Extract atomic_write_private in dev_token.rs, export read_dev_token_file
for reuse in server_client.rs, extract build_authed_unix_socket_client
to unify try_connect/connect, and remove always-true announce param.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Propagate the local dev token through worker subprocesses, share the
same authenticated local-server helper across CLI integration tests,
and clean up the async token wait path so fmt, clippy, and full tests
pass again after the dev-token auth rollout.
Replace local no-auth startup with a shared dev-token flow for CLI-managed
servers. This provisions and validates dev tokens, preserves dev-token
provenance through browser sessions, and teaches local CLI and web clients how
to authenticate against local Unix and TCP servers.
Make `fabro settings` render dense resolved settings by default for local
inspection, add a resolved view to the server settings endpoint with an
explicit compatibility marker, and update tests plus generated API clients
to lock the new behavior.
Embed defaults.toml as a base settings layer and apply it when
materializing effective settings and resolving typed settings.
This also fixes partial CLI table merging so builtin fields survive
higher-precedence overrides, and updates the affected CLI tests and
snapshots.
Move async subprocess paths to Tokio or spawn_blocking, document the
intentional synchronous std::process::Command callsites, and make CI run
Clippy with --all-targets so the guardrail applies to test code too.
Add a Clippy disallowed-methods guardrail for std::thread sleep/spawn
and convert the CLI polling paths to tokio::time::sleep so they no
longer block Tokio workers. Keep the intentional OS-thread sites with
narrow #[expect(...)] annotations that explain why std::thread is
required there.
- Replace unwrap_or_default() with expect() in hooks/llm HTTP client
builders — Default silently discards all config (timeouts, TLS, proxy)
- Route fabro-mcp through fabro_http instead of raw reqwest, respecting
FABRO_HTTP_PROXY_POLICY for MCP HTTP transport connections
- Deduplicate HttpClientBuilder / BlockingHttpClientBuilder via macro
- Extract helpers for repeated http_client error handling in diagnostics
and web_auth
- Remove duplicate test_http_client() in fabro-cli and fabro-llm
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add the shared fabro-http transport crate and route hand-written HTTP client construction through it.
Use FABRO_HTTP_PROXY_POLICY for test no-proxy defaults, remove direct reqwest deps from ordinary crates, and add clippy bans for raw reqwest entrypoints.
Make gh_cli the default GitHub integration path across install, server,
workflow, and CLI surfaces while keeping app-based setup available when
explicitly selected.
Also defer GitHub reqwest client initialization until an HTTP request is
actually needed so missing-token and token-only paths do not trip workspace
test slow timeouts.
Shorten fully-qualified Printer paths in attach.rs and convert
two missed eprintln! calls in runs/list.rs.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Plumb the CLI printer through command dispatch, replace direct stdout and
stderr writes with printer helpers, preserve important stdout in quiet
mode, and update the Claude Rust formatting hook to use cargo +nightly
fmt.
Keep project config and checked-in workflows under .fabro so they stay out of
normal repo listings. Update config discovery, CLI project commands, fixtures,
docs, and checked-in workflow paths to use .fabro/project.toml and
.fabro/workflows/*.
No production deployments exist, so there's no need for migration shims.
Remove all six backwards-compat type aliases (AgentError, SdkError,
CoreError, GraphvizError, StoreError, FabroError) and migrate ~880
callsites to use the canonical Error name directly within each crate,
or qualified imports (e.g., `use fabro_llm::Error as LlmError`) for
cross-crate references. Also fix a pre-existing absolute-path clippy
lint in fabro-server error.rs.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The rustfmt.toml uses nightly-only options (struct_field_align_threshold,
imports_granularity, etc.) so stable rustfmt silently skips them,
producing different output. Use cargo +nightly fmt going forward.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The error standardization lost the file path from parse error messages
when anyhow::Context was removed. Add path field to ParseSettings
variant so errors like "Failed to parse settings file at /path: ..."
include the file location. Also fix test that expected capitalized
"Workflow not found" to match the new lowercase error message.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Skip MiniJinja parse+render for plain-text strings (no {{ / {% / {#)
- Remove dead VariableExpansionTransform type alias
- Add From<TemplateError> for FabroError, replace manual map_err with ?
- Extract resolve_prompt_and_model helper in hooks executor
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add a shared MiniJinja-based template crate and migrate workflow prompts,
imports, hooks, and InterpString env references to the new {{ ... }}
syntax. This also threads typed run inputs through workflow rendering and
updates docs and tests to match the new templating model.
Move worker control stdin handling off Tokio's blocking shutdown path so
subprocess workers can exit cleanly after success or cooperative
cancellation even when the parent still holds stdin open.
Add regression coverage for retro-enabled success and SIGTERM-driven
cancellation with stdin intentionally left open.
Skip retry when get_retry_target points at a terminal node — retrying
into a terminal re-triggers the same goal-gate failure endlessly.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Resolve every clippy warning across the workspace when running with
--tests enabled. Previously only library code was lint-clean; test
code had accumulated issues that were invisible without --tests.
Fixes:
- redundant_closure_for_method_calls: |s| s.as_source() -> InterpString::as_source
(effective_settings, resolve_cli/root/server/features, run_event/record_serde,
materialize_run) — add InterpString imports where needed
- absolute_paths: inline fabro_types::settings::* paths -> use imports;
add #![allow(clippy::absolute_paths)] to fabro-cli and fabro-server
IT test harnesses (matching the existing pattern in integration.rs)
- bool_assert_comparison: assert_eq!(x, true) -> assert!(x)
- needless_raw_string_hashes: r#"..."# -> r"..." where no inner quotes
- field_reassign_with_default: mut + field assign -> struct literal with ..Default
- match_same_arms: merge Timeout | Disconnected arms in attach.rs
- needless_pass_by_value: signal_rx by ref in attach.rs
- unreadable_literal: 9999999999 -> 9_999_999_999
- default_trait_access: Default::default() -> BTreeMap::default()
- items_after_statements: move use to function top
- large_futures: allow in integration.rs test module (test-only, not prod)
- filter_map_bool_then: .filter_map(bool::then) -> .filter().map()
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add GhCli wrapper for best-effort gh CLI detection and org discovery.
During `fabro install`, prompt the user to create the GitHub App under
their personal account or an org they admin, with a manual entry fallback
for org app managers. App name defaults to `{owner}-fabro`.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
TestContext::command() was inheriting all parent env vars, so a
developer (or CI) running with FABRO_CONFIG set would pollute child
test subprocesses, causing settings_local_* IT tests to fail with
opaque assertion errors.
Iterate std::env::vars_os() and env_remove every FABRO_* key before
re-adding the controlled set (FABRO_NO_UPGRADE_CHECK, etc.). Safe to
iterate because the prior two commits eliminated all std::env::set_var
callers in fabro-cli and fabro-config tests.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The active_settings_path_honors_fabro_config_env test was using an
EnvGuard that called std::env::set_var/remove_var — unsafe shared
mutable state in a parallel test binary.
Extract active_settings_path_with_lookup that takes an env-lookup
closure (same pattern as resolve_auth_mode_with_lookup in jwt_auth.rs).
Rewrite the test to inject the env value via the closure. Delete the
EnvGuard struct — no remaining callers.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
build_run_manifest was reading FABRO_CONFIG env and ~/.fabro/settings.toml
internally, which forced its 3 unit tests to use unsafe std::env::set_var
to isolate from the developer's real config. This violates the project rule
against mutating shared mutable state in tests.
Add user_layer: SettingsLayer and user_settings_path: Option<PathBuf> to
ManifestBuildInput so callers pass the user layer explicitly.
- Production callers (graph, preflight, validate, run/create) load via
load_settings_user() + active_settings_path(None) at the command boundary.
- Tests pass SettingsLayer::default() and None, needing no env access.
- Delete all unsafe { set_var/remove_var } blocks and #[allow(unsafe_code)]
attributes from the 3 manifest_builder tests.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Drop the dead sandbox and hook bridge helpers that no longer have runtime
callers, and move the run settings serde coverage into fabro-types where the
wire types live. Add the missing /api/v1/runs/:id/settings contract test so the
outward sparse settings shape stays covered after the refactor.
