3771 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
Bryan Helmkamp	91d11eb04d	fix(llm): preserve raw compatible tool arguments (#448) ... ## Summary Fixes #435. Preserve raw non-JSON tool-call arguments for custom/freeform tools when using the OpenAI-compatible Chat Completions adapter. This keeps `apply_patch` receiving the raw patch text instead of `{}` when LiteLLM/openai-compatible providers emit Codex-style freeform patch calls. Also extends the OpenAI twin so black-box tests can exercise the Chat Completions path with raw tool-call arguments. ## Test Plan - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo nextest run -p fabro-agent --test it openai_compatible_twin_preserves_raw_apply_patch_arguments --run-ignored only` - `cargo nextest run -p fabro-llm` - `cargo nextest run -p fabro-test`	2026-05-28 11:52:36 -04:00
Bryan Helmkamp	2e39dfc70e	fix(agent): align compaction preserve boundary (#449) ... ## Summary Follow-up to fabro-sh/fabro#447. This keeps context compaction's effective preserve boundary consistent between summary generation, history mutation, and emitted telemetry so tool-call/result pairs that remain in raw history are not also summarized. The branch also tightens the OpenAI twin support added for this regression: scripted usage is modeled as a single `TokenUsage`, SSE completion payloads reuse the canonical Responses JSON shape, and request validation now treats custom tool-call outputs as tool outputs instead of spreading raw item-type string checks. ## Verification - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo nextest run -p fabro-agent compaction` - `cargo nextest run -p twin-openai` - `FABRO_TEST_MODE=twin cargo nextest run -p fabro-agent --profile e2e --run-ignored only --test it openai_twin_compaction_preserves_tool_call_pairs` - `git diff --check origin/main...HEAD` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex)	2026-05-28 11:26:52 -04:00
Bryan Helmkamp	81554581ca	fix(agent): preserve tool-call pairs during compaction (#447) ... ## Summary Fixes OpenAI Responses requests after context compaction by ensuring preserved tool results are not separated from the assistant tool calls that produced them. The previous fixed-size preserved tail could retain a `function_call_output` while dropping the matching `function_call`, which OpenAI rejects as an orphaned tool result. ## Changes - Extends `History::compact` so the preserved range moves backward until every kept tool result has its matching assistant tool call. - Adds a unit invariant test for compacted histories that serialize tool results. - Adds an OpenAI twin integration regression that forces compaction during a tool-use loop. - Teaches the OpenAI twin to validate orphaned `function_call_output` items and script response usage counts for deterministic compaction tests. ## Test Plan - `cargo +nightly-2026-04-14 fmt --check --all` - `git diff --check` - `FABRO_TEST_MODE=twin cargo nextest run -p fabro-agent --test it openai_twin_compaction_preserves_tool_call_pairs --run-ignored all` - `cargo nextest run -p fabro-agent` - `cargo nextest run -p twin-openai` - `cargo nextest run -p fabro-test` - `cargo +nightly-2026-04-14 clippy -p fabro-agent -p fabro-test -p twin-openai --all-targets --no-deps -- -D warnings` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex)	2026-05-28 10:37:30 -04:00
fabro-releases[bot]	6b26915a09	Bump version to 0.247.0-nightly.0	2026-05-28 10:41:43 +00:00
Bryan Helmkamp	3634048a3c	fix(web): keep runs empty state from being pushed to page bottom ... Drop flex-1 from the columns row when the landing empty state is showing so the row sizes to the column headers and the empty state sits directly beneath them. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-28 01:27:41 -04:00
Bryan Helmkamp	31a990c4dc	Add split web Docker Compose PoC (#445) ... ## Summary Adds a standalone Docker Compose proof that runs the Fabro Rust API, a Caddy static SPA server, and a Caddy edge proxy as separate services. This demonstrates split web asset serving while keeping `/api/*`, `/auth/*`, and `/health` same-origin with the API server. ## Changes - Adds `docker-compose.split-web.yaml` with private `fabro-api` and `fabro-web` services behind an exposed `edge` proxy on port 8080. - Adds Caddy edge routing that sends `/api/*`, `/auth/*`, and `/health` to Rust, while everything else goes to the static web service. - Adds a static Caddy config for `apps/fabro-web/dist` with SPA fallback, source-map blocking, security headers, immutable asset caching, and `X-Fabro-PoC-Upstream` route-proof headers. - Adds PoC server settings and a README with build, run, and validation commands. ## Verification - `cargo dev docker-build --tag fabro-sh/fabro:split-web-poc` - `docker compose -f docker-compose.split-web.yaml up -d` - `docker compose -f docker-compose.split-web.yaml ps` - `curl` checks for `/runs`, `/assets/app.css`, `/assets/app.css.map`, `/api/v1/health`, `/api/v1/auth/config`, `/auth/login/dev-token`, `/api/v1/auth/me`, and `/api/v1/attach` - Browser login flow via `browser-use`: loaded `/login`, submitted the dev token, and landed on the authenticated Runs screen - `docker compose -f docker-compose.split-web.yaml config` - `caddy validate` for both Caddyfiles - `git diff --check` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex)	2026-05-28 00:03:00 -04:00
fabro-sh-0530[bot]	9ee576690b	refactor: remove in-process IP allowlist and introduce WorkerRuntime (#444) ... ## Summary This PR does two things: it removes the in-process inbound source-IP allowlist entirely, and it lays the foundation for pluggable worker compute backends by introducing a `WorkerRuntime` abstraction. ## IP allowlist removal The `[server.ip_allowlist]` setting and its GitHub webhook overlay (`[server.integrations.github.webhooks.ip_allowlist]`) have been removed from config parsing, the settings API, and the OpenAPI spec. The `ip_allowlist.rs` module (~600 lines including the `GitHubMetaResolver`, middleware, and cache logic) is deleted. **Migration:** Existing `settings.toml` files containing those keys will now fail to parse as unknown fields. Source-IP restrictions should be moved to a reverse proxy, firewall, VPN, Tailscale ACL, or cloud ingress — as documented in the new security guidance. `build_router_with_options` loses the `ip_allowlist_config: Arc<IpAllowlistConfig>` parameter and `RouterOptions` loses `github_webhook_ip_allowlist`. Call sites in tests and the auth harness are updated accordingly. TCP serving no longer uses `make_service_with_connect_info` since `ConnectInfo` was only needed for IP extraction. ## WorkerRuntime abstraction A new `worker_runtime.rs` module introduces: - **`WorkerRuntime` trait** — `start`, `request_stop`, `force_stop`, `is_alive` - **`WorkerLaunchSpec`** — all inputs needed to describe a worker process, replacing the former `worker_command` helper - **`WorkerRef::Local { pid, process_group_id }`** — replaces the `worker_pid` / `worker_pgid` pair on `ManagedRun` - **`StartedWorker`** — carries the ref, optional stderr stream, and a `wait` future - **`LocalWorkerRuntime`** — the only implementation for now; wraps the existing subprocess spawn logic `AppState` stores an `Arc<dyn WorkerRuntime>` and `AppStateConfig` accepts an optional override in `#[cfg(test)]` for injection. Stop/kill paths in `server.rs` and `lifecycle.rs` now call `worker_runtime.request_stop` / `force_stop` / `is_alive` instead of issuing signals directly. ### Plan Summary - **Task 1:** New `worker_runtime.rs` with trait, types, and `LocalWorkerRuntime` impl - **Task 2:** Wire `Arc<dyn WorkerRuntime>` into `AppState` / `AppStateConfig` / `TestAppStateBuilder` - **Task 3:** Replace `worker_pid` / `worker_pgid` on `ManagedRun` with `worker_ref: Option<WorkerRef>`; build `WorkerLaunchSpec` in `execute_run_subprocess` - **Task 4:** Route all stop/kill calls through the runtime (`terminate_worker_for_deletion`, `shutdown_active_workers`, `cancel_run` fallback) - **Task 5:** Fake `RecordingWorkerRuntime` for unit tests; new cancel-fallback and shutdown tests ### Fabro Details <details> <summary>Ran 8 stages in 107m 33s for $21.66</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 10s | – | 0 | | preflight_lint | 2m 21s | – | 0 | | implement | 29m 0s | $11.86 | 0 | | simplify_opus | 11m 9s | $5.94 | 0 | | simplify_gpt | 53m 13s | $3.85 | 0 | | verify | 9m 23s | – | 0 | | **Total** | **107m 33s** | **$21.66** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh>	2026-05-27 23:17:23 -04:00
