From c8f09307d03a1ce9be969784a8f5dfada2097317 Mon Sep 17 00:00:00 2001 From: Bryan Helmkamp Date: Mon, 13 Apr 2026 22:24:29 -0400 Subject: [PATCH] docs: update changelog and docs for auth, install, and settings changes Add Apr 13 changelog entry (scripted install, dev-token local auth, GITHUB_TOKEN rename). Regenerate Apr 12 entry with provider credential auth and resolved settings. Update CLI reference for --non-interactive install and device code auth. Fix vault path, deploy-server --bind flag. Co-Authored-By: Claude Opus 4.6 (1M context) --- .claude/skills/changelog/watermark | 2 +- .claude/skills/docs/watermark | 2 +- docs/administration/deploy-server.mdx | 5 ++-- docs/administration/server-configuration.mdx | 2 +- docs/changelog/2026-04-12.mdx | 14 +++++++-- docs/changelog/2026-04-13.mdx | 30 ++++++++++++++++++++ docs/docs.json | 1 + docs/reference/cli.mdx | 6 ++-- 8 files changed, 51 insertions(+), 11 deletions(-) create mode 100644 docs/changelog/2026-04-13.mdx diff --git a/.claude/skills/changelog/watermark b/.claude/skills/changelog/watermark index bd495cdc6..1397cc6cd 100644 --- a/.claude/skills/changelog/watermark +++ b/.claude/skills/changelog/watermark @@ -1 +1 @@ -f67bebae4b58380b84341d57471e75a197e76e45 +64028692e5e05f46546cd18150b1167a120a6169 diff --git a/.claude/skills/docs/watermark b/.claude/skills/docs/watermark index bd495cdc6..1397cc6cd 100644 --- a/.claude/skills/docs/watermark +++ b/.claude/skills/docs/watermark @@ -1 +1 @@ -f67bebae4b58380b84341d57471e75a197e76e45 +64028692e5e05f46546cd18150b1167a120a6169 diff --git a/docs/administration/deploy-server.mdx b/docs/administration/deploy-server.mdx index b36315c5f..67e9d13dc 100644 --- a/docs/administration/deploy-server.mdx +++ b/docs/administration/deploy-server.mdx @@ -30,7 +30,7 @@ Both interfaces use the same workflow engine, the same Graphviz files, and the s fabro server start ``` -This starts the API on `127.0.0.1:3000` by default. To also run the web UI: +This starts the server on a Unix socket at `~/.fabro/fabro.sock` by default. Use `--bind 127.0.0.1` for TCP. To also run the web UI: ```bash fabro server start # API on port 3000 @@ -41,8 +41,7 @@ Common flags: | Flag | Default | Description | |---|---|---| -| `--port` | `3000` | Port to listen on | -| `--host` | `127.0.0.1` | Host address to bind to | +| `--bind` | `~/.fabro/fabro.sock` | Address to bind: `IP` or `IP:port` for TCP, or a path for Unix socket | | `--model` | — | Override default LLM model | | `--sandbox` | — | Override default sandbox provider | | `--max-concurrent-runs` | `5` | Maximum concurrent run executions | diff --git a/docs/administration/server-configuration.mdx b/docs/administration/server-configuration.mdx index c3509820f..a5f20cb0b 100644 --- a/docs/administration/server-configuration.mdx +++ b/docs/administration/server-configuration.mdx @@ -226,7 +226,7 @@ The same `[features]` section can be set in `.fabro/project.toml` (project-level Fabro splits secrets into two scopes: - Server runtime secrets live in `/server.env` and resolve with precedence `process env -> server.env`. -- Workflow-visible secrets live in `/secrets.json` (the vault). Anything stored in the vault may be used by workflows. +- Workflow-visible secrets live in `/vaults/default/secrets.json` (the vault). Anything stored in the vault may be used by workflows. For the auth model above, the main server runtime secrets are: diff --git a/docs/changelog/2026-04-12.mdx b/docs/changelog/2026-04-12.mdx index 9dcbb32c4..230683288 100644 --- a/docs/changelog/2026-04-12.mdx +++ b/docs/changelog/2026-04-12.mdx @@ -1,11 +1,15 @@ --- -title: "Typed secrets and fabro pr create --force" +title: "Provider credential auth and resolved settings" date: "2026-04-12" --- -## Typed secrets +## Provider credential auth -Secrets now carry metadata describing their type and purpose. The new secrets API lets you inspect which secrets are configured, what they're used for, and whether they're present — without exposing the values themselves. This makes it easier to diagnose missing credentials and understand what a workflow needs before running it. +Managing LLM provider credentials used to mean setting environment variables or manually configuring API keys for each session. Now, `fabro provider login` walks you through a typed authentication flow — OAuth device auth for OpenAI Codex, API key entry for other providers — and stores credentials securely in the vault. Workflows automatically pick up stored credentials at runtime, so you configure once and forget. + +## Resolved settings view + +`fabro settings` now renders a compact, fully-resolved view by default, showing the effective value for every setting after all layers (builtins, project, CLI overrides) are merged. Previously you had to mentally merge multiple config