203 commits

Author	SHA1	Message	Date
Fabro	99d3e7bf4e	fabro(01KY7YH7RYCJ1BDVTTP96ZA4HV): implement (succeeded) ... Fabro-Run: 01KY7YH7RYCJ1BDVTTP96ZA4HV Fabro-Completed: 5 Fabro-Checkpoint: 378f2a7374 ⚒️ Generated with [Fabro](https://fabro.sh)	2026-07-23 18:52:40 +00:00
Scott Werner	173968a780	feat(server): mcp-servers HTTP API — handlers + AppState wiring (#532) ... ## What Adds the **mcp-servers HTTP API**: `GET/POST /api/v1/mcp-servers` and `GET/PUT/DELETE /api/v1/mcp-servers/{id}` on top of the merged `fabro-mcp-store` foundation and OpenAPI spec. This includes the AppState wiring needed for the catalog to work end to end: `McpServerStore` construction from `{active-config-dir}/mcps/`, an `AppState` accessor, the `fabro-server` dependency, and route registration for list/create/get/replace/delete handlers. The API mirrors the automations concurrency pattern with ETags on read/write responses and required `If-Match` headers for replace/delete. ## Resolved before merge - **Credential-omitting read model:** read responses now return `McpServerView` / `McpTransportView`, so stored env/header values are not exposed by GET/list/create/replace responses. Responses include only `env_keys` / `header_keys`; persisted values remain available to runtime execution. - **Manifest catalog references:** run manifest validation, graph rendering, preflight, and run creation now resolve server-managed MCP catalog references such as `[run.agent.mcps.<name>] id = "..."`. - **Schema strictness:** unknown MCP transport fields are rejected, aligning the reused Rust domain type with the OpenAPI `additionalProperties: false` contract. - **Create response headers:** the `POST /mcp-servers` 201 response now documents its `ETag` header in OpenAPI. ## Follow-up intentionally left out Credential-literal validation remains structural only: create/replace currently accept literal env/header values and persist them for runtime use. The warn-vs-hard-reject UX is a separate follow-up for the settings UI; it is not a response-omission issue. ## Testing Current PR checks are green: - Rust: format, clippy, generated docs, Linux tests - TypeScript: build, test, typecheck Local checks run during the simplify/CI-fix pass: - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo +nightly-2026-04-14 clippy --locked --workspace --all-targets -- -D warnings` - `cargo nextest run -p fabro-config run_agent_mcps` - `cargo nextest run -p fabro-mcp-store` - `cargo nextest run -p fabro-api --test mcp_server_round_trip` - `cargo build -p fabro-api` - `cargo nextest run -p fabro-server --features test-support system_sandbox_provider` - `cargo nextest run -p fabro-server --features test-support --test it mcp_servers` --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-30 15:06:24 -04:00
Scott Werner	c311b6c67f	feat(api): add /api/v1/mcp-servers OpenAPI endpoints (#522) ... ## What Adds the HTTP contract for managing server-defined MCP servers. The handler implementation follows in a later change. - New `/api/v1/mcp-servers` paths: `list`, `create`, `retrieve`, `replace`, `delete`, with ETag / `If-Match` optimistic concurrency mirroring the automations conventions. - New schemas: `McpServer`, `CreateMcpServerRequest`, `ReplaceMcpServerRequest`, `McpServerListResponse`. - **Collapsed a duplicate `McpTransport` schema** into the single canonical one and gave it a proper `discriminator` plus the previously-missing optional `protocol` field (`streamable_http` | `sse`). This also fixes a latent gap in the existing run-config projection and is non-breaking (`protocol` is `#[serde(default)]`). ## Testing - `cargo build -p fabro-api` is green — progenitor generates the client methods and types cleanly from the new spec. ## Notes / follow-ups for the handler change - Recommended `with_replacement` mapping (reuse, no parallel DTOs): `McpServer` → `McpServerDefinition`, create/replace → `McpServerDraft`/`McpServerReplace`, transport → existing `fabro_types::McpTransport`/`McpHttpProtocol`; list envelopes become small DTOs. - Parity caveat: progenitor emits `i64` for the `u64` timeouts and `i32` for the `u16 port`; harmless under `with_replacement`, but the handler change must add identity/JSON-parity tests and not skip `with_replacement` for those types. - `createMcpServer` returns ETag on 201 (Environments convention) so the UI gets the fresh revision. - The "warn vs hard-reject credential-looking literal values" question is recorded in the request-schema descriptions and intentionally not enforced. - Part of a short series adding server-managed MCP servers. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-25 15:50:13 -04:00
Adrian Muraru	a769336c39	feat(workflow): support overriding cwd for local sandbox provider (#467) ... ## Problem The `local` sandbox uses the run's `source_directory` (the CLI's cwd at invocation time) as its working directory and `create_dir_all`s it on the server (`LocalSandbox::initialize` in `fabro-sandbox`). That is correct when the CLI and the server share a host — the agent operates directly on the user's project tree. When the server is **remote** from the CLI — e.g. `fabro serve` running in a container in Kubernetes, driven over HTTP with the `local` sandbox — the client's cwd (e.g. `/Users/alice/project`) does not exist on the server. The sandbox then tries to create that path as the (often unprivileged) server user and fails at init: ``` sandbox.failed provider="local" error="Failed to create working directory" causes=["Permission denied (os error 13)"] ``` and the run dies with `workflow_error` before the agent starts. ## Fix When `source_directory` is absent or does not exist on the server, fall back to a server-writable `workspace` directory under the run's scratch dir instead of recreating the client path. **Same-host behavior is unchanged**: an existing `source_directory` is still used as-is. The selection is extracted into a small pure helper, `local_working_directory(source_directory, run_dir)`, so it can be unit-tested directly. ## Testing - `cargo test -p fabro-workflow local_working_directory` — 3 new tests (existing source dir → used; absent → fallback; present-but-missing-on-server → fallback) - `cargo check -p fabro-workflow` 🤖 Generated with [Claude Code](https://claude.com/claude-code) Thanks for fabro @brynary! --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-14 12:32:32 -04:00
Bryan Helmkamp	bc0bda73a6	feat(web): add server-managed Environments CRUD settings UI (#462) ... ## What Adds a CRUD interface for **server-managed Environments** at `/settings/environments`, driven by the `/api/v1/environments` REST API (list / create / retrieve / replace / delete), and reshapes how built-in environments are provisioned and protected. The page lives in the **Workflows** settings nav section (also introduced in this branch), positioned before Variables. ## Why The Environments REST API shipped (#453) but had no UI — environments could only be managed via the API/CLI. This gives operators a web UI alongside Variables and Secrets, and along the way tightens the model: environments are seeded at install time (not silently re-created on every boot), and the `default` fallback is an ordinary, deletable environment. ## Web UI **Pages & component** - `settings-environments.tsx` — list view: provider badge, image/resource summary, row actions (Edit/Delete). **"New environment" is a dropdown** of the enabled sandbox providers; the chosen provider is fixed for the environment's lifetime. - `settings-environments-new.tsx` / `settings-environments-edit.tsx` — create/edit flows; create reads the provider from a query param. - `environment-form.tsx` — shared form, reorganized: - **General** panel (merged identity + image): id, and an **image-source selector** (Image reference *vs* inline Dockerfile) that shows, requires, and sends only the selected, mutually-exclusive source. - **Resources**: CPU / memory / disk as **range sliders** (CPU 1–8, memory 1–16 GB, disk 1–20 GB), each always writing a concrete value. - **Environment variables** key/value editor. - **Advanced** progressive-disclosure section holding **Network** (a single "Block all network access" toggle — allow-all vs block) and **Lifecycle** (preserve / stop-on-terminal / auto-stop). Opens by default when any advanced value is non-default. - The in-form **provider control and the Labels editor were removed** — labels remain API-managed and are round-tripped untouched so UI edits never clear them. **Data layer**: `environmentsApi` client, `queryKeys.environments`, `useEnvironments` / `useEnvironment` SWR hooks. **Nav & routing**: "Environments" item in the Workflows section before Variables; routes registered in `router.tsx`. ## Backend: seed at install, deletable `default` - **Seeding moved to install time.** The server no longer seeds built-ins on startup; `EnvironmentStore::load_or_seed` → `load` (load-only). A new public `seed_environments(dir)` (idempotent, preserves operator edits) is called by both the web installer and the CLI installer. An uninstalled instance therefore has no managed environments, and a run selecting an absent environment fails explicitly (`unknown environment: default`) rather than resurrecting a built-in. - **`default` is no longer protected.** The delete guard and the `Protected` error variant are gone; deleting `default` succeeds (204) and removes the run fallback on purpose — forcing an explicit choice. `local` is unchanged (reserved, in-memory). - **`volumes` removed** from environment settings across the OpenAPI spec, generated Rust + TS clients, config layers, sandbox/server/workflow plumbing, docs, and tests. ## API contract details honored - Edit sends the environment `revision` as `If-Match`; 409 conflicts surface a "changed since you opened it" message. - The REST API accepts inline Dockerfiles only — the form never sends a Dockerfile path. ## Verification - Rust: `cargo build` (touched crates) ✅, `cargo nextest -p fabro-environment` 21/21 ✅, server env unit + `tests/it` integration 2/2 + 15/15 ✅, `clippy` (nightly, touched crates, all targets) clean ✅, `fmt --check` clean ✅. Full `--workspace` suite not run here — worth a CI pass. - Web: `bun run typecheck` ✅, `bun run build` ✅, `environment-form.test.ts` 5/5 ✅. Web suite: 512 pass / 1 unrelated pre-existing `RunDetail` failure. - **Not visually verified in-browser** — the local app is login-gated and automated loads redirect to `/login`; rendering of the form, the New-environment dropdown, and `default` delete should be confirmed in a logged-in session. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: fabro-sh-0530[bot] <281434857+fabro-sh-0530[bot]@users.noreply.github.com> Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Release Repro <release-repro@example.com>	2026-06-13 08:44:38 -04:00
Scott Werner	23d3644787	feat(llm): catalog-estimated completion cost on Response (#494) ... Standalone pre-OpenRouter step, pulled forward from the #438 triage (the gateway-refactor plan's "additive feature PR alongside the redo"): completion responses carry a USD cost with provenance. ## What's here **`Response.cost_usd` + `Response.cost_source`** — new optional fields (`skip_serializing_if` keeps the wire shape byte-identical when unset). `CostSource` (`authoritative` | `estimated`) lives in fabro-model's billing vocabulary next to `UsdMicros`/`TokenCounts`, since the API layer reuses it. **`fabro-llm/src/cost.rs`** — `estimate_cost_usd`, a thin wrapper over the existing `Catalog::price_tokens` billing machinery (billing-policy- and speed-aware), ported from #438's prototype with attribution. One fix over the prototype: model aliases and provider names are canonicalized before building the `ModelRef` — `ModelPricing::bill` rejects non-canonical refs, so the original would silently skip cost on alias requests (caught by a new test). **Client-level stamping** — one generic post-decode site instead of #438's ~8 per-adapter sites (which predate the codec refactor): `Client::complete` stamps blocking responses and `Client::stream` stamps `Finish` events, beneath the middleware chain so middleware observes final responses. Codecs stay wire-translation-only — zero wire-snapshot churn — and every registered adapter (including custom `register_provider` ones) gets the same treatment. Stamping never overwrites an existing cost, so future authoritative in-band costs (OpenRouter) take precedence by construction. **API surface** — `cost_usd`/`cost_source` on `CompletionResponse` (OpenAPI spec + handler + regenerated TS client). The streaming endpoint already carries cost implicitly since `Finish` events serialize the `Response` verbatim; this makes the blocking surface match. `CostSource` reuses the canonical fabro-model type via `with_replacement`, with the standard round-trip test pinning type identity and JSON parity. ## Deliberately not here (stays with the OpenRouter redo per the plan's hard rule) - Authoritative `usage.cost` parsing in the `openai_compatible` codec wire structs - Cached-token usage parsing (changes observable usage values) - Per-model `billing_policy` schema field ## Verification - `cargo nextest run --workspace --no-fail-fast`: 6701 passed; only the known 5 pre-existing environment-dependent fabro-workflow failures (identical on main) - All fabro-llm wire snapshots unmodified; new pins: cost estimation unit tests (incl. alias canonicalization), Client stamping tests (blocking, streaming, beneath middleware, no-catalog), fabro-api `CostSource` round-trip - clippy `-D warnings` + pinned-nightly fmt clean; `bun run typecheck` clean in fabro-web Independent of the route-vocabulary work in #493 — branches directly off main. After both land, the OpenRouter redo shrinks to config + typed codec params + authoritative-cost decode. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-06-11 16:55:47 -04:00
Bryan Helmkamp	a4e8987da8	feat(llm): add Claude Fable 5 support (#482) ... ## Summary Adds Anthropic Claude Fable 5 as a first-class Fabro model without changing the default Anthropic model. The catalog now exposes `claude-fable-5` with `fable` and `claude-fable` aliases, 1M context, 128k max output, effort levels, vision/tools, prompt caching, and the documented pricing. The Anthropic adapter now handles Fable's API behavior directly: it uses the `claude-fable-5` API ID, omits the legacy 1M context beta header, avoids injecting default `thinking`, preserves `output_config.effort`, omits deprecated `temperature`/`top_p` sampling fields for Fable, and rejects unsupported manual enabled/disabled thinking configs locally. Fable refusals are converted into content-filter LLM errors with `stop_details` preserved. Those refusal errors are fallback-eligible, so existing `run.model.fallbacks` chains work for both prompt and agent paths, while no-fallback refusals surface clearly as LLM errors. ## Live QA Manually exercised the PR branch against a live Anthropic API key from `~/.fabro.bak/.env.bak` using a temporary local harness that was removed before commit. The run covered non-streaming completion via `fable`, token counting via `claude-fable`, streaming completion, the deep model-test path with tools/reasoning, local rejection of manual thinking config, and a live refusal probe. The live run initially exposed Anthropic's Fable rejection of `temperature`; this PR now strips deprecated sampling fields for Fable and the live harness then passed 6/6 checks. ## Testing - `cargo test -p fabro-llm --test live_fable_manual -- --nocapture --test-threads=1` -> 6 passed against live Anthropic, temporary harness removed afterward - `cargo nextest run -p fabro-llm encode_fable_uses_api_id_effort_and_omits_1m_beta` - `cargo nextest run -p fabro-model -p fabro-llm -p fabro-workflow` -> 1808 passed, 41 skipped - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo insta pending-snapshots` -> no pending snapshots - `git diff --check` --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-06-10 14:01:56 -04:00
