root/fusion
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
13,377 Commits 1 Branch 0 Tags
67cdb33a920cd040c8cf5ab81f33c4ff7a5fbfcb
Commit Graph

1430 Commits

Author SHA1 Message Date
gsxdsm
0fc6f3d849 FN-8946: enable attributed agent mission status updates 
Enable authorized agents to update feature and mission statuses with transactional, attributed audit events.

- Add mission and feature status tools to the Fusion extension and engine allowlists.
- Record bounded actor, reason, and hierarchy metadata for status transitions across every writer.
- Guard linked feature transitions and document the agent-facing workflow.

Files changed:
 .changeset/fn-8946-mission-status-writes.md        |   7 +
 docs/missions.md                                   |   7 +-
 packages/cli/skill/fusion/SKILL.md                 |   2 +-
 .../cli/skill/fusion/references/extension-tools.md |  20 +++
 .../skill/fusion/references/fusion-capabilities.md |   2 +
 packages/cli/src/__tests__/extension.test.ts       |  46 ++++++
 packages/cli/src/extension.ts                      |  27 +++
 .../mission-status-event-metadata.test.ts          |  50 ++++++
 .../__tests__/postgres/mission-store.pg.test.ts    | 160 +++++++++++++++++-
 .../core/src/async-stores/async-mission-store.ts   | 182 +++++++++++++++------
 packages/core/src/index.ts                         |   5 +
 packages/core/src/missions/mission-store.ts        |   7 +-
 packages/core/src/missions/mission-types.ts        |  99 +++++++++--
 .../src/__tests__/chat-toolset-permissions.test.ts |  24 +++
 packages/dashboard/src/mission-routes.ts           |   3 +-
 .../src/__tests__/agent-mission-tools.test.ts      |  42 ++++-
 .../src/__tests__/heartbeat-executor.test.ts       |   4 +-
 .../workflow-step-readonly-allowlist.test.ts       |   2 +
 packages/engine/src/agent-tools.ts                 |  18 ++
 .../engine/src/execution/gating-classifications.ts |   2 +
 20 files changed, 635 insertions(+), 74 deletions(-)

Fusion-Task-Id: FN-8946

Fusion-Task-Lineage: 473cc0e0-e632-48b3-ac84-adaaeb81db4b

Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
 2026-08-10 07:30:42 -07:00
gsxdsm
27cb2d2621 FN-8921: add deterministic knowledge graph tooling 
Add a committable, provenance-tagged knowledge graph layer with CLI generation and query support.

- Extract TypeScript, Markdown, and FNXC knowledge into deterministic graph nodes and edges.
- Persist recoverable graph artifacts outside ignored Fusion state and expose build/query CLI commands.
- Document configuration and add core and CLI coverage for graph structure, serialization, and recovery.

Files changed:
 .changeset/fn-8921-knowledge-graph.md              |   7 +
 .gitattributes                                     |   3 +
 AGENTS.md                                          |   1 +
 docs/README.md                                     |   2 +
 docs/cli-reference.md                              |   4 +
 docs/knowledge-graph.md                            |  37 +++++
 docs/settings-reference.md                         |   4 +
 docs/storage.md                                    |   2 +
 packages/cli/package.json                          |   3 +-
 .../__tests__/knowledge-graph-bundle-shape.test.ts |   4 +
 .../src/__tests__/knowledge-graph-command.test.ts  | 115 ++++++++++++++
 packages/cli/src/bin.ts                            |  19 +++
 packages/cli/src/commands/knowledge-graph.ts       |  79 ++++++++++
 packages/cli/tsup.config.ts                        |   2 +
 packages/core/package.json                         |   4 +-
 packages/core/src/config/settings-schema.ts        |   2 +
 packages/core/src/index.ts                         |   1 +
 .../__tests__/derive-modules.test.ts               |  11 ++
 .../__tests__/extract-file-composition.test.ts     |  20 +++
 .../knowledge-graph/__tests__/extract-fnxc.test.ts |  33 ++++
 .../__tests__/extract-markdown.test.ts             |  21 +++
 .../__tests__/extract-typescript.test.ts           |  30 ++++
 .../__tests__/file-discovery.test.ts               |  26 ++++
 .../graph-artifact-not-gitignored.test.ts          |  15 ++
 .../__tests__/graph-builder-equivalence.test.ts    |  76 ++++++++++
 .../__tests__/graph-builder-incremental.test.ts    |  52 +++++++
 .../__tests__/graph-identity.test.ts               |  11 ++
 .../knowledge-graph/__tests__/graph-query.test.ts  |  13 ++
 .../__tests__/graph-serialization.test.ts          |  29 ++++
 .../__tests__/graph-store-recovery.test.ts         | 106 +++++++++++++
 .../__tests__/resolve-imports.test.ts              |  10 ++
 .../core/src/knowledge-graph/derive-modules.ts     |   4 +
 packages/core/src/knowledge-graph/extract-file.ts  |   6 +
 packages/core/src/knowledge-graph/extract-fnxc.ts  | 168 +++++++++++++++++++++
 .../core/src/knowledge-graph/extract-markdown.ts   |   9 ++
 .../core/src/knowledge-graph/extract-typescript.ts | 107 +++++++++++++
 .../core/src/knowledge-graph/file-discovery.ts     |  85 +++++++++++
 packages/core/src/knowledge-graph/graph-builder.ts | 141 +++++++++++++++++
 .../core/src/knowledge-graph/graph-manifest.ts     |   4 +
 packages/core/src/knowledge-graph/graph-query.ts   | 126 ++++++++++++++++
 .../src/knowledge-graph/graph-serialization.ts     | 134 ++++++++++++++++
 packages/core/src/knowledge-graph/graph-store.ts   |  97 ++++++++++++
 packages/core/src/knowledge-graph/graph-types.ts   |  54 +++++++
 packages/core/src/knowledge-graph/index.ts         |  14 ++
 .../core/src/knowledge-graph/resolve-imports.ts    |   4 +
 packages/core/src/types/settings/settings-scope.ts |   2 +
 pnpm-lock.yaml                                     |  12 +-
 47 files changed, 1700 insertions(+), 9 deletions(-)

Fusion-Task-Id: FN-8921

Fusion-Task-Lineage: 7014d0f1-fc47-454b-afe5-5f0d9b229f33

Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
 2026-08-10 06:15:17 -07:00
gsxdsm
1cf86baa1c refactor: package code organization wave 18 (executor pure peels) (#3317) 
## Summary

Wave 18 continues the package code-organization program after wave 17
domain folders (U4 Slice A from
`docs/plans/2026-07-14-001-refactor-package-code-organization-plan.md`).

### What changed
Peel **pure, behavior-preserving** helpers out of
`packages/engine/src/executor.ts` into domain modules under
`packages/engine/src/executor/`, with **stable re-exports** from
`executor.ts` so deep imports and `vi.mock("../executor.js")` keep
working.

| New module | Symbols |
|------------|---------|
| `executor/task-done-refusal.ts` | `evaluateTaskDoneRefusal`,
`determineRevisionResetStart`, skip-bypass refusal helper |
| `executor/workflow-feedback-paths.ts` |
`extractReferencedPathsFromWorkflowFeedback`,
`isAlwaysAllowedScopeLeakPath`, `workflowPathMatchesDeclaredScope` |
| `executor/workflow-step-verdict.ts` |
`FUSION_WORKFLOW_STEP_CONVENTIONS_PREAMBLE`, `parseWorkflowStepVerdict`
/ `parseWorkflowStepOutput`, step outcome types |
| `executor/await-input-parse.ts` | `parseAwaitInputSentinel`,
`parseAwaitInputQuestionToolCall` |
| `executor/no-commit-eligibility.ts` | `getNoCommitEligibilityReason`
(+ prompt heuristics) |

`executor.ts` live LOC ~**22817 → ~22427** (first pure-peel batch; more
peels needed to approach the 2k cap).

### Shims
- `old path` `executor.ts` public exports → `new path` `executor/*.ts` →
delete-when consumer deep-imports are re-pointed (not this PR)

### Test plan
- [x] `@fusion/engine` typecheck
- [x] Oracle: task-done refusal, skip-bypass, workflow malformed
verdict, scope-leak allowlist, executor-step-session, executor-prompt
- [x] `vitest --project=engine-core` (merge-gate curated suite)
- [ ] CI merge gate

**Stack:** wave17 (merged) → **this PR**

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Improved recognition of workflow outcomes from structured and
conversational responses.
* Added support for extracting questions from await-input responses and
tool calls.
* Improved workflow feedback handling for referenced files and declared
scope patterns.
* Added clearer guidance for task execution, approvals, verification,
and available tools.

