Reapply the lint-safe changes that were partially displaced while merging
origin/main, including the billing serialization assertion and the attach
replay/server annotation cleanups. This keeps the merged main branch back to a
clean full-workspace clippy pass before the store-dump debugging continues.
Tighten the worker upload path so object-backed runs only fail when an
artifact upload is actually attempted without a token, and update CLI
snapshots for the new artifact storage metadata.
Fold in the workspace test and clippy fixes needed to verify the final
artifact upload implementation cleanly across Rust and web targets.
Store large context payloads in the global CAS and keep durable
checkpoint state as blob://sha256 refs instead of execution-local file
paths. Resolve and materialize blob refs at execution, output, and export
time so resumed and remote runs can read legacy and new artifacts
consistently.
Add scoped worker upload tokens and HTTP artifact upload clients.
Support manifest-first multipart stage artifact uploads with validation and checksums.
Gate artifact reads by run capability while preserving legacy scratch fallback.
Active runs deleted through rm --force were removed from server state
without signalling the worker process, which could leave detached
workers orphaned after test cleanup. Terminate the tracked worker
process group before deleting run state and cover it with an
integration regression.
Replace the overlapping usage and cost model with canonical billing
primitives centered on ModelRef, ModelHandle, TokenCounts, and
BilledModelUsage. This also renames the public API and web surface from
usage to billing, removes compatibility aliases, and normalizes provider
usage adapters onto the shared billing vocabulary.
Move detached workers onto an HTTP-backed runtime store so the server
remains the only SlateDB owner. This replaces the worker's seeded local
RunDatabase with a canonical server-backed handle for state, events, and
blobs, and updates workflow runtime plumbing to use that abstraction.
Replay persisted run events for attach requests, keep the SSE stream live
only while the run is active, and close on terminal run events instead of
returning 410 for completed runs.
The CLI now treats premature attach EOF as an error, and the affected
integration tests were stabilized around store-backed event ordering and
recovered rewind timelines.
Persist server, client, and subject provenance on run creation so
run state and inspect output can show which Fabro version created a
run, which first-party client submitted it, and how the request was
authenticated.
Replace the attach polling loop with the existing run attach SSE endpoint.
Seed from stored history once, fetch interview questions only when needed,
and keep completed-run replay behavior intact.
Default test daemons now opt into an in-memory object store and test
helpers carry explicit run ids instead of rediscovering runs from
shared state.
This also disables the disk-backed store dump integration tests until
store dump is routed through the server's live store handles.
Make fabro-store::RunProjection the single projection type used by the
server, CLI, and CLI test helpers. This removes the duplicated CLI-side
mirrors and adds serde coverage for the store-owned projection.
Pass a real cancel signal from __run-worker through the workflow engine
into sandbox command execution so cancelled runs reap gated shell loops
instead of leaking slow.gate waiters.
Eagerly start one shared test server per nextest session and point default
TestContext commands at that session socket instead of leaking per-test
daemons keyed by FABRO_STORAGE_DIR. Add isolated_server() for tests that
need an explicit separate daemon, and tighten the ps filtering test so it
still proves the contract without timing out under full-suite load.
Move subprocess workers fully behind the server-owned run store by
switching worker/server coordination to HTTP-backed run events and
control state. Reconcile stale in-flight runs on boot, terminate live
workers during shutdown, and update process titles to reflect server and
worker lifecycle phases.
Logs were growing unbounded — cli.log and server.log used
rolling::never() with no rotation. Switch to daily rotation via
tracing-appender builder API (prefix.YYYY-MM-DD.log) and clean up
files older than 7 days on startup.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Dead feature cleanup: `skill install` was hidden/experimental and never
graduated; the run verification endpoint was only implemented in demo mode.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Increase the artifact scenario timeout so the retry fixture still forces one timeout without spuriously creating a third retry under full-workspace nextest load. Also import the generated ServerSettings type directly so workspace clippy stays clean.
default_settings_path() and active_settings_path() always return a
value (Home::from_env() never fails), so unwrap_or_else fallbacks to
".fabro/settings.toml" were dead code. Change both functions to return
PathBuf instead of Option<PathBuf> and remove the unreachable branches
in server_client, serve, and user config.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Default `fabro settings` now resolves effective runtime settings against the
selected server, while `--local` preserves local-only inspection. This also
extracts shared settings resolution logic so CLI output, manifest preparation,
and the `/api/v1/settings` contract stay aligned.
Full workspace verification exposed one real mismatch after the socket and
storage split: workflow default scratch lookup still derived from ~/.fabro
instead of the new storage root. Keep the helper aligned with Settings defaults
and fold in the small clippy-driven cleanups in the related server path code.
Keep local server targeting based on explicit server targets instead of
implicitly deriving a socket from storage_dir. This makes ~/.fabro/fabro.sock
the default local socket again, keeps storage under ~/.fabro/storage, threads
FABRO_CONFIG through server autostart paths, and updates the CLI test harness
for the new split.
- centralize FABRO_HOME and storage path resolution in fabro-config
- rename store types, extract ArtifactStore, and simplify run key layout
- switch run scratch to scratch/, remove RuntimeState, and refresh docs/clients
Consolidate CLI and server machine defaults under settings.toml,
including loader renames, writer preservation fixes, same-machine
manifest handling, and docs/test updates for the new config model.
Allow run and create to resolve the same explicit or configured server
connection model used by preflight, validate, and graph. This removes the
last local-only submission assumption from the CLI surface while keeping
local storage-backed behavior intact when no remote target is selected.
Tighten pre-manifest cleanup by removing the old dotenv helper, reducing
legacy .env handling to warning-only path detection, and renaming internal
remote target fields from base_url to api_url.
This also updates install/server docs and CLI terminology so the codebase
reflects the current direct-run vs server-interface model more accurately.
Move secret storage, diagnostics, and repo/provider validation behind the
server API so credentials live under the server storage dir and take effect
immediately without process env mutation.
This also removes the old .env runtime path, rewires doctor/install/secret/
provider login/repo init around the server contract, and regenerates the
TypeScript client for the new endpoints.
Move --storage-dir and --server-url off GlobalArgs and onto the
leaf commands that actually honor them.
This aligns help, parser behavior, and env-var wiring with the
current command architecture while preserving the intended model
and exec targeting semantics.
Move the model command surface into fabro-cli and delete the dead
fabro-llm CLI module now that prompt/chat/model CLI entrypoints are gone.
This also removes the now-unused fabro-llm CLI-only dependencies.
Remove redundant config_change_after_submission test (1.67s avg) from
fabro-server — already covered by start_run_persists_full_settings_snapshot
and architectural guarantees. Defer reqwest::Client init past validation
in web_search tool so missing-key/missing-query tests skip macOS proxy
discovery (1.56s → 9ms). Move telemetry panic event tests to a CLI IT
via a new cfg(debug_assertions) __test_panic subcommand. Lower default
nextest SLOW threshold from 3s to 1.5s with 2x headroom over the new
worst-case (0.84s).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
