diff --git a/.claude/skills/changelog/watermark b/.claude/skills/changelog/watermark index dc7fea578..58fa6535b 100644 --- a/.claude/skills/changelog/watermark +++ b/.claude/skills/changelog/watermark @@ -1 +1 @@ -6544e2c589cf436de4b18b70755177183b10c7d9 +ab68fc27d10412e9d827d07a62374ccc3cd12f12 diff --git a/docs/public/changelog/2026-05-24.mdx b/docs/public/changelog/2026-05-24.mdx index 8a723cddc..47e7f7ac2 100644 --- a/docs/public/changelog/2026-05-24.mdx +++ b/docs/public/changelog/2026-05-24.mdx @@ -1,39 +1,87 @@ --- -title: "Batch delete and richer stage details" +title: "Run tools, sandbox controls, and richer run triage" date: "2026-05-24" --- -## Delete runs in batches + +**Context-window data moved into `agent.message`.** The standalone `agent.context_window.snapshot` event was removed, and context-window details now travel with the assistant message that produced them. -The runs list bulk toolbar now includes Delete for selected runs. API clients can use the matching batch delete endpoint to remove multiple runs in one request and get per-run results back. +To migrate: +1. Stop listening for `agent.context_window.snapshot`. +2. Read `context_window` from `agent.message` properties or from the stage projection. + + +## Workflow agents get the full Fabro tool catalog + +Workflow agents that opt in to Fabro run tools now receive the same run-management catalog exposed to human MCP clients. That includes `fabro_run_pair`, so an agent can start a pairing session, send messages, and read transcripts without needing a separate user-only route. + +```toml +[run.agent] +fabro_tools = true +``` + +The run projection now also reports the effective agent tools for a stage. The UI can show which native, MCP, and skill tools were actually available instead of guessing from configuration alone. + +## Sandbox providers can be managed centrally + +Operators can now enable or disable individual sandbox providers at the server level. Fabro enforces the policy during run admission, preflight, and launch, so a disabled provider fails before a run starts work. + +```toml +[server.sandbox.providers.docker] +enabled = true + +[server.sandbox.providers.daytona] +enabled = false +``` + +The web app also gained a Settings > Sandboxes page for provider visibility. That gives teams a clearer place to inspect the configured sandbox backends without digging through server config files. + +## Run triage is faster from list and stage views + +The runs list bulk toolbar now includes Delete for selected runs, with a matching batch API that returns per-run results. Run detail pages gained more direct actions, including Copy run ID, and cancelled runs can be resumed or retried instead of being recreated by hand. ```http POST /api/v1/runs/delete ``` -## Stage details are closer at hand - -Stage status, model, and event details are now available from hover popovers across the run overview graph, stage sidebar, and stage events toolbar. You can inspect stage metadata without leaving the current run view. - -Loaded stage events also gained Copy and Download actions. That makes it easier to move event output into an issue, support thread, or local investigation without selecting text from the page. +Stage status, model, and event details are now available from hover popovers across the run overview graph, stage sidebar, and stage events toolbar. Loaded stage events also gained Copy and Download actions, which makes it easier to move raw event output into an issue, support thread, or local investigation. ## More - New `POST /api/v1/runs/delete` endpoint deletes multiple runs and returns per-run results plus a summary +- Stage projections now include `agent_tools` with the effective native, MCP, and skill tools for the stage +- `AgentMessageProps.context_window` now carries context-window data directly on `agent.message` +- Pair routes now accept run-management actors, allowing workflow agents to use `fabro_run_pair` + + + +- Added legacy SSE MCP transport support for MCP servers that still expose SSE instead of streamable HTTP +- `[run.agent] fabro_tools = true` now exposes all seven Fabro run-management tools to workflow agents +- Server sandbox provider policy now blocks disabled providers at admission, preflight, and launch - Fixed unfinished stages being left open after a run failure +- Fixed local server runs being unable to access project skills +- Fixed root-stage todo projections being overridden by child OpenAI plan events +- Fixed cancelled projections for failed commands +- Fixed stale run conclusions persisting after resume +- Fixed cancelled runs being blocked from resume and retry flows - Removed a non-functional demo-mode Connect dropdown - Suppressed the redundant Starting pill on the runs list +- Added Settings > Sandboxes +- Added the New Automation form and refreshed the Secrets form layout - Added a run size badge to the run header +- Added tooltips and a more compact presentation for the stage Tools list +- Improved Slack setup and lifecycle notification messages - Unconfigured provider rows now link directly to a prefilled secret form - Removed retired OpenAI models from the catalog - Improved muted stage status pill contrast - Collapsed the stage events search field behind an icon by default - Updated the Automations nav icon +- Moved event export actions to the Debug sub-tab diff --git a/docs/public/changelog/2026-05-25.mdx b/docs/public/changelog/2026-05-25.mdx new file mode 100644 index 000000000..0aeeb939c --- /dev/null +++ b/docs/public/changelog/2026-05-25.mdx @@ -0,0 +1,86 @@ +--- +title: "Sandbox inventory, model tests, and run approvals" +date: "2026-05-25" +--- + + +**Optional integration secrets are now vault-only in the server runtime.** GitHub App, Slack, Daytona, Brave Search, and LLM provider secrets no longer fall back to process environment variables or `server.env` when Fabro is running as a server. + +To migrate: +1. Store optional integration credentials with `fabro secret set`. +2. Re-run the GitHub App install flow if you want Fabro to write GitHub App secrets into the vault for you. +3. Remove any server-runtime dependency on optional integration secrets coming from process env or `server.env`. + + + +**`POST /api/v1/demo/toggle` was removed.