494 commits

Author	SHA1	Message	Date
fabro-releases[bot]	c17b2dbee2	Bump version to 0.288.0-nightly.0	2026-07-08 10:05:49 +00:00
fabro-releases[bot]	4d82e44b00	Bump version to 0.287.0-nightly.0	2026-07-07 18:23:12 +00:00
fabro-releases[bot]	8c7d5dc7d0	Bump version to 0.283.0-nightly.0	2026-07-03 10:17:50 +00:00
fabro-sh-fabro[bot]	9008058eab	Resolve secret tokens at the run boundary (worker-side, fail-closed) (#545) ... ## Summary `{{ secrets.NAME }}` tokens in workflow config (MCP transport, prepare steps, run environment) now resolve from the server vault at the run boundary — the same late-binding point where `{{ env.* }}` tokens resolve. Secret values are never persisted and never left literal in resolved commands or env; a missing or non-Token secret aborts startup with a clear error. ## What changed **`fabro-types` — `run.rs`** - `resolve_env_string` (shared choke-point for MCP and prepare) gains a `secrets_lookup` parameter and routes through `ResolveCtx::new().with_env(...).with_secrets(...)` / `resolve_with`. - `McpServerSettings::resolve_transport_env` and `RunPrepareSettings::resolve_step_env` thread the new parameter through. - `RunEnvironmentSettings::resolve_env` becomes fallible (`Result<HashMap<_,_>, ResolveError>`). Per-value error handling preserves the historical env fallback for `Namespace::Env`-only errors while failing closed for `Namespace::Secrets` errors. The intentional `as_source()` fallback is gated behind its `#[expect(clippy::disallowed_methods)]` with an explicit reason. **`fabro-workflow` — `start.rs`** - A single vault read guard is acquired once at the top of `RunSession::new`, replacing the previous per-site reads (Daytona key, etc.). - `vault_token_lookup` wraps `fabro_auth::vault_get_token` — returning `Some(value)` only for `Token`-type secrets; `Oauth` and `File` secrets become `None` (fail-closed). - The shared `secret_lookup` closure is threaded into `runtime_mcp_server`, `runtime_setup_commands`, and `resolve_env`. `resolve_docker_config` gains the same parameter and now returns `Result`. **`fabro-sandbox` — `from_environment.rs`** - `docker_config_from_environment` (server-preflight path, no vault available) retains `resolve_or_source` behavior unchanged. - New `docker_config_from_environment_with_secrets` is the vault-backed variant used by `start.rs`. **`fabro-cli` — `exec.rs`** - `fabro exec` has no vault; passes `|_| None` for secrets, preserving existing behavior with updated call signature. ### Plan summary - **B.1** — Secret lookup threaded through `resolve_env_string` / `resolve_transport_env` / `resolve_step_env` / `resolve_env` in `fabro-types`. - **B.2** — Vault-backed `secret_lookup` closure built once in `RunSession::new` and passed to all boundary resolvers in `start.rs`. - **B.3** — Persistence invariant test: a created run's persisted `RunCreated` event still carries `{{ secrets.DEPLOY_TOKEN }}` in source form, not the resolved value. - **B.4** — Verification (fmt, clippy, nextest, release build) with hermetic temp-vault tests. ### Key design decisions - **Fail closed everywhere secrets are referenced** — no source fallback for secret tokens, even in `resolve_env` which otherwise keeps the env fallback. This is enforced by checking `value.references(Namespace::Secrets)` before the fallback branch. - **Token-only** — `vault_get_token` enforces this; `Oauth` and `File` secrets silently become `None` and then hard-error via the resolver, not a panic. - **Single vault read guard per `RunSession::new`** — acquired once, shared across MCP / prepare / env resolvers, then dropped before the struct is returned. Mirrors how the Daytona key was already read. - **`fabro exec` stays unchanged behaviorally** — the added `|_| None` secrets argument makes the new signature explicit about having no vault. ### Fabro Details <details> <summary>Ran 9 stages in 82m 55s for $24.43</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 21s | – | 0 | | preflight_lint | 2m 34s | – | 0 | | implement | 46m 58s | $15.83 | 0 | | simplify_opus | 12m 43s | $4.79 | 0 | | simplify_gpt | 6m 43s | $3.18 | 0 | | verify | 6m 41s | – | 0 | | fixup | 4m 33s | $0.63 | 0 | | **Total** | **82m 55s** | **$24.43** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-8; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, timeout="1800s", script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh>	2026-07-02 17:00:20 -04:00
Scott Werner	1806e91d7e	Fix web app load performance: caching, compression, and eager chunk loading (#550) ... ## Problem Loading the web UI from a remote server took **~11 seconds to first render on every refresh**. A HAR capture against a remote deployment showed the page downloading **13.5 MB of JavaScript across 356 files, uncompressed, on every single page load** — even though the assets are content-hashed and served with `Cache-Control: immutable`. Four compounding causes: 1. **`Pragma: no-cache` defeated the browser cache.** The security-headers middleware stamped `Pragma: no-cache` onto every response, including hashed assets that set a year-long immutable `Cache-Control`. Browsers treat a response `Pragma: no-cache` as `Cache-Control: no-cache` and check it *before* `max-age` (Chromium zeroes freshness on it), and since assets carried no validators, "revalidate" degraded into a full re-download. Empirically visible in the HAR: Google-Fonts woff2s served from cache (`transfer = 0`) during the same page load where all 356 of our assets re-downloaded in full. 2. **No response compression.** The server had no compression layer; 13.5 MB of JS compresses to ~2.5 MB with brotli. 3. **The HTML force-loaded every chunk.** `writeIndexHtml` emitted a `<script type="module">` tag for all 356 outputs. Only 2.9 MB is statically reachable from the entry; the other ~10.7 MB is dynamic-import-only code (syntax grammars, Graphviz WASM, xterm, diff file tree) that was being downloaded eagerly at high priority. 4. **The immutable heuristic over-matched.** Any dash in a filename counted as a content hash, so stable-named files (`pierre-diffs-worker/worker-portable.js`, `apple-touch-icon.png`) would be pinned in browser caches for a year across deploys once fix 1 made immutable caching effective. ## Changes - **`security_headers`**: apply the `no-store`/`Pragma: no-cache` defaults only when the handler didn't set its own `Cache-Control`. API responses keep the conservative defaults. - **Compression**: `tower-http` `CompressionLayer` (brotli + gzip) on both the main router and the install-mode router (install mode serves the same SPA bundle through a separate router). Default predicate keeps SSE (`text/event-stream`), gRPC, images, and tiny bodies identity-encoded. Quality pinned to `Precise(4)` — tower-http's default defers to the codec default, and brotli's default is quality 11 (seconds of CPU per multi-megabyte asset). - **Entry-only HTML**: `writeIndexHtml` emits script tags only for `kind === "entry-point"` outputs. The module graph pulls static imports (depth 1, so no waterfall); dynamic `import()` chunks load on demand. - **Cache-control classifier + validators**: only files matching the bundler's actual output shape (`assets/<stem>-<hash8>.js|css`, lowercase base-36) get `immutable`. Everything else is `no-cache` **with a strong ETag** and `If-None-Match` → `304` support, so index.html / app.css / the pierre worker revalidate in one cheap conditional request instead of a full re-download. ## Impact (measured on the built bundle) | | Before | After | |---|---|---| | Cold load, ~1 MB/s link | 13.5 MB raw ≈ **11–14 s** | ~0.8 MB compressed eager payload ≈ **~1 s** | | Refresh | full re-download, same 11–14 s | served from cache + one 304 ≈ **instant** | | Eager JS on first render | 13.56 MB / 356 files | 2.88 MB raw (0.79 MB gzip) / 6 files | ## Verification - 959 fabro-server tests pass (incl. new coverage); fmt + clippy clean; `bun run typecheck` passes (the 5 pre-existing bun test failures reproduce identically on `main` — missing `@pierre/diffs/dist/worker` fixture + flaky InstallApp timing tests). - New integration tests pin compression through **both** serving shapes that matter: regular routes and the SPA fallback service, each via tower `oneshot` **and** over a real TCP connection through hyper (raw-socket assertions, so no client auto-decompression can mask a regression). - Live-verified against a debug server: hashed assets get `immutable` + brotli and no `Pragma`; mutable assets get `no-cache` + ETag and answer conditionals with `304`; API responses keep `no-store`. - Headless Chrome boots the rebuilt SPA from the entry-only HTML and fully renders the UI. ## Notes for reviewers - The ETag is skipped for immutable assets deliberately — they never revalidate, so hashing multi-MB bodies per request would be pure overhead. - Install mode previously had **no** compression and shares the same bundle; it gets the same layer via a shared `compression_layer()` helper. - `bun test` has a pre-existing suite (`production build copies Pierre worker assets`) that fails without `@pierre/diffs/dist/worker` present locally; unrelated to this change. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-07-02 16:58:47 -04:00
