Expose a run-scoped websocket terminal for Docker and Daytona sandboxes, and add the web terminal route so sandbox-backed runs can be inspected interactively from the run detail page.
Expand the OpenAPI contract for frontend auth and workflow routes, regenerate the TypeScript Axios client, and route web API calls through generated client classes while preserving SSE and install exceptions.
Adds a GitHub-style left sidebar to /runs/:id/files using @pierre/trees.
Lists only the modified files, shows git status per row, and wires
selection into the existing #file=<path> deep-link flow so clicking a
row scrolls and focuses the matching diff. Uses the @pierre/theme
pierre-dark Shiki theme for visual parity with @pierre/diffs.
Configured read-only (no drag-and-drop, no rename), flattens empty
directory chains, defaults to standard icons and default density, and
filters via hide-non-matches search. Hidden below the md breakpoint to
match where the diff style is forced to unified.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Replace React Router loader/action state paths with SWR query and mutation hooks.
Add targeted run and board EventSource managers that invalidate SWR keys, and refresh embedded SPA assets.
Patches GHSA-j687-52p2-xcff (CVE-2026-41067): XSS in define:vars via
incomplete </script> tag sanitization. Requires Astro >= 6.1.6.
Also bumps @astrojs/react to ^5.0.4 for Astro 6 compatibility.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Bumps @pierre/diffs from 1.0.11 to 1.1.15 to pick up the Virtualizer
component and renderHeaderPrefix/renderCustomHeader hooks the Run
Files tab relies on for large-diff performance. 1.0 -> 1.1 merged
MouseEventManager/LineSelectionManager into InteractionManager but
the public React components (MultiFileDiff, PatchDiff, FileDiff,
File) keep their existing shape, so no consumer changes are needed
yet -- Unit 10 exercises the new features.
Pins an exact version (1.1.15) rather than a caret range so bun
doesn't resolve up to 1.1.16, which was published today and would
trip the "no packages younger than 24 h" rule in the user-global
policy.
The redundant apps/fabro-web/bun.lock is removed; bun workspaces
resolve against the root bun.lock and the per-app lockfile was
drifting from it. Embedded SPA bundle (lib/crates/fabro-spa/assets/)
is refreshed to match the new build output.
Refs plan docs/plans/2026-04-19-002-feat-run-files-changed-tab-plan.md
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Tighten the browser-based install flow after correctness and adversarial
review, without changing the external wizard shape.
- Persist the actual bind in server.listen, not the canonical URL
- Reject concurrent /install/finish and rapid GitHub App retries
- Keep the prior GitHub Token strategy until App callback succeeds
- Recover from poisoned install locks instead of propagating panics
- Rollback both settings and vault on failed persistence
- Redirect GitHub callback errors back into the wizard UI
- Validate LLM keys via /models probe instead of a billed generate()
- Reject canonical URLs with trailing slash, path, query, or fragment
- Accept any valid install-token source, not just the first present one
- Redact the install token in structured logs
- Assert install-mode SPA marker injection at startup
- Warn on suspected concurrent operators via UA + X-Forwarded-For
- Add component-level test for the GitHub callback error banner
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Add marked and @tailwindcss/typography to render markdown content as
HTML in the stage detail view instead of displaying raw text in a <pre>.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
SQLite was retired as the server metadata store in d490dbe4.
Remove dead sqlx workspace dep, better-sqlite3 trustedDependencies,
and update docs that still referenced SQLite persistence.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sets up apps/remotion with a 5-second 1080p intro video featuring the
Fabro symbol, logotype, and tagline animated over the brand navy background.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Render DOT workflow definitions as visual SVG diagrams at build time
using @viz-js/viz, replacing raw code blocks on show pages and
placeholder first-letter thumbnails on index cards
- Collapse models/skills/languages into a compact metadata strip on
show pages instead of separate boxed sections
- Fix prompt expand/collapse to use a single DOM element with max-height
animation instead of duplicating the text in two swapped containers
- Add prev/next navigation links at the bottom of show pages
- Extract duplicated langIcons data into shared src/lib/langIcons.ts
- Use varied reveal animation types (reveal-scale, reveal-left)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Updated: package.json workspaces, tsconfig path alias, CI workflow
paths, Dockerfile COPY, AGENTS.md, and doc references.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Sets up Tailwind v4 via @tailwindcss/vite, adds the full brand palette
(teal, navy, ice, mint, amber, coral) as custom theme tokens, and builds
a complete homepage with hero, feature grid, code examples, verification
section, multi-model section, observability, "Why Arc", and CTAs.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace ARC_INSECURE_DISABLE_AUTHENTICATION and ARC_API_BASE_URL env vars
with [auth] and [api] sections in ~/.arc/arc.toml. Only secrets
(ARC_JWT_PUBLIC_KEY, ARC_JWT_PRIVATE_KEY) remain as env vars.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace cookie-based sessions with SQLite-backed storage using
better-sqlite3 and React Router's createSessionStorage. Sessions are
now stored in ~/.arc/arc-web.db with a session ID cookie, enabling
larger payloads and server-side revocation.
- Add db.server.ts (lazy singleton, WAL mode, web_sessions table)
- Add session-storage.server.ts (CRUD ops, probabilistic cleanup)
- Fetch primary verified email from /user/emails during OAuth
- Add emails:read to GitHub App manifest default_permissions
- Expand session data: userUrl, githubId, githubNodeId, email
- Default ARC_API_BASE_URL to localhost:3000
- Whitelist better-sqlite3 in trustedDependencies
- Externalize better-sqlite3 from Vite SSR bundling
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds one-click GitHub App setup via the manifest flow, OAuth login
via Arctic, and cookie-based sessions so the app shell shows the
real authenticated user instead of a hardcoded placeholder.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace openapi-typescript types-only output with a full TypeScript Axios
client generated by openapi-generator-cli. The generated code is committed
so IDE support works without running codegen. arc-web consumes the client
via bun workspaces.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
