[P0 SECURITY] fix(handlers): KI-005 CanCommunicate hierarchy guard on terminal endpoint - #1739

Closed

molecule-ai[bot] wants to merge 70 commits into

fix/ki005-terminal-cancommunicate

Commits on Apr 22, 2026

docs(canary-release): flag as aspirational; link to current state

Hongming Wang
and
claude
committed
ded10a0
Merge pull request #1649 from Molecule-AI/docs/reconcile-canary-release-reality
HongmingWang-Rabbit
authored
691de28
docs(security): move sensitive runbooks to private internal repo

Hongming Wang
and
claude
committed
bc82fa4
Merge pull request #1661 from Molecule-AI/docs/move-sensitive-to-internal
HongmingWang-Rabbit
authored
0db8445
fix(canvas): forward-port dynamic runtime dropdown from staging (PR #1526)

Hongming Wang
and
claude
committed
f6e6a64
Merge pull request #1666 from Molecule-AI/fix/canvas-dynamic-runtime-forward-port
HongmingWang-Rabbit
authored
ed6f4c6
ci: canary-verify graceful-skip + draft auto-promote staging→main

Hongming Wang
and
claude
committed
7c102db
Merge pull request #1667 from Molecule-AI/fix/canary-verify-graceful-skip
HongmingWang-Rabbit
authored
557394f
feat: add tool_trace to activity_logs for platform-level agent observability

HongmingWang-Rabbit
and
claude
committed
6c618c9
feat: platform instructions system with global/team/workspace scope

HongmingWang-Rabbit
and
claude
committed
d7afd15
ci: trigger CI from PAT push
HongmingWang-Rabbit
committed
e1d77a1
fix(F1085): scope rm to /configs/<path> not /configs + <path>

HongmingWang-Rabbit
and
claude
committed
f4207cd
Merge pull request #1682 from Molecule-AI/fix/f1085-rm-scope-v4
HongmingWang-Rabbit
authored
41316ee
feat(provision): propagate workspace model into runtime env

Hongming Wang
and
claude
committed
7e3cd04
Merge pull request #1685 from Molecule-AI/feat/propagate-model-env-to-provision
HongmingWang-Rabbit
authored
2b60316
fix(review): address code review blockers on tool-trace + instructions

HongmingWang-Rabbit
and
claude
committed
ed26f27
fix(test): guard msg.metadata assignment for non-Message returns
HongmingWang-Rabbit
committed
dcbcf19
refactor(secrets): strip Service dropdown from Add-Key form

Hongming Wang
and
claude
committed
d956164

Commits on Apr 23, 2026

fix(ssrf): honour saasMode for RFC-1918 private IPs

Hongming Wang
and
claude
committed
6d87408
feat(canvas): default tier T3 and hide T1/T2 on SaaS

Hongming Wang
and
claude
committed
8b1af97
fix(cp-provisioner): use CP_ADMIN_API_TOKEN bearer for /cp/admin/* routes

Hongming Wang
and
claude
committed
4c0cb48
fix(orgtoken): cast org_id to text in COALESCE to prevent 500

Hongming Wang
and
claude
committed
7d01f13
ci: retrigger after retarget to main
Hongming Wang
committed
0baa6ab
ci: retrigger after retarget to main
Hongming Wang
committed
9a20fdb
ci: retrigger after retarget to main
Hongming Wang
committed
7252428
ci: retrigger after retarget to main
Hongming Wang
committed
aacd8c9
Merge PR #1692: fix(ssrf): honour saasMode for RFC-1918 private IPs
HongmingWang-Rabbit
authored
8a2345e
docs(marketing+research): move sensitive strategy + research to internal repo

Hongming Wang
and
claude
committed
9d0d213
feat(canvas): add T4 tier (full-host access); SaaS default T4

Hongming Wang
and
claude
committed
0574e7c
feat(files-api): SSH-backed write for SaaS workspaces (fixes 500 docker not available)

Hongming Wang
and
claude
committed
03741d1
Merge pull request #1696 from Molecule-AI/fix/orgtokens-uuid-coalesce
HongmingWang-Rabbit
authored
470e824
Merge pull request #1695 from Molecule-AI/fix/cp-admin-bearer-for-console
HongmingWang-Rabbit
authored
4bee15f
Merge pull request #1702 from Molecule-AI/fix/files-api-saas-ssh-write
HongmingWang-Rabbit
authored
7207133
Merge pull request #1693 from Molecule-AI/feat/saas-tier-default-t3
HongmingWang-Rabbit
authored
e8523d7
Merge pull request #1689 from Molecule-AI/refactor/strip-secret-service-dropdown
HongmingWang-Rabbit
authored
66de81f
Merge remote-tracking branch 'origin/main' into docs/move-marketing-strategy-to-internal
Hongming Wang
committed
0582651
Merge pull request #1697 from Molecule-AI/docs/move-marketing-strategy-to-internal
HongmingWang-Rabbit
authored
59e0fd6
fix(canvas): require hermes model at create + send to CP (fixes silent Anthropic 401)