fabro-releases[bot]	0e30ae30ba	Bump version to 0.282.0-nightly.0	2026-07-02 10:17:41 +00:00
Bryan Helmkamp	bec4b90ad3	Move environments to SQLite storage (#539) ... ## Summary Move server-managed environments from sibling TOML files into SQLite, matching the storage model already used by variables and secrets. This adds: - an `environments` SQLite table with DB-level validation for IDs, revisions, providers, network modes, booleans, and JSON fields - a SQLite-backed `EnvironmentStore` with cached synchronous reads, transactional create/replace/delete, synthetic unpersisted `local`, and `default` as an ordinary seeded row users can delete - one-time legacy import from `environments/*.toml` next to the active server `settings.toml`, including relative Dockerfile path inlining and backup rename to `environments.imported-<timestamp>.bak` - install/test/CLI seeding of `default` directly into SQLite instead of writing `environments/default.toml` - docs updates for API/SQLite-managed server environments and legacy import behavior The REST API shape is unchanged; path Dockerfile sources remain rejected over the environments API. ## Testing - `cargo nextest run -p fabro-db -p fabro-environment` - 15 passed - `cargo nextest run -p fabro-server --features test-support environments` - 16 passed - `cargo nextest run -p fabro-server --features test-support install` - 60 passed - `cargo nextest run -p fabro-server --features test-support create_run_rejects_disabled_sandbox_provider` - 1 passed - `cargo nextest run -p fabro-server --features test-support system_sandbox_provider` - 2 passed - `cargo nextest run -p fabro-cli install` - 132 passed - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings`	2026-07-01 10:31:58 -04:00
Scott Werner	0244736b05	Resolve run.prepare.steps env and interpolation at the run boundary (#530) ... ## What Per-step environment in `run.prepare.steps[].env` was parsed and then **dropped** before it reached the resolved run settings, so prepare steps could never see their declared env. This PR carries that env all the way through to the executor, resolves prepare-step interpolation at the run boundary, and fixes an argv-quoting bug. Three things: 1. **Per-step env is carried through.** `RunPrepareSettings` now holds `steps: Vec<PreparedStep>` (command plus per-step `env`) instead of a flat `commands: Vec<String>`. The per-step env reaches `exec_command`, which already accepts per-command env vars, and is merged on top of the base sandbox environment. 2. **Interpolation resolves at the run boundary.** Prepare-step `script`/`command` and per-step `env` values are carried in source form out of the portable config resolve layer (so `fabro validate` stays portable and never requires env to be set). Their `{{ env.* }}` tokens resolve in the process that actually runs the steps, via `RunPrepareSettings::resolve_step_env` — mirroring the existing MCP transport env resolution. A missing env var is a **hard error** (fail-closed); there is no fallback to the unresolved literal. 3. **Argv is shell-quoted.** Argv-style prepare steps were assembled with `join(" ")`, so an argument containing spaces or quotes was re-split by the shell. They are now shell-quoted per element with the shared `shell_quote()` helper. `script` steps stay verbatim because they are raw shell snippets. ## How - `RunPrepareSettings.commands: Vec<String>` becomes `RunPrepareSettings.steps: Vec<PreparedStep>` where `PreparedStep { command, env }`. The server-side `{{ vars.* }}` substitution pass now walks each step's command and env. - New `RunPrepareSettings::resolve_step_env(env_lookup)` resolves `{{ env.* }}` in each step's command and env values, returning a hard error on a missing var (and a loud `Unavailable` error for reserved `secrets`/`inputs` tokens). - The run boundary (`fabro_workflow::operations::start`) gains `runtime_setup_commands`, the prepare-step counterpart to `runtime_mcp_server`. `LifecycleOptions` now carries `Vec<SetupCommand>` (command + env), and the initialize phase passes each step's env to `exec_command`. - `resolve_prepare` shell-quotes each argv element and carries per-step env in source form. The stale lint suppression on the resolved fields is rewritten to describe the deliberate source preservation that now resolves at the run boundary. - The shell-quoting helper moves to a shared `fabro_util::shell` module (backed by `shlex`); `fabro_sandbox::shell_quote` delegates to it so the config resolve layer and sandbox code share one audited implementation. - The OpenAPI `RunPrepareSettings` schema and the generated TypeScript client are updated to the new `steps`/`PreparedStep` shape. ## Testing - `cargo build --workspace` - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings` - `cargo nextest run` for `fabro-util`, `fabro-types`, `fabro-config`, `fabro-sandbox`, `fabro-api`, `fabro-workflow`, `fabro-server`, `fabro-cli` (provider keys stripped) — all green. - `cd lib/packages/fabro-api-client && bun run typecheck` — clean. New tests cover: per-step env carried through resolution; script/command + env resolved at the run boundary; a missing env var is a hard error (in both the command and a per-step env value); reserved `secrets` tokens surface as `Unavailable`; argv elements are shell-quoted (an arg with spaces/quotes is correctly quoted) while a `script` stays verbatim; and an end-to-end check that per-step env reaches the executed setup command (with a negative control proving the success is attributable to the per-step env). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-01 10:31:26 -04:00
fabro-releases[bot]	c631ce557b	Bump version to 0.281.0-nightly.0	2026-07-01 10:38:53 +00:00
Scott Werner	287afd7928	Hooks: typed end-to-end interpolation, narrow header tokens, fail-closed resolution (#528) ... ## What Makes hook interpolation typed end-to-end and fail-closed, and removes the bespoke template engine on HTTP-hook headers. - **Typed end-to-end.** Hook `command`, `url`, header values, `prompt`, and `model` are now carried as a typed `InterpString` from the config resolve layer all the way to the executor. The executor resolves each segment at hook fire time from the typed value instead of collapsing it to a `String` and re-parsing it. This mirrors the MCP transport env resolution boundary (`resolve_transport_env` / `runtime_mcp_server`). - **Narrow header tokens.** HTTP-hook headers previously ran through MiniJinja with an env allowlist (`TemplateContext::with_env_lookup_allowed`). They now resolve through the same narrow `{{ ns.NAME }}` token resolver as every other hook field — no template engine, no allowlist. - **Fail-closed everywhere.** A missing or out-of-scope `{{ env.* }}` / `{{ secrets.* }}` token in a command, URL, header, prompt, or model is now a hard error that blocks the hook rather than firing it with a half-resolved or empty value. Previously command hooks failed closed but http/prompt/agent hooks failed open (warned and proceeded), which could dispatch an HTTP request with an empty credential header or run an LLM call against a half-rendered prompt. Transport-level outcomes (non-2xx responses, connection errors, unparseable bodies) stay fail-open. A follow-up cleanup commit removes the template engine's `env` namespace (`with_env_lookup` / `with_env_lookup_allowed` / the `EnvLookup` object), which the header path was the last consumer of. ## How - `fabro-types` and `fabro-hooks` `HookType` / `HookDefinition` now type the interpolatable fields as `InterpString`. `InterpString` serializes as its raw source, so persisted run specs and checkpoints round-trip unchanged. - The `fabro-config` resolve layer clones the typed `InterpString` through instead of calling `as_source()`, so the fields no longer leak unresolved template text — the old "source preservation" `#[expect]` annotations on the hook resolvers are gone. - The executor's single `resolve_interp` helper resolves a typed `InterpString` and is shared by the command, http, prompt, and agent paths; resolution failure maps to `HookDecision::Block`, which the runner already reports loudly (error for blocking hooks, warn for non-blocking). ## Testing - New unit tests: fire-time resolution from the typed value (no re-parse), narrow-token header resolution, and fail-closed behavior for HTTP url, HTTP header, and prompt hooks on a missing variable (the hook does not fire and the resolution error surfaces). - Existing hook tests updated and kept green. - Gates: `cargo build --workspace`, `cargo +nightly-2026-04-14 fmt --check --all`, `cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings`, and `cargo nextest run` for the touched crates (`fabro-hooks`, `fabro-types`, `fabro-config`, `fabro-template`, `fabro-workflow`, `fabro-server`, and the `fabro-cli` hook/config tests), all green. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-30 17:07:11 -04:00
Scott Werner	173968a780	feat(server): mcp-servers HTTP API — handlers + AppState wiring (#532) ... ## What Adds the **mcp-servers HTTP API**: `GET/POST /api/v1/mcp-servers` and `GET/PUT/DELETE /api/v1/mcp-servers/{id}` on top of the merged `fabro-mcp-store` foundation and OpenAPI spec. This includes the AppState wiring needed for the catalog to work end to end: `McpServerStore` construction from `{active-config-dir}/mcps/`, an `AppState` accessor, the `fabro-server` dependency, and route registration for list/create/get/replace/delete handlers. The API mirrors the automations concurrency pattern with ETags on read/write responses and required `If-Match` headers for replace/delete. ## Resolved before merge - **Credential-omitting read model:** read responses now return `McpServerView` / `McpTransportView`, so stored env/header values are not exposed by GET/list/create/replace responses. Responses include only `env_keys` / `header_keys`; persisted values remain available to runtime execution. - **Manifest catalog references:** run manifest validation, graph rendering, preflight, and run creation now resolve server-managed MCP catalog references such as `[run.agent.mcps.<name>] id = "..."`. - **Schema strictness:** unknown MCP transport fields are rejected, aligning the reused Rust domain type with the OpenAPI `additionalProperties: false` contract. - **Create response headers:** the `POST /mcp-servers` 201 response now documents its `ETag` header in OpenAPI. ## Follow-up intentionally left out Credential-literal validation remains structural only: create/replace currently accept literal env/header values and persist them for runtime use. The warn-vs-hard-reject UX is a separate follow-up for the settings UI; it is not a response-omission issue. ## Testing Current PR checks are green: - Rust: format, clippy, generated docs, Linux tests - TypeScript: build, test, typecheck Local checks run during the simplify/CI-fix pass: - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo +nightly-2026-04-14 clippy --locked --workspace --all-targets -- -D warnings` - `cargo nextest run -p fabro-config run_agent_mcps` - `cargo nextest run -p fabro-mcp-store` - `cargo nextest run -p fabro-api --test mcp_server_round_trip` - `cargo build -p fabro-api` - `cargo nextest run -p fabro-server --features test-support system_sandbox_provider` - `cargo nextest run -p fabro-server --features test-support --test it mcp_servers` --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-30 15:06:24 -04:00
Bryan Helmkamp	164d9dcfbc	Move variables to SQLite storage (#537) ... ## Summary This moves workflow-visible variables from JSON file storage into SQLite-backed storage, establishing the first durable SQL table while preserving the existing variable API behavior. ## What Changed - Added a `fabro-db` crate with bundled SQLite, an embedded migration for the `variables` table, and a `Database` owner for `connect()`, `migrate()`, `health_check()`, and pool access. - Replaced the `fabro-variable` JSON file store with an async SQLx-backed `VariableStore` that preserves sorted listing, case-sensitive names, empty string values, name validation, and description-preserving upserts. - Wired server startup to create `<storage>/db/fabro.sqlite3`, run SQLite migrations, import legacy variables when needed, and pass the shared pool into server state. - Grouped live server stores under `AppStores` so runs, variables, vault, environments, and automations share one state boundary while artifacts remain separate. - Updated variable handlers, run creation, validation, and test support for async SQLite-backed variable access. - Added schema, store-level, legacy import, and API-level persistence coverage for variables. ## Legacy JSON Migration On startup, Fabro looks for `<storage>/variables.json`. If it is missing, startup is a no-op for legacy variables. If the file exists, Fabro parses and validates the full file before mutating SQLite. Valid entries are inserted with `ON CONFLICT(name) DO NOTHING`, so existing SQLite values remain authoritative and only missing names are imported from the legacy file. After a successful import transaction, the source file is renamed to a timestamped backup such as `variables.json.imported-<timestamp>.bak`. A later startup naturally skips the import because the original source path no longer exists. Invalid JSON or invalid variable names leave the source file in place for operator repair. Variable values are not logged during import. Logs include only safe metadata such as source/backup paths, row counts, and variable names. ## Verification - `cargo nextest run -p fabro-db -p fabro-variable` - `cargo nextest run -p fabro-server --features test-support variables` - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings` --- [](https://github.com/EveryInc/compound-engineering-plugin) Generated with GPT-5 via [Codex](https://openai.com/codex)	2026-06-30 12:17:46 -04:00
fabro-releases[bot]	7507a2279a	Bump version to 0.278.0-nightly.0	2026-06-28 10:18:39 +00:00
Bryan Helmkamp	f015814835	security: patch tar CVE alert (#534) ... ## Summary - Updates transitive Rust dependency `tar` from `0.4.45` to `0.4.46` in `Cargo.lock`. - Expected to resolve Dependabot alert: https://github.com/fabro-sh/fabro/security/dependabot/30 - Dependency path: `fabro-sandbox` -> `tar`. ## Grouping - Kept this separate from the web alerts because it is a Rust lockfile-only patch with a separate verification path. ## Verification - `cargo tree -i tar` resolves `tar v0.4.46`. - `cargo build --workspace` - `cargo nextest run --workspace` (6860 passed, 185 skipped; nextest reported 1 leaky test warning as non-fatal) - `git diff --check` ## Residual alerts - React Router alerts 31-37 are intentionally handled in a separate web PR. Co-authored-by: Release Repro <release-repro@example.com>	2026-06-27 12:10:30 -04:00
fabro-releases[bot]	f03936a02b	Bump version to 0.277.0-nightly.0	2026-06-27 10:00:50 +00:00
fabro-releases[bot]	6529f120de	Bump version to 0.276.0-nightly.0	2026-06-26 10:23:30 +00:00
Bryan Helmkamp	bb77806900	Sync Cargo.lock for fabro-mcp-store	2026-06-25 16:43:26 -04:00
Scott Werner	4b7c2690c8	feat(mcp): add server-side MCP server store (fabro-mcp-store) (#521) ... ## What Adds the storage foundation for server-managed MCP servers: a durable store plus its domain model. No server wiring, HTTP API, or UI yet — this is standalone scaffolding that later PRs build on. - New **`fabro-mcp-store`** crate: a concrete, filesystem-backed `McpServerStore` — one TOML file per definition under `{active-config-dir}/mcps/`, an in-memory cache, and a SHA-256 content-hash revision for optimistic concurrency. Modeled directly on `AutomationStore`. Includes an id-only `ids()` accessor for cheap listing that avoids cloning the (potentially sensitive) env/header maps a full definition carries. - New **`McpServerDefinition` / `McpServerDraft` / `McpServerReplace`** domain model (plus `McpServerId` / `McpServerRevision` and structural validation) in `fabro-types`, reusing the existing `McpTransport`. These stay persistence-independent; the on-disk TOML DTO and the filesystem plumbing live in `fabro-mcp-store`. Nothing in the workspace depends on the new crate yet. Wiring `McpServerStore` into the server, the HTTP API, and the UI are follow-up PRs. ## Testing - `fabro-mcp-store`: 7/7 (empty/missing dir, non-TOML ignored, malformed/invalid-filename fail load, CRUD round-trip, stale-revision and duplicate-create rejected). - `fabro-types`: `mcp_store` validation and round-trip tests pass. `cargo build --workspace`, fmt, and clippy all green. ## Notes - The domain model derives `PartialEq` but not `Eq` because `McpTransport` carries `HashMap`s (differs from `Automation*`, matches the transport's capabilities). - Validation is structural for now (id format, non-empty name, well-formed transport); credential-literal validation is deliberately deferred to the API layer (flagged TODO). - The store is concrete by design (no trait): a future move off per-file TOML is a one-time migration, not a runtime backend choice. The revision is currently derived from the canonical TOML bytes — the one storage-coupled detail to revisit if that move happens. - Part of a short series adding server-managed MCP servers; independent of the sibling PRs. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-25 15:50:02 -04:00
fabro-releases[bot]	ba56a170d8	Bump version to 0.275.0-nightly.0	2026-06-25 12:49:18 +00:00
fabro-releases[bot]	1626240220	Bump version to 0.267.0-nightly.0	2026-06-17 16:50:57 +00:00
