fix(P0): CWE-22 path traversal + ContextMenu test regression - #1476

Merged

molecule-ai[bot] merged 18 commits into

stagingfrom

fix/P0-cwe22-path-traversal-1434-and-canvas-test-1422

Apr 21, 2026

Commits on Apr 21, 2026

feat(workspace): pre-stop serialization for pause/resume (closes #1386)

authored and
Molecule AI Controlplane Lead
committed
26f18a1
chore: PM-triggered CI re-run

molecule-ai[bot]
authored and
Molecule AI Controlplane Lead
committed
cd96e4a
chore: force Platform(Go) CI run on main — validate go vet clean

authored and
Molecule AI Controlplane Lead
committed
6f9d5b9
feat(e2e): staging full-SaaS workflow — per-run org provision + leak-free teardown

authored and
Molecule AI Controlplane Lead
committed
e6b40b2
feat(e2e): canary + canvas Playwright workflows; delegation mechanics

authored and
Molecule AI Controlplane Lead
committed
0ea0918
feat(e2e): pivot to admin-bearer-only auth + add sanity self-check workflow

authored and
Molecule AI Controlplane Lead
committed
92277e1
fix(e2e): CP DELETE /cp/admin/tenants body uses 'confirm', not 'confirm_token'

authored and
Molecule AI Controlplane Lead
committed
c2daceb
fix(e2e): poll instance_status not status in staging harness

authored and
Molecule AI Controlplane Lead
committed
a9376d6
fix(e2e): derive tenant domain from CP URL (staging vs prod)

authored and
Molecule AI Controlplane Lead
committed
cb7d6f8
fix(e2e): send X-Molecule-Org-Id on tenant calls

authored and
Molecule AI Controlplane Lead
committed
81a5e5e
fix(e2e): safety-net teardown only sweeps this run's orgs

authored and
Molecule AI Controlplane Lead
committed
6e2170b
fix(tenant-image): remove node user so canvas uid 1000 can be created

authored and
Molecule AI Controlplane Lead
committed
a06dd0e
research: add crewai-competitive-proof-points-brief.md

molecule-ai[bot]
authored and
Molecule AI Controlplane Lead
committed
70dfb21
research: add enterprise-case-study-legal-clearance-brief.md

molecule-ai[bot]
authored and
Molecule AI Controlplane Lead
committed
f7a8b8f
research: add enterprise-case-study-pipeline-targeting-brief.md

molecule-ai[bot]
authored and
Molecule AI Controlplane Lead
committed
3aebc1e
fix(P0): CWE-22 path traversal in copyFilesToContainer + ContextMenu test

authored and
Molecule AI Controlplane Lead
committed
6752187
fix(core): resolve main build — remove duplicate SSRF function declarations

authored and
Molecule AI Controlplane Lead
committed
d43d1b3
fix(P0): CWE-22 path traversal in copyFilesToContainer + ContextMenu test

authored and
Molecule AI Controlplane Lead
committed
b0eb56e

Navigation Menu

Uh oh!

fix(P0): CWE-22 path traversal + ContextMenu test regression - #1476

fix(P0): CWE-22 path traversal + ContextMenu test regression#1476
molecule-ai[bot] merged 18 commits into
stagingfrom
fix/P0-cwe22-path-traversal-1434-and-canvas-test-1422

Commits on Apr 21, 2026

feat(workspace): pre-stop serialization for pause/resume (closes #1386)

chore: PM-triggered CI re-run

chore: force Platform(Go) CI run on main — validate go vet clean

feat(e2e): staging full-SaaS workflow — per-run org provision + leak-free teardown

feat(e2e): canary + canvas Playwright workflows; delegation mechanics

feat(e2e): pivot to admin-bearer-only auth + add sanity self-check workflow

fix(e2e): CP DELETE /cp/admin/tenants body uses 'confirm', not 'confirm_token'

fix(e2e): poll instance_status not status in staging harness

fix(e2e): derive tenant domain from CP URL (staging vs prod)

fix(e2e): send X-Molecule-Org-Id on tenant calls

fix(e2e): safety-net teardown only sweeps this run's orgs

fix(tenant-image): remove node user so canvas uid 1000 can be created

research: add crewai-competitive-proof-points-brief.md

research: add enterprise-case-study-legal-clearance-brief.md

research: add enterprise-case-study-pipeline-targeting-brief.md

fix(P0): CWE-22 path traversal in copyFilesToContainer + ContextMenu test

fix(core): resolve main build — remove duplicate SSRF function declarations

fix(P0): CWE-22 path traversal in copyFilesToContainer + ContextMenu test