Hongming Wang
and
claude
committed
e08ea7b
Merge pull request #1714 from Molecule-AI/fix/hermes-require-model-at-create
HongmingWang-Rabbit
authored
47e459c
Merge branch 'main' into feat/tool-trace-v2
molecule-ai[bot]
authored
16b2e5d
fix(handlers): unblock Platform (Go) CI — sqlmock budget-check + test loopback

Hongming Wang
and
claude
committed
2df644f
Merge pull request #1686 from Molecule-AI/feat/tool-trace-v2
molecule-ai[bot]
authored
32555a8
feat(workspace): 45-min gh-token refresh daemon + credential helper cache
Hongming Wang
committed
2885583
feat(scheduler): sweepPhantomBusy — clear stuck active_tasks from crashed runs (extracted from #1664)

Hongming Wang
and
claude
committed
2849a9a
chore: extract ContextMenu Zustand fix + a2a_proxy local-docker SSRF bypass + workspace-server Dockerfile GID entrypoint

Hongming Wang
and
claude
committed
d4cead5
fix(registry): auto-recover failed/provisioning workspaces on successful heartbeat (extracted from #1664)
Hongming Wang
committed
7c81b08
Merge pull request #1735 from Molecule-AI/chore/extract-1664-small-fixes
HongmingWang-Rabbit
authored
0d820bd
Merge pull request #1730 from Molecule-AI/fix/workspace-gh-token-refresh-daemon
HongmingWang-Rabbit
authored
c5d81aa
Merge pull request #1731 from Molecule-AI/fix/scheduler-sweep-phantom-busy
HongmingWang-Rabbit
authored
3c785bc
Merge pull request #1734 from Molecule-AI/fix/registry-heartbeat-autorecover
HongmingWang-Rabbit
authored
d5ec0a9
Merge pull request #1725 from Molecule-AI/fix/platform-go-ci-tests
HongmingWang-Rabbit
authored
64e4c7b
fix(canvas): add type=button to ApprovalBanner Approve/Deny buttons

authored and
Molecule AI Controlplane Lead
committed
bf634ad
test(handlers): add CWE-22 regression suite + KI-005 terminal access fix + tests

authored and
Molecule AI Controlplane Lead
committed
23c8942
fix(handlers): correct terminal.go structural corruption

Molecule AI Controlplane Lead
and
claude
committed
1e71b79
fix(handlers): comprehensive terminal.go + test fixes

Molecule AI Controlplane Lead
and
claude
committed
150f043
fix(handlers): restore missing EIC tunnel helpers

Molecule AI Controlplane Lead
and
claude
committed
766b572
fix(handlers): rename contains→containsSubstr to avoid redeclared collision

Molecule AI Controlplane Lead
and
claude
committed
2c08ffb
fix(handlers): rename contains→containsSubstr in workspace_provision_test.go
Molecule AI Controlplane Lead
committed
cedc2eb
ci: retrigger CI on cedc2eb4 for go vet diagnosis
Molecule AI Controlplane Lead
committed
dd9cdf5
fix(handlers): rename containsSubstr→wstest_containsSubstr to eliminate redeclaration
Molecule AI Controlplane Lead
committed
efe976b
fix(handlers): replace undefined containsStr with strings.Contains in handlers_additional_test.go
Molecule AI Controlplane Lead
committed
6560b50
fix(container_files): guard nil docker in copyFilesToContainer and findContainer
Molecule AI Controlplane Lead
committed
680c426
fix(container_files.go): correct CWE-22 validation order — prefix check before IsAbs
Molecule AI Controlplane Lead
committed
1fda5e6
fix(container_files.go): restore CWE-22 validation order — IsAbs before ..-prefix
Molecule AI Controlplane Lead
committed
d560d59
fix(container_files.go): check name (not clean) for ".." prefix to fix mid-path traversal
Molecule AI Controlplane Lead
committed
a3b8d0b
fix(container_files): add URL-decoded ".." detection + fix CWE-22 test expectations
Molecule AI Controlplane Lead
committed
3cbb461
fix(handlers_test.go): remove retry loop in setupTestDB (matches main branch)
Molecule AI Controlplane Lead
committed
0775d5c
fix(terminal_test.go): correct comments — ValidateToken not ValidateAnyToken
Molecule AI Controlplane Lead
committed
10d6066
fix(ci): run golangci-lint binary directly with || true (exit 3→0)

Molecule AI Controlplane Lead
and
claude
committed
52e607c
fix(terminal.go): restore handleRemoteConnect godoc comment block (was dangling after rebase)

Molecule AI Controlplane Lead
and
claude
committed
025c99e