* **Bug Fixes**
* Prevented completion when required review approvals are missing or
revisions remain pending.
* Improved handling of workflows that legitimately require no code
changes.
  * Added clearer refusal messages and more reliable revision restarts.
  * Sanitized repository paths in Git remediation instructions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-09 15:46:09 -10:00
Victor Canô
a09e0cb87f feat(i18n): add Português (Brasil) (pt-BR) locale (#3347) 
## Summary

Adds **Português (Brasil)** (`pt-BR`) as a supported locale:

- Selectable as **Translation target language** (project settings) and
as the dashboard / terminal UI language.
- Full machine-drafted catalogs (`app`, `cli`, `common`), disclosed in
`packages/i18n/locales/TRANSLATION_STATUS.md` following the pattern
#1352 established — reviewed for glossary/register consistency (0.18%
untranslated, matching only keys that are empty in `en`), but
native-speaker corrections are welcome.
- Brazilian Portuguese content-language detection (accent-stripped
stopword list — the scorer strips diacritics before matching, so
accented entries never match; `com`/`mais` deliberately omitted to avoid
bare-domain `.com` and French collisions, with regression tests for both
directions).
- `pt`/`pt-PT` browser and environment locales resolve to `pt-BR` on all
three detection paths (`FALLBACK_LNG` routing plus a `pt` branch in
`normalizeToSupportedLocale`, mirroring the existing `zh` handling).
- `README.pt-BR.md` + switcher links in all READMEs, docs updates
(`settings-reference`, `cli-reference`, `i18n-contributing`, `--lang`
help text), changeset (`minor`).

Drive-by fixes bundled: `TRANSLATION_STATUS.md` was missing the `ko`
row; the LanguageSelector endonym test was missing `한국어`;
`docs/i18n-contributing.md` now names the two compile-enforced display
maps (`LOCALE_LABELS`, `localeDisplayName`) a new locale must update;
the `--lang` CLI help text no longer drifts from its validator.

## Test plan

- `pnpm i18n:status` (key parity gate) green; catalogs are
`i18n:sync`-idempotent.
- Updated/extended suites: core `locale-settings`, i18n
`config`/`parity`/`db-banner-catalog`/`i18n-gate-coverage`, dashboard
`useLanguage`/`LanguageSelector`/`GeneralSection.importTranslate`/`detectContentLanguage`
(incl. new pt-BR detection + bare-domain regression tests), CLI
`settings`.
- `pnpm verify:fast` (typecheck, build, boot smoke), `pnpm lint`, `pnpm
check:changesets`, and the bounded `pnpm test` lane all green locally
(the three `test:pg-gate` files fail locally only for lack of a Postgres
instance; they fail identically on clean `main`).


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added Brazilian Portuguese (Português (Brasil)) across the dashboard,
terminal interface, settings, and translation tools.
  * Added Portuguese translations for common interface and CLI content.
* Added automatic Portuguese language detection, locale normalization,
and fallback support.
* Added a Portuguese (Brazil) README with product, setup, and usage
documentation.

* **Documentation**
* Updated language selectors, CLI references, settings documentation,
and translation guidance.
  * Added Portuguese README links to translated documentation.
  * Added French to the documented dashboard language options.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: gsxdsm <gsxdsm@users.noreply.github.com>
 2026-08-09 13:33:16 -10:00
gsxdsm
c7c879905b FN-8903: add event-driven GitHub CI merge checks 
Persist ingested GitHub CI signals and use them to assess merge readiness.

- Store project-scoped GitHub check states with retention maintenance.
- Resolve configured required checks from ingested signals during PR merge decisions.
- Add delivery, lifecycle, persistence, and retention coverage with operator documentation.

Files changed:
 .changeset/fn-8903-event-driven-checks.md          |   7 ++
 docs/architecture.md                               |   1 +
 docs/settings-reference.md                         |   2 +-
 docs/signals-connectors.md                         |   2 +-
 .../src/commands/__tests__/task-lifecycle.test.ts  |  50 ++++++++-
 packages/cli/src/commands/task-lifecycle.ts        |   7 +-
 .../core/src/__tests__/ingested-checks.test.ts     |  66 +++++++++++
 .../postgres/github-check-states.pg.test.ts        |  71 ++++++++++++
 packages/core/src/config/index.ts                  |   1 +
 packages/core/src/config/ingested-checks.ts        |  32 ++++++
 packages/core/src/index.ts                         |  10 ++
 .../0048_fn_8903_github_check_states.sql           |  32 ++++++
 packages/core/src/postgres/schema-applier.ts       |  15 ++-
 packages/core/src/postgres/schema/project.ts       |  29 ++++-
 .../core/src/task-store/async/async-ci-checks.ts   | 104 ++++++++++++++++++
 packages/core/src/task-store/async/index.ts        |   1 +
 packages/core/src/types.ts                         |   2 +
 packages/dashboard/src/__tests__/github.test.ts    | 121 ++++++++++++++++++++-
 .../src/__tests__/register-signal-routes.test.ts   |  81 +++++++++++++-
 packages/dashboard/src/github.ts                   |  74 +++++++++----
 .../dashboard/src/routes/register-git-github.ts    |  29 +++--
 .../dashboard/src/routes/register-signal-routes.ts |  10 +-
 .../src/routes/register-task-workflow-routes.ts    |  14 ++-
 packages/dashboard/src/signal-source.ts            |  23 ++++
 packages/dashboard/src/signal-sources/github.ts    |   2 +
 .../self-healing-github-check-retention.test.ts    | 121 +++++++++++++++++++++
 packages/engine/src/self-healing.ts                |  23 ++++
 27 files changed, 878 insertions(+), 52 deletions(-)

Fusion-Task-Id: FN-8903
Fusion-Task-Lineage: b2643587-c568-4b6c-8b3a-d50a6165963d
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
 2026-08-09 09:14:56 -07:00
gsxdsm
2643f4e567 FN-8884: enable GitHub-native PR auto-merge 
Enable opt-in GitHub-managed auto-merge for pull requests.

- Add a project setting and dashboard control for GitHub native auto-merge.
- Arm individual, group, dashboard, and workflow PRs with `gh pr merge --auto` or GraphQL, including while checks are pending.
- Preserve deferred PR reconciliation, unavailable-feature errors, project-scoped runtime configuration, tests, documentation, and a release changeset.

Files changed:
 .changeset/fn-8884-github-native-auto-merge.md     |   7 +
 docs/settings-reference.md                         |   5 +
 packages/cli/src/commands/__tests__/daemon.test.ts |  16 +++
 packages/cli/src/commands/__tests__/serve.test.ts  |  14 ++
 .../src/commands/__tests__/task-lifecycle.test.ts  | 158 +++++++++++++++++++++
 packages/cli/src/commands/daemon.ts                |  11 +-
 packages/cli/src/commands/dashboard.ts             |  11 +-
 packages/cli/src/commands/serve.ts                 |  11 +-
 packages/cli/src/commands/task-lifecycle.ts        |  45 ++++--
 .../core/src/__tests__/settings-defaults.test.ts   |   4 +
 packages/core/src/config/settings-schema.ts        |   1 +
 packages/core/src/types/settings/settings-scope.ts |   8 ++
 .../settings/__tests__/section-keys.test.ts        |   1 +
 .../app/components/settings/section-keys.ts        |   1 +
 .../components/settings/sections/MergeSection.tsx  |  14 +-
 .../settings-default-descriptions.test.tsx         |   1 +
 .../src/__tests__/github-native-auto-merge.test.ts | 114 +++++++++++++++
 .../src/__tests__/routes-pr-merge.test.ts          |  84 +++++++++++
 packages/dashboard/src/github.ts                   |  88 +++++++++++--
 packages/dashboard/src/index.ts                    |   2 +-
 .../dashboard/src/routes/register-git-github.ts    |  33 +++--
 .../project-engine-deferred-startup.test.ts        |  21 +++
 packages/engine/src/project-engine-manager.ts      |   2 +
 packages/engine/src/project-engine.ts              |   6 +
 packages/engine/src/project/project-runtime.ts     |   6 +
 packages/engine/src/runtimes/in-process-runtime.ts |   9 +-
 packages/i18n/locales/en/app.json                  |   4 +-
 27 files changed, 634 insertions(+), 43 deletions(-)

Fusion-Task-Id: FN-8884

Fusion-Task-Lineage: cf1b1ea4-7ef7-4050-bd87-25933456a5b6

Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
 2026-08-09 04:50:30 -07:00
gsxdsm
d59c1b162f FN-8855: enforce configured PR checks before merging 
Add configurable Fusion-side PR check gating across merge surfaces.

- Add project required-check settings, validation, UI controls, CLI support, and operator documentation.
- Evaluate configured checks before dashboard and CLI PR merges, accepting successful, skipped, and neutral checks.
- Bind merges to the evaluated PR head SHA to prevent push-and-merge races.
- Cover required-check policy and head-SHA merge behavior with tests.

Files changed:
 .changeset/fn-8855-required-checks.md              |   7 +
 docs/dashboard-guide.md                            |   5 +
 docs/settings-reference.md                         |   1 +
 .../src/commands/__tests__/task-lifecycle.test.ts  |  30 ++++-
 packages/cli/src/commands/task-lifecycle.ts        |  17 ++-
 .../core/src/__tests__/required-checks.test.ts     |  16 +++
 packages/core/src/config/index.ts                  |   1 +
 packages/core/src/config/required-checks.ts        |  16 +++
 packages/core/src/config/settings-schema.ts        |   1 +
 packages/core/src/index.ts                         |   1 +
 packages/core/src/types.ts                         |   6 +
 packages/core/src/types/settings/settings-scope.ts |   6 +
 packages/core/src/types/task/task-tracking.ts      |   5 +
 .../settings/__tests__/section-keys.test.ts        |   1 +
 .../app/components/settings/section-keys.ts        |   1 +
 .../settings/sections/MergeSection.search.ts       |   3 +
 .../components/settings/sections/MergeSection.tsx  |  30 ++++-
 .../__tests__/MergeSection.requiredChecks.test.tsx |  50 +++++++
 .../settings-default-descriptions.test.tsx         |   1 +
 packages/dashboard/src/__tests__/github.test.ts    | 123 +++++++++++++++++
 packages/dashboard/src/github.ts                   | 149 +++++++++++++--------
 .../dashboard/src/routes/register-git-github.ts    |  38 ++++--
 .../src/routes/register-task-workflow-routes.ts    |   8 +-
 packages/i18n/locales/en/app.json                  |   4 +-
 24 files changed, 441 insertions(+), 79 deletions(-)

Fusion-Task-Id: FN-8855

Fusion-Task-Lineage: 708e9c27-72be-4925-bf09-5db421bcaa67

Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
 2026-08-09 01:33:06 -07:00
gsxdsm
b3504f01a4 FN-8838: refresh automated PR heads before GitHub mutations 
Refresh isolated automated PR heads against their target immediately before PR creation or merge.

- Rebase and lease-publish task and group heads at every automated GitHub boundary.
- Fail closed on concurrent head updates and reconcile retained refresh worktrees.
- Add lifecycle coverage and document the configurable integration remote.

Files changed:
 .changeset/fn-8838-refresh-pr-heads.md             |   7 +
 docs/settings-reference.md                         |   6 +
 .../task-lifecycle-refresh.integration.test.ts     | 438 ++++++++++++++++
 .../src/commands/__tests__/task-lifecycle.test.ts  | 309 ++++++++++-
 packages/cli/src/commands/daemon.ts                |   4 +-
 packages/cli/src/commands/dashboard.ts             |   4 +-
 packages/cli/src/commands/serve.ts                 |   4 +-
 packages/cli/src/commands/task-lifecycle.ts        | 581 +++++++++++++++++++--
 .../src/__tests__/group-merge-coordinator.test.ts  |  43 ++
 .../engine/src/merge/group-merge-coordinator.ts    |  34 +-
 packages/engine/src/merge/pr-nodes.ts              |  35 +-
 packages/engine/src/project-engine.ts              |  16 +-
 12 files changed, 1425 insertions(+), 56 deletions(-)

Fusion-Task-Id: FN-8838
Fusion-Task-Lineage: a9b9e800-7d73-441f-bc1b-2488d244e0b1
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
 2026-08-08 22:35:59 -07:00
gsxdsm
c0e2ba2ade FN-8836: classify GitHub branch policy merge blocks 
Classify ambiguous GitHub merge failures using refreshed pull request state.

- Distinguish branch-protection blocks from true merge conflicts.
- Surface review and required-check blockers in CLI and dashboard merge flows.
- Add regression coverage and a patch changeset.

Files changed:
 .changeset/fn-8836-gh-merge-policy-errors.md       |   7 ++
 .../src/commands/__tests__/task-lifecycle.test.ts  |  55 +++++++++
 packages/cli/src/commands/task-lifecycle.ts        |  14 ++-
 packages/core/src/__tests__/gh-cli.test.ts         |  39 +++++-
 packages/core/src/cli/gh-cli.ts                    |  60 +++++++++-
 packages/core/src/index.gate.ts                    |   1 +
 packages/core/src/index.ts                         |   1 +
 .../dashboard/src/__tests__/routes-github.test.ts  | 131 +++++++++++++++++++++
 .../dashboard/src/routes/register-git-github.ts    |  58 +++++++--
 9 files changed, 351 insertions(+), 15 deletions(-)

Fusion-Task-Id: FN-8836

Fusion-Task-Lineage: 7102f5ba-aca9-48cd-a27b-76deb952c4a5

Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
 2026-08-08 18:56:43 -07:00
gsxdsm
54d1ccb8d5 FN-8835: block unmergeable pull requests 
Fail closed before auto-merging pull requests that GitHub reports as unmergeable.

- Require normalized clean mergeability in PR readiness checks.
- Cover protected, behind, conflicting, and unknown PR states across CLI and dashboard tests.
- Add a patch changeset for the corrected auto-merge behavior.

Files changed:
 .changeset/fn-8835-pr-merge-readiness.md           |  7 +++
 .../src/commands/__tests__/task-lifecycle.test.ts  | 21 ++++---
 packages/dashboard/src/__tests__/github.test.ts    | 64 ++++++++++++++++++----
 packages/dashboard/src/github.ts                   | 11 ++++
 4 files changed, 84 insertions(+), 19 deletions(-)

Fusion-Task-Id: FN-8835

Fusion-Task-Lineage: 698dacf9-5f24-42b7-b927-ae5b5579ee3f

Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
 2026-08-08 18:13:52 -07:00
gsxdsm
03f84d406c chore(release): v0.76.0-beta.0 
Version bump via changesets.
 2026-08-08 14:25:19 -07:00
gsxdsm
0fda8b203b test: bind a project partition in the PG harness for built-in agent provisioning 
FN-8764 made AgentStore.init() unconditionally provision the four durable
built-in workflow-owner agents, and that provisioning needs a bound
asyncLayer.projectId — backendProjectId rejects the empty/unbound partition so a
shared cluster cannot mix ownership. Every AgentStore-backed PG test therefore
threw in init(); without this change all 10 cases in agent-instructions.pg.test
fail at agent-store.ts:526.

createTaskStoreForTest / createSharedPgTaskStoreTestHarness gain an OPT-IN
projectId. Undefined keeps the historical project-agnostic harness (RLS bypass,
empty-string partition) that the rest of the core suite relies on. When set, the
connection GUC `fusion.project_id`, the AsyncDataLayer, and the seeded config row
all share one partition — so agents (explicit project_id) and their config
revisions (GUC-default project_id) land together and the
(project_id, agent_id) FK on agent_config_revisions holds.

Also folds in two already-merged consequences: serve.test expects the
consumerId: "engine" that serve.ts:326 already passes (FN-8685), and the
auto-generated Fusion skill docs pick up fn_workflow_step_resume, the roles /
max_workflow_sessions agent fields, and the deprecated singular role.

Uncommitted in the working tree; reviewed, verified against the real database,
and committed as-is.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-08-07 17:33:56 -07:00
gsxdsm
eaadd153b1 FN-8764: route workflow stages through durable role agents 
Route workflow stages through task-scoped durable role agents.

- Persist normalized multi-role agents and workflow principal fences with migrations.
- Route planning, execution, review, and merge workflow nodes through authorized permanent principals with capacity leasing and recovery.
- Retire ephemeral workflow-stage workers and expose role-aware agent configuration, workflow editing, and documentation.
- Preserve lifecycle-column ratchet coverage by centralizing workflow-role classification rather than adding test exemptions.

Files changed:
 .changeset/fn-8764-workflow-role-agents.md         |   7 +
 CONCEPTS.md                                        |   3 +
 docs/agents.md                                     |   6 +
 docs/architecture.md                               |   6 +
 docs/cli-reference.md                              |   2 +
 docs/dashboard-guide.md                            |   4 +
 docs/settings-reference.md                         |   6 +-
 docs/storage.md                                    |   2 +
 docs/workflow-steps.md                             |   6 +
 .../src/__tests__/extension-agent-update.test.ts   |  11 +-
 packages/cli/src/__tests__/extension.test.ts       |  18 +-
 packages/cli/src/extension.ts                      |  41 +-
 .../core/src/__tests__/agent-permissions.test.ts   |  12 +
 .../core/src/__tests__/agent-role-policy.test.ts   |   7 +
 packages/core/src/__tests__/agent-roles.test.ts    |  21 +
 .../legacy-column-collection-gating-ledger.test.ts |  19 +-
 .../src/__tests__/postgres/schema-applier.test.ts  |  16 +-
 .../core/src/__tests__/settings-parity.test.ts     |   9 +-
 .../workflow-agent-node-classification.test.ts     |  25 +
 .../src/__tests__/workflow-work-item-cas.test.ts   |  38 ++
 packages/core/src/agents/agent-permissions.ts      |  11 +-
 packages/core/src/agents/agent-role-policy.ts      |  39 +-
 packages/core/src/agents/agent-store.ts            | 190 ++++++-
 .../core/src/async-stores/async-agent-store.ts     |   6 +
 packages/core/src/config/settings-schema.ts        |   5 +-
 packages/core/src/index.gate.ts                    |   2 +-
 packages/core/src/index.ts                         |   7 +-
 .../0045_fn_8764_multi_role_workflow_agents.sql    |  20 +
 .../0046_fn_8764_workflow_principal_fence.sql      |  49 ++
 packages/core/src/postgres/schema-applier.ts       |  22 +-
 packages/core/src/postgres/schema/project.ts       |  21 +
 packages/core/src/store.ts                         |   2 +-
 .../task-store/async/async-workflow-workitems.ts   |  49 +-
 packages/core/src/task-store/row-types.ts          |   4 +
 packages/core/src/task-store/settings-helpers.ts   |  16 +-
 packages/core/src/task-store/settings-ops-2.ts     |  13 +-
 packages/core/src/task-store/settings-ops.ts       |  16 +-
 packages/core/src/task-store/task-row-mappers.ts   |   4 +
 .../src/task-store/workflow-task-create-ops.ts     |   6 +-
 .../src/task-store/workflow-workitems-ops-2.ts     |  25 +-
 packages/core/src/types.ts                         |   2 +
 packages/core/src/types/agents/agents.ts           |  45 +-
 packages/core/src/types/merge/merge-queue.ts       |  17 +
 packages/core/src/types/settings/settings-scope.ts |   9 +-
 packages/core/src/workflows/workflow-ir-types.ts   |  58 +++
 packages/core/src/workflows/workflow-ir.ts         |  19 +
 .../dashboard/app/components/AgentDetailView.css   |  14 +
 .../dashboard/app/components/AgentDetailView.tsx   |  34 +-
 .../dashboard/app/components/NewAgentDialog.tsx    |  28 +-
 .../app/components/WorkflowNodeEditor.tsx          |  19 +
 .../__tests__/AgentDetailView.core.test.tsx        |   4 +-
 .../app/components/__tests__/AgentsView.test.tsx   |   2 +-
 .../__tests__/SettingsModal.general.test.tsx       |  86 ---
 .../__tests__/SettingsModal.test-harness.tsx       |   1 -
 .../components/agent-presets/agentCreatePayload.ts |   9 +-
 .../app/components/settings/section-keys.ts        |   1 -
 .../settings/sections/GeneralSection.tsx           |   8 -
 .../settings-default-descriptions.test.tsx         |   1 -
 .../app/components/workflow-flow-mapping.ts        |   7 +
 packages/dashboard/src/mission-routes.ts           |  26 +-
 .../src/routes/__tests__/agent-core-routes.test.ts |  23 +-
 .../src/routes/register-agent-core-routes.ts       |  42 +-
 ...gister-agent-import-export-generation-routes.ts |  21 -
 .../engine/src/__tests__/agent-action-gate.test.ts |  33 ++
 .../engine/src/__tests__/agent-assignment.test.ts  | 370 -------------
 .../src/__tests__/ephemeral-worker-manager.test.ts | 575 ---------------------
 ...ecutor-ephemeral-disabled-dispatch-gate.test.ts | 223 --------
 .../__tests__/executor-fast-mode-workflows.test.ts |  58 +++
 .../engine/src/__tests__/log-severity-manifest.ts  |   1 -
 .../__tests__/log-severity-spam-contract.test.ts   |   3 -
 .../resolved-read-with-literal-filter.test.ts      |   4 -
 .../__tests__/scheduler-ephemeral-toggle.test.ts   | 175 -------
 .../__tests__/scheduler-workflow-cutover.test.ts   |  19 -
 .../src/__tests__/workflow-agent-capacity.test.ts  |  47 ++
 .../src/__tests__/workflow-agent-routing.test.ts   | 137 +++++
 .../src/__tests__/workflow-graph-foreach.test.ts   |  15 +
 .../__tests__/workflow-graph-task-runner.test.ts   |  73 +++
 .../src/__tests__/workflow-task-runtime.test.ts    |  95 ++++
 .../src/__tests__/workflow-work-scheduler.test.ts  |  20 +
 packages/engine/src/agents/agent-action-gate.ts    |  64 +++
 packages/engine/src/agents/agent-assignment.ts     | 135 -----
 packages/engine/src/agents/agent-reflection.ts     |   1 +
 .../engine/src/agents/ephemeral-worker-manager.ts  | 429 ---------------
 .../engine/src/agents/workflow-agent-capacity.ts   | 113 ++++
 .../engine/src/agents/workflow-agent-router.ts     | 185 +++++++
 packages/engine/src/execution/reviewer.ts          |  26 +-
 packages/engine/src/executor.ts                    | 501 +++++++++++++++---
 packages/engine/src/index.ts                       |   1 -
 packages/engine/src/merger.ts                      |  20 +-
 packages/engine/src/pi.ts                          |  11 +
 packages/engine/src/runtimes/in-process-runtime.ts |  37 --
 packages/engine/src/scheduler.ts                   | 114 +---
 packages/engine/src/triage.ts                      | 196 ++++++-
 .../src/workflows/workflow-graph-executor.ts       | 109 +++-
 .../engine/src/workflows/workflow-graph-loop.ts    |  13 +-
 .../src/workflows/workflow-graph-task-runner.ts    |  12 +
 .../engine/src/workflows/workflow-task-runtime.ts  | 125 ++++-
 .../src/workflows/workflow-work-scheduler.ts       |   8 +-
 98 files changed, 2722 insertions(+), 2468 deletions(-)

Fusion-Task-Id: FN-8764
Fusion-Task-Lineage: 5527fccb-342d-46f6-8108-bbf89142efec
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
 2026-08-07 01:36:34 -07:00
ischindl
f7ca14beab feat(workflow): add fn_workflow_step_resume operator escape hatch for stuck pending merge-review steps (#3339) 
## Summary

Adds an **operator-only** escape hatch for a card stranded `in-review`
(or `in-progress`) with a workflow step permanently stuck in `pending`
status — the leading real-world cause being a dispatched prompt node
(e.g. `code-review`) whose verdict callback was never received (see
#1946). Transitions the stuck `pending` pre-merge step to `status:
"failed"` with resume audit metadata, so the existing
`fn_task_bypass_review` escape hatch can then clear the merge blocker.

## What changed

- **`WorkflowStepResult`** gains resume audit fields: `resumedBy`,
`resumedAt`, `resumeReason`, `resumedFromStatus`. They are pure audit
trail and **do not** participate in merge-blocking
(`getTaskMergeBlocker`).
- **`findPendingPreMergeStep`** (new helper, exported from
`@fusion/core`) summarizes the stuck-pending pre-merge state for
operator tooling. Ignores post-merge steps; returns the newest pending
pre-merge result.
- **`TaskStore.resumeWorkflowStep(id, { stepId, reason, actor })`** —
the store primitive (eligibility-gated: task must be
`in-review`/`in-progress`, not paused; step must exist and be `pending`;
a mandatory non-blank `reason` and `stepId` are required). Runs under
`withTaskLock`, writes the resume as a terminal `failed` result, appends
a task-log breadcrumb, and emits the new `task:resume-step` run-audit
event.
- **`fn_workflow_step_resume`** — new CLI/pi-extension tool registered
**only** on the operator surface (deliberately **not** wired into
executor/reviewer/triage agent tool lists). Accepts `{ id, stepId,
reason }`; the actor defaults to `cli-operator`.
- **Run-audit**: new `task:resume-step` `DatabaseMutationType` member.

## Why

A prompt-node verdict callback can be lost (dispatched prompt never
receives a verdict), leaving the step `pending` forever. Previously the
only recourse was `fn_task_bypass_review`, which requires a terminal
*failed* pre-merge step to clear the blocker — a permanently `pending`
step could not be bypassed. This PR bridges that gap: resume (pending →
failed) then bypass (failed merge-blocker cleared).

## Verification

- **Typecheck**: `@fusion/core`, `@fusion/engine`, `@runfusion/fusion`
all clean.
- **`task-merge-bypass.test.ts`**: 15/15 pass (incl. 5 new
`findPendingPreMergeStep` cases).
- **`store-resume-step.test.ts`** (new, PG-backed): 9/9 pass —
eligibility gating, resume rewrite + audit fields, run-audit event,
non-pending/non-found/blank-argument rejection, in-progress column
support, property preservation.
- **`extension.test.ts`**: 75/75 pass (expected-tool registration
includes the new tool).

## Files

- `packages/core/src/types/workflow/workflow-steps.ts`
- `packages/core/src/merge/task-merge.ts`
- `packages/core/src/store.ts`
- `packages/core/src/index.ts`
- `packages/core/src/__tests__/store-resume-step.test.ts` (new)
- `packages/core/src/__tests__/task-merge-bypass.test.ts`
- `packages/engine/src/util/run-audit.ts`
- `packages/cli/src/extension.ts`
- `packages/cli/src/__tests__/extension.test.ts`
- `.changeset/stas-032-resume-workflow-step.md` (minor, feature)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added an operator-only workflow recovery tool for permanently pending
pre-merge steps.
* Operators can mark eligible pending steps as failed by providing a
required audit reason.
* Recovery actions record operator details, timestamps, reasons, prior
status, task logs, and audit events.
* **Bug Fixes**
* Improved selection of the latest pending pre-merge workflow step while
excluding post-merge steps.
* Added validation to prevent recovery of paused, invalid, or
out-of-scope workflow steps.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: schindler <schindler@users.noreply.github.com>
Co-authored-by: gsxdsm <gsxdsm@users.noreply.github.com>
 2026-08-07 00:26:15 -07:00
ischindl
4739f8aa67 fix: eagerly warm extension host stores from engine TaskStores (#3340) 
## Summary

Warm the extension-host task stores **up front** at dashboard startup
instead of letting the first `fn_task_*` call lazily boot a second
PostgreSQL pool per project.

## What changed

`packages/cli/src/commands/dashboard.ts`:

- After the dashboard boots, iterate every registered project (from
`centralCoreForEngine.listProjects()`) and call
`setHostTaskStore(p.path, engine.getTaskStore())` for each non-cwd
project that already has a running `ProjectEngine`.
- Reuses each engine's **existing** `TaskStore` directly — no new
backend connection, no schema advisory-lock contention, no extra
connection-pool exhaustion.
- `cwd` is skipped because its store is already injected at startup.
- Per-project failures are non-fatal (warn) and a failed project listing
logs a single warn — dashboard startup never blocks on this.
- `.changeset/extension-host-store-warmup.md` (patch, fix).

## Why

Left on its own, the first extension tool call (`fn_task_update`,
`fn_task_archive`, `fn_agent_show`, …) for a non-cwd project falls
through to `createTaskStoreForBackend`, which boots a **second**
PostgreSQL connection pool on demand. On busy hosts that lazy boot can
time out, or the call stalls behind pool/startup contention — the
classic "first `fn_task_*` call is slow or errors" experience.
Pre-populating from the already-running engines removes that lazy
worst-case path entirely.

## Verification

- `pnpm verify:fast` — PASS (13 steps, 115s): CLI `tsup` build green,
scoped typecheck/build green, boot smoke green (`fn --help` + real
`serve` with `GET /api/health` 200).
- Cherry-picked cleanly onto current `origin/main` (`5532019fd`); branch
is up-to-date with `origin/main` at PR time.

## Files

- `packages/cli/src/commands/dashboard.ts` (+30)
- `.changeset/extension-host-store-warmup.md` (new)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved dashboard startup reliability by reusing existing project
task connections.
* Prevented extension task tools from creating duplicate connection
pools.
* Added non-blocking warnings when individual project initialization or
discovery fails.
* Dashboard startup now reports how many project task stores were
successfully prepared.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: gsxdsm <gsxdsm@users.noreply.github.com>
 2026-08-07 00:25:39 -07:00
gsxdsm
64413f4e8d chore(release): v0.75.1 
Version bump via changesets.
 2026-08-06 00:18:07 -07:00
gsxdsm
cb500eeb4c chore(release): v0.75.1-beta.2 
Version bump via changesets.
 2026-08-05 18:19:27 -07:00
gsxdsm
1db7adcdb0 FN-8809: preserve agent principals for secret approvals 
Keep prompt-gated secret approvals bound to their calling chat-agent session.

- Resolve extension secret callers through async session identity context.
- Give anonymous engine sessions unique principals and preserve them across tool invocations.
- Surface actionable approval decision errors in the mailbox and cover approval flows.

Files changed:
 .changeset/fn-8809-secrets-chat-approval.md        |   7 +
 .../__tests__/extension-permission-gates.test.ts   | 257 ++++++++++++++++++++-
 packages/cli/src/extension.ts                      |  96 +++++---
 .../__tests__/session-identity-registry.test.ts    |  27 +++
 packages/core/src/index.ts                         |   4 +-
 packages/core/src/session-identity-registry.ts     |  47 +++-
 packages/dashboard/app/components/MailboxView.tsx  |  11 +-
 .../app/components/__tests__/MailboxView.test.tsx  |  49 ++++
 .../dashboard/src/__tests__/chat-manager.test.ts   |  28 ++-
 .../__tests__/register-approval-routes.test.ts     |  22 ++
 .../src/__tests__/pi-create-fn-agent.test.ts       | 210 ++++++++++++++++-
 packages/engine/src/pi.ts                          |  34 ++-
 12 files changed, 748 insertions(+), 44 deletions(-)

Fusion-Task-Id: FN-8809

Fusion-Task-Lineage: 2e070f78-7215-4401-bcf2-6fa25fa27066

Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
 2026-08-05 16:46:53 -07:00
gsxdsm
2a0827835d FN-8810: wire secrets stores into runtime worktrees 
Wire project secrets stores into runtime and dashboard heartbeat worktree acquisition.

- Inject the project secrets store into executor and heartbeat monitors.
- Cover in-process, UI-only dashboard, and secrets-env worktree materialization paths.
- Add a patch changeset for restored secrets-env files.

Files changed:
 .changeset/fn-8810-secrets-env-runtime-wiring.md   |   7 ++
 .../commands/__tests__/dashboard-supervise.test.ts |  28 ++++-
 packages/cli/src/commands/dashboard.ts             |  38 ++++++-
 .../src/__tests__/in-process-runtime.pg.test.ts    | 121 ++++++++++++++++++++-
 .../src/__tests__/secrets-env-writer.test.ts       |  35 ++++++
 .../worktree-acquisition-secrets-env.test.ts       |   4 +-
 packages/engine/src/runtimes/in-process-runtime.ts |   9 ++
 7 files changed, 233 insertions(+), 9 deletions(-)

Fusion-Task-Id: FN-8810

Fusion-Task-Lineage: a67c3fbe-7744-4898-8a56-8739caa04479

Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
 2026-08-05 15:23:08 -07:00
gsxdsm
68e964383f chore(release): v0.75.1-beta.1 
Version bump via changesets.
 2026-08-05 00:12:09 -07:00
gsxdsm
6a5e1b0145 chore(release): v0.75.1-beta.0 
Version bump via changesets.
 2026-08-04 20:38:29 -07:00
gsxdsm
5dbfef7b64 chore(release): v0.75.0 
Version bump via changesets.
 2026-08-04 16:41:28 -07:00
gsxdsm
b1d5e0fec3 chore(release): v0.75.0-beta.2 
Version bump via changesets.
 2026-08-04 11:58:02 -07:00
gsxdsm
07dccbe2bd FN-8783: parallelize static merge-gate validators 
Run independent static merge-gate policy validators concurrently without weakening gate ordering.

- Add a fail-closed concurrent static-validator runner with coverage for inventory and failures.
- Preserve curated engine, PostgreSQL, unit, and CI-shape gate contracts.
- Document the gate composition and warm-cache performance policy.

Files changed:
 docs/testing.md                                    |  13 ++-
 package.json                                       |   3 +-
 packages/cli/src/__tests__/ci-workflow.test.ts     |  21 ++--
 packages/engine/vitest.config.ts                   |  36 +++++--
 .../__tests__/engine-vitest-gate-policy.test.mjs   |  90 +++++++++++++----
 scripts/__tests__/run-static-gate-checks.test.mjs  | 100 +++++++++++++++++++
 scripts/run-static-gate-checks.mjs                 | 106 +++++++++++++++++++++
 7 files changed, 332 insertions(+), 37 deletions(-)

Fusion-Task-Id: FN-8783

Fusion-Task-Lineage: d5d3c9e1-b3c4-45ff-a3e7-f9555585cd70

Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
 2026-08-04 09:21:07 -07:00
gsxdsm
9e4a0817db feat: restart the development engine on source changes (#3329) 
## Summary

Add an opt-in source-development loop that restarts the dashboard and
engine when runtime TypeScript or JSON changes. Use `pnpm dev:watch`;
`pnpm dev:hmr` now combines Vite UI HMR with the same supervised
API/engine restart path.

The watcher filters tests, fixtures, generated declarations, build
output, and task state. It coalesces bursts with a two-second maximum
wait, waits for the child to acknowledge its IPC listener, and rebuilds
runtime dist artifacts before a source-triggered respawn.

## Safety model

- Close scheduler, triage, heartbeat, mission, routine, self-healing,
and merge admission before checking for active work.
- Let already-running agents reach a safe boundary; do not mutate
durable pause settings.
- Enter the existing graceful exit-code-86 shutdown and supervised
respawn path.
- Retry failed liveness reads and declined restart requests instead of
dropping the pending change.
- Keep ordinary `pnpm dev` behavior unchanged; inherited watch state
does not break nested non-dashboard development commands.

A development restart intentionally replaces the dashboard process, so
transient dashboard connections and project dev-server children
reconnect or restart with it. Agent work is the protected boundary.

## Validation

- `pnpm lint`
- `pnpm test:gate` (753 tests passed across engine, core, PostgreSQL
gate, and CI-shape suites)
- Focused CLI watcher/restart/supervision suites: 40 tests passed
- Focused engine drain/manager suites: 52 tests passed
- `pnpm --filter @runfusion/fusion typecheck`
- `pnpm --filter @fusion/engine typecheck`
- `pnpm verify:fast` (13 steps passed, including CLI build and real
health boot smoke)
- Manual unsupported-command probe confirms explicit `--watch` fails
clearly outside the dashboard command

## Post-Deploy Monitoring & Validation

- Watch for `[fusion:dev] source changed`, `source restart deferred`,
`active work drained`, and `restart requested` logs during the first
watched development session.
- Healthy behavior is one exit-86 respawn per edit batch, no interrupted
active agents, refreshed dist artifacts, and a healthy dashboard after
respawn.
- Investigate repeated restart loops, watcher attachment warnings,
declined restart retries, or liveness-read failures.
- Immediate mitigation is to use ordinary `pnpm dev` without `--watch`;
no production runtime behavior or durable setting needs rollback.
- Validation owner: Fusion maintainers during the first source edit
after merge.

---

[![Compound
Engineering](https://img.shields.io/badge/Built_with-Compound_Engineering-6366f1)](https://github.com/EveryInc/compound-engineering-plugin)


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added `pnpm dev:watch` to automatically restart development runtime
processes when source files change.
* Development restarts now wait for active work to finish, preventing
new work from starting during the transition.
* Enhanced `pnpm dev:hmr` with graceful runtime source restarts while
keeping the dashboard available.
  * Rapid source changes are grouped to avoid unnecessary restarts.

* **Documentation**
* Updated development setup and contribution guides with the new watch
workflow.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-04 08:57:30 -07:00
gsxdsm
993a2f9d86 chore(release): v0.75.0-beta.1 
Version bump via changesets.
 2026-08-04 01:59:50 -07:00
gsxdsm
77c698a249 chore(release): v0.75.0-beta.0 
Version bump via changesets.
 2026-08-03 13:04:46 -07:00
gsxdsm
56819e21e9 fix: restore plugin SDK and Todo packaging 2026-08-03 12:16:32 -07:00
Phil Larson
5d8d494230 fix(todos): restore clean build and navigation coverage (#3321) 
## Summary
- remove an unavailable jest-dom type from the Todo plugin production
TypeScript build
- update the dashboard navigation fixture for the plugin-owned Todo
destination and root test id

## Test plan
- `corepack pnpm --filter @fusion-plugin-examples/todos build`
- `corepack pnpm --filter @fusion-plugin-examples/todos test`
- `FUSION_DASHBOARD_DEEP=1 corepack pnpm --filter @fusion/dashboard exec
vitest run app/components/__tests__/navigation-history.test.tsx
--project dashboard-app-quality-components-a --silent=passed-only
--reporter=dot`
- `corepack pnpm check:changesets`

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
  * Restored CLI packaging for the bundled Todo Lists plugin.
  * Made `AgentStore` available to bundled plugins at runtime.
* **Tests**
* Updated navigation coverage for Todo Lists dashboard views, overflow
placement, and ordering.
* Added coverage for opening and dismissing the Todo view through
browser history navigation.
  * Improved validation of runtime exports.
* **Chores**
  * Simplified test type configuration for the Todo Lists plugin.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
 2026-08-03 12:14:31 -07:00
gsxdsm
5b2b31d2c9 FN-8762: extract Todo Lists into bundled plugin 
Move Todo Lists into a bundled, project-enabled plugin package.

- Move Todo UI, client API, and server routes into the plugin package.
- Register and bundle Todo as an enabled plugin dashboard view rather than a static host feature.
- Preserve Todo route validation and server-error semantics, including task assignment agent lookup.
- Keep disabled and legacy Todo views out of project navigation and main content.

Files changed:
 .changeset/fn-8762-todos-plugin.md                 |   7 +
 AGENTS.md                                          |   3 +-
 docs/PLUGIN_AUTHORING.md                           |   4 +
 docs/dashboard-guide.md                            |   4 +
 docs/todo-view.md                                  | 151 +----
 .../cli/src/plugins/staged-bundled-plugin-ids.ts   |   1 +
 packages/cli/tsup.config.ts                        |   8 +
 .../core/src/board/mobile-nav-primary-items.ts     |   2 -
 .../__tests__/bundled-plugin-install.test.ts       |   2 +
 .../core/src/plugins/bundled-plugin-install.ts     |   1 +
 packages/dashboard/app/App.tsx                     |  18 +-
 .../app/__tests__/lazy-loaded-views-docs.test.ts   |   9 +-
 packages/dashboard/app/api/legacy.ts               |  15 -
 packages/dashboard/app/api/system/index.ts         |   1 -
 packages/dashboard/app/api/system/todo.ts          |  85 ---
 packages/dashboard/app/components/Header.tsx       |  23 +-
 .../dashboard/app/components/LeftSidebarNav.tsx    |   1 -
 packages/dashboard/app/components/MobileNavBar.tsx |   4 -
 .../dashboard/app/components/SettingsModal.tsx     |   2 -
 .../app/components/__tests__/App.test.tsx          |   7 -
 .../app/components/__tests__/Header.test.tsx       |  42 --
 .../app/components/__tests__/RightDock.test.tsx    |  18 +-
 ...skDetail.mobile-transition.board-panel.test.tsx |   1 -
 .../__tests__/TaskDetail.swipe-back.test.tsx       |   1 -
 .../__tests__/TodoView.mobile-css.test.ts          |  66 ---
 .../app/components/__tests__/TodoView.test.tsx     | 649 ---------------------
 .../__tests__/navigation-history.test.tsx          |   3 -
 .../__tests__/overflowViewRegistry.test.tsx        | 118 +---
 .../app/components/dashboard/MainContent.tsx       |  27 +-
 .../dashboard/app/components/dashboard/types.ts    |   6 +-
 .../app/components/overflowViewRegistry.tsx        |  21 +-
 .../app/hooks/__tests__/useTodoLists.test.ts       | 291 ---------
 .../app/hooks/__tests__/useViewState.test.ts       |  11 +
 packages/dashboard/app/hooks/useAppSettings.ts     |   5 -
 packages/dashboard/app/hooks/useViewState.ts       |   5 +
 .../__tests__/registerBundledPluginViews.test.tsx  |  14 +
 packages/dashboard/app/plugins/bundled-todos.d.ts  |   5 +
 .../app/plugins/registerBundledPluginViews.ts      |  18 +
 packages/dashboard/app/plugins/types.ts            |   4 +
 .../src/__tests__/todo-documentation.test.ts       |  68 ---
 .../dashboard/src/__tests__/todo-routes.test.ts    | 577 ------------------
 packages/dashboard/src/registry-manifest.json      | 101 +++-
 packages/dashboard/src/routes.ts                   |   1 -
 .../src/routes/plugin-bundled-runtimes.ts          |   1 +
 .../src/routes/register-integrated-routers.ts      |   2 -
 packages/dashboard/src/shared/dashboard-views.ts   |   6 -
 packages/dashboard/src/todo-routes.ts              | 342 -----------
 packages/dashboard/vite.config.ts                  |   8 +
 packages/dashboard/vitest.config.ts                |   8 +
 packages/desktop/scripts/workspace-tools.ts        |   1 +
 plugins/fusion-plugin-todos/README.md              |  20 +
 plugins/fusion-plugin-todos/manifest.json          |   6 +
 plugins/fusion-plugin-todos/package.json           |  38 ++
 .../fusion-plugin-todos/src/dashboard-interop.d.ts |  12 +
 plugins/fusion-plugin-todos/src/dashboard-view.tsx |   4 +
 .../src/dashboard/LoadingSpinner.tsx               |   1 +
 .../src/dashboard}/TodoView.css                    |   0
 .../src/dashboard}/TodoView.tsx                    |  16 +-
 plugins/fusion-plugin-todos/src/dashboard/api.ts   |  15 +
 .../src/dashboard/projectStorage.ts                |   3 +
 .../fusion-plugin-todos/src/dashboard/swrCache.ts  |   6 +
 .../src/dashboard/useConfirm.ts                    |   1 +
 .../src/dashboard}/useTodoLists.ts                 |   4 +-
 plugins/fusion-plugin-todos/src/index.ts           |   4 +
 .../fusion-plugin-todos/src/todo-routes.test.ts    |  46 ++
 plugins/fusion-plugin-todos/src/todo-routes.ts     | 156 +++++
 plugins/fusion-plugin-todos/tsconfig.json          |  28 +
 plugins/fusion-plugin-todos/vitest.config.ts       |   9 +
 pnpm-lock.yaml                                     |  64 +-
 pnpm-workspace.yaml                                |   1 +
 70 files changed, 671 insertions(+), 2531 deletions(-)

Fusion-Task-Id: FN-8762
Fusion-Task-Lineage: 3beb502c-3793-451b-b357-50c243395410
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
 2026-08-03 09:04:45 -07:00
gsxdsm
cb57093d03 refactor: domain folder layout (types, API, core, engine) (#2398) 
## Summary

Wave 17 organizes Fusion into **domain folders** (stacks on #2397).

### Layout
- **core/types/** — board, task, agents, settings, merge, workflow,
mesh, …
- **core/src/** — agents, ai, async-stores, workflows, tasks, config,
db, …
- **dashboard/app/api/** — client, tasks, agents, git, missions,
planning, …
- **engine/src/** — agents, auth, execution, merge, missions, overseer,
worktree, …

Root keepers retained for large entrypoints (`store.ts`, `executor.ts`,
`merger.ts`, …).

Public barrels (`@fusion/core`, `@fusion/engine`, `app/api.ts` → legacy)
stay stable.

## Test plan
- [x] `@fusion/core` typecheck
- [x] `@fusion/engine` typecheck (pre-existing playwright-core noise
only)
- [ ] CI merge gate

**Stack:** #2394 → #2397 → **this PR**
 2026-08-03 00:20:53 -07:00
dependabot[bot]
a6d64eba8c chore(deps): bump i18next from 26.3.1 to 26.3.6 (#3307) 
Bumps [i18next](https://github.com/i18next/i18next) from 26.3.1 to
26.3.6.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next/releases">i18next's
releases</a>.</em></p>
<blockquote>
<h2>v26.3.6</h2>
<ul>
<li>fix: allow TypeScript 7 in the optional <code>typescript</code> peer
dependency range (<code>^5 || ^6 || ^7</code>). With
<code>typescript@7.0.2</code> in a project, <code>npm install</code>
failed with an <code>ERESOLVE</code> peer conflict. The published types
are TS7-compatible as-is: every <code>test/typescript</code> suite
produces identical results under 6.0 and 7.0.2. Reported in <a
href="https://redirect.github.com/i18next/react-i18next/issues/1927">react-i18next#1927</a>,
thanks <a
href="https://github.com/andikapradanaarif"><code>@​andikapradanaarif</code></a>.</li>
</ul>
<h2>v26.3.5</h2>
<ul>
<li>fix: <code>$t()</code> nesting options blocks that span multiple
lines are now parsed. <code>nest()</code> decided where the nested key
ends by testing <code>match[1]</code> with <code>/{.*}/</code>, whose
dot does not cross line breaks — so a <code>$t(key, { ... })</code>
options object containing a newline was treated as having no options,
mis-split as formatters, and the nested lookup ran without its options
(placeholders stayed unresolved). The nesting regexp itself already
matches newlines inside <code>$t(...)</code>; adding the <code>s</code>
(dotAll) flag makes multiline options behave like the single-line form.
Thanks <a href="https://github.com/spokodev"><code>@​spokodev</code></a>
(<a
href="https://redirect.github.com/i18next/i18next/pull/2440">#2440</a>).</li>
<li>fix: <code>getUsedParamsDetails</code> (the <code>returnDetails:
true</code> path) no longer mutates the passed <code>replace</code>
object. It wrote <code>count</code> straight onto
<code>options.replace</code> so the returned <code>usedParams</code>
would include it — a caller reusing one <code>replace</code> object
across <code>t()</code> calls then carried a stale <code>count</code>
into later interpolations (e.g. a previous call's <code>count: 5</code>
rendered instead of the current call's value). The details are now built
from a copy; <code>usedParams</code> still includes <code>count</code>.
Thanks <a href="https://github.com/spokodev"><code>@​spokodev</code></a>
(<a
href="https://redirect.github.com/i18next/i18next/pull/2441">#2441</a>).</li>
<li>fix: with the default <code>skipOnVariables: true</code> +
<code>escapeValue: true</code>, a <code>{{placeholder}}</code> carried
inside an interpolated value now stays literal even when the value
contains escapable characters. The skip logic advanced the regex
<code>lastIndex</code> by the raw value length, but the escaped text
written into the string is longer, so <code>lastIndex</code> landed
inside the inserted value and a trailing <code>{{placeholder}}</code> in
it got interpolated — leaking another in-scope variable that should have
stayed literal (values without escapable characters were already skipped
correctly). The advance now uses the escaped length that is actually
written, and the regex-safe <code>$</code>-doubling is applied only at
the <code>String.replace</code> call so it can't distort the length
arithmetic. Thanks <a
href="https://github.com/spokodev"><code>@​spokodev</code></a> (<a
href="https://redirect.github.com/i18next/i18next/pull/2442">#2442</a>).</li>
</ul>
<h2>v26.3.4</h2>
<ul>
<li>fix(security): <code>deepExtend</code> (used by
<code>addResourceBundle(..., deep, overwrite)</code>) no longer recurses
into inherited properties. It checked key existence with the
<code>in</code> operator, which walks the prototype chain, so a source
key matching an inherited built-in (e.g. <code>hasOwnProperty</code>,
<code>toString</code>) caused recursion into the shared
<code>Object.prototype</code> function and, with <code>overwrite:
true</code>, could overwrite e.g.
<code>Object.prototype.hasOwnProperty.call</code> with a non-callable
value — corrupting a shared built-in process-wide (DoS). Existence is
now checked with <code>Object.prototype.hasOwnProperty.call</code>, so
such keys are copied as plain own data instead. This complements the
existing <code>__proto__</code>/<code>constructor</code> guard and is
also strictly more correct for an own-property merge. Only affects
applications that pass attacker-controlled data with <code>deep:
true</code> and <code>overwrite: true</code>; no standard
backend/integration does this. Distinct from CVE-2026-48713 /
CVE-2026-48714 (different packages, <code>setPath</code> mechanism).
Thanks to zx (Jace) for the responsible disclosure.</li>
</ul>
<h2>v26.3.3</h2>
<ul>
<li>fix(types): selector <code>t($ =&gt; $.arr, { returnObjects: true,
context })</code> on a JSON array of <strong>heterogeneous</strong>
objects now preserves each element's full shape (e.g. <code>{ transKey1:
string; transKey2: string }[]</code>) instead of collapsing to a union
of partial element types. Two type-level causes: (1)
<code>FilterKeys</code> evaluated the whole array element type at once,
so <code>keyof (A | B)</code> only saw the keys common to every element
— it now distributes over the object union and filters each element
independently; (2) when TypeScript merges mismatched array element types
it injects phantom optional <code>undefined</code> keys (e.g.
<code>transKey1_withContext?: undefined</code> on elements that don't
define it), which the context-detection helpers mistook for real context
variants — they now skip keys typed as <code>undefined</code>. Also adds
a dedicated <code>context</code> + <code>returnObjects: true</code>
selector overload using <code>const Fn</code> +
<code>ReturnType&lt;Fn&gt;</code>, so <code>Target</code> is no longer
collapsed to <code>unknown</code> via <code>ApplyTarget</code>. Resolves
Problem 1 of <a
href="https://redirect.github.com/i18next/i18next/issues/2398">#2398</a>
(Problem 2 was already fixed on master). Thanks <a
href="https://github.com/sauravgupta-dotcom"><code>@​sauravgupta-dotcom</code></a>
(<a
href="https://redirect.github.com/i18next/i18next/pull/2438">#2438</a>).
Fixes <a
href="https://redirect.github.com/i18next/i18next/issues/2398">#2398</a>.</li>
</ul>
<h2>v26.3.2</h2>
<ul>
<li>fix: chained formatters with a parenthesised option that contains
the format separator (e.g. <code>join(separator: ', ')</code>) now work
at <strong>any</strong> position in the chain, not just first.
Previously the comma-in-parens reassembly only repaired
<code>formats[0]</code>, so <code>{{v, uppercase, join(separator: ',
')}}</code> split the <code>join(...)</code> option on the inner comma
and never rejoined it, producing corrupt output. Replaced the
first-position-only repair with a position-independent pass that
re-joins fragments until each open paren closes. Thanks <a
href="https://github.com/spokodev"><code>@​spokodev</code></a> (<a
href="https://redirect.github.com/i18next/i18next/pull/2437">#2437</a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/i18next/i18next/blob/master/CHANGELOG.md">i18next's
changelog</a>.</em></p>
<blockquote>
<h2>26.3.6</h2>
<ul>
<li>fix: allow TypeScript 7 in the optional <code>typescript</code> peer
dependency range (<code>^5 || ^6 || ^7</code>). With
<code>typescript@7.0.2</code> in a project, <code>npm install</code>
failed with an <code>ERESOLVE</code> peer conflict. The published types
are TS7-compatible as-is: every <code>test/typescript</code> suite
produces identical results under 6.0 and 7.0.2. Reported in <a
href="https://redirect.github.com/i18next/react-i18next/issues/1927">react-i18next#1927</a>,
thanks <a
href="https://github.com/andikapradanaarif"><code>@​andikapradanaarif</code></a>.</li>
</ul>
<h2>26.3.5</h2>
<ul>
<li>fix: <code>$t()</code> nesting options blocks that span multiple
lines are now parsed. <code>nest()</code> decided where the nested key
ends by testing <code>match[1]</code> with <code>/{.*}/</code>, whose
dot does not cross line breaks — so a <code>$t(key, { ... })</code>
options object containing a newline was treated as having no options,
mis-split as formatters, and the nested lookup ran without its options
(placeholders stayed unresolved). The nesting regexp itself already
matches newlines inside <code>$t(...)</code>; adding the <code>s</code>
(dotAll) flag makes multiline options behave like the single-line form.
Thanks <a href="https://github.com/spokodev"><code>@​spokodev</code></a>
(<a
href="https://redirect.github.com/i18next/i18next/pull/2440">#2440</a>).</li>
<li>fix: <code>getUsedParamsDetails</code> (the <code>returnDetails:
true</code> path) no longer mutates the passed <code>replace</code>
object. It wrote <code>count</code> straight onto
<code>options.replace</code> so the returned <code>usedParams</code>
would include it — a caller reusing one <code>replace</code> object
across <code>t()</code> calls then carried a stale <code>count</code>
into later interpolations (e.g. a previous call's <code>count: 5</code>
rendered instead of the current call's value). The details are now built
from a copy; <code>usedParams</code> still includes <code>count</code>.
Thanks <a href="https://github.com/spokodev"><code>@​spokodev</code></a>
(<a
href="https://redirect.github.com/i18next/i18next/pull/2441">#2441</a>).</li>
<li>fix: with the default <code>skipOnVariables: true</code> +
<code>escapeValue: true</code>, a <code>{{placeholder}}</code> carried
inside an interpolated value now stays literal even when the value
contains escapable characters. The skip logic advanced the regex
<code>lastIndex</code> by the raw value length, but the escaped text
written into the string is longer, so <code>lastIndex</code> landed
inside the inserted value and a trailing <code>{{placeholder}}</code> in
it got interpolated — leaking another in-scope variable that should have
stayed literal (values without escapable characters were already skipped
correctly). The advance now uses the escaped length that is actually
written, and the regex-safe <code>$</code>-doubling is applied only at
the <code>String.replace</code> call so it can't distort the length
arithmetic. Thanks <a
href="https://github.com/spokodev"><code>@​spokodev</code></a> (<a
href="https://redirect.github.com/i18next/i18next/pull/2442">#2442</a>).</li>
</ul>
<h2>26.3.4</h2>
<ul>
<li>fix(security): <code>deepExtend</code> (used by
<code>addResourceBundle(..., deep, overwrite)</code>) no longer recurses
into inherited properties. It checked key existence with the
<code>in</code> operator, which walks the prototype chain, so a source
key matching an inherited built-in (e.g. <code>hasOwnProperty</code>,
<code>toString</code>) caused recursion into the shared
<code>Object.prototype</code> function and, with <code>overwrite:
true</code>, could overwrite e.g.
<code>Object.prototype.hasOwnProperty.call</code> with a non-callable
value — corrupting a shared built-in process-wide (DoS). Existence is
now checked with <code>Object.prototype.hasOwnProperty.call</code>, so
such keys are copied as plain own data instead. This complements the
existing <code>__proto__</code>/<code>constructor</code> guard and is
also strictly more correct for an own-property merge. Only affects
applications that pass attacker-controlled data with <code>deep:
true</code> and <code>overwrite: true</code>; no standard
backend/integration does this. Distinct from CVE-2026-48713 /
CVE-2026-48714 (different packages, <code>setPath</code> mechanism). See
advisory <a
href="https://github.com/i18next/i18next/security/advisories/GHSA-6jcc-5g8w-32mx">GHSA-6jcc-5g8w-32mx</a>,
CVSS 5.9 (<code>CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H</code>).
Thanks to zx (Jace) <a
href="https://github.com/manus-use"><code>@​manus-use</code></a> for the
responsible disclosure.</li>
</ul>
<h2>26.3.3</h2>
<ul>
<li>fix(types): selector <code>t($ =&gt; $.arr, { returnObjects: true,
context })</code> on a JSON array of <strong>heterogeneous</strong>
objects now preserves each element's full shape (e.g. <code>{ transKey1:
string; transKey2: string }[]</code>) instead of collapsing to a union
of partial element types. Two type-level causes: (1)
<code>FilterKeys</code> evaluated the whole array element type at once,
so <code>keyof (A | B)</code> only saw the keys common to every element
— it now distributes over the object union and filters each element
independently; (2) when TypeScript merges mismatched array element types
it injects phantom optional <code>undefined</code> keys (e.g.
<code>transKey1_withContext?: undefined</code> on elements that don't
define it), which the context-detection helpers mistook for real context
variants — they now skip keys typed as <code>undefined</code>. Also adds
a dedicated <code>context</code> + <code>returnObjects: true</code>
selector overload using <code>const Fn</code> +
<code>ReturnType&lt;Fn&gt;</code>, so <code>Target</code> is no longer
collapsed to <code>unknown</code> via <code>ApplyTarget</code>. Resolves
Problem 1 of <a
href="https://redirect.github.com/i18next/i18next/issues/2398">#2398</a>
(Problem 2 was already fixed on master). Thanks <a
href="https://github.com/sauravgupta-dotcom"><code>@​sauravgupta-dotcom</code></a>
(<a
href="https://redirect.github.com/i18next/i18next/pull/2438">#2438</a>).
Fixes <a
href="https://redirect.github.com/i18next/i18next/issues/2398">#2398</a>.</li>
</ul>
<h2>26.3.2</h2>
<ul>
<li>fix: chained formatters with a parenthesised option that contains
the format separator (e.g. <code>join(separator: ', ')</code>) now work
at <strong>any</strong> position in the chain, not just first.
Previously the comma-in-parens reassembly only repaired
<code>formats[0]</code>, so <code>{{v, uppercase, join(separator: ',
')}}</code> split the <code>join(...)</code> option on the inner comma
and never rejoined it, producing corrupt output. Replaced the
first-position-only repair with a position-independent pass that
re-joins fragments until each open paren closes. Thanks <a
href="https://github.com/spokodev"><code>@​spokodev</code></a> (<a
href="https://redirect.github.com/i18next/i18next/pull/2437">#2437</a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="e1c60d4dd2"><code>e1c60d4</code></a>
26.3.6</li>
<li><a
href="04da43e08c"><code>04da43e</code></a>
fix: allow typescript 7 in optional peerDependencies range
(react-i18next#1927)</li>
<li><a
href="8eed4accc6"><code>8eed4ac</code></a>
build</li>
<li><a
href="573ae73568"><code>573ae73</code></a>
26.3.5</li>
<li><a
href="cc54b05b5c"><code>cc54b05</code></a>
docs(changelog): 26.3.5 — multiline $t() options, replace mutation,
escaped-l...</li>
<li><a
href="3180d67291"><code>3180d67</code></a>
fix: skip interpolation of placeholders inside escaped values (<a
href="https://redirect.github.com/i18next/i18next/issues/2442">#2442</a>)</li>
<li><a
href="d16f5a2da7"><code>d16f5a2</code></a>
fix: stop mutating the passed replace object when returning details (<a
href="https://redirect.github.com/i18next/i18next/issues/2441">#2441</a>)</li>
<li><a
href="bed56c1159"><code>bed56c1</code></a>
fix: parse $t() nesting options block that spans multiple lines (<a
href="https://redirect.github.com/i18next/i18next/issues/2440">#2440</a>)</li>
<li><a
href="c19e45864f"><code>c19e458</code></a>
docs(changelog): link GHSA advisory for deepExtend fix</li>
<li><a
href="7bb87d09f9"><code>7bb87d0</code></a>
docs(changelog): reference security advisory for deepExtend fix</li>
<li>Additional commits viewable in <a
href="https://github.com/i18next/i18next/compare/v26.3.1...v26.3.6">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=i18next&package-manager=npm_and_yarn&previous-version=26.3.1&new-version=26.3.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: gsxdsm <gsxdsm@users.noreply.github.com>
 2026-08-02 23:39:03 -07:00
gsxdsm
86a749cac9 fix(ci): disable package-manager-cache on skip-install setup-node 
actions/setup-node@v5 defaults package-manager-cache:true, so the agent-browser
pack fixture still registered a pnpm store path and failed post-job with Path
Validation Error after a successful pack/upload. Explicitly set
package-manager-cache:false when skip-install is true.
 2026-08-02 23:27:03 -07:00
gsxdsm
fb0863f660 FN-8753: enable installed voice input in project settings 
Make Voice Input available only after its local model and runtime are ready.

