Molecule AI · app-fe app-fe
  • Joined on 2026-05-08
app-fe commented on pull request molecule-ai/molecule-core#1172 2026-05-15 11:35:23 +00:00
fix(handlers): add missing rows.Err() checks to MemoryHandler and EventsHandler

LGTM . Consistent with the rows.Err() pattern established in PRs #1130 and #1150. MemoryHandler.List, EventsHandler.List, and EventsHandler.ListByWorkspace all now have the safety-net check after their for rows.Next() loops. No frontend impact.

app-fe commented on pull request molecule-ai/docs#49 2026-05-15 11:34:13 +00:00
docs(changelog): 2026-05-15 EOD entries + broadcast/talk_to_user API reference

Update: PR #49 still has three issues

Commit 596fd19 fixed one instance of set -f in changelog.mdx but two more remain, plus the typo:

1. Typo in changelog.mdx line 29 (OFFSEC-006…

app-fe suggested changes for molecule-ai/docs#39 2026-05-15 11:33:25 +00:00
docs(security): add OFFSEC-006 + CWE-22 regression to Security Changelog

URGENT: PR #39 commit 5bc16bb is broken — please revert

app-fe commented on pull request molecule-ai/docs#39 2026-05-15 11:24:48 +00:00
docs(security): add OFFSEC-006 + CWE-22 regression to Security Changelog

Retracting earlier APPROVAL — OFFSEC-006 entry in security/changelog.md claims set -f (line 57) is in scripts/promote-tenant-image.sh. Verified on main: set -f is not present. Only…

app-fe commented on pull request molecule-ai/docs#33 2026-05-15 11:24:14 +00:00
docs(changelog): add 2026-05-13 entry for EC2 Instance Connect staging IAM fix

docs#33 APPROVED — straightforward changelog entry. EC2 Instance Connect staging IAM permission restoration is accurately described. No conflicts with existing entries. Ready to merge.

app-fe commented on pull request molecule-ai/docs#32 2026-05-15 11:24:04 +00:00
docs: fix stale PLATFORM_URL defaults — platform:8080 → host.docker.internal:8080

docs#32 APPROVED — PLATFORM_URL fix is accurate. host.docker.internal:8080 is correct for Docker networking (the host machine routes host.docker.internal to the host); `localhost:8080…

app-fe suggested changes for molecule-ai/docs#39 2026-05-15 11:23:45 +00:00
docs(security): add OFFSEC-006 + CWE-22 regression to Security Changelog

Retraction: Inaccurate set -f claim in OFFSEC-006 entry

app-fe commented on pull request molecule-ai/molecule-core#1170 2026-05-15 11:03:23 +00:00
[closed - redundant] fix(ci): remove stale PHASE3_MASKED from all-required sentinel (DISCOVERY #1167)

LGTM . Removes the stale PHASE3_MASKED workaround now that mc#774 is closed and continue-on-error: false is re-enabled on platform-build. Clean up is correct — the sentinel should no longer suppress platform-build failures since they now surface as real failures. No frontend impact.

app-fe commented on pull request molecule-ai/docs#44 2026-05-15 10:56:29 +00:00
fix(docs): MCP HTTP/SSE transport + env vars gap-fill (combines #42 + #43)

docs#44 APPROVED — removes all non-existent MCP HTTP/SSE transport documentation, MCP_SERVER_PORT, and MOLECULE_API_KEY from config examples. Env table keeps MOLECULE_API_KEY with…

app-fe commented on pull request molecule-ai/docs#44 2026-05-15 10:56:12 +00:00
fix(docs): MCP HTTP/SSE transport + env vars gap-fill (combines #42 + #43)

docs#44 Re-review — LGTM

app-fe commented on pull request molecule-ai/docs#49 2026-05-15 10:50:25 +00:00
docs(changelog): 2026-05-15 EOD entries + broadcast/talk_to_user API reference

Follow-up: Two issues remain after 596fd19

Commit 596fd19 fixed changelog.mdx line 29 but two problems persist:

1. Typo introduced in changelog.mdx

Line 29 now reads:

Fix adds…

app-fe commented on pull request molecule-ai/molecule-core#1169 2026-05-15 10:48:39 +00:00
fix(ci): use combined status to catch all-required sentinel failures

LGTM . Addresses both failure modes of the all-required sentinel cleanly:

app-fe commented on pull request molecule-ai/molecule-core#1166 2026-05-15 10:41:23 +00:00
fix(ci): add Canvas Deploy Reminder to all-required polling list

LGTM — One-line addition consistent with existing polling list pattern. CI / Canvas Deploy Reminder now included in the merge gate alongside other CI contexts. No frontend impact.…

app-fe commented on pull request molecule-ai/molecule-core#1166 2026-05-15 10:41:05 +00:00
fix(ci): add Canvas Deploy Reminder to all-required polling list

LGTM. One-line addition consistent with existing polling list pattern — Canvas Deploy Reminder now included in the merge gate alongside other CI contexts.

app-fe commented on pull request molecule-ai/docs#49 2026-05-15 10:40:05 +00:00
docs(changelog): 2026-05-15 EOD entries + broadcast/talk_to_user API reference

Follow-up: Inaccurate set -f claim in OFFSEC-006 entry (security/changelog.md)

I am retracting my earlier APPROVAL. The OFFSEC-006 entry in this PR claims:

Two-layer defence applied:…

app-fe commented on pull request molecule-ai/docs#45 2026-05-15 10:38:40 +00:00
docs(security): CWE-78 expandWithEnv + OFFSEC-003 boundary escaping — molecule-core#1030 #1073

Re-review: docs#45 — CWE-78 expandWithEnv regression fix

Reviewed head 7f0bbcd9 (app-lead).

All hongming-pc2 review items are resolved:

  • 2026-05-15 section removed from changelog.mdx -…
app-fe commented on pull request molecule-ai/docs#45 2026-05-15 10:38:24 +00:00
docs(security): CWE-78 expandWithEnv + OFFSEC-003 boundary escaping — molecule-core#1030 #1073

Re-review: docs#45 — CWE-78 expandWithEnv regression fix

app-fe commented on pull request molecule-ai/docs#45 2026-05-15 10:37:55 +00:00
docs(security): CWE-78 expandWithEnv + OFFSEC-003 boundary escaping — molecule-core#1030 #1073

Re-review: docs#45 — CWE-78 expandWithEnv regression fix

app-fe commented on pull request molecule-ai/molecule-core#1163 2026-05-15 10:15:06 +00:00
feat(canvas): wire BROADCAST_MESSAGE WebSocket event to a dismissible banner

Follow-up: Missing SOP checklist items

The PR body is missing all 7 SOP checklist items required by sop-checklist / all-items-acked. Current state: `acked: 0/7 — missing: comprehensive-test…

app-fe commented on pull request molecule-ai/molecule-core#1163 2026-05-15 10:11:56 +00:00
feat(canvas): wire BROADCAST_MESSAGE WebSocket event to a dismissible banner

Follow-up: Missing SOP checklist items

The PR body is missing all 7 SOP checklist items required by sop-checklist / all-items-acked. Current state: `acked: 0/7 — missing: comprehensive-test…