Adds bundled plugin resolution for `@runfusion/fusion`, including a dist candidate check in `bundled-plugin-install.ts` and regression tests covering the install path, with a patch changeset prepared.
Fusion-Task-Id: FN-5630
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Fusion-Task-Id: FN-5630
Instead of immediately parking the task as failed when the auto-merge
fast-path detects a non-ancestor commitSha (the symptom of a pre-FN-5627
TOCTOU poisoning), clear the poisoned mergeDetails fields and re-enqueue
for a fresh aiMergeTask attempt. The branch typically still has the work
intact; the merger just needs to redo the squash + ref-advance with the
now-fixed flow.
Recovery semantics:
- mergeRetries < MAX_AUTO_MERGE_RETRIES (3): clear poisoned fields
(commitSha, mergedAt, landedFiles, filesChanged, insertions, deletions,
noOpVerifiedShortCircuit, landedFilesAttributionRestricted, mergeConfirmed),
increment mergeRetries, clear status/error, re-enqueue via
internalEnqueueMerge. Emit new merger:fast-path-auto-recovered audit event.
- mergeRetries >= MAX_AUTO_MERGE_RETRIES: terminal park as failed (existing
behavior), with merger:fast-path-blocked-foreign-commit audit event
carrying budgetExhausted=true.
The recoverable path keeps the task in in-review with status=null, so
downstream consumers (dashboard banner, ntfy notifications) don't surface
a transient failure for what should be a self-healing event. The terminal
path remains FN-4538/FN-5488 compatible: status=failed at retry ceiling
on in-review is recognized by clearStaleBlockedBy fast paths so
downstream todos don't deadlock.
Tests updated and added:
- FN-5627 auto-recover test: asserts mergeRetries=1, status=null, all
poisoned fields cleared, no moveTask('done'), no task:merged emit.
- FN-5627 budget-exhausted test: asserts status=failed with descriptive
error, mergeRetries=3 input, no moveTask('done').
Fusion-Task-Id: FN-5627
The merger persisted `mergeConfirmed: true` + `commitSha` to the task row
as soon as the local squash commit was built, BEFORE running
`git update-ref refs/heads/<integration>` to actually advance the
integration branch. If the ref-advance then failed for any reason (lock
contention, hook rejection, packed-refs race, or a misclassified non-CAS
error via the merger-ref-update-advance.ts string heuristic), the task row
was poisoned: the auto-merge scheduler's mergeConfirmed fast-path would
silently promote the never-landed work to 'done' on the next tick,
including emitting task:merged and closing the linked GitHub tracking
issue. The 'expected SHA == observed SHA' log signature on FN-5625 was a
red herring — the ref-advance had failed for non-race reasons but the
string heuristic in merger-ref-update-advance.ts classified it as
'concurrent-advance', and the downstream IntegrationBranchConcurrentAdvanceError
routed through the unsafe 'merge already confirmed' recovery path.
This silently dropped real work on at least 9 tasks across 2026-05-27/28
(FN-5596, FN-5597, FN-5599, FN-5612, FN-5613, FN-5614, FN-5616, FN-5623,
FN-5625) and likely affected older now-archived tasks for which evidence
has been pruned.
Three-layer fix:
1. merger.ts (~9752): in reuseTaskWorktreeMerge mode, persist
`mergeConfirmed: false` initially. After advanceIntegrationBranchRef
returns advanced=true, do a follow-up updateTask to flip the flag.
Other merge paths (legacy in-place, verified no-op fast-paths,
owned-commit recovery) advance the ref BEFORE the mergeDetails write
and remain unchanged.
2. project-engine.ts (~1378): defense-in-depth reachability gate on the
auto-merge 'merge already confirmed' fast-path. Before moveTask to
'done', verify `git merge-base --is-ancestor <commitSha>
refs/heads/<integration>` succeeds. On failure, clear mergeConfirmed,
set status='failed' with descriptive error, leave task in 'in-review',
and emit `merger:fast-path-blocked-foreign-commit` run-audit event.
Legitimate no-op merges (no commitSha) bypass the gate; ancient tasks
missing mergeTargetBranch also bypass to avoid false-positive parks.
3. merger-ref-update-advance.ts (~189): replace fragile string heuristic
('is at' / 'expected' / 'cannot lock ref' in stderr) with structured
detection. After update-ref fails, re-read the ref: if observed ==
expected, classify as `ref-update-refused` (no race occurred); only
classify as `concurrent-advance` when ref actually moved. Eliminates
the misleading 'expected X observed X' same-SHA pair.
Tests: 3 new regression tests covering all three layers. Full engine
suite: 6150 tests pass.
Fixes:
- FN-5625 (autopilot validator trigger fix lost)
- FN-5623 (`fn goals` CLI lost)
- FN-5616 (source-issue close handlers lost)
- FN-5614 (`fn update` collision retry lost)
- FN-5613 (dashboard reload banner lost)
- FN-5612 (bundled-plugin-install lost)
- FN-5599 (tablet modal width lost)
- FN-5597 (ntfy notifier priority lost)
- FN-5596 (PR tab spacing test lost)
Fusion-Task-Id: FN-5627
Implements graceful suppression of transient `task.json` ENOENT errors in the executor, logging a suppression signal and surfacing a banner in the UI, with test coverage for both the executor behavior and notification service. Documentation in `docs/architecture.md` and a changeset for `@runfusion/f
Fusion-Task-Id: FN-5624
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Fusion-Task-Id: FN-5624
Prior attempt accepted either fs.watch failure path (sync throw vs async
error event) — but on Linux Node, fs.watch with `recursive: true` on a
missing directory silently succeeds (returns a no-op watcher, never
throws, never emits an error). Neither catch arm fires, so the warning
the test wants to assert never appears.
Switch to a NUL-byte-embedded path. Node validates the path argument up
front and throws ERR_INVALID_ARG_VALUE synchronously on every platform,
guaranteeing the `watch:fs-watch-setup` catch arm runs. Restore the
strict assertions on phase + message.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Introduces a Goals REST API (`GET/POST/PUT /api/goals` and `GET/PUT /api/goals/:id`) backed by a new `@fusion/core` goal store and typed goal types, including comprehensive route and store test coverage. Documentation on architecture and storage is updated to reflect the new domain, and a changeset
Fusion-Task-Id: FN-5622
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Fusion-Task-Id: FN-5622
`store-activity.test.ts > "logs fs.watch setup failures and keeps polling
active"` flakes on Linux CI: it sets `tasksDir` to a non-existent path
and expects `fs.watch` to throw synchronously (routed to
`watch:fs-watch-setup`). macOS Node does throw, but Linux Node returns a
watcher that emits an async `error` event instead (routed to
`watch:fs-watch-error`). The contract this test guards is "log the
failure and keep polling alive" — not which catch arm handled it.
Match either warning message + phase, and use `vi.waitFor` so the async
Linux path isn't raced by the spy.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
React 19 removed the global JSX namespace; matches the pattern already used in agentHealth.tsx.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Implements source issue delete handling in the task dashboard, including prompt-based user interaction for source-linked issues, new GitHub tracking state logic in `packages/dashboard/src/github-tracking-state.ts`, and corresponding test coverage, with documentation added to `docs/task-management.md
Fusion-Task-Id: FN-5618
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Fusion-Task-Id: FN-5618
Adds padding expansion to the PR notice block in PrPanel.css with corresponding test assertions to verify the token values, completing the FN-5619 styling pass.
Fusion-Task-Id: FN-5619
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Fusion-Task-Id: FN-5619
FN-5615 improves TUI token visibility by dynamically sizing the system panel height and clarifying the manual token copy hint, with regression tests added in the dashboard-tui app and a changeset for the patch release.
Fusion-Task-Id: FN-5615
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Fusion-Task-Id: FN-5615
Complete the standalone build pipeline fix by setting `DEV=false` during bun compile to eliminate React DevTools from production executables, with hardened regression tests and documentation.
Fusion-Task-Id: FN-5611
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Fusion-Task-Id: FN-5611
Externalizes the `cpu-features` dependency from the CLI build step to support Bun compilation compatibility, completing Step 2 of the migration.
Fusion-Task-Id: FN-5610
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Fusion-Task-Id: FN-5610
Adds macOS code signing and notarization infrastructure (FN-5609), introducing hardened runtime entitlements, electron-builder config for signed builds, and signing-enabled release workflows, with tests validating the configuration and docs covering the signing flow.
Fusion-Task-Id: FN-5609
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Fusion-Task-Id: FN-5609
Adds Linux ARM64 as a target architecture to the desktop release pipeline, including dual-arch release and test-release workflows, electron-builder configuration updates, and corresponding tests and documentation.
Fusion-Task-Id: FN-5608
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Fusion-Task-Id: FN-5608
Add multi-platform updater feed configuration for the desktop app, including Windows, Mac, and Linux feed files with a collector, wired into the release and test-release workflows, plus corresponding tests and documentation.
Fusion-Task-Id: FN-5607
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Fusion-Task-Id: FN-5607
Adds ARM64 (Apple Silicon) as a target platform in both the release and test-release CI matrices, with corresponding test assertions covering the updated workflow configurations.
Fusion-Task-Id: FN-5606
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Fusion-Task-Id: FN-5606
Implements Linux GPG signing for the release pipeline by adding a `sign-linux.sh` helper, wiring it into the release and test-release workflows, including `.asc` signature files in release collectors, and documenting the full signing workflow in CODE_SIGNING.md with a note in the desktop README.
Fusion-Task-Id: FN-5605
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Fusion-Task-Id: FN-5605
Added OpenAI Responses API as a new custom provider type, wiring `apiType: "responses"` through the core registry, engine routes, and dashboard UI with a dropdown selector; includes test coverage across the registry, routes, and component layers.
Fusion-Task-Id: FN-5601
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Fusion-Task-Id: FN-5601
This merge implements an OAuth relogin banner feature (FN-5595) that displays in the dashboard when OAuth tokens expire. The feature includes a new `OAuthReloginBanner` component with styling and tests, an OAuth validity logger in the engine for tracking token state, and corresponding API route inte
Fusion-Task-Id: FN-5595
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Fusion-Task-Id: FN-5595
Added GitHub Actions workflows for macOS and Linux desktop release artifacts (`release.yml` and `test-release.yml`), wired in new `dist` scripts across platforms, and extended test coverage for electron-builder config and release workflow logic, with updated documentation for the new artifacts.
Fusion-Task-Id: FN-5603
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Fusion-Task-Id: FN-5603
Messages sent with to_id="user" (the natural alias agents use) were
silently dropped from getInbox() due to two gaps:
WRITE PATH (types.ts): normalizeMessageParticipant did not include "user"
in DASHBOARD_USER_ALIASES, so messages were stored with toId="user"
instead of toId="dashboard".
READ PATH (message-store.ts): getParticipantIdsForLookup did not include
"user" in the IN-clause for the dashboard mailbox lookup, so messages
already stored with toId="user" (from old sessions) were never returned.
Both paths now include "user" as a canonical alias for DASHBOARD_USER_ID.
Tests:
- normalizeMessageParticipant("user","user") -> {id:"dashboard",type:"user"}
- getInbox("dashboard","user") returns messages stored with toId="user"
(legacy case: inserted directly into DB without normalization)
- fix(perf): use messagesRef.current in loadMoreMessages to avoid
recreating callback on every streamed token; messagesRef is already
kept in sync on every render so no useEffect needed — removes
`messages` from useCallback deps
- fix(api): reject invalid order query param with 400 instead of
silently ignoring; valid values are 'asc' and 'desc'
Tests:
- useChat: loadMoreMessages identity is stable when messages array changes
- chat-routes: GET /messages?order=invalid returns 400
When the user clicks 'Latest' while loadMoreMessages was in-flight,
the scroll restoration (which maintains position when older messages
are prepended) was undoing the explicit jump-to-bottom.
Fix: clear scrollRestoreSnapshotRef and set isUserScrollingRef=false
before anchorToBottom so the layout effect's restoration is skipped.
Cold-start dashboard responsiveness went from ~99s to ~6-11s. CPU profiling
identified two synchronous-spawn hotspots blocking the event loop:
- `GitHubTrackingReconciler` scanned up to 200 done tasks per startup,
each call into `getIssue` invoking `isGhAvailable()` + `isGhAuthenticated()`
via `execFileSync`. `gh auth status` makes a network roundtrip, so 400
sync spawns ≈ 71s of pure event-loop blocking (69% of cold-start CPU).
Memoized both checks with a 60s TTL; `resetGhAvailabilityCache()` is
exported for login/logout flows that need immediate invalidation.
- `PRAGMA integrity_check(100)` walks every page of the SQLite file (~7s
per database, multiple DBs × projects). The deferred check was scheduled
3s after init — right in the responsiveness-critical window. Pushed to
60s so the user is already interacting before it runs; check itself is
unchanged.
Also yields the event loop between major InProcessRuntime init phases and
between self-healing recovery steps (34 per project), defers orphan-task
AI agent resumption by 30s (env-overridable, auto-zero under Vitest), and
ships an opt-in `FUSION_TRACE_EL_LAG=/path/to/file` event-loop lag tracer
that diagnosed all of the above.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Two compounding bugs surfaced as `feat(FN-XXXX): merge fusion/fn-XXXX`
commits landing on main:
1. The verification-fix finalize path could bind `undefined` to SQLite
parameter 4 (`commitSha`) of `upsertTaskCommitAssociation` under the
parallel-attempt race, failing the merge over a denormalization
write after the commit had already landed. Centralized both
duplicated callsites into a helper that validates each git output
before binding.
2. Four self-healing/aiMergeTask recovery sites copied
`classification.commit.subject` verbatim into
`mergeDetails.mergeCommitMessage`, persisting the tier-3
`merge ${branch}` fallback when it ended up on the landed commit.
New `regenerateBareMergeSubject` helper detects the bare pattern
and rebuilds a descriptive subject via the AI summarizer. Cosmetic
only — the git commit is not amended.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Multiple coordinated fixes for the perceived "dashboard takes forever to
load" complaint. Per-page-load HTTP requests drop from ~177 to ~101 and
duplicate per-project InProcessRuntime creation is eliminated.
- engine: shouldUseHybridExecutor no longer auto-enables for local-only
multi-project setups (set FUSION_HYBRID_EXECUTOR=1 to force). The
duplicate-runtime path was running self-healing twice per project and
contending on the same SQLite file. ProjectEngineManager already
handles N local projects with one InProcessRuntime each.
- dashboard cli: parallelized independent store inits, started
CentralCore.init early in background, ran plugin loading concurrently
with extension resolution. Sequenced SQLite store inits to avoid a
TOCTOU race in addColumnIfMissing migrations across TaskStore /
AutomationStore / PluginStore / AgentStore (all open the same
.fusion/fusion.db). Restored try/catch around HybridExecutor.initialize
and engineManager.ensureEngine so a paused or broken cwd project no
longer aborts dashboard startup.
- dashboard client: added in-flight request dedupe wrapped around the
top API offenders. /api/plugins/ui-slots drops from 17x to 1x per load.
dedupe.forceFresh redirects ALL in-flight waiters to receive the fresh
post-mutation response, not just the forcing caller. Generation
counters in useAgents and AgentListModal protect against slow polls
overwriting fresh state.
- dashboard SSE: agent event handler now debounces 250ms with a
trailing-edge guard so multi-agent activity bursts coalesce to at
most 2 refetches per burst.
- dashboard route: PATCH /api/projects/:id with isolationMode change
returns 503 with actionable guidance when HybridExecutor is
unavailable, instead of silently persisting a config the live runtime
won't honor.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Move resolveScopedChatManager() before res.flushHeaders() in the
POST /messages route so that failures (e.g. project DB cannot be
opened) produce a proper HTTP error instead of silently closing the
SSE connection.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Resolve conflict in register-chat-routes.ts: keep per-project
ChatManager routing via resolveScopedChatManager while preserving
main's resolveProjectChatContext-based store resolution for read
routes. The auto-merged chat-project-services.ts correctly combines
main's fallback-safe resolveProjectChatContext with the PR's new
getOrCreateScopedChatManager cache.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Added Windows ARM64 support to the desktop build pipeline, introducing separate target architecture arrays for x64 and ARM64, configuring electron-builder to produce artifacts for both platforms, and adding tests to assert the correct architecture names.
Fusion-Task-Id: FN-5594
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Fusion-Task-Id: FN-5594
Adds a Windows desktop build job to the release pipeline, wires the desktop artifacts into both release and test-release workflows, includes workflow shape assertions in tests, and documents the Windows release artifacts in the desktop README.
Fusion-Task-Id: FN-5593
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Fusion-Task-Id: FN-5593
Adds Windows desktop packaging support for Fusion, including a new GitHub Actions workflow for building Windows desktop targets, matching build scripts in the root and desktop package, a test for electron-builder configuration, and documentation of the packaging path.
Fusion-Task-Id: FN-5587
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Fusion-Task-Id: FN-5587
Adds a dedicated Secrets section to the SettingsModal navigation, removes the now-unused secrets footer callback wiring from App and AppModals, updates the related tests, and documents the secrets location in the dashboard guide.
Fusion-Task-Id: FN-5588
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Fusion-Task-Id: FN-5588
- Remove fetchAllMessagesInChat/fetchAllMessages helpers
- Keep limit:50 for initial load in useChat and useQuickChat
- Add IntersectionObserver sentinel at top of ChatView message list to
trigger loadMoreMessages() when user scrolls to the top
- Keep stale-session guards (activeSessionRef checks) from original PR
- Tests: revert assertions back to { limit: 50 }
The session existence checks in GET /stream and POST /messages were using
options?.chatStore (global DB), so secondary-project sessions would throw
notFound before the scoped ChatManager ran. Replaces with resolveScopedChatStore.
In multi-project mode the global chatManager was backed by ~/.fusion/fusion.db.
Secondary project chat sessions live in per-project DBs, so
chatManager.sendMessage() failed with 'Chat session not found' for any
project that is not the daemon's CWD.
Fix: add getOrCreateScopedChatManager to chat-project-services.ts (cached by
fusionDir, same pattern as the existing chatStore cache). POST /messages,
GET /stream, POST /cancel, and GET /sessions isGenerating enrichment all
resolve the per-project ChatManager when projectId is provided.
Fallback to global chatManager when no projectId (preserves single-project mode).
Tests: added multi-project chat routing describe block in chat-routes.test.ts.
