Find a file
dependabot[bot] 0929eaac87
Bump quinn-proto from 0.11.13 to 0.11.14 (#1)
Bumps [quinn-proto](https://github.com/quinn-rs/quinn) from 0.11.13 to
0.11.14.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/quinn-rs/quinn/releases">quinn-proto's
releases</a>.</em></p>
<blockquote>
<h2>quinn-proto 0.11.14</h2>
<p><a href="https://github.com/jxs"><code>@​jxs</code></a> reported a
denial of service issue in quinn-proto 5 days ago:</p>
<ul>
<li><a
href="https://github.com/quinn-rs/quinn/security/advisories/GHSA-6xvm-j4wr-6v98">https://github.com/quinn-rs/quinn/security/advisories/GHSA-6xvm-j4wr-6v98</a></li>
</ul>
<p>We coordinated with them to release this version to patch the issue.
Unfortunately the maintainers missed these issues during code review and
we did not have enough fuzzing coverage -- we regret the oversight and
have added an additional fuzzing target.</p>
<p>Organizations that want to participate in coordinated disclosure can
contact us privately to discuss terms.</p>
<h2>What's Changed</h2>
<ul>
<li>Fix over-permissive proto dependency edge by <a
href="https://github.com/Ralith"><code>@​Ralith</code></a> in <a
href="https://redirect.github.com/quinn-rs/quinn/pull/2385">quinn-rs/quinn#2385</a></li>
<li>0.11.x: avoid unwrapping VarInt decoding during parameter parsing by
<a href="https://github.com/djc"><code>@​djc</code></a> in <a
href="https://redirect.github.com/quinn-rs/quinn/pull/2559">quinn-rs/quinn#2559</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="2c315aa7f9"><code>2c315aa</code></a>
proto: bump version to 0.11.14</li>
<li><a
href="8ad47f431e"><code>8ad47f4</code></a>
Use newer rustls-pki-types PEM parser API</li>
<li><a
href="c81c0289ab"><code>c81c028</code></a>
ci: fix workflow syntax</li>
<li><a
href="0050172969"><code>0050172</code></a>
ci: pin wasm-bindgen-cli version</li>
<li><a
href="8a6f82c58d"><code>8a6f82c</code></a>
Take semver-compatible dependency updates</li>
<li><a
href="e52db4ad8d"><code>e52db4a</code></a>
Apply suggestions from clippy 1.91</li>
<li><a
href="6df7275c58"><code>6df7275</code></a>
chore: Fix <code>unnecessary_unwrap</code> clippy</li>
<li><a
href="c8eefa07e0"><code>c8eefa0</code></a>
proto: avoid unwrapping varint decoding during parameters parsing</li>
<li><a
href="9723a97775"><code>9723a97</code></a>
fuzz: add fuzzing target for parsing transport parameters</li>
<li><a
href="eaf0ef3025"><code>eaf0ef3</code></a>
Fix over-permissive proto dependency edge (<a
href="https://redirect.github.com/quinn-rs/quinn/issues/2385">#2385</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/quinn-rs/quinn/compare/quinn-proto-0.11.13...quinn-proto-0.11.14">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=quinn-proto&package-manager=cargo&previous-version=0.11.13&new-version=0.11.14)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/fabro-sh/fabro/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-15 17:41:32 -04:00
.cargo Disable empty doc-tests and add terse test output alias 2026-02-23 10:57:26 -05:00
.claude Update docs for rewind, workflow list, daytona, and validation 2026-03-14 13:51:57 -04:00
.config Fix Daytona e2e test failures and improve test reliability 2026-03-08 18:51:43 -04:00
.github rename Arc to Fabro in all Rust crates, symbols, env vars, and supporting files 2026-03-12 12:25:58 -04:00
apps Update docs, frontend, marketing, and skills for .fabro extension 2026-03-13 22:38:25 -04:00
bin rename docs-internal to files-internal 2026-03-12 14:50:27 -04:00
docker rename Arc to Fabro in all Rust crates, symbols, env vars, and supporting files 2026-03-12 12:25:58 -04:00
docs Rename metadata branch from refs/fabro/{run_id} to fabro/meta/{run_id} (#3) 2026-03-15 17:40:51 -04:00
docs-internal Fold CheckpointSaved into CheckpointCompleted 2026-03-15 14:43:09 -04:00
fabro/workflows cleanup workflows 2026-03-15 11:04:04 -04:00
lib Plan: Add prevent_idle_sleep to fabro via fabro-beastie (#5) 2026-03-15 17:41:20 -04:00
skills/fabro-create-workflow Update docs, frontend, marketing, and skills for .fabro extension 2026-03-13 22:38:25 -04:00
test Use temp dir for dry-run instead of ~/.fabro/runs to avoid clutter in fabro ps -a 2026-03-15 17:27:10 -04:00
.env.example fix clippy large_enum_variant and rename ARC_ env vars in .env.example 2026-03-12 14:37:22 -04:00
.gitignore Track .claude directory and add docs skill watermark 2026-03-08 11:23:07 -04:00
AGENTS.md Rename arc/ to fabro/ in git branch prefixes and workflow paths 2026-03-14 12:20:07 -04:00
bun.lock Rename Arc to Fabro in TypeScript/JavaScript 2026-03-12 11:13:18 -04:00
Cargo.lock Bump quinn-proto from 0.11.13 to 0.11.14 (#1) 2026-03-15 17:41:32 -04:00
Cargo.toml Adopt cli-table for ANSI-aware table rendering and fix fabro ps bugs 2026-03-15 17:27:10 -04:00
CLAUDE.md Move CLAUDE.md to AGENTS.md with symlink for compatibility 2026-03-09 13:02:06 -04:00
CONTRIBUTING.md fix remaining arc references in README, CONTRIBUTING, docs-internal 2026-03-12 12:28:04 -04:00
fabro.toml chore: bump snapshot to fabro-v5 2026-03-15 17:27:09 -04:00
install.sh rename Arc to Fabro in all Rust crates, symbols, env vars, and supporting files 2026-03-12 12:25:58 -04:00
LICENSE.md Add README.md and MIT LICENSE 2026-03-10 14:48:58 -04:00
package.json Move packages/ to lib/packages/ and update all references 2026-03-09 13:13:56 -04:00
README.md commas 2026-03-15 12:31:08 -04:00

