fix(canvas/test): use string keys in TIER_CONFIG toHaveProperty calls #435

Closed
app-fe wants to merge 1 commits from fix/canvas-tiers-config-string-keys into main
Member

Summary

Fix TypeScript strict-mode error in canvas test:

  • → for all four tier levels
  • Vitest's is string-keyed
  • TypeScript rejects numeric literal keys on

Clean PR: 1 file, +4/-4 lines. All 16 tests pass.

🤖 Generated with Claude Code

## Summary Fix TypeScript strict-mode error in canvas test: - → for all four tier levels - Vitest's is string-keyed - TypeScript rejects numeric literal keys on Clean PR: 1 file, +4/-4 lines. All 16 tests pass. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
app-fe added 31 commits 2026-05-11 09:05:42 +00:00
fix(a2a): handle string-form errors in delegate_task
Secret scan / Scan diff for credential-shaped strings (pull_request) Failing after 14s
sop-tier-check / tier-check (pull_request) Failing after 7s
audit-force-merge / audit (pull_request) Failing after 5s
bea89ce4e9
The A2A proxy can return three error shapes:
  {"error": "plain string"}
  {"error": {"message": "...", "code": ...}}
  {"error": {"message": {"nested": "object"}}}   ← value at .message is a string

builtin_tools/a2a_tools.py:72 called data["error"].get("message")
without guarding against error being a string, which raised:
  AttributeError: 'str' object has no attribute 'get'

This broke every delegation attempt through the legacy a2a_tools path
(the LangChain-wrapped version used by adapter templates). The
SSOT parser a2a_response.py already handled string errors; the
legacy inline sniffer in a2a_tools.py did not.

Fix: branch on isinstance(err, dict/str/other) before calling .get().

Also update both publish-workflow files to remove the dead
`staging` branch trigger — trunk-based migration (PR #109,
2026-05-08) removed the staging branch.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
[infra-lead-agent] fix(ci): retry git clone in clone-manifest.sh (publish-workspace-server-image flake)
Secret scan / Scan diff for credential-shaped strings (pull_request) Failing after 1s
sop-tier-check / tier-check (pull_request) Failing after 1s
audit-force-merge / audit (pull_request) Failing after 2s
7ff5622a42
The publish-workspace-server-image / build-and-push job clones the full
manifest (~36 repos) serially in the "Pre-clone manifest deps" step on a
memory-constrained Gitea Actions runner. Under host memory pressure the
OOM killer SIGKILLs git-remote-https mid-clone:

  cloning .../molecule-ai-plugin-molecule-skill-code-review.git ...
  error: git-remote-https died of signal 9
  fatal: the remote end hung up unexpectedly
    Failure - Main Pre-clone manifest deps
  exitcode '128': failure

Observed in run 4622 (2026-05-10, staging HEAD b5d2ab88) — died on the
14th of 36 clones, which red-lights CI and wedges staging→main.

Wrap each `git clone` in clone-manifest.sh with bounded retry + backoff
(3 attempts, 3s/6s), wiping any partial checkout between tries. A single
transient SIGKILL / network blip no longer fails the whole tenant image
rebuild. Benefits every caller of the script (publish-workspace-server-image,
harness-replays, Dockerfile builds, local quickstart).

This is a mitigation; the durable fix is more runner RAM/swap on the
operator host — tracked separately with Infra-SRE.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
fix(workspace): inject plugins_registry into sys.modules before loading adapters (closes #296)
sop-tier-check / tier-check (pull_request) Failing after 3s
Secret scan / Scan diff for credential-shaped strings (pull_request) Failing after 58s
audit-force-merge / audit (pull_request) Successful in 2s
d4d3306150
Plugin adapters in molecule-skill-* repos do:
  from plugins_registry.builtins import AgentskillsAdaptor as Adaptor

But _load_module_from_path() used exec_module() with a fresh module
namespace that did NOT have plugins_registry or its submodules in sys.modules,
causing:
  ModuleNotFoundError: No module named 'plugins_registry'

Fix: before exec_module(), import and register plugins_registry + all three
submodules (builtins, protocol, raw_drop) in sys.modules so adapter imports
resolve correctly.  Follows the Option 1 recommendation from issue #296.

Also adds test_resolve_plugin.py verifying the fix for both the
AgentskillsAdaptor import and the full InstallContext/resolve/protocol import.

