236 commits

Author	SHA1	Message	Date
Bryan Helmkamp	9d9c48ba25	feat(server): add docker worker runtime ... Add server worker runtime settings and the worker bootstrap API. Add API bootstrap support for worker CLI processes and Docker-backed workers. Update the split-web PoC compose config and docs for Docker worker validation.	2026-05-29 21:54:01 -04:00
fabro-sh-0530[bot]	4cff07373c	feat: add server-owned environment store (Task 1 & 2 foundation) (#446) ... ## Summary Moves environment definitions out of project/workflow TOML config and into server-owned files, introducing the `fabro-environment` crate and enforcing source-aware validation so project/workflow/user configs can no longer define environment catalogs. ### What changed **New `fabro-environment` crate** — workspace crate wired into `fabro-cli` and `fabro-server`. Exposes a `seeded_catalog_layer()` that CLI commands inject at the call site to fill the environment catalog that settings resolution requires. **Config environments are now migration-only** — `defaults.toml` no longer ships a built-in `[environments.*]` catalog. Instead: - `SettingsSource` enum tags every parsed layer (ActiveSettings, Project, Workflow, DirectRun, User). - `validate_settings_source` rejects `[environments.<id>]` in any source except `ActiveSettings` with a targeted message: `[environments.<id>] is now server-managed; move this definition to the server environments directory`. - TOML-provided `run.environment.{image,resources,network,lifecycle,labels,volumes,env}` overrides are also rejected; only `run.environment.id` survives. **New migration** (`2026052801_settings_environments_to_server_files`) — chains after the existing legacy-sandbox migration. Extracts `[environments.*]` entries from `settings.toml` into sibling `environments/<id>.toml` files, writes a `.settings-environments-migration.bak` backup, and fails without modifying any file if a target already exists. **Builder API additions** — `RunSettingsBuilder::load_from_with_catalog`, `load_default_with_catalog`, `from_toml_with_catalog` let callers inject a server-side catalog; the bare `from_toml` path now errors if no catalog is present and a named environment is selected. `WorkflowSettingsBuilder` test helpers in `src/tests/mod.rs` centralise catalog injection across all config tests. **`.fabro/project.toml`** — removed the inline `[environments.fabro-dev]` block (environment definition now lives server-side). ### Key design decisions - CLI offline commands (graph, preflight, validate) use `seeded_catalog_layer()` as a local stand-in until a running server is available — matches the pre-existing behaviour without regressing offline workflows. - `load_settings_path` no longer runs migrations for non-ActiveSettings sources, preventing project/workflow files from accidentally triggering file-system writes. - The `MigrationReport` type is now the new migration's `SettingsEnvironmentsMigrationReport` (exposes `contents: String` instead of a parsed layer), keeping `load.rs` simpler and decoupled from layer parsing. ### Fabro Details <details> <summary>Ran 9 stages in 143m 23s for $105.27</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 11s | – | 0 | | preflight_lint | 2m 23s | – | 0 | | implement | 28m 27s | – | 0 | | simplify_opus | 37m 27s | $53.28 | 0 | | simplify_gpt | 20m 50s | $12.14 | 0 | | verify | 6m 3s | – | 0 | | fixup | 45m 15s | $39.84 | 0 | | **Total** | **143m 23s** | **$105.27** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-28 17:10:59 -04:00
fabro-sh-0530[bot]	29a9a3f7d6	refactor: Remove inbound IP allowlisting (#443) ... ## Summary Removes Fabro's in-process inbound source-IP allowlist entirely. `[server.ip_allowlist]` and `[server.integrations.github.webhooks.ip_allowlist]` are gone from config parsing, resolved settings types, the OpenAPI spec, generated API clients, and the Settings > Security UI. Existing `settings.toml` files containing those keys now fail as unknown fields — this is a hard removal with no migration path. Network source restrictions should be enforced upstream via a reverse proxy, firewall, VPN, Tailscale ACLs, Kubernetes ingress, or platform policy. ### What changed - **Config/types** (`fabro-config`, `fabro-types`): Removed `ServerIpAllowlistLayer`, `ServerIpAllowlistOverrideLayer`, `ServerIpAllowlistSettings`, `ServerIpAllowlistOverrideSettings`, `IpAllowEntry`, associated resolver functions, GitHub `/meta` hook-range parsing, and Unix socket trusted-proxy validation. `ipnet` dropped from `fabro-types`; kept in `fabro-config` for sandbox CIDR validation. - **Server runtime** (`fabro-server`): Deleted `ip_allowlist.rs`, removed `IpAllowlistConfig` parameter from `build_router_with_options` and `RouterOptions`, removed the global allowlist middleware layer, and removed `GitHubMetaResolver` startup logic. GitHub webhook HMAC verification is unchanged. - **OpenAPI + generated clients**: Removed `ServerIpAllowlistSettings`, `ServerIpAllowlistOverrideSettings`, `IpAllowEntry`, `LiteralIpAllowEntry`, `GitHubMetaHooksEntry` schemas; removed `ip_allowlist` from `ServerNamespace` and `IntegrationWebhooksSettings`; dropped `IpAllowEntry` re-exports from `fabro-api`. - **Web UI**: Removed IP allowlist row from Settings > Security; updated nav description and page copy. - **Docs/changelog**: Security docs explicitly state Fabro provides no source-IP filtering and direct operators upstream. Changelog entry dated 2026-05-27 documents the breaking removal and annotates the 2026-04-19 entry where the feature was introduced. ### Also in this diff (unrelated to IP allowlisting) The worker control stream was migrated from reading newline-delimited JSON on stdin to a reconnecting WebSocket (`/api/v1/runs/{id}/worker/control-stream`). This adds `tokio-tungstenite` to `fabro-cli`/`fabro-server`, introduces `WorkerControlManagerHandle` with backoff reconnection and deduplication of replayed delivery IDs, and adds `RunPause`/`RunUnpause` message handling. A new integration test (`detached_run_cancel_reaches_worker_over_control_websocket`) exercises the full cancel path over the WebSocket. ### Key decisions - **Hard removal via `deny_unknown_fields`**: stale config is immediately visible as a startup error rather than silently ignored. - **No stub or default pass-through**: `IpAllowlistConfig::default()` is gone, not left as a no-op wrapper, to avoid keeping the feature shape alive. - **Webhook HMAC boundary unchanged**: source-IP filtering on webhook routes is removed; cryptographic signature verification remains the security boundary. ### Fabro Details <details> <summary>Ran 9 stages in 59m 53s for $27.24</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 15s | – | 0 | | preflight_lint | 2m 22s | – | 0 | | implement | 33m 54s | $22.81 | 0 | | simplify_opus | 5m 55s | $0.75 | 0 | | simplify_gpt | 3m 35s | $2.81 | 0 | | verify | 8m 34s | – | 0 | | fixup | 2m 24s | $0.87 | 0 | | **Total** | **59m 53s** | **$27.24** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh>	2026-05-27 22:29:08 -04:00
Bryan Helmkamp	ec1b3f2084	feat(sandbox): secure daytona snapshot names (#429) ... ## Summary Secures Daytona custom snapshot creation by removing user-controlled snapshot/image references and replacing them with deterministic names Fabro computes internally. Docker image selection now uses `image.docker`, while Daytona only accepts `image.dockerfile` for custom snapshots and continues to use `daytona-medium` when no Dockerfile is configured. ## Changes - Replaces public `image.ref` config/API shape with Docker-specific `image.docker` across Rust settings, OpenAPI, generated TypeScript client, docs, defaults, examples, and web samples. - Adds Daytona snapshot identity generation using HMAC-SHA256 over a canonical manifest keyed by the Daytona API key, producing `fabro-<uuid>` snapshot names without exposing Dockerfile text or key material. - Routes Daytona custom Dockerfiles, including devcontainer-generated Dockerfiles, through the same computed identity path before calling Daytona snapshot APIs. - Updates sandbox initialization events and store projections so initialized run state can show the resolved image and computed Daytona snapshot after startup. - Updates legacy config migration behavior so Docker image refs map to `image.docker`, while Daytona legacy snapshot names are not preserved. ## Breaking Changes - `image.ref` is no longer accepted in new environment config. - Docker environments should use `image.docker` for image selection. - Daytona environments reject `image.docker`; use `image.dockerfile` to request a custom computed snapshot. ## Verification - `cargo build -p fabro-api` - `cd lib/packages/fabro-api-client && bun run generate` - `cd lib/packages/fabro-api-client && bun run typecheck` - `cd apps/fabro-web && bun run typecheck` - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings` - `ulimit -n 4096 && cargo nextest run --no-fail-fast -p fabro-cli -p fabro-config -p fabro-sandbox -p fabro-workflow -p fabro-store -p fabro-server -p fabro-api` - `cargo insta pending-snapshots` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex)	2026-05-27 11:52:35 -04:00
Bryan Helmkamp	b1bd2f522c	feat(server): add variables API (#430) ... ## Summary Adds a workflow-visible variables store and HTTP API for managing non-sensitive run variables, then wires those variables into run config interpolation before run creation, validation, and preflight. ## What Changed - Adds `/api/v1/variables` CRUD endpoints backed by a JSON variable store and generated Rust/TypeScript API types. - Supports `{{ vars.NAME }}` interpolation alongside existing `{{ env.NAME }}` handling for run-owned config fields, including environment, MCP, hook, artifact, checkpoint, SCM, and notification settings. - Reuses canonical `fabro-types` variable DTOs in `fabro-api` and adds OpenAPI name patterns so clients see the same env-style variable contract enforced by the server. - Keeps variable updates store-owned with `update_existing`, avoiding duplicated not-found/update semantics in the HTTP handler. - Shares env-style name validation between variables, interpolation parsing, and vault token names to avoid grammar drift. Variables are intentionally non-sensitive: list/get responses include values, unlike vault secrets. ## Validation - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo test -p fabro-types` - `cargo test -p fabro-variable` - `cargo test -p fabro-api --test variable_round_trip` - `cargo test -p fabro-server --features test-support --test it api::variables` - `cargo +nightly-2026-04-14 clippy -p fabro-types -p fabro-variable -p fabro-vault --all-targets -- -D warnings` - `cargo +nightly-2026-04-14 clippy -p fabro-server --features test-support --all-targets -- -D warnings` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex/)	2026-05-27 11:46:36 -04:00