fabro-sh-0530[bot]	e3bbe91053	Add GET/POST /automations/{id}/runs endpoints (#442) ... ## Summary Implements the two automation run endpoints from issue #399, backed by a significant refactor of the worker control channel from stdin JSONL to a WebSocket-based pub/sub bus. ## What changed ### New API endpoints (`automations.rs`) - `GET /automations/{id}/runs` — lists cached runs filtered to those linked to the given automation ID, sorted newest-first, with `page[limit]`/`page[offset]` pagination and the standard `{ data, meta }` envelope. - `POST /automations/{id}/runs` — requires `RequiredRunToolActor` auth, checks that the automation exists and has an enabled API trigger (returning 409 with `automation_api_trigger_disabled` otherwise), materializes the run manifest, and delegates to the shared `create_run_from_manifest` helper with a fully-populated `AutomationRef`. ### `enabled_api_trigger()` helper (`fabro-automation`) A new method on `Automation` encapsulates the "automation is enabled **and** has an enabled API trigger" check, keeping the handler clean. ### Worker control channel: stdin JSONL → WebSocket bus The most significant structural change is how the server delivers control messages (answers, cancel, pause/unpause, steer, pair events) to running workers: | Before | After | |---|---| | Server pipes JSONL lines to worker stdin | Server publishes to `WorkerControlBus`; worker connects via WebSocket | | Worker reads stdin on a blocking OS thread | Worker manages a reconnecting WebSocket with ping/pong liveness | | No delivery deduplication | `AppliedWorkerControlDeliveryIds` deduplicates replayed frames | | No reconnect / resume | Worker reconnects with exponential backoff; replays from last applied cursor | The `LocalWorkerControlBus` replaces the old `mpsc` channel and stdin pipe. `RunAnswerTransport::Subprocess` is renamed `Worker` and holds a `run_id` + `Arc<dyn WorkerControlBus>` instead of a channel sender. Worker stdin is now `Stdio::null()`. New control messages `RunPause` / `RunUnpause` are added to the protocol, wired through to `RunControlState`. ### Plan Summary - Add `enabled_api_trigger()` to `Automation`. - Implement `list_automation_runs` and `create_automation_run` handlers; route them under `/automations/{id}/runs`. - Expose `create_run_from_manifest` from the runs handler for reuse. - Add `RequiredRunToolActor` extractor. - Replace stdin JSONL worker control with `WorkerControlBus` + WebSocket reconnect loop in the CLI worker. - Add integration tests for all 409/201 cases, run persistence, listing filters, pagination, and sorting. ### Fabro Details <details> <summary>Ran 8 stages in 51m 5s for $21.34</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 8s | – | 0 | | preflight_lint | 2m 23s | – | 0 | | implement | 20m 52s | $13.05 | 0 | | simplify_opus | 11m 5s | $5.70 | 0 | | simplify_gpt | 5m 0s | $2.60 | 0 | | verify | 9m 4s | – | 0 | | **Total** | **51m 5s** | **$21.34** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh>	2026-05-27 22:29:29 -04:00
fabro-sh-0530[bot]	29a9a3f7d6	refactor: Remove inbound IP allowlisting (#443) ... ## Summary Removes Fabro's in-process inbound source-IP allowlist entirely. `[server.ip_allowlist]` and `[server.integrations.github.webhooks.ip_allowlist]` are gone from config parsing, resolved settings types, the OpenAPI spec, generated API clients, and the Settings > Security UI. Existing `settings.toml` files containing those keys now fail as unknown fields — this is a hard removal with no migration path. Network source restrictions should be enforced upstream via a reverse proxy, firewall, VPN, Tailscale ACLs, Kubernetes ingress, or platform policy. ### What changed - **Config/types** (`fabro-config`, `fabro-types`): Removed `ServerIpAllowlistLayer`, `ServerIpAllowlistOverrideLayer`, `ServerIpAllowlistSettings`, `ServerIpAllowlistOverrideSettings`, `IpAllowEntry`, associated resolver functions, GitHub `/meta` hook-range parsing, and Unix socket trusted-proxy validation. `ipnet` dropped from `fabro-types`; kept in `fabro-config` for sandbox CIDR validation. - **Server runtime** (`fabro-server`): Deleted `ip_allowlist.rs`, removed `IpAllowlistConfig` parameter from `build_router_with_options` and `RouterOptions`, removed the global allowlist middleware layer, and removed `GitHubMetaResolver` startup logic. GitHub webhook HMAC verification is unchanged. - **OpenAPI + generated clients**: Removed `ServerIpAllowlistSettings`, `ServerIpAllowlistOverrideSettings`, `IpAllowEntry`, `LiteralIpAllowEntry`, `GitHubMetaHooksEntry` schemas; removed `ip_allowlist` from `ServerNamespace` and `IntegrationWebhooksSettings`; dropped `IpAllowEntry` re-exports from `fabro-api`. - **Web UI**: Removed IP allowlist row from Settings > Security; updated nav description and page copy. - **Docs/changelog**: Security docs explicitly state Fabro provides no source-IP filtering and direct operators upstream. Changelog entry dated 2026-05-27 documents the breaking removal and annotates the 2026-04-19 entry where the feature was introduced. ### Also in this diff (unrelated to IP allowlisting) The worker control stream was migrated from reading newline-delimited JSON on stdin to a reconnecting WebSocket (`/api/v1/runs/{id}/worker/control-stream`). This adds `tokio-tungstenite` to `fabro-cli`/`fabro-server`, introduces `WorkerControlManagerHandle` with backoff reconnection and deduplication of replayed delivery IDs, and adds `RunPause`/`RunUnpause` message handling. A new integration test (`detached_run_cancel_reaches_worker_over_control_websocket`) exercises the full cancel path over the WebSocket. ### Key decisions - **Hard removal via `deny_unknown_fields`**: stale config is immediately visible as a startup error rather than silently ignored. - **No stub or default pass-through**: `IpAllowlistConfig::default()` is gone, not left as a no-op wrapper, to avoid keeping the feature shape alive. - **Webhook HMAC boundary unchanged**: source-IP filtering on webhook routes is removed; cryptographic signature verification remains the security boundary. ### Fabro Details <details> <summary>Ran 9 stages in 59m 53s for $27.24</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 15s | – | 0 | | preflight_lint | 2m 22s | – | 0 | | implement | 33m 54s | $22.81 | 0 | | simplify_opus | 5m 55s | $0.75 | 0 | | simplify_gpt | 3m 35s | $2.81 | 0 | | verify | 8m 34s | – | 0 | | fixup | 2m 24s | $0.87 | 0 | | **Total** | **59m 53s** | **$27.24** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh>	2026-05-27 22:29:08 -04:00
fabro-sh-0530[bot]	475b4ab650	Replace stdin JSONL control pipe with WebSocket worker control bus (#440) ... ## Summary Workers no longer receive control messages over stdin JSONL. A new `WorkerControlBus` abstraction (backed by `LocalWorkerControlBus` for local/single-node deployments) publishes `WorkerControlEnvelope` messages server-side; a worker-initiated WebSocket at `GET /runs/{id}/worker/control-stream` delivers them with ordered, replayable delivery frames. The bus API is designed so a Redis Streams backend can slot in later without touching API handlers or worker message handling. ### Plan Summary - **Task 1 – Bus contract:** `WorkerControlBus` trait, `WorkerControlDelivery`, `WorkerControlCursor` (`Start` / `After(id)`), bus errors. - **Task 2 – Local backend:** `LocalWorkerControlBus` — in-memory per-run stream, replay from `Start`, reconnect via `After(id)`, 1 024-message trim bound, cleanup on terminal runs. - **Task 3 – Server state:** `Arc<dyn WorkerControlBus>` added to `AppState`; `LocalWorkerControlBus` constructed at startup. - **Task 4 – Protocol extension:** `WorkerControlMessage::RunPause` / `RunUnpause`, `WorkerControlDeliveryFrame`, WebSocket liveness constants (`WORKER_CONTROL_WS_PING_INTERVAL = 15s`, `WORKER_CONTROL_WS_LIVENESS_TIMEOUT = 45s`), close-reason strings. - **Task 5 – Worker message handler:** `apply_worker_control_message` split out; pause/unpause routing; delivery-id dedupe (`AppliedWorkerControlDeliveryIds`, capacity 2 048). - **Task 6 – Worker WebSocket client:** `spawn_worker_control_manager` — HTTP→ws/wss and Unix-socket connection, backoff 100ms→5s, first-connection gate before `operations::start/resume`, ping/pong watchdog, fatal loss wired back to `execute`. - **Task 7 – Server route:** `GET /runs/{id}/worker/control-stream`, worker-only auth via new `RequireWorkerRunScoped` extractor, `Start`/`After` cursor dispatch, 410 on invalid cursor, server-side ping/pong. - **Task 8 – Stdin removal:** `RunAnswerTransport::Subprocess` renamed to `Worker { run_id, bus }`; `pump_worker_control_jsonl` deleted; worker launched with `stdin(Stdio::null())`; pause/unpause transport methods added. - **Tasks 9–10 – E2E & verification:** reconnect, invalid-cursor, cancel-over-WebSocket, and human-interview regression tests; no Redis dependency added. ### Key design decisions **`RunAnswerTransport::Subprocess` → `Worker { run_id, bus }`** — all existing transport methods (`submit`, `cancel_run`, `steer`, `interrupt`, `pair_*`) now call `bus.publish(run_id, envelope)` instead of writing to a channel that fed stdin. The match arms are symmetric, so the diff is mechanical but large. **First-connection gate** — `execute()` calls `control_manager.wait_for_first_connection().await?` before `operations::start` or `operations::resume`. Temporary failures spin with backoff; a fatal invalid-cursor or request-build failure propagates as an error before the workflow starts. **Fatal vs. reconnectable** — HTTP 410 or a WebSocket close with reason `"invalid_cursor"` is fatal (infrastructure failure, not user cancellation). Any other close/error triggers the reconnect loop while the run is non-terminal. **`AutomationStore::load` made synchronous** — startup load now uses `std::fs` under a `clippy::disallowed_methods` exception; async `tokio::fs` is no longer needed for the one-shot directory scan. Invalid automation files now fail loudly instead of being silently skipped. **`canRetry` extended to succeeded runs** — `status.kind === "succeeded"` is now retryable (non-archived). Tests and API docs updated to match. **Default model bumps** — OpenAI default: `gpt-5.4` → `gpt-5.5`; Gemini default: `gemini-3.1-pro-preview` → `gemini-3.5-flash`. ### Fabro Details <details> <summary>Ran 9 stages in 129m 19s for $58.27</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 10s | – | 0 | | preflight_lint | 2m 23s | – | 0 | | implement | 73m 48s | $41.53 | 0 | | simplify_opus | 22m 55s | $11.75 | 0 | | simplify_gpt | 7m 19s | $2.74 | 0 | | verify | 8m 51s | – | 0 | | fixup | 10m 59s | $2.24 | 0 | | **Total** | **129m 19s** | **$58.27** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-27 20:24:25 -04:00