Closes #296.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
fix(platform): A2A proxy ResponseHeaderTimeout 60s → 180s default, env-configurable
Secret scan / Scan diff for credential-shaped strings (pull_request) Failing after 2s
sop-tier-check / tier-check (pull_request) Failing after 1s
audit-force-merge / audit (pull_request) Successful in 3s
ba0680d5fb
Cherry-pick of d79a4bd2 from PR #318 onto fresh main base (PR #318 closed).

Issue #310: platform a2a-proxy logs ~300/hr
`timeout awaiting response headers` because ResponseHeaderTimeout was hardcoded
to 60s. Opus agent turns (big context + internal delegate_task round-trips)
routinely exceed 60s, so the proxy gave up before headers arrived even when
the workspace agent was healthy.

Changes:
- a2a_proxy.go: ResponseHeaderTimeout: 60s hardcoded →
  envx.Duration("A2A_PROXY_RESPONSE_HEADER_TIMEOUT", 180s).
  180s gives Opus turns comfortable headroom. The X-Timeout caller header
  still bounds the absolute request ceiling independently.
- a2a_proxy_test.go: TestA2AClientResponseHeaderTimeout verifies the 180s
  default and env-override parsing logic.

Env var: A2A_PROXY_RESPONSE_HEADER_TIMEOUT (e.g. 5m, 300s).

Closes #310.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
fix(workspace): auto-suffix duplicate names on POST /workspaces (closes 500 on double-click)
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 3s
sop-tier-check / tier-check (pull_request) Manual override — infra#241 runner broken
audit-force-merge / audit (pull_request) Successful in 6s
8c68159e42
The Canvas template-deploy path returned HTTP 500 with raw pq error
when a user clicked a template card twice in quick succession. Root
cause: migration 20260506000000 added the partial-unique index
`workspaces_parent_name_uniq` on (COALESCE(parent_id, sentinel), name)
WHERE status != 'removed' to close TOCTOU on /org/import (#2872). The
org-import handler resolves the constraint via ON CONFLICT DO NOTHING
+ idempotent re-select. The Canvas Create handler did not — it
bubbled the pq violation as a generic 500.

Fix: auto-suffix the user-typed name on collision via a small retry
helper that pins on SQLSTATE 23505 + constraint name (so unrelated
unique indexes still fail loud), retries with " (2)", " (3)" up to
N=20, and threads the actually-persisted name back into the response
+ broadcast payload (so the canvas displays what the DB actually
holds). Exhaustion maps to a clean 409 Conflict instead of a 500.

#2872 protection is preserved unchanged — the index stays in place,
and /org/import's ON CONFLICT path is unaffected. The bundle-import
INSERT (handlers/bundle.go) is a separate code path and is not
touched here; if it surfaces the same UX issue a follow-up can adopt
the same helper.

Verification (against running localhost:8080 platform):

  Three back-to-back POSTs with name="ManualVerify-1778459812":
    POST #1 -> 201, id=db2dacf7-…, persisted name="ManualVerify-1778459812"
    POST #2 -> 201, id=f468083d-…, persisted name="ManualVerify-1778459812 (2)"
    POST #3 -> 201, id=5f5ae905-…, persisted name="ManualVerify-1778459812 (3)"
  Log lines: "name collision auto-suffix \"…\" -> \"… (N)\""

Tests:
- workspace_create_name_test.go — 4 unit tests via sqlmock pin the
  retry contract (happy path no-suffix, single-collision -> " (2)",
  non-retryable error pass-through, exhaustion -> errWorkspaceNameExhausted).
- workspace_create_name_integration_test.go — 2 real-Postgres tests
  (build tag `integration`) confirm the partial-unique index
  behaviour AND the WHERE status != 'removed' tombstone exemption.
- Watch-it-fail confirmed: temporarily removing the
  `fmt.Sprintf("%s (%d)", baseName, attempt+1)` candidate-naming
  line makes TestInsertWorkspaceWithNameRetry_SecondAttemptSuffixed
  fail with the expected argument-mismatch from sqlmock.

Pre-existing test failures in handlers/ (TestExecuteDelegation_…,
TestMCPHandler_CommitMemory_GlobalScope_Blocked) reproduce on
unmodified staging and are NOT caused by this change.
fix(ci): install jq before sop-tier-check script runs
Secret scan / Scan diff for credential-shaped strings (push) Successful in 9s
b1b5c67055
Root cause: the sop-tier-check.sh script uses jq extensively for all
JSON API parsing (whoami, labels, team IDs, reviews). Gitea Actions
runners (ubuntu-latest label) do not bundle jq — script exits at
line 67 with "jq: command not found", producing "Failing after 1-3s"
status on every staging PR.

