Replace the overlapping usage and cost model with canonical billing
primitives centered on ModelRef, ModelHandle, TokenCounts, and
BilledModelUsage. This also renames the public API and web surface from
usage to billing, removes compatibility aliases, and normalizes provider
usage adapters onto the shared billing vocabulary.
Persist server, client, and subject provenance on run creation so
run state and inspect output can show which Fabro version created a
run, which first-party client submitted it, and how the request was
authenticated.
Replace the attach polling loop with the existing run attach SSE endpoint.
Seed from stored history once, fetch interview questions only when needed,
and keep completed-run replay behavior intact.
Default test daemons now opt into an in-memory object store and test
helpers carry explicit run ids instead of rediscovering runs from
shared state.
This also disables the disk-backed store dump integration tests until
store dump is routed through the server's live store handles.
Make fabro-store::RunProjection the single projection type used by the
server, CLI, and CLI test helpers. This removes the duplicated CLI-side
mirrors and adds serde coverage for the store-owned projection.
Pass a real cancel signal from __run-worker through the workflow engine
into sandbox command execution so cancelled runs reap gated shell loops
instead of leaking slow.gate waiters.
Eagerly start one shared test server per nextest session and point default
TestContext commands at that session socket instead of leaking per-test
daemons keyed by FABRO_STORAGE_DIR. Add isolated_server() for tests that
need an explicit separate daemon, and tighten the ps filtering test so it
still proves the contract without timing out under full-suite load.
Move subprocess workers fully behind the server-owned run store by
switching worker/server coordination to HTTP-backed run events and
control state. Reconcile stale in-flight runs on boot, terminate live
workers during shutdown, and update process titles to reflect server and
worker lifecycle phases.
Logs were growing unbounded — cli.log and server.log used
rolling::never() with no rotation. Switch to daily rotation via
tracing-appender builder API (prefix.YYYY-MM-DD.log) and clean up
files older than 7 days on startup.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Dead feature cleanup: `skill install` was hidden/experimental and never
graduated; the run verification endpoint was only implemented in demo mode.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Increase the artifact scenario timeout so the retry fixture still forces one timeout without spuriously creating a third retry under full-workspace nextest load. Also import the generated ServerSettings type directly so workspace clippy stays clean.
default_settings_path() and active_settings_path() always return a
value (Home::from_env() never fails), so unwrap_or_else fallbacks to
".fabro/settings.toml" were dead code. Change both functions to return
PathBuf instead of Option<PathBuf> and remove the unreachable branches
in server_client, serve, and user config.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Default `fabro settings` now resolves effective runtime settings against the
selected server, while `--local` preserves local-only inspection. This also
extracts shared settings resolution logic so CLI output, manifest preparation,
and the `/api/v1/settings` contract stay aligned.
Full workspace verification exposed one real mismatch after the socket and
storage split: workflow default scratch lookup still derived from ~/.fabro
instead of the new storage root. Keep the helper aligned with Settings defaults
and fold in the small clippy-driven cleanups in the related server path code.
Keep local server targeting based on explicit server targets instead of
implicitly deriving a socket from storage_dir. This makes ~/.fabro/fabro.sock
the default local socket again, keeps storage under ~/.fabro/storage, threads
FABRO_CONFIG through server autostart paths, and updates the CLI test harness
for the new split.
- centralize FABRO_HOME and storage path resolution in fabro-config
- rename store types, extract ArtifactStore, and simplify run key layout
- switch run scratch to scratch/, remove RuntimeState, and refresh docs/clients
Consolidate CLI and server machine defaults under settings.toml,
including loader renames, writer preservation fixes, same-machine
manifest handling, and docs/test updates for the new config model.
Allow run and create to resolve the same explicit or configured server
connection model used by preflight, validate, and graph. This removes the
last local-only submission assumption from the CLI surface while keeping
local storage-backed behavior intact when no remote target is selected.
Tighten pre-manifest cleanup by removing the old dotenv helper, reducing
legacy .env handling to warning-only path detection, and renaming internal
remote target fields from base_url to api_url.
This also updates install/server docs and CLI terminology so the codebase
reflects the current direct-run vs server-interface model more accurately.
Move secret storage, diagnostics, and repo/provider validation behind the
server API so credentials live under the server storage dir and take effect
immediately without process env mutation.
This also removes the old .env runtime path, rewires doctor/install/secret/
provider login/repo init around the server contract, and regenerates the
TypeScript client for the new endpoints.
Move --storage-dir and --server-url off GlobalArgs and onto the
leaf commands that actually honor them.
This aligns help, parser behavior, and env-var wiring with the
current command architecture while preserving the intended model
and exec targeting semantics.
Move the model command surface into fabro-cli and delete the dead
fabro-llm CLI module now that prompt/chat/model CLI entrypoints are gone.
This also removes the now-unused fabro-llm CLI-only dependencies.
Remove redundant config_change_after_submission test (1.67s avg) from
fabro-server — already covered by start_run_persists_full_settings_snapshot
and architectural guarantees. Defer reqwest::Client init past validation
in web_search tool so missing-key/missing-query tests skip macOS proxy
discovery (1.56s → 9ms). Move telemetry panic event tests to a CLI IT
via a new cfg(debug_assertions) __test_panic subcommand. Lower default
nextest SLOW threshold from 3s to 1.5s with 2x headroom over the new
worst-case (0.84s).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Rename the hidden detached worker command to __runner, remove launcher
bookkeeping, and resolve runs through a shared server-backed lookup.
This leaves attach, resume, logs, and related commands using the server
as the source of truth and updates the integration coverage around the
new lifecycle.
Replace the brittle raw NDJSON snapshots in logs tests with direct
assertions on the stable contract: the command succeeds, all events belong
to the requested run, and the expected lifecycle events appear in order.
This keeps coverage on logs behavior while avoiding churn from unrelated
run.created payload details like default model configuration.
Scope the ps listing to the current test case and compare a normalized
projection instead of exact live run payload equality. This avoids flakes
from parallel tests and in-flight status transitions while preserving the
CLI contract under test.
