104 commits

Author	SHA1	Message	Date
Bryan Helmkamp	a163c16cda	feat: make local a reserved, in-memory environment ... `local` no longer makes sense as a configurable environment — the local sandbox provider ignores image/resources/network/lifecycle/volumes. Stop seeding it as an editable TOML file and stop offering it as a creatable provider in the UI form. Instead the server synthesizes a reserved, in-memory `local` environment only when `server.sandbox.providers.local.enabled`. It is never persisted and cannot be created, replaced, or deleted (409). Provider-enablement is already enforced at run create/preflight/start, so the synthetic `local` just needs to exist in the store catalog when enabled. - fabro-environment: drop `local` from disk seeds; thread `local_enabled` into load_or_seed and inject a synthetic `local`; ignore any stale `local.toml`; reject create/replace/delete of `local` with a new Reserved error. seeded_catalog_layer keeps `local` for CLI validation. - fabro-server: pass local.enabled into the store; map Reserved -> 409. - web: form provider dropdown excludes local; the `local` row is read-only (no Edit/Delete) with a reserved tag. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-05-31 11:24:14 -04:00
fabro-sh-0530[bot]	4cff07373c	feat: add server-owned environment store (Task 1 & 2 foundation) (#446) ... ## Summary Moves environment definitions out of project/workflow TOML config and into server-owned files, introducing the `fabro-environment` crate and enforcing source-aware validation so project/workflow/user configs can no longer define environment catalogs. ### What changed **New `fabro-environment` crate** — workspace crate wired into `fabro-cli` and `fabro-server`. Exposes a `seeded_catalog_layer()` that CLI commands inject at the call site to fill the environment catalog that settings resolution requires. **Config environments are now migration-only** — `defaults.toml` no longer ships a built-in `[environments.*]` catalog. Instead: - `SettingsSource` enum tags every parsed layer (ActiveSettings, Project, Workflow, DirectRun, User). - `validate_settings_source` rejects `[environments.<id>]` in any source except `ActiveSettings` with a targeted message: `[environments.<id>] is now server-managed; move this definition to the server environments directory`. - TOML-provided `run.environment.{image,resources,network,lifecycle,labels,volumes,env}` overrides are also rejected; only `run.environment.id` survives. **New migration** (`2026052801_settings_environments_to_server_files`) — chains after the existing legacy-sandbox migration. Extracts `[environments.*]` entries from `settings.toml` into sibling `environments/<id>.toml` files, writes a `.settings-environments-migration.bak` backup, and fails without modifying any file if a target already exists. **Builder API additions** — `RunSettingsBuilder::load_from_with_catalog`, `load_default_with_catalog`, `from_toml_with_catalog` let callers inject a server-side catalog; the bare `from_toml` path now errors if no catalog is present and a named environment is selected. `WorkflowSettingsBuilder` test helpers in `src/tests/mod.rs` centralise catalog injection across all config tests. **`.fabro/project.toml`** — removed the inline `[environments.fabro-dev]` block (environment definition now lives server-side). ### Key design decisions - CLI offline commands (graph, preflight, validate) use `seeded_catalog_layer()` as a local stand-in until a running server is available — matches the pre-existing behaviour without regressing offline workflows. - `load_settings_path` no longer runs migrations for non-ActiveSettings sources, preventing project/workflow files from accidentally triggering file-system writes. - The `MigrationReport` type is now the new migration's `SettingsEnvironmentsMigrationReport` (exposes `contents: String` instead of a parsed layer), keeping `load.rs` simpler and decoupled from layer parsing. ### Fabro Details <details> <summary>Ran 9 stages in 143m 23s for $105.27</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 11s | – | 0 | | preflight_lint | 2m 23s | – | 0 | | implement | 28m 27s | – | 0 | | simplify_opus | 37m 27s | $53.28 | 0 | | simplify_gpt | 20m 50s | $12.14 | 0 | | verify | 6m 3s | – | 0 | | fixup | 45m 15s | $39.84 | 0 | | **Total** | **143m 23s** | **$105.27** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-28 17:10:59 -04:00
fabro-sh-0530[bot]	9ee576690b	refactor: remove in-process IP allowlist and introduce WorkerRuntime (#444) ... ## Summary This PR does two things: it removes the in-process inbound source-IP allowlist entirely, and it lays the foundation for pluggable worker compute backends by introducing a `WorkerRuntime` abstraction. ## IP allowlist removal The `[server.ip_allowlist]` setting and its GitHub webhook overlay (`[server.integrations.github.webhooks.ip_allowlist]`) have been removed from config parsing, the settings API, and the OpenAPI spec. The `ip_allowlist.rs` module (~600 lines including the `GitHubMetaResolver`, middleware, and cache logic) is deleted. **Migration:** Existing `settings.toml` files containing those keys will now fail to parse as unknown fields. Source-IP restrictions should be moved to a reverse proxy, firewall, VPN, Tailscale ACL, or cloud ingress — as documented in the new security guidance. `build_router_with_options` loses the `ip_allowlist_config: Arc<IpAllowlistConfig>` parameter and `RouterOptions` loses `github_webhook_ip_allowlist`. Call sites in tests and the auth harness are updated accordingly. TCP serving no longer uses `make_service_with_connect_info` since `ConnectInfo` was only needed for IP extraction. ## WorkerRuntime abstraction A new `worker_runtime.rs` module introduces: - **`WorkerRuntime` trait** — `start`, `request_stop`, `force_stop`, `is_alive` - **`WorkerLaunchSpec`** — all inputs needed to describe a worker process, replacing the former `worker_command` helper - **`WorkerRef::Local { pid, process_group_id }`** — replaces the `worker_pid` / `worker_pgid` pair on `ManagedRun` - **`StartedWorker`** — carries the ref, optional stderr stream, and a `wait` future - **`LocalWorkerRuntime`** — the only implementation for now; wraps the existing subprocess spawn logic `AppState` stores an `Arc<dyn WorkerRuntime>` and `AppStateConfig` accepts an optional override in `#[cfg(test)]` for injection. Stop/kill paths in `server.rs` and `lifecycle.rs` now call `worker_runtime.request_stop` / `force_stop` / `is_alive` instead of issuing signals directly. ### Plan Summary - **Task 1:** New `worker_runtime.rs` with trait, types, and `LocalWorkerRuntime` impl - **Task 2:** Wire `Arc<dyn WorkerRuntime>` into `AppState` / `AppStateConfig` / `TestAppStateBuilder` - **Task 3:** Replace `worker_pid` / `worker_pgid` on `ManagedRun` with `worker_ref: Option<WorkerRef>`; build `WorkerLaunchSpec` in `execute_run_subprocess` - **Task 4:** Route all stop/kill calls through the runtime (`terminate_worker_for_deletion`, `shutdown_active_workers`, `cancel_run` fallback) - **Task 5:** Fake `RecordingWorkerRuntime` for unit tests; new cancel-fallback and shutdown tests ### Fabro Details <details> <summary>Ran 8 stages in 107m 33s for $21.66</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 10s | – | 0 | | preflight_lint | 2m 21s | – | 0 | | implement | 29m 0s | $11.86 | 0 | | simplify_opus | 11m 9s | $5.94 | 0 | | simplify_gpt | 53m 13s | $3.85 | 0 | | verify | 9m 23s | – | 0 | | **Total** | **107m 33s** | **$21.66** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh>	2026-05-27 23:17:23 -04:00
fabro-sh-0530[bot]	29a9a3f7d6	refactor: Remove inbound IP allowlisting (#443) ... ## Summary Removes Fabro's in-process inbound source-IP allowlist entirely. `[server.ip_allowlist]` and `[server.integrations.github.webhooks.ip_allowlist]` are gone from config parsing, resolved settings types, the OpenAPI spec, generated API clients, and the Settings > Security UI. Existing `settings.toml` files containing those keys now fail as unknown fields — this is a hard removal with no migration path. Network source restrictions should be enforced upstream via a reverse proxy, firewall, VPN, Tailscale ACLs, Kubernetes ingress, or platform policy. ### What changed - **Config/types** (`fabro-config`, `fabro-types`): Removed `ServerIpAllowlistLayer`, `ServerIpAllowlistOverrideLayer`, `ServerIpAllowlistSettings`, `ServerIpAllowlistOverrideSettings`, `IpAllowEntry`, associated resolver functions, GitHub `/meta` hook-range parsing, and Unix socket trusted-proxy validation. `ipnet` dropped from `fabro-types`; kept in `fabro-config` for sandbox CIDR validation. - **Server runtime** (`fabro-server`): Deleted `ip_allowlist.rs`, removed `IpAllowlistConfig` parameter from `build_router_with_options` and `RouterOptions`, removed the global allowlist middleware layer, and removed `GitHubMetaResolver` startup logic. GitHub webhook HMAC verification is unchanged. - **OpenAPI + generated clients**: Removed `ServerIpAllowlistSettings`, `ServerIpAllowlistOverrideSettings`, `IpAllowEntry`, `LiteralIpAllowEntry`, `GitHubMetaHooksEntry` schemas; removed `ip_allowlist` from `ServerNamespace` and `IntegrationWebhooksSettings`; dropped `IpAllowEntry` re-exports from `fabro-api`. - **Web UI**: Removed IP allowlist row from Settings > Security; updated nav description and page copy. - **Docs/changelog**: Security docs explicitly state Fabro provides no source-IP filtering and direct operators upstream. Changelog entry dated 2026-05-27 documents the breaking removal and annotates the 2026-04-19 entry where the feature was introduced. ### Also in this diff (unrelated to IP allowlisting) The worker control stream was migrated from reading newline-delimited JSON on stdin to a reconnecting WebSocket (`/api/v1/runs/{id}/worker/control-stream`). This adds `tokio-tungstenite` to `fabro-cli`/`fabro-server`, introduces `WorkerControlManagerHandle` with backoff reconnection and deduplication of replayed delivery IDs, and adds `RunPause`/`RunUnpause` message handling. A new integration test (`detached_run_cancel_reaches_worker_over_control_websocket`) exercises the full cancel path over the WebSocket. ### Key decisions - **Hard removal via `deny_unknown_fields`**: stale config is immediately visible as a startup error rather than silently ignored. - **No stub or default pass-through**: `IpAllowlistConfig::default()` is gone, not left as a no-op wrapper, to avoid keeping the feature shape alive. - **Webhook HMAC boundary unchanged**: source-IP filtering on webhook routes is removed; cryptographic signature verification remains the security boundary. ### Fabro Details <details> <summary>Ran 9 stages in 59m 53s for $27.24</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 15s | – | 0 | | preflight_lint | 2m 22s | – | 0 | | implement | 33m 54s | $22.81 | 0 | | simplify_opus | 5m 55s | $0.75 | 0 | | simplify_gpt | 3m 35s | $2.81 | 0 | | verify | 8m 34s | – | 0 | | fixup | 2m 24s | $0.87 | 0 | | **Total** | **59m 53s** | **$27.24** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh>	2026-05-27 22:29:08 -04:00
fabro-sh-0530[bot]	475b4ab650	Replace stdin JSONL control pipe with WebSocket worker control bus (#440) ... ## Summary Workers no longer receive control messages over stdin JSONL. A new `WorkerControlBus` abstraction (backed by `LocalWorkerControlBus` for local/single-node deployments) publishes `WorkerControlEnvelope` messages server-side; a worker-initiated WebSocket at `GET /runs/{id}/worker/control-stream` delivers them with ordered, replayable delivery frames. The bus API is designed so a Redis Streams backend can slot in later without touching API handlers or worker message handling. ### Plan Summary - **Task 1 – Bus contract:** `WorkerControlBus` trait, `WorkerControlDelivery`, `WorkerControlCursor` (`Start` / `After(id)`), bus errors. - **Task 2 – Local backend:** `LocalWorkerControlBus` — in-memory per-run stream, replay from `Start`, reconnect via `After(id)`, 1 024-message trim bound, cleanup on terminal runs. - **Task 3 – Server state:** `Arc<dyn WorkerControlBus>` added to `AppState`; `LocalWorkerControlBus` constructed at startup. - **Task 4 – Protocol extension:** `WorkerControlMessage::RunPause` / `RunUnpause`, `WorkerControlDeliveryFrame`, WebSocket liveness constants (`WORKER_CONTROL_WS_PING_INTERVAL = 15s`, `WORKER_CONTROL_WS_LIVENESS_TIMEOUT = 45s`), close-reason strings. - **Task 5 – Worker message handler:** `apply_worker_control_message` split out; pause/unpause routing; delivery-id dedupe (`AppliedWorkerControlDeliveryIds`, capacity 2 048). - **Task 6 – Worker WebSocket client:** `spawn_worker_control_manager` — HTTP→ws/wss and Unix-socket connection, backoff 100ms→5s, first-connection gate before `operations::start/resume`, ping/pong watchdog, fatal loss wired back to `execute`. - **Task 7 – Server route:** `GET /runs/{id}/worker/control-stream`, worker-only auth via new `RequireWorkerRunScoped` extractor, `Start`/`After` cursor dispatch, 410 on invalid cursor, server-side ping/pong. - **Task 8 – Stdin removal:** `RunAnswerTransport::Subprocess` renamed to `Worker { run_id, bus }`; `pump_worker_control_jsonl` deleted; worker launched with `stdin(Stdio::null())`; pause/unpause transport methods added. - **Tasks 9–10 – E2E & verification:** reconnect, invalid-cursor, cancel-over-WebSocket, and human-interview regression tests; no Redis dependency added. ### Key design decisions **`RunAnswerTransport::Subprocess` → `Worker { run_id, bus }`** — all existing transport methods (`submit`, `cancel_run`, `steer`, `interrupt`, `pair_*`) now call `bus.publish(run_id, envelope)` instead of writing to a channel that fed stdin. The match arms are symmetric, so the diff is mechanical but large. **First-connection gate** — `execute()` calls `control_manager.wait_for_first_connection().await?` before `operations::start` or `operations::resume`. Temporary failures spin with backoff; a fatal invalid-cursor or request-build failure propagates as an error before the workflow starts. **Fatal vs. reconnectable** — HTTP 410 or a WebSocket close with reason `"invalid_cursor"` is fatal (infrastructure failure, not user cancellation). Any other close/error triggers the reconnect loop while the run is non-terminal. **`AutomationStore::load` made synchronous** — startup load now uses `std::fs` under a `clippy::disallowed_methods` exception; async `tokio::fs` is no longer needed for the one-shot directory scan. Invalid automation files now fail loudly instead of being silently skipped. **`canRetry` extended to succeeded runs** — `status.kind === "succeeded"` is now retryable (non-archived). Tests and API docs updated to match. **Default model bumps** — OpenAI default: `gpt-5.4` → `gpt-5.5`; Gemini default: `gemini-3.1-pro-preview` → `gemini-3.5-flash`. ### Fabro Details <details> <summary>Ran 9 stages in 129m 19s for $58.27</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 10s | – | 0 | | preflight_lint | 2m 23s | – | 0 | | implement | 73m 48s | $41.53 | 0 | | simplify_opus | 22m 55s | $11.75 | 0 | | simplify_gpt | 7m 19s | $2.74 | 0 | | verify | 8m 51s | – | 0 | | fixup | 10m 59s | $2.24 | 0 | | **Total** | **129m 19s** | **$58.27** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-27 20:24:25 -04:00