Fix: add apt-get install -y jq step before the script run.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
fix(workspace): OFFSEC-003 sanitize read_delegation_results()
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 12s
sop-tier-check / tier-check (pull_request) Manual override — infra#241 runner broken. infra-lead APPROVED. PR routes read_delegation_results through sanitize_a2a_result.
audit-force-merge / audit (pull_request) Successful in 10s
3f6de6fe8b
Adds _sanitize_a2a.py (from PR #346) and integrates sanitize_a2a_result()
into read_delegation_results() so peer-supplied summary and response_preview
fields are escaped before being injected into the agent prompt.

Output is wrapped in [A2A_RESULT_FROM_PEER]...[/A2A_RESULT_FROM_PEER]
boundary markers so content after the block is clearly not from a peer.

Fixes:
- test_a2a_executor.py: correct mock patch path to executor_helpers
- test_executor_helpers.py: fix boundary-injection test assertion to match
  _strip_closed_blocks behaviour (closes marker, removes following text)

Follow-up to PR #346 (OFFSEC-003 boundary escape) which noted
"read_delegation_results() path still needs sanitization" as a gap.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
fix(workspace): OFFSEC-003 sanitize polling-path delegation results
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 11s
sop-tier-check / tier-check (pull_request) Manual override — infra#241 runner broken. OFFSEC-003 polling-path sanitization fix.
audit-force-merge / audit (pull_request) Successful in 11s
8e94c178d2
Issue: _delegate_sync_via_polling (RFC #2829 PR-5 sync path) returned
unsanitized response_preview and error_detail fields to the agent context.
A malicious peer could inject trust-boundary markers to break the boundary
established by the main sanitization layer.

Changes:
- a2a_tools_delegation.py: sanitize response_preview before returning on
  completed; sanitize error_detail/summary before wrapping in _A2A_ERROR_PREFIX
- test_a2a_tools_delegation.py: TestPollingPathSanitization covers both paths

Companion to PR #382 (runtime/offsec-003-executor-sanitize) which covers
the async heartbeat path in executor_helpers.read_delegation_results.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
fix(workspace): skip idle prompt when delegation results are pending
sop-tier-check / tier-check (pull_request) Failing after 7s
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 9s
Secret scan / Scan diff for credential-shaped strings (push) Successful in 36s
audit-force-merge / audit (pull_request) Has been skipped
b1e42ac1da
Issue #381: agent tick generators producing stale-repo state.

Root cause: the idle loop fires every idle_interval_seconds (default 10 min)
and sends an idle prompt regardless of pending delegation results. If a
delegation completes just before the idle tick fires, the heartbeat writes
results to DELEGATION_RESULTS_FILE and sends a self-message — but the idle
prompt arrives first and the agent composes a stale tick before processing
the results notification. Peers receive repeated identical asks.

Fix: before sending the idle prompt, read DELEGATION_RESULTS_FILE. If it
contains unconsumed results, skip this idle tick. The heartbeat's own
self-message (sent when results arrive) will wake the agent, which then
sees the results in _prepare_prompt() and processes them before composing.

Companion to wsr PR (runtime-runtime mirror).

Changes:
- workspace/main.py: pending-results check in _run_idle_loop() (+26 lines)
- workspace/tests/test_idle_loop_pending_check.py: 6-case unit test

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
fix(platform): /github-installation-token returns 501 on missing config (#388)
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 10s
sop-tier-check / tier-check (pull_request) Failing after 9s
audit-force-merge / audit (pull_request) Successful in 21s
ed94ce1e69
When GITHUB_APP_ID/INSTALLATION_ID/PRIVATE_KEY_FILE are unset (Gitea-
canonical deployment or suspended GitHub App org), generateAppInstallation
Token() returns "required" — a permanent configuration error, not a
transient one. Return HTTP 501 Not Implemented with scm:"gitea" so
the workspace credential helper distinguishes "not configured" (stop
retrying) from "provider failed" (retry with back-off).

The 501 body is intentionally compatible with the scm:"gitea" shape
already used elsewhere in the platform so callers can branch on SCM type.
fix(platform): close CWE-59 symlink-traversal gap in resolveInsideRoot (#380)
sop-tier-check / tier-check (pull_request) Failing after 5s
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 6s
audit-force-merge / audit (pull_request) Successful in 30s
72a48214ee
Follow-up to #369. `resolveInsideRoot` used `filepath.Abs` which does NOT
resolve symlinks — so "workspaces/dev/leaked" where "leaked" is a symlink
to "/etc" would lexically pass the prefix check but resolve outside root.

