mirror of
https://github.com/fabro-sh/fabro.git
synced 2026-08-28 05:27:41 +00:00
docs: update changelog and docs for auth, install, and settings changes
Add Apr 13 changelog entry (scripted install, dev-token local auth, GITHUB_TOKEN rename). Regenerate Apr 12 entry with provider credential auth and resolved settings. Update CLI reference for --non-interactive install and device code auth. Fix vault path, deploy-server --bind flag. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Bryan Helmkamp
parent
e5b7bb1909
commit
c8f09307d0
8 changed files with 51 additions and 11 deletions
|
|
@ -1 +1 @@
|
|||
f67bebae4b58380b84341d57471e75a197e76e45
|
||||
64028692e5e05f46546cd18150b1167a120a6169
|
||||
|
|
|
|||
|
|
@ -1 +1 @@
|
|||
f67bebae4b58380b84341d57471e75a197e76e45
|
||||
64028692e5e05f46546cd18150b1167a120a6169
|
||||
|
|
|
|||
|
|
@ -30,7 +30,7 @@ Both interfaces use the same workflow engine, the same Graphviz files, and the s
|
|||
fabro server start
|
||||
```
|
||||
|
||||
This starts the API on `127.0.0.1:3000` by default. To also run the web UI:
|
||||
This starts the server on a Unix socket at `~/.fabro/fabro.sock` by default. Use `--bind 127.0.0.1` for TCP. To also run the web UI:
|
||||
|
||||
```bash
|
||||
fabro server start # API on port 3000
|
||||
|
|
@ -41,8 +41,7 @@ Common flags:
|
|||
|
||||
| Flag | Default | Description |
|
||||
|---|---|---|
|
||||
| `--port` | `3000` | Port to listen on |
|
||||
| `--host` | `127.0.0.1` | Host address to bind to |
|
||||
| `--bind` | `~/.fabro/fabro.sock` | Address to bind: `IP` or `IP:port` for TCP, or a path for Unix socket |
|
||||
| `--model` | — | Override default LLM model |
|
||||
| `--sandbox` | — | Override default sandbox provider |
|
||||
| `--max-concurrent-runs` | `5` | Maximum concurrent run executions |
|
||||
|
|
|
|||
|
|
@ -226,7 +226,7 @@ The same `[features]` section can be set in `.fabro/project.toml` (project-level
|
|||
Fabro splits secrets into two scopes:
|
||||
|
||||
- Server runtime secrets live in `<data_dir>/server.env` and resolve with precedence `process env -> server.env`.
|
||||
- Workflow-visible secrets live in `<data_dir>/secrets.json` (the vault). Anything stored in the vault may be used by workflows.
|
||||
- Workflow-visible secrets live in `<data_dir>/vaults/default/secrets.json` (the vault). Anything stored in the vault may be used by workflows.
|
||||
|
||||
For the auth model above, the main server runtime secrets are:
|
||||
|
||||
|
|
|
|||
|
|
@ -1,11 +1,15 @@
|
|||
---
|
||||
title: "Typed secrets and fabro pr create --force"
|
||||
title: "Provider credential auth and resolved settings"
|
||||
date: "2026-04-12"
|
||||
---
|
||||
|
||||
## Typed secrets
|
||||
## Provider credential auth
|
||||
|
||||
Secrets now carry metadata describing their type and purpose. The new secrets API lets you inspect which secrets are configured, what they're used for, and whether they're present — without exposing the values themselves. This makes it easier to diagnose missing credentials and understand what a workflow needs before running it.
|
||||
Managing LLM provider credentials used to mean setting environment variables or manually configuring API keys for each session. Now, `fabro provider login` walks you through a typed authentication flow — OAuth device auth for OpenAI Codex, API key entry for other providers — and stores credentials securely in the vault. Workflows automatically pick up stored credentials at runtime, so you configure once and forget.
|
||||
|
||||
## Resolved settings view
|
||||
|
||||
`fabro settings` now renders a compact, fully-resolved view by default, showing the effective value for every setting after all layers (builtins, project, CLI overrides) are merged. Previously you had to mentally merge multiple config sources to understand what value was active. Builtin defaults are now materialized as a base layer, so `fabro settings` always shows a complete picture even when you haven't configured anything explicitly.
