config file could produce the same
hash as a benign one, silently suppressing the hot-reload callback and
preventing agents from picking up legitimate config changes.

Replace hashlib.md5 → hashlib.sha256 in both _hash_file() methods.
Update docstrings, comments, and the type-annotation comment
(rel_path → md5 hex → sha256 hex).

Test update: test_skills_watcher.py — rename helper _md5 → _sha256,
update the hash-length assertion from 32 (MD5) to 64 (SHA-256), and
rename the test from test_hash_file_returns_md5_for_existing_file to
test_hash_file_returns_sha256_for_existing_file. All 25 watcher tests
pass.

Note: H2 (a2a_client.py timeout=None) was already fixed in Cycle 5
(timeout=httpx.Timeout(connect=30.0, read=300.0, ...)) — confirmed by
code review before opening this PR.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-14 07:52:07 +00:00
..
__init__.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
conftest.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_a2a_cli.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_a2a_client.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_a2a_executor.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_a2a_mcp_server.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_a2a_tools_impl.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_a2a_tools_module.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_adapters.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_agent_base_urls.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_agent.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_approval.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_audit.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_awareness_client_full.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_claude_sdk_executor.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_cli_executor.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_common_setup.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_compliance.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_config.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_consolidation.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_coordinator_parent.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_coordinator_routing.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_delegation.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_events.py fix(security): Cycle 5 — auth middleware, injection hardening, skill sandbox 2026-04-14 04:44:42 +00:00
test_executor_helpers.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_first_party_plugins.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_governance.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_heartbeat.py fix(security): Cycle 5 — auth middleware, injection hardening, skill sandbox 2026-04-14 04:44:42 +00:00
test_hermes_adapter.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_hitl.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_main_initial_prompt.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_mcp_memory.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_medo.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_memory.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_molecule_ai_status.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_namespaces.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_openclaw_adapter.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_platform_auth.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_plugins_builtins_drift.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_plugins_builtins.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_plugins_registry.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_plugins.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_preflight.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_prompt.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_qianfan_provider.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_routing_policy.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_sandbox.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_security_scan.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_shared_runtime.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_skills_loader.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_skills_watcher.py fix(security): H1 — replace MD5 with SHA-256 in config/skill watchers 2026-04-14 07:52:07 +00:00
test_telemetry.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_temporal_workflow.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00
test_watcher.py initial commit — Molecule AI platform 2026-04-13 11:55:37 -07:00