Fix: call `filepath.EvalSymlinks` before the final prefix check. If the
resolved path points outside root the function returns "path escapes root".
Broken symlinks are also rejected (fail closed).

Also add TestResolveInsideRoot_RejectsSymlinkTraversal covering:
- Symlink pointing outside → rejected (CWE-59)
- Symlink staying inside root → allowed
- Broken symlink → rejected
fix(workspace): add missing _sanitize_a2a import in a2a_tools_delegation (#399)
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 19s
sop-tier-check / tier-check (pull_request) Failing after 17s
audit-force-merge / audit (pull_request) Successful in 28s
a8f8b5b7c1
REGRESSION: Staging commit 8e94c178 (PR #390) added sanitize_a2a_result
calls to _delegate_sync_via_polling but did NOT add the import. Any
delegation completing via the polling path raises NameError at runtime.

One-line fix: add `from _sanitize_a2a import sanitize_a2a_result`.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
fix(workspace): OFFSEC-003 — sanitize summary/response_preview in JSON endpoint of read_delegation_results
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 19s
sop-tier-check / tier-check (pull_request) Failing after 17s
af95f94db1
Fixes the second unsanitized exit point flagged in issue #413:
- task_id filter path: sanitize summary + response_preview before returning raw delegation object
- list path (all recent): sanitize both fields in every delegation entry before embedding in JSON

Both are peer-supplied delegation ledger data returned via the JSON polling endpoint.
Sync path (lines 173, 182) was already fixed in #416.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
ci: re-trigger after runner stall (infra#241)
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 17s
sop-tier-check / tier-check (pull_request) Failing after 17s
audit-force-merge / audit (pull_request) Successful in 22s
2527a99425
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
fix(canvas/a11y): WCAG 2.4.7 focus-visible rings on remaining interactive buttons
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 19s
sop-tier-check / tier-check (pull_request) Failing after 15s
audit-force-merge / audit (pull_request) Successful in 17s
25fbcaf6da
- MissingKeysModal: backdrop gains aria-label (screen-reader dismiss);
  Save, Open Settings, Cancel Deploy, Deploy/Add Keys buttons gain
  focus-visible ring
- AuditTrailPanel: filter pills, Refresh, Load More buttons gain
  focus-visible ring
- MemoryInspectorPanel: Clear search, Refresh, row expand, Forget
  buttons gain focus-visible ring
- TemplatePalette: Org Templates toggle, Refresh org, Import org,
  Import Agent Folder, Template Palette toggle, Refresh templates
  buttons gain focus-visible ring
- PricingTable: CTA button gains focus-visible ring

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
force-merge: review-timing race (hongming-pc Five-Axis APPROVED at 07:54Z, sop-tier-check ran at 07:41Z before review landed; gate working, only timing-race per feedback_pull_request_review_no_refire); see audit-force-merge trail
fix(canvas/test): use string keys in TIER_CONFIG toHaveProperty calls
sop-tier-check / tier-check (pull_request) Successful in 19s
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 30s
audit-force-merge / audit (pull_request) Has been skipped
62999efe08
Vitest's toHaveProperty is string-keyed; TypeScript strict mode with
noPropertyAccessFromIndexSignature rejects numeric literal keys on
Record<number, TIER_CONFIG_LEVEL>.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
app-fe closed this pull request 2026-05-11 09:13:46 +00:00
Author
Member

[app-fe-agent] Closing — HEAD was pointing at fix/a11y-canvas-clean (staging-tipped) instead of origin/main, causing 41-file bloat from staging-commits-ahead-of-main. Recreating as clean branch from origin/main.

[app-fe-agent] Closing — HEAD was pointing at fix/a11y-canvas-clean (staging-tipped) instead of origin/main, causing 41-file bloat from staging-commits-ahead-of-main. Recreating as clean branch from origin/main.
core-qa reviewed 2026-05-11 09:14:04 +00:00
core-qa left a comment
Member

[core-qa-agent] N/A — canvas test-only changes. Fixes TypeScript strict-mode errors in test files (TIER_CONFIG string-keyed property calls). No production code changed.

[core-qa-agent] N/A — canvas test-only changes. Fixes TypeScript strict-mode errors in test files (TIER_CONFIG string-keyed property calls). No production code changed.
Some checks are pending
sop-tier-check / tier-check (pull_request) Successful in 19s
Secret scan / Scan diff for credential-shaped strings (pull_request) Successful in 30s
audit-force-merge / audit (pull_request) Has been skipped
CI / all-required (pull_request)
Required

Pull request closed

Sign in to join this conversation.
No Reviewers
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#435