mirror of
https://github.com/fabro-sh/fabro.git
synced 2026-09-11 22:53:00 +00:00
fb2174c7d0
## Summary API-backed Fabro agent sessions can now use the same five run-control tools that were previously MCP-only, while the server uses a single scoped `FABRO_WORKER_TOKEN` path for worker authorization. This lets server-dispatched API agents create, gather, inspect, and interact with runs without reintroducing a separate delegated run-agent token or leaking credentials into sandboxed child environments. ## Changes - Moved the reusable run-tool implementation into the new `fabro-tool` crate so MCP and API agent backends share the same tool schemas and client behavior. - Registered the five `fabro_run_*` tools for API-mode agents, with ACP sessions continuing to omit those tools. - Replaced `FABRO_RUN_AGENT_TOKEN` with scoped worker-token auth: base worker tokens keep same-run access, and `run:worker agent:run_tools` tokens can call the run-control API across runs. - Added server auth guards for run-tool actors and run-scoped-or-run-tools routes, then applied them only to the routes used by the run-tool client backend. - Kept `FABRO_WORKER_TOKEN` scrubbed from sandbox commands, hooks, ACP subprocesses, MCP env providers, and other child tool environments. ## Testing - `cargo nextest run -p fabro-server worker_token principal_middleware spawn_env --no-fail-fast` - `cargo nextest run -p fabro-cli runner --no-fail-fast` - `cargo nextest run -p fabro-workflow agent_run --no-fail-fast` - `cargo nextest run -p fabro-static --no-fail-fast` - `cargo +nightly-2026-04-14 fmt --check --all` - `cargo +nightly-2026-04-14 clippy -p fabro-server -p fabro-cli -p fabro-static --all-targets -- -D warnings` - `git diff --check` --- [](https://github.com/EveryInc/compound-engineering-plugin) 🤖 Generated with GPT-5 via [Codex](https://openai.com/codex)
131 lines
4 KiB
TOML
131 lines
4 KiB
TOML
[package]
|
|
name = "fabro-cli"
|
|
edition.workspace = true
|
|
version.workspace = true
|
|
publish = false
|
|
license.workspace = true
|
|
description = "Unified CLI for the Fabro AI framework"
|
|
|
|
[[bin]]
|
|
name = "fabro"
|
|
path = "src/main.rs"
|
|
|
|
[features]
|
|
default = []
|
|
sleep_inhibitor = ["dep:core-foundation"]
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
fabro-auth = { path = "../fabro-auth" }
|
|
fabro-config = { path = "../fabro-config" }
|
|
fabro-llm = { path = "../fabro-llm" }
|
|
fabro-model = { path = "../fabro-model" }
|
|
fabro-oauth = { path = "../fabro-oauth" }
|
|
fabro-github = { path = "../fabro-github" }
|
|
fabro-agent = { path = "../fabro-agent" }
|
|
fabro-devcontainer = { path = "../fabro-devcontainer" }
|
|
fabro-dump = { path = "../fabro-dump" }
|
|
fabro-hooks = { path = "../fabro-hooks" }
|
|
fabro-install = { path = "../fabro-install" }
|
|
fabro-interview = { path = "../fabro-interview" }
|
|
fabro-mcp = { path = "../fabro-mcp" }
|
|
fabro-mcp-server = { path = "../fabro-mcp-server" }
|
|
fabro-manifest = { path = "../fabro-manifest" }
|
|
fabro-proc = { path = "../fabro-proc" }
|
|
fabro-sandbox = { path = "../fabro-sandbox", features = ["daytona"] }
|
|
fabro-checkpoint = { path = "../fabro-checkpoint" }
|
|
fabro-graphviz = { path = "../fabro-graphviz" }
|
|
fabro-validate = { path = "../fabro-validate" }