fabro-sh-0530[bot]	ee1502f793	Add automation run materialization core and shared run creation helper (#441) ... ## Summary Automation-triggered runs need to share the same run creation pipeline as `POST /runs`. This PR lays the core infrastructure: a `create_run_from_manifest` helper that the HTTP handler and the upcoming automation scheduler can both call, plus a `AutomationRunMaterializer` trait with a production implementation that clones a GitHub repo and builds a `RunManifest` from it. ### Plan Summary - Extract the body of `handler/runs.rs::create_run` into a crate-private `create_run_from_manifest(state, CreateRunFromManifestRequest)` helper; `POST /runs` calls it with `automation: None`, preserving existing behavior. - Add `AutomationRunMaterializeInput/Materialized/Error` types and the `AutomationRunMaterializer` trait (`automation_materializer.rs`). - Implement `ProductionAutomationRunMaterializer`: validates `owner/repo` slug, shallow-clones via `tokio::process::Command` argv (never shell strings), sets `GIT_TERMINAL_PROMPT=0`, enforces per-operation timeouts, redacts credentials from error text, resolves the workflow with `fabro_config::project::WorkflowLocation::resolve`, and builds a `RunManifest` via `fabro_manifest::build_run_manifest`. - Add `TestAutomationRunMaterializer` (gated on `test` or `test-support`) for fake injection in route tests without network access. - Wire the materializer override into `AppState` and `AppStateConfig` behind `#[cfg(any(test, feature = "test-support"))]`; expose via `TestAppStateBuilder::automation_materializer`. - Move `async-trait` from `[dev-dependencies]` to `[dependencies]` in `fabro-server` since the trait is now in production code. ## What changed and why **`automation_materializer.rs` (new)** — Core of this PR. The `GitCommandPlan` builder keeps all git invocations as argv slices so there is no shell injection surface. Credentials are injected exclusively via `GIT_CONFIG_VALUE_0` (the `extraheader` mechanism), never embedded in the clone URL, so they cannot appear in run metadata or error messages. The `redact_git_output` function scrubs the raw token, the Base64-encoded form, and the full `AUTHORIZATION` header value from any error string before it surfaces. **`create_run_from_manifest`** — The extracted helper accepts an optional `AutomationRef` which is forwarded into `create_input.automation` so the store can persist automation provenance on the run. The `POST /runs` code path passes `None`, leaving existing API behavior identical. **Test injection** — `TestAutomationRunMaterializer` captures every `AutomationRunMaterializeInput` it receives and returns a caller-controlled `Result`, letting route tests assert what inputs the scheduler would pass without touching GitHub. ```mermaid flowchart TB A["POST /runs\n(HTTP handler)"] -->|automation: None| H["create_run_from_manifest"] S["Automation scheduler\n(future issue)"] -->|automation: Some(ref)| H H --> DB[(Run store)] M["AutomationRunMaterializer\n(trait)"] -->|produces RunManifest| S M -- production --> P["ProductionAutomationRunMaterializer\n(git clone → manifest build)"] M -- test --> T["TestAutomationRunMaterializer\n(captures input, returns fixture)"] ``` ### Fabro Details <details> <summary>Ran 8 stages in 72m 56s for $36.55</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 2s | – | 0 | | preflight_compile | 2m 12s | – | 0 | | preflight_lint | 2m 27s | – | 0 | | implement | 30m 41s | $23.10 | 0 | | simplify_opus | 19m 19s | $9.12 | 0 | | simplify_gpt | 7m 53s | $4.33 | 0 | | verify | 9m 20s | – | 0 | | **Total** | **72m 56s** | **$36.55** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh>	2026-05-27 20:14:56 -04:00
Bryan Helmkamp	a992a7d76b	feat(runs): allow retrying succeeded runs ... Broaden manual retry eligibility to all unarchived terminal runs while preserving active and archived precondition failures.	2026-05-27 18:49:45 -04:00
fabro-sh-0530[bot]	2d78f96107	Wire automation store into AppState and expose CRUD REST API (#439) ... ## Summary Loads `AutomationStore` into `AppState` at server startup and exposes five authenticated REST endpoints (`GET/POST /automations`, `GET/PUT/DELETE /automations/{id}`) backed by the existing `fabro-automation` crate. ### Plan Summary - Add `fabro-automation` as a dependency of `fabro-server` and mount `Arc<AutomationStore>` on `AppState`, computed from a sibling `automations/` directory next to the active config file. - Change `AutomationStore::load` from `async` to synchronous (`std::fs`) so it can run before the Tokio runtime needs to make progress; malformed files now fail startup instead of being silently skipped. - Implement `src/server/handler/automations.rs` with shared helpers for path-ID parsing, `If-Match` (quoted/unquoted) parsing, ETag formatting, and `AutomationStoreError → ApiError` mapping. - HTTP semantics: 201 on create, 404 on missing, 409 on duplicate or stale revision, 422 on domain validation failure, 428 on missing `If-Match`. - Update `TestAppStateBuilder` to derive `active_config_path` from the vault path so each test gets an isolated sibling `automations/` directory; add `try_build()` to allow startup-failure assertions. - Update the OpenAPI spec and generated TypeScript client to include `AutomationListMeta` with a `total` field. ## Key design decisions **Sync load path.** `AutomationStore::load` is now `fn` (not `async fn`), using `std::fs`. A `#[expect(clippy::disallowed_methods)]` annotation explains the rationale: this runs once at startup before the runtime needs to yield, and avoids requiring a Tokio handle at the call site in `build_app_state`. **Fail-fast on malformed files.** Previously, corrupt TOML files were logged as warnings and skipped. Now any parse or validation error during load aborts server startup. The old `warn_load_failure` helper is deleted; tests that relied on skip behaviour are replaced with tests that assert `Err(AutomationStoreError::Parse { .. })` and `Err(AutomationStoreError::InvalidFilename { .. })`. **ETag / If-Match handling.** `parse_required_if_match` strips optional surrounding quotes before parsing the revision, so both `"<rev>"` and bare `<rev>` are accepted from clients. Missing `If-Match` on PUT/DELETE returns **428 Precondition Required**, not 400. **Test isolation.** `TestAppStateBuilder::build` now derives `active_config_path` from `vault_path.with_file_name("settings.toml")` instead of a random temp path, so the sibling `automations/` directory is predictable and cleaned up with the same temp dir. ### Fabro Details <details> <summary>Ran 10 stages in 85m 20s for $33.66</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 19s | – | 0 | | preflight_lint | 2m 5s | – | 0 | | fix_lints | 33s | $0.15 | 0 | | implement | 30m 33s | $17.35 | 0 | | simplify_opus | 20m 27s | $11.82 | 0 | | simplify_gpt | 6m 41s | $3.88 | 0 | | verify | 15m 44s | – | 0 | | fixup | 6m 8s | $0.46 | 0 | | **Total** | **85m 20s** | **$33.66** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh>	2026-05-27 18:45:59 -04:00
Bryan Helmkamp	fa565ceaae	chore(model): update provider default models (#437) ... Updates the built-in catalog so OpenAI default selection now resolves to `gpt-5.5` and Gemini default selection resolves to `gemini-3.5-flash`. The public model defaults table and catalog assertions were updated to pin the new behavior. Verified with `cargo nextest run -p fabro-model`. --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 (Codex) via [Codex](https://openai.com/codex)	2026-05-27 18:45:51 -04:00