Ryan Neal	d5b2220ed3	feat(llm): Amazon Bedrock provider — Converse codec, SigV4 + API-key auth (#459) ... Adds **Amazon Bedrock** as an opt-in built-in provider, over Bedrock's unified **Converse / ConverseStream** API. One codec serves every Converse-capable family — Claude, Amazon Nova, Meta Llama, Mistral, DeepSeek, Moonshot Kimi, Z.AI GLM, MiniMax, NVIDIA Nemotron, and OpenAI gpt-oss — because AWS translates the envelope to each model's native dialect server-side. Auth is either **AWS SigV4** (the default credential chain — env / profile / IMDS / IRSA / SSO, resolved per request so sessions refresh) or a **Bedrock API key** (`AWS_BEARER_TOKEN_BEDROCK`, bearer). Disabled by default (the Ollama / OpenRouter opt-in pattern). This is the redo of #459's original Claude-only `InvokeModel` adapter, rebuilt on the gateway-refactor seams (#481–#497). @depopry's SigV4 signer, AWS event-stream frame decoder, `BedrockAuth`, the `aws_sigv4` credential grammar, `AdapterKind::Bedrock`, region-from-base_url, and the lean-deps decision are preserved and authored by him on the first two commits; the per-family `BedrockCodec` trait he wrote turned out to be the crate-wide `Codec` seam in miniature, so the refactor promoted exactly that shape. The original Claude-only description is preserved in a comment below. ## What's here - **`AdapterKind::Bedrock` × `CodecKind::BedrockConverse`** on the route, plus the `aws_sigv4` credential source (no static secret — the adapter signs at request time; `fabro-auth` stays AWS-free). *(@depopry)* - **SigV4 signer + AWS event-stream `FrameDecoder`** on the lean AWS stack (no `aws-sdk-bedrockruntime`; transport stays on `fabro-http`). Re-targeted at Converse's direct-JSON stream frames; the signer resolves credentials per request. *(@depopry)* - **`bedrock_converse` codec** — Converse envelope (`system[]`, typed content blocks, `inferenceConfig`, `toolConfig`), prompt caching via `cachePoint`, thinking-signature round-trip through `reasoningContent`, usage mapped onto the disjoint `TokenCounts` buckets, `provider_options.bedrock` passthrough. Plus the adapter shell and an event-stream byte loop beside the transport's shared SSE loop. - **Catalog**: `bedrock.toml` (Claude incl. Fable 5, Nova 2, Llama 4, Mistral, DeepSeek, Kimi, GLM, MiniMax, Nemotron, gpt-oss — cross-region inference-profile ids, per-model `billing_policy` so Claude bills Anthropic-style) and a companion **`bedrock-openai`** provider for GPT-5.5/5.4 over the `bedrock-mantle` Responses endpoint (pure config over the existing `openai_responses` codec, zero new code). - Secrets registry (`AWS_BEARER_TOKEN_BEDROCK`), gitleaks rules for both Bedrock key formats, the `docs/integrations/bedrock` guide, and live e2e tests. ## Live verification (confirmed end-to-end against a real AWS account) Verified on a real Bedrock account (us-east-2, SigV4 + bearer): - **SigV4 + Converse** — multiple families (Claude, Nova, DeepSeek, …) via the full settings → catalog → route → adapter → codec path. - **ConverseStream** — streaming deltas through the workflow engine. - **Multi-turn tool use** — agent loop with tool calls round-tripping (no-arg tools included). - **Multi-model routing** — Claude + DeepSeek pinned in one run through the single Converse codec. - **mantle Responses** — `openai.gpt-5.5` answered via the `bedrock-openai` provider (bearer auth). The exercise caught and fixed several issues that unit tests (static creds, mocked transports) could not — see the follow-up commits below. ## Follow-up fixes from live testing (commits on top of the foundation) 1. **Worker AWS env** — the workflow worker scrubs its env to an allowlist, so SigV4 (which re-resolves from the ambient chain per request) couldn't work through `fabro run`. The AWS credential-chain inputs now cross into the worker. 2. **Vault bearer key** — Bedrock was the only key-based provider missing a `vault:` credential ref, so `fabro secret set AWS_BEARER_TOKEN_BEDROCK` silently didn't feed it. Now resolves env → vault → SigV4. 3. **Converse tool-encoding hardening** — a no-arg tool call's `toolUse.input` is now a `{}` object (Bedrock rejects null), and every tool `inputSchema` gets a top-level `type: "object"` (strict families like DeepSeek reject a typeless schema Claude tolerates). 4. **Nova output cap** — `amazon.nova-2-lite` max_output 65536 → 65535 (Bedrock's per-request limit). Earlier fixes already folded into the foundation commits: the `aws-config` sleep-impl (default chain panicked) and AWS error-body decoding (top-level `message`/`Message`/`__type` → proper messages instead of "Unknown error"). ## Manual testing & setup See `docs/integrations/bedrock` — now documents the non-obvious account setup that live testing surfaced: the per-Region Anthropic use-case approval, `aws-marketplace:Subscribe` for third-party models, the Fable 5 / Mythos-class data-sharing opt-in, and the bearer-vs-SigV4 precedence override for running Converse + mantle side by side. ## Open decision / discussion - **Model-id naming** — Bedrock rows use dotted ids mirroring Bedrock's native inference-profile ids (`us.anthropic.claude-sonnet-4-6`, `openai.gpt-5.5`), which also makes them the wire `api_id`. Third scheme alongside bare ids and OpenRouter's `vendor/model` slashes. No collision risk (enforced at catalog build). Open to a uniform scheme if preferred. - **`BEDROCK_API_KEY` alias** — see the comment thread; the AWS console hands some users `export BEDROCK_API_KEY=` while the SDK-standard var is `AWS_BEARER_TOKEN_BEDROCK`. Question of whether to accept both. ## Deferred (named follow-ups) - **`qwen.qwen3-coder-next`** — omitted pending a verified Bedrock model/inference-profile id (its fabro id isn't a valid Bedrock identifier; needs an explicit `api_id`). Re-add once confirmed via `aws bedrock list-inference-profiles`. - **Claude Mythos 5** — Anthropic-Messages-only on `bedrock-mantle` (limited preview). - **Converse structured output** (`response_format` rejected with a clear error). - **`reasoning_effort` on Converse rows** via `additionalModelRequestFields` (the `bedrock-openai` GPT rows already accept effort levels). - **CountTokens** route (`count_input_tokens` returns `None`). ## Verification `cargo nextest run --workspace`: green except the pre-existing environment-dependent fabro-workflow failures (identical on main). clippy `-D warnings` + pinned-nightly fmt clean. Codec unit tests + adapter httpmock tests + frame-decoder/signer locks. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Scott Werner <scott@sublayer.com> Co-authored-by: Scott Werner <stwerner@vt.edu>	2026-06-16 11:46:49 -04:00
Bryan Helmkamp	bc0bda73a6	feat(web): add server-managed Environments CRUD settings UI (#462) ... ## What Adds a CRUD interface for **server-managed Environments** at `/settings/environments`, driven by the `/api/v1/environments` REST API (list / create / retrieve / replace / delete), and reshapes how built-in environments are provisioned and protected. The page lives in the **Workflows** settings nav section (also introduced in this branch), positioned before Variables. ## Why The Environments REST API shipped (#453) but had no UI — environments could only be managed via the API/CLI. This gives operators a web UI alongside Variables and Secrets, and along the way tightens the model: environments are seeded at install time (not silently re-created on every boot), and the `default` fallback is an ordinary, deletable environment. ## Web UI **Pages & component** - `settings-environments.tsx` — list view: provider badge, image/resource summary, row actions (Edit/Delete). **"New environment" is a dropdown** of the enabled sandbox providers; the chosen provider is fixed for the environment's lifetime. - `settings-environments-new.tsx` / `settings-environments-edit.tsx` — create/edit flows; create reads the provider from a query param. - `environment-form.tsx` — shared form, reorganized: - **General** panel (merged identity + image): id, and an **image-source selector** (Image reference *vs* inline Dockerfile) that shows, requires, and sends only the selected, mutually-exclusive source. - **Resources**: CPU / memory / disk as **range sliders** (CPU 1–8, memory 1–16 GB, disk 1–20 GB), each always writing a concrete value. - **Environment variables** key/value editor. - **Advanced** progressive-disclosure section holding **Network** (a single "Block all network access" toggle — allow-all vs block) and **Lifecycle** (preserve / stop-on-terminal / auto-stop). Opens by default when any advanced value is non-default. - The in-form **provider control and the Labels editor were removed** — labels remain API-managed and are round-tripped untouched so UI edits never clear them. **Data layer**: `environmentsApi` client, `queryKeys.environments`, `useEnvironments` / `useEnvironment` SWR hooks. **Nav & routing**: "Environments" item in the Workflows section before Variables; routes registered in `router.tsx`. ## Backend: seed at install, deletable `default` - **Seeding moved to install time.** The server no longer seeds built-ins on startup; `EnvironmentStore::load_or_seed` → `load` (load-only). A new public `seed_environments(dir)` (idempotent, preserves operator edits) is called by both the web installer and the CLI installer. An uninstalled instance therefore has no managed environments, and a run selecting an absent environment fails explicitly (`unknown environment: default`) rather than resurrecting a built-in. - **`default` is no longer protected.** The delete guard and the `Protected` error variant are gone; deleting `default` succeeds (204) and removes the run fallback on purpose — forcing an explicit choice. `local` is unchanged (reserved, in-memory). - **`volumes` removed** from environment settings across the OpenAPI spec, generated Rust + TS clients, config layers, sandbox/server/workflow plumbing, docs, and tests. ## API contract details honored - Edit sends the environment `revision` as `If-Match`; 409 conflicts surface a "changed since you opened it" message. - The REST API accepts inline Dockerfiles only — the form never sends a Dockerfile path. ## Verification - Rust: `cargo build` (touched crates) ✅, `cargo nextest -p fabro-environment` 21/21 ✅, server env unit + `tests/it` integration 2/2 + 15/15 ✅, `clippy` (nightly, touched crates, all targets) clean ✅, `fmt --check` clean ✅. Full `--workspace` suite not run here — worth a CI pass. - Web: `bun run typecheck` ✅, `bun run build` ✅, `environment-form.test.ts` 5/5 ✅. Web suite: 512 pass / 1 unrelated pre-existing `RunDetail` failure. - **Not visually verified in-browser** — the local app is login-gated and automated loads redirect to `/login`; rendering of the form, the New-environment dropdown, and `default` delete should be confirmed in a logged-in session. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: fabro-sh-0530[bot] <281434857+fabro-sh-0530[bot]@users.noreply.github.com> Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Release Repro <release-repro@example.com>	2026-06-13 08:44:38 -04:00