fabro-sh-0530[bot]	ee1502f793	Add automation run materialization core and shared run creation helper (#441) ... ## Summary Automation-triggered runs need to share the same run creation pipeline as `POST /runs`. This PR lays the core infrastructure: a `create_run_from_manifest` helper that the HTTP handler and the upcoming automation scheduler can both call, plus a `AutomationRunMaterializer` trait with a production implementation that clones a GitHub repo and builds a `RunManifest` from it. ### Plan Summary - Extract the body of `handler/runs.rs::create_run` into a crate-private `create_run_from_manifest(state, CreateRunFromManifestRequest)` helper; `POST /runs` calls it with `automation: None`, preserving existing behavior. - Add `AutomationRunMaterializeInput/Materialized/Error` types and the `AutomationRunMaterializer` trait (`automation_materializer.rs`). - Implement `ProductionAutomationRunMaterializer`: validates `owner/repo` slug, shallow-clones via `tokio::process::Command` argv (never shell strings), sets `GIT_TERMINAL_PROMPT=0`, enforces per-operation timeouts, redacts credentials from error text, resolves the workflow with `fabro_config::project::WorkflowLocation::resolve`, and builds a `RunManifest` via `fabro_manifest::build_run_manifest`. - Add `TestAutomationRunMaterializer` (gated on `test` or `test-support`) for fake injection in route tests without network access. - Wire the materializer override into `AppState` and `AppStateConfig` behind `#[cfg(any(test, feature = "test-support"))]`; expose via `TestAppStateBuilder::automation_materializer`. - Move `async-trait` from `[dev-dependencies]` to `[dependencies]` in `fabro-server` since the trait is now in production code. ## What changed and why **`automation_materializer.rs` (new)** — Core of this PR. The `GitCommandPlan` builder keeps all git invocations as argv slices so there is no shell injection surface. Credentials are injected exclusively via `GIT_CONFIG_VALUE_0` (the `extraheader` mechanism), never embedded in the clone URL, so they cannot appear in run metadata or error messages. The `redact_git_output` function scrubs the raw token, the Base64-encoded form, and the full `AUTHORIZATION` header value from any error string before it surfaces. **`create_run_from_manifest`** — The extracted helper accepts an optional `AutomationRef` which is forwarded into `create_input.automation` so the store can persist automation provenance on the run. The `POST /runs` code path passes `None`, leaving existing API behavior identical. **Test injection** — `TestAutomationRunMaterializer` captures every `AutomationRunMaterializeInput` it receives and returns a caller-controlled `Result`, letting route tests assert what inputs the scheduler would pass without touching GitHub. ```mermaid flowchart TB A["POST /runs\n(HTTP handler)"] -->|automation: None| H["create_run_from_manifest"] S["Automation scheduler\n(future issue)"] -->|automation: Some(ref)| H H --> DB[(Run store)] M["AutomationRunMaterializer\n(trait)"] -->|produces RunManifest| S M -- production --> P["ProductionAutomationRunMaterializer\n(git clone → manifest build)"] M -- test --> T["TestAutomationRunMaterializer\n(captures input, returns fixture)"] ``` ### Fabro Details <details> <summary>Ran 8 stages in 72m 56s for $36.55</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 2s | – | 0 | | preflight_compile | 2m 12s | – | 0 | | preflight_lint | 2m 27s | – | 0 | | implement | 30m 41s | $23.10 | 0 | | simplify_opus | 19m 19s | $9.12 | 0 | | simplify_gpt | 7m 53s | $4.33 | 0 | | verify | 9m 20s | – | 0 | | **Total** | **72m 56s** | **$36.55** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh>	2026-05-27 20:14:56 -04:00
Bryan Helmkamp	a992a7d76b	feat(runs): allow retrying succeeded runs ... Broaden manual retry eligibility to all unarchived terminal runs while preserving active and archived precondition failures.	2026-05-27 18:49:45 -04:00
Bryan Helmkamp	e18772888e	Model run sandbox lifecycle explicitly (#431) ... ## Summary Fixes sandbox state reporting by separating a requested sandbox plan from an initialized sandbox instance. Runs now project sandbox lifecycle as `planned`, `initializing`, `ready`, or `failed`, and live sandbox operations only proceed once a real instance exists. ## Changes - Introduces `RunSandboxPlan`, `RunSandboxInstance`, and lifecycle-backed `RunSandbox` domain types, with serde validation that prevents `ready` sandboxes without an instance. - Updates store projection behavior so sandbox events transition through planned, initializing, ready, and failed states while preserving requested provider/image/snapshot separately from runtime metadata. - Tightens server sandbox handlers so details/files/services/terminal/VNC helpers require an initialized instance and return a clear 404 when the sandbox was never created. - Updates the OpenAPI contract and regenerated clients so `Run.sandbox` exposes lifecycle state while `SandboxDetails.sandbox` contains only initialized instance metadata. - Updates the web UI to render lifecycle state directly from run summaries, hide the Sandbox tab for pure planned sandboxes, and disable sandbox controls until the instance is ready. - Cleans up duplicated lifecycle display/type logic and duplicate server-side sandbox instance loading found during review. | Lifecycle state | Meaning | Live controls | | --- | --- | --- | | `planned` | Sandbox was requested but no provider instance exists | Hidden/disabled | | `initializing` | Provider setup has started | State view only | | `ready` | Runtime instance exists | Enabled | | `failed` | Provider setup failed with error details | State view only | ## Testing - `cargo check --workspace` - `cargo +nightly-2026-04-14 fmt --check --all` - `git diff --check` - `cd apps/fabro-web && bun run typecheck` - `cd apps/fabro-web && bun test app/routes/run-detail.test.ts app/routes/run-sandbox.test.tsx app/components/run-summary-panel.test.tsx` - `cargo nextest run -p fabro-types --test sandbox_model_serde` - `cargo nextest run -p fabro-store run_created_projects_planned_sandbox_lifecycle sandbox_lifecycle_events_update_projected_sandbox_state run_failed_before_sandbox_events_leaves_sandbox_planned` - `cargo nextest run -p fabro-server planned_sandbox_returns_404_from_details_endpoint planned_sandbox_rejects_live_operations failed_sandbox_rejects_live_operations local_sandbox_returns_provider_neutral_details` - `cargo nextest run -p fabro-api --test run_sandbox_round_trip` - `cargo nextest run -p fabro-api --test sandbox_details_round_trip` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex)	2026-05-27 12:48:56 -04:00
Bryan Helmkamp	e13de9faaf	feat(automation): persist automation refs on runs (#428) ... ## Summary Adds durable automation metadata to workflow runs so automation-triggered runs can carry their automation and trigger references through creation, stored events, projections, summaries, fork, retry, and API surfaces. This also introduces the new `fabro-automation` crate with typed automation IDs, TOML parsing/validation, revision hashing, and a file-backed automation store. The store avoids overwriting malformed existing TOML files on create and keeps read access from being blocked by mutation disk I/O. ## Changes - Add `AutomationRef` propagation through `RunSpec`, `run.created`, store projections, summaries, fork, retry, and related tests. - Add `fabro-automation` domain/store crate for automation TOML definitions, trigger validation, revisions, create/replace/delete, and load behavior. - Update OpenAPI and regenerated TypeScript client types for `RunSpec.automation` and `AutomationRef.trigger_id`. - Add API/type regression coverage for the new automation fields. - Harden automation store create semantics so skipped malformed files still reserve their path. ## Verification - `cargo nextest run -p fabro-automation` - `cargo +nightly-2026-04-14 clippy -p fabro-automation --all-targets -- -D warnings` - `cargo nextest run -p fabro-api` - `cargo nextest run -p fabro-types run_spec_round_trips_templated_settings run_created_props_round_trip_templated_settings` - `cd lib/packages/fabro-api-client && bun run typecheck` - `cargo +nightly-2026-04-14 fmt --check --all` - `git diff --check`	2026-05-27 11:52:57 -04:00
Bryan Helmkamp	ec1b3f2084	feat(sandbox): secure daytona snapshot names (#429) ... ## Summary Secures Daytona custom snapshot creation by removing user-controlled snapshot/image references and replacing them with deterministic names Fabro computes internally. Docker image selection now uses `image.docker`, while Daytona only accepts `image.dockerfile` for custom snapshots and continues to use `daytona-medium` when no Dockerfile is configured. ## Changes - Replaces public `image.ref` config/API shape with Docker-specific `image.docker` across Rust settings, OpenAPI, generated TypeScript client, docs, defaults, examples, and web samples. - Adds Daytona snapshot identity generation using HMAC-SHA256 over a canonical manifest keyed by the Daytona API key, producing `fabro-<uuid>` snapshot names without exposing Dockerfile text or key material. - Routes Daytona custom Dockerfiles, including devcontainer-generated Dockerfiles, through the same computed identity path before calling Daytona snapshot APIs. - Updates sandbox initialization events and store projections so initialized run state can show the resolved image and computed Daytona snapshot after startup. - Updates legacy config migration behavior so Docker image refs map to `image.docker`, while Daytona legacy snapshot names are not preserved. ## Breaking Changes - `image.ref` is no longer accepted in new environment config. - Docker environments should use `image.docker` for image selection. - Daytona environments reject `image.docker`; use `image.dockerfile` to request a custom computed snapshot. ## Verification - `cargo build -p fabro-api` - `cd lib/packages/fabro-api-client && bun run generate` - `cd lib/packages/fabro-api-client && bun run typecheck` - `cd apps/fabro-web && bun run typecheck` - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings` - `ulimit -n 4096 && cargo nextest run --no-fail-fast -p fabro-cli -p fabro-config -p fabro-sandbox -p fabro-workflow -p fabro-store -p fabro-server -p fabro-api` - `cargo insta pending-snapshots` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex)	2026-05-27 11:52:35 -04:00
Bryan Helmkamp	b1bd2f522c	feat(server): add variables API (#430) ... ## Summary Adds a workflow-visible variables store and HTTP API for managing non-sensitive run variables, then wires those variables into run config interpolation before run creation, validation, and preflight. ## What Changed - Adds `/api/v1/variables` CRUD endpoints backed by a JSON variable store and generated Rust/TypeScript API types. - Supports `{{ vars.NAME }}` interpolation alongside existing `{{ env.NAME }}` handling for run-owned config fields, including environment, MCP, hook, artifact, checkpoint, SCM, and notification settings. - Reuses canonical `fabro-types` variable DTOs in `fabro-api` and adds OpenAPI name patterns so clients see the same env-style variable contract enforced by the server. - Keeps variable updates store-owned with `update_existing`, avoiding duplicated not-found/update semantics in the HTTP handler. - Shares env-style name validation between variables, interpolation parsing, and vault token names to avoid grammar drift. Variables are intentionally non-sensitive: list/get responses include values, unlike vault secrets. ## Validation - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo test -p fabro-types` - `cargo test -p fabro-variable` - `cargo test -p fabro-api --test variable_round_trip` - `cargo test -p fabro-server --features test-support --test it api::variables` - `cargo +nightly-2026-04-14 clippy -p fabro-types -p fabro-variable -p fabro-vault --all-targets -- -D warnings` - `cargo +nightly-2026-04-14 clippy -p fabro-server --features test-support --all-targets -- -D warnings` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex/)	2026-05-27 11:46:36 -04:00
Bryan Helmkamp	ab0f94fd82	feat(system): report runtime integration status (#416) ... ## Summary Settings > Integrations now reflects the server's actual integration readiness instead of only static `settings.toml` booleans. This adds `/api/v1/system/integrations` as the runtime source of truth, covering server config, vault credential presence, and Slack Socket Mode connection state. ## What Changed - Added shared `fabro-types` integration status models and reused them from `fabro-api` to avoid duplicate API/domain types. - Added `GET /api/v1/system/integrations` to the OpenAPI spec, Rust server routes, demo routes, and generated TypeScript client. - Reports GitHub and Slack status as `disabled`, `missing_credentials`, `configured`, `connecting`, `connected`, or `error`, with non-secret metadata and missing credential names. - Tracks Slack Socket Mode runtime state from the Slack connection loop and respects explicit `server.integrations.slack.enabled = false` even when vault tokens exist. - Updated the Integrations settings page to read the new runtime endpoint, so a vault-configured Slack setup no longer appears simply as disabled. ## Verification - `cargo build -p fabro-api` - `cargo nextest run -p fabro-api system_integrations` - `cargo nextest run -p fabro-config resolved_server_integrations_are_slack_only_for_chat` - `cargo nextest run -p fabro-slack run_event_loop_notifies_connected_status` - `cargo nextest run -p fabro-server --features test-support --test it get_system_integrations` - `cargo nextest run -p fabro-server` - `cargo +nightly-2026-04-14 fmt --check --all` - `cd apps/fabro-web && bun test app/routes/settings-integrations.test.tsx app/lib/query-keys.test.ts` - `cd apps/fabro-web && bun run typecheck` - `cd apps/fabro-web && bun run build` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex)	2026-05-26 19:27:32 -04:00
Bryan Helmkamp	6a94970b21	fix(model): retire GPT-5.2 and GPT-5.3 catalog entries (#412) ... ## Summary Retires the built-in OpenAI catalog rows for GPT-5.2 and GPT-5.3-era models while preserving compatibility through aliases on the closest remaining replacements. `gpt-5.2`, `gpt5`, `gpt-5.3-codex`, and `codex` now resolve through `gpt-5.4`; `gpt-5.3-codex-spark` and `codex-spark` now resolve through `gpt-5.4-mini`. The Rust tests that pinned individual declarative catalog rows were removed so future catalog updates stay data-only. ## Verification - `cargo nextest run -p fabro-model` - `cargo nextest run -p fabro-server list_models` - `cargo +nightly-2026-04-14 fmt --check --all` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex)	2026-05-26 00:06:50 -04:00
fabro-sh-0530[bot]	bd72570437	Add provider-backed sandbox inventory API and rename SandboxProvider to… (#409) ... ## Summary Exposes `GET /api/v1/sandboxes` and `GET /api/v1/sandboxes/{id}` endpoints that query sandbox inventory directly from configured providers (Docker, Daytona), independent of run projections. Also renames the existing `SandboxProvider` enum to `SandboxProviderKind` throughout the codebase to free the name for the new `SandboxProvider` trait. ### Plan Summary - **OpenAPI + types**: New `SandboxInfo`, `SandboxListResponse`, `SandboxListMeta`, `SandboxProviderLookupError`, and `SandboxProviderKind` schemas added to the API spec; canonical Rust DTOs added to `fabro-types`. - **Provider trait and registry**: `SandboxProvider` trait (`list`, `get`, `create`, `delete`) and `SandboxProviderRegistry` introduced in `fabro-sandbox/src/provider.rs`. Registry fans out calls across all configured providers and implements fail-soft semantics for list and conflict/unavailable detection for get. - **Provider implementations**: `DockerSandboxProvider` uses Bollard label-filtered container listing and per-inspect; `DaytonaSandboxProvider` uses the SDK with paginated label-filtered listing. Both verify `sh.fabro.managed=true`. - **Shared detail mapping**: Docker and Daytona inspect-to-`SandboxInfo` paths extracted into `docker_info_from_inspect` / `daytona_info_from_sdk_sandbox` so run-scoped `SandboxDetails` and inventory `SandboxInfo` share the same normalization logic. - **Monitoring UI**: `RunsInfo` now exposes `scheduler_slots_used`; the monitoring panel displays "slots used" instead of the raw active-run count. ## What changed and why **`SandboxProvider` → `SandboxProviderKind`** is a mechanical rename across ~20 call sites so the unqualified name `SandboxProvider` can be claimed by the new trait without collision. **Registry lookup semantics** for `get_managed_by_native_id`: | Outcome | HTTP | |---|---| | Exactly one provider matches | `200` | | All providers succeed, none match | `404` | | Two or more providers match the same id | `409` | | No match + at least one provider failed | `502` | List is always fail-soft: partial results are returned and failing providers appear in `meta.provider_errors`. **`DockerFields` / `DaytonaFields` structs** were introduced inside `details.rs` to hold the shared normalization output. Both `map_docker_inspect` (run-scoped) and `docker_info_from_inspect` (inventory) now delegate to `docker_fields_from_inspect`, eliminating duplicate field-extraction logic. Same pattern for Daytona. **`futures` moved from optional to unconditional** in `fabro-sandbox/Cargo.toml` because `join_all` / `try_join_all` are now used in `provider.rs`, which is not feature-gated. **`local` provider** intentionally returns an empty list and `None` for get — it has no provider-managed inventory. ### Fabro Details <details> <summary>Ran 8 stages in 102m 54s for $41.81</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 6s | – | 0 | | preflight_lint | 2m 20s | – | 0 | | implement | 56m 40s | $10.82 | 0 | | simplify_opus | 27m 50s | $26.24 | 0 | | simplify_gpt | 5m 2s | $4.76 | 0 | | verify | 8m 24s | – | 0 | | **Total** | **102m 54s** | **$41.81** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh>	2026-05-25 22:41:57 -04:00
