5cca462843
Three changes that bring the local harness from "covers what staging covers minus the SaaS topology" to "exercises every surface we shipped this session against the prod-shape Dockerfile.tenant image." 1. Drop the /etc/hosts requirement. Replays previously needed `127.0.0.1 harness-tenant.localhost` in /etc/hosts to resolve the cf-proxy. That gated the harness behind a sudo step on every fresh dev box and CI runner. The cf-proxy nginx already routes by Host header (matches production CF tunnel: URL is public, Host carries tenant identity), so the no-sudo path is to target loopback :8080 with `Host: harness-tenant.localhost` set as a header. New `tests/harness/_curl.sh` centralises this — curl_anon / curl_admin / curl_workspace / psql_exec wrappers all set the Host + auth headers automatically. seed.sh, peer-discovery-404.sh, buildinfo-stale-image.sh updated to source it. Legacy /etc/hosts users still work via env-var override. 2. Fix the seed.sh FK regression that blocked DB-side replays. POST /workspaces ignores any `id` in the request body and generates one server-side. seed.sh was minting client-side UUIDs that never reached the workspaces table, so any replay that INSERTed into activity_logs (FK-constrained on workspace_id) failed with the workspace-not-found error. Capture the returned id from the response instead. 3. Two new replays cover the surfaces shipped this session. chat-history.sh — exercises the full SaaS-shape wire that PR #2472 (peer_id filter), #2474 (chat_history client tool), and #2476 (before_ts paging) ride on. 8 phases / 16 assertions: peer_id filter, limit cap, before_ts paging, OR-clause covering both source_id and target_id, malformed peer_id 400, malformed before_ts 400, URL-encoded SQLi-shape rejection. Verified PASS against the live harness. channel-envelope-trust-boundary.sh — exercises PR #2471 + #2481 by importing from `molecule_runtime.*` (the wheel-rewritten path) so it catches "wheel build dropped a fix that unit tests still pass." 5 phases / 11 assertions: malicious peer_id scrubbed from envelope, agent_card_url omitted on validation failure, XML-injection bytes scrubbed, valid UUID preserved, _agent_card_url_for direct gate. Verified PASS against published wheel 0.1.79. run-all-replays.sh auto-discovers — no registration needed. Full lifecycle (boot → seed → 4 replays → teardown) runs clean. Roadmap section updated to reflect Phase 1 (this PR) → Phase 2 (multi-tenant + CI gate) → Phase 3 (real CP) → Phase 4 (Miniflare + LocalStack + traffic replay). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
150 lines
3.1 KiB
Plaintext
150 lines
3.1 KiB
Plaintext
# Binaries
|
|
workspace-server/server
|
|
workspace-server/molecli
|
|
*.exe
|
|
*.out
|
|
*.bin
|
|
|
|
# Go
|
|
*.test
|
|
|
|
# Dependencies
|
|
node_modules/
|
|
|
|
# Build output
|
|
dist/
|
|
**/.next/
|
|
canvas/tsconfig.tsbuildinfo
|
|
canvas/next-env.d.ts
|
|
mcp-server/dist/
|
|
|
|
# Environment & secrets
|
|
.env
|
|
.env.local
|
|
.env.*.local
|
|
.env.production
|
|
|
|
# OS
|
|
.DS_Store
|
|
Thumbs.db
|
|
|
|
# IDE
|
|
.vscode/
|
|
.idea/
|
|
*.swp
|
|
*.swo
|
|
*~
|
|
|
|
# Python
|
|
__pycache__/
|
|
*.pyc
|
|
*.pyo
|
|
.venv/
|
|
venv/
|
|
*.egg-info/
|
|
.pytest_cache/
|
|
|
|
# Brand monitor runtime state (never commit)
|
|
brand-monitor/.surge_state.json
|
|
brand-monitor/.monitor_state.json
|
|
|
|
# Docker
|
|
*.log
|
|
|
|
# Local docker-compose overrides (per-developer port remaps, etc.)
|
|
docker-compose.override.yml
|
|
docker-compose.override.yaml
|
|
|
|
# Test / coverage
|
|
coverage/
|
|
.coverage
|
|
.coverage.*
|
|
.nyc_output/
|
|
test-results/
|
|
playwright-report/
|
|
|
|
# Databases (local dev)
|
|
*.db
|
|
*.sqlite
|
|
*.sqlite3
|
|
|
|
# Langfuse / ClickHouse / Docker volumes
|
|
langfuse_data/
|
|
clickhouse_data/
|
|
postgres_data/
|
|
redis_data/
|
|
|
|
# Auth tokens
|
|
.auth-token
|
|
|
|
# Awareness memory (local agent memory, not project code)
|
|
.awareness/
|
|
|
|
# Claude Code (local agent config — not shared)
|
|
.claude/
|
|
CLAUDE.md
|
|
.mcp.json
|
|
test-results/
|
|
|
|
# Workspace instance configs (auto-generated by provisioner, not templates)
|
|
workspace-configs-templates/ws-*
|
|
|
|
# Local dev cruft — provisioner writes here at runtime; templates live at repo root
|
|
workspace-server/workspace-configs-templates/
|
|
|
|
# Codex/Gemini agent skill cache (local only, not authoritative)
|
|
.agents/
|
|
|
|
# Workspace runtime markers (written by agent containers, not committed)
|
|
.initial_prompt_done
|
|
|
|
# Exported bundles (may contain env vars / secrets)
|
|
*.bundle.json
|
|
|
|
# Logs
|
|
logs/
|
|
|
|
# Backups
|
|
backups/
|
|
.claude-bridge/
|
|
|
|
# Migration additions
|
|
.initial_prompt_done
|
|
|
|
# GitHub App private key + other local-only secrets — never committed.
|
|
.secrets/
|
|
*.pem
|
|
|
|
# Cloned-via-manifest dirs — populated locally by scripts/clone-manifest.sh,
|
|
# tracked in their own standalone repos. Never commit to core.
|
|
# org-templates live in Molecule-AI/molecule-ai-org-template-* repos
|
|
# (including molecule-dev — no checkin exception).
|
|
# plugins live in Molecule-AI/molecule-ai-plugin-* repos.
|
|
# All three directories are populated by scripts/clone-manifest.sh
|
|
# (now auto-run by infra/scripts/setup.sh). The in-tree exception for
|
|
# molecule-dev was removed because the checked-in copy drifted from
|
|
# the standalone repo and shipped with broken !include references to
|
|
# role files that never existed in the snapshot.
|
|
/org-templates/
|
|
/plugins/
|
|
/workspace-configs-templates/
|
|
# Cloned by publish-workspace-server-image.yml so the Dockerfile's
|
|
# replace-directive path resolves. Lives in its own repo.
|
|
/molecule-ai-plugin-github-app-auth/
|
|
|
|
# Internal-flavored content lives in Molecule-AI/internal — NEVER in this
|
|
# public monorepo. Migrated 2026-04-23 (CEO directive). The CI workflow
|
|
# .github/workflows/block-internal-paths.yml enforces this; this gitignore
|
|
# is the second line of defence so accidental local writes don't reach a
|
|
# commit. See docs/internal-content-policy.md for the full rationale.
|
|
/research/
|
|
/marketing/
|
|
/docs/marketing/
|
|
# Common temp/scratch patterns agents have produced
|
|
/comment-*.json
|
|
*-temp.md
|
|
*-temp.txt
|
|
/test-pmm-*.txt
|
|
/tick-reflections-*.md
|
|
tests/harness/cp-stub/cp-stub
|