fabro-releases[bot]	786d2953a1	Bump version to 0.260.0-nightly.0	2026-06-10 10:40:28 +00:00
fabro-releases[bot]	4083c3ef10	Bump version to 0.259.0-nightly.0	2026-06-09 10:29:35 +00:00
fabro-releases[bot]	7d951930dd	Bump version to 0.256.0-nightly.0	2026-06-06 09:55:50 +00:00
fabro-releases[bot]	3c6ac9e6e1	Bump version to 0.255.0-nightly.0	2026-06-05 10:37:02 +00:00
Bryan Helmkamp	497aaba6f2	Bump version to 0.254.0	2026-06-04 08:51:34 -04:00
fabro-releases[bot]	84d9f282ab	Bump version to 0.254.0-nightly.0	2026-06-04 10:33:58 +00:00
fabro-releases[bot]	d132b96fe7	Bump version to 0.253.0-nightly.0	2026-06-03 10:49:54 +00:00
Bryan Helmkamp	f69677cf82	Bump version to 0.252.0	2026-06-02 20:45:09 -04:00
fabro-releases[bot]	083bbf8b30	Bump version to 0.252.0-nightly.0	2026-06-02 23:27:41 +00:00
fabro-releases[bot]	f76d191a48	Bump version to 0.251.0-nightly.1	2026-06-01 23:57:37 +00:00
fabro-releases[bot]	0f3ef1c63d	Bump version to 0.251.0-nightly.0	2026-06-01 22:40:10 +00:00
fabro-releases[bot]	228387e53b	Bump version to 0.250.0-nightly.0	2026-05-31 10:07:23 +00:00
fabro-sh-0530[bot]	17cae07e5a	Add scheduled automation executor with in-memory cron planner (#457) ... ## Summary Automation schedule triggers now fire automatically at their UTC cron times. A new long-lived server task (`spawn_automation_scheduler`) owns an in-memory planner that tracks one cursor per enabled schedule trigger and creates/starts a normal Fabro run whenever a cursor comes due — reusing the same materialization and run-creation path as API-triggered runs. ### Plan Summary - **Planner** (`AutomationSchedulePlanner`) — pure in-memory, no persistent state. Reconciles cursors from the live automation list on every tick; advances each due cursor _before_ spawning the fire task so a failed materialization never hot-loops. - **Executor loop** (`spawn_automation_scheduler`) — wakes on the nearest cursor due time (capped at 30 s), on automation store mutations (via `Notify`), or on shutdown. Spawns one Tokio task per due trigger so slow materializations don't block other triggers. - **Run firing** (`fire_scheduled_automation_run`) — materializes, calls `create_run_from_manifest` with `Principal::System { Engine }`, then calls `queue_run_start`. Warnings on any failure; next attempt waits for the next cron occurrence. - **Wiring** — `automation_scheduler_notify: Notify` added to `AppState`; `create_automation`, `replace_automation`, and `delete_automation` handlers call `notify_automation_scheduler()` so the planner reacts immediately to changes. - **Visibility widening** — `handler/lifecycle.rs` (`queue_run_start`) and `handler/mod.rs` (`lifecycle`) promoted from `pub(super)` to `pub(in crate::server)` so the scheduler (a sibling of `handler`) can call the same start path. - **Shared cron parser** — `parse_schedule_expression` extracted to `fabro-automation` and re-exported so both validation and the scheduler use the same parser configuration (no seconds, no year). ### Key design decisions | Decision | Rationale | |---|---| | Cursor advances before fire task spawns | Guarantees at-most-one attempt per occurrence even if materialization panics | | No backfill on startup | Matches locked spec; `next_occurrence(expr, now)` always starts from the current time | | `Principal::System { Engine }` for actor | Avoids adding new public enum variants or OpenAPI surface | | `automation_temp_root()` extracted to `AppState` | Removes duplicated `Storage::new(…).scratch_dir().join("automations")` from the automations handler | | Tests use `run_due_schedules_once` helper | Drives the planner directly with fixed `DateTime<Utc>` values; no wall-clock sleeps in tests | ### Fabro Details <details> <summary>Ran 9 stages in 60m 12s for $22.11</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 9s | – | 0 | | preflight_lint | 2m 26s | – | 0 | | implement | 20m 14s | $12.44 | 0 | | simplify_opus | 12m 29s | $6.34 | 0 | | simplify_gpt | 3m 53s | $2.79 | 0 | | verify | 11m 5s | – | 0 | | fixup | 6m 46s | $0.54 | 0 | | **Total** | **60m 12s** | **$22.11** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh>	2026-05-29 22:19:47 -04:00
fabro-sh-0530[bot]	037073d2b2	feat: Add Environment REST CRUD API under /api/v1/environments (#453) ... ## Summary Adds a server-managed Environment CRUD API at `/api/v1/environments`, modeled after the existing Automations API and backed by `EnvironmentStore`. The API manages only server-side environment definitions in `environments/*.toml`; client-side catalogs (workflow, project TOML, run inputs) are unaffected. ### Plan Summary - **OpenAPI contract**: new `Environments` tag, `EnvironmentId` path parameter, five CRUD paths, list envelope, and REST-specific inline-only image schema (`EnvironmentApiImageSettings`) - **Server handler** (`environments.rs`): mirrors `automations.rs` — auth guard, ETag/If-Match, and `EnvironmentStoreError → ApiError` mapping - **Shared handler utilities**: `parse_required_if_match` and `json_with_etag_response` extracted from `automations.rs` into `handler/mod.rs` so both modules share them - **Inline-only Dockerfile enforcement**: `ApiDockerfileSource::Path` is parsed and immediately rejected with `422`; the file is never read - **Manifest refresh**: `refresh_manifest_run_settings_from_environment_catalog()` called after create, replace, and delete so `/system/info` and default run settings stay consistent - **Client regeneration**: TypeScript Axios client regenerated with `EnvironmentsApi` and new model files; Rust `fabro-api` type aliases updated - **Tests**: integration suite in `tests/it/api/environments.rs` covering all CRUD paths, error cases, and the manifest-refresh invariant; OpenAPI conformance test verifies generated surfaces ## Key Design Decisions **Inline-only Dockerfile at the REST boundary.** Allowing `path` sources over REST would let callers silently read arbitrary server-local files into the environment catalog. The handler recognizes the `path` discriminant so it can return a descriptive `422` rather than a generic parse error, but the payload is discarded via `IgnoredAny` — no disk access occurs. **Shared ETag utilities instead of per-handler helpers.** The original `parse_required_if_match` and ETag header builder in `automations.rs` were duplicated for environments. They're now generic over any `FromStr` revision type in `handler/mod.rs`, making future resource handlers cheaper to add. **`Environment` response type aliased to domain type.** The OpenAPI-generated `Environment` response struct is replaced with `fabro_environment::Environment` via `build.rs` `with_replacement`. A compile-time function-cast witness in `fabro-api/tests/environment_round_trip.rs` confirms the alias holds. Request types (`CreateEnvironmentRequest`, `ReplaceEnvironmentRequest`) stay API-specific because their image schema differs from the workflow/settings schema. **Stale revision → `409`.** Consistent with Automations; `428` is reserved for missing `If-Match` only. ### Fabro Details <details> <summary>Ran 8 stages in 59m 23s for $30.41</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 9s | – | 0 | | preflight_lint | 2m 25s | – | 0 | | implement | 25m 43s | $19.79 | 0 | | simplify_opus | 14m 34s | $6.98 | 0 | | simplify_gpt | 4m 39s | $3.64 | 0 | | verify | 9m 14s | – | 0 | | **Total** | **59m 23s** | **$30.41** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh>	2026-05-29 17:30:57 -04:00
Bryan Helmkamp	0f6da7d5cc	chore: bump fabro-environment to 0.247.0-nightly.0 in Cargo.lock ... Cargo.lock churn from the merge with origin/main; the workspace bumped fabro-environment's version but Cargo.lock still pointed at the 0.246.0-nightly.0 entry until a build refreshed it. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-29 08:52:24 -04:00
fabro-sh-0530[bot]	4cff07373c	feat: add server-owned environment store (Task 1 & 2 foundation) (#446) ... ## Summary Moves environment definitions out of project/workflow TOML config and into server-owned files, introducing the `fabro-environment` crate and enforcing source-aware validation so project/workflow/user configs can no longer define environment catalogs. ### What changed **New `fabro-environment` crate** — workspace crate wired into `fabro-cli` and `fabro-server`. Exposes a `seeded_catalog_layer()` that CLI commands inject at the call site to fill the environment catalog that settings resolution requires. **Config environments are now migration-only** — `defaults.toml` no longer ships a built-in `[environments.*]` catalog. Instead: - `SettingsSource` enum tags every parsed layer (ActiveSettings, Project, Workflow, DirectRun, User). - `validate_settings_source` rejects `[environments.<id>]` in any source except `ActiveSettings` with a targeted message: `[environments.<id>] is now server-managed; move this definition to the server environments directory`. - TOML-provided `run.environment.{image,resources,network,lifecycle,labels,volumes,env}` overrides are also rejected; only `run.environment.id` survives. **New migration** (`2026052801_settings_environments_to_server_files`) — chains after the existing legacy-sandbox migration. Extracts `[environments.*]` entries from `settings.toml` into sibling `environments/<id>.toml` files, writes a `.settings-environments-migration.bak` backup, and fails without modifying any file if a target already exists. **Builder API additions** — `RunSettingsBuilder::load_from_with_catalog`, `load_default_with_catalog`, `from_toml_with_catalog` let callers inject a server-side catalog; the bare `from_toml` path now errors if no catalog is present and a named environment is selected. `WorkflowSettingsBuilder` test helpers in `src/tests/mod.rs` centralise catalog injection across all config tests. **`.fabro/project.toml`** — removed the inline `[environments.fabro-dev]` block (environment definition now lives server-side). ### Key design decisions - CLI offline commands (graph, preflight, validate) use `seeded_catalog_layer()` as a local stand-in until a running server is available — matches the pre-existing behaviour without regressing offline workflows. - `load_settings_path` no longer runs migrations for non-ActiveSettings sources, preventing project/workflow files from accidentally triggering file-system writes. - The `MigrationReport` type is now the new migration's `SettingsEnvironmentsMigrationReport` (exposes `contents: String` instead of a parsed layer), keeping `load.rs` simpler and decoupled from layer parsing. ### Fabro Details <details> <summary>Ran 9 stages in 143m 23s for $105.27</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 11s | – | 0 | | preflight_lint | 2m 23s | – | 0 | | implement | 28m 27s | – | 0 | | simplify_opus | 37m 27s | $53.28 | 0 | | simplify_gpt | 20m 50s | $12.14 | 0 | | verify | 6m 3s | – | 0 | | fixup | 45m 15s | $39.84 | 0 | | **Total** | **143m 23s** | **$105.27** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-28 17:10:59 -04:00
fabro-releases[bot]	6b26915a09	Bump version to 0.247.0-nightly.0	2026-05-28 10:41:43 +00:00
fabro-sh-0530[bot]	29a9a3f7d6	refactor: Remove inbound IP allowlisting (#443) ... ## Summary Removes Fabro's in-process inbound source-IP allowlist entirely. `[server.ip_allowlist]` and `[server.integrations.github.webhooks.ip_allowlist]` are gone from config parsing, resolved settings types, the OpenAPI spec, generated API clients, and the Settings > Security UI. Existing `settings.toml` files containing those keys now fail as unknown fields — this is a hard removal with no migration path. Network source restrictions should be enforced upstream via a reverse proxy, firewall, VPN, Tailscale ACLs, Kubernetes ingress, or platform policy. ### What changed - **Config/types** (`fabro-config`, `fabro-types`): Removed `ServerIpAllowlistLayer`, `ServerIpAllowlistOverrideLayer`, `ServerIpAllowlistSettings`, `ServerIpAllowlistOverrideSettings`, `IpAllowEntry`, associated resolver functions, GitHub `/meta` hook-range parsing, and Unix socket trusted-proxy validation. `ipnet` dropped from `fabro-types`; kept in `fabro-config` for sandbox CIDR validation. - **Server runtime** (`fabro-server`): Deleted `ip_allowlist.rs`, removed `IpAllowlistConfig` parameter from `build_router_with_options` and `RouterOptions`, removed the global allowlist middleware layer, and removed `GitHubMetaResolver` startup logic. GitHub webhook HMAC verification is unchanged. - **OpenAPI + generated clients**: Removed `ServerIpAllowlistSettings`, `ServerIpAllowlistOverrideSettings`, `IpAllowEntry`, `LiteralIpAllowEntry`, `GitHubMetaHooksEntry` schemas; removed `ip_allowlist` from `ServerNamespace` and `IntegrationWebhooksSettings`; dropped `IpAllowEntry` re-exports from `fabro-api`. - **Web UI**: Removed IP allowlist row from Settings > Security; updated nav description and page copy. - **Docs/changelog**: Security docs explicitly state Fabro provides no source-IP filtering and direct operators upstream. Changelog entry dated 2026-05-27 documents the breaking removal and annotates the 2026-04-19 entry where the feature was introduced. ### Also in this diff (unrelated to IP allowlisting) The worker control stream was migrated from reading newline-delimited JSON on stdin to a reconnecting WebSocket (`/api/v1/runs/{id}/worker/control-stream`). This adds `tokio-tungstenite` to `fabro-cli`/`fabro-server`, introduces `WorkerControlManagerHandle` with backoff reconnection and deduplication of replayed delivery IDs, and adds `RunPause`/`RunUnpause` message handling. A new integration test (`detached_run_cancel_reaches_worker_over_control_websocket`) exercises the full cancel path over the WebSocket. ### Key decisions - **Hard removal via `deny_unknown_fields`**: stale config is immediately visible as a startup error rather than silently ignored. - **No stub or default pass-through**: `IpAllowlistConfig::default()` is gone, not left as a no-op wrapper, to avoid keeping the feature shape alive. - **Webhook HMAC boundary unchanged**: source-IP filtering on webhook routes is removed; cryptographic signature verification remains the security boundary. ### Fabro Details <details> <summary>Ran 9 stages in 59m 53s for $27.24</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 15s | – | 0 | | preflight_lint | 2m 22s | – | 0 | | implement | 33m 54s | $22.81 | 0 | | simplify_opus | 5m 55s | $0.75 | 0 | | simplify_gpt | 3m 35s | $2.81 | 0 | | verify | 8m 34s | – | 0 | | fixup | 2m 24s | $0.87 | 0 | | **Total** | **59m 53s** | **$27.24** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh>	2026-05-27 22:29:08 -04:00
fabro-sh-0530[bot]	475b4ab650	Replace stdin JSONL control pipe with WebSocket worker control bus (#440) ... ## Summary Workers no longer receive control messages over stdin JSONL. A new `WorkerControlBus` abstraction (backed by `LocalWorkerControlBus` for local/single-node deployments) publishes `WorkerControlEnvelope` messages server-side; a worker-initiated WebSocket at `GET /runs/{id}/worker/control-stream` delivers them with ordered, replayable delivery frames. The bus API is designed so a Redis Streams backend can slot in later without touching API handlers or worker message handling. ### Plan Summary - **Task 1 – Bus contract:** `WorkerControlBus` trait, `WorkerControlDelivery`, `WorkerControlCursor` (`Start` / `After(id)`), bus errors. - **Task 2 – Local backend:** `LocalWorkerControlBus` — in-memory per-run stream, replay from `Start`, reconnect via `After(id)`, 1 024-message trim bound, cleanup on terminal runs. - **Task 3 – Server state:** `Arc<dyn WorkerControlBus>` added to `AppState`; `LocalWorkerControlBus` constructed at startup. - **Task 4 – Protocol extension:** `WorkerControlMessage::RunPause` / `RunUnpause`, `WorkerControlDeliveryFrame`, WebSocket liveness constants (`WORKER_CONTROL_WS_PING_INTERVAL = 15s`, `WORKER_CONTROL_WS_LIVENESS_TIMEOUT = 45s`), close-reason strings. - **Task 5 – Worker message handler:** `apply_worker_control_message` split out; pause/unpause routing; delivery-id dedupe (`AppliedWorkerControlDeliveryIds`, capacity 2 048). - **Task 6 – Worker WebSocket client:** `spawn_worker_control_manager` — HTTP→ws/wss and Unix-socket connection, backoff 100ms→5s, first-connection gate before `operations::start/resume`, ping/pong watchdog, fatal loss wired back to `execute`. - **Task 7 – Server route:** `GET /runs/{id}/worker/control-stream`, worker-only auth via new `RequireWorkerRunScoped` extractor, `Start`/`After` cursor dispatch, 410 on invalid cursor, server-side ping/pong. - **Task 8 – Stdin removal:** `RunAnswerTransport::Subprocess` renamed to `Worker { run_id, bus }`; `pump_worker_control_jsonl` deleted; worker launched with `stdin(Stdio::null())`; pause/unpause transport methods added. - **Tasks 9–10 – E2E & verification:** reconnect, invalid-cursor, cancel-over-WebSocket, and human-interview regression tests; no Redis dependency added. ### Key design decisions **`RunAnswerTransport::Subprocess` → `Worker { run_id, bus }`** — all existing transport methods (`submit`, `cancel_run`, `steer`, `interrupt`, `pair_*`) now call `bus.publish(run_id, envelope)` instead of writing to a channel that fed stdin. The match arms are symmetric, so the diff is mechanical but large. **First-connection gate** — `execute()` calls `control_manager.wait_for_first_connection().await?` before `operations::start` or `operations::resume`. Temporary failures spin with backoff; a fatal invalid-cursor or request-build failure propagates as an error before the workflow starts. **Fatal vs. reconnectable** — HTTP 410 or a WebSocket close with reason `"invalid_cursor"` is fatal (infrastructure failure, not user cancellation). Any other close/error triggers the reconnect loop while the run is non-terminal. **`AutomationStore::load` made synchronous** — startup load now uses `std::fs` under a `clippy::disallowed_methods` exception; async `tokio::fs` is no longer needed for the one-shot directory scan. Invalid automation files now fail loudly instead of being silently skipped. **`canRetry` extended to succeeded runs** — `status.kind === "succeeded"` is now retryable (non-archived). Tests and API docs updated to match. **Default model bumps** — OpenAI default: `gpt-5.4` → `gpt-5.5`; Gemini default: `gemini-3.1-pro-preview` → `gemini-3.5-flash`. ### Fabro Details <details> <summary>Ran 9 stages in 129m 19s for $58.27</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 10s | – | 0 | | preflight_lint | 2m 23s | – | 0 | | implement | 73m 48s | $41.53 | 0 | | simplify_opus | 22m 55s | $11.75 | 0 | | simplify_gpt | 7m 19s | $2.74 | 0 | | verify | 8m 51s | – | 0 | | fixup | 10m 59s | $2.24 | 0 | | **Total** | **129m 19s** | **$58.27** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh> Co-authored-by: Bryan Helmkamp <bryan@brynary.com>	2026-05-27 20:24:25 -04:00
fabro-sh-0530[bot]	2d78f96107	Wire automation store into AppState and expose CRUD REST API (#439) ... ## Summary Loads `AutomationStore` into `AppState` at server startup and exposes five authenticated REST endpoints (`GET/POST /automations`, `GET/PUT/DELETE /automations/{id}`) backed by the existing `fabro-automation` crate. ### Plan Summary - Add `fabro-automation` as a dependency of `fabro-server` and mount `Arc<AutomationStore>` on `AppState`, computed from a sibling `automations/` directory next to the active config file. - Change `AutomationStore::load` from `async` to synchronous (`std::fs`) so it can run before the Tokio runtime needs to make progress; malformed files now fail startup instead of being silently skipped. - Implement `src/server/handler/automations.rs` with shared helpers for path-ID parsing, `If-Match` (quoted/unquoted) parsing, ETag formatting, and `AutomationStoreError → ApiError` mapping. - HTTP semantics: 201 on create, 404 on missing, 409 on duplicate or stale revision, 422 on domain validation failure, 428 on missing `If-Match`. - Update `TestAppStateBuilder` to derive `active_config_path` from the vault path so each test gets an isolated sibling `automations/` directory; add `try_build()` to allow startup-failure assertions. - Update the OpenAPI spec and generated TypeScript client to include `AutomationListMeta` with a `total` field. ## Key design decisions **Sync load path.** `AutomationStore::load` is now `fn` (not `async fn`), using `std::fs`. A `#[expect(clippy::disallowed_methods)]` annotation explains the rationale: this runs once at startup before the runtime needs to yield, and avoids requiring a Tokio handle at the call site in `build_app_state`. **Fail-fast on malformed files.** Previously, corrupt TOML files were logged as warnings and skipped. Now any parse or validation error during load aborts server startup. The old `warn_load_failure` helper is deleted; tests that relied on skip behaviour are replaced with tests that assert `Err(AutomationStoreError::Parse { .. })` and `Err(AutomationStoreError::InvalidFilename { .. })`. **ETag / If-Match handling.** `parse_required_if_match` strips optional surrounding quotes before parsing the revision, so both `"<rev>"` and bare `<rev>` are accepted from clients. Missing `If-Match` on PUT/DELETE returns **428 Precondition Required**, not 400. **Test isolation.** `TestAppStateBuilder::build` now derives `active_config_path` from `vault_path.with_file_name("settings.toml")` instead of a random temp path, so the sibling `automations/` directory is predictable and cleaned up with the same temp dir. ### Fabro Details <details> <summary>Ran 10 stages in 85m 20s for $33.66</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 19s | – | 0 | | preflight_lint | 2m 5s | – | 0 | | fix_lints | 33s | $0.15 | 0 | | implement | 30m 33s | $17.35 | 0 | | simplify_opus | 20m 27s | $11.82 | 0 | | simplify_gpt | 6m 41s | $3.88 | 0 | | verify | 15m 44s | – | 0 | | fixup | 6m 8s | $0.46 | 0 | | **Total** | **85m 20s** | **$33.66** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh>	2026-05-27 18:45:59 -04:00
fabro-sh-0530[bot]	c767db897f	Add Automations API contract to OpenAPI spec and update generated clien… (#436) ... ## Summary Defines the public Automations REST API contract in the OpenAPI spec, updates the `RunSandbox` schema to reflect the new sandbox lifecycle model, adds `fabro-automation` as a dependency to `fabro-api` for type reuse, and removes the retired `fabro-devcontainer` crate and all references to it. ## What changed ### Automations API (`fabro-api.yaml`) Seven new paths under `/api/v1/automations` covering the full CRUD surface plus run sub-resources: ``` GET/POST /automations GET/PUT/DELETE /automations/{id} GET/POST /automations/{id}/runs ``` New schemas: `Automation`, `AutomationTarget`, `AutomationTrigger` (discriminated oneOf on `type`), `AutomationApiTrigger`, `AutomationScheduleTrigger`, `CreateAutomationRequest`, `ReplaceAutomationRequest`, `AutomationListResponse`. Key contract decisions: - `AutomationTrigger` uses an OpenAPI discriminator (`propertyName: type`); unknown discriminator values → HTTP 422, not 400. - `PUT` and `DELETE` require an `If-Match` header (428 if absent, 409 on mismatch); `GET` and `PUT` responses carry an `ETag`. - `POST /automations/{id}/runs` fires the automation's enabled API trigger; 409 if the automation is disabled or lacks one. - Run sub-resource responses reuse the existing `Run` and `PaginatedRunList` schemas. ### `RunSandbox` schema refactor The sandbox schema is restructured to express the full lifecycle rather than only the ready state: | Before | After | |---|---| | Flat object with `provider`, `image`, `snapshot`, `runtime` | Discriminated by `kind`: `planned`, `initializing`, `ready`, `failed` | | `runtime` was nullable | Moved into `RunSandboxInstance` (non-nullable); present only when `kind = ready` | | No failure detail | New `RunSandboxFailure` schema with `error`, `causes`, `duration_ms` | `SandboxDetails.sandbox` now references `RunSandboxInstance` (the ready state), which preserves the existing shape for the details endpoint while the richer `RunSandbox` type appears on run responses. ### Web UI (`run-sandbox-lifecycle.ts`) New helper module that bridges the old flat-object sandbox wire shape and the new lifecycle-keyed shape, with display metadata for each lifecycle state. Consumers (`RunSummaryPanel`, `TerminalView`, `RunSandbox` route, `run-detail` header/tabs) updated to route through these helpers so both old and new wire shapes are handled transparently. ### `fabro-devcontainer` removal The `fabro-devcontainer` crate is removed from `Cargo.lock`, `AGENTS.md`, nextest config, and all doc references. Public-facing changelog entries for devcontainer-specific features are removed or retitled. ### Plan Summary - Add Automations CRUD + run sub-resource paths and schemas to the OpenAPI spec - Restructure `RunSandbox` schema to model lifecycle states (`planned → initializing → ready | failed`) - Add `fabro-automation` dependency to `fabro-api` for domain-type reuse; add JSON parity round-trip tests - Regenerate Rust API types and TypeScript client - Remove `fabro-devcontainer` crate and all references - Add `run-sandbox-lifecycle.ts` helper module in the web UI and update all sandbox-state consumers ### Fabro Details <details> <summary>Ran 9 stages in 83m 29s for $35.47</summary> | Stage | Duration | Cost | Retries | |---|---|---|---| | start | 0s | – | 0 | | toolchain | 1s | – | 0 | | preflight_compile | 2m 22s | – | 0 | | preflight_lint | 2m 40s | – | 0 | | implement | 45m 36s | $28.67 | 0 | | simplify_opus | 7m 46s | $2.46 | 0 | | simplify_gpt | 6m 7s | $3.92 | 0 | | verify | 12m 8s | – | 0 | | fixup | 5m 52s | $0.43 | 0 | | **Total** | **83m 29s** | **$35.47** | **0** | </details> <details> <summary>Ran <code>ImplementPlan.fabro</code> (11 nodes and 14 edges)</summary> ```dot digraph ImplementPlan { graph [ goal="Implement and simplify", model_stylesheet=" * { model: claude-opus-4-7; } " ] rankdir=LR start [shape=Mdiamond, label="Start"] exit [shape=Msquare, label="Exit"] toolchain [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0] preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check -q --workspace 2>&1", max_retries=0] preflight_lint [label="Preflight Lint", shape=parallelogram, script="cargo +nightly-2026-04-14 clippy -q --workspace --all-targets -- -D warnings 2>&1", max_retries=0] fix_lints [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3] implement [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan. Use red/green TDD.", model="gpt-55", reasoning_effort="xhigh"] simplify_opus [label="Simplify (Opus)", prompt="@prompts/simplify.md"] simplify_gpt [label="Simplify (GPT-55)", prompt="@prompts/simplify.md", model="gpt-55"] verify [label="Verify", shape=parallelogram, script="git fetch origin main 2>&1 && git merge --no-edit --no-stat origin/main 2>&1 && cargo +nightly-2026-04-14 fmt --all 2>&1 && cargo dev docs refresh 2>&1 && cargo +nightly-2026-04-14 fmt --check --all 2>&1 && { command -v rg >/dev/null 2>&1 || { echo 'rg is required for verify'; exit 127; }; } && ! rg -n 'AuthMode::Disabled|RunAuthMethod|RunSubjectProvenance|\bActorRef\b|\bActorKind\b|AuthenticatedSubject|AuthenticatedService|AuthorizeRunScoped|AuthorizeRunBlob|AuthorizeStageArtifact|AuthorizeCommandLog|auth_method\s*==\s*\"disabled\"' lib/crates apps lib/packages docs/public/api-reference/fabro-api.yaml 2>&1 && cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings 2>&1 && cargo nextest run --workspace --status-level slow --profile ci 2>&1 && cargo dev docs check 2>&1 && bun install --frozen-lockfile 2>&1 && (cd apps/fabro-web && bun run typecheck) 2>&1 && (cd apps/fabro-web && bun run test) 2>&1 && (cd lib/packages/fabro-api-client && bun run typecheck) 2>&1 && cargo dev build -- -p fabro-cli --release 2>&1", goal_gate=true, retry_target="fixup"] fixup [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all format, clippy, Rust test, docs, TypeScript typecheck/test, and build failures.", max_visits=3] start -> toolchain toolchain -> preflight_compile [condition="outcome=succeeded"] toolchain -> exit preflight_compile -> preflight_lint [condition="outcome=succeeded"] preflight_compile -> exit preflight_lint -> implement [condition="outcome=succeeded"] preflight_lint -> fix_lints fix_lints -> preflight_lint implement -> simplify_opus -> simplify_gpt -> verify verify -> exit [condition="outcome=succeeded"] verify -> fixup fixup -> verify } ``` </details> ⚒️ Generated with [Fabro](https://fabro.sh) --------- Co-authored-by: Fabro <noreply@fabro.sh>	2026-05-27 14:07:01 -04:00
Bryan Helmkamp	352b7c5de4	refactor: remove devcontainer support (#433) ... ## Summary Remove devcontainer support from the product surface and codebase: the parser crate, workflow bridge, lifecycle execution path, typed events, CLI progress rendering, generated client field, and public/internal documentation references are all gone. ## What Changed - Deleted the dedicated parser crate and removed its Cargo dependencies and lockfile entries. - Removed workflow initialization paths that resolved repository devcontainer metadata, applied Daytona snapshots from it, merged environment variables from it, or ran its lifecycle commands. - Removed the typed event variants and CLI progress handlers for the retired lifecycle events while leaving shared unknown-event handling intact. - Cleaned the generated TypeScript client and tracked docs so repository search has no remaining devcontainer references outside git history. ## Verification - `cargo +nightly-2026-04-14 fmt --all` - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo build --workspace` - `cargo nextest run -p fabro-types` - `cargo nextest run -p fabro-workflow` - `cargo nextest run -p fabro-cli run_progress` - `cd lib/packages/fabro-api-client && bun run generate && bun run typecheck` - `cargo metadata --no-deps --format-version 1 | rg -i "fabro-devcontainer|devcontainer"` - `rg -n -i "devcontainer|dev container|dev-container|dev_container|fabro-devcontainer|\\.devcontainer" . --glob '!target/**' --glob '!.worktrees/**'` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex)	2026-05-27 12:48:40 -04:00
Bryan Helmkamp	cf124be413	fix(types): finish image.ref → image.docker rename in env var substitution ... Commit ec1b3f2 (#429) renamed `EnvironmentImageSettings::reference` to `docker` but missed the variable-substitution call site in `substitute_environment` and its companion test, breaking the workspace build. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-27 12:15:14 -04:00
Bryan Helmkamp	e13de9faaf	feat(automation): persist automation refs on runs (#428) ... ## Summary Adds durable automation metadata to workflow runs so automation-triggered runs can carry their automation and trigger references through creation, stored events, projections, summaries, fork, retry, and API surfaces. This also introduces the new `fabro-automation` crate with typed automation IDs, TOML parsing/validation, revision hashing, and a file-backed automation store. The store avoids overwriting malformed existing TOML files on create and keeps read access from being blocked by mutation disk I/O. ## Changes - Add `AutomationRef` propagation through `RunSpec`, `run.created`, store projections, summaries, fork, retry, and related tests. - Add `fabro-automation` domain/store crate for automation TOML definitions, trigger validation, revisions, create/replace/delete, and load behavior. - Update OpenAPI and regenerated TypeScript client types for `RunSpec.automation` and `AutomationRef.trigger_id`. - Add API/type regression coverage for the new automation fields. - Harden automation store create semantics so skipped malformed files still reserve their path. ## Verification - `cargo nextest run -p fabro-automation` - `cargo +nightly-2026-04-14 clippy -p fabro-automation --all-targets -- -D warnings` - `cargo nextest run -p fabro-api` - `cargo nextest run -p fabro-types run_spec_round_trips_templated_settings run_created_props_round_trip_templated_settings` - `cd lib/packages/fabro-api-client && bun run typecheck` - `cargo +nightly-2026-04-14 fmt --check --all` - `git diff --check`	2026-05-27 11:52:57 -04:00
Bryan Helmkamp	ec1b3f2084	feat(sandbox): secure daytona snapshot names (#429) ... ## Summary Secures Daytona custom snapshot creation by removing user-controlled snapshot/image references and replacing them with deterministic names Fabro computes internally. Docker image selection now uses `image.docker`, while Daytona only accepts `image.dockerfile` for custom snapshots and continues to use `daytona-medium` when no Dockerfile is configured. ## Changes - Replaces public `image.ref` config/API shape with Docker-specific `image.docker` across Rust settings, OpenAPI, generated TypeScript client, docs, defaults, examples, and web samples. - Adds Daytona snapshot identity generation using HMAC-SHA256 over a canonical manifest keyed by the Daytona API key, producing `fabro-<uuid>` snapshot names without exposing Dockerfile text or key material. - Routes Daytona custom Dockerfiles, including devcontainer-generated Dockerfiles, through the same computed identity path before calling Daytona snapshot APIs. - Updates sandbox initialization events and store projections so initialized run state can show the resolved image and computed Daytona snapshot after startup. - Updates legacy config migration behavior so Docker image refs map to `image.docker`, while Daytona legacy snapshot names are not preserved. ## Breaking Changes - `image.ref` is no longer accepted in new environment config. - Docker environments should use `image.docker` for image selection. - Daytona environments reject `image.docker`; use `image.dockerfile` to request a custom computed snapshot. ## Verification - `cargo build -p fabro-api` - `cd lib/packages/fabro-api-client && bun run generate` - `cd lib/packages/fabro-api-client && bun run typecheck` - `cd apps/fabro-web && bun run typecheck` - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo +nightly-2026-04-14 clippy --workspace --all-targets -- -D warnings` - `ulimit -n 4096 && cargo nextest run --no-fail-fast -p fabro-cli -p fabro-config -p fabro-sandbox -p fabro-workflow -p fabro-store -p fabro-server -p fabro-api` - `cargo insta pending-snapshots` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex)	2026-05-27 11:52:35 -04:00
Bryan Helmkamp	b1bd2f522c	feat(server): add variables API (#430) ... ## Summary Adds a workflow-visible variables store and HTTP API for managing non-sensitive run variables, then wires those variables into run config interpolation before run creation, validation, and preflight. ## What Changed - Adds `/api/v1/variables` CRUD endpoints backed by a JSON variable store and generated Rust/TypeScript API types. - Supports `{{ vars.NAME }}` interpolation alongside existing `{{ env.NAME }}` handling for run-owned config fields, including environment, MCP, hook, artifact, checkpoint, SCM, and notification settings. - Reuses canonical `fabro-types` variable DTOs in `fabro-api` and adds OpenAPI name patterns so clients see the same env-style variable contract enforced by the server. - Keeps variable updates store-owned with `update_existing`, avoiding duplicated not-found/update semantics in the HTTP handler. - Shares env-style name validation between variables, interpolation parsing, and vault token names to avoid grammar drift. Variables are intentionally non-sensitive: list/get responses include values, unlike vault secrets. ## Validation - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo test -p fabro-types` - `cargo test -p fabro-variable` - `cargo test -p fabro-api --test variable_round_trip` - `cargo test -p fabro-server --features test-support --test it api::variables` - `cargo +nightly-2026-04-14 clippy -p fabro-types -p fabro-variable -p fabro-vault --all-targets -- -D warnings` - `cargo +nightly-2026-04-14 clippy -p fabro-server --features test-support --all-targets -- -D warnings` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex/)	2026-05-27 11:46:36 -04:00
fabro-releases[bot]	9b8d7b798a	Bump version to 0.246.0-nightly.0	2026-05-27 10:39:37 +00:00
fabro-releases[bot]	7148e37bbe	Bump version to 0.245.0-nightly.1	2026-05-26 10:39:31 +00:00