fabro-sh-0530[bot]	bd837fc0f0	Add POST /api/v1/providers/test endpoint (#406) ... ## Summary Adds `POST /api/v1/providers/test` so API, CLI, and UI callers can check LLM provider health without parsing `/health/diagnostics`. The endpoint tests every configured provider once using the catalog probe model and returns typed, per-provider results with an aggregate summary — all at HTTP 200, with provider failures expressed in the body. This PR also adds `scheduler_slots_used` to `SystemRunCounts` to distinguish runs occupying concurrency slots from all "active" runs (e.g. runs blocked waiting for human input count as active but do not hold a scheduler slot). ### What changed and why **Provider probe logic** (`diagnostics.rs`) The inline probe loop inside `check_llm_providers` was extracted into `test_llm_providers` / `probe_single_provider`, which both the new endpoint and the existing diagnostics check now share. The extraction preserves the diagnostics output format: `diagnostic_detail` (a `#[serde(skip)]` field) carries the richer context string used for the `LLM Providers` section, while `error_message` carries the redacted, public-facing error. Key decisions: - `ProviderProbeStatus` is `ok | error` only — no `skip`, because v1 only iterates configured providers. - `model_id` is nullable so auth/registration failures (where no probe was sent) can be expressed cleanly. - API key values appearing in upstream error responses are passed through `redact_string` before being stored in `error_message`. **Route** (`handler/models.rs`) `.route("/providers/test", post(test_providers))` added alongside `/providers`, protected by the same `RequiredUser` extractor. **`scheduler_slots_used`** (`handler/system.rs`, `server.rs`) The status predicate (`Starting | Running | Blocked | Paused`) was already duplicated between the scheduler loop and `get_system_info`. It's now a named function `counts_toward_scheduler_capacity`, used in both places and in the new `SystemRunCounts` field. The web UI monitoring panel was updated to display "slots used" instead of "active." **Generated clients** OpenAPI spec updated; Rust and TypeScript clients regenerated. New TypeScript types: `ProviderTestList`, `ProviderTestResult`, `ProviderTestStatus`, `ProviderTestSummary`. ### Plan Summary - Add `testProviders` OpenAPI operation and `ProviderTestList` / supporting schemas to `fabro-api.yaml`. - Extract shared `test_llm_providers` from `check_llm_providers` in `diagnostics.rs`; keep diagnostics output identical. - Wire `POST /providers/test` handler in `handler/models.rs`. - Add `scheduler_slots_used` to `SystemRunCounts` and extract `counts_toward_scheduler_capacity` predicate. - Regenerate Rust and TypeScript API clients. - Add integration tests covering: no providers, successful probe, auth failure (no upstream call), registration failure, mixed catalog order, and API key non-leakage. ### Fabro Details <details> <summary>Ran 8 stages in 53m 33s for $40.83</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 8s | – | 0 | | preflight_lint | 2m 19s | – | 0 | | implement | 23m 56s | $30.73 | 0 | | simplify_opus | 12m 53s | $5.80 | 0 | | simplify_gpt | 2m 40s | $4.30 | 0 | | verify | 9m 5s | – | 0 | | **Total** | **53m 33s** | **$40.83** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh>	2026-05-25 21:57:26 -04:00
Bryan Helmkamp	02a87cb650	fix(settings): show scheduler slot usage (#404) ... ## Summary Fixes the Settings Resources concurrency meter so it reports scheduler capacity usage instead of all non-terminal runs. `/api/v1/system/info` now exposes `runs.scheduler_slots_used`, computed from the same status predicate the scheduler uses, while `runs.active` remains unchanged for existing lifecycle semantics. The settings page uses only the new slot count, so pending approval runs and runnable queued runs no longer make the concurrency meter look full. ## Verification - `cargo build -p fabro-api` - `cargo nextest run -p fabro-server --features test-support worker_started_child_run_requires_approval_before_becoming_runnable` - `cargo nextest run -p fabro-server --features test-support scheduler_capacity_counts_only_runs_occupying_slots` - `cargo nextest run -p fabro-server --features test-support get_system_info_returns_runtime_fields` - `cargo nextest run -p fabro-server --features test-support test_app_state_with_options_respects_max_concurrent_runs` - `cargo nextest run -p fabro-server --features test-support openapi_conformance` - `bun test app/routes/settings-monitoring.test.tsx` - `bun run typecheck` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 (context unknown, reasoning unknown) via [Codex](https://openai.com/codex)	2026-05-25 18:28:18 -04:00
fabro-sh-0530[bot]	e8f0aceee8	refactor: rationalize server secret scopes (vault-only for optional int… (#401) ... ## Summary Separates Fabro server secrets into two explicit scopes: **bootstrap** secrets that come from process env or `server.env`, and **optional integration** secrets that come exclusively from the vault. This makes secret resolution simple and predictable, and removes all `process env → server.env` fallback paths for optional integrations such as GitHub App, Slack, Daytona, Brave Search, and LLM provider keys. ## What changed **New `ToolSecrets` struct in `fabro-agent`** — Brave Search API key is now passed explicitly through `SessionOptions.tool_secrets` rather than read from process env inside the tool. The standalone CLI reads the key at the CLI boundary (with an explicit `#[expect(clippy::disallowed_methods)]` annotation); the server will read it from the vault. The error message changes from `"BRAVE_SEARCH_API_KEY environment variable is not set"` to `"BRAVE_SEARCH_API_KEY is not configured"`. **`VaultCredentialSource::vault_only` constructor in `fabro-auth`** — Adds a constructor that passes `|_| None` as the env lookup, ensuring the server LLM credential source never resolves provider keys from process env. **GitHub App secrets move to vault in install flows** — Both the CLI `fabro install github` path and the browser install finish handler now write `GITHUB_APP_PRIVATE_KEY`, `GITHUB_APP_CLIENT_SECRET`, and `GITHUB_APP_WEBHOOK_SECRET` to the vault instead of `server.env`. Switching strategies removes stale secrets from the other strategy's storage location. The `vault_set` field type changes from `Vec<(String, String)>` to `Vec<VaultSecretWrite>` to carry per-secret type metadata (file vs. token). **`fabro-vault` gains a `fabro-static` dependency** — Needed so the vault crate can reference canonical env-var names from the shared registry without a cycle. **`GH_TOKEN` fallback removed** — `GITHUB_TOKEN` is now read from the vault only; the changelog and `server-configuration.mdx` note drops mention of `GH_TOKEN` as an accepted fallback. **Version bump** — Workspace crates promoted from `0.244.0-nightly.0` to `0.244.0`. **Docs** — Internal strategy doc, public admin docs (Docker, Railway, server-configuration, security, troubleshooting), and integration docs (GitHub, Slack, Daytona, Brave Search, LiteLLM, tools reference, models) all updated to reflect vault-only optional secrets and direct users to `fabro secret set` rather than process env or `server.env`. ### Plan Summary - **Task 1** (secret registry) — not yet present in this diff; classification lives in the places that consume it. - **Task 3–6** (vault-only lookups for GitHub, Slack, Daytona, LLM) — implemented via `vault_only` constructor, `tool_secrets` threading, and install-path changes. - **Task 7** (Brave Search explicit injection) — `ToolSecrets`, `register_core_tools` wiring, CLI boundary read. - **Task 8** (install persistence) — GitHub App secrets written to vault; token strategy writes `GITHUB_TOKEN` to vault and clears app vault keys; app strategy clears `GITHUB_TOKEN` vault key. - **Task 9** (docs) — all public and internal docs updated. ### Fabro Details <details> <summary>Ran 0 stages in 155m 26s for $60.85</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | **Total** | **155m 26s** | **$60.85** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-25 17:26:01 -04:00
fabro-sh-0530[bot]	b15d8b8476	feat: Add approve/deny run controls to MCP and CLI (#400) ... ## Summary Exposes the existing `POST /api/v1/runs/{id}/approve` and `POST /api/v1/runs/{id}/deny` REST endpoints through the `fabro_run_interact` MCP tool and two new top-level CLI commands (`fabro approve`, `fabro deny`). Workflow agents are explicitly blocked from using these actions — approval remains a human/user operation. ## What changed **Client & tool backend** (`fabro-client`, `fabro-tool`): Added `approve_run` and `deny_run` to `Client` and the `FabroToolBackend` trait, implemented in `ClientBackend`. `deny_run` passes a `DenyRunRequest` body; absent, blank, or whitespace-only reasons are normalised to `None`. **`fabro_run_interact` MCP tool**: Added `Approve` and `Deny` variants to `RunInteractAction` / `ValidatedInteractAction`, and an optional `reason` parameter (only valid for `deny`; validated and trimmed on input). Both actions return `{ "summary": … }` using the existing shape. The tool description is updated to list the new actions. **Workflow-agent guard** (`fabro-workflow`): Before dispatching `fabro_run_interact`, the handler checks `validated.action.requires_user()`. If the action is `approve` or `deny`, it returns an immediate `ToolError` without ever reaching the backend, keeping the guard explicit and independent of server auth. **CLI** (`fabro-cli`): Extracted the archive/unarchive batch loop into a shared `run_resolved_run_batch` helper in `commands/runs/mod.rs`, then implemented `approval.rs` using the same helper. Both commands follow the same batch contract as archive: attempt all runs, collect per-run errors, exit non-zero if any fail, and emit `{ "approved"/"denied": […], "errors": […] }` in JSON mode. **Server auth regression** (`fabro-server`): Extended `run_tools_worker_cannot_call_user_only_non_mcp_routes` to cover `POST /runs/{id}/deny` alongside the existing `approve` and `timeline` checks. **Docs** (`mcp.mdx`, `cli.mdx`): Updated the `fabro_run_interact` table entry and added approve/deny examples, plus reference sections for the two new CLI commands. ### Plan Summary - Add `approve_run` / `deny_run` to `Client` and `FabroToolBackend` - Extend `fabro_run_interact` with `approve`, `deny`, and optional `reason` - Block workflow-agent self-approval with an early `ToolError` - Refactor archive batch loop into shared `run_resolved_run_batch` helper - Add `fabro approve` and `fabro deny` CLI commands reusing that helper - Add integration tests for CLI commands, MCP tool, and server auth guard ### Fabro Details <details> <summary>Ran 9 stages in 63m 57s for $42.33</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 6s | – | 0 | | preflight_lint | 2m 17s | – | 0 | | implement | 28m 16s | $32.57 | 0 | | simplify_opus | 10m 59s | $4.24 | 0 | | simplify_gpt | 6m 13s | $3.96 | 0 | | verify | 10m 51s | – | 0 | | fixup | 2m 29s | $1.55 | 0 | | **Total** | **63m 57s** | **$42.33** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh>	2026-05-25 15:49:57 -04:00
Bryan Helmkamp	05c57a5150	fix: clear stale conclusions on resume ... Resume attempts must not inherit the prior terminal conclusion. Leaving it in the projection made attach and summaries treat a live resumed run as already failed.	2026-05-24 18:47:04 -04:00
Bryan Helmkamp	cf5c71e255	fix: allow resuming cancelled runs	2026-05-24 18:35:34 -04:00
fabro-sh-0530[bot]	2c0416e1c5	feat: add server sandbox provider enablement policy (#389) ... Operators can now disable individual sandbox providers at the server level via `[server.sandbox.providers.<provider>]` in `settings.toml`, without breaking existing deployments that omit the section entirely. ## What changed **Config layer & resolution** (`fabro-config`, `fabro-types`): new sparse `ServerSandboxLayer` / `ServerSandboxProvidersLayer` / `ServerSandboxProviderLayer` structs with `deny_unknown_fields` parse validation. Resolution defaults every missing level to `enabled = true`. The resolved `ServerSandboxSettings` / `ServerSandboxProvidersSettings` / `ServerSandboxProviderSettings` types live in `fabro-types` and are shared by all consumers. **Policy enforcement** (`fabro-server`): three check points enforce the effective provider (after dry-run Local coercion): 1. `POST /api/v1/runs` — 400 at admission. 2. `POST /api/v1/runs/preflight` — `ok: false` with a `Sandbox Provider Policy` error check. 3. Launch (`execute_run_in_process` / `execute_run_subprocess`) — fail-before-execution with a `LaunchFailed` reason. The dry-run coercion logic was extracted into `SandboxProvider::effective_for(mode)` on the type itself and reused across `fabro-server` and `fabro-workflow`. **Installer** (`fabro-install`): `write_sandbox_settings` now always writes all three provider policy tables with `enabled = true`, so generated `settings.toml` files are self-documenting. **API schema & clients**: `ServerNamespace` gains a required `sandbox` field in the OpenAPI spec; three new TypeScript model files were regenerated accordingly. ### Plan Summary - Task 1: config layer structs → resolved types → resolver helpers → tests - Task 2: `effective_sandbox_provider` + `sandbox_provider_policy_error` helpers; admission, preflight, and launch checks + integration tests - Task 3: installer writes all three provider entries; install finish tests updated - Task 4: OpenAPI schema, `fabro-api` build mappings, TS client regeneration, docs ### Fabro Details <details> <summary>Ran 8 stages in 59m 15s for $45.70</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 5s | – | 0 | | preflight_lint | 2m 21s | – | 0 | | implement | 27m 55s | $38.88 | 0 | | simplify_opus | 14m 20s | $4.93 | 0 | | simplify_gpt | 3m 14s | $1.88 | 0 | | verify | 8m 49s | – | 0 | | **Total** | **59m 15s** | **$45.70** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-24 16:49:05 -04:00