Scott Werner	d590122531	feat: chat-driven workflow builder at /playground (#450) ... ## Summary Adds a new `/playground` route where users build a Fabro workflow by chatting with Ask Fabro on the right while watching a live canvas re-render on the left. The workflow can be downloaded as a `.fabro.zip` or — eventually — launched as a real Fabro run; today the "Run for real" button POSTs to `/api/v1/runs` and redirects to the resulting `/runs/{id}` page, with a placeholder project/repo/folder picker. The feature is built as a standalone component subtree under `apps/fabro-web/app/components/playground/` with no `AppShell` or `react-router` dependencies, so it can be re-embedded in other contexts later by passing `chatEndpoint`, `authMode`, and an optional `realRunRedirect` prop. ## What changed **Frontend (`apps/fabro-web/`)** - New `/playground` route + `<Playground>` component tree. - Live SVG canvas via `@viz-js/viz` with click-to-inspect (read-only node detail panel), pan, zoom, fit-to-window, and a simulated walk through the graph driven by a Play button. - Docked chat sidebar (assistant-ui) wired to the new `/api/v1/playground/chat` endpoint, with auto-retry on parse failure and a playground-specific tool-call summary that reads `Wrote workflow.fabro (N nodes, M edges)`. - File tabs (`workflow.fabro` / `workflow.toml` / `README.md`), `.fabro.zip` download via `fflate`, and a "Run for real" toolbar button that POSTs an inline `RunManifest` to `/api/v1/runs`. - Draft persists across page refreshes via `localStorage`. **Backend (`lib/crates/fabro-server/`)** - New `POST /api/v1/playground/chat` SSE endpoint. Server is stateless across turns: each request carries the full draft, the server runs the LLM with a single `write_workflow_file` tool, streams `StreamEvent` frames back, and lets the client own diffing/animating the result into the canvas. - Request-size caps before the LLM call (50 messages, 100 nodes, 200 edges) so a misbehaving or malicious client can't drag multi-MB transcripts through token billing. **Spec / wire contract** - OpenAPI: new `playground/chat` operation + four new schemas (`CreatePlaygroundChatRequest`, `PlaygroundWorkflowDraft`, `PlaygroundWorkflowNode`, `PlaygroundWorkflowEdge`). - `lib/packages/fabro-api-client` not regenerated yet (the playground uses raw `fetch`); reviewers who want the TS client to pick up the new types can run `bun run generate` in that package. ## Key design decisions 1. **Single `write_workflow_file` tool, not six per-op tools.** The first cut exposed `add_node`/`update_node`/`connect`/etc. as discrete tool calls. The model would routinely add nodes without wiring them up, leaving the canvas in a broken half-state. Pivoted to a single tool that takes the full new `workflow.fabro` content; the browser parses the DOT, diffs it against the local draft, and animates the resulting reducer ops in. The model only has to "get the file right", and the canvas still paints node-by-node thanks to the client-side animator. 2. **Stateless server.** Each chat turn POSTs the full current draft; nothing is persisted server-side. Keeps the endpoint cheap, makes refresh-resumption trivial (browser owns the truth), and means the same endpoint can later sit behind a rate-limited anonymous variant without growing per-session state. 3. **Standalone component subtree.** `<Playground>` has no `AppShell`/router/store dependencies. All cross-cutting concerns flow in as props (`chatEndpoint`, `authMode`, `realRunRedirect`). This is the structural hook that makes future re-embedding possible without a refactor. 4. **Chat is the only mutation path.** Click-to-inspect on the canvas is read-only. Bi-directional canvas editing was explicitly cut from scope to keep one source of truth for "how the workflow changed." 5. **Inline `RunManifest` instead of temp-dir-then-clone.** The playground has no project to run against, so the `Run for real` modal builds a `RunManifest` that carries the full DOT and `workflow.toml` source inline (`workflows[key].{source, config}`). `cwd` is pinned to a fixed `/tmp/fabro-playground` constant — no LLM-controlled segment in a filesystem-looking field. 6. **React effects policy compliance.** All `useEffect` calls in playground component code go through the existing primitives in `app/hooks/effects.ts` (`useDocumentEvent`, `useInterval`) or a purpose-named hook (`useCanvasRender`). ## Still outstanding (planned follow-ups) - [ ] **Actually kicking off the ad-hoc run.** "Run for real" today POSTs a manifest with a placeholder project/repo/folder fieldset. The intent is to reuse the project-picker pattern being introduced on the in-flight automations branch — once that pattern lands, the disabled inputs in `run-for-real-modal.tsx` become the live surface. - [ ] **Header link to `/playground`.** No nav entry yet; users have to type the URL directly. - [ ] **Live SSE-driven canvas overlay** via `GET /api/v1/runs/{id}/attach` — currently the modal redirects to the standard run-view page; the "watch it build on the playground canvas" experience comes when the `stage.*` events are wired through. - [ ] **Regenerate `lib/packages/fabro-api-client`** so the new types ship to TS consumers. - [ ] **Smoke test:** end-to-end download → unzip → `fabro run <name>` round-trip. - [ ] **`scripts/build.ts` dist-symlink bug:** `pruneOldBuilds` can delete the directory `apps/fabro-web/dist` points at, which pins the dev server in 503 "build in progress" forever. Workaround documented; the real fix is a separate PR. ## Test plan - [ ] `cd apps/fabro-web && bun run test app/components/playground/` — 111 tests pass - [ ] `cd apps/fabro-web && bun run typecheck` — clean - [ ] `cargo test -p fabro-server playground` — 6 tests pass - [ ] Visit `/playground`; the canvas renders the welcome `start → ??? → exit` ghost. - [ ] Type "build me a release-notes workflow" in chat; nodes/edges animate in; ack reads `Wrote workflow.fabro (N nodes, M edges)`. - [ ] Click a node → inspector panel populates; click empty canvas → deselects. - [ ] Click `Simulate`; nodes light up `start → ... → exit` along the resolved path. - [ ] Click `Download .fabro`; unzip; `cd <unzipped> && fabro run <name>` runs locally. - [ ] Click `Run for real` → modal opens → confirm → POST succeeds → redirected to `/runs/{id}` → run executes. - [ ] Refresh the page; the draft persists from localStorage. - [ ] Click `Start over` → `Yes`; canvas resets to welcome state. --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-06-09 11:24:56 -04:00
fabro-sh-0530[bot]	fe1d33c041	Remove top-level automation enabled master gate (#456) ... The top-level `enabled` flag on automations created a confusing two-level activation model (automation-level + trigger-level). Since automations are brand new with no existing data to migrate, the master gate is removed entirely — trigger-level `enabled` is now the sole activation control. ## What changed **Domain model (`fabro-automation`):** `enabled` removed from `Automation`, `AutomationDraft`, `AutomationReplace`, and `PersistedAutomation`. `enabled_api_trigger()` no longer short-circuits on the automation flag. The `default_true()` helper is gone. A new test asserts that TOML with a top-level `enabled` key is rejected (no silent compatibility path). **Server handler:** Conflict detail updated from `"automation is disabled or has no enabled API trigger"` → `"automation has no enabled API trigger"`. The `disabled_automation_run_endpoint_returns_conflict_code` test is deleted; the trigger-disabled and missing-trigger tests remain as the authoritative inactive-run coverage. **OpenAPI + generated clients:** `enabled` removed from `Automation`, `CreateAutomationRequest`, and `ReplaceAutomationRequest` schemas and from the generated TypeScript interfaces. Trigger-level `enabled` on `AutomationApiTrigger` and `AutomationScheduleTrigger` is untouched. **Web UI:** `AutomationFormValues.enabled` and the "Enabled" toggle row are gone. `isFormValid` no longer requires at least one enabled trigger. `canRun` in the detail view is now just `apiTrigger?.enabled === true`. The `StatusChip` component is removed. The automations list uses a new `apiEnabled` field (derived from `hasEnabledApiTrigger`) to drive run-button state and tooltip copy. A shared `lib/automation.ts` helper centralises `findApiTrigger`, `findScheduleTrigger`, and `hasEnabledApiTrigger` to avoid repeated inline `.find()` calls across routes. ### Fabro Details <details> <summary>Ran 8 stages in 41m 34s for $17.84</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 15s | – | 0 | | preflight_lint | 2m 25s | – | 0 | | implement | 13m 0s | $9.25 | 0 | | simplify_opus | 9m 43s | $6.18 | 0 | | simplify_gpt | 3m 56s | $2.41 | 0 | | verify | 9m 17s | – | 0 | | **Total** | **41m 34s** | **$17.84** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh>	2026-05-29 22:18:14 -04:00
fabro-sh-0530[bot]	037073d2b2	feat: Add Environment REST CRUD API under /api/v1/environments (#453) ... ## Summary Adds a server-managed Environment CRUD API at `/api/v1/environments`, modeled after the existing Automations API and backed by `EnvironmentStore`. The API manages only server-side environment definitions in `environments/*.toml`; client-side catalogs (workflow, project TOML, run inputs) are unaffected. ### Plan Summary - **OpenAPI contract**: new `Environments` tag, `EnvironmentId` path parameter, five CRUD paths, list envelope, and REST-specific inline-only image schema (`EnvironmentApiImageSettings`) - **Server handler** (`environments.rs`): mirrors `automations.rs` — auth guard, ETag/If-Match, and `EnvironmentStoreError → ApiError` mapping - **Shared handler utilities**: `parse_required_if_match` and `json_with_etag_response` extracted from `automations.rs` into `handler/mod.rs` so both modules share them - **Inline-only Dockerfile enforcement**: `ApiDockerfileSource::Path` is parsed and immediately rejected with `422`; the file is never read - **Manifest refresh**: `refresh_manifest_run_settings_from_environment_catalog()` called after create, replace, and delete so `/system/info` and default run settings stay consistent - **Client regeneration**: TypeScript Axios client regenerated with `EnvironmentsApi` and new model files; Rust `fabro-api` type aliases updated - **Tests**: integration suite in `tests/it/api/environments.rs` covering all CRUD paths, error cases, and the manifest-refresh invariant; OpenAPI conformance test verifies generated surfaces ## Key Design Decisions **Inline-only Dockerfile at the REST boundary.** Allowing `path` sources over REST would let callers silently read arbitrary server-local files into the environment catalog. The handler recognizes the `path` discriminant so it can return a descriptive `422` rather than a generic parse error, but the payload is discarded via `IgnoredAny` — no disk access occurs. **Shared ETag utilities instead of per-handler helpers.** The original `parse_required_if_match` and ETag header builder in `automations.rs` were duplicated for environments. They're now generic over any `FromStr` revision type in `handler/mod.rs`, making future resource handlers cheaper to add. **`Environment` response type aliased to domain type.** The OpenAPI-generated `Environment` response struct is replaced with `fabro_environment::Environment` via `build.rs` `with_replacement`. A compile-time function-cast witness in `fabro-api/tests/environment_round_trip.rs` confirms the alias holds. Request types (`CreateEnvironmentRequest`, `ReplaceEnvironmentRequest`) stay API-specific because their image schema differs from the workflow/settings schema. **Stale revision → `409`.** Consistent with Automations; `428` is reserved for missing `If-Match` only. ### Fabro Details <details> <summary>Ran 8 stages in 59m 23s for $30.41</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 9s | – | 0 | | preflight_lint | 2m 25s | – | 0 | | implement | 25m 43s | $19.79 | 0 | | simplify_opus | 14m 34s | $6.98 | 0 | | simplify_gpt | 4m 39s | $3.64 | 0 | | verify | 9m 14s | – | 0 | | **Total** | **59m 23s** | **$30.41** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh>	2026-05-29 17:30:57 -04:00
fabro-sh-0530[bot]	4cff07373c	feat: add server-owned environment store (Task 1 & 2 foundation) (#446) ... ## Summary Moves environment definitions out of project/workflow TOML config and into server-owned files, introducing the `fabro-environment` crate and enforcing source-aware validation so project/workflow/user configs can no longer define environment catalogs. ### What changed **New `fabro-environment` crate** — workspace crate wired into `fabro-cli` and `fabro-server`. Exposes a `seeded_catalog_layer()` that CLI commands inject at the call site to fill the environment catalog that settings resolution requires. **Config environments are now migration-only** — `defaults.toml` no longer ships a built-in `[environments.*]` catalog. Instead: - `SettingsSource` enum tags every parsed layer (ActiveSettings, Project, Workflow, DirectRun, User). - `validate_settings_source` rejects `[environments.<id>]` in any source except `ActiveSettings` with a targeted message: `[environments.<id>] is now server-managed; move this definition to the server environments directory`. - TOML-provided `run.environment.{image,resources,network,lifecycle,labels,volumes,env}` overrides are also rejected; only `run.environment.id` survives. **New migration** (`2026052801_settings_environments_to_server_files`) — chains after the existing legacy-sandbox migration. Extracts `[environments.*]` entries from `settings.toml` into sibling `environments/<id>.toml` files, writes a `.settings-environments-migration.bak` backup, and fails without modifying any file if a target already exists. **Builder API additions** — `RunSettingsBuilder::load_from_with_catalog`, `load_default_with_catalog`, `from_toml_with_catalog` let callers inject a server-side catalog; the bare `from_toml` path now errors if no catalog is present and a named environment is selected. `WorkflowSettingsBuilder` test helpers in `src/tests/mod.rs` centralise catalog injection across all config tests. **`.fabro/project.toml`** — removed the inline `[environments.fabro-dev]` block (environment definition now lives server-side). ### Key design decisions - CLI offline commands (graph, preflight, validate) use `seeded_catalog_layer()` as a local stand-in until a running server is available — matches the pre-existing behaviour without regressing offline workflows. - `load_settings_path` no longer runs migrations for non-ActiveSettings sources, preventing project/workflow files from accidentally triggering file-system writes. - The `MigrationReport` type is now the new migration's `SettingsEnvironmentsMigrationReport` (exposes `contents: String` instead of a parsed layer), keeping `load.rs` simpler and decoupled from layer parsing. ### Fabro Details <details> <summary>Ran 9 stages in 143m 23s for $105.27</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 11s | – | 0 | | preflight_lint | 2m 23s | – | 0 | | implement | 28m 27s | – | 0 | | simplify_opus | 37m 27s | $53.28 | 0 | | simplify_gpt | 20m 50s | $12.14 | 0 | | verify | 6m 3s | – | 0 | | fixup | 45m 15s | $39.84 | 0 | | **Total** | **143m 23s** | **$105.27** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-28 17:10:59 -04:00
fabro-sh-0530[bot]	29a9a3f7d6	refactor: Remove inbound IP allowlisting (#443) ... ## Summary Removes Fabro's in-process inbound source-IP allowlist entirely. `[server.ip_allowlist]` and `[server.integrations.github.webhooks.ip_allowlist]` are gone from config parsing, resolved settings types, the OpenAPI spec, generated API clients, and the Settings > Security UI. Existing `settings.toml` files containing those keys now fail as unknown fields — this is a hard removal with no migration path. Network source restrictions should be enforced upstream via a reverse proxy, firewall, VPN, Tailscale ACLs, Kubernetes ingress, or platform policy. ### What changed - **Config/types** (`fabro-config`, `fabro-types`): Removed `ServerIpAllowlistLayer`, `ServerIpAllowlistOverrideLayer`, `ServerIpAllowlistSettings`, `ServerIpAllowlistOverrideSettings`, `IpAllowEntry`, associated resolver functions, GitHub `/meta` hook-range parsing, and Unix socket trusted-proxy validation. `ipnet` dropped from `fabro-types`; kept in `fabro-config` for sandbox CIDR validation. - **Server runtime** (`fabro-server`): Deleted `ip_allowlist.rs`, removed `IpAllowlistConfig` parameter from `build_router_with_options` and `RouterOptions`, removed the global allowlist middleware layer, and removed `GitHubMetaResolver` startup logic. GitHub webhook HMAC verification is unchanged. - **OpenAPI + generated clients**: Removed `ServerIpAllowlistSettings`, `ServerIpAllowlistOverrideSettings`, `IpAllowEntry`, `LiteralIpAllowEntry`, `GitHubMetaHooksEntry` schemas; removed `ip_allowlist` from `ServerNamespace` and `IntegrationWebhooksSettings`; dropped `IpAllowEntry` re-exports from `fabro-api`. - **Web UI**: Removed IP allowlist row from Settings > Security; updated nav description and page copy. - **Docs/changelog**: Security docs explicitly state Fabro provides no source-IP filtering and direct operators upstream. Changelog entry dated 2026-05-27 documents the breaking removal and annotates the 2026-04-19 entry where the feature was introduced. ### Also in this diff (unrelated to IP allowlisting) The worker control stream was migrated from reading newline-delimited JSON on stdin to a reconnecting WebSocket (`/api/v1/runs/{id}/worker/control-stream`). This adds `tokio-tungstenite` to `fabro-cli`/`fabro-server`, introduces `WorkerControlManagerHandle` with backoff reconnection and deduplication of replayed delivery IDs, and adds `RunPause`/`RunUnpause` message handling. A new integration test (`detached_run_cancel_reaches_worker_over_control_websocket`) exercises the full cancel path over the WebSocket. ### Key decisions - **Hard removal via `deny_unknown_fields`**: stale config is immediately visible as a startup error rather than silently ignored. - **No stub or default pass-through**: `IpAllowlistConfig::default()` is gone, not left as a no-op wrapper, to avoid keeping the feature shape alive. - **Webhook HMAC boundary unchanged**: source-IP filtering on webhook routes is removed; cryptographic signature verification remains the security boundary. ### Fabro Details <details> <summary>Ran 9 stages in 59m 53s for $27.24</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 15s | – | 0 | | preflight_lint | 2m 22s | – | 0 | | implement | 33m 54s | $22.81 | 0 | | simplify_opus | 5m 55s | $0.75 | 0 | | simplify_gpt | 3m 35s | $2.81 | 0 | | verify | 8m 34s | – | 0 | | fixup | 2m 24s | $0.87 | 0 | | **Total** | **59m 53s** | **$27.24** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh>	2026-05-27 22:29:08 -04:00
fabro-sh-0530[bot]	ee1502f793	Add automation run materialization core and shared run creation helper (#441) ... ## Summary Automation-triggered runs need to share the same run creation pipeline as `POST /runs`. This PR lays the core infrastructure: a `create_run_from_manifest` helper that the HTTP handler and the upcoming automation scheduler can both call, plus a `AutomationRunMaterializer` trait with a production implementation that clones a GitHub repo and builds a `RunManifest` from it. ### Plan Summary - Extract the body of `handler/runs.rs::create_run` into a crate-private `create_run_from_manifest(state, CreateRunFromManifestRequest)` helper; `POST /runs` calls it with `automation: None`, preserving existing behavior. - Add `AutomationRunMaterializeInput/Materialized/Error` types and the `AutomationRunMaterializer` trait (`automation_materializer.rs`). - Implement `ProductionAutomationRunMaterializer`: validates `owner/repo` slug, shallow-clones via `tokio::process::Command` argv (never shell strings), sets `GIT_TERMINAL_PROMPT=0`, enforces per-operation timeouts, redacts credentials from error text, resolves the workflow with `fabro_config::project::WorkflowLocation::resolve`, and builds a `RunManifest` via `fabro_manifest::build_run_manifest`. - Add `TestAutomationRunMaterializer` (gated on `test` or `test-support`) for fake injection in route tests without network access. - Wire the materializer override into `AppState` and `AppStateConfig` behind `#[cfg(any(test, feature = "test-support"))]`; expose via `TestAppStateBuilder::automation_materializer`. - Move `async-trait` from `[dev-dependencies]` to `[dependencies]` in `fabro-server` since the trait is now in production code. ## What changed and why **`automation_materializer.rs` (new)** — Core of this PR. The `GitCommandPlan` builder keeps all git invocations as argv slices so there is no shell injection surface. Credentials are injected exclusively via `GIT_CONFIG_VALUE_0` (the `extraheader` mechanism), never embedded in the clone URL, so they cannot appear in run metadata or error messages. The `redact_git_output` function scrubs the raw token, the Base64-encoded form, and the full `AUTHORIZATION` header value from any error string before it surfaces. **`create_run_from_manifest`** — The extracted helper accepts an optional `AutomationRef` which is forwarded into `create_input.automation` so the store can persist automation provenance on the run. The `POST /runs` code path passes `None`, leaving existing API behavior identical. **Test injection** — `TestAutomationRunMaterializer` captures every `AutomationRunMaterializeInput` it receives and returns a caller-controlled `Result`, letting route tests assert what inputs the scheduler would pass without touching GitHub. ```mermaid flowchart TB A["POST /runs\n(HTTP handler)"] -->|automation: None| H["create_run_from_manifest"] S["Automation scheduler\n(future issue)"] -->|automation: Some(ref)| H H --> DB[(Run store)] M["AutomationRunMaterializer\n(trait)"] -->|produces RunManifest| S M -- production --> P["ProductionAutomationRunMaterializer\n(git clone → manifest build)"] M -- test --> T["TestAutomationRunMaterializer\n(captures input, returns fixture)"] ``` ### Fabro Details <details> <summary>Ran 8 stages in 72m 56s for $36.55</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 2s | – | 0 | | preflight_compile | 2m 12s | – | 0 | | preflight_lint | 2m 27s | – | 0 | | implement | 30m 41s | $23.10 | 0 | | simplify_opus | 19m 19s | $9.12 | 0 | | simplify_gpt | 7m 53s | $4.33 | 0 | | verify | 9m 20s | – | 0 | | **Total** | **72m 56s** | **$36.55** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh>	2026-05-27 20:14:56 -04:00
fabro-sh-0530[bot]	c767db897f	Add Automations API contract to OpenAPI spec and update generated clien… (#436) ... ## Summary Defines the public Automations REST API contract in the OpenAPI spec, updates the `RunSandbox` schema to reflect the new sandbox lifecycle model, adds `fabro-automation` as a dependency to `fabro-api` for type reuse, and removes the retired `fabro-devcontainer` crate and all references to it. ## What changed ### Automations API (`fabro-api.yaml`) Seven new paths under `/api/v1/automations` covering the full CRUD surface plus run sub-resources: ``` GET/POST /automations GET/PUT/DELETE /automations/{id} GET/POST /automations/{id}/runs ``` New schemas: `Automation`, `AutomationTarget`, `AutomationTrigger` (discriminated oneOf on `type`), `AutomationApiTrigger`, `AutomationScheduleTrigger`, `CreateAutomationRequest`, `ReplaceAutomationRequest`, `AutomationListResponse`. Key contract decisions: - `AutomationTrigger` uses an OpenAPI discriminator (`propertyName: type`); unknown discriminator values → HTTP 422, not 400. - `PUT` and `DELETE` require an `If-Match` header (428 if absent, 409 on mismatch); `GET` and `PUT` responses carry an `ETag`. - `POST /automations/{id}/runs` fires the automation's enabled API trigger; 409 if the automation is disabled or lacks one. - Run sub-resource responses reuse the existing `Run` and `PaginatedRunList` schemas. ### `RunSandbox` schema refactor The sandbox schema is restructured to express the full lifecycle rather than only the ready state: | Before | After | |---|---| | Flat object with `provider`, `image`, `snapshot`, `runtime` | Discriminated by `kind`: `planned`, `initializing`, `ready`, `failed` | | `runtime` was nullable | Moved into `RunSandboxInstance` (non-nullable); present only when `kind = ready` | | No failure detail | New `RunSandboxFailure` schema with `error`, `causes`, `duration_ms` | `SandboxDetails.sandbox` now references `RunSandboxInstance` (the ready state), which preserves the existing shape for the details endpoint while the richer `RunSandbox` type appears on run responses. ### Web UI (`run-sandbox-lifecycle.ts`) New helper module that bridges the old flat-object sandbox wire shape and the new lifecycle-keyed shape, with display metadata for each lifecycle state. Consumers (`RunSummaryPanel`, `TerminalView`, `RunSandbox` route, `run-detail` header/tabs) updated to route through these helpers so both old and new wire shapes are handled transparently. ### `fabro-devcontainer` removal The `fabro-devcontainer` crate is removed from `Cargo.lock`, `AGENTS.md`, nextest config, and all doc references. Public-facing changelog entries for devcontainer-specific features are removed or retitled. ### Plan Summary - Add Automations CRUD + run sub-resource paths and schemas to the OpenAPI spec - Restructure `RunSandbox` schema to model lifecycle states (`planned → initializing → ready | failed`) - Add `fabro-automation` dependency to `fabro-api` for domain-type reuse; add JSON parity round-trip tests - Regenerate Rust API types and TypeScript client - Remove `fabro-devcontainer` crate and all references - Add `run-sandbox-lifecycle.ts` helper module in the web UI and update all sandbox-state consumers ### Fabro Details <details> <summary>Ran 9 stages in 83m 29s for $35.47</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 22s | – | 0 | | preflight_lint | 2m 40s | – | 0 | | implement | 45m 36s | $28.67 | 0 | | simplify_opus | 7m 46s | $2.46 | 0 | | simplify_gpt | 6m 7s | $3.92 | 0 | | verify | 12m 8s | – | 0 | | fixup | 5m 52s | $0.43 | 0 | | **Total** | **83m 29s** | **$35.47** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh>	2026-05-27 14:07:01 -04:00
Bryan Helmkamp	e18772888e	Model run sandbox lifecycle explicitly (#431) ... ## Summary Fixes sandbox state reporting by separating a requested sandbox plan from an initialized sandbox instance. Runs now project sandbox lifecycle as `planned`, `initializing`, `ready`, or `failed`, and live sandbox operations only proceed once a real instance exists. ## Changes - Introduces `RunSandboxPlan`, `RunSandboxInstance`, and lifecycle-backed `RunSandbox` domain types, with serde validation that prevents `ready` sandboxes without an instance. - Updates store projection behavior so sandbox events transition through planned, initializing, ready, and failed states while preserving requested provider/image/snapshot separately from runtime metadata. - Tightens server sandbox handlers so details/files/services/terminal/VNC helpers require an initialized instance and return a clear 404 when the sandbox was never created. - Updates the OpenAPI contract and regenerated clients so `Run.sandbox` exposes lifecycle state while `SandboxDetails.sandbox` contains only initialized instance metadata. - Updates the web UI to render lifecycle state directly from run summaries, hide the Sandbox tab for pure planned sandboxes, and disable sandbox controls until the instance is ready. - Cleans up duplicated lifecycle display/type logic and duplicate server-side sandbox instance loading found during review. | Lifecycle state | Meaning | Live controls | | --- | --- | --- | | `planned` | Sandbox was requested but no provider instance exists | Hidden/disabled | | `initializing` | Provider setup has started | State view only | | `ready` | Runtime instance exists | Enabled | | `failed` | Provider setup failed with error details | State view only | ## Testing - `cargo check --workspace` - `cargo +nightly-2026-04-14 fmt --check --all` - `git diff --check` - `cd apps/fabro-web && bun run typecheck` - `cd apps/fabro-web && bun test app/routes/run-detail.test.ts app/routes/run-sandbox.test.tsx app/components/run-summary-panel.test.tsx` - `cargo nextest run -p fabro-types --test sandbox_model_serde` - `cargo nextest run -p fabro-store run_created_projects_planned_sandbox_lifecycle sandbox_lifecycle_events_update_projected_sandbox_state run_failed_before_sandbox_events_leaves_sandbox_planned` - `cargo nextest run -p fabro-server planned_sandbox_returns_404_from_details_endpoint planned_sandbox_rejects_live_operations failed_sandbox_rejects_live_operations local_sandbox_returns_provider_neutral_details` - `cargo nextest run -p fabro-api --test run_sandbox_round_trip` - `cargo nextest run -p fabro-api --test sandbox_details_round_trip` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex)	2026-05-27 12:48:56 -04:00
Bryan Helmkamp	e13de9faaf	feat(automation): persist automation refs on runs (#428) ... ## Summary Adds durable automation metadata to workflow runs so automation-triggered runs can carry their automation and trigger references through creation, stored events, projections, summaries, fork, retry, and API surfaces. This also introduces the new `fabro-automation` crate with typed automation IDs, TOML parsing/validation, revision hashing, and a file-backed automation store. The store avoids overwriting malformed existing TOML files on create and keeps read access from being blocked by mutation disk I/O. ## Changes - Add `AutomationRef` propagation through `RunSpec`, `run.created`, store projections, summaries, fork, retry, and related tests. - Add `fabro-automation` domain/store crate for automation TOML definitions, trigger validation, revisions, create/replace/delete, and load behavior. - Update OpenAPI and regenerated TypeScript client types for `RunSpec.automation` and `AutomationRef.trigger_id`. - Add API/type regression coverage for the new automation fields. - Harden automation store create semantics so skipped malformed files still reserve their path. ## Verification - `cargo nextest run -p fabro-automation` - `cargo +nightly-2026-04-14 clippy -p fabro-automation --all-targets -- -D warnings` - `cargo nextest run -p fabro-api` - `cargo nextest run -p fabro-types run_spec_round_trips_templated_settings run_created_props_round_trip_templated_settings` - `cd lib/packages/fabro-api-client && bun run typecheck` - `cargo +nightly-2026-04-14 fmt --check --all` - `git diff --check`	2026-05-27 11:52:57 -04:00
Bryan Helmkamp	ec1b3f2084	feat(sandbox): secure daytona snapshot names (#429) ... ## Summary Secures Daytona custom snapshot creation by removing user-controlled snapshot/image references and replacing them with deterministic names Fabro computes internally. Docker image selection now uses `image.docker`, while Daytona only accepts `image.dockerfile` for custom snapshots and continues to use `daytona-medium` when no Dockerfile is configured. ## Changes - Replaces public `image.ref` config/API shape with Docker-specific `image.docker` across Rust settings, OpenAPI, generated TypeScript client, docs, defaults, examples, and web samples. - Adds Daytona snapshot identity generation using HMAC-SHA256 over a canonical manifest keyed by the Daytona API key, producing `fabro-<uuid>` snapshot names without exposing Dockerfile text or key material. - Routes Daytona custom Dockerfiles, including devcontainer-generated Dockerfiles, through the same computed identity path before calling Daytona snapshot APIs. - Updates sandbox initialization events and store projections so initialized run state can show the resolved image and computed Daytona snapshot after startup. - Updates legacy config migration behavior so Docker image refs map to `image.docker`, while Daytona legacy snapshot names are not preserved. ## Breaking Changes - `image.ref` is no longer accepted in new environment config. - Docker environments should use `image.docker` for image selection. - Daytona environments reject `image.docker`; use `image.dockerfile` to request a custom computed snapshot. ## Verification - `cargo build -p fabro-api` - `cd lib/packages/fabro-api-client && bun run generate` - `cd lib/packages/fabro-api-client && bun run typecheck` - `cd apps/fabro-web && bun run typecheck` - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings` - `ulimit -n 4096 && cargo nextest run --no-fail-fast -p fabro-cli -p fabro-config -p fabro-sandbox -p fabro-workflow -p fabro-store -p fabro-server -p fabro-api` - `cargo insta pending-snapshots` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex)	2026-05-27 11:52:35 -04:00
Bryan Helmkamp	b1bd2f522c	feat(server): add variables API (#430) ... ## Summary Adds a workflow-visible variables store and HTTP API for managing non-sensitive run variables, then wires those variables into run config interpolation before run creation, validation, and preflight. ## What Changed - Adds `/api/v1/variables` CRUD endpoints backed by a JSON variable store and generated Rust/TypeScript API types. - Supports `{{ vars.NAME }}` interpolation alongside existing `{{ env.NAME }}` handling for run-owned config fields, including environment, MCP, hook, artifact, checkpoint, SCM, and notification settings. - Reuses canonical `fabro-types` variable DTOs in `fabro-api` and adds OpenAPI name patterns so clients see the same env-style variable contract enforced by the server. - Keeps variable updates store-owned with `update_existing`, avoiding duplicated not-found/update semantics in the HTTP handler. - Shares env-style name validation between variables, interpolation parsing, and vault token names to avoid grammar drift. Variables are intentionally non-sensitive: list/get responses include values, unlike vault secrets. ## Validation - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo test -p fabro-types` - `cargo test -p fabro-variable` - `cargo test -p fabro-api --test variable_round_trip` - `cargo test -p fabro-server --features test-support --test it api::variables` - `cargo +nightly-2026-04-14 clippy -p fabro-types -p fabro-variable -p fabro-vault --all-targets -- -D warnings` - `cargo +nightly-2026-04-14 clippy -p fabro-server --features test-support --all-targets -- -D warnings` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex/)	2026-05-27 11:46:36 -04:00
Bryan Helmkamp	ab0f94fd82	feat(system): report runtime integration status (#416) ... ## Summary Settings > Integrations now reflects the server's actual integration readiness instead of only static `settings.toml` booleans. This adds `/api/v1/system/integrations` as the runtime source of truth, covering server config, vault credential presence, and Slack Socket Mode connection state. ## What Changed - Added shared `fabro-types` integration status models and reused them from `fabro-api` to avoid duplicate API/domain types. - Added `GET /api/v1/system/integrations` to the OpenAPI spec, Rust server routes, demo routes, and generated TypeScript client. - Reports GitHub and Slack status as `disabled`, `missing_credentials`, `configured`, `connecting`, `connected`, or `error`, with non-secret metadata and missing credential names. - Tracks Slack Socket Mode runtime state from the Slack connection loop and respects explicit `server.integrations.slack.enabled = false` even when vault tokens exist. - Updated the Integrations settings page to read the new runtime endpoint, so a vault-configured Slack setup no longer appears simply as disabled. ## Verification - `cargo build -p fabro-api` - `cargo nextest run -p fabro-api system_integrations` - `cargo nextest run -p fabro-config resolved_server_integrations_are_slack_only_for_chat` - `cargo nextest run -p fabro-slack run_event_loop_notifies_connected_status` - `cargo nextest run -p fabro-server --features test-support --test it get_system_integrations` - `cargo nextest run -p fabro-server` - `cargo +nightly-2026-04-14 fmt --check --all` - `cd apps/fabro-web && bun test app/routes/settings-integrations.test.tsx app/lib/query-keys.test.ts` - `cd apps/fabro-web && bun run typecheck` - `cd apps/fabro-web && bun run build` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex)	2026-05-26 19:27:32 -04:00
fabro-sh-0530[bot]	bd72570437	Add provider-backed sandbox inventory API and rename SandboxProvider to… (#409) ... ## Summary Exposes `GET /api/v1/sandboxes` and `GET /api/v1/sandboxes/{id}` endpoints that query sandbox inventory directly from configured providers (Docker, Daytona), independent of run projections. Also renames the existing `SandboxProvider` enum to `SandboxProviderKind` throughout the codebase to free the name for the new `SandboxProvider` trait. ### Plan Summary - **OpenAPI + types**: New `SandboxInfo`, `SandboxListResponse`, `SandboxListMeta`, `SandboxProviderLookupError`, and `SandboxProviderKind` schemas added to the API spec; canonical Rust DTOs added to `fabro-types`. - **Provider trait and registry**: `SandboxProvider` trait (`list`, `get`, `create`, `delete`) and `SandboxProviderRegistry` introduced in `fabro-sandbox/src/provider.rs`. Registry fans out calls across all configured providers and implements fail-soft semantics for list and conflict/unavailable detection for get. - **Provider implementations**: `DockerSandboxProvider` uses Bollard label-filtered container listing and per-inspect; `DaytonaSandboxProvider` uses the SDK with paginated label-filtered listing. Both verify `sh.fabro.managed=true`. - **Shared detail mapping**: Docker and Daytona inspect-to-`SandboxInfo` paths extracted into `docker_info_from_inspect` / `daytona_info_from_sdk_sandbox` so run-scoped `SandboxDetails` and inventory `SandboxInfo` share the same normalization logic. - **Monitoring UI**: `RunsInfo` now exposes `scheduler_slots_used`; the monitoring panel displays "slots used" instead of the raw active-run count. ## What changed and why **`SandboxProvider` → `SandboxProviderKind`** is a mechanical rename across ~20 call sites so the unqualified name `SandboxProvider` can be claimed by the new trait without collision. **Registry lookup semantics** for `get_managed_by_native_id`: | Outcome | HTTP | |---|---| | Exactly one provider matches | `200` | | All providers succeed, none match | `404` | | Two or more providers match the same id | `409` | | No match + at least one provider failed | `502` | List is always fail-soft: partial results are returned and failing providers appear in `meta.provider_errors`. **`DockerFields` / `DaytonaFields` structs** were introduced inside `details.rs` to hold the shared normalization output. Both `map_docker_inspect` (run-scoped) and `docker_info_from_inspect` (inventory) now delegate to `docker_fields_from_inspect`, eliminating duplicate field-extraction logic. Same pattern for Daytona. **`futures` moved from optional to unconditional** in `fabro-sandbox/Cargo.toml` because `join_all` / `try_join_all` are now used in `provider.rs`, which is not feature-gated. **`local` provider** intentionally returns an empty list and `None` for get — it has no provider-managed inventory. ### Fabro Details <details> <summary>Ran 8 stages in 102m 54s for $41.81</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 6s | – | 0 | | preflight_lint | 2m 20s | – | 0 | | implement | 56m 40s | $10.82 | 0 | | simplify_opus | 27m 50s | $26.24 | 0 | | simplify_gpt | 5m 2s | $4.76 | 0 | | verify | 8m 24s | – | 0 | | **Total** | **102m 54s** | **$41.81** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh>	2026-05-25 22:41:57 -04:00
fabro-sh-0530[bot]	2c0416e1c5	feat: add server sandbox provider enablement policy (#389) ... Operators can now disable individual sandbox providers at the server level via `[server.sandbox.providers.<provider>]` in `settings.toml`, without breaking existing deployments that omit the section entirely. ## What changed **Config layer & resolution** (`fabro-config`, `fabro-types`): new sparse `ServerSandboxLayer` / `ServerSandboxProvidersLayer` / `ServerSandboxProviderLayer` structs with `deny_unknown_fields` parse validation. Resolution defaults every missing level to `enabled = true`. The resolved `ServerSandboxSettings` / `ServerSandboxProvidersSettings` / `ServerSandboxProviderSettings` types live in `fabro-types` and are shared by all consumers. **Policy enforcement** (`fabro-server`): three check points enforce the effective provider (after dry-run Local coercion): 1. `POST /api/v1/runs` — 400 at admission. 2. `POST /api/v1/runs/preflight` — `ok: false` with a `Sandbox Provider Policy` error check. 3. Launch (`execute_run_in_process` / `execute_run_subprocess`) — fail-before-execution with a `LaunchFailed` reason. The dry-run coercion logic was extracted into `SandboxProvider::effective_for(mode)` on the type itself and reused across `fabro-server` and `fabro-workflow`. **Installer** (`fabro-install`): `write_sandbox_settings` now always writes all three provider policy tables with `enabled = true`, so generated `settings.toml` files are self-documenting. **API schema & clients**: `ServerNamespace` gains a required `sandbox` field in the OpenAPI spec; three new TypeScript model files were regenerated accordingly. ### Plan Summary - Task 1: config layer structs → resolved types → resolver helpers → tests - Task 2: `effective_sandbox_provider` + `sandbox_provider_policy_error` helpers; admission, preflight, and launch checks + integration tests - Task 3: installer writes all three provider entries; install finish tests updated - Task 4: OpenAPI schema, `fabro-api` build mappings, TS client regeneration, docs ### Fabro Details <details> <summary>Ran 8 stages in 59m 15s for $45.70</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 5s | – | 0 | | preflight_lint | 2m 21s | – | 0 | | implement | 27m 55s | $38.88 | 0 | | simplify_opus | 14m 20s | $4.93 | 0 | | simplify_gpt | 3m 14s | $1.88 | 0 | | verify | 8m 49s | – | 0 | | **Total** | **59m 15s** | **$45.70** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-24 16:49:05 -04:00
fabro-sh-0530[bot]	7d655d7c95	feat: expose effective agent tool list via StageProjection.agent_tools (#388) ... ## Summary Adds `StageProjection.agent_tools` — a replay-authoritative list of every tool the model can actually call — so UI and API consumers no longer have to infer tool availability from `permission_level`. The field is populated by a new `agent.tools.available` durable event emitted once per stage session after provider-profile setup, MCP integration, and access-policy filtering are complete. ### Plan Summary - **Types (`fabro-types`)** — new `AgentToolSummary`, `AgentToolSource`, `AgentToolCategory`, `AgentToolsAvailableProps`, and `EventBody::AgentToolsAvailable`; `agent_tools: Vec<AgentToolSummary>` added to `StageProjection` with skip-serializing-if-empty semantics. - **Tool registry (`fabro-agent`)** — `ToolSource::Mcp` gains `original_name` (no more re-parsing the qualified name downstream); `ToolDefinitionWithSource::to_agent_tool_summary()` maps to the public DTO; `Session::effective_tools()` / `agent_tool_summaries()` expose the filtered list; `tool_category` split into `tool_category` (CLI gate, defaults `Shell`) and `known_tool_category` (projection, returns `None` → `Other` for unknown tools). - **Projection reducer (`fabro-store`)** — `AgentToolsAvailable` replaces the stage's `agent_tools`; `AgentToolStarted` flips `invoked = true` on the matching entry; legacy runs without the event get an empty list. - **OpenAPI + generated clients** — `AgentToolSummary`, `AgentToolSource`, `AgentToolCategory`, `AgentToolsAvailableProps` schemas added; `StageProjection.agent_tools` field added; `build.rs` replacements wire them to the `fabro-types` structs. - **Web sidebar** — new collapsible "Tools" section renders name, description, source/category badge, and used/available state from `stage.agent_tools`; `permission_level` is kept as secondary fallback metadata for legacy stages. ## Key design decisions - **`agent_tools`, not `tools`** — avoids ambiguity with MCP nested tools and completion API tool definitions. - **Dedicated `agent.tools.available` event** — cleaner than overloading `agent.session.activated`; replacement semantics on replay mean re-emission works if tool registration ever becomes mutable. - **`original_name` carried in `ToolSource::Mcp`** — stored by the MCP integration at registration time so the projection never needs to re-parse qualified names like `mcp__filesystem__read_file`. - **`invoked` is projected state, not event state** — the availability event always emits `false`; replay of `agent.tool.started` flips matching entries. - **Parameter schemas omitted** — `AgentToolSummary` carries only `name`, `description`, `source`, `category`, and `invoked` to keep payloads small and avoid exposing implementation detail. - **`AgentToolCategory::Other` for unknown tools** — unlike the CLI permission gate (which defaults to `Shell` to require approval), the projection uses `Other` to surface unrecognized MCP/skill tools accurately. ### Fabro Details <details> <summary>Ran 8 stages in 56m 37s for $58.75</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 0s | – | 0 | | preflight_lint | 2m 15s | – | 0 | | implement | 22m 54s | $42.64 | 0 | | simplify_opus | 16m 41s | $10.62 | 0 | | simplify_gpt | 3m 43s | $5.49 | 0 | | verify | 8m 33s | – | 0 | | **Total** | **56m 37s** | **$58.75** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-24 16:41:55 -04:00
Bryan Helmkamp	e1ea4ebb9d	Fix verification fixture drift	2026-05-24 12:14:59 -04:00
Bryan Helmkamp	846d1e91af	Polish stage insights sidebar ... - Track which MCP servers the agent invoked. New `invoked: bool` on `McpServerProjection` (OpenAPI + Rust type + generated TS client), set by the projector when an `AgentToolStarted` event has an `mcp__<server>__*` tool_name. UI shows `used/total` in the section header, replaces the tool count with `used` on invoked rows, and dims rows that weren't invoked. Sticky across status re-reads. - Quiet noisy context-window warnings. When the snapshot's total is provider-authoritative (ProviderApiScaledBreakdown or ResponseUsageScaledBreakdown), drop local-estimator warning codes from the snapshot — they imply the user-facing total is wrong when it isn't. Also dedupe by code so a 35-turn conversation with opaque reasoning blocks no longer surfaces 35 copies of the same warning. - Reword the legitimately-local warnings. "opaque provider context estimated from JSON" → "Some content couldn't be precisely tokenized; total is approximate." Same treatment for the media, provider-options, and whole-request local-estimate messages. - Rename the sidebar header from "INSIGHTS" to "AGENT" to better describe what it shows. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-23 23:34:24 -04:00
fabro-sh-0530[bot]	39fa73d5e2	Add context-window snapshot API for agent stages (#378) ... ## Summary Adds a best-effort `GET /api/v1/runs/{id}/stages/{stageId}/context-window` endpoint that exposes model-visible input-token usage, broken down by category (system prompt, tools, MCP tools, skills, memory, conversation, other). The endpoint degrades gracefully: it returns a stored projection snapshot when the stage is inactive, and `available: false` when no snapshot has ever been observed rather than surfacing count gaps as HTTP errors. ### Plan Summary - **Unit 1** – OpenAPI schemas (`StageContextWindow`, `StageContextWindowProjection`, breakdown/enum types) and generated Rust + TypeScript clients, with `fabro-api` build-time type replacements pointing at the hand-written `fabro-types` structs. - **Unit 2** – `ToolSource` enum on `RegisteredTool` (Native / Mcp / Skill) + `ToolDefinitionWithSource`; new `context_window.rs` builder in `fabro-agent` that assembles a content-free category breakdown at request-assembly time; `fabro-llm::token_count` narrow public helpers (`estimate_message_tokens`, `estimate_tool_definition_tokens`, `estimate_request_control_tokens`). - **Unit 3** – `AgentEvent::ContextWindowSnapshot` carries a `StageContextWindowProjection`; the session emits a local snapshot immediately, then a provider-scaled replacement (or response-usage-scaled replacement) asynchronously; fingerprinting prevents double-counting the same request. - **Unit 4** – Server endpoint (stubbed routing; full handler targets a follow-up) returning the latest projected snapshot. - **Unit 5** – `queryKeys.runs.stageContextWindow`, `useRunStageContextWindow` hook, and SSE invalidation for `agent.context_window.snapshot` and all stage-lifecycle events. ### Key design decisions **Agent-side counting, not server-side.** The exact `fabro_llm::Request` only exists inside the active agent session. Rather than moving raw prompt/message content into server-managed state, the session counts the request it already has and emits content-free projection events. The HTTP endpoint just reads the latest durable snapshot. **Hybrid category ownership.** `fabro-agent` owns the category taxonomy (it sees memory documents, skills, MCP registration, and session history); `fabro-llm` exposes narrow estimation helpers. Neither crate leaks the other's concerns. **Provider count is async and non-blocking.** A spawned task calls `Client::count_input_tokens(..., PreferProvider)` with a clone of the request. It is cancelled via `close_token` when the session closes. Failures produce a warning on the snapshot, not a stage error. **`available: false` instead of 4xx for known-but-unobserved stages.** The sidebar needs stable empty states; HTTP errors only mean the run or stage doesn't exist. ```mermaid flowchart TB A[Session::build_request] --> B[build_local_snapshot\nLocalEstimate] B --> C[emit ContextWindowSnapshot] C --> D{provider count\nspawned task} D -- success --> E[scaled_snapshot\nProviderApiScaledBreakdown] D -- failure --> F[warning appended to local snapshot] E --> G[emit ContextWindowSnapshot] G --> H[run_state reducer\nupdates StageProjection.context_window] F --> H H --> I[GET context-window endpoint\nreturns projection] ``` **`ToolSource` on every `RegisteredTool`.** All 20+ `make_*_tool` call sites are updated to set `ToolSource::Native`; MCP tools get `ToolSource::Mcp { server_name }` at registration time; `make_use_skill_tool` gets `ToolSource::Skill`. A parallel `definitions_with_source_for_policy` method preserves existing `definitions_for_policy` behaviour unchanged. ### Fabro Details <details> <summary>Ran 8 stages in 90m 57s for $70.01</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 1m 59s | – | 0 | | preflight_lint | 2m 11s | – | 0 | | implement | 45m 14s | $48.47 | 0 | | simplify_opus | 25m 50s | $18.29 | 0 | | simplify_gpt | 6m 12s | $3.25 | 0 | | verify | 8m 59s | – | 0 | | **Total** | **90m 57s** | **$70.01** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-23 19:58:18 -04:00
fabro-sh-0530[bot]	def37896cd	Expose PermissionLevel on StageProjection and add sortable run columns (#373) ... ## Summary Two independent additions landed together: surfacing `PermissionLevel` on `StageProjection` (the primary goal), and making four previously unsortable run-list columns (`repo`, `title`, `workflow`, `changes`) sortable. ## Permission Level on StageProjection `PermissionLevel` (`read-only | read-write | full`) was already resolved at session start inside `fabro-agent` but never reached the API. This wires it through the existing `agent.session.activated` event rather than introducing a new event. The data flow: ```mermaid graph TB A[SessionOptions.permission_level] -->|set at CLI build_tool_approval| B[Session.permission_level] B -->|read in api.rs| C[ActivationLeaseOptions.permission_level] C -->|emitted as| D[Event::AgentSessionActivated.permission_level] D -->|convert.rs| E[EventBody::AgentSessionActivated.permission_level] E -->|run_state.rs apply_event| F[StageProjection.permission_level] F -->|OpenAPI + TS client| G[API consumers] ``` Key decisions: - **No new event or type.** `PermissionLevel` is reused from `fabro_types::session` directly; `AgentSessionActivatedProps` gains one optional field with `skip_serializing_if`, so older persisted events deserialize cleanly to `None`. - **`Option<PermissionLevel>` on `StageProjection`** follows the same pattern as `provider_used` — agent stages populate it, non-agent stages leave it `None`. No migration required. - **`AgentSessionActivatedProps` is now a progenitor type replacement** so the API crate and the canonical type stay in sync (verified by the new `agent_session_activated_props_round_trip` test). ### Plan Summary - `fabro-agent` `config.rs` / `session.rs` — store and expose `permission_level` on `SessionOptions` - `fabro-types` `run_event/agent.rs` — add field to `AgentSessionActivatedProps` - `fabro-types` `run_projection.rs` — add field to `StageProjection` - `fabro-workflow` `api.rs` / `activation_lease.rs` / `convert.rs` / `events.rs` — thread the value to the emission site - `fabro-store` `run_state.rs` — fold into projection on `AgentSessionActivated`, plus new unit test - OpenAPI schema, `fabro-api` build.rs, TS client — all regenerated/updated ## Sortable Run Columns `repo`, `title`, `workflow`, and `changes` columns were rendered as plain `<th>` elements with no sort affordance. They now use `SortHeader` in the frontend, the server-side `RunsSortKey` enum gains the four variants, and the OpenAPI `ListRunsSortEnum` and TS client enum are extended to match. Sort helpers (`run_repo_key`, `run_title_key`, `run_workflow_key`, `run_changes_total`) normalize to lowercase strings / integer totals and compose with the existing stable ULID tiebreak. ### Fabro Details <details> <summary>Ran 9 stages in 53m 42s for $18.48</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 14s | – | 0 | | preflight_lint | 2m 29s | – | 0 | | implement | 20m 37s | $11.87 | 0 | | simplify_opus | 8m 0s | $3.61 | 0 | | simplify_gpt | 5m 11s | $2.50 | 0 | | verify | 4m 48s | – | 0 | | fixup | 9m 56s | $0.50 | 0 | | **Total** | **53m 42s** | **$18.48** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: fabro-bot <fabro-bot@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-23 19:41:01 -04:00
fabro-sh-0530[bot]	dbe3e3966d	Migrate sandbox config to named environments; add InterviewOption metad… (#372) ... ## Summary Two related changes land together: the sandbox configuration surface is replaced with a named-environment model, and `InterviewOption` gains `description` and `preview` fields needed for the mid-stage agent interview tools described in the plan. ## What changed ### Named environments (was `[run.sandbox]`) `[run.sandbox]` and its provider-specific sub-tables (`[run.sandbox.daytona]`, `[run.sandbox.docker]`) are replaced by a two-level model: - **`[environments.<slug>]`** — reusable catalog entries with a unified shape: `provider`, `image`, `resources`, `network`, `lifecycle`, `labels`, `volumes`, `env`. - **`[run.environment] id = "<slug>"`** — selects which environment a run uses. - **`[run.environment.<field>]`** — sparse run-level overrides applied on top of the selected environment. The OpenAPI schema drops `RunSandboxSettings`, `DaytonaSettings`, `DaytonaSnapshotSettings`, `DaytonaNetworkLayer`, and `DockerSettings` in favour of `EnvironmentSettings`, `RunEnvironmentSettings`, and the new sub-schemas (`EnvironmentImageSettings`, `EnvironmentResourcesSettings`, `EnvironmentNetworkSettings`, `EnvironmentLifecycleSettings`, `EnvironmentVolumeSettings`). The `--sandbox` CLI flag becomes `--environment`. All docs, example configs, `.fabro/project.toml`, and the automation-detail / run-settings UI panels are updated to the new shape. The run-settings page renames "Sandbox" → "Environment" and reads from the new field paths. ### `InterviewOption` metadata fields `description` and `preview` are added to the canonical `InterviewOption` type (OpenAPI, helpers.ts, interview-dock, human-qa renderer). Both are treated as untrusted model-authored text — stored and displayed as plain strings, never rendered as HTML. The `interview-dock` test asserts that raw HTML in `preview` is not rendered. Option `description` is shown as secondary text under the label in choice and multi-select buttons. ### `StageModelUsage` projection `provider_used` on `RunStageInfo` and stage projections is promoted from a freeform object to a typed `StageModelUsage` schema (with `mode`, `provider`, `model`, `reasoning_effort`, `speed`). The `extractStageModel` event-scraping helper is replaced by `formatStageModelUsageLabel` and `stageModelUsageTitle`, which work directly from the projection field. The `Stage` interface gains `providerUsed` and the `EventsToolbar` consumes it. ### Other schema additions `ReasoningEffort` enum, `small_default` on model info, `SubAgentProjection`/`SkillsProjection`/`McpServerProjection` inline in stage projections, and `TodoListProjection` moved from the run-state top-level `todos_by_list` map into per-stage `todos`. ### Plan summary - Replace `[run.sandbox]` config with `[environments.<slug>]` + `[run.environment]` selection across config, OpenAPI, UI, and docs. - Extend `InterviewOption` with `description` and `preview`; render `description` in choice/multi-select buttons. - Promote `provider_used` to a typed `StageModelUsage` schema; drop event-scraping in favour of the projection field. - Add `ReasoningEffort`, `small_default`, subagent/skills/MCP stage-projection schemas to OpenAPI. ### Fabro Details <details> <summary>Ran 9 stages in 93m 2s for $48.56</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 4s | – | 0 | | preflight_lint | 2m 16s | – | 0 | | implement | 39m 28s | $35.95 | 0 | | simplify_opus | 22m 6s | $8.66 | 0 | | simplify_gpt | 7m 18s | $1.66 | 0 | | verify | 6m 33s | – | 0 | | fixup | 12m 34s | $2.29 | 0 | | **Total** | **93m 2s** | **$48.56** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Fabro <fabro@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-23 15:47:33 -04:00
fabro-sh-0530[bot]	f73f2a53f3	Replace queued with pending/runnable and add approval flow (web + API s… (#371) ... ## Summary Replaces the single `queued` pre-execution state with explicit `pending` and `runnable` states, and wires approve/deny actions for parent-generated child runs that require human approval before they can execute. This diff covers the web UI and OpenAPI spec layers of that change. ## What changed **Run status model** - `queued` is removed from all TypeScript types, display maps, column routing, and tests. - `pending` (awaiting approval) and `runnable` (eligible for the scheduler) replace it as distinct board columns and `RunStatus` variants with their own labels and colors (`runnable` gets cyan; `pending` stays muted). **Approval actions** - New `approveRun` / `denyRun` API calls in `run-actions.ts` invoke the new `POST /runs/{id}/approve` and `POST /runs/{id}/deny` endpoints. - `canApprove` predicate requires both `status.kind === "pending"` and `lifecycle.approval?.state === "pending"` — a run whose status is pending but has no approval record does not expose the action. - `useApproveRun` / `useDenyRun` mutations in `mutations.ts` follow the same pattern as `useCancelRun`. - `ActionsMenu` in `run-detail.tsx` gains Approve (lifecycle group) and Deny (destructive group) menu items. **Board and event plumbing** - `columnForStatus` now routes `pending → pending column` and `runnable → runnable column`; `submitted` stays in the pending column. - `BOARD_STATUS_EVENTS` and `RUN_SUMMARY_EVENTS` replace `run.queued` with `run.start_requested`, `run.pending`, `run.approved`, `run.denied`, and `run.runnable`. - The `pending` column is hidden when empty (same behaviour the old `queued` column had). **Waterfall phases (`run-phases.ts`)** - `queued` phase is removed; `pending` and `runnable` phases are added in order. - The submitted phase closes at `run.start_requested` rather than `run.queued`. - Each phase derives its timestamps from its own event rather than a single `firstTs` lookup, making multi-phase pre-execution timelines accurate. **OpenAPI spec** - `POST /api/v1/runs/{id}/approve` and `POST /api/v1/runs/{id}/deny` endpoints added with 200/404/409 responses. - `startRun` description updated to describe the pending/runnable branching behaviour. - `cancelRun` description updated to reference `pending`/`runnable` instead of `queued`. ### Plan Summary - **Task 3** (OpenAPI schema additions for approve/deny endpoints) — complete in this diff. - **Task 6** (Web UI surfaces: board columns, run-detail actions, waterfall phases, event subscriptions) — complete in this diff. - **Task 7** (doc cleanup: references to `queued` replaced in plans, brainstorms, and QA docs) — complete in this diff. ### Fabro Details <details> <summary>Ran 9 stages in 127m 37s for $104.98</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 2s | – | 0 | | preflight_compile | 2m 15s | – | 0 | | preflight_lint | 2m 29s | – | 0 | | implement | 92m 10s | $91.53 | 0 | | simplify_opus | 18m 35s | $10.65 | 0 | | simplify_gpt | 7m 36s | $2.81 | 0 | | verify | 3m 42s | – | 0 | | fmt | 3s | – | 0 | | **Total** | **127m 37s** | **$104.98** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (12 nodes and 15 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --cargo-quiet --workspace --status-level fail 2>&1 && cargo dev docs refresh 2>&1 && cargo dev docs check 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all clippy lint warnings, test failures, and generated docs errors.", max_visits=3] fmt [label="Format", shape=parallelogram, script="cargo +nightly-2026-04-14 fmt --all 2>&1", max_retries=0] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> fmt [condition="outcome=succeeded"] verify -> fixup fixup -> verify fmt -> exit } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: fabro <fabro@anthropic.com> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-23 15:34:33 -04:00
Bryan Helmkamp	fd63f4b523	feat(api): expose run size buckets (#369) ... ## Summary Adds a stable `Run.size` API field so clients can bucket workflow runs by current best-effort billed usage without introducing a separate cost-estimation system. The field uses the `RunSize` enum and serializes as uppercase `XS`, `S`, `M`, `L`, or `XL`. ## Changes - Derives run size from terminal billed totals when available, otherwise from the existing projected stage usage while a run is still active. - Exposes `size` on `Run` in the OpenAPI contract and regenerated TypeScript client. - Preserves existing `Run.billing` behavior so live/provisional usage only affects `size`, not the nullable billing summary. ## Verification - `cargo nextest run -p fabro-types run_size` - `cargo nextest run -p fabro-store summary_size_tracks_current_projected_usage_before_terminal_conclusion` - `cargo nextest run -p fabro-api run_summary_json_matches_openapi_shape` - `cargo +nightly-2026-04-14 fmt --check --all` - `cd apps/fabro-web && bun run typecheck` - `git diff --check` - `cargo build --workspace` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex)	2026-05-23 14:41:41 -04:00
fabro-sh-0530[bot]	7d8506cb7c	feat: add manual retry for failed and dead runs (#362) ... ## Summary Adds a **Retry** action that creates a fresh run from a failed or dead run's captured durable definition. The new run gets a new ID, records `retried_from: <source_run_id>`, and is immediately queued. The source run is left entirely unchanged. ### Plan Summary - `retried_from: Option<RunId>` added to `RunCreatedProps`, `RunProjection`, and `Run` (API surface); defaults to `null` for backward compat with legacy events. - `POST /api/v1/runs/{id}/retry` → `201` with the new run; eligible source states are `failed` (except `reason=cancelled`) and `dead`. - New `retry_run` workflow operation (modeled after `fork`) creates a new run store, appends `run.created` with `retried_from` set, then `run.submitted`. No checkpoints, sandbox state, PR links, questions, or conclusions are copied. - `start_run` handler refactored into a reusable `queue_run_start(state, id, resume)` helper so retry can queue the new run through the same path. - Web: `canRetry` predicate, `useRetryRun` mutation, **Retry** menu item in `ActionsMenu`, "Retried from" link in `RunSummaryPanelView`, and navigation to the new run on success (deduplicated via `lastProcessed.retry`). - OpenAPI spec updated; generated Rust and TypeScript client types regenerated. ## Key design decisions **No runtime state is copied.** Only the durable definition fields (`graph`, `settings`, `labels`, `git`, `manifest_blob`, `definition_blob`, `fork_source_ref`, `parent_id`, `title`) are forwarded to the new `RunCreated` event. Checkpoints, sandbox, billing, PR links, and pending controls are left in the source run. **`queue_run_start` extraction.** `start_run` was restructured to extract a `queue_run_start(state, id, resume) -> Result<(), ApiError>` helper, so the retry handler can reuse the exact same queueing path without duplicating logic. **`lastProcessed.retry` deduplication.** The UI effect that fires on `retryMutation.data` checks `state.lastProcessed.retry === result` before navigating, so React StrictMode double-invocation or re-renders won't push duplicate navigations. **Demo mode guard.** `canRetry` is gated by `!demoMode` at the call site so the button is hidden in demo mode and never navigates to a missing demo run. ### Fabro Details <details> <summary>Ran 9 stages in 65m 2s for $51.70</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 2s | – | 0 | | preflight_compile | 1m 53s | – | 0 | | preflight_lint | 2m 8s | – | 0 | | implement | 36m 51s | $36.06 | 0 | | simplify_opus | 16m 22s | $14.46 | 0 | | simplify_gpt | 3m 10s | $1.18 | 0 | | verify | 3m 39s | – | 0 | | fmt | 3s | – | 0 | | **Total** | **65m 2s** | **$51.70** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (12 nodes and 15 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --cargo-quiet --workspace --status-level fail 2>&1 && cargo dev docs refresh 2>&1 && cargo dev docs check 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all clippy lint warnings, test failures, and generated docs errors.", max_visits=3] fmt [label="Format", shape=parallelogram, script="cargo +nightly-2026-04-14 fmt --all 2>&1", max_retries=0] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> fmt [condition="outcome=succeeded"] verify -> fixup fixup -> verify fmt -> exit } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-23 14:07:24 -04:00
fabro-sh-0530[bot]	0f36304d2c	Add small_default model role and async generated run titles (#368) ... ## Summary Introduces a `small_default` catalog role for identifying each provider's small/cheap utility model, and uses that model to asynchronously generate human-readable run titles when the caller doesn't supply one explicitly. ### Plan Summary - **Catalog**: Add `small_default: Option<bool>` to `ModelCatalogSettings` and `small_default: bool` to the `Model` type. Mark built-in small defaults: `claude-haiku-4-5` (Anthropic), `gpt-5.4-mini` (OpenAI), `gemini-3.1-flash-lite-preview` (Gemini). Validate that each provider has at most one small default; zero is allowed with fallback to the provider's regular default. - **Helpers**: Add `small_default_for_provider` and `small_default_for_configured_ids` on `Catalog`, mirroring the existing `default_for_provider` / `default_for_configured_ids` / `probe_for_provider` pattern. - **Title generation**: New `run_title_generation` module in `fabro-server` builds a prompt from workflow identity, goal, and raw run inputs, calls `generate_object` with `max_tokens(64)` and a 10 s timeout, normalizes output (trim, reject blank/control, truncate to 100 chars), and falls back to the deterministic title on any failure. - **Server integration**: In the create-run handler, if no explicit `RunManifest.title` was supplied and at least one LLM provider is ready, spawn a detached task that generates a title and appends `run.title.updated` — but only if the title hasn't been changed by a concurrent user PATCH. ## What changed and why **`small_default` vs `default`** — the existing `default` role drives normal model selection for workflow execution and must not be disturbed. `small_default` is a separate, additive role for lightweight metadata work. The two roles are intentionally independent so teams can promote a newer large model to `default` without accidentally routing title generation there. **Best-effort, async title enrichment** — run creation is kept synchronous and reliable. The title task is fire-and-forget: LLM errors, timeouts, and validation failures all silently leave the deterministic title in place. The stale-title guard (`current.title != deterministic_title`) prevents the async task from clobbering a concurrent user edit via `PATCH /runs/{id}`. **No redaction** — per the design goal, raw input values are forwarded to the model. This is noted explicitly in the prompt and in the module docs. **Prompt size bounding** — each of the three prompt sections (workflow identity, run inputs, workflow summary) is independently capped at 4 000 characters with a `...[truncated]` marker so pathological inputs can't produce enormous requests. ## Public interface changes - `Model` gains `small_default: bool` in the Rust type, OpenAPI schema, and generated TypeScript client. - `MAX_RUN_TITLE_CHARS` is now `pub` in `fabro-types` so the title-generation module can reuse the same limit. - Config docs (`models.mdx`, `litellm.mdx`) document `small_default = true` alongside `default` and `probe`. ### Fabro Details <details> <summary>Ran 9 stages in 61m 23s for $32.17</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 2s | – | 0 | | preflight_compile | 1m 52s | – | 0 | | preflight_lint | 2m 5s | – | 0 | | implement | 29m 16s | $23.26 | 0 | | simplify_opus | 17m 15s | $6.28 | 0 | | simplify_gpt | 7m 1s | $2.63 | 0 | | verify | 3m 7s | – | 0 | | fmt | 3s | – | 0 | | **Total** | **61m 23s** | **$32.17** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (12 nodes and 15 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --cargo-quiet --workspace --status-level fail 2>&1 && cargo dev docs refresh 2>&1 && cargo dev docs check 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all clippy lint warnings, test failures, and generated docs errors.", max_visits=3] fmt [label="Format", shape=parallelogram, script="cargo +nightly-2026-04-14 fmt --all 2>&1", max_retries=0] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> fmt [condition="outcome=succeeded"] verify -> fixup fixup -> verify fmt -> exit } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-23 13:48:39 -04:00
fabro-sh-0530[bot]	f81c5b96b1	Move agent state (todos, subagents, skills, MCP) onto StageProjection (#364) ... ## Summary The `GET /runs/{id}` response now carries per-stage agent state — todos, subagents, skills, and MCP server status — directly on each `StageProjection`, unblocking the agent-stage sidebar without any new endpoints. ## What changed and why **`RunProjection.todos_by_list` removed.** The run-level map was the only home for todos, but every list was already 1:1 with a stage (keyed by `openai_plan:<session>` or `anthropic_tasks:<root_session>`). Moving todos onto `StageProjection.todos: Option<TodoListProjection>` eliminates the awkward cross-stage indirection with no loss of expressiveness. **Four new fields on `StageProjection`** (`todos`, `subagents`, `skills`, `mcp_servers`) plus five new projection-side types (`SubAgentProjection`, `SubAgentStatus`, `SkillsProjection`, `ActivatedSkill`, `McpServerProjection`, `McpServerStatus`). All colocated in `run_projection.rs`; no new modules. Four existing event-payload types are reused directly (`TodoListProjection`, `AgentSkillSummary`, `AgentSkillActivationSource`, `AgentMcpToolSummary`) via `with_replacement(...)` in `fabro-api/build.rs` so progenitor doesn't generate parallel `ApiFoo` aliases. **Reducer rerouting** (`run_state.rs`): `TodoCreated/Updated/Deleted` now resolve the owning stage via the existing `stage_at_stored_or_current_visit` helper and mutate `stage.todos` directly. Eight new event arms handle `AgentSubSpawned/Completed/Failed/Closed`, `AgentSkillsDiscovered/Activated`, and `AgentMcpReady/Failed` using the same `stage_at_stored_or_visit` pattern already used for other agent events. **Design decisions called out in the plan:** - `SkillActivated` appends every activation (event-sourced replay semantics); the UI can collapse if needed. - `upsert_mcp_server` replaces by `server_name`, so a server that recovers after a failure shows its final state. - `SubAgentStatus` and `McpServerStatus` are projection-side enums, intentionally distinct from the runtime per-process status types in `fabro-agent`. **OpenAPI + TS client** updated in lockstep: new schemas added, `todos_by_list` removed from `RunProjection`, `bun run generate` regenerated 20+ new model files. ### Plan Summary - Extend `StageProjection` with `todos`, `subagents`, `skills`, `mcp_servers` + supporting types in `run_projection.rs` - Remove `RunProjection.todos_by_list` (no cross-stage use case) - Reroute todo reducer handlers; add 8 new event arms for subagent/skill/MCP events - Wire reused types through `fabro-api/build.rs` `with_replacement`; regenerate TS client - Update all existing todo reducer tests to read from `stage.todos`; add new test modules for subagent, skill, and MCP event families - Update stale comment in `run-events.ts` ### Fabro Details <details> <summary>Ran 9 stages in 38m 52s for $13.29</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 6s | – | 0 | | preflight_lint | 2m 16s | – | 0 | | implement | 16m 8s | $7.80 | 0 | | simplify_opus | 10m 34s | $3.91 | 0 | | simplify_gpt | 3m 23s | $1.58 | 0 | | verify | 3m 51s | – | 0 | | fmt | 2s | – | 0 | | **Total** | **38m 52s** | **$13.29** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (12 nodes and 15 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --cargo-quiet --workspace --status-level fail 2>&1 && cargo dev docs refresh 2>&1 && cargo dev docs check 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all clippy lint warnings, test failures, and generated docs errors.", max_visits=3] fmt [label="Format", shape=parallelogram, script="cargo +nightly-2026-04-14 fmt --all 2>&1", max_retries=0] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> fmt [condition="outcome=succeeded"] verify -> fixup fixup -> verify fmt -> exit } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-23 13:26:51 -04:00
fabro-sh-0530[bot]	7e6052bec3	Surface reasoning_effort + speed in stage badge end-to-end (#363) ... ## Summary The run page stage badge showed only the model name. This PR plumbs `reasoning_effort` and `speed` from the LLM call site all the way through the event stream, store projection, API, and UI so the badge now renders `gpt-5.5 · high`. ### Plan Summary - **Event props** — `AgentSessionActivatedProps` and `StagePromptProps` gain `reasoning_effort: Option<ReasoningEffort>` and `speed: Option<Speed>` with `serde(default, skip_serializing_if)` for back-compat. - **Typed projection** — `provider_used: Option<serde_json::Value>` is replaced by `Option<StageModelUsage>`, a proper struct in `fabro-types` with factory methods (`from_prompt_props`, `from_agent_session_activated`). The freeform JSON bag is gone. - **Emission sites** — `ActivationLeaseOptions` carries the new fields; `emit_stage_prompt()` (new shared helper) resolves `EffectiveRequestControls` via the backend and stamps them on `Event::Prompt`. `AgentHandler` and `PromptHandler` both call this helper instead of building the event inline. - **ACP path** — `AgentAcpStarted` no longer writes `provider_used`; the canonical source is the later `AgentSessionActivated` event, which is already emitted for ACP steering sessions. Runs without a hub legitimately leave `provider_used` unset. - **OpenAPI** — new `StageModelUsage` and `ReasoningEffort` schemas replace the `object | null` bag; `build.rs` maps both to the canonical Rust types; a new `stage_model_usage_round_trip` integration test enforces the parity requirement. - **UI** — `extractStageModel` (event-scanning heuristic) is deleted; replaced by `formatStageModelUsageLabel` and `stageModelUsageTitle` that read directly off `selectedStage.providerUsed`. `parseFanInOutcome` now sources the reducer model from `stage.prompt` instead of `prompt.completed`. ### Key design decisions **No type sprawl**: `fabro_model::ReasoningEffort` and `Speed` are reused verbatim via `with_replacement` in `build.rs` — no parallel enums. **ACP behavior change**: previously `AgentAcpStarted` wrote a bespoke `provider_used` blob and a later `AgentSessionActivated` would be ignored for ACP sessions. Now `AgentSessionActivated` is the single write path for all modes; ACP runs that never activate a steering hub correctly leave `provider_used = null`. The integration test (`acp.rs`) is updated to assert the new shape, and the unit test is renamed `agent_acp_started_alone_leaves_stage_provider_used_unset` to document intent. **`emit_stage_prompt` helper**: both `AgentHandler` and the existing prompt path share one function to avoid the two call sites drifting apart again. ### Fabro Details <details> <summary>Ran 9 stages in 98m 44s for $65.70</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 2s | – | 0 | | preflight_compile | 2m 15s | – | 0 | | preflight_lint | 2m 30s | – | 0 | | implement | 42m 19s | $26.85 | 0 | | simplify_opus | 38m 3s | $35.17 | 0 | | simplify_gpt | 9m 20s | $3.68 | 0 | | verify | 3m 38s | – | 0 | | fmt | 3s | – | 0 | | **Total** | **98m 44s** | **$65.70** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (12 nodes and 15 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --cargo-quiet --workspace --status-level fail 2>&1 && cargo dev docs refresh 2>&1 && cargo dev docs check 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all clippy lint warnings, test failures, and generated docs errors.", max_visits=3] fmt [label="Format", shape=parallelogram, script="cargo +nightly-2026-04-14 fmt --all 2>&1", max_retries=0] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> fmt [condition="outcome=succeeded"] verify -> fixup fixup -> verify fmt -> exit } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com> Co-authored-by: Bryan Helmkamp <bhelmkamp@users.noreply.github.com>	2026-05-23 13:14:55 -04:00
fabro-sh-0530[bot]	94c657b92e	feat: add run.checkpoint.skip_git_hooks to bypass Git commit hooks (#355) ... ## Summary Adds an opt-in `skip_git_hooks` boolean to `[run.checkpoint]` that causes Fabro-managed run-branch checkpoint commits to pass `--no-verify` to `git commit`, bypassing local hooks such as `pre-commit` and `commit-msg`. Defaults to `false`. Metadata-branch snapshots and Fabro `[[run.hooks]]` are unaffected. ```toml [run.checkpoint] skip_git_hooks = true ``` ### Plan Summary - `RunCheckpointSettings` (dense, in `fabro-types`) gains `skip_git_hooks: bool` with `#[serde(default)]`. - `RunCheckpointLayer` (sparse, in `fabro-config`) gains `skip_git_hooks: Option<bool>` so layered config can distinguish unset from explicit `false`. - `RunCheckpointLayer::combine` is refactored from a wholesale-replace to field-level merging: `exclude_globs` keeps its existing replace-wins semantics; `skip_git_hooks` uses `.or()` (highest-priority layer that sets it wins). - `resolve_checkpoint` resolves `None → false`. - `git_checkpoint` / `checked_git_checkpoint` in `sandbox_git.rs` accept a new `skip_git_hooks: bool` and append `--no-verify` when true. - `parallel_branch_commit_cmd` (new helper in `handler/parallel.rs`) replaces the inline format string and accepts the same flag. - `GitState` carries `checkpoint_skip_git_hooks`; `RunOptions::checkpoint_skip_git_hooks()` exposes it; `execute.rs` and `git.rs` thread it through. - OpenAPI schema, TypeScript API client, and docs are updated. ### Key design decisions **Field-level merging in `combine`**: the previous `RunCheckpointLayer::combine` replaced the whole struct when `self.exclude_globs` was non-empty. The refactor keeps that same replace rule for `exclude_globs` while adding independent `Option::or` merging for `skip_git_hooks`, so the two fields don't interfere. **`--no-verify` only on run-branch commits**: the flag is injected only in the two Git commit paths Fabro controls for run-branch checkpoints. Metadata-branch snapshots use `git2` and never fire local hooks regardless of this setting. ### Fabro Details <details> <summary>Ran 9 stages in 48m 3s for $13.91</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 3s | – | 0 | | preflight_compile | 2m 4s | – | 0 | | preflight_lint | 2m 15s | – | 0 | | implement | 24m 13s | $10.38 | 0 | | simplify_opus | 10m 31s | $1.59 | 0 | | simplify_gpt | 5m 8s | $1.93 | 0 | | verify | 3m 4s | – | 0 | | fmt | 3s | – | 0 | | **Total** | **48m 3s** | **$13.91** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (12 nodes and 15 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD."] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --cargo-quiet --workspace --status-level fail 2>&1 && cargo dev docs refresh 2>&1 && cargo dev docs check 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all clippy lint warnings, test failures, and generated docs errors.", max_visits=3] fmt [label="Format", shape=parallelogram, script="cargo +nightly-2026-04-14 fmt --all 2>&1", max_retries=0] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> fmt [condition="outcome=succeeded"] verify -> fixup fixup -> verify fmt -> exit } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh>	2026-05-22 17:26:06 -04:00
Bryan Helmkamp	4190e13a20	Collapsible run stage sidebar (#352) ... ## What Makes the run-detail stage sidebar (shown on the Overview and Stages tabs) collapsible with a slide animation. - A toggle button slides the panel between full width (`w-56`) and an icon-only rail (`w-12`), animating `width` over 300ms with the same easing as the Ask Fabro panel. - When collapsed, **stage status icons stay visible** — green check / red X / spinning teal for running — so run progress is still scannable at a glance. Workflow links (Graph Source, Run Logs, etc.) collapse to icons too so they remain reachable. - Labels and durations become `sr-only` with `title` tooltips for hover. - The open/closed choice persists to `localStorage` (`fabro:stage-sidebar-collapsed`), carrying across the Overview and Stages tabs and reloads. ## Layout - The collapse toggle is inline with the `STAGES` heading row (or `WORKFLOW` when a run has no stages yet), so it doesn't push the stage list down. - The stage sidebar's top padding on the Stages tab was reduced (`pt-6` → `pt-3`) so the heading aligns with the adjacent content column and sits closer to the tab nav. ## Notes Self-contained in `StageSidebar` — `run-overview.tsx` and `run-stages.tsx` render it inside flex layouts that already track its width, so the slide works in both with no parent changes (aside from the padding tweak). Verified: `tsc` typecheck passes; `stage-sidebar` lib tests pass (10/10). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: fabro-sh-0530[bot] <281434857+fabro-sh-0530[bot]@users.noreply.github.com> Co-authored-by: Fabro <noreply@fabro.sh>	2026-05-22 12:20:29 -04:00
fabro-sh-0530[bot]	f5ec711a2c	Stage-based pairing API and fabro_run_pair MCP tool (#344) ... ## Summary Run pairing previously required callers to supply an opaque `agent_session_id` alongside a `stage_id` to start or target a pair session. This leaked an internal runtime identifier across the public HTTP API, generated TypeScript client, and would have bled into any MCP tooling. This PR removes that coupling: the public pair API now identifies targets by `StageId` alone, the server resolves the live session internally, and a new `fabro_run_pair` MCP tool exposes the full pair lifecycle without ever seeing session identifiers. ### What changed **Public contract simplification** (`fabro-types`, OpenAPI, generated TS client) - `PairTarget` is now `{ stage_id, node_label }` — `node_id`, `visit`, `agent_session_id`, `provider`, and `model` are removed. - `PairStartRequest` accepts `{ stage_id }` instead of `{ target: PairTargetSelector }`. - `PairTargetSelector` and `PairTranscriptModel` types are deleted entirely. - `PairMessageRecord.target` (selector) replaced by `PairMessageRecord.stage_id`. - `PairTranscriptAssistantMessage.model` field removed. - `MAX_PAIR_MESSAGE_BYTES` extracted as a public constant shared between the server handler and the MCP tool. **Internal session binding** (`SteeringHub`, server projection) - `ActivePair` now carries `session_id: String` separately from the public `PairRecord`. This preserves the stale-session protection that previously relied on `target.agent_session_id`. - Transcript matching changed from `(session_id AND stage_id)` to `stage_id` within the already-scoped pair window sequence range — simpler and sufficient. - `active_api_targets` deactivation no longer does a per-target `agent_session_id` check; it relies on the `active_steerable_stages` lease already doing that guard. **New `fabro_run_pair` MCP tool** (`fabro-mcp-server`) - Actions: `status`, `start`, `get`, `message`, `end`, `transcript`. - Validation happens before any network call; missing `run_id`, missing `stage_id` for `start`, missing/invalid `pair_id` for other actions, and overlong message text all return clean tool-level errors. - `strum::IntoStaticStr` on `RunPairAction` enables the `parse_pair_id_for_action` helper to embed the action name in error messages without a `match`. - MCP result schema and serialized results are covered by leakage assertions confirming none of the removed fields surface. **Tests** - Negative leakage assertions added to pair DTO tests, event round-trip tests, control-protocol tests, server handler tests, MCP validation tests, and MCP schema test. - Tool count updated from 5 → 6 in all CLI MCP integration tests. - Steering hub test renamed: `pair_start_rejects_non_selected_or_missing_target` → `pair_start_rejects_missing_target` (session-mismatch rejection is now an internal concern). ### Fabro Details <details> <summary>Ran 9 stages in 60m 29s for $31.78</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 9s | – | 0 | | preflight_lint | 2m 26s | – | 0 | | implement | 33m 14s | $25.51 | 0 | | simplify_opus | 15m 7s | $4.18 | 0 | | simplify_gpt | 3m 46s | $2.08 | 0 | | verify | 3m 9s | – | 0 | | fmt | 3s | – | 0 | | **Total** | **60m 29s** | **$31.78** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (12 nodes and 15 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD."] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --cargo-quiet --workspace --status-level fail 2>&1 && cargo dev docs refresh 2>&1 && cargo dev docs check 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all clippy lint warnings, test failures, and generated docs errors.", max_visits=3] fmt [label="Format", shape=parallelogram, script="cargo +nightly-2026-04-14 fmt --all 2>&1", max_retries=0] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> fmt [condition="outcome=succeeded"] verify -> fixup fixup -> verify fmt -> exit } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-21 21:57:55 -04:00
Bryan Helmkamp	296fbddec9	feat(api): add ask fabro session endpoints (#342) ... ## Summary Adds the run-backed API surface needed for a real Ask Fabro sidebar: run readiness metadata, detailed session projections, session-scoped event listing/attach streaming, and turn control that exposes durable turn IDs and machine-readable failures. ## What Changed - Extended the OpenAPI contract and regenerated Rust/TypeScript clients for `Run.ask_fabro`, `SessionDetail`, `SessionTurn`, paginated run sessions, session event APIs, and optional client-supplied `turn_id` values. - Updated `fabro-types` and `fabro-store` so durable `run.session.*` events project active turn state, transcript messages, and the latest owning run event sequence. - Implemented server routing for session details, `/events`, `/attach`, turn conflict headers, typed turn failure codes, and cheap run readiness decoration across run responses. - Added browser helpers for POST turn streaming and session attach SSE parsing, plus an exported generated `sessionsApi`. ## Verification - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings` - `cargo build --workspace` - `cargo test -p fabro-types run_session_turn_failed_defaults_code_for_old_events` - `cargo test -p fabro-store run_sessions::tests` - `cargo test -p fabro-api` - `cargo test -p fabro-server --features test-support --test it api::sessions` - `cargo test -p fabro-server --features test-support --test it api::runs` - `cd apps/fabro-web && bun test app/lib/session-stream.test.ts` - `cd apps/fabro-web && bun run typecheck` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 Codex (context unknown, medium reasoning) via [Codex](https://openai.com/codex/)	2026-05-21 21:26:15 -04:00
fabro-sh-0530[bot]	54bc67017e	feat: Replace duration/elapsed fields with wall_time_ms and StageTiming (#343) ... ## Summary Replaces the ambiguous `runtime_secs`, `elapsed_secs`, and `duration_ms` timing fields on run/stage public API surfaces with explicit `wall_time_ms` (elapsed clock time) and a `StageTiming` value object that also carries `inference_time_ms`, `tool_time_ms`, and `active_time_ms`. This is a greenfield breaking change — no compatibility shims are preserved. ### What changed **API shape** - `RunBillingStage.runtime_secs` → `RunBillingStage.timing: StageTiming` - `RunBillingTotals.runtime_secs` → `RunBillingTotals.timing: StageTiming` - `RunSummary.timestamps.duration_ms` / `elapsed_secs` removed; a top-level `timing: StageTiming | null` field added - Stage list item `duration_secs` → `wall_time_ms` **Web app (`apps/fabro-web`)** - `run-billing.tsx`: `liveRuntimeSecs` → `liveWallTimeMs`; live ticking now returns milliseconds and the footer total sums `wallTimeMs` across rows - `stage-sidebar.ts`: `duration_secs` → `wall_time_ms` for the per-stage duration display - `runs.ts`: `elapsed_secs` lookup replaced with `timing.wall_time_ms` - `formatElapsedSecs` / `formatDurationSecs` call sites replaced with `formatDurationMs` **Lockfile / tooling** - `@openapitools/openapi-generator-cli@2.20.2` added as a dev dependency to `@qltysh/fabro-api-client` to support regenerating the TypeScript client after schema edits; several transitive deps pulled in alongside it. ### Design notes - **Units are now consistent**: every timing value on run/stage surfaces is in milliseconds; the old API mixed seconds (`runtime_secs`, `elapsed_secs`) with milliseconds (`duration_ms`). - **Live ticking** still works correctly: the in-flight billing row computes `now - startedAt` in ms and sums across rows for the footer, avoiding a server round-trip during a running stage. - **`StageTiming.active_time_ms = inference_time_ms + tool_time_ms`** — parallel work is summed, so run active time can exceed wall time. - Subsystem-internal `duration_ms` fields (sandbox setup, devcontainer lifecycle, hooks) are intentionally left unchanged; only public run/stage timing surfaces are affected. ### Fabro Details <details> <summary>Ran 9 stages in 115m 53s for $108.50</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 6s | – | 0 | | preflight_lint | 2m 18s | – | 0 | | implement | 80m 53s | $101.97 | 0 | | simplify_opus | 21m 35s | $4.09 | 0 | | simplify_gpt | 5m 1s | $2.44 | 0 | | verify | 3m 11s | – | 0 | | fmt | 3s | – | 0 | | **Total** | **115m 53s** | **$108.50** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (12 nodes and 15 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD."] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --cargo-quiet --workspace --status-level fail 2>&1 && cargo dev docs refresh 2>&1 && cargo dev docs check 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all clippy lint warnings, test failures, and generated docs errors.", max_visits=3] fmt [label="Format", shape=parallelogram, script="cargo +nightly-2026-04-14 fmt --all 2>&1", max_retries=0] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> fmt [condition="outcome=succeeded"] verify -> fixup fixup -> verify fmt -> exit } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-21 21:06:40 -04:00
Bryan Helmkamp	5095873ddd	feat(web): add detail popovers to the run header ... Hovering the run header items now reveals a popover with extra context: - Run status: failure reason and error message for failed runs; archived timestamp for archived runs (no popover otherwise) - Repository: full owner/repo name and the cloned branch - Workflow: node and edge counts plus run labels - PR: live GitHub details fetched lazily on hover — title, an open/draft/merged/closed badge, and the head -> base branch arrow Workflow node/edge counts are new: WorkflowRef now carries node_count/edge_count, computed in build_summary from the parsed graph that is already in hand there. Adds a HoverCard primitive alongside Tooltip (shared useHoverAnchor hook) for rich, viewport-aware popovers. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-21 14:10:39 -04:00
Bryan Helmkamp	86b1fbef7f	feat(api): bind sessions to runs (#336) ... ## Summary Ask Fabro sessions are now run-bound instead of standalone. Sessions are created under their owning run, then accessed by flat session ID routes, with durable state projected from the run event stream rather than a separate session store. ## Changes - Move session creation/listing to `POST/GET /api/v1/runs/{id}/sessions` while keeping flat session reads, turns, interrupts, and event streams under `/api/v1/sessions/{id}/...`. - Add typed `run.session.*` events, ULID-backed session/turn IDs, read-only default permissions, and a rebuildable SlateDB `session_id -> run_id` index. - Remove the old file-backed session store and wire the server, runtime, Rust client, generated API crates, and TypeScript client around run event projections. - Replace the old top-level CLI session command with `fabro run ask` for chatting with a run. - Regenerate the TypeScript API client; this also catches up existing generated models for Pair/run event detail schemas already present in the OpenAPI spec. ## Validation - `cargo build -p fabro-api -p fabro-client -p fabro-server -p fabro-cli` - `cargo nextest run -p fabro-server --features test-support -E 'test(run_bound_session_is_created_as_run_event_and_resolves_by_flat_id) | test(sessions_are_listed_only_under_their_owning_run)'` - `cargo nextest run -p fabro-store projection_rebuilds_runtime_context_from_run_events` - `cargo +nightly-2026-04-14 clippy -p fabro-api -p fabro-client -p fabro-store -p fabro-server -p fabro-cli --all-targets -- -D warnings` - `cargo +nightly-2026-04-14 fmt --check --all` - `cd lib/packages/fabro-api-client && bun run typecheck && cd ../../../apps/fabro-web && bun run typecheck` - `git diff --check` --- [](https://github.com/EveryInc/compound-engineering-plugin) Generated with GPT-5 via [Codex](https://openai.com/codex)	2026-05-21 10:53:41 -04:00
Bryan Helmkamp	bf96baa9f0	feat(server): add run pairing API (#312) ... ## Summary Adds the server-side run pairing surface for joining one active API-mode agent session, sending pair messages, reading a compact transcript, and ending pairing explicitly before workflow release continues. This PR wires the feature end to end: - adds OpenAPI paths and shared `fabro-types` DTOs for pair lifecycle, messages, transcript entries, and run event details - adds typed `RunEvent` variants for pair lifecycle and pair-scoped user/system messages - extends the workflow steering hub and agent session drain path with typed pair control items, single-target validation, pair parking, and pair end/resume behavior - extends worker JSONL control and server transports for pair start/message/end while preserving existing steer/interrupt/answer/cancel behavior - adds Axum handlers for `/api/v1/runs/{id}/pair`, pair messages, pair transcript, and `/api/v1/runs/{id}/events/{seq}` - adds `fabro-client` helpers for the new endpoints ## Notes The subprocess path does not add a bidirectional worker ack channel in this PR. Instead, the HTTP pair handlers only return lifecycle/message success after the corresponding durable runtime event is observed, so mpsc enqueue success alone is not treated as API success. The plan checklist in `docs/superpowers/plans/2026-05-18-server-side-run-pairing-api-events.md` is included with that distinction left visible. ## Verification - `cargo build -p fabro-api` - `cargo check -p fabro-api -p fabro-client -p fabro-agent -p fabro-workflow -p fabro-interview -p fabro-server` - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings` - `cargo nextest run -p fabro-api pair run_event_round_trips_pair_lifecycle_events run_event_round_trips_agent_pair_messages` - `cargo nextest run -p fabro-workflow pair` - `cargo nextest run -p fabro-interview pair` - `cargo nextest run -p fabro-server pair subprocess_answer_transport_pair_commands_enqueue_control_messages steer interrupt`	2026-05-20 18:58:38 -04:00
Bryan Helmkamp	d17599898e	feat(web): show creator avatar on run "Created by" cell (#319) ... ## Summary The run Overview tab's "Created by" cell rendered every user as a colored circle with the first letter of their login. Reviewers and run owners expected the same GitHub avatar shown on `/profile` and in the top-right nav. The cell only had `login` to work with — the `PrincipalUser` schema carried no avatar URL. This threads an optional `avatar_url` through `UserPrincipal` end-to-end: schema, server auth, and frontend. The avatar is captured at action time from the request's auth context and persisted with the run's `created_by` principal — a point-in-time snapshot, the same pattern as audit logs and chat apps. ## What changed - **`fabro-types`** — `UserPrincipal` gains `avatar_url: Option<String>` with `#[serde(default, skip_serializing_if)]`, plus a `Principal::user_with_avatar` constructor. The existing `Principal::user` constructor is unchanged (sets `None`), so test fixtures and CLI/replay call sites need no edits. - **OpenAPI** — `PrincipalUser` gains an optional nullable `avatar_url`; Rust (progenitor) and TypeScript clients regenerated. - **`fabro-server`** — `auth_context_from_session` (cookie auth) and `classify_user_token` (JWT auth) populate the principal's avatar from the session/JWT, treating an empty string as `None`. - **`fabro-web`** — the `run-summary-panel` "Created by" cell renders an `<img>` when `avatar_url` is present, falling back to the initial circle otherwise. ## Compatibility The field is optional with serde defaults, so old persisted runs and `RunEvent.actor` payloads deserialize unchanged — they show the initial-circle fallback. No migration or backfill. ## Known gap CLI-initiated runs (`fabro run ...`) still show the initial circle: the CLI auth flow hardcodes an empty `avatar_url` in the JWT subject (`cli_flow.rs:508`). Wiring the avatar through CLI login (`~/.fabro/auth.json`, JWT claims, refresh-token chain) is a deliberate follow-up. Web-initiated runs get the avatar today. ## Test plan - `cargo nextest run --workspace` — 5,832 tests pass, including new `principal.rs` and `principal_round_trip.rs` cases covering avatar serialization and legacy-JSON (no-field) deserialization. - `cd apps/fabro-web && bun test run-summary-panel` — 13 tests pass, including a new case asserting the `<img>` renders with the avatar src. - `bun run typecheck`, `cargo +nightly-2026-04-14 fmt --check --all`, and `clippy --workspace --all-targets -- -D warnings` all clean. - Manual: restart `fabro server`, create a run from the web UI, confirm the real avatar renders on the Overview tab; confirm an older run falls back to the initial circle. --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with Claude Opus 4.7 (1M context, extended thinking) via [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-20 09:11:57 -04:00
Bryan Helmkamp	fbe8b50a16	feat(server): add GET /api/v1/providers and /settings/models page (#321) ... ## Summary Operators had no UI surface to see which LLM providers their Fabro server has configured — provider state was only inferable indirectly via the per-model `configured` flag on `GET /api/v1/models`. This adds a dedicated **Models** settings tab backed by a new providers endpoint. - **`fabro_model::Provider`** — a public projection of the internal `CatalogProvider` that *structurally* excludes credential-bearing fields (`auth`, `extra_headers`, `billing_policy`, `agent_profile`). Reused by the generated API client via progenitor `with_replacement`, mirroring the existing `Model` pattern — no parallel API DTO. - **`GET /api/v1/providers`** — lists catalog providers with effective config and a `configured` status stamped per request from `ready_llm_provider_ids()`. Sorted by the catalog's existing `provider_order`. No write endpoints. - **`/settings/models` web page** — new route + nav entry (`CpuChipIcon`, between Integrations and Security) rendering each provider with model count, default model, configured status, and a "Get API key" link for unconfigured providers. ## Key decisions - Provider sort: reuse catalog `provider_order` (priority desc, id asc) — zero extra code. - `adapter` is hidden in the UI row (noisy for first-party providers); the OpenAPI `adapter` field is pinned to an enum matching the closed `AdapterKind` type. - `configured` reflects credential resolution **at the time of the response**, not a frozen startup snapshot — doc/spec wording corrected to match. ## Testing - `fabro-model`: `From<&CatalogProvider>` + serde `skip_serializing_if` unit tests. - `fabro-api`: `Provider` type-identity + JSON-parity tests, including the required/optional field split. - `fabro-server`: handler tests for configured vs unconfigured providers, exact `model_count`/`default_model` against catalog truth, and credential-omission (asserts internal field names *and* the injected credential value never reach the wire). - OpenAPI route conformance test covers `GET /api/v1/providers`. - `cargo build --workspace`, `fmt --check`, `clippy -D warnings` clean; 935 Rust tests pass; web `tsc` typecheck passes. - Reviewed via a 10-persona `ce:review` (autofix) — no P0/P1 in shipped code; 8 safe fixes applied. Not done: manual UI screenshots — the `apps/fabro-web` build is blocked in this environment by an unrelated missing `@assistant-ui/react` dependency. Run `bun install` in `apps/fabro-web` to verify `/settings/models` manually. ## Post-Deploy Monitoring & Validation - **What to watch:** request logs for `GET /api/v1/providers` — expect `200`s for authenticated users, `401` for unauthenticated. The handler resolves LLM credentials per request via `ready_llm_provider_ids()` (the same path the existing `list_models` handler already uses). - **Healthy signals:** `/settings/models` renders the provider list; `configured` matches each provider's actual credential state; no credential strings appear in any response body or log line. - **Failure signals / rollback trigger:** any provider object in the response containing `auth`, `extra_headers`, or a raw key/token value → roll back immediately (the projection type makes this structurally impossible, but treat any occurrence as P0). 5xx spikes on the new route. - **Validation window / owner:** first 24h after deploy, owned by the deploying engineer. Pre-existing note (not introduced here): credential resolution can refresh OAuth tokens and write the vault as a side effect of this read — shared with `list_models`; flagged for a future caching pass. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-20 09:05:00 -04:00
Bryan Helmkamp	cd74013d06	refactor(auth): split credential sources and vault schemas (#306) ... ## Summary Compared with `origin/main`, this PR splits credential storage and credential references into explicit types. Vault secrets now distinguish `token`, `oauth`, and `file` payloads, while runtime/model configuration points to credentials through explicit `env:<NAME>` and `vault:<NAME>` source refs. ## Changes - Replaces the old `environment`/`credential` secret schema vocabulary with `token`/`oauth`/`file` across OpenAPI, Rust API tests, generated TypeScript models, CLI/docs references, and the changelog. - Updates auth resolution, refresh, provider strategies, workflow LLM handling, server diagnostics, install flows, run manifests, and secret handlers to consume typed vault entries and explicit credential sources. - Updates provider catalog TOMLs and config parsing so provider auth and extra headers use `vault` refs instead of ambiguous `credential` refs. - Updates CLI install/login/run/secret paths and integration tests to write and read the new credential shapes. - Removes the temporary legacy vault migration and empty-vault fallback, then centralizes provider vault secret-name lookup and Codex API credential shaping. ## Verification - `cargo +nightly-2026-04-14 fmt --all` - `cargo +nightly-2026-04-14 clippy -p fabro-auth -p fabro-model -p fabro-config -p fabro-vault -p fabro-server -p fabro-cli --all-targets -- -D warnings` - `ulimit -n 4096 && cargo nextest run -p fabro-auth -p fabro-model -p fabro-config -p fabro-vault -p fabro-server -p fabro-cli` (`1938` passed, `35` skipped)	2026-05-18 11:07:42 -04:00
David Bock	6a86ced77c	fix(server): persist manifest metadata names (#302) ... When Fabro creates a detached run through the server, the resulting run metadata should still read like something a human can trust at a glance. Before this change, those runs could persist with `settings.project.name` and `settings.workflow.name` left `null` even though Fabro already had enough local context to infer them. That made `inspect` output look half-populated and made it harder to tell whether the saved run state was complete. This fixes that trust gap in the server-backed manifest flow. ## Summary - backfill missing manifest-backed project and workflow names during server run preparation - prefer explicit `[workflow].name` from bundled `workflow.toml`, then fall back to graph name or workflow slug - cover both manifest preparation and persisted run-state behavior with server tests ## Testing - cargo test -p fabro-server prepare_manifest_backfills_missing_project_and_workflow_names -- --nocapture - cargo test -p fabro-server prepare_manifest_preserves_explicit_project_and_workflow_names -- --nocapture - cargo test -p fabro-server create_run_persists_backfilled_project_and_workflow_names -- --nocapture --------- Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-18 08:31:23 -04:00
Bryan Helmkamp	93452001a1	feat(api): require typed PermissionLevel on session create (#300) ... ## Summary - `POST /api/v1/sessions` now requires `permissions` as a typed enum (`read-only` | `read-write` | `full`) instead of accepting an optional plain string. - Removes the silent fallback at `sessions.rs:906-911` where unknown values (e.g. `"readonly"`) were coerced to `read-write` — a real security footgun: a client trying to lock the agent down would get write access instead. - Invalid or missing values are now rejected by axum's `Json` extractor with `422 Unprocessable Entity`. ## Approach - New `PermissionLevel` OpenAPI schema (`type: string, enum: [...]`). - Moves `PermissionLevel` from `fabro_agent::cli` to `fabro_types::session` so `fabro-api` can `with_replacement` it without a circular dep. `fabro_agent::cli::PermissionLevel` remains as a `pub use` re-export so existing call sites keep working. - `SessionRecord.permissions` becomes required and non-nullable for coherence — every created session has a concrete level. - `build_tool_approval` in the server takes `PermissionLevel` directly; the string-match fallback is deleted. - CLI's `session_permissions` returns a concrete `PermissionLevel` (defaults to `read-write` when neither flag nor settings provide one) and is sent explicitly on every request. ## Scope notes Confirmed out of scope and not addressed here: - Mid-session model/permission switching - Interactive tool approval / HITL ## Breaking change The `permissions` field is now required on `CreateSessionRequest` and non-nullable on `SessionRecord`. Existing on-disk session records persisted with `"permissions": null` will fail to deserialize. Acceptable per project policy (no migration); local dev users may need to clear `~/.fabro/storage/sessions/` once. ## Test plan - [x] `cargo build --workspace` - [x] `cargo nextest run -p fabro-api` — 125/125 (includes new `permission_level_round_trip` parity tests) - [x] `cargo nextest run -p fabro-server` — 554/554 (includes new 422 tests for missing + invalid permissions) - [x] `cargo nextest run -p fabro-cli` — 892/892 - [x] `cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings` - [x] `cargo +nightly-2026-04-14 fmt --check --all` - [x] `bun run generate` on `fabro-api-client` — emits typed `PermissionLevel` union and required field on `CreateSessionRequest` 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-17 17:15:20 -04:00
Bryan Helmkamp	ac32963538	feat(web): add Children tab to Run detail page (#294) ... ## Summary - Surfaces parent/child run relationships in the web UI as a new **Children** tab between Files Changed and Sandbox on `/runs/:id`. - Backend exposes a new `children_count` field on the `Run` summary, computed on read from the existing `RunProjectionCacheState.children_by_parent` index — accurate without an extra query. - Frontend reuses the compact-table `RunRow` from `/runs` (now exported) so the children list matches the existing list-view at a glance. - Tab always shows, with a zero state when there are no children. Refresh button (icon-only, matching the Files Changed pattern) re-fetches both the list and the parent detail so the count badge updates with the list. ## Screenshots Captured live from the running fabro server. **Populated — `Children · 2` tab active, two succeeded child rows:**  **Zero state — visiting a run that has no children:**  ## API verification ```sh # parent $ curl -s -H "Authorization: Bearer $TOKEN" \ http://127.0.0.1:32276/api/v1/runs/01KRTKP5DJJ4EV6T7QSB081Z1N \ | jq '{id, parent_id, children_count}' { "id": "01KRTKP5DJJ4EV6T7QSB081Z1N", "parent_id": null, "children_count": 2 } # child $ curl -s -H "Authorization: Bearer $TOKEN" \ http://127.0.0.1:32276/api/v1/runs/01KRTKP7VAS2J2AG73GQSAKF4G \ | jq '{id, parent_id, children_count}' { "id": "01KRTKP7VAS2J2AG73GQSAKF4G", "parent_id": "01KRTKP5DJJ4EV6T7QSB081Z1N", "children_count": 0 } # list-by-parent $ curl -s -H "Authorization: Bearer $TOKEN" \ "http://127.0.0.1:32276/api/v1/runs?parent_id=01KRTKP5DJJ4EV6T7QSB081Z1N" \ | jq '{count: (.data | length), has_more: .meta.has_more}' { "count": 2, "has_more": false } ``` ## What's in each commit | Commit | What | | --- | --- | | `2f5f4296` | `chore(api-client)`: regenerate TS client from current OpenAPI spec — catches up drift from #292's source-aware diagnostics and the session/turn shape updates that hadn't been re-run yet. Pure generator output. | | `ba16d2b3` | `feat(web)`: the actual Children tab feature. Backend `children_count` field + cache wiring, new `useChildRuns` SWR hook, exported `RunRow`/`RUNS_LIST_GRID_TEMPLATE` from `runs.tsx`, new `run-children.tsx` route, `Run.children_count` on the generated TS type. | | `de0c32c9` | `docs`: live UI screenshots for this PR. Safe to revert before merge if reviewers prefer a screenshot-free repo. | ## Reproducing the screenshots 1. `cargo build -p fabro-cli && ./target/debug/fabro server start` 2. `cd apps/fabro-web && bun run build` 3. ```sh PARENT=$(./target/debug/fabro run hello --dry-run --detach --sandbox local --json | jq -r .run_id) ./target/debug/fabro run hello --dry-run --detach --sandbox local --parent "$PARENT" ./target/debug/fabro run hello --dry-run --detach --sandbox local --parent "$PARENT" ``` 4. Open `http://127.0.0.1:<port>/runs/$PARENT/children` (populated) and a child's children tab (zero state). ## Test plan - [x] `cargo nextest run -p fabro-store -p fabro-types -p fabro-api -p fabro-server -p fabro-mcp-server` — 900+ tests pass, including new `run_summary_includes_children_count` in `fabro-store` - [x] `cd apps/fabro-web && bun run typecheck` — clean - [x] `cd apps/fabro-web && bun test` — 383/383 pass - [x] OpenAPI ↔ Rust parity (the `fabro-api` `run_summary_round_trip` test covers the new field both directions) - [x] Manual API verification via curl (above) - [x] Live UI verification (screenshots above) ## Out of scope (v1) - Real-time SSE updates of the children list (refresh button covers this). - Multi-page pagination UI (shows first page with a "more exist" footer when `has_more`). - Parent breadcrumb on the child run page (separate small change). - Tree/nesting view (flat list only). - Empty-state CTA. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-17 10:21:40 -04:00
Bryan Helmkamp	56c7f627c4	feat(session): add server-backed agent sessions (#278) ... ## Summary Adds the first server-backed Fabro agent session slice: persistent session records, durable turn/event storage, HTTP session APIs, SSE turn streaming, generated clients, and a new `fabro session -p <prompt>` CLI path. ## What Changed - Adds shared session IDs, records, statuses, event envelopes, and message DTOs in `fabro-types`, with OpenAPI replacements in `fabro-api`. - Renames the agent runtime transcript item from `Turn` to `Message` and adds conversion between runtime history and persisted `SessionMessage` records. - Introduces a file-backed `SessionStore` for session metadata, turns, full transcripts, and append-only events under local storage. - Wires server session routes for create/list/read/update/delete, turn submission, event replay, interrupt requests, and session-scoped tools. - Implements streamed turn execution with durable events persisted before SSE broadcast, active-turn conflict handling, local same-machine `working_dir` validation, and noninteractive permission denials. - Adds `fabro-client` helpers and the `fabro session -p` command, plus regenerated TypeScript API client files. ## Notes V1 intentionally keeps session execution local to same-machine server targets. Remote clone-backed session sandboxes, interactive REPL/TUI behavior, warm session pooling, and real tool discovery for `/sessions/{id}/tools` remain follow-up work. ## Verification - `cargo build --workspace` - `cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings` - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo test -p fabro-store session_store_contract_tests --lib` - `cargo test -p fabro-agent history::tests::session_message_roundtrip_preserves_runtime_history --lib` - `cargo test -p fabro-server 'session_' --lib` - `cargo test -p fabro-server --features test-support --test it openapi_conformance -- --nocapture` - `cargo test -p fabro-cli --test it cmd::session:: -- --nocapture` - `cd lib/packages/fabro-api-client && bun run typecheck` - `git diff --check` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex)	2026-05-16 17:25:05 -04:00
Bryan Helmkamp	4f5e3b78f8	refactor: remove compatibility shims (#281) ... ## Summary Simplifies the greenfield PR/run schema surface by collapsing alias-only type shims and removing legacy compatibility paths that kept old wire shapes and workflow names alive. ## Changes - Use canonical `Run`, `PullRequestLink`, `PullRequestResponse`, `BoardColumn`, `WorkflowSettings`, SWR `Key`, and `SteerRunRequest` names directly across Rust and web code. - Remove legacy PR/event deserialization compatibility for old PR records and command output fields, with tests updated to reject stale wire shapes. - Drop obsolete workflow aliases for `agent_loop`, `one_shot`, `codergen_mode`, and `stack.child_dotfile`, then update docs and tests to the current names. ## Verification - `git diff --check` - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings` - `cargo nextest run -p fabro-types -p fabro-api -p fabro-client -p fabro-store -p fabro-server -p fabro-workflow -p fabro-cli` - `cd apps/fabro-web && bun run typecheck` - `cd apps/fabro-web && bun test` --- [](https://github.com/EveryInc/compound-engineering-plugin) Generated with GPT-5 via [Codex](https://openai.com/codex) --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-16 15:29:25 -04:00
Bryan Helmkamp	2296ba6ea8	feat(runs): add parent run links (#271) ... ## Summary Adds orchestration-only parent links between runs without merging them into fork or rewind lineage. Runs can now be created under a parent, linked to a different parent, or unlinked through event-sourced mutations that rebuild summaries and projections from the run event stream. ## Changes - Adds optional `parent_id` to run manifests, public run summaries, run projections, `run.created`, OpenAPI, and the generated TypeScript API client. - Adds `PUT /api/v1/runs/{id}/parent` and `DELETE /api/v1/runs/{id}/parent` for mutable parent links across any run state, including terminal or archived runs. - Records `run.parent.linked` and `run.parent.unlinked` events with actor metadata and previous/current parent IDs. - Validates parent changes in the API path: parent must exist for new links, self-parenting is rejected, cycles are rejected, and same-parent or already-root operations are idempotent no-ops. - Adds `parent_id` filtering to run listing while preserving dangling historical parent references after parent deletion. ## Validation - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo build -p fabro-api` - `cargo check -p fabro-workflow -p fabro-store -p fabro-server` - `cargo nextest run -p fabro-types -p fabro-store` - `cargo nextest run -p fabro-server --features test-support create_run_can_set_parent_and_list_children link_relink_and_unlink_parent_are_idempotent parent_link_validation_rejects_missing_self_and_cycles deleting_parent_leaves_child_parent_id_as_historical_reference` - `cargo nextest run -p fabro-api run_summary_json_matches_openapi_shape` - `cd lib/packages/fabro-api-client && bun run typecheck` Known unrelated broad-suite blocker: `cargo nextest run -p fabro-server --features test-support get_graph_returns_svg` currently returns 500 because the render subprocess emits test-harness output instead of SVG. --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 (unknown context, medium reasoning) via [Codex](https://openai.com/codex)	2026-05-16 13:57:33 -04:00