fabro-sh-0530[bot]	c767db897f	Add Automations API contract to OpenAPI spec and update generated clien… (#436) ... ## Summary Defines the public Automations REST API contract in the OpenAPI spec, updates the `RunSandbox` schema to reflect the new sandbox lifecycle model, adds `fabro-automation` as a dependency to `fabro-api` for type reuse, and removes the retired `fabro-devcontainer` crate and all references to it. ## What changed ### Automations API (`fabro-api.yaml`) Seven new paths under `/api/v1/automations` covering the full CRUD surface plus run sub-resources: ``` GET/POST /automations GET/PUT/DELETE /automations/{id} GET/POST /automations/{id}/runs ``` New schemas: `Automation`, `AutomationTarget`, `AutomationTrigger` (discriminated oneOf on `type`), `AutomationApiTrigger`, `AutomationScheduleTrigger`, `CreateAutomationRequest`, `ReplaceAutomationRequest`, `AutomationListResponse`. Key contract decisions: - `AutomationTrigger` uses an OpenAPI discriminator (`propertyName: type`); unknown discriminator values → HTTP 422, not 400. - `PUT` and `DELETE` require an `If-Match` header (428 if absent, 409 on mismatch); `GET` and `PUT` responses carry an `ETag`. - `POST /automations/{id}/runs` fires the automation's enabled API trigger; 409 if the automation is disabled or lacks one. - Run sub-resource responses reuse the existing `Run` and `PaginatedRunList` schemas. ### `RunSandbox` schema refactor The sandbox schema is restructured to express the full lifecycle rather than only the ready state: | Before | After | |---|---| | Flat object with `provider`, `image`, `snapshot`, `runtime` | Discriminated by `kind`: `planned`, `initializing`, `ready`, `failed` | | `runtime` was nullable | Moved into `RunSandboxInstance` (non-nullable); present only when `kind = ready` | | No failure detail | New `RunSandboxFailure` schema with `error`, `causes`, `duration_ms` | `SandboxDetails.sandbox` now references `RunSandboxInstance` (the ready state), which preserves the existing shape for the details endpoint while the richer `RunSandbox` type appears on run responses. ### Web UI (`run-sandbox-lifecycle.ts`) New helper module that bridges the old flat-object sandbox wire shape and the new lifecycle-keyed shape, with display metadata for each lifecycle state. Consumers (`RunSummaryPanel`, `TerminalView`, `RunSandbox` route, `run-detail` header/tabs) updated to route through these helpers so both old and new wire shapes are handled transparently. ### `fabro-devcontainer` removal The `fabro-devcontainer` crate is removed from `Cargo.lock`, `AGENTS.md`, nextest config, and all doc references. Public-facing changelog entries for devcontainer-specific features are removed or retitled. ### Plan Summary - Add Automations CRUD + run sub-resource paths and schemas to the OpenAPI spec - Restructure `RunSandbox` schema to model lifecycle states (`planned → initializing → ready | failed`) - Add `fabro-automation` dependency to `fabro-api` for domain-type reuse; add JSON parity round-trip tests - Regenerate Rust API types and TypeScript client - Remove `fabro-devcontainer` crate and all references - Add `run-sandbox-lifecycle.ts` helper module in the web UI and update all sandbox-state consumers ### Fabro Details <details> <summary>Ran 9 stages in 83m 29s for $35.47</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 22s | – | 0 | | preflight_lint | 2m 40s | – | 0 | | implement | 45m 36s | $28.67 | 0 | | simplify_opus | 7m 46s | $2.46 | 0 | | simplify_gpt | 6m 7s | $3.92 | 0 | | verify | 12m 8s | – | 0 | | fixup | 5m 52s | $0.43 | 0 | | **Total** | **83m 29s** | **$35.47** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh>	2026-05-27 14:07:01 -04:00
fabro-sh-0530[bot]	7b7a2c9044	Add fabro variable CLI namespace for server-managed variables (#434) ... ## Summary Exposes the existing variables API through a new `fabro variable` CLI namespace (`list`, `get`, `set`, `rm`), following the same patterns as `fabro secret`. Variables are intentionally readable — `list` and `get` show stored values — while `fabro secret` remains write-only. This PR also ships a significant set of accompanying changes: a refactored sandbox lifecycle model in the web UI, removal of the `fabro-devcontainer` crate, and a new `RunSandbox` OpenAPI schema that models the full planned → initializing → ready/failed lifecycle. ## What Changed ### CLI (`fabro variable`) - New `fabro variable` namespace with `list` (aliased `ls`), `get`, `set`, and `rm` subcommands, dispatched through the same `ServerTargetArgs` pattern as `fabro secret`. - `fabro-client` gains five new wrapper methods (`list_variables`, `get_variable`, `create_variable`, `update_variable`, `delete_variable`) over the generated OpenAPI client. - `set` is an upsert; `--value-stdin` accepts empty input after newline-trimming (unlike the secrets equivalent). - CLI reference docs (`docs/public/reference/cli.mdx`) regenerated; `docs/public/workflows/variables.mdx` gains a short section explaining `{{ vars.NAME }}` interpolation and the variables-vs-secrets security boundary. ### Sandbox lifecycle model (web) - New `RunSandbox` OpenAPI shape splits the old flat object into `kind` (planned/initializing/ready/failed) + `plan` + optional `instance` + optional `failure`. - `apps/fabro-web/app/lib/run-sandbox-lifecycle.ts` centralises lifecycle helpers (`sandboxLifecycleKind`, `sandboxInstance`, `sandboxRuntime`, `sandboxIsReady`, `sandboxTabVisible`, `SANDBOX_LIFECYCLE_DISPLAY`). - Run summary panel and sandbox route now show lifecycle state (Initializing / Failed with causes / Not created) before or instead of the fully-loaded `SandboxDetails`. - The sandbox details query is skipped entirely until `sandboxIsReady` returns true, preventing unnecessary 404 fetches for planned/failed sandboxes. - `runHasSandbox` in `tabs-shell.tsx` delegates to `sandboxTabVisible`, hiding the Sandbox tab for `planned` state and showing it for `initializing`/`ready`/`failed`. - Legacy flat sandbox shape (no `kind`) is handled via backwards-compatible shims in the new helpers. ### `fabro-devcontainer` removal - The `fabro-devcontainer` crate has been removed from `Cargo.lock` and all dependent crates. - References to devcontainer in internal plans, docs, changelog entries, and event schemas have been cleaned up or reworded to reflect that the feature is no longer present. ### Plan summary - **Unit 1:** `fabro-client` variable wrappers - **Unit 2:** CLI args, dispatch, and `commands/variable/mod.rs` - **Unit 3:** `list`, `get`, `set`, `rm` behavior modules - **Unit 4:** Test harness helpers and integration tests - **Unit 5:** Regenerated CLI docs + `variables.mdx` update ### Fabro Details <details> <summary>Ran 8 stages in 58m 50s for $23.81</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 9s | – | 0 | | preflight_lint | 2m 21s | – | 0 | | implement | 31m 34s | $18.44 | 0 | | simplify_opus | 8m 48s | $2.60 | 0 | | simplify_gpt | 4m 1s | $2.77 | 0 | | verify | 9m 17s | – | 0 | | **Total** | **58m 50s** | **$23.81** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh>	2026-05-27 13:57:25 -04:00
Bryan Helmkamp	e18772888e	Model run sandbox lifecycle explicitly (#431) ... ## Summary Fixes sandbox state reporting by separating a requested sandbox plan from an initialized sandbox instance. Runs now project sandbox lifecycle as `planned`, `initializing`, `ready`, or `failed`, and live sandbox operations only proceed once a real instance exists. ## Changes - Introduces `RunSandboxPlan`, `RunSandboxInstance`, and lifecycle-backed `RunSandbox` domain types, with serde validation that prevents `ready` sandboxes without an instance. - Updates store projection behavior so sandbox events transition through planned, initializing, ready, and failed states while preserving requested provider/image/snapshot separately from runtime metadata. - Tightens server sandbox handlers so details/files/services/terminal/VNC helpers require an initialized instance and return a clear 404 when the sandbox was never created. - Updates the OpenAPI contract and regenerated clients so `Run.sandbox` exposes lifecycle state while `SandboxDetails.sandbox` contains only initialized instance metadata. - Updates the web UI to render lifecycle state directly from run summaries, hide the Sandbox tab for pure planned sandboxes, and disable sandbox controls until the instance is ready. - Cleans up duplicated lifecycle display/type logic and duplicate server-side sandbox instance loading found during review. | Lifecycle state | Meaning | Live controls | | --- | --- | --- | | `planned` | Sandbox was requested but no provider instance exists | Hidden/disabled | | `initializing` | Provider setup has started | State view only | | `ready` | Runtime instance exists | Enabled | | `failed` | Provider setup failed with error details | State view only | ## Testing - `cargo check --workspace` - `cargo +nightly-2026-04-14 fmt --check --all` - `git diff --check` - `cd apps/fabro-web && bun run typecheck` - `cd apps/fabro-web && bun test app/routes/run-detail.test.ts app/routes/run-sandbox.test.tsx app/components/run-summary-panel.test.tsx` - `cargo nextest run -p fabro-types --test sandbox_model_serde` - `cargo nextest run -p fabro-store run_created_projects_planned_sandbox_lifecycle sandbox_lifecycle_events_update_projected_sandbox_state run_failed_before_sandbox_events_leaves_sandbox_planned` - `cargo nextest run -p fabro-server planned_sandbox_returns_404_from_details_endpoint planned_sandbox_rejects_live_operations failed_sandbox_rejects_live_operations local_sandbox_returns_provider_neutral_details` - `cargo nextest run -p fabro-api --test run_sandbox_round_trip` - `cargo nextest run -p fabro-api --test sandbox_details_round_trip` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex)	2026-05-27 12:48:56 -04:00
