Find a file
arc-1e68f1[bot] 43f5fb0edb
Inject GitHub App IAT into Sandbox as GITHUB_TOKEN (#7)
This PR adds GitHub App Installation Access Token (IAT) injection into
sandboxes, allowing `gh` CLI and other GitHub-authenticated tools to
work seamlessly inside workflow sandboxes. Workflow authors can declare
required GitHub permissions in `workflow.toml` under a `[github]`
section (e.g., `permissions = { contents = "write", pull_requests =
"read" }`), with project-wide defaults available in `fabro.toml`.
Workflow-level config fully replaces project-level defaults, consistent
with existing `[pull_request]` behavior.

The implementation introduces a `GitHubConfig` struct wired through
`WorkflowRunConfig`, `RunDefaults`, and `ProjectConfig`, with proper
`apply_defaults` (inherit if unset) and `merge_overlay` (replace if
present) semantics. At runtime, a new `mint_github_token()` helper signs
a JWT, resolves the repo's owner/repo from the origin URL, and requests
a scoped IAT which is injected as `GITHUB_TOKEN` into the sandbox
environment. The previously private
`create_installation_access_token_with_permissions` in `fabro-github` is
made public to support this. A preflight check also mints a token during
validation to surface credential or permission issues early.

Comprehensive tests cover TOML parsing with and without `[github]`,
default inheritance, workflow-over-default precedence, and overlay merge
semantics for `RunDefaults`.

### Fabro Details

<details>
<summary>Ran 7 stages in 27m 15s for $5.88</summary>

| Stage | Duration | Cost | Retries |
|---|---|---|---|
| start | 0s | – | 0 |
| toolchain | 0s | – | 0 |
| preflight_compile | 0s | – | 0 |
| preflight_lint | 0s | – | 0 |
| implement | 0s | $3.79 | 0 |
| simplify | 0s | $2.09 | 0 |
| verify | 0s | – | 0 |
| **Total** | **27m 15s** | **$5.88** | **0** |

</details>

<details>
<summary>Ran <code>ImplementAndSimplify.fabro</code> (10 nodes and 13
edges)</summary>

```dot
digraph ImplementAndSimplify {
    graph [
        goal="Implement and simplify",
        model_stylesheet="
            * { backend: api; model: claude-opus-4-6;}
        "
    ]
    rankdir=LR

    start [shape=Mdiamond, label="Start"]
    exit  [shape=Msquare, label="Exit"]

    toolchain         [label="Toolchain", shape=parallelogram, script="command -v cargo >/dev/null || { curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y && sudo ln -sf $HOME/.cargo/bin/* /usr/local/bin/; }; cargo --version 2>&1", max_retries=0]
    preflight_compile [label="Preflight Compile", shape=parallelogram, script="cargo check 2>&1", max_retries=0]
    preflight_lint    [label="Preflight Lint", shape=parallelogram, script="cargo clippy -- -D warnings 2>&1", max_retries=0]
    fix_lints         [label="Fix Lints", prompt="The preflight lint step failed. Read the build output from context and fix all clippy lint warnings.", max_visits=3]
    implement         [label="Implement", prompt="Read the plan file referenced in the goal and implement every step. Make all the code changes described in the plan."]
    simplify          [label="Simplify", prompt="@prompts/simplify.md"]
    verify            [label="Verify", shape=parallelogram, script="cargo clippy -- -D warnings 2>&1 && cargo test 2>&1", goal_gate=true, retry_target="fixup"]
    fixup             [label="Fixup", prompt="The verify step failed. Read the build output from context and fix all clippy lint warnings and test failures.", max_visits=3]

    start -> toolchain
    toolchain -> preflight_compile [condition="outcome=success"]
    toolchain -> exit
    preflight_compile -> preflight_lint [condition="outcome=success"]
    preflight_compile -> exit
    preflight_lint -> implement [condition="outcome=success"]
    preflight_lint -> fix_lints
    fix_lints -> preflight_lint
    implement -> simplify -> verify
    verify -> exit  [condition="outcome=success"]
    verify -> fixup
    fixup -> verify
}

```

</details>

⚒️ Generated with [Fabro](https://fabro.sh)

---------

Co-authored-by: Fabro <noreply@fabro.sh>
Co-authored-by: Claude <claude@anthropic.com>
2026-03-15 18:24:30 -04:00
.cargo Disable empty doc-tests and add terse test output alias 2026-02-23 10:57:26 -05:00
.claude Update docs for rewind, workflow list, daytona, and validation 2026-03-14 13:51:57 -04:00
.config Fix Daytona e2e test failures and improve test reliability 2026-03-08 18:51:43 -04:00
.github rename Arc to Fabro in all Rust crates, symbols, env vars, and supporting files 2026-03-12 12:25:58 -04:00
apps Update docs, frontend, marketing, and skills for .fabro extension 2026-03-13 22:38:25 -04:00
bin rename docs-internal to files-internal 2026-03-12 14:50:27 -04:00
docker rename Arc to Fabro in all Rust crates, symbols, env vars, and supporting files 2026-03-12 12:25:58 -04:00
docs Inject GitHub App IAT into Sandbox as GITHUB_TOKEN (#7) 2026-03-15 18:24:30 -04:00
docs-internal Fold CheckpointSaved into CheckpointCompleted 2026-03-15 14:43:09 -04:00
fabro/workflows cleanup workflows 2026-03-15 11:04:04 -04:00
lib Inject GitHub App IAT into Sandbox as GITHUB_TOKEN (#7) 2026-03-15 18:24:30 -04:00
skills/fabro-create-workflow Update docs, frontend, marketing, and skills for .fabro extension 2026-03-13 22:38:25 -04:00
test Use temp dir for dry-run instead of ~/.fabro/runs to avoid clutter in fabro ps -a 2026-03-15 17:27:10 -04:00
.env.example fix clippy large_enum_variant and rename ARC_ env vars in .env.example 2026-03-12 14:37:22 -04:00
.gitignore Track .claude directory and add docs skill watermark 2026-03-08 11:23:07 -04:00
AGENTS.md Rename arc/ to fabro/ in git branch prefixes and workflow paths 2026-03-14 12:20:07 -04:00
bun.lock Rename Arc to Fabro in TypeScript/JavaScript 2026-03-12 11:13:18 -04:00
Cargo.lock Bump quinn-proto from 0.11.13 to 0.11.14 (#1) 2026-03-15 17:41:32 -04:00
Cargo.toml Adopt cli-table for ANSI-aware table rendering and fix fabro ps bugs 2026-03-15 17:27:10 -04:00
CLAUDE.md Move CLAUDE.md to AGENTS.md with symlink for compatibility 2026-03-09 13:02:06 -04:00
CONTRIBUTING.md fix remaining arc references in README, CONTRIBUTING, docs-internal 2026-03-12 12:28:04 -04:00
fabro.toml chore: bump snapshot to fabro-v5 2026-03-15 17:27:09 -04:00
install.sh rename Arc to Fabro in all Rust crates, symbols, env vars, and supporting files 2026-03-12 12:25:58 -04:00
LICENSE.md Add README.md and MIT LICENSE 2026-03-10 14:48:58 -04:00
package.json Move packages/ to lib/packages/ and update all references 2026-03-09 13:13:56 -04:00
README.md commas 2026-03-15 12:31:08 -04:00

Fabro

The open source, dark software factory for expert engineers

AI coding agents are powerful but unpredictable. You either babysit every step or review a 50-file diff you don't trust. Fabro gives you a middle path: define the process as a graph, let agents execute it, and intervene only where it matters. Why Fabro?

License: MIT docs

curl -fsSL https://fabro.sh/install.sh | bash
Fabro Runs board showing workflows across Working, Pending, Verify, and Merge stages