Bryan Helmkamp	ab0f94fd82	feat(system): report runtime integration status (#416) ... ## Summary Settings > Integrations now reflects the server's actual integration readiness instead of only static `settings.toml` booleans. This adds `/api/v1/system/integrations` as the runtime source of truth, covering server config, vault credential presence, and Slack Socket Mode connection state. ## What Changed - Added shared `fabro-types` integration status models and reused them from `fabro-api` to avoid duplicate API/domain types. - Added `GET /api/v1/system/integrations` to the OpenAPI spec, Rust server routes, demo routes, and generated TypeScript client. - Reports GitHub and Slack status as `disabled`, `missing_credentials`, `configured`, `connecting`, `connected`, or `error`, with non-secret metadata and missing credential names. - Tracks Slack Socket Mode runtime state from the Slack connection loop and respects explicit `server.integrations.slack.enabled = false` even when vault tokens exist. - Updated the Integrations settings page to read the new runtime endpoint, so a vault-configured Slack setup no longer appears simply as disabled. ## Verification - `cargo build -p fabro-api` - `cargo nextest run -p fabro-api system_integrations` - `cargo nextest run -p fabro-config resolved_server_integrations_are_slack_only_for_chat` - `cargo nextest run -p fabro-slack run_event_loop_notifies_connected_status` - `cargo nextest run -p fabro-server --features test-support --test it get_system_integrations` - `cargo nextest run -p fabro-server` - `cargo +nightly-2026-04-14 fmt --check --all` - `cd apps/fabro-web && bun test app/routes/settings-integrations.test.tsx app/lib/query-keys.test.ts` - `cd apps/fabro-web && bun run typecheck` - `cd apps/fabro-web && bun run build` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex)	2026-05-26 19:27:32 -04:00
fabro-sh-0530[bot]	e8f0aceee8	refactor: rationalize server secret scopes (vault-only for optional int… (#401) ... ## Summary Separates Fabro server secrets into two explicit scopes: **bootstrap** secrets that come from process env or `server.env`, and **optional integration** secrets that come exclusively from the vault. This makes secret resolution simple and predictable, and removes all `process env → server.env` fallback paths for optional integrations such as GitHub App, Slack, Daytona, Brave Search, and LLM provider keys. ## What changed **New `ToolSecrets` struct in `fabro-agent`** — Brave Search API key is now passed explicitly through `SessionOptions.tool_secrets` rather than read from process env inside the tool. The standalone CLI reads the key at the CLI boundary (with an explicit `#[expect(clippy::disallowed_methods)]` annotation); the server will read it from the vault. The error message changes from `"BRAVE_SEARCH_API_KEY environment variable is not set"` to `"BRAVE_SEARCH_API_KEY is not configured"`. **`VaultCredentialSource::vault_only` constructor in `fabro-auth`** — Adds a constructor that passes `|_| None` as the env lookup, ensuring the server LLM credential source never resolves provider keys from process env. **GitHub App secrets move to vault in install flows** — Both the CLI `fabro install github` path and the browser install finish handler now write `GITHUB_APP_PRIVATE_KEY`, `GITHUB_APP_CLIENT_SECRET`, and `GITHUB_APP_WEBHOOK_SECRET` to the vault instead of `server.env`. Switching strategies removes stale secrets from the other strategy's storage location. The `vault_set` field type changes from `Vec<(String, String)>` to `Vec<VaultSecretWrite>` to carry per-secret type metadata (file vs. token). **`fabro-vault` gains a `fabro-static` dependency** — Needed so the vault crate can reference canonical env-var names from the shared registry without a cycle. **`GH_TOKEN` fallback removed** — `GITHUB_TOKEN` is now read from the vault only; the changelog and `server-configuration.mdx` note drops mention of `GH_TOKEN` as an accepted fallback. **Version bump** — Workspace crates promoted from `0.244.0-nightly.0` to `0.244.0`. **Docs** — Internal strategy doc, public admin docs (Docker, Railway, server-configuration, security, troubleshooting), and integration docs (GitHub, Slack, Daytona, Brave Search, LiteLLM, tools reference, models) all updated to reflect vault-only optional secrets and direct users to `fabro secret set` rather than process env or `server.env`. ### Plan Summary - **Task 1** (secret registry) — not yet present in this diff; classification lives in the places that consume it. - **Task 3–6** (vault-only lookups for GitHub, Slack, Daytona, LLM) — implemented via `vault_only` constructor, `tool_secrets` threading, and install-path changes. - **Task 7** (Brave Search explicit injection) — `ToolSecrets`, `register_core_tools` wiring, CLI boundary read. - **Task 8** (install persistence) — GitHub App secrets written to vault; token strategy writes `GITHUB_TOKEN` to vault and clears app vault keys; app strategy clears `GITHUB_TOKEN` vault key. - **Task 9** (docs) — all public and internal docs updated. ### Fabro Details <details> <summary>Ran 0 stages in 155m 26s for $60.85</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | **Total** | **155m 26s** | **$60.85** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-25 17:26:01 -04:00
fabro-sh-0530[bot]	2c0416e1c5	feat: add server sandbox provider enablement policy (#389) ... Operators can now disable individual sandbox providers at the server level via `[server.sandbox.providers.<provider>]` in `settings.toml`, without breaking existing deployments that omit the section entirely. ## What changed **Config layer & resolution** (`fabro-config`, `fabro-types`): new sparse `ServerSandboxLayer` / `ServerSandboxProvidersLayer` / `ServerSandboxProviderLayer` structs with `deny_unknown_fields` parse validation. Resolution defaults every missing level to `enabled = true`. The resolved `ServerSandboxSettings` / `ServerSandboxProvidersSettings` / `ServerSandboxProviderSettings` types live in `fabro-types` and are shared by all consumers. **Policy enforcement** (`fabro-server`): three check points enforce the effective provider (after dry-run Local coercion): 1. `POST /api/v1/runs` — 400 at admission. 2. `POST /api/v1/runs/preflight` — `ok: false` with a `Sandbox Provider Policy` error check. 3. Launch (`execute_run_in_process` / `execute_run_subprocess`) — fail-before-execution with a `LaunchFailed` reason. The dry-run coercion logic was extracted into `SandboxProvider::effective_for(mode)` on the type itself and reused across `fabro-server` and `fabro-workflow`. **Installer** (`fabro-install`): `write_sandbox_settings` now always writes all three provider policy tables with `enabled = true`, so generated `settings.toml` files are self-documenting. **API schema & clients**: `ServerNamespace` gains a required `sandbox` field in the OpenAPI spec; three new TypeScript model files were regenerated accordingly. ### Plan Summary - Task 1: config layer structs → resolved types → resolver helpers → tests - Task 2: `effective_sandbox_provider` + `sandbox_provider_policy_error` helpers; admission, preflight, and launch checks + integration tests - Task 3: installer writes all three provider entries; install finish tests updated - Task 4: OpenAPI schema, `fabro-api` build mappings, TS client regeneration, docs ### Fabro Details <details> <summary>Ran 8 stages in 59m 15s for $45.70</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 5s | – | 0 | | preflight_lint | 2m 21s | – | 0 | | implement | 27m 55s | $38.88 | 0 | | simplify_opus | 14m 20s | $4.93 | 0 | | simplify_gpt | 3m 14s | $1.88 | 0 | | verify | 8m 49s | – | 0 | | **Total** | **59m 15s** | **$45.70** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-24 16:49:05 -04:00
Fabian Kukuck	990324710c	Add legacy SSE MCP transport support (#386) ... ## Summary Adds support for MCP servers that use the SSE-based HTTP transport, including Playwright MCP. Fabro already supports stdio and Streamable HTTP MCP servers. Some MCP servers still expose the SSE transport shape where the client opens an SSE stream, receives an `endpoint` event, and sends JSON-RPC requests back to that endpoint. This PR adds an explicit `protocol = "sse"` option while keeping Streamable HTTP as the default. ## What Changed - Added `McpHttpProtocol` with `streamable_http` as the default and `sse` as an opt-in protocol. - Added an SSE MCP client transport implementation. - Wired HTTP MCP setup to choose Streamable HTTP or SSE based on config. - Added `protocol = "sse"` support for both `http` and `sandbox` MCP entries. - Updated sandbox MCP resolution so SSE sandbox servers connect through the preview `/sse` path. - Documented `protocol = "sse"` for Playwright MCP. - Added an integration test covering SSE initialize, tool listing, and tool calls. ## Example ```toml [run.agent.mcps.playwright] type = "sandbox" protocol = "sse" command = ["npx", "@playwright/mcp@latest", "--port", "3100", "--headless", "--browser", "chromium"] port = 3100 startup_timeout = "60s" tool_timeout = "2m" ``` ## Compatibility Existing MCP configs are unchanged because `protocol` defaults to `streamable_http`. ## Validation - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo nextest run -p fabro-mcp` - `cargo check -p fabro-agent -p fabro-workflow -p fabro-config` --------- Co-authored-by: Bryan Helmkamp <bryan@brynary.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-24 15:29:01 -04:00
fabro-sh-0530[bot]	c81fcc2a27	Auto-migrate legacy [run.sandbox] config files to named-environment syn… (#375) ... ## Summary On startup, Fabro now detects confidently migratable pre-v1.0 `[run.sandbox]` config files and rewrites them in-place to the `[run.environment]` + `[environments.default]` named-environment syntax. The original file is preserved as a sibling `*.legacy-sandbox-migration.bak` before any write. Unsupported or ambiguous keys produce a targeted error listing exact key paths rather than a generic TOML unknown-field failure. ### Plan Summary - **New module** `legacy_sandbox_migration.rs` owns all detection, rewriting, backup logic, and unsupported-key diagnostics — isolated so it can be deleted before v1.0. - **`load.rs` hook** catches parse failures on file loads and attempts migration before re-raising the original error, leaving in-memory `SettingsLayer` parsing strict and unchanged. - **Field mappings** cover Daytona (snapshot, volumes, labels, lifecycle, `auto_stop_interval`) and Docker (image, `memory_limit`, `cpu_quota` divisible by 100 000, `skip_clone`). - **Ambiguity guard** rejects files that already contain `[run.environment]` or `[environments.default]` alongside `[run.sandbox]`. - **Docs** add a `<Warning>` block to `environments.mdx` and a new `2026-05-23.mdx` changelog entry. This PR also bundles two unrelated improvements that landed in the same branch: additional sort keys (`repo`, `title`, `workflow`, `changes`) for the runs list API and UI, and a test isolation fix in `user.rs` that wraps path assertions in `with_var` to avoid `FABRO_HOME` leakage. ### Migration flow ```mermaid flowchart TB A[load_settings_path] --> B{parse SettingsLayer} B -- ok --> G[resolve paths / return] B -- err --> C{migrate_settings_path} C -- no legacy sandbox --> D[return original parse error] C -- has new env config --> E[error: ambiguous, manual fix required] C -- unsupported keys --> F[error: list unsupported keys] C -- success --> H[write .bak, rewrite file, warn] H --> I[parse migrated SettingsLayer] I --> G ``` ### Fabro Details <details> <summary>Ran 0 stages in 53m 26s for $16.82</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | **Total** | **53m 26s** | **$16.82** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Fabro <fabro@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-23 19:34:43 -04:00
fabro-sh-0530[bot]	0f36304d2c	Add small_default model role and async generated run titles (#368) ... ## Summary Introduces a `small_default` catalog role for identifying each provider's small/cheap utility model, and uses that model to asynchronously generate human-readable run titles when the caller doesn't supply one explicitly. ### Plan Summary - **Catalog**: Add `small_default: Option<bool>` to `ModelCatalogSettings` and `small_default: bool` to the `Model` type. Mark built-in small defaults: `claude-haiku-4-5` (Anthropic), `gpt-5.4-mini` (OpenAI), `gemini-3.1-flash-lite-preview` (Gemini). Validate that each provider has at most one small default; zero is allowed with fallback to the provider's regular default. - **Helpers**: Add `small_default_for_provider` and `small_default_for_configured_ids` on `Catalog`, mirroring the existing `default_for_provider` / `default_for_configured_ids` / `probe_for_provider` pattern. - **Title generation**: New `run_title_generation` module in `fabro-server` builds a prompt from workflow identity, goal, and raw run inputs, calls `generate_object` with `max_tokens(64)` and a 10 s timeout, normalizes output (trim, reject blank/control, truncate to 100 chars), and falls back to the deterministic title on any failure. - **Server integration**: In the create-run handler, if no explicit `RunManifest.title` was supplied and at least one LLM provider is ready, spawn a detached task that generates a title and appends `run.title.updated` — but only if the title hasn't been changed by a concurrent user PATCH. ## What changed and why **`small_default` vs `default`** — the existing `default` role drives normal model selection for workflow execution and must not be disturbed. `small_default` is a separate, additive role for lightweight metadata work. The two roles are intentionally independent so teams can promote a newer large model to `default` without accidentally routing title generation there. **Best-effort, async title enrichment** — run creation is kept synchronous and reliable. The title task is fire-and-forget: LLM errors, timeouts, and validation failures all silently leave the deterministic title in place. The stale-title guard (`current.title != deterministic_title`) prevents the async task from clobbering a concurrent user edit via `PATCH /runs/{id}`. **No redaction** — per the design goal, raw input values are forwarded to the model. This is noted explicitly in the prompt and in the module docs. **Prompt size bounding** — each of the three prompt sections (workflow identity, run inputs, workflow summary) is independently capped at 4 000 characters with a `...[truncated]` marker so pathological inputs can't produce enormous requests. ## Public interface changes - `Model` gains `small_default: bool` in the Rust type, OpenAPI schema, and generated TypeScript client. - `MAX_RUN_TITLE_CHARS` is now `pub` in `fabro-types` so the title-generation module can reuse the same limit. - Config docs (`models.mdx`, `litellm.mdx`) document `small_default = true` alongside `default` and `probe`. ### Fabro Details <details> <summary>Ran 9 stages in 61m 23s for $32.17</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 2s | – | 0 | | preflight_compile | 1m 52s | – | 0 | | preflight_lint | 2m 5s | – | 0 | | implement | 29m 16s | $23.26 | 0 | | simplify_opus | 17m 15s | $6.28 | 0 | | simplify_gpt | 7m 1s | $2.63 | 0 | | verify | 3m 7s | – | 0 | | fmt | 3s | – | 0 | | **Total** | **61m 23s** | **$32.17** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (12 nodes and 15 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --cargo-quiet --workspace --status-level fail 2>&1 && cargo dev docs refresh 2>&1 && cargo dev docs check 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all clippy lint warnings, test failures, and generated docs errors.", max_visits=3] fmt [label="Format", shape=parallelogram, script="cargo +nightly-2026-04-14 fmt --all 2>&1", max_retries=0] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> fmt [condition="outcome=succeeded"] verify -> fixup fixup -> verify fmt -> exit } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-23 13:48:39 -04:00
fabro-sh-0530[bot]	7f84ac5e3f	Replace run-scoped sandbox config with named environments (#360) ... ## Summary Replaces the `[run.sandbox]` configuration surface with a named, provider-explicit environment catalog. Runs now select an environment by slug (`[run.environment] id = "..."`) rather than configuring a sandbox inline. Fabro resolves the catalog through normal settings precedence, applies sparse run-level overrides, and creates a concrete sandbox from the resolved environment. This is a clean break — no `[run.sandbox]` compatibility layer. ### Plan Summary - **New config shape:** Top-level `[environments.<slug>]` catalog valid in `settings.toml`, `.fabro/project.toml`, and `workflow.toml`. Runs reference a slug via `[run.environment] id = "..."` with optional sparse overrides under `[run.environment.*]`. - **Unified environment fields:** `provider`, `image` (ref + dockerfile), `resources` (cpu/memory/disk), `network` (mode + allow CIDRs), `lifecycle` (preserve/stop_on_terminal/auto_stop), `labels`, `volumes`, `env` — replacing the previous split between `[run.sandbox]`, `[run.sandbox.docker]`, `[run.sandbox.daytona]`, and `[run.sandbox.daytona.snapshot]`. - **OpenAPI schema update:** `RunSandboxSettings`, `DockerSettings`, `DaytonaSettings`, and `DaytonaNetworkLayer` replaced with `RunEnvironmentSettings`, `EnvironmentSettings`, `EnvironmentProvider`, `EnvironmentImageSettings`, `EnvironmentResourcesSettings`, `EnvironmentNetworkSettings`, `EnvironmentLifecycleSettings`, and `EnvironmentVolumeSettings`. - **CLI flag rename:** `--sandbox <provider>` → `--environment <slug>` on `run`, `create`, `preflight`, and `server start/restart`. - **Provider capability model:** Hard errors for security properties a provider cannot enforce (local with blocked/CIDR networking; docker with CIDR allow-lists). Warnings for unsupported resource limits, volumes, labels, auto-stop, and Docker Dockerfiles. - **Docs and internal code updated** throughout: `.fabro/project.toml`, workflow configs, all public docs, CLI args, manifest builders, and the runner's GitHub credentials check. ### Provider mapping | Environment field | Local | Docker | Daytona | |---|---|---|---| | `image.ref` | Ignored | Docker image | Snapshot name | | `image.dockerfile` | Ignored | Warning; ignored | Snapshot Dockerfile (requires `image.ref`) | | `resources.cpu/memory/disk` | Warning; ignored | cpu_quota / memory limit / warning | Snapshot sizing | | `network.mode = block` | **Error** | `network_mode = none` | Daytona block | | `network.mode = cidr_allow_list` | **Error** | **Error** | Daytona CIDR allow-list | | `labels` | Warning; ignored | Warning; ignored | Daytona labels | | `volumes` | Warning; ignored | Warning; ignored | Daytona volume mounts | | `lifecycle.auto_stop` | Warning; ignored | Warning; ignored | Daytona auto-stop interval | | `env` | Process env overlay | Container env | Sandbox env | ### Fabro Details <details> <summary>Ran 11 stages in 217m 39s for $129.86</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 4m 7s | – | 0 | | preflight_lint | 4m 9s | – | 0 | | fix_lints | 3m 46s | $1.06 | 0 | | implement | 76m 6s | $57.39 | 0 | | simplify_opus | 71m 50s | $38.17 | 0 | | simplify_gpt | 8m 27s | $2.24 | 0 | | verify | 6m 10s | – | 0 | | fixup | 42m 1s | $31.00 | 0 | | fmt | 3s | – | 0 | | **Total** | **217m 39s** | **$129.86** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (12 nodes and 15 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --cargo-quiet --workspace --status-level fail 2>&1 && cargo dev docs refresh 2>&1 && cargo dev docs check 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all clippy lint warnings, test failures, and generated docs errors.", max_visits=3] fmt [label="Format", shape=parallelogram, script="cargo +nightly-2026-04-14 fmt --all 2>&1", max_retries=0] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> fmt [condition="outcome=succeeded"] verify -> fixup fixup -> verify fmt -> exit } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com> Co-authored-by: Bryan Helmkamp <bhelmkamp@users.noreply.github.com>	2026-05-23 13:03:21 -04:00
fabro-sh-0530[bot]	94c657b92e	feat: add run.checkpoint.skip_git_hooks to bypass Git commit hooks (#355) ... ## Summary Adds an opt-in `skip_git_hooks` boolean to `[run.checkpoint]` that causes Fabro-managed run-branch checkpoint commits to pass `--no-verify` to `git commit`, bypassing local hooks such as `pre-commit` and `commit-msg`. Defaults to `false`. Metadata-branch snapshots and Fabro `[[run.hooks]]` are unaffected. ```toml [run.checkpoint] skip_git_hooks = true ``` ### Plan Summary - `RunCheckpointSettings` (dense, in `fabro-types`) gains `skip_git_hooks: bool` with `#[serde(default)]`. - `RunCheckpointLayer` (sparse, in `fabro-config`) gains `skip_git_hooks: Option<bool>` so layered config can distinguish unset from explicit `false`. - `RunCheckpointLayer::combine` is refactored from a wholesale-replace to field-level merging: `exclude_globs` keeps its existing replace-wins semantics; `skip_git_hooks` uses `.or()` (highest-priority layer that sets it wins). - `resolve_checkpoint` resolves `None → false`. - `git_checkpoint` / `checked_git_checkpoint` in `sandbox_git.rs` accept a new `skip_git_hooks: bool` and append `--no-verify` when true. - `parallel_branch_commit_cmd` (new helper in `handler/parallel.rs`) replaces the inline format string and accepts the same flag. - `GitState` carries `checkpoint_skip_git_hooks`; `RunOptions::checkpoint_skip_git_hooks()` exposes it; `execute.rs` and `git.rs` thread it through. - OpenAPI schema, TypeScript API client, and docs are updated. ### Key design decisions **Field-level merging in `combine`**: the previous `RunCheckpointLayer::combine` replaced the whole struct when `self.exclude_globs` was non-empty. The refactor keeps that same replace rule for `exclude_globs` while adding independent `Option::or` merging for `skip_git_hooks`, so the two fields don't interfere. **`--no-verify` only on run-branch commits**: the flag is injected only in the two Git commit paths Fabro controls for run-branch checkpoints. Metadata-branch snapshots use `git2` and never fire local hooks regardless of this setting. ### Fabro Details <details> <summary>Ran 9 stages in 48m 3s for $13.91</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 3s | – | 0 | | preflight_compile | 2m 4s | – | 0 | | preflight_lint | 2m 15s | – | 0 | | implement | 24m 13s | $10.38 | 0 | | simplify_opus | 10m 31s | $1.59 | 0 | | simplify_gpt | 5m 8s | $1.93 | 0 | | verify | 3m 4s | – | 0 | | fmt | 3s | – | 0 | | **Total** | **48m 3s** | **$13.91** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (12 nodes and 15 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD."] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --cargo-quiet --workspace --status-level fail 2>&1 && cargo dev docs refresh 2>&1 && cargo dev docs check 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all clippy lint warnings, test failures, and generated docs errors.", max_visits=3] fmt [label="Format", shape=parallelogram, script="cargo +nightly-2026-04-14 fmt --all 2>&1", max_retries=0] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> fmt [condition="outcome=succeeded"] verify -> fixup fixup -> verify fmt -> exit } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh>	2026-05-22 17:26:06 -04:00
Bryan Helmkamp	4190e13a20	Collapsible run stage sidebar (#352) ... ## What Makes the run-detail stage sidebar (shown on the Overview and Stages tabs) collapsible with a slide animation. - A toggle button slides the panel between full width (`w-56`) and an icon-only rail (`w-12`), animating `width` over 300ms with the same easing as the Ask Fabro panel. - When collapsed, **stage status icons stay visible** — green check / red X / spinning teal for running — so run progress is still scannable at a glance. Workflow links (Graph Source, Run Logs, etc.) collapse to icons too so they remain reachable. - Labels and durations become `sr-only` with `title` tooltips for hover. - The open/closed choice persists to `localStorage` (`fabro:stage-sidebar-collapsed`), carrying across the Overview and Stages tabs and reloads. ## Layout - The collapse toggle is inline with the `STAGES` heading row (or `WORKFLOW` when a run has no stages yet), so it doesn't push the stage list down. - The stage sidebar's top padding on the Stages tab was reduced (`pt-6` → `pt-3`) so the heading aligns with the adjacent content column and sits closer to the tab nav. ## Notes Self-contained in `StageSidebar` — `run-overview.tsx` and `run-stages.tsx` render it inside flex layouts that already track its width, so the slide works in both with no parent changes (aside from the padding tweak). Verified: `tsc` typecheck passes; `stage-sidebar` lib tests pass (10/10). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: fabro-sh-0530[bot] <281434857+fabro-sh-0530[bot]@users.noreply.github.com> Co-authored-by: Fabro <noreply@fabro.sh>	2026-05-22 12:20:29 -04:00
fabro-sh-0530[bot]	f5f921aa3c	feat: add [run.agent] fabro_tools opt-in for worker run tools (#348) ... ## Summary Workflow agents previously always received the `agent:run_tools` JWT scope and had Fabro run tools registered unconditionally. This PR makes Fabro run tool access an explicit per-run opt-in via `[run.agent] fabro_tools = true`, defaulting to `false`. ## What changed **Config layer** (`fabro-types`, `fabro-config`): `RunAgentSettings` gains a `fabro_tools: bool` field (serialized with `#[serde(default)]` for backward compatibility). The corresponding `RunAgentLayer` gets an optional `fabro_tools: Option<bool>` that resolves to `false` when absent. Layer merging follows the existing `Combine` macro semantics, so a workflow-level `false` overrides a user-level `true`. **Server** (`fabro-server`): `worker_command` gains an `agent_fabro_tools_enabled: bool` parameter. The server reads `run_state.spec.settings.run.agent.fabro_tools` from the stored run before spawning `__run-worker`, then issues the worker JWT with either `["run:worker"]` or `["run:worker", "agent:run_tools"]` accordingly. `WorkerScopeSet::run_worker()` loses its `#[cfg(test)]` gate so it's available in production paths. **CLI worker** (`fabro-cli`): `FabroRunToolServices` construction is now gated on `run_spec.settings.run.agent.fabro_tools` rather than being unconditional. The resolved run spec already carries the setting, so no env-var parsing is needed in the runner. **Tests**: The single monolithic `worker_command_always_sets_worker_token_env` test is replaced by two focused tests — one confirming the default scope is `["run:worker"]` only, and one confirming the opt-in scope includes `agent:run_tools`. Shared assertion logic is extracted into `assert_worker_command_passes_token_only_by_env` and `worker_token_claims` helpers. Config resolver tests cover default, explicit true/false, and layer-override behavior. **Docs**: `[run.agent]` description and reference tables are updated; a new `run-configuration.mdx` section explains the opt-in semantics before the existing `[run.agent.mcps]` section. ### Plan Summary - 1. Add `fabro_tools` to resolved and layered run config, with resolver tests. - 2. Gate worker JWT scope and pass setting from stored run state into `worker_command`. - 3. Gate CLI `FabroRunToolServices` construction on the resolved setting. - 4. Update docs generator sample and public reference/execution docs. - 5. Full verification pass (nextest, fmt, clippy). ### Fabro Details <details> <summary>Ran 9 stages in 54m 4s for $15.21</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 4s | – | 0 | | preflight_lint | 2m 18s | – | 0 | | implement | 28m 5s | $10.58 | 0 | | simplify_opus | 12m 4s | $2.86 | 0 | | simplify_gpt | 5m 19s | $1.77 | 0 | | verify | 3m 37s | – | 0 | | fmt | 3s | – | 0 | | **Total** | **54m 4s** | **$15.21** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (12 nodes and 15 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD."] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --cargo-quiet --workspace --status-level fail 2>&1 && cargo dev docs refresh 2>&1 && cargo dev docs check 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all clippy lint warnings, test failures, and generated docs errors.", max_visits=3] fmt [label="Format", shape=parallelogram, script="cargo +nightly-2026-04-14 fmt --all 2>&1", max_retries=0] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> fmt [condition="outcome=succeeded"] verify -> fixup fixup -> verify fmt -> exit } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: fabro-agent <agent@fabro.local>	2026-05-22 09:41:27 -04:00
Bryan Helmkamp	cd74013d06	refactor(auth): split credential sources and vault schemas (#306) ... ## Summary Compared with `origin/main`, this PR splits credential storage and credential references into explicit types. Vault secrets now distinguish `token`, `oauth`, and `file` payloads, while runtime/model configuration points to credentials through explicit `env:<NAME>` and `vault:<NAME>` source refs. ## Changes - Replaces the old `environment`/`credential` secret schema vocabulary with `token`/`oauth`/`file` across OpenAPI, Rust API tests, generated TypeScript models, CLI/docs references, and the changelog. - Updates auth resolution, refresh, provider strategies, workflow LLM handling, server diagnostics, install flows, run manifests, and secret handlers to consume typed vault entries and explicit credential sources. - Updates provider catalog TOMLs and config parsing so provider auth and extra headers use `vault` refs instead of ambiguous `credential` refs. - Updates CLI install/login/run/secret paths and integration tests to write and read the new credential shapes. - Removes the temporary legacy vault migration and empty-vault fallback, then centralizes provider vault secret-name lookup and Codex API credential shaping. ## Verification - `cargo +nightly-2026-04-14 fmt --all` - `cargo +nightly-2026-04-14 clippy -p fabro-auth -p fabro-model -p fabro-config -p fabro-vault -p fabro-server -p fabro-cli --all-targets -- -D warnings` - `ulimit -n 4096 && cargo nextest run -p fabro-auth -p fabro-model -p fabro-config -p fabro-vault -p fabro-server -p fabro-cli` (`1938` passed, `35` skipped)	2026-05-18 11:07:42 -04:00
David Bock	6a86ced77c	fix(server): persist manifest metadata names (#302) ... When Fabro creates a detached run through the server, the resulting run metadata should still read like something a human can trust at a glance. Before this change, those runs could persist with `settings.project.name` and `settings.workflow.name` left `null` even though Fabro already had enough local context to infer them. That made `inspect` output look half-populated and made it harder to tell whether the saved run state was complete. This fixes that trust gap in the server-backed manifest flow. ## Summary - backfill missing manifest-backed project and workflow names during server run preparation - prefer explicit `[workflow].name` from bundled `workflow.toml`, then fall back to graph name or workflow slug - cover both manifest preparation and persisted run-state behavior with server tests ## Testing - cargo test -p fabro-server prepare_manifest_backfills_missing_project_and_workflow_names -- --nocapture - cargo test -p fabro-server prepare_manifest_preserves_explicit_project_and_workflow_names -- --nocapture - cargo test -p fabro-server create_run_persists_backfilled_project_and_workflow_names -- --nocapture --------- Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-18 08:31:23 -04:00
Bryan Helmkamp	302e2445b4	refactor(model): move provider facts into catalog (#298) ... ## Summary Moves provider-specific facts out of `AdapterKind` metadata and into provider catalog data, leaving adapters responsible for runtime protocol behavior. This makes providers that share an adapter mostly TOML-driven while still surfacing adapter construction failures during readiness checks. ## What Changed - Provider TOML now owns auth mode, API-key/header policy, billing policy, agent profile, base URLs/env overrides, extra headers, and probe markers. - Auth, install, config, diagnostics, and server flows resolve provider credentials from catalog auth config, including API-key, header-only, and no-auth providers. - LLM client registration now reports adapter construction failures, validates final adapter requests before HTTP dispatch, and preserves custom primary auth headers. - Billing and docs now use provider-owned billing policy instead of adapter metadata, and the old adapter metadata surface is removed. ## Reviewer Notes OpenAI-compatible `base_url` validation now happens during adapter/client registration rather than catalog build. That keeps catalog parsing adapter-agnostic while still letting readiness and model listing reflect providers that cannot register. ## Verification - `cargo check -p fabro-model -p fabro-auth -p fabro-llm -p fabro-server -p fabro-cli` - `cargo nextest run -p fabro-llm -- adapter_registry` - `cargo nextest run -p fabro-model -- catalog` - `cargo nextest run -p fabro-auth -- api_key` - `cargo nextest run -p fabro-server -- install` - `cargo +nightly-2026-04-14 fmt --check --all` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex) --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-17 20:59:08 -04:00
Bryan Helmkamp	b9497517a5	feat(llm): support agent profile overrides (#291) ... ## Summary Adds catalog-level `agent_profile` overrides so custom providers and individual models can choose Anthropic, OpenAI, or Gemini agent behavior independently from their adapter default. The effective precedence is model override, then provider override, then adapter metadata. ## What Changed - Added typed provider/model `agent_profile` settings in `fabro-config` and `fabro-model`, with serde/strum support for `anthropic`, `openai`, and `gemini`. - Centralized effective profile resolution in the catalog, including provider alias canonicalization and a guard against unrelated model overrides leaking across providers. - Updated run startup, API sessions, CLI/ACP backends, prompt project-memory discovery, and standalone agent startup to use the resolved catalog profile. - Documented provider-level and model-level `agent_profile` configuration in the public model and user configuration docs. No OpenAPI or model-list response shape changes are included. ## Validation - `cargo nextest run -p fabro-model -p fabro-config -p fabro-workflow -p fabro-agent` passed: 1826 passed, 125 skipped. - `cargo +nightly-2026-04-14 fmt --check --all` passed. - `cargo +nightly-2026-04-14 clippy -p fabro-model -p fabro-config -p fabro-workflow -p fabro-agent --all-targets -- -D warnings` passed. - `git diff --check` passed. - `cargo nextest list -p fabro-dev` confirmed there is no docs-options reference test target to run. ## Post-Deploy Monitoring & Validation Watch workflow and agent-session logs for provider/model resolution errors, unexpected project-memory file selection, or CLI/ACP launch command mismatches on custom catalog providers. Healthy signal: custom provider/model runs start normally and use the intended profile-specific behavior. Failure trigger: repeated `Provider ... is not configured` errors, missing expected project memory, or profile-specific agent startup failures after configuring `agent_profile`. Mitigation is to remove the override from config or revert this PR. Validation window: first deploy cycle after merge; owner: release/on-call engineer. --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex)	2026-05-16 17:40:59 -04:00
Bryan Helmkamp	87950295bd	refactor(llm): split provider identity from adapters (#280) ... ## Summary This PR separates provider identity from adapter behavior across the LLM stack. Provider IDs now represent catalog rows and provider metadata, while adapter/profile routing owns protocol behavior for Anthropic, OpenAI, Gemini, and OpenAI-compatible providers. ## Changes - Replace the shared `fabro_model::Provider` enum with open-ended `ProviderId` catalog identity and typed `AdapterKind` metadata. - Route auth, CLI, ACP, workflow, memory selection, profile construction, and LLM client registration through catalog provider rows instead of provider-ID fallbacks. - Move API-key URL/header/env metadata into provider catalog/auth flows and require configured provider rows for credential-backed clients. - Simplify billing to `algorithm`-tagged OpenAI, Anthropic, and Gemini shapes; OpenAI-compatible adapters bill through the OpenAI algorithm. - Remove greenfield compatibility paths for old provider aliases, legacy provider-tagged billing JSON, and the `openai_compatible` pseudo-provider env fallback. - Update fixtures and tests to exercise catalog-driven Kimi/Zai/Minimax/Inception/custom OpenAI-compatible routing. ## Validation - `cargo test --no-run -p fabro-model -p fabro-auth -p fabro-agent -p fabro-workflow -p fabro-server -p fabro-llm -p fabro-api -p fabro-cli -p fabro-store -p fabro-static` - `cargo nextest run -p fabro-model -p fabro-auth -p fabro-agent -p fabro-workflow -p fabro-server --no-fail-fast` - `cargo nextest run -p fabro-llm -p fabro-api -p fabro-cli -p fabro-store -p fabro-static --no-fail-fast` - `cargo +nightly-2026-04-14 fmt --check --all` - `git diff --check` - `cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex)	2026-05-16 13:13:41 -04:00
Bryan Helmkamp	78941a2b84	test(model): prepare catalog-only providers (#264) ... ## Summary Prepares the model catalog tests for catalog-only built-in providers so a future provider can be added with just its catalog TOML. ## Changes - Replaces the closed-enum round-trip guardrail with a catalog metadata guardrail, allowing built-in TOML providers that do not have `Provider` enum variants. - Makes the all-model `fabro model` CLI tests assert stable table structure instead of snapshotting every built-in catalog row. - Renames synthetic custom-provider and missing-provider fixtures away from provider names that can become real catalog entries. ## Verification - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo nextest run -p fabro-model -p fabro-auth -p fabro-llm -p fabro-server -p fabro-workflow -p fabro-config` - `cargo nextest run -p fabro-cli cmd::model` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 (unknown context, medium reasoning) via [Codex](https://openai.com/codex) --------- Co-authored-by: Jesse <606+jesseproudman@users.noreply.github.com>	2026-05-14 21:51:18 -04:00
Bryan Helmkamp	e7e4fb5ca1	Add Daytona volume mount passthrough (#263) ... ## Summary This adds run-configuration support for mounting existing Daytona volumes into Fabro-managed Daytona sandboxes. Concretely, this PR: - adds `[[run.sandbox.daytona.volumes]]` with `volume_id`, `mount_path`, and optional `subpath` - resolves that config through the layer/settings/runtime pipeline - forwards configured mounts to `daytona_sdk::SandboxBaseParams.volumes` when creating the sandbox - documents the configuration surface in the Daytona environment and run configuration docs ## Motivation Daytona already supports attaching volumes when a sandbox is created, but Fabro currently owns that sandbox creation call. That means users cannot attach a pre-created Daytona volume to a Fabro-managed sandbox from run config. The intended use is persistent, provider-owned state such as agent credentials, caches, datasets, or other files that should survive ephemeral sandbox lifecycles. ## Scope This is intentionally a narrow passthrough. Fabro does not create, delete, list, wait on, or otherwise manage Daytona volume lifecycle. Users create the volume in Daytona first, then reference its `volume_id` from Fabro run config. `volumes` defaults to an empty list in resolved settings for backwards compatibility with existing serialized settings. ## Testing - `cargo test -p fabro-server runtime_daytona_config_preserves_volume_mounts` - `cargo test -p fabro-config resolves_daytona_volume_mounts` - `cargo test -p fabro-sandbox --features daytona volume_mounts` - `cargo test -p fabro-workflow runtime_daytona_config_preserves_volume_mounts` - `cargo check -p fabro-server` --- _Re-opened from #262 (originally by @kimprobably) to land a rustfmt fix — the original PR came from an org-owned fork, which blocks maintainer pushes. Branch is now on the base repo. Original commit preserved; one additional commit fixes rustfmt formatting._ Co-authored-by: Tim Keen <tim@keen.digital>	2026-05-14 10:54:43 -04:00
Bryan Helmkamp	1cfe9419f5	refactor(llm): simplify catalog cleanup paths (#261) ... ## Summary This is a cleanup pass over the configurable LLM provider/catalog work from issue #210. It addresses reuse, quality, and efficiency findings from the phase 0-9 review without changing the public provider settings contract. Notable changes: - skip LLM client initialization during run preflight when the workflow has no LLM nodes - make preflight provider checks use alias-aware `Client::has_provider` - resolve `run.model.fallbacks` through the catalog instead of the old empty-key bridge - paginate `/models` before cloning returned rows - share label parsing, provider default-adapter lookup, enum expected-value formatting, and billing token formatting helpers - use catalog provider display names for OpenAI-compatible agent profiles - align process-env configured-provider discovery with `EnvCredentialSource` ## Verification - `cargo check -p fabro-config -p fabro-model -p fabro-auth -p fabro-agent -p fabro-workflow -p fabro-server -p fabro-cli` - `cargo nextest run -p fabro-config parse_labels_keeps_key_value_pairs` - `cargo nextest run -p fabro-workflow resolve_fallback_chain_resolves` - `cargo nextest run -p fabro-auth configured_providers` - `cargo nextest run -p fabro-server list_models` - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo +nightly-2026-04-14 clippy -p fabro-model -p fabro-auth -p fabro-workflow -p fabro-server -p fabro-agent -p fabro-config -p fabro-cli --all-targets -- -D warnings` - `cd apps/fabro-web && bun test app/routes/run-billing.test.tsx` - `cd apps/fabro-web && bun run typecheck` - `git diff --check` --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-14 09:35:42 -04:00
Bryan Helmkamp	a81eb09e78	feat(llm): add catalog controls and speed billing (#249) ... ## Summary This PR advances the catalog-driven LLM work from fabro-sh/fabro#210 by making the resolved model catalog the source of truth for provider registration, request control validation, and billing identity. Runs now preserve canonical provider/model/speed identity through pricing and API responses instead of collapsing billing around provider API aliases or model IDs alone. ## What Changed - Register LLM provider adapters from the resolved catalog, including custom OpenAI-compatible providers and their credential resolution paths. - Validate effective model request controls, including run-level defaults and node overrides, before dispatching LLM requests. - Add catalog-aware billing lookup that prices canonical `ModelRef` values, uses base model costs for standard speed, applies per-speed cost overrides, and returns an unknown estimate instead of silently billing zero for unsupported combinations. - Move Anthropic Opus fast-mode pricing into the built-in catalog for `claude-opus-4-6` and `claude-opus-4-7`. - Thread the injected catalog and effective speed controls through workflow billing, including API-mode and CLI-mode handlers. - Update billing APIs, server aggregation, generated clients, and the web billing view to expose provider/model/speed billing identity and keep standard and fast usage in separate rows. ## Notes for Review Billing lookup intentionally uses canonical catalog model IDs. Provider `api_id` substitution remains limited to provider request construction, so aliases can be used on the wire without changing billing identity. Event conversion paths that do not have catalog access now preserve token counts with a null dollar estimate rather than falling back to the bootstrap catalog. ## Verification - `cargo build -p fabro-api` - `cd lib/packages/fabro-api-client && bun run generate` - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings` - `ulimit -n 4096 && cargo nextest run -p fabro-model -p fabro-workflow -p fabro-server -p fabro-api -p fabro-cli --no-fail-fast` - `ulimit -n 4096 && cargo nextest run --workspace --no-fail-fast` - `cd apps/fabro-web && bun run typecheck` - `cd apps/fabro-web && bun test` - `git diff --check` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex) --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-13 14:12:16 -04:00
Bryan Helmkamp	0e3d0c5c97	feat(manifest): support path-based Daytona Dockerfiles (#258) ... ## Summary Supports `dockerfile = { path = "..." }` for Daytona snapshots declared in `.fabro/project.toml` and workflow-local `workflow.toml`, resolving each path relative to the TOML file that declared it. Manifest building now bundles project-level Dockerfiles into the target workflow file bundle, and server manifest preparation rewrites bundled Dockerfile paths to inline content before settings reach sandbox creation. The repo Daytona snapshot config now uses `.fabro/Dockerfile` instead of embedding the Dockerfile in TOML, preserving the prior Dockerfile content exactly. ## Testing - `cargo nextest run -p fabro-manifest build_manifest_bundles_project_config_daytona_dockerfile_relative_to_project_config` - `cargo nextest run -p fabro-manifest` - `cargo nextest run -p fabro-server prepare_manifest_inlines_project_config_daytona_dockerfile_from_bundle prepare_manifest_errors_when_project_config_dockerfile_bundle_is_missing` - `cargo nextest run -p fabro-server` - `cargo nextest run -p fabro-config` - `cargo nextest run -p fabro-manifest -p fabro-server -p fabro-config` - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings` Optional credentialed Daytona live smoke was not run. ## Post-Deploy Monitoring & Validation - Log queries/search terms: `missing bundled dockerfile`, `unsupported dockerfile reference`, `invalid manifest project config path`, `dockerfile path should have been resolved to inline content before sandbox creation`, Daytona snapshot creation failures. - Metrics/dashboards: run submission/preflight failure rate, Daytona sandbox startup failure rate, snapshot creation failure rate, and run validation errors for manifests using bundled files. - Healthy signals: runs using `.fabro/project.toml` with `dockerfile = { path = "Dockerfile" }` progress past manifest preparation and Daytona snapshot creation without path-resolution errors. - Failure signals and rollback trigger: any sustained increase in manifest preparation failures or Daytona snapshot failures containing the log terms above; rollback by reverting this PR or temporarily restoring inline Dockerfile TOML for affected deployments. - Validation window and owner: first 24 hours after deploy; owner is the deploying operator/on-call engineer. 	2026-05-13 12:32:15 -04:00
Bryan Helmkamp	264cac3c64	feat(server): inject settings-backed model catalog (#247) ... ## Summary This PR moves the server-facing model catalog paths onto a resolved catalog stored in `AppState`, using configured `[llm]` provider/model overrides layered on top of the built-in catalog. The server now uses the injected catalog for: - `/models` listing and model test lookup - `/completions` default model and provider inference - manifest preflight materialization and LLM model alias resolution - diagnostics LLM probes - pull request default model selection - runtime settings refresh via `replace_settings` It also adds catalog overlay helpers in `fabro-model` and converts resolved server runtime `[llm]` settings into the catalog shape in `fabro-config`. This branch also includes the earlier `chore: update dockerfile` commit, which updates the Daytona snapshot to `fabro-v10` and installs Chromium through the xtradeb PPA with an XFCE/browser wrapper. Related: #210 ## Tests - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo nextest run -p fabro-config -p fabro-model -p fabro-server` (844 tests passed) - `cargo +nightly-2026-04-14 clippy -p fabro-config -p fabro-model -p fabro-server --all-targets -- -D warnings`	2026-05-12 17:55:28 -04:00
Bryan Helmkamp	34d83db801	feat(model): support open provider catalog data (#245) ... ## Summary This PR moves Fabro’s provider/model catalog toward settings-driven provider identity by replacing the closed provider schema at the API/auth/model boundary with `ProviderId`, then loading built-in provider and model metadata from embedded per-provider TOML files. The immediate result is that built-ins now use the same settings-shaped catalog data that custom providers will use later, while request-serving paths still keep the existing bootstrap/default catalog behavior until the resolved-catalog plumbing lands. ## Changes - Replaces API-facing provider enum usage with string-backed `ProviderId`, including OpenAPI/progenitor replacements and regenerated TypeScript client models. - Routes model, auth, billing, CLI, server, and workflow call sites through provider IDs where they cross product identity boundaries. - Builds `Catalog` from settings-shaped provider/model data with validation for adapter keys, OpenAI-compatible `base_url`, duplicate aliases, provider defaults, disabled entries, model controls, and per-speed cost rows. - Replaces `catalog.json` with embedded provider TOML files under `lib/crates/fabro-model/src/catalog/providers/`. - Adds an explicit `fabro_model::bootstrap_catalog` hatch for setup/install paths and extends the dev policy test to keep bootstrap access contained. - Preserves public training and knowledge-cutoff labels in LLM model settings while still accepting bare TOML dates. ## Verification - `cargo nextest run -p fabro-model -p fabro-config -p fabro-api` — 416 passed - `cargo nextest run -p fabro-dev --features dev bootstrap_catalog_references_stay_in_allowlist` — 1 passed - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings` - `cargo build --workspace` - `git diff --check` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex)	2026-05-12 15:42:49 -04:00
Bryan Helmkamp	d7cb27ff65	Add gateway extra_headers settings for LLM providers (#244) ... ## Summary Adds the Phase 1 settings surface for gateway-backed LLM providers. This was prompted by @haroldolivieri's Portkey/Bedrock field report on PR #207, which showed that gateway auth and routing often live in custom headers rather than the adapter's primary API-key header. This PR is schema and seam work only. It does not make settings-defined providers runnable yet; later phases still own ProviderId migration, catalog construction, auth resolution, and production adapter registration. ## Changes - add typed `extra_headers` values to `[llm.providers.<id>]` - support explicit `literal`, `env`, and `credential` header value forms while rejecting bare strings, empty values, ambiguous tables, and unknown keys - cover whole-map header merge behavior and adapter header pass-through tests - update the settings-driven LLM plan with the Phase 1 gateway header attribution and completion notes ## Non-goals - does not make settings-defined providers runnable yet - does not migrate ProviderId/OpenAPI/auth resolver/runtime catalog plumbing - does not route Codex OAuth through custom provider settings ## Tests - `cargo nextest run -p fabro-config -p fabro-llm` - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo +nightly-2026-04-14 clippy -p fabro-config -p fabro-llm --all-targets -- -D warnings` - `git diff --check origin/main...HEAD` ## Post-Deploy Monitoring & Validation No additional operational monitoring required. This is schema and adapter-seam coverage only; production provider registration and runtime credential/header resolution remain deferred. ## Attribution Motivated by @haroldolivieri's Portkey/Bedrock report on PR #207: https://github.com/fabro-sh/fabro/pull/207#issuecomment-4377929769 Commits include `Co-authored-by: Haroldo Olivieri <6575718+haroldolivieri@users.noreply.github.com>`. --- Compound Engineered: Codex, `ce:work`. --------- Co-authored-by: Haroldo Olivieri <6575718+haroldolivieri@users.noreply.github.com>	2026-05-12 12:09:08 -04:00
Bryan Helmkamp	087c9233f3	fix(validate): pick up sibling workflow.toml inputs for bare .fabro path (#242) ... ## Summary - `fabro validate path/to/workflow.fabro` now auto-discovers a sibling `workflow.toml` and loads its `[run.inputs]`, so templated graphs validate the same way they do when invoked by name or by toml path. - The discovery is opt-in to the user's specific graph: we only pick up the sibling toml if its `[workflow].graph` resolves back to the `.fabro` the user passed. Unrelated tomls in the same directory are ignored. ## Why `fabro validate` is the natural fast-feedback tool for CI/pre-commit hooks that iterate on changed `.fabro` files. Previously, a graph using `{{ inputs.* }}` would fail with a generic MiniJinja "undefined value" error when validated by path, even when a sibling `workflow.toml` defined those inputs. The other two invocation forms (by name, by toml) worked, which made the path form a usability cliff. Fixes #195. ## Test plan - [x] New integration test: `bare_fabro_picks_up_sibling_workflow_toml_inputs` validates `test/templated_inputs/workflow.fabro` (uses `{{ inputs.app_dir }}`) and expects `Validation: OK`. - [x] New unit tests in `fabro-config::project`: - `resolve_workflow_path_picks_up_sibling_workflow_toml` — happy path. - `resolve_workflow_path_ignores_sibling_toml_pointing_elsewhere` — guard: don't apply an unrelated sibling toml. - [x] `cargo nextest run --workspace` — 5585 tests pass. - [x] `cargo +nightly-2026-04-14 fmt --check --all`, `clippy --workspace --all-targets -- -D warnings` clean. - [x] Manual: `fabro validate /tmp/fabro-issue-195/workflow.fabro` (templated graph + sibling toml with `[run.inputs]`) prints `Validation: OK`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Nate Aune <118984+natea@users.noreply.github.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-12 12:05:21 -04:00
Bryan Helmkamp	a33d17c88d	feat(run): add managed branch controls (#243) ... ## Summary Adds run-level controls for clone behavior, managed run branch setup/pushes, and metadata branch writes/pushes so workflows can opt out of Fabro-managed Git behavior without relying on provider-specific `skip_clone` settings. This closes fabro-sh/fabro#240. ## What Changed - Introduced `[run.clone]`, `[run.run_branch]`, and `[run.meta_branch]` settings with defaults that preserve current behavior. - Removed user-facing `skip_clone` from Docker/Daytona config while mapping the new run-level clone setting into the internal sandbox runtime options. - Gated run branch setup/push, metadata branch writer creation/push, and PR branch output on the new settings. - Enforced invalid combinations: pull requests require an enabled pushed run branch, and disabling the run branch also disables metadata branch behavior. - Updated OpenAPI, the generated TypeScript API client, frontend fixture data, and docs for the new configuration shape. ## Testing - `cargo nextest run -p fabro-config -p fabro-types -p fabro-workflow -p fabro-server` - `cargo build -p fabro-api` - `cd lib/packages/fabro-api-client && bun run generate` - `cd lib/packages/fabro-api-client && bun run typecheck` - `cd apps/fabro-web && bun run typecheck` - `cd apps/fabro-web && bun test` - `cargo build --workspace` - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings` - `cargo insta pending-snapshots` - `git diff --check` ## Post-Deploy Monitoring & Validation - Validation window: first 24 hours after release; owner: release owner/on-call engineer. - Log queries/search terms: `run_branch`, `meta_branch`, `clone.enabled`, `skip_clone`, `pull request requires an enabled pushed run branch`, `metadata branch`. - Healthy signals: runs without custom branch config continue creating and pushing run/meta branches; runs with `[run.clone] enabled = false` start provider sandboxes without cloning; runs with branch pushes disabled complete without Git push errors. - Failure signals: increased run startup failures for Docker/Daytona, unexpected PR creation conflicts, missing metadata for default-config runs, or validation errors for configurations that previously used default settings. - Mitigation trigger: if default-config runs stop producing expected branch/metadata artifacts or sandbox startup failures increase, roll back the release or temporarily restore previous defaults while investigating the run-level setting resolution path. --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex) Co-authored-by: Haroldo Olivieri <6575718+haroldolivieri@users.noreply.github.com>	2026-05-12 12:00:30 -04:00
fabro-sh-0530[bot]	10de9fd16c	Add foundation for settings-driven LLM catalog (#207) ... ## Summary This lays the groundwork for settings-driven LLM providers and models without switching production routing yet. The new schemas and shared vocabulary let later catalog construction treat provider/model identity as data while keeping adapter behavior and control values Rust-owned. ## What changed - Added `[llm.providers]` and `[llm.models]` settings layers with sparse per-entry merging, whole-array replacement for credential/alias/control lists, TOML date support for `knowledge_cutoff`, and typed `credential:` / `env:` references that reject literal secrets. - Added `ProviderId`, `ModelId`, and a shared `ReasoningEffort` enum in `fabro-model`, plus adapter metadata for `anthropic`, `openai`, `gemini`, and `openai_compatible`. - Added a matching `fabro-llm` adapter factory registry with parity tests to keep metadata keys and factory keys in sync. - Added `[run.model.controls]` defaults through config resolution and runtime settings types. - Added a workspace policy test to prevent future `bootstrap_catalog` use outside install/test-support paths. ### Plan Summary - This is the foundation slice of the settings-driven catalog plan. - Production still uses the existing `Provider` enum and `Catalog::builtin()` call paths. - ProviderId routing, OpenAPI regeneration, auth resolver changes, resolved `Arc<Catalog>` injection, typed request speed, and per-speed billing are deferred follow-ups. ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: fabro-bot <fabro-bot@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-12 10:01:57 -04:00
Bryan Helmkamp	a19f6dd03a	feat(cli): add Fabro MCP server (#236) ... ## Summary Adds a stdio-based Fabro MCP server so MCP clients can manage Fabro workflow runs through the authenticated `fabro` CLI, without a separate MCP auth flow. ## What Changed - Adds `fabro mcp start`, `fabro mcp config`, and `fabro mcp init <agent>` for launching and configuring the MCP server. - Introduces a new `fabro-mcp-server` crate with run-management tools: - `fabro_run_create` - `fabro_run_search` - `fabro_run_interact` - `fabro_run_gather` - `fabro_run_events` - Reuses the CLI's authenticated server connection behavior, including OAuth refresh, dev-token/local-server handling, explicit server targets, proxy behavior, and stdio env/cwd isolation. - Moves shared run-manifest construction into `fabro-manifest` so CLI runs and MCP-created runs use the same override semantics. - Extends MCP client stdio support with configured cwd and exact environment handling for reliable spawned-server tests. --------- Co-authored-by: fabro-sh-0530[bot] <281434857+fabro-sh-0530[bot]@users.noreply.github.com> Co-authored-by: Fabro <noreply@fabro.sh>	2026-05-11 18:20:50 -04:00
Bryan Helmkamp	eb2d9fae29	fix(clippy): remove stale run spec fixture field ... Remove the leftover in_place field from a RunSpec test fixture after the field was intentionally removed, and clean up a raw string lint surfaced by workspace clippy.	2026-05-09 13:06:50 -04:00
Bryan Helmkamp	8ad14faa17	refactor(integrations): make chat integrations Slack-only	2026-05-09 11:43:16 -04:00
Bryan Helmkamp	1ff30ea03c	Merge remote-tracking branch 'origin/main'	2026-05-09 11:05:15 -04:00
Bryan Helmkamp	2a8884883a	refactor(workflow): remove local worktree mode ... Make local sandbox execution direct by removing the public worktree mode and in-place controls from CLI, config, run state, API surfaces, docs, and UI. Keep worktree support only for internal parallel-node isolation.	2026-05-09 11:04:23 -04:00
Bryan Helmkamp	5b0b1efdc2	fix(workflow): ignore deprecated project directory ... Project workflows now resolve from the discovered .fabro directory instead of honoring project.directory. Keep the legacy field parse-only while removing it from resolved settings and API/client shapes.	2026-05-09 10:55:56 -04:00
Bryan Helmkamp	5fc9157017	refactor(workflow): remove retro stage (#230) ... ## Summary Removes Fabro's automatic retro generation stage so workflow runs go directly from execution to finalization and optional PR creation. This drops the retro-specific crate, events, projection fields, config/API knobs, and user-facing docs in favor of the existing durable run observability surfaces. ## What Changed - Deleted the `fabro-retro` crate and the workflow `retro` pipeline phase, with finalization now consuming `Executed` state directly. - Removed retro configuration and API surface area, including `--no-retro`, `[run.execution].retros`, manifest `no_retro`, `features.retros`, and run projection `retro*` fields. - Retired typed `retro.*` events while keeping historical event logs readable by deserializing retired retro event names as `Unknown`. - Stopped appending retro sections to generated PR bodies and updated docs, marketing copy, screenshots, and navigation to point users toward observability/event-stream inspection. ## Testing Not run during PR creation; this branch already contained the implementation commit. --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 (unknown context, reasoning unspecified) via [Codex](https://openai.com/codex)	2026-05-09 10:18:20 -04:00
Bryan Helmkamp	f07bb4aaba	feat(cli): support sparse input overrides (#222) ... ## Summary - Add repeatable `-I` / `--input KEY=VALUE` CLI overrides for workflow run inputs on `fabro run`, `fabro create`, and `fabro preflight`. CLI inputs are sparse per-key overrides that merge over the resolved config inputs (preserving unrelated inherited values), unlike TOML `[run.inputs]` which still replaces wholesale. - Manifest bundling and graph-level goal resolution render workflow source with the effective inputs before structural scanning, so input-driven `@prompt`, `import`, and `stack.child_workflow` paths get bundled correctly. - Persist raw `KEY=VALUE` strings on `ManifestArgs.input` so server-side replay applies the same sparse overrides on top of merged config. - Review-driven cleanups: shared `TemplateContext::for_input_scan` helper for the recurring "render inputs but defer goal" idiom (replaces 4 sites), `#[derive(Default)]` on `ManifestBuildInput` to drop boilerplate, inline trivial `apply_input_overrides` wrapper, drop a redundant clone, and tighten the parser/test helpers. ## Test plan - [ ] `cargo nextest run -p fabro-cli -p fabro-config -p fabro-server -p fabro-template -p fabro-workflow` - [ ] `cargo +nightly-2026-04-14 fmt --check --all` - [ ] `cargo +nightly-2026-04-14 clippy -p fabro-cli -p fabro-config -p fabro-server -p fabro-template -p fabro-workflow --all-targets -- -D warnings` - [ ] Smoke: `fabro run <workflow> -I key=value --input other=42` overrides those keys while preserving unrelated inherited inputs - [ ] Smoke: `-I` accepts strings, integers, floats, booleans, empty values; rejects arrays, inline tables, datetimes; rejects missing `=` and empty key - [ ] Smoke: input-driven `@prompts/{{ inputs.foo }}` and `stack.child_workflow="{{ inputs.bar }}/workflow.fabro"` paths bundle correctly when overridden via `-I` 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-09 10:00:35 -04:00
Bryan Helmkamp	d3e33ce32c	feat(runs): own sandbox lifecycle ... Create run-owned sandbox lifecycle operations so terminal runs stop by default, resumes attach and start persisted sandboxes, and run deletion deletes or hands off provider resources according to preserve settings.	2026-05-08 18:38:08 -07:00
fabro-sh-0530[bot]	e40dc7d9ad	Move GitHub token permissions to [run.integrations.github.permissions] (#215) ... ## Summary Token scopes describe what *a run* is authorized to do, not server identity. Today they live under `[server.integrations.github.permissions]`, which can't be overridden by `workflow.toml` / `project.toml` (server keys are stripped from per-workflow layers) — so projects and workflows can't tighten or relax permissions despite the docs already advertising a per-run config. This PR moves them under `[run.integrations.github.permissions]`, where the standard layer-merge (workflow > project > user > defaults) Just Works. Greenfield, no migration shim. ## What changed - **New layer/resolved types** in `fabro-config` and `fabro-types`: `RunIntegrationsLayer`, `RunIntegrationsGithubLayer`, and resolved counterparts. `permissions` becomes a flat `HashMap<String, InterpString>` post-resolve; empty = no token requested. - **Server schema**: `permissions` removed from `GithubIntegrationLayer` / `GithubIntegrationSettings`. `deny_unknown_fields` rejects the stale path. - **Bundled `workflow.toml` parsing** (`run_manifest.rs`): now goes through `SettingsLayer` via the new `parse_run_layer_from_settings_toml` helper, so stale `[server.integrations.github.permissions]` errors instead of being silently dropped by the old `toml::Table` lift-out. - **Consumers updated**: server preflight, run launch path, and the CLI worker (`runner.rs`) all read run-level permissions. CLI worker previously hardcoded `HashMap::new()` — runs launched via the local CLI path were getting no `GITHUB_TOKEN` regardless of TOML. - **Shared helpers** on `RunIntegrationsGithubSettings`: `is_token_requested()` and `resolve_permissions(lookup)` so server and CLI don't drift. - **OpenAPI + TS client** regenerated; new `RunIntegrationsSettings` / `RunIntegrationsGithubSettings` schemas added, `permissions` removed from `GithubIntegrationSettings`. - **Repo workflows + docs** rewritten to the new path. Docs gain a security-model note (boundary = installation grants; no Fabro-side cap). ## Key design decision: hand-rolled `Combine` for `RunIntegrationsGithubLayer` `ReplaceMap`'s "empty inherits from below" semantics (`maps.rs:76-80`) are wrong here — we want `permissions = {}` in a higher layer to act as an explicit clear. So the layer field is `Option<HashMap<...>>` with hand-rolled `Combine`: | Higher layer | Lower layer | Result | |---|---|---| | `None` | anything | lower (inherit) | | `Some(map)` | anything | `Some(map)` (full replace, including `Some({})` = clear) | Not derived: the blanket `Option<T: Combine>` impl would recurse into the inner `HashMap` and reintroduce empty-fallback. Documented inline in `layers/run.rs`. `InterpString` is preserved through resolve and only flattened to `String` at the start-services boundary, matching the existing pattern. ### Plan Summary - New `[run.integrations.github.permissions]` layer + resolved types; remove from server side. - Hand-rolled `Combine` so empty-wins-as-clear; no change to `ReplaceMap` semantics for other consumers. - Strict `SettingsLayer` parse for bundled `workflow.toml` so stale schema errors loudly. - Both server and CLI worker paths read run-level permissions via shared helpers. - OpenAPI + TS client regenerated; parity test added. - Repo workflow TOMLs and `integrations/github.mdx` rewritten. ### Fabro Details <details> <summary>Ran 0 stages in 61m 23s for $53.41</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | **Total** | **61m 23s** | **$53.41** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (12 nodes and 15 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD."] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --cargo-quiet --workspace --status-level fail 2>&1 && cargo dev docs refresh 2>&1 && cargo dev docs check 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all clippy lint warnings, test failures, and generated docs errors.", max_visits=3] fmt [label="Format", shape=parallelogram, script="cargo +nightly-2026-04-14 fmt --all 2>&1", max_retries=0] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> fmt [condition="outcome=succeeded"] verify -> fixup fixup -> verify fmt -> exit } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-05 15:33:31 -04:00
Bryan Helmkamp	3f9a861f87	fix(error): preserve source chains across workspace ... Keep typed transport and provider errors intact through API, GitHub, OAuth, install, diagnostics, and artifact paths. Add regression coverage for cloned shared errors and communication error chains.	2026-05-01 17:30:20 -04:00
Bryan Helmkamp	cdd46b4fa8	Make git metadata sandbox-native	2026-04-27 21:43:15 -07:00
Bryan Helmkamp	3a8e1a0517	refactor(sandbox): make Docker clone-based by default ... Switch Docker sandboxes from host bind mounts to per-run clone-based containers with structured run metadata, reconnect validation, archive-based file transfer, and Docker resource defaults. Extend run config/API surfaces so Docker image and clone settings flow through manifests, server preflight, workflow startup, and generated clients. Update docs and tests for the new default Docker provider path.	2026-04-26 18:21:02 -04:00
Bryan Helmkamp	583fa1e9d1	refactor(config): share log destination resolution ... Move FABRO_LOG_DESTINATION parsing into fabro-config so CLI and server worker startup use the same validation behavior. Worker startup now exports one canonical resolved destination instead of relying on a generic env allowlist path.	2026-04-26 17:47:22 -04:00
Bryan Helmkamp	d07596ca80	feat(server): support stdout log destination ... Add configurable server log destinations with an environment override so containers can stream foreground server logs to stdout while local installs keep file logging by default. Validate configured log filters at load time and reject stdout logging for daemon mode.	2026-04-26 14:52:15 -04:00
Bryan Helmkamp	11be286fa1	refactor(dev): simplify generated docs tooling ... Share the real CLI parser with reference generation, reuse option metadata flattening, and centralize dev command execution helpers.	2026-04-24 18:41:00 -04:00
Bryan Helmkamp	12ea5341bb	feat(dev): generate options reference ... Add a settings reference generator backed by OptionsMetadata on the sparse config layer structs. The generated user-configuration page is fenced and checked in CI alongside the CLI reference.	2026-04-24 16:49:16 -04:00
Bryan Helmkamp	80de5ca616	refactor(static): centralize env var names ... Add fabro-static::EnvVars as the shared registry for fixed environment variable names and migrate env reads, clap env bindings, and subprocess/test allowlists to use it. Add clippy bans for raw std::env lookup APIs so future dynamic env facades must be documented explicitly.	2026-04-24 12:29:51 -04:00
Bryan Helmkamp	906868c30c	drop unused test-support feature from fabro-config ... SettingsLayer::{test_default, ensure_test_auth_methods} are `pub(crate)` and only called from fabro-config's own in-crate tests, but their impl block was gated on `cfg(any(test, feature = "test-support"))`. No external crate enabled the `test-support` feature, so under `--all-features` the methods compiled in without reachable callers and clippy flagged them as dead code. Narrow the gate to `cfg(test)` and drop the vestigial feature entry. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-04-23 22:29:29 -04:00