|
|
fabro-workflow = { path = "../fabro-workflow" }
|
|
fabro-server = { path = "../fabro-server" }
|
|
fabro-client = { path = "../fabro-client" }
|
|
fabro-api = { path = "../fabro-api" }
|
|
fabro-telemetry = { path = "../fabro-telemetry" }
|
|
fabro-store = { path = "../fabro-store" }
|
|
fabro-vault = { path = "../fabro-vault" }
|
|
fabro-types = { path = "../fabro-types", features = ["clap"] }
|
|
fabro-redact.workspace = true
|
|
fabro-util = { path = "../fabro-util" }
|
|
fabro-http.workspace = true
|
|
fabro-static.workspace = true
|
|
fabro-template = { path = "../fabro-template" }
|
|
fabro-tool = { path = "../fabro-tool" }
|
|
clap.workspace = true
|
|
clap_complete.workspace = true
|
|
cli-table.workspace = true
|
|
console.workspace = true
|
|
indicatif.workspace = true
|
|
daytona-sdk.workspace = true
|
|
anyhow.workspace = true
|
|
miette.workspace = true
|
|
dotenvy.workspace = true
|
|
tokio.workspace = true
|
|
tracing.workspace = true
|
|
tracing-subscriber.workspace = true
|
|
tracing-appender.workspace = true
|
|
chrono = { workspace = true, features = ["serde"] }
|
|
dirs.workspace = true
|
|
fs2.workspace = true
|
|
serde.workspace = true
|
|
thiserror.workspace = true
|
|
toml.workspace = true
|
|
toml_edit.workspace = true
|
|
futures.workspace = true
|
|
regex.workspace = true
|
|
semver.workspace = true
|
|
progenitor-client = "0.13"
|
|
async-trait.workspace = true
|
|
jsonwebtoken.workspace = true
|
|
base64.workspace = true
|
|
ulid.workspace = true
|
|
scopeguard = "1"
|
|
rustls = { version = "0.23", default-features = false, features = ["std", "ring"] }
|
|
ring = "0.17"
|
|
x509-parser = "0.16"
|
|
rand.workspace = true
|
|
dialoguer.workspace = true
|
|
git2.workspace = true
|
|
axum.workspace = true
|
|
serde_json.workspace = true
|
|
serde_yaml = "0.9"
|
|
tempfile = "3"
|
|
sha2.workspace = true
|
|
shlex = "1"
|
|
walkdir.workspace = true
|
|
object_store.workspace = true
|
|
bytes.workspace = true
|
|
tokio-util.workspace = true
|
|
libc = "0.2"
|
|
nix = { version = "0.30", features = ["fs"] }
|
|
|
|
[target.'cfg(target_os = "macos")'.dependencies]
|
|
core-foundation = { version = "0.9", optional = true }
|
|
|
|
# Vendor openssl only for musl targets. daytona-sdk transitively pulls
|
|
# native-tls via reqwest, which needs libssl. On glibc runners the system
|
|
# libssl is used; on musl runners we compile openssl from source.
|
|
[target.'cfg(target_env = "musl")'.dependencies]
|
|
openssl = { version = "0.10", features = ["vendored"] }
|
|
|
|
[build-dependencies]
|
|
fabro-build-support = { path = "../build-support" }
|
|
chrono = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
assert_cmd = "2"
|
|
fabro-acp = { path = "../fabro-acp", features = ["test-support"] }
|
|
fabro-build-support = { path = "../build-support" }
|
|
fabro-server = { path = "../fabro-server", features = ["test-support"] }
|
|
insta = { workspace = true, features = ["filters"] }
|
|
paste = "1"
|
|
predicates = "3"
|
|
serde_json.workspace = true
|
|
tempfile = "3"
|
|
temp-env = "0.3"
|
|
httpmock = "0.8"
|
|
fabro-test = { workspace = true }
|
|
fabro-macros = { path = "../fabro-macros" }
|
|
hkdf.workspace = true
|
|
reqwest = { workspace = true, features = ["cookies"] }
|