Use Cases

  • Extend disengagement time — Stop babysitting an agent REPL. Define a workflow with verification gates and walk away — Fabro keeps the process on track without you.
  • Leverage ensemble intelligence — Seamlessly combine models from different vendors. Use one model to implement, another to cross-critique, and a third to summarize — all in a single workflow.
  • Share best practices across your team — Collaborate on version-controlled workflows that encode your software processes as code. Review, iterate, and reuse them like any other source file.
  • Reduce token bills — Route cheap tasks to fast, inexpensive models and reserve frontier models for the steps that need them. CSS-like stylesheets make this a one-line change.
  • Improve agent security — Run agents in cloud sandboxes with full network and filesystem isolation. Keep untrusted code off your laptop and out of your production environment.
  • Run agents 24/7 — Fabro's API server queues and executes runs continuously. Close your laptop — workflows keep running and results are waiting when you return.
  • Scale infinitely — Move execution off your laptop and into cloud sandboxes. Run as many concurrent workflows as your infrastructure allows.
  • Guarantee code quality — Layer deterministic verifications — test suites, linters, type checkers, LLM-as-judge — into your workflow graph. Failures trigger fix loops automatically.
  • Achieve compounding engineering — Automatic retrospectives after every run feed a continuous improvement loop. Your workflows get better over time, not just your code.
  • Specify in natural language — Define requirements as natural-language specs and let Fabro generate — and regenerate — implementations that conform to them.

Key Features

Feature Description
🔀 Deterministic workflow graphs Define pipelines in Graphviz DOT with branching, loops, parallelism, and human gates. Diffable, reviewable, version-controlled
🙋 Human-in-the-loop Approval gates pause for human decisions. Steer running agents mid-turn. Interview steps collect structured input
🎨 Multi-model routing CSS-like stylesheets route each node to the right model and provider, with automatic fallback chains
☁️ Cloud sandboxes Run agents in isolated Daytona cloud VMs with snapshot-based setup, network controls, and automatic cleanup
🔌 SSH access and preview links Shell into running sandboxes with fabro ssh and expose ports with fabro preview for live debugging
🌲 Git checkpointing Every stage commits code changes and execution metadata to Git branches. Resume, revert, or trace any change
📊 Automatic retros Each run generates a retrospective with cost, duration, files touched, and an LLM-written narrative
Comprehensive API REST API with SSE event streaming and a React web UI. Run workflows programmatically or as a service
🦀 Single binary, no runtime One compiled Rust executable with zero dependencies. No Python, no Node, no Docker required
⚖️ Open source (MIT) Full source code, no vendor lock-in. Self-host, fork, or extend to fit your workflow

Example Workflow

A plan-approve-implement workflow where a human reviews the plan before the agent writes code:

Plan-Implement workflow graph showing Start → Plan → Approve Plan → Implement → Simplify → Exit with a Revise loop
digraph PlanImplement {
    graph [
        goal="Plan, approve, implement, and simplify a change"
        model_stylesheet="
            *        { model: claude-haiku-4-5; reasoning_effort: low; }
            .coding  { model: claude-sonnet-4-5; reasoning_effort: high; }
        "
    ]

    start [shape=Mdiamond, label="Start"]
    exit  [shape=Msquare, label="Exit"]

    plan      [label="Plan", prompt="Analyze the goal and codebase. Write a step-by-step plan.", reasoning_effort="high"]
    approve   [shape=hexagon, label="Approve Plan"]
    implement [label="Implement", class="coding", prompt="Read plan.md and implement every step."]
    simplify  [label="Simplify", class="coding", prompt="Review the changes for clarity and correctness."]

    start -> plan -> approve
    approve -> implement [label="[A] Approve"]
    approve -> plan      [label="[R] Revise"]
    implement -> simplify -> exit
}

Agents run as multi-turn LLM sessions with tool access. Human gates (hexagon) pause for approval. The stylesheet routes planning to a cheap model and coding to a frontier model. See the DOT language reference for the full syntax.


📖 Documentation

Fabro ships with comprehensive documentation covering every feature in depth:

  • Getting Started -- Installation, first workflow, and why Fabro exists
  • Defining Workflows -- Node types, transitions, variables, stylesheets, and human gates
  • Executing Workflows -- Run configuration, sandboxes, checkpoints, retros, and failure handling
  • Tutorials -- Step-by-step guides from hello world to parallel multi-model ensembles
  • API Reference -- Full OpenAPI spec with authentication, SSE events, and client SDKs

Quick Start

Install

curl -fsSL https://fabro.sh/install.sh | bash

# Initialize your project
cd my-repo/
fabro init

# Run your first workflow
fabro run hello

Help or Feedback


License

Fabro is licensed under the MIT License.