fabro-sh-0530[bot]	883a11ce4d	feat: MCP tool parity for fabro_tools workflow agents (#387) ... ## Summary Workflow agents that opt in with `[run.agent] fabro_tools = true` now see the full seven-tool Fabro run-management catalog — including `fabro_run_pair` — matching what human MCP clients receive. Auth extractors have been renamed from the ad-hoc "run tools" vocabulary to product-level names, and all pair routes now accept run-management actors instead of requiring a user principal. ### Plan Summary - **Shared catalog parity** — `FABRO_RUN_PAIR_TOOL_NAME` added to `TOOL_DEFINITIONS` in `fabro-tool`, making `register_fabro_run_tools()` register all seven tools. - **Workflow agent executor** — new `FABRO_RUN_PAIR_TOOL_NAME` match arm in `execute_fabro_run_tool` parses `FabroRunPairParams`, calls `fabro_tool::pair_run`, and renders the standard summary. - **Auth extractor rename** — `RequiredRunToolActor` → `RequiredRunManagementActor`; `RequireRunScopedOrRunTools` → `RequireRunManagementTarget`. Semantics are unchanged; names now describe the product policy. - **Pair route migration** — all six pair handlers (`get_pair_status`, `start_pair`, `get_pair`, `end_pair`, `send_pair_message`, `get_transcript`) switch from `RequiredUser` to `RequireRunManagementTarget`, removing the `Principal::User(auth.0)` construction and the now-redundant `parse_run_id_path` calls. - **Test coverage** — unit tests for the renamed extractors, integration tests proving run-tools workers can read pair status/transcript cross-run, that auth is accepted before domain logic (worker-control-unavailable), that cross-run base workers remain forbidden, and that run-tools workers still cannot call user-only routes (approve, timeline). ### Key design decisions **Forced-child behavior is preserved.** `fabro_run_create` from a workflow agent still calls `ensure_current_run_parent`; the plan specifically excludes relaxing this. **Principal provenance is unchanged.** Workers keep `Principal::Worker { run_id: … }` when acting through `fabro_tools`; no user principal is forged. **Pair handler run-id extraction simplified.** Because `RequireRunManagementTarget` already extracts and validates the run ID from the path, the pair handlers no longer repeat that parse — the second `Path` component for pair-specific routes is bound to `_id` and discarded. **Twin-OpenAI gains `instructions_text` logging.** The integration test for project-skill discovery needed to inspect the system prompt sent to OpenAI; the twin now captures and exposes `instructions_text` in request logs. This is a supporting change, not part of the auth model. ### Fabro Details <details> <summary>Ran 8 stages in 44m 10s for $39.32</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 6s | – | 0 | | preflight_lint | 2m 17s | – | 0 | | implement | 23m 9s | $33.23 | 0 | | simplify_opus | 4m 6s | $1.06 | 0 | | simplify_gpt | 4m 1s | $5.03 | 0 | | verify | 7m 56s | – | 0 | | **Total** | **44m 10s** | **$39.32** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-24 15:52:19 -04:00
fabro-sh-0530[bot]	98c26d5370	Fold context-window data into agent.message, remove snapshot event (#390) ... ## Summary Removes the standalone `agent.context_window.snapshot` event and instead attaches the context-window projection directly to `agent.message`. This eliminates the async provider token-count API calls that the old approach required, and simplifies the event log to a single event type carrying all post-response agent data. ## What Changed and Why **Before:** After each LLM turn, the agent emitted a separate `agent.context_window.snapshot` event — first a local estimate, then potentially a second one after an async `count_input_tokens` call resolved (or after response usage arrived). This required fingerprint deduplication state, a `close_token` to cancel in-flight counts, and frontend handling for the extra event type. **After:** The `AgentEvent::AssistantMessage` variant carries an `Option<StageContextWindowProjection>`. The projection is computed locally at request-build time and then refined using response token usage when available (`ResponseUsageScaledBreakdown`), or kept as a `LocalEstimate` when response usage is absent. No provider API calls are made. ### Plan Summary - **Task 1:** Added `context_window: Option<StageContextWindowProjection>` to `AgentMessageProps` (Rust types + OpenAPI), removed `AgentContextWindowSnapshotProps` and `EventBody::AgentContextWindowSnapshot`. - **Task 2:** Removed the spawned `count_input_tokens` task, `close_token`, fingerprint sets, and both snapshot-emit methods from `Session`. Added `context_window_from_response_usage` to `context_window.rs`; `BuiltRequest` now holds the local projection instead of the tool list. - **Task 3:** Workflow conversion copies `context_window` from `AgentEvent::AssistantMessage` into `AgentMessageProps`; store reducer reads it from `AgentMessage` instead of the removed snapshot variant and stamps `event_seq`. - **Task 4:** GET endpoint tests updated to seed data via `agent.message` with embedded context-window; endpoint behavior unchanged. - **Task 5:** Frontend constant and tests for `agent.context_window.snapshot` removed; `agent.message` already invalidates `stageContextWindow` through existing stage-activity handling. TypeScript client regenerated with the new `AgentMessageProps` model. ### Key Design Decisions - **No provider token-count API calls** during normal execution — context-window accuracy relies on local estimates scaled by response usage, which is always available for successful turns. - **Failed-before-response turns** emit no context-window data (`context_window: None`), matching the old behavior where a snapshot would have been emitted but response-usage scaling would never arrive. - `BuiltRequest` drops the `tools` field (only needed for the now-removed snapshot emission path); the local projection is computed at build time and stored directly. ### Fabro Details <details> <summary>Ran 8 stages in 60m 3s for $55.78</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 1s | – | 0 | | preflight_lint | 2m 16s | – | 0 | | implement | 30m 39s | $44.82 | 0 | | simplify_opus | 10m 48s | $4.03 | 0 | | simplify_gpt | 5m 1s | $6.93 | 0 | | verify | 8m 47s | – | 0 | | **Total** | **60m 3s** | **$55.78** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-24 15:48:21 -04:00
Bryan Helmkamp	4ad9827baf	Remove retired OpenAI catalog models	2026-05-24 11:40:35 -04:00
Bryan Helmkamp	f35dccecab	Finalize unfinished stages after run failure	2026-05-24 11:18:02 -04:00
fabro-sh-0530[bot]	04e169ef79	Add POST /api/v1/runs/delete batch delete endpoint (#382) ... ## Summary Adds a fail-soft batch delete endpoint (`POST /api/v1/runs/delete`) that mirrors the existing archive/unarchive batch pattern, processes 1–250 run IDs independently, and returns per-item outcomes with an aggregate summary. Existing `DELETE /api/v1/runs/{id}` behavior is unchanged. ### Plan Summary - **OpenAPI-first**: new `BatchDeleteRunsRequest/Response/Result/Summary` schemas added to the spec; Rust (`fabro-api`) and TypeScript (`fabro-api-client`) clients regenerated. - **Delete internals refactored**: `DeleteRunOutcome` gains `Deleted` and `AlreadyAbsent` variants (replacing the old `NoContent`); `delete_run_internal` and its helpers now return `Result<_, ApiError>` instead of `Result<_, Response>`, enabling both the single-delete handler and the new batch handler to reuse the same logic. - **Batch handler**: `batch_delete_runs` in `lifecycle.rs` validates the request (reusing the generalized `validate_batch_run_ids`), loops over IDs, and assembles `BatchDeleteRunsResult` items mapping `ApiError::status()` to outcome strings (`conflict`, `error`). - **Web helper**: `deleteRuns` added to `run-actions.ts` alongside `archiveRuns`/`unarchiveRuns`, with the same `as unknown as` cast needed for the openapi-generator `Set<string>` quirk. - **Tests**: six new server integration tests cover ordered results, mixed outcomes without rollback, force deletion, sandbox preservation handoff, pre-mutation validation rejection, and auth gating. ### Key design decisions **`POST /runs/delete` not `DELETE /runs`** — JSON request bodies on `DELETE` are poorly supported by proxies and HTTP clients; the existing batch lifecycle endpoints already use JSON-body `POST` actions. **`already_absent` counts as success** — consistent with single-delete semantics where `204` means "deleted or already absent"; callers doing cleanup don't need to special-case missing IDs. **`force` is batch-wide** — callers needing mixed force behavior issue separate requests; this keeps the request schema simple. **`SandboxDeleteOutcome` internal enum** — introduced alongside `DeleteRunOutcome` to cleanly separate the sandbox-layer result (absent/cleaned/preserved) from the top-level outcome that callers see, avoiding a leaky intermediate type. ### Fabro Details <details> <summary>Ran 8 stages in 41m 52s for $13.37</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 3s | – | 0 | | preflight_lint | 2m 17s | – | 0 | | implement | 15m 12s | $8.10 | 0 | | simplify_opus | 8m 54s | $3.30 | 0 | | simplify_gpt | 3m 54s | $1.97 | 0 | | verify | 9m 0s | – | 0 | | **Total** | **41m 52s** | **$13.37** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh>	2026-05-24 09:00:16 -04:00
fabro-sh-0530[bot]	8ceb246b5a	feat: Add batch archive/unarchive API endpoints and update web bulk act… (#380) ... ## Summary The web UI previously issued one archive/unarchive HTTP request per selected run. This PR adds `POST /api/v1/runs/archive` and `POST /api/v1/runs/unarchive` endpoints that process up to 250 runs in a single fail-soft, non-transactional request, then wires the web bulk-action toolbar and board column menu to use them. ### Plan Summary - **OpenAPI contract** — four new schemas (`BatchRunLifecycleRequest`, `BatchRunLifecycleResponse`, `BatchRunLifecycleResult`, `BatchRunLifecycleSummary`) and two new paths; Rust and TypeScript clients regenerated. - **Server handlers** — `batch_archive_runs` / `batch_unarchive_runs` behind `RequiredUser`; full request validation (empty, >250, duplicates, unparseable IDs) before any mutation; per-item outcome mapping (`archived`, `already_archived`, `unarchived`, `not_archived`, `conflict`, `not_found`, `error`). - **Frontend helpers** — `archiveRuns` / `unarchiveRuns` wrappers in `run-actions.ts`; single-run helpers unchanged. - **UI integration** — `BulkActionToolbar` and `ColumnActionsMenu` replaced `Promise.allSettled` fan-out with one batch call; new `summarizeBatchLifecycleAction` helper drives toast copy for all-success, partial, and all-failure cases. ## Key Design Decisions **Fail-soft `200` for valid batches.** A batch where some items fail is still a successfully *processed* request; the per-item `ok` flag and `summary` counts communicate individual outcomes without requiring the caller to handle HTTP errors for partial failures. Request-level problems (bad IDs, empty list) still return `400`. **`RequiredUser` only.** Batch endpoints accept any-run mutations from a request body, so a run-scoped worker token must not be accepted. This is enforced at the handler level, separate from existing single-run lifecycle routes. **Request validation before any mutation.** Empty list, >250 IDs, duplicate IDs, and unparseable IDs all return `400` before touching any run — avoiding partial mutation surprises from invalid input. **Idempotent outcomes are successes.** `already_archived` (archive of an already-archived run) and `not_archived` (unarchive of a terminal non-archived run) both set `ok=true`. This matches the existing single-run semantics and avoids spurious failures in retry scenarios. **`ask_fabro_readiness` hoisted out of the per-item loop.** Readiness resolution involves LLM credential work; it's identical for every run in the batch, so it's resolved once before the loop and shared via `&AskFabroReadiness`. **`uniqueItems: true` / `Set<string>` workaround.** The OpenAPI generator maps `uniqueItems` arrays to `Set<T>` in TypeScript, but the HTTP wire format is still a JSON array. The frontend helper casts through `unknown` to send an array so Axios serializes correctly. ### Fabro Details <details> <summary>Ran 8 stages in 47m 48s for $23.53</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 4s | – | 0 | | preflight_lint | 2m 16s | – | 0 | | implement | 20m 17s | $15.09 | 0 | | simplify_opus | 10m 27s | $6.18 | 0 | | simplify_gpt | 3m 58s | $2.25 | 0 | | verify | 8m 14s | – | 0 | | **Total** | **47m 48s** | **$23.53** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh>	2026-05-23 23:32:35 -04:00
fabro-sh-0530[bot]	39fa73d5e2	Add context-window snapshot API for agent stages (#378) ... ## Summary Adds a best-effort `GET /api/v1/runs/{id}/stages/{stageId}/context-window` endpoint that exposes model-visible input-token usage, broken down by category (system prompt, tools, MCP tools, skills, memory, conversation, other). The endpoint degrades gracefully: it returns a stored projection snapshot when the stage is inactive, and `available: false` when no snapshot has ever been observed rather than surfacing count gaps as HTTP errors. ### Plan Summary - **Unit 1** – OpenAPI schemas (`StageContextWindow`, `StageContextWindowProjection`, breakdown/enum types) and generated Rust + TypeScript clients, with `fabro-api` build-time type replacements pointing at the hand-written `fabro-types` structs. - **Unit 2** – `ToolSource` enum on `RegisteredTool` (Native / Mcp / Skill) + `ToolDefinitionWithSource`; new `context_window.rs` builder in `fabro-agent` that assembles a content-free category breakdown at request-assembly time; `fabro-llm::token_count` narrow public helpers (`estimate_message_tokens`, `estimate_tool_definition_tokens`, `estimate_request_control_tokens`). - **Unit 3** – `AgentEvent::ContextWindowSnapshot` carries a `StageContextWindowProjection`; the session emits a local snapshot immediately, then a provider-scaled replacement (or response-usage-scaled replacement) asynchronously; fingerprinting prevents double-counting the same request. - **Unit 4** – Server endpoint (stubbed routing; full handler targets a follow-up) returning the latest projected snapshot. - **Unit 5** – `queryKeys.runs.stageContextWindow`, `useRunStageContextWindow` hook, and SSE invalidation for `agent.context_window.snapshot` and all stage-lifecycle events. ### Key design decisions **Agent-side counting, not server-side.** The exact `fabro_llm::Request` only exists inside the active agent session. Rather than moving raw prompt/message content into server-managed state, the session counts the request it already has and emits content-free projection events. The HTTP endpoint just reads the latest durable snapshot. **Hybrid category ownership.** `fabro-agent` owns the category taxonomy (it sees memory documents, skills, MCP registration, and session history); `fabro-llm` exposes narrow estimation helpers. Neither crate leaks the other's concerns. **Provider count is async and non-blocking.** A spawned task calls `Client::count_input_tokens(..., PreferProvider)` with a clone of the request. It is cancelled via `close_token` when the session closes. Failures produce a warning on the snapshot, not a stage error. **`available: false` instead of 4xx for known-but-unobserved stages.** The sidebar needs stable empty states; HTTP errors only mean the run or stage doesn't exist. ```mermaid flowchart TB A[Session::build_request] --> B[build_local_snapshot\nLocalEstimate] B --> C[emit ContextWindowSnapshot] C --> D{provider count\nspawned task} D -- success --> E[scaled_snapshot\nProviderApiScaledBreakdown] D -- failure --> F[warning appended to local snapshot] E --> G[emit ContextWindowSnapshot] G --> H[run_state reducer\nupdates StageProjection.context_window] F --> H H --> I[GET context-window endpoint\nreturns projection] ``` **`ToolSource` on every `RegisteredTool`.** All 20+ `make_*_tool` call sites are updated to set `ToolSource::Native`; MCP tools get `ToolSource::Mcp { server_name }` at registration time; `make_use_skill_tool` gets `ToolSource::Skill`. A parallel `definitions_with_source_for_policy` method preserves existing `definitions_for_policy` behaviour unchanged. ### Fabro Details <details> <summary>Ran 8 stages in 90m 57s for $70.01</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 1m 59s | – | 0 | | preflight_lint | 2m 11s | – | 0 | | implement | 45m 14s | $48.47 | 0 | | simplify_opus | 25m 50s | $18.29 | 0 | | simplify_gpt | 6m 12s | $3.25 | 0 | | verify | 8m 59s | – | 0 | | **Total** | **90m 57s** | **$70.01** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-23 19:58:18 -04:00
fabro-sh-0530[bot]	def37896cd	Expose PermissionLevel on StageProjection and add sortable run columns (#373) ... ## Summary Two independent additions landed together: surfacing `PermissionLevel` on `StageProjection` (the primary goal), and making four previously unsortable run-list columns (`repo`, `title`, `workflow`, `changes`) sortable. ## Permission Level on StageProjection `PermissionLevel` (`read-only | read-write | full`) was already resolved at session start inside `fabro-agent` but never reached the API. This wires it through the existing `agent.session.activated` event rather than introducing a new event. The data flow: ```mermaid graph TB A[SessionOptions.permission_level] -->|set at CLI build_tool_approval| B[Session.permission_level] B -->|read in api.rs| C[ActivationLeaseOptions.permission_level] C -->|emitted as| D[Event::AgentSessionActivated.permission_level] D -->|convert.rs| E[EventBody::AgentSessionActivated.permission_level] E -->|run_state.rs apply_event| F[StageProjection.permission_level] F -->|OpenAPI + TS client| G[API consumers] ``` Key decisions: - **No new event or type.** `PermissionLevel` is reused from `fabro_types::session` directly; `AgentSessionActivatedProps` gains one optional field with `skip_serializing_if`, so older persisted events deserialize cleanly to `None`. - **`Option<PermissionLevel>` on `StageProjection`** follows the same pattern as `provider_used` — agent stages populate it, non-agent stages leave it `None`. No migration required. - **`AgentSessionActivatedProps` is now a progenitor type replacement** so the API crate and the canonical type stay in sync (verified by the new `agent_session_activated_props_round_trip` test). ### Plan Summary - `fabro-agent` `config.rs` / `session.rs` — store and expose `permission_level` on `SessionOptions` - `fabro-types` `run_event/agent.rs` — add field to `AgentSessionActivatedProps` - `fabro-types` `run_projection.rs` — add field to `StageProjection` - `fabro-workflow` `api.rs` / `activation_lease.rs` / `convert.rs` / `events.rs` — thread the value to the emission site - `fabro-store` `run_state.rs` — fold into projection on `AgentSessionActivated`, plus new unit test - OpenAPI schema, `fabro-api` build.rs, TS client — all regenerated/updated ## Sortable Run Columns `repo`, `title`, `workflow`, and `changes` columns were rendered as plain `<th>` elements with no sort affordance. They now use `SortHeader` in the frontend, the server-side `RunsSortKey` enum gains the four variants, and the OpenAPI `ListRunsSortEnum` and TS client enum are extended to match. Sort helpers (`run_repo_key`, `run_title_key`, `run_workflow_key`, `run_changes_total`) normalize to lowercase strings / integer totals and compose with the existing stable ULID tiebreak. ### Fabro Details <details> <summary>Ran 9 stages in 53m 42s for $18.48</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 14s | – | 0 | | preflight_lint | 2m 29s | – | 0 | | implement | 20m 37s | $11.87 | 0 | | simplify_opus | 8m 0s | $3.61 | 0 | | simplify_gpt | 5m 11s | $2.50 | 0 | | verify | 4m 48s | – | 0 | | fixup | 9m 56s | $0.50 | 0 | | **Total** | **53m 42s** | **$18.48** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: fabro-bot <fabro-bot@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-23 19:41:01 -04:00
fabro-sh-0530[bot]	dbe3e3966d	Migrate sandbox config to named environments; add InterviewOption metad… (#372) ... ## Summary Two related changes land together: the sandbox configuration surface is replaced with a named-environment model, and `InterviewOption` gains `description` and `preview` fields needed for the mid-stage agent interview tools described in the plan. ## What changed ### Named environments (was `[run.sandbox]`) `[run.sandbox]` and its provider-specific sub-tables (`[run.sandbox.daytona]`, `[run.sandbox.docker]`) are replaced by a two-level model: - **`[environments.<slug>]`** — reusable catalog entries with a unified shape: `provider`, `image`, `resources`, `network`, `lifecycle`, `labels`, `volumes`, `env`. - **`[run.environment] id = "<slug>"`** — selects which environment a run uses. - **`[run.environment.<field>]`** — sparse run-level overrides applied on top of the selected environment. The OpenAPI schema drops `RunSandboxSettings`, `DaytonaSettings`, `DaytonaSnapshotSettings`, `DaytonaNetworkLayer`, and `DockerSettings` in favour of `EnvironmentSettings`, `RunEnvironmentSettings`, and the new sub-schemas (`EnvironmentImageSettings`, `EnvironmentResourcesSettings`, `EnvironmentNetworkSettings`, `EnvironmentLifecycleSettings`, `EnvironmentVolumeSettings`). The `--sandbox` CLI flag becomes `--environment`. All docs, example configs, `.fabro/project.toml`, and the automation-detail / run-settings UI panels are updated to the new shape. The run-settings page renames "Sandbox" → "Environment" and reads from the new field paths. ### `InterviewOption` metadata fields `description` and `preview` are added to the canonical `InterviewOption` type (OpenAPI, helpers.ts, interview-dock, human-qa renderer). Both are treated as untrusted model-authored text — stored and displayed as plain strings, never rendered as HTML. The `interview-dock` test asserts that raw HTML in `preview` is not rendered. Option `description` is shown as secondary text under the label in choice and multi-select buttons. ### `StageModelUsage` projection `provider_used` on `RunStageInfo` and stage projections is promoted from a freeform object to a typed `StageModelUsage` schema (with `mode`, `provider`, `model`, `reasoning_effort`, `speed`). The `extractStageModel` event-scraping helper is replaced by `formatStageModelUsageLabel` and `stageModelUsageTitle`, which work directly from the projection field. The `Stage` interface gains `providerUsed` and the `EventsToolbar` consumes it. ### Other schema additions `ReasoningEffort` enum, `small_default` on model info, `SubAgentProjection`/`SkillsProjection`/`McpServerProjection` inline in stage projections, and `TodoListProjection` moved from the run-state top-level `todos_by_list` map into per-stage `todos`. ### Plan summary - Replace `[run.sandbox]` config with `[environments.<slug>]` + `[run.environment]` selection across config, OpenAPI, UI, and docs. - Extend `InterviewOption` with `description` and `preview`; render `description` in choice/multi-select buttons. - Promote `provider_used` to a typed `StageModelUsage` schema; drop event-scraping in favour of the projection field. - Add `ReasoningEffort`, `small_default`, subagent/skills/MCP stage-projection schemas to OpenAPI. ### Fabro Details <details> <summary>Ran 9 stages in 93m 2s for $48.56</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 4s | – | 0 | | preflight_lint | 2m 16s | – | 0 | | implement | 39m 28s | $35.95 | 0 | | simplify_opus | 22m 6s | $8.66 | 0 | | simplify_gpt | 7m 18s | $1.66 | 0 | | verify | 6m 33s | – | 0 | | fixup | 12m 34s | $2.29 | 0 | | **Total** | **93m 2s** | **$48.56** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Fabro <fabro@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-23 15:47:33 -04:00
fabro-sh-0530[bot]	f73f2a53f3	Replace queued with pending/runnable and add approval flow (web + API s… (#371) ... ## Summary Replaces the single `queued` pre-execution state with explicit `pending` and `runnable` states, and wires approve/deny actions for parent-generated child runs that require human approval before they can execute. This diff covers the web UI and OpenAPI spec layers of that change. ## What changed **Run status model** - `queued` is removed from all TypeScript types, display maps, column routing, and tests. - `pending` (awaiting approval) and `runnable` (eligible for the scheduler) replace it as distinct board columns and `RunStatus` variants with their own labels and colors (`runnable` gets cyan; `pending` stays muted). **Approval actions** - New `approveRun` / `denyRun` API calls in `run-actions.ts` invoke the new `POST /runs/{id}/approve` and `POST /runs/{id}/deny` endpoints. - `canApprove` predicate requires both `status.kind === "pending"` and `lifecycle.approval?.state === "pending"` — a run whose status is pending but has no approval record does not expose the action. - `useApproveRun` / `useDenyRun` mutations in `mutations.ts` follow the same pattern as `useCancelRun`. - `ActionsMenu` in `run-detail.tsx` gains Approve (lifecycle group) and Deny (destructive group) menu items. **Board and event plumbing** - `columnForStatus` now routes `pending → pending column` and `runnable → runnable column`; `submitted` stays in the pending column. - `BOARD_STATUS_EVENTS` and `RUN_SUMMARY_EVENTS` replace `run.queued` with `run.start_requested`, `run.pending`, `run.approved`, `run.denied`, and `run.runnable`. - The `pending` column is hidden when empty (same behaviour the old `queued` column had). **Waterfall phases (`run-phases.ts`)** - `queued` phase is removed; `pending` and `runnable` phases are added in order. - The submitted phase closes at `run.start_requested` rather than `run.queued`. - Each phase derives its timestamps from its own event rather than a single `firstTs` lookup, making multi-phase pre-execution timelines accurate. **OpenAPI spec** - `POST /api/v1/runs/{id}/approve` and `POST /api/v1/runs/{id}/deny` endpoints added with 200/404/409 responses. - `startRun` description updated to describe the pending/runnable branching behaviour. - `cancelRun` description updated to reference `pending`/`runnable` instead of `queued`. ### Plan Summary - **Task 3** (OpenAPI schema additions for approve/deny endpoints) — complete in this diff. - **Task 6** (Web UI surfaces: board columns, run-detail actions, waterfall phases, event subscriptions) — complete in this diff. - **Task 7** (doc cleanup: references to `queued` replaced in plans, brainstorms, and QA docs) — complete in this diff. ### Fabro Details <details> <summary>Ran 9 stages in 127m 37s for $104.98</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 2s | – | 0 | | preflight_compile | 2m 15s | – | 0 | | preflight_lint | 2m 29s | – | 0 | | implement | 92m 10s | $91.53 | 0 | | simplify_opus | 18m 35s | $10.65 | 0 | | simplify_gpt | 7m 36s | $2.81 | 0 | | verify | 3m 42s | – | 0 | | fmt | 3s | – | 0 | | **Total** | **127m 37s** | **$104.98** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (12 nodes and 15 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --cargo-quiet --workspace --status-level fail 2>&1 && cargo dev docs refresh 2>&1 && cargo dev docs check 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all clippy lint warnings, test failures, and generated docs errors.", max_visits=3] fmt [label="Format", shape=parallelogram, script="cargo +nightly-2026-04-14 fmt --all 2>&1", max_retries=0] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> fmt [condition="outcome=succeeded"] verify -> fixup fixup -> verify fmt -> exit } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: fabro <fabro@anthropic.com> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-23 15:34:33 -04:00
Bryan Helmkamp	1cd5d89316	Runs list view: table layout, server-side sort/pagination, redesigned toolbar (#367) ... ## Summary Overhauls the `/runs` list view and consolidates the two runs endpoints that backed it. **API** - Removes `GET /api/v1/boards/runs`, `PaginatedBoardRunList`, and `BoardColumnDefinition`. The board view is now a pure frontend rendering. - `GET /api/v1/runs` gains `status` (repeatable `BoardColumn`), `sort` (`created_at | updated_at | status | elapsed`, default `created_at`), and `direction` (`asc | desc`, default `desc`). - `BoardColumn` enum gains `removing`; default behavior hides Removing-status runs, opt in with `?status=removing`. - `PaginationMeta` gains an optional `total: int64`; `list_runs` fills it in (free — it already filters all runs in memory before paging). **List view UI** - Renders as a real `<table>` with column headings instead of horizontal cards. - Sortable Status, Elapsed, Created, and Updated headers — click to toggle direction, click another to switch sort key (resets to desc). URL params drive `sort`/`direction`/`page`/`size`. - New pager footer with rows-per-page selector (10/25/50/100), `Page X of Y`, and first/prev/next/last icon buttons. - Toolbar redesigned into left (search + filter buttons for Time/Repo/Workflow + archived toggle) and right (column picker + view toggle) sections. Filter buttons use Headless UI `Menu` popovers; the column picker uses Headless UI `Listbox` with `multiple` for multi-select. Hidden columns persist via `?hide=...`. **Tests** - 589 server tests pass, including new coverage for status filter (single + repeated), Removing opt-in, sort × direction with `id desc` tiebreak, and status-bucket sorting. - Frontend tests updated for the matcher-based cache invalidation and the new `buildBoardColumns` signature; 435 pass (3 pre-existing `RunDetail full-height` failures unrelated to this change). ## Test plan - [ ] `cargo build --workspace` - [ ] `cargo nextest run -p fabro-server` - [ ] `cd lib/packages/fabro-api-client && bun run generate` — no diff (already regenerated and committed) - [ ] `cd apps/fabro-web && bun run typecheck && bun test` - [ ] Manual: visit `/runs` — board view still renders all columns in canonical order, Removing runs hidden, archived toggle works. - [ ] Manual: visit `/runs?view=list` — table renders with sortable headers; clicking a header updates URL; pager advances; changing rows-per-page resets to page 1; column picker hides/shows columns and round-trips via `?hide=`. - [ ] Manual: `curl '/api/v1/boards/runs'` → 404; `curl '/api/v1/runs?status=removing'` returns only removing runs; `curl '/api/v1/runs?sort=status&direction=asc'` returns runs grouped by status bucket. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-23 14:25:58 -04:00
fabro-sh-0530[bot]	7d8506cb7c	feat: add manual retry for failed and dead runs (#362) ... ## Summary Adds a **Retry** action that creates a fresh run from a failed or dead run's captured durable definition. The new run gets a new ID, records `retried_from: <source_run_id>`, and is immediately queued. The source run is left entirely unchanged. ### Plan Summary - `retried_from: Option<RunId>` added to `RunCreatedProps`, `RunProjection`, and `Run` (API surface); defaults to `null` for backward compat with legacy events. - `POST /api/v1/runs/{id}/retry` → `201` with the new run; eligible source states are `failed` (except `reason=cancelled`) and `dead`. - New `retry_run` workflow operation (modeled after `fork`) creates a new run store, appends `run.created` with `retried_from` set, then `run.submitted`. No checkpoints, sandbox state, PR links, questions, or conclusions are copied. - `start_run` handler refactored into a reusable `queue_run_start(state, id, resume)` helper so retry can queue the new run through the same path. - Web: `canRetry` predicate, `useRetryRun` mutation, **Retry** menu item in `ActionsMenu`, "Retried from" link in `RunSummaryPanelView`, and navigation to the new run on success (deduplicated via `lastProcessed.retry`). - OpenAPI spec updated; generated Rust and TypeScript client types regenerated. ## Key design decisions **No runtime state is copied.** Only the durable definition fields (`graph`, `settings`, `labels`, `git`, `manifest_blob`, `definition_blob`, `fork_source_ref`, `parent_id`, `title`) are forwarded to the new `RunCreated` event. Checkpoints, sandbox, billing, PR links, and pending controls are left in the source run. **`queue_run_start` extraction.** `start_run` was restructured to extract a `queue_run_start(state, id, resume) -> Result<(), ApiError>` helper, so the retry handler can reuse the exact same queueing path without duplicating logic. **`lastProcessed.retry` deduplication.** The UI effect that fires on `retryMutation.data` checks `state.lastProcessed.retry === result` before navigating, so React StrictMode double-invocation or re-renders won't push duplicate navigations. **Demo mode guard.** `canRetry` is gated by `!demoMode` at the call site so the button is hidden in demo mode and never navigates to a missing demo run. ### Fabro Details <details> <summary>Ran 9 stages in 65m 2s for $51.70</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 2s | – | 0 | | preflight_compile | 1m 53s | – | 0 | | preflight_lint | 2m 8s | – | 0 | | implement | 36m 51s | $36.06 | 0 | | simplify_opus | 16m 22s | $14.46 | 0 | | simplify_gpt | 3m 10s | $1.18 | 0 | | verify | 3m 39s | – | 0 | | fmt | 3s | – | 0 | | **Total** | **65m 2s** | **$51.70** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (12 nodes and 15 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --cargo-quiet --workspace --status-level fail 2>&1 && cargo dev docs refresh 2>&1 && cargo dev docs check 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all clippy lint warnings, test failures, and generated docs errors.", max_visits=3] fmt [label="Format", shape=parallelogram, script="cargo +nightly-2026-04-14 fmt --all 2>&1", max_retries=0] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> fmt [condition="outcome=succeeded"] verify -> fixup fixup -> verify fmt -> exit } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-23 14:07:24 -04:00
fabro-sh-0530[bot]	0f36304d2c	Add small_default model role and async generated run titles (#368) ... ## Summary Introduces a `small_default` catalog role for identifying each provider's small/cheap utility model, and uses that model to asynchronously generate human-readable run titles when the caller doesn't supply one explicitly. ### Plan Summary - **Catalog**: Add `small_default: Option<bool>` to `ModelCatalogSettings` and `small_default: bool` to the `Model` type. Mark built-in small defaults: `claude-haiku-4-5` (Anthropic), `gpt-5.4-mini` (OpenAI), `gemini-3.1-flash-lite-preview` (Gemini). Validate that each provider has at most one small default; zero is allowed with fallback to the provider's regular default. - **Helpers**: Add `small_default_for_provider` and `small_default_for_configured_ids` on `Catalog`, mirroring the existing `default_for_provider` / `default_for_configured_ids` / `probe_for_provider` pattern. - **Title generation**: New `run_title_generation` module in `fabro-server` builds a prompt from workflow identity, goal, and raw run inputs, calls `generate_object` with `max_tokens(64)` and a 10 s timeout, normalizes output (trim, reject blank/control, truncate to 100 chars), and falls back to the deterministic title on any failure. - **Server integration**: In the create-run handler, if no explicit `RunManifest.title` was supplied and at least one LLM provider is ready, spawn a detached task that generates a title and appends `run.title.updated` — but only if the title hasn't been changed by a concurrent user PATCH. ## What changed and why **`small_default` vs `default`** — the existing `default` role drives normal model selection for workflow execution and must not be disturbed. `small_default` is a separate, additive role for lightweight metadata work. The two roles are intentionally independent so teams can promote a newer large model to `default` without accidentally routing title generation there. **Best-effort, async title enrichment** — run creation is kept synchronous and reliable. The title task is fire-and-forget: LLM errors, timeouts, and validation failures all silently leave the deterministic title in place. The stale-title guard (`current.title != deterministic_title`) prevents the async task from clobbering a concurrent user edit via `PATCH /runs/{id}`. **No redaction** — per the design goal, raw input values are forwarded to the model. This is noted explicitly in the prompt and in the module docs. **Prompt size bounding** — each of the three prompt sections (workflow identity, run inputs, workflow summary) is independently capped at 4 000 characters with a `...[truncated]` marker so pathological inputs can't produce enormous requests. ## Public interface changes - `Model` gains `small_default: bool` in the Rust type, OpenAPI schema, and generated TypeScript client. - `MAX_RUN_TITLE_CHARS` is now `pub` in `fabro-types` so the title-generation module can reuse the same limit. - Config docs (`models.mdx`, `litellm.mdx`) document `small_default = true` alongside `default` and `probe`. ### Fabro Details <details> <summary>Ran 9 stages in 61m 23s for $32.17</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 2s | – | 0 | | preflight_compile | 1m 52s | – | 0 | | preflight_lint | 2m 5s | – | 0 | | implement | 29m 16s | $23.26 | 0 | | simplify_opus | 17m 15s | $6.28 | 0 | | simplify_gpt | 7m 1s | $2.63 | 0 | | verify | 3m 7s | – | 0 | | fmt | 3s | – | 0 | | **Total** | **61m 23s** | **$32.17** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (12 nodes and 15 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --cargo-quiet --workspace --status-level fail 2>&1 && cargo dev docs refresh 2>&1 && cargo dev docs check 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all clippy lint warnings, test failures, and generated docs errors.", max_visits=3] fmt [label="Format", shape=parallelogram, script="cargo +nightly-2026-04-14 fmt --all 2>&1", max_retries=0] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> fmt [condition="outcome=succeeded"] verify -> fixup fixup -> verify fmt -> exit } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-23 13:48:39 -04:00
fabro-sh-0530[bot]	7e6052bec3	Surface reasoning_effort + speed in stage badge end-to-end (#363) ... ## Summary The run page stage badge showed only the model name. This PR plumbs `reasoning_effort` and `speed` from the LLM call site all the way through the event stream, store projection, API, and UI so the badge now renders `gpt-5.5 · high`. ### Plan Summary - **Event props** — `AgentSessionActivatedProps` and `StagePromptProps` gain `reasoning_effort: Option<ReasoningEffort>` and `speed: Option<Speed>` with `serde(default, skip_serializing_if)` for back-compat. - **Typed projection** — `provider_used: Option<serde_json::Value>` is replaced by `Option<StageModelUsage>`, a proper struct in `fabro-types` with factory methods (`from_prompt_props`, `from_agent_session_activated`). The freeform JSON bag is gone. - **Emission sites** — `ActivationLeaseOptions` carries the new fields; `emit_stage_prompt()` (new shared helper) resolves `EffectiveRequestControls` via the backend and stamps them on `Event::Prompt`. `AgentHandler` and `PromptHandler` both call this helper instead of building the event inline. - **ACP path** — `AgentAcpStarted` no longer writes `provider_used`; the canonical source is the later `AgentSessionActivated` event, which is already emitted for ACP steering sessions. Runs without a hub legitimately leave `provider_used` unset. - **OpenAPI** — new `StageModelUsage` and `ReasoningEffort` schemas replace the `object | null` bag; `build.rs` maps both to the canonical Rust types; a new `stage_model_usage_round_trip` integration test enforces the parity requirement. - **UI** — `extractStageModel` (event-scanning heuristic) is deleted; replaced by `formatStageModelUsageLabel` and `stageModelUsageTitle` that read directly off `selectedStage.providerUsed`. `parseFanInOutcome` now sources the reducer model from `stage.prompt` instead of `prompt.completed`. ### Key design decisions **No type sprawl**: `fabro_model::ReasoningEffort` and `Speed` are reused verbatim via `with_replacement` in `build.rs` — no parallel enums. **ACP behavior change**: previously `AgentAcpStarted` wrote a bespoke `provider_used` blob and a later `AgentSessionActivated` would be ignored for ACP sessions. Now `AgentSessionActivated` is the single write path for all modes; ACP runs that never activate a steering hub correctly leave `provider_used = null`. The integration test (`acp.rs`) is updated to assert the new shape, and the unit test is renamed `agent_acp_started_alone_leaves_stage_provider_used_unset` to document intent. **`emit_stage_prompt` helper**: both `AgentHandler` and the existing prompt path share one function to avoid the two call sites drifting apart again. ### Fabro Details <details> <summary>Ran 9 stages in 98m 44s for $65.70</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 2s | – | 0 | | preflight_compile | 2m 15s | – | 0 | | preflight_lint | 2m 30s | – | 0 | | implement | 42m 19s | $26.85 | 0 | | simplify_opus | 38m 3s | $35.17 | 0 | | simplify_gpt | 9m 20s | $3.68 | 0 | | verify | 3m 38s | – | 0 | | fmt | 3s | – | 0 | | **Total** | **98m 44s** | **$65.70** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (12 nodes and 15 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --cargo-quiet --workspace --status-level fail 2>&1 && cargo dev docs refresh 2>&1 && cargo dev docs check 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all clippy lint warnings, test failures, and generated docs errors.", max_visits=3] fmt [label="Format", shape=parallelogram, script="cargo +nightly-2026-04-14 fmt --all 2>&1", max_retries=0] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> fmt [condition="outcome=succeeded"] verify -> fixup fixup -> verify fmt -> exit } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com> Co-authored-by: Bryan Helmkamp <bhelmkamp@users.noreply.github.com>	2026-05-23 13:14:55 -04:00
fabro-sh-0530[bot]	651eae6b34	Add Slack run lifecycle notifications via [run.notifications] (#365) ... ## Summary Extends the Slack integration to post `run.started`, `run.completed`, and `run.failed` notifications, configured per-run or per-workflow through `[run.notifications]` rather than server config. Interview behavior is unchanged and keeps its own state. ### What changed and why **`SlackService` is now started whenever Slack credentials are present**, regardless of whether `default_channel` is set. Previously, the service required `default_channel` to initialize, which blocked lifecycle notifications for users who have no interview default. `default_channel` is now `Option<String>` and is only consulted in the `InterviewStarted` path. **`handle_event` receives the full `EventEnvelope` and `AppState`** instead of just the `RunEvent`. Lifecycle handling needs to read the cached run projection (for `[run.notifications]` routes) and scan prior events (for PR details and the `run.started` event name), both of which require `AppState`. **Lifecycle path in `handle_event`** (`RunStarted` / `RunCompleted` / `RunFailed`): 1. Reads the run projection to find enabled Slack routes whose `events` list contains the current event name. 2. For terminal events, scans prior run events to recover `PullRequestCreated` details and the `run.started` event name. 3. Resolves each route's channel (supporting `{{ env.VAR }}` interpolation); warns and skips on missing/empty/unresolved channels without affecting other routes. 4. Posts once per matching route concurrently via `join_all`; post failures are logged, never propagated. **`fabro-slack/src/blocks.rs`** adds `run_lifecycle_blocks` and helpers separate from the interview builders: - `RunLifecycleKind` uses `strum::IntoStaticStr` for the title string. - All untrusted fields go through `escape_slack_controls` + `truncate_to_limit`. - `compact_duration` formats milliseconds into human-readable strings (`1.2s`, `1m 5s`, `2h 30m`, …). - PR line includes number, optional URL link, and optional HTML-escaped title. **`SlackClient::with_api_base_and_http`** is added as a test constructor so server tests can point the client at a `MockServer` without going through the normal builder path. ### Design decisions - Lifecycle notifications are fire-and-forget and never touch `posted_messages` or `thread_registry`, keeping interview and notification state fully separate. - `default_channel` is only used for interviews; lifecycle channel always comes from `[run.notifications.<name>.slack].channel`. This matches the goal of not promoting per-run config into server config. - PR title is sourced only from prior `PullRequestCreated` events — no GitHub API call is made at notification time. If only a `PullRequestLink` is available in the projection, number and URL are included but title is omitted. - Workflow label resolution follows a priority chain: workflow name → workflow slug → graph name → `run.started` event name → raw event name. ### Plan Summary - Make `SlackService` start without `default_channel`; gate interview path on `default_channel` presence. - Add `handle_lifecycle_event` that filters routes, loads prior events, builds blocks, resolves channels, and fans out posts. - Add `run_lifecycle_blocks` Block Kit builder with escaping, truncation, and `compact_duration`. - Add server integration tests covering: started/completed/failed posting, route filtering, missing/unresolved channel skipping, PR details from prior events, and interview/lifecycle state isolation. - Update public docs for Slack integration and run configuration. ### Fabro Details <details> <summary>Ran 9 stages in 53m 38s for $22.76</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 2s | – | 0 | | preflight_compile | 1m 58s | – | 0 | | preflight_lint | 2m 11s | – | 0 | | implement | 23m 3s | $14.18 | 0 | | simplify_opus | 16m 37s | $6.36 | 0 | | simplify_gpt | 5m 30s | $2.23 | 0 | | verify | 3m 31s | – | 0 | | fmt | 3s | – | 0 | | **Total** | **53m 38s** | **$22.76** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (12 nodes and 15 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --cargo-quiet --workspace --status-level fail 2>&1 && cargo dev docs refresh 2>&1 && cargo dev docs check 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all clippy lint warnings, test failures, and generated docs errors.", max_visits=3] fmt [label="Format", shape=parallelogram, script="cargo +nightly-2026-04-14 fmt --all 2>&1", max_retries=0] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> fmt [condition="outcome=succeeded"] verify -> fixup fixup -> verify fmt -> exit } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bhelmkamp@users.noreply.github.com>	2026-05-23 13:07:42 -04:00