|
||||
|
||||
## More
|
||||
|
||||
|
|
@ -13,3 +17,7 @@ Secrets now carry metadata describing their type and purpose. The new secrets AP
|
|||
- Added `--force` option to `fabro pr create` to skip confirmation prompts
|
||||
- `fabro doctor` now checks that the storage directory exists and is writable
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="API">
|
||||
- Settings API endpoint now returns a `resolved` view alongside the raw settings
|
||||
</Accordion>
|
||||
|
|
|
|||
30
docs/changelog/2026-04-13.mdx
Normal file
30
docs/changelog/2026-04-13.mdx
Normal file
|
|
@ -0,0 +1,30 @@
|
|||
---
|
||||
title: "Scripted install and local server auth"
|
||||
date: "2026-04-13"
|
||||
---
|
||||
|
||||
## Scripted non-interactive install
|
||||
|
||||
`fabro install` now supports fully non-interactive setup, including GitHub App creation. You can pass all required values as flags — app ID, private key, webhook secret — without any browser interaction. The installer generates Ed25519 keys natively in Rust instead of shelling out to OpenSSL, and the browser-based GitHub App bootstrap flow has been removed in favor of the CLI-only path. This makes it possible to script Fabro deployments in CI or headless environments.
|
||||
|
||||
```bash
|
||||
fabro install --github-app-id 12345 --github-private-key-file key.pem --github-webhook-secret s3cret
|
||||
```
|
||||
|
||||
## Dev-token local server auth
|
||||
|
||||
Local CLI-managed servers previously started with no authentication. Now, `fabro server start` provisions a dev token and passes it to both the CLI and web clients automatically. This means local servers are authenticated by default — the web UI redirects through a token-based login flow, and CLI commands authenticate transparently. The dev token is scoped to the local session and stored alongside other server state.
|
||||
|
||||
<Warning>
|
||||
**`GITHUB_CLI_TOKEN` renamed to `GITHUB_TOKEN`.** The environment variable and vault secret for GitHub token auth have been renamed. The `gh_cli` strategy is now called `token`, reflecting that at runtime it's just a stored token — not tied to the `gh` CLI.
|
||||
|
||||
To migrate: replace `GITHUB_CLI_TOKEN` with `GITHUB_TOKEN` in your environment or vault configuration. `GH_TOKEN` is also accepted as a fallback.
|
||||
</Warning>
|
||||
|
||||
## More
|
||||
|
||||
<Accordion title="Fixes">
|
||||
- Fixed OpenAI Codex OAuth device auth to align with current endpoint response shape
|
||||
- Fixed setup registration and OAuth state validation to prevent half-written configurations
|
||||
- Fixed vault-backed credentials not loading during server-spawned workflow execution
|
||||
</Accordion>
|
||||
|
|
@ -251,6 +251,7 @@
|
|||
"group": "April 2026",
|
||||
"icon": "clock-rotate-left",
|
||||
"pages": [
|
||||
"changelog/2026-04-13",
|
||||
"changelog/2026-04-12",
|
||||
"changelog/2026-04-11",
|
||||
"changelog/2026-04-10",
|
||||
|
|
|
|||
|
|
@ -810,7 +810,7 @@ fabro provider login --provider anthropic
|
|||
|---|---|
|
||||
| `--provider <PROVIDER>` | LLM provider to authenticate with (required) |
|
||||
|
||||
For OpenAI, this launches a browser-based OAuth PKCE flow with an automatic fallback to manual API key entry. All other providers prompt for an API key with validation. Credentials are saved to the connected Fabro server's secret store.
|
||||
For OpenAI, this offers a device code flow — you open a URL in your browser, enter a one-time code, and Fabro completes the auth handshake automatically. If you decline, it falls back to manual API key entry. All other providers prompt for an API key with validation. Credentials are saved to the connected Fabro server's vault as typed credentials.
|
||||
|
||||
## `fabro install`
|
||||
|
||||
|
|
@ -819,13 +819,15 @@ Interactive setup wizard that walks you through configuring API keys and validat
|
|||
```bash
|
||||
fabro install
|
||||
fabro install --web-url https://fabro.example.com
|
||||
fabro install --non-interactive --llm-provider anthropic --llm-api-key-env ANTHROPIC_API_KEY --github-strategy token
|
||||
```
|
||||
|
||||
| Flag | Description | Default |
|
||||
|---|---|---|
|
||||
| `--web-url <URL>` | Web UI base URL for OAuth callback endpoints | `http://localhost:3000` |
|
||||
| `--non-interactive` | Run without prompts; supply inputs via scripted flags | — |
|
||||
|
||||
When configuring a GitHub App, the wizard detects your GitHub organizations (via the `gh` CLI) and lets you choose whether to register the app under your personal account or an organization.
|
||||
When configuring a GitHub App, the wizard detects your GitHub organizations (via the `gh` CLI) and lets you choose whether to register the app under your personal account or an organization. Use `--non-interactive` for headless or CI environments where no TTY is available.
|
||||
|
||||
## `fabro uninstall`
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue