fix(workspace): credential helper security hardening - #1746

Closed

HongmingWang-Rabbit wants to merge 34 commits into

stagingfrom

feat/credential-helper-auto-refresh

Commits on Apr 23, 2026

docs(canary-release): flag as aspirational; link to current state

authored and
Molecule AI Infra Lead
committed
f1521ef
docs(security): move sensitive runbooks to private internal repo

authored and
Molecule AI Infra Lead
committed
4501252
feat: add tool_trace to activity_logs for platform-level agent observability

authored and
Molecule AI Infra Lead
committed
edd922f
feat: platform instructions system with global/team/workspace scope

authored and
Molecule AI Infra Lead
committed
0ddb0b0
ci: trigger CI from PAT push

HongmingWang-Rabbit
authored and
Molecule AI Infra Lead
committed
fb81045
fix(review): address code review blockers on tool-trace + instructions

authored and
Molecule AI Infra Lead
committed
bbc1c1b
fix(test): guard msg.metadata assignment for non-Message returns

HongmingWang-Rabbit
authored and
Molecule AI Infra Lead
committed
f2c71c7
feat(provision): propagate workspace model into runtime env

authored and
Molecule AI Infra Lead
committed
8a05724
docs(marketing+research): move sensitive strategy + research to internal repo

authored and
Molecule AI Infra Lead
committed
d3842fc
fix(ssrf): honour saasMode for RFC-1918 private IPs

authored and
Molecule AI Infra Lead
committed
62a2118
ci: retrigger after retarget to main

Hongming Wang
authored and
Molecule AI Infra Lead
committed
06aba14
fix(orgtoken): cast org_id to text in COALESCE to prevent 500

authored and
Molecule AI Infra Lead
committed
275ee83
ci: retrigger after retarget to main

Hongming Wang
authored and
Molecule AI Infra Lead
committed
4e13596
fix(cp-provisioner): use CP_ADMIN_API_TOKEN bearer for /cp/admin/* routes

authored and
Molecule AI Infra Lead
committed
9ea9ab5
ci: retrigger after retarget to main

Hongming Wang
authored and
Molecule AI Infra Lead
committed
82add13
feat(files-api): SSH-backed write for SaaS workspaces (fixes 500 docker not available)

authored and
Molecule AI Infra Lead
committed
702f444
feat(canvas): default tier T3 and hide T1/T2 on SaaS

authored and
Molecule AI Infra Lead
committed
5d6c1a4
ci: retrigger after retarget to main

Hongming Wang
authored and
Molecule AI Infra Lead
committed
afa1b0f
feat(canvas): add T4 tier (full-host access); SaaS default T4

authored and
Molecule AI Infra Lead
committed
0a87cf0
refactor(secrets): strip Service dropdown from Add-Key form

authored and
Molecule AI Infra Lead
committed
cdfe579
fix(canvas): require hermes model at create + send to CP (fixes silent Anthropic 401)

authored and
Molecule AI Infra Lead
committed
3631ff9
chore: extract ContextMenu Zustand fix + a2a_proxy local-docker SSRF bypass + workspace-server Dockerfile GID entrypoint

authored and
Molecule AI Infra Lead
committed
d42e153
feat(workspace): 45-min gh-token refresh daemon + credential helper cache

Hongming Wang
authored and
Molecule AI Infra Lead
committed
c568a66
feat(scheduler): sweepPhantomBusy — clear stuck active_tasks from crashed runs (extracted from #1664)

authored and
Molecule AI Infra Lead
committed
466ed72
fix(registry): auto-recover failed/provisioning workspaces on successful heartbeat (extracted from #1664)

Hongming Wang
authored and
Molecule AI Infra Lead
committed
3adad5f
fix(handlers): unblock Platform (Go) CI — sqlmock budget-check + test loopback

authored and
Molecule AI Infra Lead
committed
b34c6b7
fix(workspace): credential helper security hardening

authored and
Molecule AI Infra Lead
committed
3a82b61
feat(org-template): SHARED_RULES.md + platform_instructions seeds from 24h retro

authored and
Molecule AI Infra Lead
committed
854f1d7
ci: trigger CI run

HongmingWang-Rabbit
authored and
Molecule AI Infra Lead
committed
043b442
ci: add trailing newline to nudge CI trigger

HongmingWang-Rabbit
authored and
Molecule AI Infra Lead
committed
a57a490
fix(rules): add merge authority + multi-role approval gate (rules 9, 10, 11)

authored and
Molecule AI Infra Lead
committed
95133a4
feat(rules): rules 11-14 — secrets matrix, escalation ladder, task queue, adaptive cadence

authored and
Molecule AI Infra Lead
committed
19eff59
chore(repo): remove org-templates/molecule-dev/ — standalone repo is source of truth

authored and
Molecule AI Infra Lead
committed
bfec9e5
feat(rules): seed 4 Philosophy rules into platform_instructions global scope

authored and
Molecule AI Infra Lead
committed
122032e

Navigation Menu

Uh oh!

fix(workspace): credential helper security hardening - #1746

fix(workspace): credential helper security hardening#1746
HongmingWang-Rabbit wants to merge 34 commits into
stagingfrom
feat/credential-helper-auto-refresh

Commits on Apr 23, 2026

docs(canary-release): flag as aspirational; link to current state

docs(security): move sensitive runbooks to private internal repo

feat: add tool_trace to activity_logs for platform-level agent observability

feat: platform instructions system with global/team/workspace scope

ci: trigger CI from PAT push

fix(review): address code review blockers on tool-trace + instructions

fix(test): guard msg.metadata assignment for non-Message returns

feat(provision): propagate workspace model into runtime env

docs(marketing+research): move sensitive strategy + research to internal repo

fix(ssrf): honour saasMode for RFC-1918 private IPs

ci: retrigger after retarget to main

fix(orgtoken): cast org_id to text in COALESCE to prevent 500

ci: retrigger after retarget to main

fix(cp-provisioner): use CP_ADMIN_API_TOKEN bearer for /cp/admin/* routes

ci: retrigger after retarget to main

feat(files-api): SSH-backed write for SaaS workspaces (fixes 500 docker not available)

feat(canvas): default tier T3 and hide T1/T2 on SaaS

ci: retrigger after retarget to main

feat(canvas): add T4 tier (full-host access); SaaS default T4

refactor(secrets): strip Service dropdown from Add-Key form

fix(canvas): require hermes model at create + send to CP (fixes silent Anthropic 401)

chore: extract ContextMenu Zustand fix + a2a_proxy local-docker SSRF bypass + workspace-server Dockerfile GID entrypoint

feat(workspace): 45-min gh-token refresh daemon + credential helper cache

feat(scheduler): sweepPhantomBusy — clear stuck active_tasks from crashed runs (extracted from #1664)

fix(registry): auto-recover failed/provisioning workspaces on successful heartbeat (extracted from #1664)

fix(handlers): unblock Platform (Go) CI — sqlmock budget-check + test loopback

fix(workspace): credential helper security hardening

feat(org-template): SHARED_RULES.md + platform_instructions seeds from 24h retro

ci: trigger CI run

ci: add trailing newline to nudge CI trigger

fix(rules): add merge authority + multi-role approval gate (rules 9, 10, 11)

feat(rules): rules 11-14 — secrets matrix, escalation ladder, task queue, adaptive cadence

chore(repo): remove org-templates/molecule-dev/ — standalone repo is source of truth

feat(rules): seed 4 Philosophy rules into platform_instructions global scope