fabro-sh-0530[bot]	7f84ac5e3f	Replace run-scoped sandbox config with named environments (#360) ... ## Summary Replaces the `[run.sandbox]` configuration surface with a named, provider-explicit environment catalog. Runs now select an environment by slug (`[run.environment] id = "..."`) rather than configuring a sandbox inline. Fabro resolves the catalog through normal settings precedence, applies sparse run-level overrides, and creates a concrete sandbox from the resolved environment. This is a clean break — no `[run.sandbox]` compatibility layer. ### Plan Summary - **New config shape:** Top-level `[environments.<slug>]` catalog valid in `settings.toml`, `.fabro/project.toml`, and `workflow.toml`. Runs reference a slug via `[run.environment] id = "..."` with optional sparse overrides under `[run.environment.*]`. - **Unified environment fields:** `provider`, `image` (ref + dockerfile), `resources` (cpu/memory/disk), `network` (mode + allow CIDRs), `lifecycle` (preserve/stop_on_terminal/auto_stop), `labels`, `volumes`, `env` — replacing the previous split between `[run.sandbox]`, `[run.sandbox.docker]`, `[run.sandbox.daytona]`, and `[run.sandbox.daytona.snapshot]`. - **OpenAPI schema update:** `RunSandboxSettings`, `DockerSettings`, `DaytonaSettings`, and `DaytonaNetworkLayer` replaced with `RunEnvironmentSettings`, `EnvironmentSettings`, `EnvironmentProvider`, `EnvironmentImageSettings`, `EnvironmentResourcesSettings`, `EnvironmentNetworkSettings`, `EnvironmentLifecycleSettings`, and `EnvironmentVolumeSettings`. - **CLI flag rename:** `--sandbox <provider>` → `--environment <slug>` on `run`, `create`, `preflight`, and `server start/restart`. - **Provider capability model:** Hard errors for security properties a provider cannot enforce (local with blocked/CIDR networking; docker with CIDR allow-lists). Warnings for unsupported resource limits, volumes, labels, auto-stop, and Docker Dockerfiles. - **Docs and internal code updated** throughout: `.fabro/project.toml`, workflow configs, all public docs, CLI args, manifest builders, and the runner's GitHub credentials check. ### Provider mapping | Environment field | Local | Docker | Daytona | |---|---|---|---| | `image.ref` | Ignored | Docker image | Snapshot name | | `image.dockerfile` | Ignored | Warning; ignored | Snapshot Dockerfile (requires `image.ref`) | | `resources.cpu/memory/disk` | Warning; ignored | cpu_quota / memory limit / warning | Snapshot sizing | | `network.mode = block` | **Error** | `network_mode = none` | Daytona block | | `network.mode = cidr_allow_list` | **Error** | **Error** | Daytona CIDR allow-list | | `labels` | Warning; ignored | Warning; ignored | Daytona labels | | `volumes` | Warning; ignored | Warning; ignored | Daytona volume mounts | | `lifecycle.auto_stop` | Warning; ignored | Warning; ignored | Daytona auto-stop interval | | `env` | Process env overlay | Container env | Sandbox env | ### Fabro Details <details> <summary>Ran 11 stages in 217m 39s for $129.86</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 4m 7s | – | 0 | | preflight_lint | 4m 9s | – | 0 | | fix_lints | 3m 46s | $1.06 | 0 | | implement | 76m 6s | $57.39 | 0 | | simplify_opus | 71m 50s | $38.17 | 0 | | simplify_gpt | 8m 27s | $2.24 | 0 | | verify | 6m 10s | – | 0 | | fixup | 42m 1s | $31.00 | 0 | | fmt | 3s | – | 0 | | **Total** | **217m 39s** | **$129.86** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (12 nodes and 15 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --cargo-quiet --workspace --status-level fail 2>&1 && cargo dev docs refresh 2>&1 && cargo dev docs check 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all clippy lint warnings, test failures, and generated docs errors.", max_visits=3] fmt [label="Format", shape=parallelogram, script="cargo +nightly-2026-04-14 fmt --all 2>&1", max_retries=0] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> fmt [condition="outcome=succeeded"] verify -> fixup fixup -> verify fmt -> exit } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com> Co-authored-by: Bryan Helmkamp <bhelmkamp@users.noreply.github.com>	2026-05-23 13:03:21 -04:00
Bryan Helmkamp	4190e13a20	Collapsible run stage sidebar (#352) ... ## What Makes the run-detail stage sidebar (shown on the Overview and Stages tabs) collapsible with a slide animation. - A toggle button slides the panel between full width (`w-56`) and an icon-only rail (`w-12`), animating `width` over 300ms with the same easing as the Ask Fabro panel. - When collapsed, **stage status icons stay visible** — green check / red X / spinning teal for running — so run progress is still scannable at a glance. Workflow links (Graph Source, Run Logs, etc.) collapse to icons too so they remain reachable. - Labels and durations become `sr-only` with `title` tooltips for hover. - The open/closed choice persists to `localStorage` (`fabro:stage-sidebar-collapsed`), carrying across the Overview and Stages tabs and reloads. ## Layout - The collapse toggle is inline with the `STAGES` heading row (or `WORKFLOW` when a run has no stages yet), so it doesn't push the stage list down. - The stage sidebar's top padding on the Stages tab was reduced (`pt-6` → `pt-3`) so the heading aligns with the adjacent content column and sits closer to the tab nav. ## Notes Self-contained in `StageSidebar` — `run-overview.tsx` and `run-stages.tsx` render it inside flex layouts that already track its width, so the slide works in both with no parent changes (aside from the padding tweak). Verified: `tsc` typecheck passes; `stage-sidebar` lib tests pass (10/10). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: fabro-sh-0530[bot] <281434857+fabro-sh-0530[bot]@users.noreply.github.com> Co-authored-by: Fabro <noreply@fabro.sh>	2026-05-22 12:20:29 -04:00
fabro-sh-0530[bot]	f5f921aa3c	feat: add [run.agent] fabro_tools opt-in for worker run tools (#348) ... ## Summary Workflow agents previously always received the `agent:run_tools` JWT scope and had Fabro run tools registered unconditionally. This PR makes Fabro run tool access an explicit per-run opt-in via `[run.agent] fabro_tools = true`, defaulting to `false`. ## What changed **Config layer** (`fabro-types`, `fabro-config`): `RunAgentSettings` gains a `fabro_tools: bool` field (serialized with `#[serde(default)]` for backward compatibility). The corresponding `RunAgentLayer` gets an optional `fabro_tools: Option<bool>` that resolves to `false` when absent. Layer merging follows the existing `Combine` macro semantics, so a workflow-level `false` overrides a user-level `true`. **Server** (`fabro-server`): `worker_command` gains an `agent_fabro_tools_enabled: bool` parameter. The server reads `run_state.spec.settings.run.agent.fabro_tools` from the stored run before spawning `__run-worker`, then issues the worker JWT with either `["run:worker"]` or `["run:worker", "agent:run_tools"]` accordingly. `WorkerScopeSet::run_worker()` loses its `#[cfg(test)]` gate so it's available in production paths. **CLI worker** (`fabro-cli`): `FabroRunToolServices` construction is now gated on `run_spec.settings.run.agent.fabro_tools` rather than being unconditional. The resolved run spec already carries the setting, so no env-var parsing is needed in the runner. **Tests**: The single monolithic `worker_command_always_sets_worker_token_env` test is replaced by two focused tests — one confirming the default scope is `["run:worker"]` only, and one confirming the opt-in scope includes `agent:run_tools`. Shared assertion logic is extracted into `assert_worker_command_passes_token_only_by_env` and `worker_token_claims` helpers. Config resolver tests cover default, explicit true/false, and layer-override behavior. **Docs**: `[run.agent]` description and reference tables are updated; a new `run-configuration.mdx` section explains the opt-in semantics before the existing `[run.agent.mcps]` section. ### Plan Summary - 1. Add `fabro_tools` to resolved and layered run config, with resolver tests. - 2. Gate worker JWT scope and pass setting from stored run state into `worker_command`. - 3. Gate CLI `FabroRunToolServices` construction on the resolved setting. - 4. Update docs generator sample and public reference/execution docs. - 5. Full verification pass (nextest, fmt, clippy). ### Fabro Details <details> <summary>Ran 9 stages in 54m 4s for $15.21</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 4s | – | 0 | | preflight_lint | 2m 18s | – | 0 | | implement | 28m 5s | $10.58 | 0 | | simplify_opus | 12m 4s | $2.86 | 0 | | simplify_gpt | 5m 19s | $1.77 | 0 | | verify | 3m 37s | – | 0 | | fmt | 3s | – | 0 | | **Total** | **54m 4s** | **$15.21** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (12 nodes and 15 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD."] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --cargo-quiet --workspace --status-level fail 2>&1 && cargo dev docs refresh 2>&1 && cargo dev docs check 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all clippy lint warnings, test failures, and generated docs errors.", max_visits=3] fmt [label="Format", shape=parallelogram, script="cargo +nightly-2026-04-14 fmt --all 2>&1", max_retries=0] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> fmt [condition="outcome=succeeded"] verify -> fixup fixup -> verify fmt -> exit } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: fabro-agent <agent@fabro.local>	2026-05-22 09:41:27 -04:00
fabro-sh-0530[bot]	f5ec711a2c	Stage-based pairing API and fabro_run_pair MCP tool (#344) ... ## Summary Run pairing previously required callers to supply an opaque `agent_session_id` alongside a `stage_id` to start or target a pair session. This leaked an internal runtime identifier across the public HTTP API, generated TypeScript client, and would have bled into any MCP tooling. This PR removes that coupling: the public pair API now identifies targets by `StageId` alone, the server resolves the live session internally, and a new `fabro_run_pair` MCP tool exposes the full pair lifecycle without ever seeing session identifiers. ### What changed **Public contract simplification** (`fabro-types`, OpenAPI, generated TS client) - `PairTarget` is now `{ stage_id, node_label }` — `node_id`, `visit`, `agent_session_id`, `provider`, and `model` are removed. - `PairStartRequest` accepts `{ stage_id }` instead of `{ target: PairTargetSelector }`. - `PairTargetSelector` and `PairTranscriptModel` types are deleted entirely. - `PairMessageRecord.target` (selector) replaced by `PairMessageRecord.stage_id`. - `PairTranscriptAssistantMessage.model` field removed. - `MAX_PAIR_MESSAGE_BYTES` extracted as a public constant shared between the server handler and the MCP tool. **Internal session binding** (`SteeringHub`, server projection) - `ActivePair` now carries `session_id: String` separately from the public `PairRecord`. This preserves the stale-session protection that previously relied on `target.agent_session_id`. - Transcript matching changed from `(session_id AND stage_id)` to `stage_id` within the already-scoped pair window sequence range — simpler and sufficient. - `active_api_targets` deactivation no longer does a per-target `agent_session_id` check; it relies on the `active_steerable_stages` lease already doing that guard. **New `fabro_run_pair` MCP tool** (`fabro-mcp-server`) - Actions: `status`, `start`, `get`, `message`, `end`, `transcript`. - Validation happens before any network call; missing `run_id`, missing `stage_id` for `start`, missing/invalid `pair_id` for other actions, and overlong message text all return clean tool-level errors. - `strum::IntoStaticStr` on `RunPairAction` enables the `parse_pair_id_for_action` helper to embed the action name in error messages without a `match`. - MCP result schema and serialized results are covered by leakage assertions confirming none of the removed fields surface. **Tests** - Negative leakage assertions added to pair DTO tests, event round-trip tests, control-protocol tests, server handler tests, MCP validation tests, and MCP schema test. - Tool count updated from 5 → 6 in all CLI MCP integration tests. - Steering hub test renamed: `pair_start_rejects_non_selected_or_missing_target` → `pair_start_rejects_missing_target` (session-mismatch rejection is now an internal concern). ### Fabro Details <details> <summary>Ran 9 stages in 60m 29s for $31.78</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 9s | – | 0 | | preflight_lint | 2m 26s | – | 0 | | implement | 33m 14s | $25.51 | 0 | | simplify_opus | 15m 7s | $4.18 | 0 | | simplify_gpt | 3m 46s | $2.08 | 0 | | verify | 3m 9s | – | 0 | | fmt | 3s | – | 0 | | **Total** | **60m 29s** | **$31.78** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (12 nodes and 15 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD."] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --cargo-quiet --workspace --status-level fail 2>&1 && cargo dev docs refresh 2>&1 && cargo dev docs check 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all clippy lint warnings, test failures, and generated docs errors.", max_visits=3] fmt [label="Format", shape=parallelogram, script="cargo +nightly-2026-04-14 fmt --all 2>&1", max_retries=0] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> fmt [condition="outcome=succeeded"] verify -> fixup fixup -> verify fmt -> exit } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-21 21:57:55 -04:00
fabro-sh-0530[bot]	54bc67017e	feat: Replace duration/elapsed fields with wall_time_ms and StageTiming (#343) ... ## Summary Replaces the ambiguous `runtime_secs`, `elapsed_secs`, and `duration_ms` timing fields on run/stage public API surfaces with explicit `wall_time_ms` (elapsed clock time) and a `StageTiming` value object that also carries `inference_time_ms`, `tool_time_ms`, and `active_time_ms`. This is a greenfield breaking change — no compatibility shims are preserved. ### What changed **API shape** - `RunBillingStage.runtime_secs` → `RunBillingStage.timing: StageTiming` - `RunBillingTotals.runtime_secs` → `RunBillingTotals.timing: StageTiming` - `RunSummary.timestamps.duration_ms` / `elapsed_secs` removed; a top-level `timing: StageTiming | null` field added - Stage list item `duration_secs` → `wall_time_ms` **Web app (`apps/fabro-web`)** - `run-billing.tsx`: `liveRuntimeSecs` → `liveWallTimeMs`; live ticking now returns milliseconds and the footer total sums `wallTimeMs` across rows - `stage-sidebar.ts`: `duration_secs` → `wall_time_ms` for the per-stage duration display - `runs.ts`: `elapsed_secs` lookup replaced with `timing.wall_time_ms` - `formatElapsedSecs` / `formatDurationSecs` call sites replaced with `formatDurationMs` **Lockfile / tooling** - `@openapitools/openapi-generator-cli@2.20.2` added as a dev dependency to `@qltysh/fabro-api-client` to support regenerating the TypeScript client after schema edits; several transitive deps pulled in alongside it. ### Design notes - **Units are now consistent**: every timing value on run/stage surfaces is in milliseconds; the old API mixed seconds (`runtime_secs`, `elapsed_secs`) with milliseconds (`duration_ms`). - **Live ticking** still works correctly: the in-flight billing row computes `now - startedAt` in ms and sums across rows for the footer, avoiding a server round-trip during a running stage. - **`StageTiming.active_time_ms = inference_time_ms + tool_time_ms`** — parallel work is summed, so run active time can exceed wall time. - Subsystem-internal `duration_ms` fields (sandbox setup, devcontainer lifecycle, hooks) are intentionally left unchanged; only public run/stage timing surfaces are affected. ### Fabro Details <details> <summary>Ran 9 stages in 115m 53s for $108.50</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 6s | – | 0 | | preflight_lint | 2m 18s | – | 0 | | implement | 80m 53s | $101.97 | 0 | | simplify_opus | 21m 35s | $4.09 | 0 | | simplify_gpt | 5m 1s | $2.44 | 0 | | verify | 3m 11s | – | 0 | | fmt | 3s | – | 0 | | **Total** | **115m 53s** | **$108.50** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (12 nodes and 15 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD."] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --cargo-quiet --workspace --status-level fail 2>&1 && cargo dev docs refresh 2>&1 && cargo dev docs check 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all clippy lint warnings, test failures, and generated docs errors.", max_visits=3] fmt [label="Format", shape=parallelogram, script="cargo +nightly-2026-04-14 fmt --all 2>&1", max_retries=0] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> fmt [condition="outcome=succeeded"] verify -> fixup fixup -> verify fmt -> exit } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-21 21:06:40 -04:00
Bryan Helmkamp	fb2174c7d0	feat(agent): expose Fabro run tools in sessions (#339) ... ## Summary API-backed Fabro agent sessions can now use the same five run-control tools that were previously MCP-only, while the server uses a single scoped `FABRO_WORKER_TOKEN` path for worker authorization. This lets server-dispatched API agents create, gather, inspect, and interact with runs without reintroducing a separate delegated run-agent token or leaking credentials into sandboxed child environments. ## Changes - Moved the reusable run-tool implementation into the new `fabro-tool` crate so MCP and API agent backends share the same tool schemas and client behavior. - Registered the five `fabro_run_*` tools for API-mode agents, with ACP sessions continuing to omit those tools. - Replaced `FABRO_RUN_AGENT_TOKEN` with scoped worker-token auth: base worker tokens keep same-run access, and `run:worker agent:run_tools` tokens can call the run-control API across runs. - Added server auth guards for run-tool actors and run-scoped-or-run-tools routes, then applied them only to the routes used by the run-tool client backend. - Kept `FABRO_WORKER_TOKEN` scrubbed from sandbox commands, hooks, ACP subprocesses, MCP env providers, and other child tool environments. ## Testing - `cargo nextest run -p fabro-server worker_token principal_middleware spawn_env --no-fail-fast` - `cargo nextest run -p fabro-cli runner --no-fail-fast` - `cargo nextest run -p fabro-workflow agent_run --no-fail-fast` - `cargo nextest run -p fabro-static --no-fail-fast` - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo +nightly-2026-04-14 clippy -p fabro-server -p fabro-cli -p fabro-static --all-targets -- -D warnings` - `git diff --check` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex)	2026-05-21 19:48:54 -04:00