Fabro

The open source, dark software factory for expert engineers

AI coding agents are powerful but unpredictable. You either babysit every step or review a 50-file diff you don't trust. Fabro gives you a middle path: define the process as a graph, let agents execute it, and intervene only where it matters. Why Fabro?

License: MIT docs

curl -fsSL https://fabro.sh/install.sh | bash
Fabro Runs board showing workflows across Working, Pending, Verify, and Merge stages

Use Cases

  • Extend disengagement time — Stop babysitting an agent REPL. Define a workflow with verification gates and walk away — Fabro keeps the process on track without you.
  • Leverage ensemble intelligence — Seamlessly combine models from different vendors. Use one model to implement, another to cross-critique, and a third to summarize — all in a single workflow.
  • Share best practices across your team — Collaborate on version-controlled workflows that encode your software processes as code. Review, iterate, and reuse them like any other source file.
  • Reduce token bills — Route cheap tasks to fast, inexpensive models and reserve frontier models for the steps that need them. CSS-like stylesheets make this a one-line change.
  • Improve agent security — Run agents in cloud sandboxes with full network and filesystem isolation. Keep untrusted code off your laptop and out of your production environment.
  • Run agents 24/7 — Fabro's API server queues and executes runs continuously. Close your laptop — workflows keep running and results are waiting when you return.
  • Scale infinitely — Move execution off your laptop and into cloud sandboxes. Run as many concurrent workflows as your infrastructure allows.
  • Guarantee code quality — Layer deterministic verifications — test suites, linters, type checkers, LLM-as-judge — into your workflow graph. Failures trigger fix loops automatically.
  • Achieve compounding engineering — Automatic retrospectives after every run feed a continuous improvement loop. Your workflows get better over time, not just your code.
  • Specify in natural language — Define requirements as natural-language specs and let Fabro generate — and regenerate — implementations that conform to them.

Key Features

Feature Description
🔀 Deterministic workflow graphs Define pipelines in Graphviz DOT with branching, loops, parallelism, and human gates. Diffable, reviewable, version-controlled
🙋 Human-in-the-loop Approval gates pause for human decisions. Steer running agents mid-turn. Interview steps collect structured input
🎨 Multi-model routing CSS-like stylesheets route each node to the right model and provider, with automatic fallback chains
☁️ Cloud sandboxes Run agents in isolated Daytona cloud VMs with snapshot-based setup, network controls, and automatic cleanup
🔌 SSH access and preview links Shell into running sandboxes with fabro ssh and expose ports with fabro preview for live debugging
🌲 Git checkpointing Every stage commits code changes and execution metadata to Git branches. Resume, revert, or trace any change
📊 Automatic retros Each run generates a retrospective with cost, duration, files touched, and an LLM-written narrative
Comprehensive API REST API with SSE event streaming and a React web UI. Run workflows programmatically or as a service
🦀 Single binary, no runtime One compiled Rust executable with zero dependencies. No Python, no Node, no Docker required
⚖️ Open source (MIT) Full source code, no vendor lock-in. Self-host, fork, or extend to fit your workflow

Example Workflow

A plan-approve-implement workflow where a human reviews the plan before the agent writes code:

Plan-Implement workflow graph showing Start → Plan → Approve Plan → Implement → Simplify → Exit with a Revise loop
digraph PlanImplement {
    graph [
        goal="Plan, approve, implement, and simplify a change"
        model_stylesheet="
            *        { model: claude-haiku-4-5; reasoning_effort: low; }
            .coding  { model: claude-sonnet-4-5; reasoning_effort: high; }
        "
    ]

    start [shape=Mdiamond, label="Start"]
    exit  [shape=Msquare, label="Exit"]

    plan      [label="Plan", prompt="Analyze the goal and codebase. Write a step-by-step plan.", reasoning_effort="high"]
    approve   [shape=hexagon, label="Approve Plan"]
    implement [label="Implement", class="coding", prompt="Read plan.md and implement every step."]
    simplify  [label="Simplify", class="coding", prompt="Review the changes for clarity and correctness."]

    start -> plan -> approve
    approve -> implement [label="[A] Approve"]
    approve -> plan      [label="[R] Revise"]
    implement -> simplify -> exit
}

Agents run as multi-turn LLM sessions with tool access. Human gates (hexagon) pause for approval. The stylesheet routes planning to a cheap model and coding to a frontier model. See the DOT language reference for the full syntax.


📖 Documentation

Fabro ships with comprehensive documentation covering every feature in depth:

  • Getting Started -- Installation, first workflow, and why Fabro exists
  • Defining Workflows -- Node types, transitions, variables, stylesheets, and human gates
  • Executing Workflows -- Run configuration, sandboxes, checkpoints, retros, and failure handling
  • Tutorials -- Step-by-step guides from hello world to parallel multi-model ensembles
  • API Reference -- Full OpenAPI spec with authentication, SSE events, and client SDKs

Quick Start

Install

curl -fsSL https://fabro.sh/install.sh | bash

# Initialize your project
cd my-repo/
fabro init

# Run your first workflow
fabro run hello

Help or Feedback


License

Fabro is licensed under the MIT License.