2492f8c806
Integrates github.com/Molecule-AI/molecule-ai-plugin-github-app-auth. When GITHUB_APP_ID is set, the platform constructs a plugin Authenticator at boot and registers it as an EnvMutator on the WorkspaceHandler. Every workspace provision then gets a fresh GITHUB_TOKEN / GH_TOKEN injected from the App's installation token (rotates ~hourly, refresh 5 min before expiry). Verified live this turn: - Platform boot log: `github-app-auth: registered, 1 mutator(s) in chain` - `docker exec ws-<id> gh auth status` → `Logged in as molecule-ai[bot] (GH_TOKEN)` - `gh issue list --repo Molecule-AI/molecule-core` returns real data (Hermes #498/#499/#500 visible from inside a workspace container) ## Changes - platform/go.mod + go.sum: new dep on the plugin - platform/cmd/server/main.go: import + conditional registration (soft-skip when GITHUB_APP_ID is unset for self-hosted/dev) - docker-compose.yml: pass GITHUB_APP_* env + bind-mount private key ## Drive-by .gitignore: exclude /org-templates /plugins /workspace-configs-templates — these dirs are populated locally by clone-manifest.sh from the standalone repos, should never be committed to core. Without this rule my previous git add -A staged 33 embedded git dirs. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
126 lines
2.0 KiB
Plaintext
126 lines
2.0 KiB
Plaintext
# Binaries
|
|
platform/server
|
|
platform/molecli
|
|
*.exe
|
|
*.out
|
|
*.bin
|
|
|
|
# Go
|
|
*.test
|
|
|
|
# Dependencies
|
|
node_modules/
|
|
|
|
# Build output
|
|
dist/
|
|
**/.next/
|
|
canvas/tsconfig.tsbuildinfo
|
|
canvas/next-env.d.ts
|
|
mcp-server/dist/
|
|
|
|
# Environment & secrets
|
|
.env
|
|
.env.local
|
|
.env.*.local
|
|
.env.production
|
|
|
|
# OS
|
|
.DS_Store
|
|
Thumbs.db
|
|
|
|
# IDE
|
|
.vscode/
|
|
.idea/
|
|
*.swp
|
|
*.swo
|
|
*~
|
|
|
|
# Python
|
|
__pycache__/
|
|
*.pyc
|
|
*.pyo
|
|
.venv/
|
|
venv/
|
|
*.egg-info/
|
|
.pytest_cache/
|
|
|
|
# Docker
|
|
*.log
|
|
|
|
# Local docker-compose overrides (per-developer port remaps, etc.)
|
|
docker-compose.override.yml
|
|
docker-compose.override.yaml
|
|
|
|
# Test / coverage
|
|
coverage/
|
|
.coverage
|
|
.coverage.*
|
|
.nyc_output/
|
|
test-results/
|
|
playwright-report/
|
|
|
|
# Databases (local dev)
|
|
*.db
|
|
*.sqlite
|
|
*.sqlite3
|
|
|
|
# Langfuse / ClickHouse / Docker volumes
|
|
langfuse_data/
|
|
clickhouse_data/
|
|
postgres_data/
|
|
redis_data/
|
|
|
|
# Auth tokens
|
|
.auth-token
|
|
|
|
# Awareness memory (local agent memory, not project code)
|
|
.awareness/
|
|
|
|
# Claude Code worktrees and runtime artifacts
|
|
.claude/worktrees/
|
|
.claude/scheduled_tasks.lock
|
|
.claude/audit.jsonl
|
|
.claude/freeze
|
|
.claude/judge-subagents
|
|
.claude/per-tick-reflections.md
|
|
|
|
# Workspace instance configs (auto-generated by provisioner, not templates)
|
|
workspace-configs-templates/ws-*
|
|
|
|
# Local dev cruft — provisioner writes here at runtime; templates live at repo root
|
|
platform/workspace-configs-templates/
|
|
|
|
# Codex/Gemini agent skill cache (local only, not authoritative)
|
|
.agents/
|
|
|
|
# Workspace runtime markers (written by agent containers, not committed)
|
|
.initial_prompt_done
|
|
|
|
# Exported bundles (may contain env vars / secrets)
|
|
*.bundle.json
|
|
|
|
# Logs
|
|
logs/
|
|
|
|
# Backups
|
|
backups/
|
|
docs/.vitepress/dist/
|
|
.claude-bridge/
|
|
org-templates/**/.env
|
|
org-templates/**/.auth-token
|
|
|
|
# Migration additions (2026-04-13)
|
|
.initial_prompt_done
|
|
.claude-bridge/
|
|
.claude/scheduled_tasks.json
|
|
|
|
# GitHub App private key + other local-only secrets — never committed.
|
|
.secrets/
|
|
*.pem
|
|
|
|
# Cloned-via-manifest dirs — populated locally by scripts/clone-manifest.sh,
|
|
# tracked in their own standalone repos. Never commit to core.
|
|
/org-templates/
|
|
/plugins/
|
|
/workspace-configs-templates/
|