** Demo mode remains available through the `X-Fabro-Demo: 1` request header or a manually set `fabro-demo=1` browser cookie. + +To migrate: +1. Stop calling `POST /api/v1/demo/toggle`. +2. Send `X-Fabro-Demo: 1` on demo requests that should use fixture-backed behavior. + + +## Provider-backed sandbox inventory + +Fabro can now list managed sandboxes directly from configured providers instead of relying only on run projections. The new inventory API queries Docker and Daytona, returns partial provider failures in metadata, and can retrieve a specific provider-native sandbox ID when exactly one provider owns it. + +```http +GET /api/v1/sandboxes +GET /api/v1/sandboxes/{id} +``` + +This gives operators a live view of the sandbox fleet even when a run record is missing, stale, or no longer the easiest way to answer "what is running right now?" + +## Settings can test models in place + +Settings > Models now has a real model table, default and priority provider labels, and a Test models sweep that checks configured providers from the UI. The server exposes a provider test endpoint that returns per-provider results without turning one provider failure into a failed request. + +```http +POST /api/v1/providers/test +``` + +The Settings area also gained a linked overview page and a cleaner navigation structure. Model configuration, integrations, monitoring, security, storage, and sandboxes now sit in a more predictable operations surface. + +## Run approvals are available everywhere + +Pending runs can now be approved or denied from the CLI and MCP run tools, not only from the web app. That lets operators and agents move approval-gated workflows forward from automation scripts, terminals, or MCP clients. + +```bash +fabro approve +fabro deny --reason "Not approved for execution" +``` + +The runs list also exposes approval and delete actions closer to the rows you are already reviewing. Children now use the shared runs list view, with size sorting, per-row actions, and a simpler sub-tab toolbar. + +## More + + +- New `GET /api/v1/sandboxes` endpoint lists Fabro-managed sandboxes directly from configured providers +- New `GET /api/v1/sandboxes/{id}` endpoint retrieves a managed sandbox by provider-native ID +- New `POST /api/v1/providers/test` endpoint tests every configured LLM provider with provider-level failures returned in the response body +- Removed `POST /api/v1/demo/toggle`; demo mode is now header or cookie driven + + + +- Added `fabro approve` and `fabro deny` commands for pending workflow runs +- Added `fabro graph --allow-invalid` for rendering DOT graphs while keeping validation diagnostics visible + + + +- Added the bundled `goal` workflow for auditing and continuing active work +- Structured output docs now clarify fallback behavior when a model cannot produce valid schema-conforming output + + + +- Fixed stage inference and tool timing values always reporting as zero +- Fixed Settings > Monitoring showing active runs instead of scheduler slots used +- Fixed the runs list pager appearing when pagination was not relevant +- Fixed run diff stats and run size chips displaying inconsistently across board and list surfaces + + + +- Added `gemini-3.5-flash` to the model catalog +- Added size sorting, per-row actions, and a bulk More menu to run lists +- Added priority-provider and default-model labels to Settings > Models +- Removed the redundant time filter and archived toggle from the run Children sub-tab + diff --git a/docs/public/changelog/2026-05-26.mdx b/docs/public/changelog/2026-05-26.mdx new file mode 100644 index 000000000..58ac13315 --- /dev/null +++ b/docs/public/changelog/2026-05-26.mdx @@ -0,0 +1,40 @@ +--- +title: "Integration readiness and run filters" +date: "2026-05-26" +--- + +## Integrations show runtime readiness + +Settings > Integrations now reflects what the server can actually use at runtime instead of only showing static config flags. Fabro checks server settings, vault credential presence, and live Slack Socket Mode connection state, then reports whether each integration is disabled, missing credentials, configured, connecting, connected, or in error. + +```http +GET /api/v1/system/integrations +``` + +This makes setup issues easier to diagnose. A vault-configured Slack integration no longer appears disabled just because the old settings-only check could not see the runtime connection state. + +## Runs list filters get more precise + +The `/runs` toolbar now supports selecting multiple statuses at once, so you can keep related states visible without repeatedly changing one filter. The list also gained a Created by avatar column, which helps separate user-created, agent-created, and system-created work when a workspace is busy. + +Together with the recent size and action columns, the runs list is becoming a denser triage surface. You can narrow the list by lifecycle state, scan ownership, and act on rows without opening each run first. + +## More + + +- New `GET /api/v1/system/integrations` endpoint returns runtime integration status for GitHub and Slack + + + +- Fixed content security policy headers for the hosted web app +- Fixed terminal origin checks when a browser omits the default port +- Fixed GitHub App post-install copy so it works across installation origins +- Fixed agent session compaction dropping accumulated usage totals +- Removed retired GPT-5.2 and GPT-5.3 catalog entries + + + +- Added a multi-select run status filter to the `/runs` toolbar +- Added a Created by avatar column to the runs list +- Compacted the Test column on Settings > Models + diff --git a/docs/public/docs.json b/docs/public/docs.json index 6cf6675cc..51da121d0 100644 --- a/docs/public/docs.json +++ b/docs/public/docs.json @@ -256,6 +256,8 @@ "group": "May 2026", "icon": "clock-rotate-left", "pages": [ + "changelog/2026-05-26", + "changelog/2026-05-25", "changelog/2026-05-24", "changelog/2026-05-23", "changelog/2026-05-22",