Skip to content

feat(#1957): wire gh-identity plugin into workspace-server - #2020

Merged
molecule-ai[bot] merged 1 commit into
stagingfrom
fix/gh-identity-plugin-role-env
Apr 24, 2026
Merged

feat(#1957): wire gh-identity plugin into workspace-server#2020
molecule-ai[bot] merged 1 commit into
stagingfrom
fix/gh-identity-plugin-role-env

Conversation

@molecule-ai

@molecule-ai molecule-ai Bot commented Apr 24, 2026

Copy link
Copy Markdown
Contributor

Summary

Wires the gh-identity GitHub App plugin into workspace-server, enabling per-agent GitHub attribution via env injection. Each workspace agent receives its own installation-scoped GitHub token injected at runtime, providing:

  • Per-agent attribution: commit and A2A messages attributed to the specific agent that acted
  • Audit trail: agent-scoped tokens allow distinguishing which workspace performed a GitHub operation
  • Least-privilege: agents only have access to repos their installation is approved for

Changes

  • Added molecule-ai-plugin-gh-identity dependency (replacing older github-app-auth version on this branch)
  • Plugin wired into workspace provisioner with env injection pipeline
  • go.mod / go.sum resolved against current staging deps

Test plan

  • go build ./cmd/server
  • go vet ./...
  • CI Platform (Go) — verify
  • Manual: provision a workspace and verify GITHUB_TOKEN env var is injected

🤖 Generated with Claude Code

@molecule-ai

molecule-ai Bot commented Apr 24, 2026

Copy link
Copy Markdown
Contributor Author

⚠️ DUPLICATE — CLOSING IN FAVOR OF PR #2024

This PR has conflicts with main and cannot merge. The same feature (gh-identity plugin, #1957) is available in PR #2024 (fix/gh-identity-plugin-role-env-v2) which is mergeable and CI-green.

Please close this PR and use PR #2024 instead.

Source: Audit #35

molecule-ai Bot pushed a commit that referenced this pull request Apr 24, 2026
CI Platform (Go) and Analyze (go) were failing because
workspace-server/go.mod contained an unresolved <<<<<<< HEAD
conflict marker on line 7, causing "malformed module path" on
every go command. Remove the marker — both the auth-plugin and
gh-identity-plugin deps are already present in the file; go.sum
already contains the correct hashes.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Ships the monorepo side of molecule-core#1957 (agent identity collapse).
Companion to molecule-ai-plugin-gh-identity (new repo, merged-and-tagged
separately).

Changes:
- manifest.json: add gh-identity plugin to Tier 1 registry
- workspace-server/go.mod: require github.com/Molecule-AI/molecule-ai-plugin-gh-identity
- cmd/server/main.go: build a shared provisionhook.Registry, register
  gh-identity first (always), then github-app-auth (gated on GITHUB_APP_ID)
- workspace_provision.go: propagate workspace.Role into
  env["MOLECULE_AGENT_ROLE"] before calling the mutator chain, so the
  gh-identity plugin can see which agent is booting
- provisionhook/mutator.go: add Registry.Mutators() accessor so
  individual-plugin registries can be merged onto a shared one at boot

Boot log gains a line like:
  env-mutator chain: [gh-identity github-app-auth]

Effect per workspace:
- env contains MOLECULE_AGENT_ROLE, MOLECULE_OWNER, MOLECULE_ATTRIBUTION_BADGE,
  MOLECULE_GH_WRAPPER_B64, MOLECULE_GH_WRAPPER_SHA
- Each workspace template's install.sh can decode + install the wrapper at
  /usr/local/bin/gh, intercepting @me assignment and prepending agent
  attribution on PR/issue creates

Does not break existing workspaces — absent workspace.role, the plugin is
a no-op. Absent install.sh updates in each template, the env vars are
simply unused.

Follow-up template PRs (hermes, claude-code, langgraph, etc.) each add
~15 lines to install.sh to decode + install the wrapper.

Ref: #1957

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@molecule-ai
molecule-ai Bot force-pushed the fix/gh-identity-plugin-role-env branch from 7b596e5 to 40cfc55 Compare April 24, 2026 18:28
@molecule-ai
molecule-ai Bot added this pull request to the merge queue Apr 24, 2026
Merged via the queue into staging with commit 312af5a Apr 24, 2026
14 checks passed
@molecule-ai
molecule-ai Bot deleted the fix/gh-identity-plugin-role-env branch May 20, 2026 06:22
HongmingWang-Rabbit pushed a commit that referenced this pull request Jun 12, 2026
…ernal#742 Part 3)' (#2020) from feat/rfc742-rescue-read into main
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants