Replace the Command::new("dot") shell-out in render_dot() with a direct
FFI call to the vendored Graphviz library. Drop PNG support (SVG only).
Remove GraphFormat enum, dot_is_available() helpers, dot-related
diagnostics/doctor checks, and the graphviz install prompt. Update
OpenAPI spec to remove png format and 502 responses. Update CLI help
text, snapshot tests, and documentation.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Vendor the Graphviz C source code into a new fabro-graphviz-sys crate,
compiled via the cc crate. This eliminates the system dependency on the
dot binary. Pre-generated parser files (grammar.c, scan.c, htmlparse.c)
and table files (colortbl.h, entities.h) are committed alongside the
vendored source. A global Mutex serializes FFI calls to work around
Graphviz's non-thread-safe internal state.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Adds explicit instructions for removing unused RenderWorkflowGraphFormat
and GraphFormat imports from server.rs. Clarifies the render_graph_from_manifest
handler changes with specific line references. Details graph.rs changes for
the format field, JSON output, and debug log. Documents the decision to
retain the --format CLI flag with a single svg value for forward compat.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Add missing fabro-cli/tests/it/cmd/graph.rs snapshot updates (help text
references "SVG or PNG" and "[possible values: svg, png]")
- Add missing documentation updates (cli.mdx, overview.mdx, troubleshooting.mdx,
changelog) that reference Graphviz as a system dependency
- Add missing args.rs doc comment update ("SVG or PNG" -> "SVG") and Display impl
- Fix unused CStr import in lib.rs code sample
- Remove redundant #![allow(unsafe_code)] -- Cargo.toml override suffices
- Clarify util/ directory contents are speculative, include all initially
- Specify exact imports to remove from render.rs (Command, Write, bail)
- Specify exact doctor.rs tests affected and how to fix spec() helper
- Add graph.rs test snapshot to execution order step 9
- Add documentation update step 12 to execution order
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The plan was missing fabro-cli/tests/it/cmd/json_global.rs which has its
own dot_is_available() guard and clippy attribute that need updating.
Also improved specificity of diagnostics.rs, doctor.rs, and install.rs
change descriptions with exact line numbers and rationale.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Add get_graph_returns_svg test to the BAD_GATEWAY guard removal list
(was only mentioning render_graph_from_manifest_returns_svg)
- Fix build.rs defines section: config.h is the single source of truth,
build.rs should use -include config.h instead of duplicating -D flags
- Change render_graph_bytes error from 502 BAD_GATEWAY to 400 BAD_REQUEST
since vendored Graphviz means failures are bad input, not missing service
- Clarify thread safety risk: Graphviz has global state beyond gvContext,
document Mutex fallback strategy if concurrent test reveals races
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Detailed implementation plan for replacing the shell-out to `dot` with
a vendored Graphviz C library compiled via the `cc` crate. Covers crate
structure, build.rs approach, pre-generated parser files, FFI wrapper,
caller updates, OpenAPI spec changes, and testing strategy.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The fabro-http crate's proxy policy mechanism was not being used in
tests. http_api.rs used #[cfg(test)] to call .no_proxy(), but cfg(test)
only applies within the crate being tested — downstream crates like
fabro-workflow and fabro-cli hit the production path with system proxy
discovery, adding ~900ms per reqwest client per process.
- Set FABRO_HTTP_PROXY_POLICY=disabled in .cargo/config.toml so all
test HTTP clients skip proxy discovery automatically
- Remove dead #[cfg(test)] branch in http_api.rs; it now relies on the
env var like every other fabro-http consumer
- Remove kind(test) from nextest overrides so timeout budgets apply to
unit tests too, not just integration tests
- Remove unused SessionCookie import in web_auth.rs
Eliminates all 11 flaky nextest timeouts under parallel load.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Resolve conflicts in install.rs: apply gh_cli→token rename from local
to new non-interactive App support and pending_github_settings pattern
from origin/main.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
test_secret_store_path() placed secrets directly in /tmp/, meaning all
tests shared /tmp/server.env. Under parallel nextest, tests that needed
SESSION_SECRET would race on this file, and tests that didn't provide one
(auth_login_github_redirects_to_github) would accidentally inherit it
from another test.
Fix: each test now gets its own temp directory via a ULID-keyed subdirectory.
Also fix the github redirect test to explicitly provide its session key.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replace the install-time OpenSSL Ed25519 shell-out with Rust-native key
material generation, drop the stale OpenSSL doctor requirement, and make
GitHub App setup persist valid auth settings and secrets together.
This also fixes the live non-interactive app install path by enabling
GitHub auth, populating allowed usernames, and avoiding half-written
settings when later persistence fails.
The gh_cli strategy was named after its bootstrap mechanism, not what it
actually is at runtime: a stored token. This rename makes the abstraction
honest and decouples runtime behavior from the gh CLI.
- Rename GithubIntegrationStrategy::GhCli to Token (serialized as "token")
- Rename vault/env secret from GITHUB_CLI_TOKEN to GITHUB_TOKEN
- Accept GH_TOKEN as a fallback in both CLI and server
- CLI no longer shells out to `gh auth token` at runtime; reads from
vault/env like the server already did
- fabro install still bootstraps from `gh auth token` as a one-time op
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Make fabro install the only supported GitHub App setup path. This removes
HTTP endpoints and browser routes that mutated local server config, rewrites
/setup as an operator instructions page, and aligns the installer manifest
with the live GitHub OAuth callback and setup URLs.
Clippy's absolute_paths lint requires importing the module rather than
using fully-qualified paths in production code.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Conflicts resolved:
- install.rs: kept simplified auth (port 32276, no TLS, no username
in merge_server_settings), adapted to origin's input_source API by
removing username from ServerConfigSelection::Write
- serve.rs: kept ProviderCredentials import from origin, dropped
ClientAuth (removed with mTLS)
- server.rs: kept both imports (ServerAuthMethod + Provider)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Extract generate_session_secret and validate_session_secret to
fabro_util::session_secret, removing duplicate implementations in
install.rs (with private hex module) and start.rs
- Remove dead run_auth_method_for_config/run_auth_method_for_method
from jwt_auth.rs (zero callers)
- Replace test read_dev_token helper with dev_token::read_dev_token_file
which validates the fabro_dev_ prefix rather than just non-empty
- Extract build_unix_socket_probe_client to deduplicate probe client
construction in try_connect/connect_unix_socket_api_client_bundle
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Align the OpenAI device-auth flow with the live Codex endpoints and
allow API-backed OpenAI resolution to fall back to the stored
openai_codex credential. This makes provider login work against the
current OpenAI response shape and lets doctor/workflows use the saved
credential without OPENAI_API_KEY in the environment.
Replace the old strategy matrix with server.auth.methods, browser session
cookies, and raw dev-token bearer auth. Remove mTLS auth leftovers, auto-
provision local session secrets, and update tests and docs to the new auth
surface.
Pass the shared storage dir into worker runs so vault-backed credentials
load during real workflow execution, including server-spawned workers.
Also finish the QA follow-ups around scripted install behavior, list
credential metadata in secret listings, and give the slow OpenAPI
conformance test a narrow nextest timeout override.
Extract atomic_write_private in dev_token.rs, export read_dev_token_file
for reuse in server_client.rs, extract build_authed_unix_socket_client
to unify try_connect/connect, and remove always-true announce param.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Propagate the local dev token through worker subprocesses, share the
same authenticated local-server helper across CLI integration tests,
and clean up the async token wait path so fmt, clippy, and full tests
pass again after the dev-token auth rollout.
Replace local no-auth startup with a shared dev-token flow for CLI-managed
servers. This provisions and validates dev tokens, preserves dev-token
provenance through browser sessions, and teaches local CLI and web clients how
to authenticate against local Unix and TCP servers.
Share provider display names and OAuth expiry helpers across auth, CLI,
and server code, and simplify the small match arms and helper plumbing
that full-workspace clippy surfaced during final verification.
Prepares for future multi-vault support by nesting the secrets file
at storage_root/vaults/default/secrets.json instead of storage_root/secrets.json.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Make `fabro settings` render dense resolved settings by default for local
inspection, add a resolved view to the server settings endpoint with an
explicit compatibility marker, and update tests plus generated API clients
to lock the new behavior.
Addresses supply chain hardening items from #160:
- Pin taiki-e/install-action to commit SHA
- Pin rust:1-bookworm and oven/bun:1 to image digests
- Pin mintlify to 4.2.507
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add fabro uninstall, pr create --force, secret list metadata, and
install owner selection to CLI reference. Add GitHub App owner
selection step to integration setup flow.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Embed defaults.toml as a base settings layer and apply it when
materializing effective settings and resolving typed settings.
This also fixes partial CLI table merging so builtin fields survive
higher-precedence overrides, and updates the affected CLI tests and
snapshots.
Adds installer/fabro.rb.template and an update-homebrew job that
generates the formula from release artifacts and pushes it to
fabro-sh/homebrew-tap on each tagged release.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