Bryan Helmkamp	86b1fbef7f	feat(api): bind sessions to runs (#336) ... ## Summary Ask Fabro sessions are now run-bound instead of standalone. Sessions are created under their owning run, then accessed by flat session ID routes, with durable state projected from the run event stream rather than a separate session store. ## Changes - Move session creation/listing to `POST/GET /api/v1/runs/{id}/sessions` while keeping flat session reads, turns, interrupts, and event streams under `/api/v1/sessions/{id}/...`. - Add typed `run.session.*` events, ULID-backed session/turn IDs, read-only default permissions, and a rebuildable SlateDB `session_id -> run_id` index. - Remove the old file-backed session store and wire the server, runtime, Rust client, generated API crates, and TypeScript client around run event projections. - Replace the old top-level CLI session command with `fabro run ask` for chatting with a run. - Regenerate the TypeScript API client; this also catches up existing generated models for Pair/run event detail schemas already present in the OpenAPI spec. ## Validation - `cargo build -p fabro-api -p fabro-client -p fabro-server -p fabro-cli` - `cargo nextest run -p fabro-server --features test-support -E 'test(run_bound_session_is_created_as_run_event_and_resolves_by_flat_id) | test(sessions_are_listed_only_under_their_owning_run)'` - `cargo nextest run -p fabro-store projection_rebuilds_runtime_context_from_run_events` - `cargo +nightly-2026-04-14 clippy -p fabro-api -p fabro-client -p fabro-store -p fabro-server -p fabro-cli --all-targets -- -D warnings` - `cargo +nightly-2026-04-14 fmt --check --all` - `cd lib/packages/fabro-api-client && bun run typecheck && cd ../../../apps/fabro-web && bun run typecheck` - `git diff --check` --- [](https://github.com/EveryInc/compound-engineering-plugin) Generated with GPT-5 via [Codex](https://openai.com/codex)	2026-05-21 10:53:41 -04:00
Bryan Helmkamp	bf96baa9f0	feat(server): add run pairing API (#312) ... ## Summary Adds the server-side run pairing surface for joining one active API-mode agent session, sending pair messages, reading a compact transcript, and ending pairing explicitly before workflow release continues. This PR wires the feature end to end: - adds OpenAPI paths and shared `fabro-types` DTOs for pair lifecycle, messages, transcript entries, and run event details - adds typed `RunEvent` variants for pair lifecycle and pair-scoped user/system messages - extends the workflow steering hub and agent session drain path with typed pair control items, single-target validation, pair parking, and pair end/resume behavior - extends worker JSONL control and server transports for pair start/message/end while preserving existing steer/interrupt/answer/cancel behavior - adds Axum handlers for `/api/v1/runs/{id}/pair`, pair messages, pair transcript, and `/api/v1/runs/{id}/events/{seq}` - adds `fabro-client` helpers for the new endpoints ## Notes The subprocess path does not add a bidirectional worker ack channel in this PR. Instead, the HTTP pair handlers only return lifecycle/message success after the corresponding durable runtime event is observed, so mpsc enqueue success alone is not treated as API success. The plan checklist in `docs/superpowers/plans/2026-05-18-server-side-run-pairing-api-events.md` is included with that distinction left visible. ## Verification - `cargo build -p fabro-api` - `cargo check -p fabro-api -p fabro-client -p fabro-agent -p fabro-workflow -p fabro-interview -p fabro-server` - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings` - `cargo nextest run -p fabro-api pair run_event_round_trips_pair_lifecycle_events run_event_round_trips_agent_pair_messages` - `cargo nextest run -p fabro-workflow pair` - `cargo nextest run -p fabro-interview pair` - `cargo nextest run -p fabro-server pair subprocess_answer_transport_pair_commands_enqueue_control_messages steer interrupt`	2026-05-20 18:58:38 -04:00
Jess Martin	5bfd115339	[codex] Add ACP steering support (#329) ... ## Summary - Adds a backend-neutral live control abstraction so steering, interrupt, and interrupt+steer no longer depend on API-only session handles. - Reworks ACP sessions into a live protocol loop that uses ACP `session/prompt` for follow-up steers and ACP `session/cancel` for interrupts without restarting the process. - Registers ACP sessions as steerable, removes the stale non-steerable server/UI/API path, preserves ACP projection metadata, and keeps unsupported backends out of the steerability gate. ## Validation - `LC_ALL=C cargo nextest run --workspace --no-fail-fast` (5,833 passed, 178 skipped) - `cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings` - `cargo +nightly-2026-04-14 fmt --check --all` - `git diff --check` - `cd apps/fabro-web && LC_ALL=C ASDF_NODEJS_VERSION=20.13.1 ASDF_BUN_VERSION=1.3.11 bun test` (396 passed) - `cd apps/fabro-web && LC_ALL=C ASDF_NODEJS_VERSION=20.13.1 ASDF_BUN_VERSION=1.3.11 bun run typecheck` - `cargo build -p fabro-api` - `cd lib/packages/fabro-api-client && LC_ALL=C ASDF_BUN_VERSION=1.3.11 bun run typecheck` --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-20 17:21:56 -04:00
Bryan Helmkamp	32015b2226	fix(graph): support dotted Fabro graph attributes (#324) ... ## Summary Graph rendering now accepts documented Fabro dotted DOT attributes end to end while keeping raw Graphviz calls behind `fabro-graphviz`. The new `RenderableDot` boundary applies Fabro render styling and normalization before raw SVG rendering, and both the CLI subprocess and server path now route through that typed boundary instead of calling `graphviz_sys` directly outside the graphviz crate. The branch also adds a small curated DOT compatibility corpus covering ACP agent attributes, human default choices, and subworkflow manager attributes. Those fixtures are exercised by both render and validation tests, and the run overview now shows graph render errors directly instead of falling through to the empty graph state. ## Verification - `cargo nextest run -p fabro-graphviz` - `cargo nextest run -p fabro-validate` - `cargo nextest run -p fabro-cli render_graph` - `cargo nextest run -p fabro-server render_graph_from_manifest_accepts_fabro_dotted_attributes` - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo +nightly-2026-04-14 clippy -p fabro-graphviz -p fabro-cli -p fabro-server -p fabro-validate --all-targets -- -D warnings` - `rg -n "graphviz_sys" lib/crates/fabro-cli lib/crates/fabro-server` - `cd apps/fabro-web && bun test` - `cd apps/fabro-web && bun run typecheck` --- [](https://github.com/EveryInc/compound-engineering-plugin) Generated with GPT-5 via [Codex](https://openai.com/codex) --------- Co-authored-by: Jess Martin <27258+jessmartin@users.noreply.github.com>	2026-05-20 09:31:08 -04:00
Bryan Helmkamp	fbe8b50a16	feat(server): add GET /api/v1/providers and /settings/models page (#321) ... ## Summary Operators had no UI surface to see which LLM providers their Fabro server has configured — provider state was only inferable indirectly via the per-model `configured` flag on `GET /api/v1/models`. This adds a dedicated **Models** settings tab backed by a new providers endpoint. - **`fabro_model::Provider`** — a public projection of the internal `CatalogProvider` that *structurally* excludes credential-bearing fields (`auth`, `extra_headers`, `billing_policy`, `agent_profile`). Reused by the generated API client via progenitor `with_replacement`, mirroring the existing `Model` pattern — no parallel API DTO. - **`GET /api/v1/providers`** — lists catalog providers with effective config and a `configured` status stamped per request from `ready_llm_provider_ids()`. Sorted by the catalog's existing `provider_order`. No write endpoints. - **`/settings/models` web page** — new route + nav entry (`CpuChipIcon`, between Integrations and Security) rendering each provider with model count, default model, configured status, and a "Get API key" link for unconfigured providers. ## Key decisions - Provider sort: reuse catalog `provider_order` (priority desc, id asc) — zero extra code. - `adapter` is hidden in the UI row (noisy for first-party providers); the OpenAPI `adapter` field is pinned to an enum matching the closed `AdapterKind` type. - `configured` reflects credential resolution **at the time of the response**, not a frozen startup snapshot — doc/spec wording corrected to match. ## Testing - `fabro-model`: `From<&CatalogProvider>` + serde `skip_serializing_if` unit tests. - `fabro-api`: `Provider` type-identity + JSON-parity tests, including the required/optional field split. - `fabro-server`: handler tests for configured vs unconfigured providers, exact `model_count`/`default_model` against catalog truth, and credential-omission (asserts internal field names *and* the injected credential value never reach the wire). - OpenAPI route conformance test covers `GET /api/v1/providers`. - `cargo build --workspace`, `fmt --check`, `clippy -D warnings` clean; 935 Rust tests pass; web `tsc` typecheck passes. - Reviewed via a 10-persona `ce:review` (autofix) — no P0/P1 in shipped code; 8 safe fixes applied. Not done: manual UI screenshots — the `apps/fabro-web` build is blocked in this environment by an unrelated missing `@assistant-ui/react` dependency. Run `bun install` in `apps/fabro-web` to verify `/settings/models` manually. ## Post-Deploy Monitoring & Validation - **What to watch:** request logs for `GET /api/v1/providers` — expect `200`s for authenticated users, `401` for unauthenticated. The handler resolves LLM credentials per request via `ready_llm_provider_ids()` (the same path the existing `list_models` handler already uses). - **Healthy signals:** `/settings/models` renders the provider list; `configured` matches each provider's actual credential state; no credential strings appear in any response body or log line. - **Failure signals / rollback trigger:** any provider object in the response containing `auth`, `extra_headers`, or a raw key/token value → roll back immediately (the projection type makes this structurally impossible, but treat any occurrence as P0). 5xx spikes on the new route. - **Validation window / owner:** first 24h after deploy, owned by the deploying engineer. Pre-existing note (not introduced here): credential resolution can refresh OAuth tokens and write the vault as a side effect of this read — shared with `list_models`; flagged for a future caching pass. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-20 09:05:00 -04:00
Bryan Helmkamp	e7ce0f6a86	fix(server): restore legacy vault migration removed mid-PR ... PR #306 added a temporary startup migration for pre-token/oauth vault files (commit 3448a7d06) and then deleted it 28 minutes later in the same PR (commit 437a27769) before merging. Installs that still have `credential` or `environment` entries in secrets.json now refuse to boot with `unknown variant 'credential'`. Restore vault_legacy_migration.rs and wire it back into build_app_state so old vault files are rewritten to `token`/`oauth`/`file` shape with a timestamped backup on first boot. Keep the strict `Vault::load` path (no empty-vault fail-open) so a genuinely corrupt vault still aborts startup instead of silently zeroing out secrets. The migration self-deletes after the 2026-08-18 removal deadline noted in the module docs.	2026-05-18 16:00:18 -04:00
Bryan Helmkamp	29b7cc0de0	feat(workflow): enforce strict api/acp backends (#307) ... ## Summary This PR makes agent execution a strict two-backend contract: API-backed stages use Fabro-owned model/provider auth, while ACP-backed stages launch a user-supplied stdio process that owns its own auth and tools. That removes the legacy CLI backend and prevents ACP execution from accidentally resolving or forwarding provider credentials. ## Changes - Replaces the old `api`/`cli`/`acp` backend model with `AgentBackend { api, acp }`, with `backend=\"cli\"` rejected and migrated toward explicit ACP process configuration. - Splits ACP process configuration into `acp.command` for shell command strings and `acp.config` for JSON stdio configs, while rejecting legacy `acp_command`. - Restricts ACP to `agent` nodes and rejects API-only attributes such as `model`, `provider`, `reasoning_effort`, `max_tokens`, and `speed` on ACP nodes. - Deletes the workflow CLI runtime, CLI credential resolver surface, CLI live smoke tests, and `agent.cli.*` event handling. - Updates ACP events and projections to report process identity (`command`, optional `config_name`) rather than provider/model metadata. - Updates import/stylesheet propagation, CLI workflow smoke coverage, server steering tests, and web model extraction for the new event/backend contract. ## Validation - `cargo check -p fabro-auth -p fabro-acp -p fabro-workflow -p fabro-cli --all-targets` - `cargo nextest run -p fabro-auth -p fabro-acp -p fabro-validate -p fabro-store -p fabro-workflow --lib` - `cargo nextest run -p fabro-acp` - `cargo nextest run -p fabro-cli --test it workflow::acp::acp_backend_workflow` - `cargo nextest run -p fabro-workflow --test it codergen_without_backend_simulated` - `cargo nextest run -p fabro-workflow --test it import_e2e_through_engine` - `cargo nextest run -p fabro-workflow --test it stylesheet_application` - `cargo nextest run -p fabro-server steer_with_active_acp_stage_returns_non_steerable_conflict` - `cargo nextest run -p fabro-server active_acp_stage_marker_clears_on_terminal_paths` - `cargo nextest run -p fabro-types agent_backend_accepts_only_api_and_acp` - `cd apps/fabro-web && bun test app/routes/run-stages.test.ts` - `cd apps/fabro-web && bun run typecheck` - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex) --------- Co-authored-by: Peter Bell <4843+PeterBell@users.noreply.github.com>	2026-05-18 13:20:56 -04:00
Bryan Helmkamp	cd74013d06	refactor(auth): split credential sources and vault schemas (#306) ... ## Summary Compared with `origin/main`, this PR splits credential storage and credential references into explicit types. Vault secrets now distinguish `token`, `oauth`, and `file` payloads, while runtime/model configuration points to credentials through explicit `env:<NAME>` and `vault:<NAME>` source refs. ## Changes - Replaces the old `environment`/`credential` secret schema vocabulary with `token`/`oauth`/`file` across OpenAPI, Rust API tests, generated TypeScript models, CLI/docs references, and the changelog. - Updates auth resolution, refresh, provider strategies, workflow LLM handling, server diagnostics, install flows, run manifests, and secret handlers to consume typed vault entries and explicit credential sources. - Updates provider catalog TOMLs and config parsing so provider auth and extra headers use `vault` refs instead of ambiguous `credential` refs. - Updates CLI install/login/run/secret paths and integration tests to write and read the new credential shapes. - Removes the temporary legacy vault migration and empty-vault fallback, then centralizes provider vault secret-name lookup and Codex API credential shaping. ## Verification - `cargo +nightly-2026-04-14 fmt --all` - `cargo +nightly-2026-04-14 clippy -p fabro-auth -p fabro-model -p fabro-config -p fabro-vault -p fabro-server -p fabro-cli --all-targets -- -D warnings` - `ulimit -n 4096 && cargo nextest run -p fabro-auth -p fabro-model -p fabro-config -p fabro-vault -p fabro-server -p fabro-cli` (`1938` passed, `35` skipped)	2026-05-18 11:07:42 -04:00