Bryan Helmkamp	352b7c5de4	refactor: remove devcontainer support (#433) ... ## Summary Remove devcontainer support from the product surface and codebase: the parser crate, workflow bridge, lifecycle execution path, typed events, CLI progress rendering, generated client field, and public/internal documentation references are all gone. ## What Changed - Deleted the dedicated parser crate and removed its Cargo dependencies and lockfile entries. - Removed workflow initialization paths that resolved repository devcontainer metadata, applied Daytona snapshots from it, merged environment variables from it, or ran its lifecycle commands. - Removed the typed event variants and CLI progress handlers for the retired lifecycle events while leaving shared unknown-event handling intact. - Cleaned the generated TypeScript client and tracked docs so repository search has no remaining devcontainer references outside git history. ## Verification - `cargo +nightly-2026-04-14 fmt --all` - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo build --workspace` - `cargo nextest run -p fabro-types` - `cargo nextest run -p fabro-workflow` - `cargo nextest run -p fabro-cli run_progress` - `cd lib/packages/fabro-api-client && bun run generate && bun run typecheck` - `cargo metadata --no-deps --format-version 1 | rg -i "fabro-devcontainer|devcontainer"` - `rg -n -i "devcontainer|dev container|dev-container|dev_container|fabro-devcontainer|\\.devcontainer" . --glob '!target/**' --glob '!.worktrees/**'` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex)	2026-05-27 12:48:40 -04:00
Bryan Helmkamp	8df6fff947	refactor(web): give variables row its own value column ... Moves Edit and Delete into an ellipsis menu and promotes the variable value into its own column so a long value gets the space the action buttons used to occupy. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-27 12:21:49 -04:00
Bryan Helmkamp	cf124be413	fix(types): finish image.ref → image.docker rename in env var substitution ... Commit ec1b3f2 (#429) renamed `EnvironmentImageSettings::reference` to `docker` but missed the variable-substitution call site in `substitute_environment` and its companion test, breaking the workspace build. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-27 12:15:14 -04:00
Bryan Helmkamp	03d2a9acdd	feat(web): add /settings/variables management UI ... Adds a sidebar-linked Variables page above Secrets that lists, creates, edits, and deletes variables via the new /api/v1/variables endpoints. Values are shown inline since variables are non-sensitive. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-27 12:14:41 -04:00
Bryan Helmkamp	e13de9faaf	feat(automation): persist automation refs on runs (#428) ... ## Summary Adds durable automation metadata to workflow runs so automation-triggered runs can carry their automation and trigger references through creation, stored events, projections, summaries, fork, retry, and API surfaces. This also introduces the new `fabro-automation` crate with typed automation IDs, TOML parsing/validation, revision hashing, and a file-backed automation store. The store avoids overwriting malformed existing TOML files on create and keeps read access from being blocked by mutation disk I/O. ## Changes - Add `AutomationRef` propagation through `RunSpec`, `run.created`, store projections, summaries, fork, retry, and related tests. - Add `fabro-automation` domain/store crate for automation TOML definitions, trigger validation, revisions, create/replace/delete, and load behavior. - Update OpenAPI and regenerated TypeScript client types for `RunSpec.automation` and `AutomationRef.trigger_id`. - Add API/type regression coverage for the new automation fields. - Harden automation store create semantics so skipped malformed files still reserve their path. ## Verification - `cargo nextest run -p fabro-automation` - `cargo +nightly-2026-04-14 clippy -p fabro-automation --all-targets -- -D warnings` - `cargo nextest run -p fabro-api` - `cargo nextest run -p fabro-types run_spec_round_trips_templated_settings run_created_props_round_trip_templated_settings` - `cd lib/packages/fabro-api-client && bun run typecheck` - `cargo +nightly-2026-04-14 fmt --check --all` - `git diff --check`	2026-05-27 11:52:57 -04:00
Bryan Helmkamp	ec1b3f2084	feat(sandbox): secure daytona snapshot names (#429) ... ## Summary Secures Daytona custom snapshot creation by removing user-controlled snapshot/image references and replacing them with deterministic names Fabro computes internally. Docker image selection now uses `image.docker`, while Daytona only accepts `image.dockerfile` for custom snapshots and continues to use `daytona-medium` when no Dockerfile is configured. ## Changes - Replaces public `image.ref` config/API shape with Docker-specific `image.docker` across Rust settings, OpenAPI, generated TypeScript client, docs, defaults, examples, and web samples. - Adds Daytona snapshot identity generation using HMAC-SHA256 over a canonical manifest keyed by the Daytona API key, producing `fabro-<uuid>` snapshot names without exposing Dockerfile text or key material. - Routes Daytona custom Dockerfiles, including devcontainer-generated Dockerfiles, through the same computed identity path before calling Daytona snapshot APIs. - Updates sandbox initialization events and store projections so initialized run state can show the resolved image and computed Daytona snapshot after startup. - Updates legacy config migration behavior so Docker image refs map to `image.docker`, while Daytona legacy snapshot names are not preserved. ## Breaking Changes - `image.ref` is no longer accepted in new environment config. - Docker environments should use `image.docker` for image selection. - Daytona environments reject `image.docker`; use `image.dockerfile` to request a custom computed snapshot. ## Verification - `cargo build -p fabro-api` - `cd lib/packages/fabro-api-client && bun run generate` - `cd lib/packages/fabro-api-client && bun run typecheck` - `cd apps/fabro-web && bun run typecheck` - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings` - `ulimit -n 4096 && cargo nextest run --no-fail-fast -p fabro-cli -p fabro-config -p fabro-sandbox -p fabro-workflow -p fabro-store -p fabro-server -p fabro-api` - `cargo insta pending-snapshots` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex)	2026-05-27 11:52:35 -04:00
Bryan Helmkamp	b1bd2f522c	feat(server): add variables API (#430) ... ## Summary Adds a workflow-visible variables store and HTTP API for managing non-sensitive run variables, then wires those variables into run config interpolation before run creation, validation, and preflight. ## What Changed - Adds `/api/v1/variables` CRUD endpoints backed by a JSON variable store and generated Rust/TypeScript API types. - Supports `{{ vars.NAME }}` interpolation alongside existing `{{ env.NAME }}` handling for run-owned config fields, including environment, MCP, hook, artifact, checkpoint, SCM, and notification settings. - Reuses canonical `fabro-types` variable DTOs in `fabro-api` and adds OpenAPI name patterns so clients see the same env-style variable contract enforced by the server. - Keeps variable updates store-owned with `update_existing`, avoiding duplicated not-found/update semantics in the HTTP handler. - Shares env-style name validation between variables, interpolation parsing, and vault token names to avoid grammar drift. Variables are intentionally non-sensitive: list/get responses include values, unlike vault secrets. ## Validation - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo test -p fabro-types` - `cargo test -p fabro-variable` - `cargo test -p fabro-api --test variable_round_trip` - `cargo test -p fabro-server --features test-support --test it api::variables` - `cargo +nightly-2026-04-14 clippy -p fabro-types -p fabro-variable -p fabro-vault --all-targets -- -D warnings` - `cargo +nightly-2026-04-14 clippy -p fabro-server --features test-support --all-targets -- -D warnings` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex/)	2026-05-27 11:46:36 -04:00
Bryan Helmkamp	8bca376f35	fix(web): close run phase on terminal events (#427) ... Run Events no longer leaves the pre-execution Initializing bar open when a run fails before `run.running`. This addresses the waterfall symptom in fabro-sh/fabro#426. The phase derivation now records terminal `run.completed` / `run.failed` events and uses them as fallback boundaries for Submitted, Pending, Runnable, and Initializing phases. The existing `run.running` handoff still takes precedence once execution actually starts. Tested: - `cd apps/fabro-web && bun test app/lib/run-phases.test.ts` - `cd apps/fabro-web && bun run typecheck` - `git diff --check` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex)	2026-05-27 10:38:32 -04:00
fabro-sh-0530[bot]	5d6cd48e9e	Replace vague expect/panic messages with invariant-explaining messages (#422) ... Production code must not panic without a clear explanation of *why* the failure is impossible. This PR upgrades panic-adjacent messages across the codebase to meet that standard, and converts two genuine runtime panics into proper error handling. ## What changed **Invariant-explaining `expect` messages** — all existing `expect("short label")` calls that guarded hard-coded literals, just-inserted map entries, just-pushed Vec elements, or hard-coded regex/template strings now carry a sentence explaining *why* the None/Err path cannot be reached (e.g. `"node was just inserted by ensure_node, so get_mut cannot return None"`). No behavior changes. **`assert_eq!` → `panic!` with justification** in `strategy.rs` — the bare assert is replaced with an explicit `panic!` whose message names every existing call site that enforces the `CodexDevice ↔ OpenAI` invariant, making future regressions easier to diagnose. **Genuine runtime errors converted to `Result`** — `select_backend` / `select_backend_for_gh_command` in the upgrade command previously called `.expect()` on `http_client()`, which can fail due to TLS or environment issues. Both functions now return `Result<Backend>` and propagate the error to the CLI boundary. **Signal handler panics degraded to warnings** in `serve.rs` — `ctrl_c()` and `unix::signal()` failures no longer panic the server; instead they log a warning and park the future, allowing the server to keep running without graceful-shutdown support rather than crashing on startup. **Telemetry thread spawn failure** in `fabro-telemetry` — instead of panicking, a failure to spawn the background thread logs a debug message and silently disables telemetry, which is the correct degradation for an optional observability feature. **OS RNG `expect` messages** — three sites (`random_secret`, `random_auth_code`, `generate_dev_token`) now explain that a failure means the system RNG is broken and the security of the generated value would be compromised, justifying the panic boundary. ### Fabro Details <details> <summary>Ran 3 stages in 45m 16s for $11.65</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | work | 34m 22s | $9.00 | 0 | | audit | 10m 35s | $2.65 | 0 | | **Total** | **45m 16s** | **$11.65** | **0** | </details> <details> <summary>Ran <code>Goal.fabro</code> (4 nodes and 5 edges)</summary> ```dot digraph Goal { graph [ goal="Complete the user-provided goal", rankdir=LR, max_node_visits=30 ] start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] work [ label="Work", thread_id="goal", fidelity="full", max_visits=12, prompt="@prompts/continue.md" ] audit [ label="Completion Audit", thread_id="goal", fidelity="full", goal_gate=true, retry_target="work", output_schema="routing", output_retries=2, max_visits=12, prompt="@prompts/audit.md" ] start -> work -> audit audit -> exit [label="Done", condition="outcome=succeeded"] audit -> work [label="Continue", condition="outcome=failed || preferred_label=Continue"] audit -> work [label="No clear verdict"] } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-27 10:38:20 -04:00
fabro-sh-0530[bot]	b196a97ac4	Introduce approved effect hooks and migrate direct useEffect calls (#425) ... ## Summary Implements the React Effects Policy by creating the approved hook surface in `hooks/effects.ts` and migrating a broad set of direct `useEffect` calls across the codebase to either purpose-named hooks or non-effect patterns. ### Plan Summary - Add `hooks/effects.ts` exporting `useMountEffect`, `useInterval`, `useTimeout`, `useDebouncedValue`, `useWindowEvent`, `useDocumentEvent`, `useDocumentTitle`, `useMediaQuery`, `useLocationHash`, and `useResizeObserver` - Extract large imperative effects into purpose-named hooks: `useTerminalSession`, `useFloatingTooltipMeasurements`, `useAnnotatedRunGraphSvg`, `useInstallEffects`, and others - Move install session fetch from a component effect into a SWR query (`install-query.ts`) - Replace `useEffect` + `useState` state-derivation patterns with render-time computation or ref callbacks - Replace `AskFabroLayoutProvider`/`useAskFabroLayout` context with a prop callback ## What changed and why **`hooks/effects.ts`** — the new approved primitive surface. All internal `useEffect` calls here are intentional; the hooks expose the *external system* they manage rather than leaking `useEffect` to component code. `useMediaQuery` and `useLocationHash` use `useSyncExternalStore` instead of effect + state. **`useTerminalSession`** — the largest extraction. The 130-line xterm/WebSocket/ResizeObserver setup block moves from `terminal-view.tsx` into its own hook, which now owns the `terminalRef`, `fitRef`, and `socketRef` that previously cluttered the component. `TerminalConnectionError` and `ConnectionStatus` types are exported from the hook. **`useFloatingTooltipMeasurements`** — extracts the `useLayoutEffect` + ResizeObserver + window resize listener out of `FloatingTooltip`. The `FloatingTooltipSize` type moves with it so consumers don't need to import from the component. **`useInstallSessionQuery` + `useInstallEffects`** — the install session fetch moves from a component effect to SWR (`install-query.ts`). The three remaining install effects (token URL scrubbing, GitHub error URL scrubbing, health-poll restart) move into `hooks/use-install-effects.ts`. The root-redirect effect is replaced with a render-time `<Navigate>` gate. The `SessionState` discriminant now carries `token` so stale query results can be discarded without an effect chain. **`SelectionCheckbox`** — `useEffect` setting `input.indeterminate` is replaced with a ref callback, which runs synchronously after the node is attached and avoids a stale-frame flash. **`event-debug.tsx`** — the manual `window.addEventListener("keydown", ...)` pattern is replaced with `useWindowEvent`, removing the `react-doctor-disable` suppression comments. **`run-waterfall.tsx`** — the local `useTickingNow` is deleted; `RunWaterfall` now calls the shared `useTickingNow` from `lib/time` with the new `active` parameter signature. **`toast.test.tsx`** — `useEffect(() => onReady?.(api), ...)` in the test helper is replaced with a direct call during render, which is valid because `onReady` has no side effects that React cares about. **`AskFabroSidebar`** — `setIsResizing` from the layout context is replaced with an `onResizeActiveChange` prop, removing the `useAskFabroLayout` call and the hidden context coupling from the sidebar. ### Fabro Details <details> <summary>Ran 3 stages in 114m 5s for $95.71</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | work | 103m 3s | $80.42 | 0 | | audit | 10m 19s | $15.29 | 0 | | **Total** | **114m 5s** | **$95.71** | **0** | </details> <details> <summary>Ran <code>Goal.fabro</code> (4 nodes and 5 edges)</summary> ```dot digraph Goal { graph [ goal="Complete the user-provided goal", rankdir=LR, max_node_visits=30 ] start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] work [ label="Work", thread_id="goal", fidelity="full", max_visits=12, model="gpt-55", reasoning_effort="xhigh", prompt="@prompts/continue.md" ] audit [ label="Completion Audit", thread_id="goal", fidelity="full", goal_gate=true, retry_target="work", output_schema="routing", output_retries=2, max_visits=12, model="gpt-55", reasoning_effort="xhigh", prompt="@prompts/audit.md" ] start -> work -> audit audit -> exit [label="Done", condition="outcome=succeeded"] audit -> work [label="Continue", condition="outcome=failed || preferred_label=Continue"] audit -> work [label="No clear verdict"] } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-27 10:37:29 -04:00
Bryan Helmkamp	c20c6b5361	chore: update goal workflow	2026-05-27 08:06:56 -04:00
Bryan Helmkamp	c8b9cb9b9b	fix(web): make runs board fill viewport so horizontal scroll works anywhere ... Opt the /runs route into the shell's full-height flex chain, then propagate height through the page root, the columns scroll container, and the list view wrapper. Previously the board only extended to its content height, so the empty space below was non-interactive — you could only scroll horizontally from the top half of the page.	2026-05-27 07:55:57 -04:00
fabro-releases[bot]	9b8d7b798a	Bump version to 0.246.0-nightly.0	2026-05-27 10:39:37 +00:00
fabro-sh-0530[bot]	c2da22a27c	Replace DIY overlay primitives with Radix UI + Sonner (#424) ... ## Summary Replaces ~285 lines of hand-rolled Tooltip, HoverCard, and Toast code in `fabro-web` with battle-tested primitives — gaining real keyboard accessibility, Radix collision detection, and Sonner's toast lifecycle — while keeping all 13+ call sites unchanged. ### Plan Summary - **Tooltip + HoverCard → Radix wrappers**: `@radix-ui/react-tooltip` and `@radix-ui/react-hover-card` replace the DIY `useHoverAnchor` hook. A `TooltipProvider` is mounted in `app-shell.tsx` (200ms delay, 300ms skip-delay for grouped sidebar hovers). `<Tooltip>` self-wraps in a local provider when rendered outside the shell (tests, isolated mounts). - **Toast system → Sonner**: `toast.tsx` shrinks to a ~30-line shim preserving the `{ push, dismiss, clear }` API. `ToastProvider` becomes a no-op pass-through in DOM contexts; in non-DOM test environments it renders an `aria-live` fallback backed by `useSonner` so test assertions still work. The `action` field is dropped (was test-only). `toast.test.tsx` is rewritten against observable rendered text. - **CSS-only tooltips → `<Tooltip>`**: Two inline `group-hover/*` blocks in `settings-models.tsx` are swapped for the new wrapper, gaining keyboard focus + Esc dismiss + collision avoidance. - **SVG-anchored hovers → `FloatingTooltip`**: A new `app/components/floating-tooltip.tsx` helper portals to `document.body` and computes collision-avoiding `top`/`bottom` placement from a raw `DOMRect` (no wrappable trigger). It absorbs `hover-card-style.ts` (deleted) and is used by `run-overview.tsx` and `event-debug.tsx`. ### What changed and why **`FloatingTooltip`** handles the two SVG/Graphviz hover sites where there is no React trigger element to wrap — only a `DOMRect` measured from DOM events. It uses `useLayoutEffect` + `ResizeObserver` to measure its own rendered size before applying final position, so it never clips at viewport edges. This is the one place a `useLayoutEffect` is intentional and documented. **`Tooltip` provider fallback**: Radix throws if `<Tooltip>` renders without an ancestor `TooltipProvider`. Rather than requiring every test to mount the shell, the component detects provider presence via context and injects a local one when needed. **Toast shim backward-compat**: `ToastProvider` previously accepted `autoDismissMs` as a prop; that prop is silently dropped. The `action` field on `ToastInput` is removed (only one test referenced it — `run-detail.test.ts` is updated accordingly). All other consumers compile without changes. **CSP fix** (bundled): `img-src` gains `https://avatars.githubusercontent.com` to allow GitHub avatar images, with the corresponding integration-test assertion updated. ### Fabro Details <details> <summary>Ran 8 stages in 54m 1s for $32.86</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 6s | – | 0 | | preflight_lint | 2m 23s | – | 0 | | implement | 21m 38s | $22.48 | 0 | | simplify_opus | 13m 51s | $7.00 | 0 | | simplify_gpt | 3m 54s | $3.38 | 0 | | verify | 9m 35s | – | 0 | | **Total** | **54m 1s** | **$32.86** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh>	2026-05-26 23:03:06 -04:00
Bryan Helmkamp	8102c11919	chore(workflows): use gpt-55 xhigh for goal workflow ... Switches the goal workflow's work and audit nodes from the default claude-sonnet to gpt-55 with xhigh reasoning, matching the implement node in implement-plan. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-26 22:43:33 -04:00
Bryan Helmkamp	5eb3eb1a23	fix(server): allow GitHub avatars in CSP img-src ... Recent CSP enforcement blocked avatars.githubusercontent.com images used by run cards in the web UI. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-26 22:39:52 -04:00
Bryan Helmkamp	5529ed5dd0	chore: AGENTS.md	2026-05-26 22:05:04 -04:00
Bryan Helmkamp	7bd9d1ec27	chore: add panic policy	2026-05-26 22:04:04 -04:00
Bryan Helmkamp	70b9e9a1ab	docs: sync product docs with runtime changes	2026-05-26 21:55:17 -04:00
Bryan Helmkamp	c54025a21c	docs(changelog): refresh recent product changes	2026-05-26 21:49:16 -04:00
Bryan Helmkamp	ab68fc27d1	fix(workflow): preserve usage across session compaction (#420) ... ## Summary Fixes shared-thread workflow stages that compact their session before routing/audit bookkeeping finishes. The workflow backend now records token usage from each `Session::process_input` call as it happens, instead of slicing assistant turns out of the final session history after the session may have been compacted or replaced. ## Changes - Track per-input token usage inside `fabro-agent::Session` alongside the existing timing data. - Use the recorded per-input usage in the workflow LLM backend for initial prompts, retry-after-compaction prompts, and schema repair prompts. - Keep the invariant panic message for inconsistent session history explicit with `expect(...)`. - Add a black-box workflow integration test that drives a shared-thread audit through pre-routing compaction and asserts the audit still succeeds. ## Verification - `ulimit -n 4096 && cargo nextest run --workspace` - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings` - `cd apps/fabro-web && bun test --isolate` - `cd apps/fabro-web && bun run typecheck` - `cd lib/packages/fabro-api-client && bun run typecheck` - After rebasing onto current `origin/main`: `ulimit -n 4096 && cargo nextest run -p fabro-workflow --test it integration::shared_thread_compaction_before_routing_audit_succeeds` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex)	2026-05-26 21:19:53 -04:00
Bryan Helmkamp	535cbda355	fix(server): enforce content security policy (#421) ... ## Summary Enforces Fabro's CSP by switching from `Content-Security-Policy-Report-Only` to `Content-Security-Policy` while preserving the SPA sources we know are required. The policy now hashes the install-mode inline bootstrap and allows `ws:`/`wss:` connections so terminal WebSockets do not regress under enforcement. The security headers integration test now asserts enforced CSP behavior, and the public security docs now describe the default headers Fabro emits. ## Verification - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo test -p fabro-server csp::tests --lib` - `cargo test -p fabro-server security_headers::tests --lib` - `cargo test -p fabro-server --features test-support --test it security_headers_are_applied_to_all_responses` - Browser QA against an enforced local server: login, runs list, settings, and automation diagram rendered with no CSP console violations or page errors. - Live listener on `127.0.0.1:32276` restarted and verified to emit `content-security-policy` with no report-only header. --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex)	2026-05-26 21:19:36 -04:00
Bryan Helmkamp	38695d7e89	fix(server): normalize default ports in terminal origin check (#417) ... ## Summary The terminal WebSocket origin check (`origin_allowed` in `handler/sandbox.rs`) rejected browser requests when the `Host` header omitted the default port for the scheme. Result: clicking the **Terminal** tab on `/runs/<id>/sandbox` returned **403 Forbidden** and the UI showed "Terminal WebSocket connection failed." Other tabs (Services, Filesystem, VNC) worked because their WebSockets either don't traverse the server (VNC connects directly to Daytona's signed preview URL) or aren't WebSocket upgrades. ## Root cause Browsers send `Origin: https://example.com` and `Host: example.com` (no `:443`) on default HTTPS. The previous logic always constructed the origin authority *with* the default port, then string-compared against the raw `Host` header: ```rust let origin_authority = match origin_url.port_or_known_default() { Some(port) => format!("{origin_host}:{port}"), None => origin_host.to_string(), }; origin_authority.eq_ignore_ascii_case(host) ``` So `"example.com:443"` got compared against `"example.com"` and never matched. Every browser-driven WS upgrade to a default-port HTTPS deployment failed. ## Fix Parse the `Host` header through the origin's scheme into another `Url`, then compare `host_str()` and `port_or_known_default()` on both sides. This normalizes default ports symmetrically. ```rust let Ok(host_url) = url::Url::parse(&format!("{}://{host}", origin_url.scheme())) else { return false; }; origin_url.host_str() == host_url.host_str() && origin_url.port_or_known_default() == host_url.port_or_known_default() ``` Reproduced in a production deployment of the nightly image behind Caddy doing TLS termination on a public IP. Before the fix the terminal WS handshake returned 403 every time; with the fix the handshake completes and the terminal session attaches. ## Tests Added four new cases alongside the existing two: - `origin_validation_allows_default_https_port_omitted_from_host` — the bug case (browser-style `Origin: https://host` + `Host: host`). - `origin_validation_allows_default_http_port_omitted_from_host` — same for plain HTTP. - `origin_validation_allows_explicit_default_port_in_host` — `Host: example.com:443` still matches `Origin: https://example.com`. - `origin_validation_rejects_scheme_mismatch_on_default_port` — `Origin: http://example.com` + `Host: example.com:443` is still rejected (different effective ports). All six `origin_validation_*` tests pass; the full `fabro-server` suite stays green (679/679). ## Test plan - [x] `cargo nextest run -p fabro-server origin_validation` — 6 passed - [x] `cargo nextest run -p fabro-server` — 679 passed - [x] `cargo +nightly-2026-04-14 fmt --check --all` - [x] `cargo +nightly-2026-04-14 clippy -p fabro-server --all-targets -- -D warnings` - [x] Manual: terminal tab in the SPA against a TLS-terminated default-port deployment 🤖 Generated with [Claude Code](https://claude.com/claude-code)	2026-05-26 19:30:24 -04:00
Bryan Helmkamp	08cd80cac7	docs: add React effects policy (#419) ... ## Summary Adds an internal React effects policy for `apps/fabro-web` so direct component effects are exceptional and real external integrations move behind purpose-named hooks. The policy covers preferred alternatives such as render-time derivation, SWR query hooks, mutation callbacks, URL/router primitives, keyed resets, and `useSyncExternalStore`. It also documents guardrails for `useMountEffect`, React 19 `useEffectEvent`, one-shot telemetry effects, migration workflow, current hotspots, and review checklist. ## Verification Not run; docs-only change. --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex)	2026-05-26 19:30:02 -04:00
