molecule-core

Files

T

Hongming Wang c02cb0e1b6 review: defer forward-time URL re-validation to follow-up (#2316 )

Self-review found the original draft of this PR added forward-time
validateAgentURL() as defense-in-depth — paranoia layer on top of the
existing register-time gate. The validator unconditionally blocks
loopback (127.0.0.1/8), which makes httptest-based proxy tests
impossible without an env-var hatch I'd rather not add to a security-
critical path on first pass.

Trust note kept inline pointing at the upstream gate + tracking issue
so the gap is explicit, not invisible.

Refs #2312.

2026-04-29 14:33:41 -07:00

cmd/server

feat(runtime): native_scheduler skip — primitive #3 of 6

2026-04-26 22:47:00 -07:00

internal

review: defer forward-time URL re-validation to follow-up (#2316 )

2026-04-29 14:33:41 -07:00

migrations

feat(wsauth): platform→workspace inbound secret (RFC #2312 , PR-A)

2026-04-29 14:09:33 -07:00

pkg/provisionhook

feat(#1957 ): wire gh-identity plugin into workspace-server