sources to understand what value was active. Builtin defaults are now materialized as a base layer, so `fabro settings` always shows a complete picture even when you haven't configured anything explicitly. ## More @@ -13,3 +17,7 @@ Secrets now carry metadata describing their type and purpose. The new secrets AP - Added `--force` option to `fabro pr create` to skip confirmation prompts - `fabro doctor` now checks that the storage directory exists and is writable + + +- Settings API endpoint now returns a `resolved` view alongside the raw settings + diff --git a/docs/changelog/2026-04-13.mdx b/docs/changelog/2026-04-13.mdx new file mode 100644 index 000000000..3b23acaea --- /dev/null +++ b/docs/changelog/2026-04-13.mdx @@ -0,0 +1,30 @@ +--- +title: "Scripted install and local server auth" +date: "2026-04-13" +--- + +## Scripted non-interactive install + +`fabro install` now supports fully non-interactive setup, including GitHub App creation. You can pass all required values as flags — app ID, private key, webhook secret — without any browser interaction. The installer generates Ed25519 keys natively in Rust instead of shelling out to OpenSSL, and the browser-based GitHub App bootstrap flow has been removed in favor of the CLI-only path. This makes it possible to script Fabro deployments in CI or headless environments. + +```bash +fabro install --github-app-id 12345 --github-private-key-file key.pem --github-webhook-secret s3cret +``` + +## Dev-token local server auth + +Local CLI-managed servers previously started with no authentication. Now, `fabro server start` provisions a dev token and passes it to both the CLI and web clients automatically. This means local servers are authenticated by default — the web UI redirects through a token-based login flow, and CLI commands authenticate transparently. The dev token is scoped to the local session and stored alongside other server state. + + +**`GITHUB_CLI_TOKEN` renamed to `GITHUB_TOKEN`.** The environment variable and vault secret for GitHub token auth have been renamed. The `gh_cli` strategy is now called `token`, reflecting that at runtime it's just a stored token — not tied to the `gh` CLI. + +To migrate: replace `GITHUB_CLI_TOKEN` with `GITHUB_TOKEN` in your environment or vault configuration. `GH_TOKEN` is also accepted as a fallback. + + +## More + + +- Fixed OpenAI Codex OAuth device auth to align with current endpoint response shape +- Fixed setup registration and OAuth state validation to prevent half-written configurations +- Fixed vault-backed credentials not loading during server-spawned workflow execution + diff --git a/docs/docs.json b/docs/docs.json index 519dbe8be..8b19eb445 100644 --- a/docs/docs.json +++ b/docs/docs.json @@ -251,6 +251,7 @@ "group": "April 2026", "icon": "clock-rotate-left", "pages": [ + "changelog/2026-04-13", "changelog/2026-04-12", "changelog/2026-04-11", "changelog/2026-04-10", diff --git a/docs/reference/cli.mdx b/docs/reference/cli.mdx index 77f56d2a3..b785df962 100644 --- a/docs/reference/cli.mdx +++ b/docs/reference/cli.mdx @@ -810,7 +810,7 @@ fabro provider login --provider anthropic |---|---| | `--provider ` | LLM provider to authenticate with (required) | -For OpenAI, this launches a browser-based OAuth PKCE flow with an automatic fallback to manual API key entry. All other providers prompt for an API key with validation. Credentials are saved to the connected Fabro server's secret store. +For OpenAI, this offers a device code flow — you open a URL in your browser, enter a one-time code, and Fabro completes the auth handshake automatically. If you decline, it falls back to manual API key entry. All other providers prompt for an API key with validation. Credentials are saved to the connected Fabro server's vault as typed credentials. ## `fabro install` @@ -819,13 +819,15 @@ Interactive setup wizard that walks you through configuring API keys and validat ```bash fabro install fabro install --web-url https://fabro.example.com +fabro install --non-interactive --llm-provider anthropic --llm-api-key-env ANTHROPIC_API_KEY --github-strategy token ``` | Flag | Description | Default | |---|---|---| | `--web-url ` | Web UI base URL for OAuth callback endpoints | `http://localhost:3000` | +| `--non-interactive` | Run without prompts; supply inputs via scripted flags | — | -When configuring a GitHub App, the wizard detects your GitHub organizations (via the `gh` CLI) and lets you choose whether to register the app under your personal account or an organization. +When configuring a GitHub App, the wizard detects your GitHub organizations (via the `gh` CLI) and lets you choose whether to register the app under your personal account or an organization. Use `--non-interactive` for headless or CI environments where no TTY is available. ## `fabro uninstall`