Bryan Helmkamp	ab0f94fd82	feat(system): report runtime integration status (#416) ... ## Summary Settings > Integrations now reflects the server's actual integration readiness instead of only static `settings.toml` booleans. This adds `/api/v1/system/integrations` as the runtime source of truth, covering server config, vault credential presence, and Slack Socket Mode connection state. ## What Changed - Added shared `fabro-types` integration status models and reused them from `fabro-api` to avoid duplicate API/domain types. - Added `GET /api/v1/system/integrations` to the OpenAPI spec, Rust server routes, demo routes, and generated TypeScript client. - Reports GitHub and Slack status as `disabled`, `missing_credentials`, `configured`, `connecting`, `connected`, or `error`, with non-secret metadata and missing credential names. - Tracks Slack Socket Mode runtime state from the Slack connection loop and respects explicit `server.integrations.slack.enabled = false` even when vault tokens exist. - Updated the Integrations settings page to read the new runtime endpoint, so a vault-configured Slack setup no longer appears simply as disabled. ## Verification - `cargo build -p fabro-api` - `cargo nextest run -p fabro-api system_integrations` - `cargo nextest run -p fabro-config resolved_server_integrations_are_slack_only_for_chat` - `cargo nextest run -p fabro-slack run_event_loop_notifies_connected_status` - `cargo nextest run -p fabro-server --features test-support --test it get_system_integrations` - `cargo nextest run -p fabro-server` - `cargo +nightly-2026-04-14 fmt --check --all` - `cd apps/fabro-web && bun test app/routes/settings-integrations.test.tsx app/lib/query-keys.test.ts` - `cd apps/fabro-web && bun run typecheck` - `cd apps/fabro-web && bun run build` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex)	2026-05-26 19:27:32 -04:00
Bryan Helmkamp	9a21553533	fix(web): generalize GitHub App post-install copy (#418) ... ## Summary The `/setup` screen rendered after GitHub redirects post-install (params `installation_id` + `setup_action=install`) showed copy that assumed the user was retrying a failed run: > **Retry the run** — Start the run or preflight again so Fabro can clone the repository and push checkpoint branches with the new installation. But this screen is also where **first-time installers** land during onboarding, when there is no prior run to retry. The "retry" framing is confusing in that path. ## Fix Rewrite step 2 to be neutral between onboarding and retry-after-failure: > **Use the new installation** — Sign in and start a run or preflight. Fabro can now clone repositories and push checkpoint branches using the new installation. The CTA below the steps ("Continue to sign in") and step 1 ("Return to Fabro / The GitHub App is installed for the selected account or repositories") already work for both paths — only step 2 was over-fit. No structural changes; the route still keys off the same query params. Update `setup.test.ts` to assert the new title. ## Test plan - [x] `bun test app/routes/setup.test.ts` — 1 pass - [x] `bun run typecheck` — clean - [x] Manual: behavior unchanged for first-time-setup path (no install params); only the post-install variant text changes 🤖 Generated with [Claude Code](https://claude.com/claude-code)	2026-05-26 19:27:09 -04:00
fabro-sh-0530[bot]	01892185ff	Replace bare unwrap() with documented expect() across production runtim… (#415) ... Audit and remediation pass enforcing the project's no-panic-in-production policy. Every `unwrap()` on a mutex/RwLock in reachable runtime code is replaced with `expect()` carrying a message that explains *why* the lock cannot be poisoned (no code panics while holding it). Bare `unreachable!()` and `panic!()` calls are updated with messages that name the invariant being asserted. One genuine bug is fixed in the process. ## What changed **`unwrap()` → `expect()` on locks** (`fabro-core`, `fabro-oauth`, `fabro-util`, `fabro-workflow/*`, `fabro-server`): Every `Mutex`/`RwLock` `.unwrap()` in production paths now carries the standard justification pattern: `"<name> mutex/RwLock should not be poisoned: no code panics while holding this lock"`. **`unreachable!()` and `panic!()` message quality**: Bare `unreachable!()` calls in `subagent.rs`, `wait.rs`, `condition.rs`, `event/convert.rs`, and `server.rs` now name the structural invariant (e.g. "outer match arm already verified…"). The `panic!` in `tools.rs` now includes the offending name and the expected format, making it actionable. **`sha_newtype` / `short_sha_newtype` in `run_files.rs` — actual bug fix**: These helpers previously called `unwrap_or_else(|e| panic!(…))` on git output, meaning a malformed SHA from a real git subprocess would panic in a request handler. They now return `Result<T, ApiError>` and propagate errors to callers, which in turn propagate with `?`. This is the only change that alters observable behavior under failure. **Demo-only panics in `fabro-server/src/demo/mod.rs`**: Panic messages updated to clarify that these paths operate on hardcoded compile-time constants, so the panic is a programming-error guard rather than a runtime failure guard. ## Design note The lock-poisoning `expect` messages all follow a single template so reviewers can quickly verify the claim: if you ever add code that can panic inside a lock guard scope, the message becomes a lie and that must be caught in review. The uniformity is intentional. ### Fabro Details <details> <summary>Ran 0 stages in 64m 54s for $14.28</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | **Total** | **64m 54s** | **$14.28** | **0** | </details> <details> <summary>Ran <code>Goal.fabro</code> (4 nodes and 5 edges)</summary> ```dot digraph Goal { graph [ goal="Complete the user-provided goal", rankdir=LR, max_node_visits=30 ] start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] work [ label="Work", thread_id="goal", fidelity="full", max_visits=12, prompt="@prompts/continue.md" ] audit [ label="Completion Audit", thread_id="goal", fidelity="full", goal_gate=true, retry_target="work", output_schema="routing", output_retries=2, max_visits=12, prompt="@prompts/audit.md" ] start -> work -> audit audit -> exit [label="Done", condition="outcome=succeeded"] audit -> work [label="Continue", condition="outcome=failed || preferred_label=Continue"] audit -> work [label="No clear verdict"] } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-26 17:46:39 -04:00
Bryan Helmkamp	71c06c1bc4	feat(web): add "Created by" avatar column to runs list view ... Visible by default to the right of Status; toggleable via the column picker. Extracts the principal avatar/label helper out of the run summary panel so both surfaces share one renderer. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-26 09:28:20 -04:00
Bryan Helmkamp	7c69807f1d	feat(web): add multi-select run status filter to /runs toolbar ... Status filter operates on the eight non-archived BoardColumn lanes and filters both the board (hides whole lanes) and the list (hides rows). Show archived remains a standalone toggle alongside it; an `archived` token in a previously-saved status string is migrated into the toggle on read so the two controls stay independent. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-26 09:28:20 -04:00
fabro-releases[bot]	7148e37bbe	Bump version to 0.245.0-nightly.1	2026-05-26 10:39:31 +00:00
Bryan Helmkamp	6a94970b21	fix(model): retire GPT-5.2 and GPT-5.3 catalog entries (#412) ... ## Summary Retires the built-in OpenAI catalog rows for GPT-5.2 and GPT-5.3-era models while preserving compatibility through aliases on the closest remaining replacements. `gpt-5.2`, `gpt5`, `gpt-5.3-codex`, and `codex` now resolve through `gpt-5.4`; `gpt-5.3-codex-spark` and `codex-spark` now resolve through `gpt-5.4-mini`. The Rust tests that pinned individual declarative catalog rows were removed so future catalog updates stay data-only. ## Verification - `cargo nextest run -p fabro-model` - `cargo nextest run -p fabro-server list_models` - `cargo +nightly-2026-04-14 fmt --check --all` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex)	2026-05-26 00:06:50 -04:00
Bryan Helmkamp	d679bb7a88	fix(web): compact Test column on settings/models (#413) ... ## Summary - Render the Test column as an icon-only status (queued/testing/ok/failed) so a long error message no longer expands the column width. - Move the failure message into a hover/focus tooltip — wider, monospaced, and preserving newlines for readable multi-line errors. ## Test plan - [ ] Visit `/settings/models`, run "Test models", and confirm the Test column stays narrow regardless of error length. - [ ] Hover/focus a failed row's icon and verify the tooltip shows the full multi-line error in monospace. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-26 00:06:41 -04:00
fabro-releases[bot]	43291a6317	Bump version to 0.245.0-nightly.0	2026-05-26 02:58:03 +00:00