---
title: "GitHub CLI auth and web run controls"
date: "2026-04-20"
---

## GitHub login for the CLI

The CLI can now authenticate to GitHub-backed Fabro servers through a browser login flow. Instead of copying bearer tokens around, run `fabro auth login`, approve the flow in your browser, and let the CLI store and refresh the session for future commands.

```bash
fabro auth login
fabro auth status
fabro auth logout
```

Token refresh is wired through the shared client path used by commands such as `fabro doctor`, `fabro model`, `fabro repo init`, `fabro secret`, `fabro system`, and `fabro version`, so authenticated server commands can recover from expired access tokens without a manual retry.

## Run controls in the web app

Run detail pages now expose lifecycle actions directly in the browser. You can start, pause, unpause, cancel, archive, and unarchive runs from the run UI, with toasts and server-sent event updates keeping the page state in sync after the action completes.

Blocked runs also get a clearer notice in the stage sidebar. The web app now treats lifecycle actions as first-class run operations instead of burying them in CLI-only workflows.

## More

<Accordion title="API">
- Corrected the GitHub webhook OpenAPI contract so generated clients match the server route
</Accordion>

<Accordion title="CLI">
- Added `fabro auth login`, `fabro auth status`, and `fabro auth logout`
- Restored configured socket autostart behavior for local server targets
- `fabro system df` now checks server stores in parallel
</Accordion>

<Accordion title="Fixes">
- Fixed CLI login so the browser must confirm the auth request before the CLI receives a token
- Removed explicit remote same-host auth fallbacks from the CLI client
- Fixed server stop polling so zombie processes do not keep a server marked as running
- Rejected obfuscated IPv4 host forms when parsing CLI server targets
- Deduplicated archive, unarchive, cancel, and lifecycle toasts in the web app
</Accordion>
