fix(core): consolidate 3 security fixes — CWE-22/CWE-78/SSRF dedup - #1497

Closed

molecule-ai[bot] wants to merge 31 commits into

stagingfrom

fix/security-v3-main

Commits on Apr 21, 2026

feat(e2e): staging full-SaaS workflow — per-run org provision + leak-free teardown

Hongming Wang
and
claude
committed
187a9bf
feat(e2e): canary + canvas Playwright workflows; delegation mechanics

Hongming Wang
and
claude
committed
f470085
feat(e2e): pivot to admin-bearer-only auth + add sanity self-check workflow

Hongming Wang
and
claude
committed
d7193df
fix(e2e): CP DELETE /cp/admin/tenants body uses 'confirm', not 'confirm_token'

Hongming Wang
and
claude
committed
6bd674e
Merge pull request #1355 from Molecule-AI/staging

molecule-ai[bot]
and
claude
authored
7dd66c9
feat(workspace): pre-stop serialization for pause/resume (closes #1386)

authored
4675402
fix(e2e): poll instance_status not status in staging harness

Hongming Wang
and
claude
committed
a510573
fix(e2e): derive tenant domain from CP URL (staging vs prod)

Hongming Wang
and
claude
committed
37a02d6
fix(e2e): send X-Molecule-Org-Id on tenant calls

Hongming Wang
and
claude
committed
e9d111d
fix(e2e): safety-net teardown only sweeps this run's orgs

Hongming Wang
and
claude
committed
81c4c02
chore: PM-triggered CI re-run
molecule-ai[bot]
authored
f2583c2
chore: force Platform(Go) CI run on main — validate go vet clean

molecule-ai[bot]
and
PM
authored
a49a7e0
fix(tenant-image): remove node user so canvas uid 1000 can be created

Hongming Wang
and
claude
committed
3fe90d1
Merge pull request #1445 from Molecule-AI/fix/tenant-dockerfile-uid-conflict
HongmingWang-Rabbit
authored
a14cf86
research: add crewai-competitive-proof-points-brief.md
molecule-ai[bot]
authored
f376c83
research: add enterprise-case-study-legal-clearance-brief.md
molecule-ai[bot]
authored
6f470d0
research: add enterprise-case-study-pipeline-targeting-brief.md
molecule-ai[bot]
authored
deeea0d
fix(P0): CWE-22 path traversal in copyFilesToContainer + ContextMenu test

authored
38e9eba
fix(core): resolve main build — remove duplicate SSRF function declarations

Molecule AI Core Platform Lead
and
claude
committed
8f8be17
Merge pull request #1469 from Molecule-AI/fix/main-build-dedupe-ssrf
molecule-ai[bot]
authored
d86b8fe
fix(e2e): inject OPENAI_API_KEY into workspace secrets

Hongming Wang
and
claude
committed
5be20ac
fix(e2e): set MODEL_PROVIDER=openai for Hermes runtime

Hongming Wang
and
claude
committed
392282c
fix(e2e): MODEL_PROVIDER is provider:model slug, not just provider

Hongming Wang
and
claude
committed
b8b3d5c
fix(e2e): delegation raw curl missing X-Molecule-Org-Id

Hongming Wang
and
claude
committed
5e130b7
fix(CI): correct BASE in detect-changes (PR/push race); catch RuntimeError in conftest (#1473)

authored
859d676
fix(build): add missing fmt import to a2a_proxy.go

HongmingWang-Rabbit
and
claude
committed
ce52b67
fix: CWE-78 rm scope, go vet failures, delegation idempotency

authored
64ccf8e
ci(e2e): wire MOLECULE_STAGING_OPENAI_KEY into workflow env

Hongming Wang
and
claude
committed
bd020d8
Merge pull request #1491 from Molecule-AI/feat/e2e-staging-saas-cicd
HongmingWang-Rabbit
authored
2133e56
fix(core): consolidate 3 security fixes — CWE-22/CWE-78/SSRF dedup

molecule-ai[bot]
and
DevOps Bot
authored
a01e4a1
ci: trigger for PR #1497
molecule-ai[bot]
authored
42a8c01

Navigation Menu

fix(core): consolidate 3 security fixes — CWE-22/CWE-78/SSRF dedup - #1497

fix(core): consolidate 3 security fixes — CWE-22/CWE-78/SSRF dedup#1497
molecule-ai[bot] wants to merge 31 commits into
stagingfrom
fix/security-v3-main

Commits on Apr 21, 2026

feat(e2e): staging full-SaaS workflow — per-run org provision + leak-free teardown

feat(e2e): canary + canvas Playwright workflows; delegation mechanics

feat(e2e): pivot to admin-bearer-only auth + add sanity self-check workflow

fix(e2e): CP DELETE /cp/admin/tenants body uses 'confirm', not 'confirm_token'

Merge pull request #1355 from Molecule-AI/staging

feat(workspace): pre-stop serialization for pause/resume (closes #1386)

fix(e2e): poll instance_status not status in staging harness

fix(e2e): derive tenant domain from CP URL (staging vs prod)

fix(e2e): send X-Molecule-Org-Id on tenant calls

fix(e2e): safety-net teardown only sweeps this run's orgs

chore: PM-triggered CI re-run

chore: force Platform(Go) CI run on main — validate go vet clean

fix(tenant-image): remove node user so canvas uid 1000 can be created

Merge pull request #1445 from Molecule-AI/fix/tenant-dockerfile-uid-conflict

research: add crewai-competitive-proof-points-brief.md

research: add enterprise-case-study-legal-clearance-brief.md

research: add enterprise-case-study-pipeline-targeting-brief.md

fix(P0): CWE-22 path traversal in copyFilesToContainer + ContextMenu test

fix(core): resolve main build — remove duplicate SSRF function declarations

Merge pull request #1469 from Molecule-AI/fix/main-build-dedupe-ssrf

fix(e2e): inject OPENAI_API_KEY into workspace secrets

fix(e2e): set MODEL_PROVIDER=openai for Hermes runtime

fix(e2e): MODEL_PROVIDER is provider:model slug, not just provider

fix(e2e): delegation raw curl missing X-Molecule-Org-Id

fix(CI): correct BASE in detect-changes (PR/push race); catch RuntimeError in conftest (#1473)

fix(build): add missing fmt import to a2a_proxy.go

fix: CWE-78 rm scope, go vet failures, delegation idempotency

ci(e2e): wire MOLECULE_STAGING_OPENAI_KEY into workflow env

Merge pull request #1491 from Molecule-AI/feat/e2e-staging-saas-cicd

fix(core): consolidate 3 security fixes — CWE-22/CWE-78/SSRF dedup

ci: trigger for PR #1497