- Bundle the optional sherpa runtime with the published CLI.
- Gate the project setting on model installation and stable runtime status codes.
- Add localized recovery guidance, documentation, and coverage.

Files changed:
 .changeset/fn-8753-voice-input-enable.md           |  7 ++++
 docs/dashboard-guide.md                            |  2 +-
 docs/settings-reference.md                         |  8 +++--
 packages/cli/package.json                          |  3 ++
 packages/cli/src/__tests__/package-config.test.ts  | 16 +++++++++
 .../settings/__tests__/VoiceInputSection.test.tsx  | 36 ++++++++++++++++----
 .../settings/sections/VoiceInputSection.tsx        | 30 ++++++++++++-----
 packages/dashboard/package.json                    |  2 +-
 .../routes/__tests__/register-voice-routes.test.ts | 39 ++++++++++++++++++++++
 .../dashboard/src/stt/__tests__/voice-stt.test.ts  | 27 ++++++++++++---
 packages/dashboard/src/stt/parakeet-service.ts     | 26 ++++++++++-----
 packages/i18n/locales/en/app.json                  |  6 ++++
 pnpm-lock.yaml                                     |  6 +++-
 13 files changed, 175 insertions(+), 33 deletions(-)

Fusion-Task-Id: FN-8753

Fusion-Task-Lineage: db92b148-37f0-45d2-b616-ed2e3f2d54f6

Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
 2026-08-02 23:09:48 -07:00
dependabot[bot]
6e416b044d chore(deps): bump actions/download-artifact from 4 to 8 (#3304) 
Bumps
[actions/download-artifact](https://github.com/actions/download-artifact)
from 4 to 8.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/download-artifact/releases">actions/download-artifact's
releases</a>.</em></p>
<blockquote>
<h2>v8.0.0</h2>
<h2>v8 - What's new</h2>
<blockquote>
<p>[!IMPORTANT]
actions/download-artifact@v8 has been migrated to an ESM module. This
should be transparent to the caller but forks might need to make
significant changes.</p>
</blockquote>
<blockquote>
<p>[!IMPORTANT]
Hash mismatches will now error by default. Users can override this
behavior with a setting change (see below).</p>
</blockquote>
<h3>Direct downloads</h3>
<p>To support direct uploads in <code>actions/upload-artifact</code>,
the action will no longer attempt to unzip all downloaded files.
Instead, the action checks the <code>Content-Type</code> header ahead of
unzipping and skips non-zipped files. Callers wishing to download a
zipped file as-is can also set the new <code>skip-decompress</code>
parameter to <code>true</code>.</p>
<h3>Enforced checks (breaking)</h3>
<p>A previous release introduced digest checks on the download. If a
download hash didn't match the expected hash from the server, the action
would log a warning. Callers can now configure the behavior on mismatch
with the <code>digest-mismatch</code> parameter. To be secure by
default, we are now defaulting the behavior to <code>error</code> which
will fail the workflow run.</p>
<h3>ESM</h3>
<p>To support new versions of the @actions/* packages, we've upgraded
the package to ESM.</p>
<h2>What's Changed</h2>
<ul>
<li>Don't attempt to un-zip non-zipped downloads by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/download-artifact/pull/460">actions/download-artifact#460</a></li>
<li>Add a setting to specify what to do on hash mismatch and default it
to <code>error</code> by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/download-artifact/pull/461">actions/download-artifact#461</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/download-artifact/compare/v7...v8.0.0">https://github.com/actions/download-artifact/compare/v7...v8.0.0</a></p>
<h2>v7.0.0</h2>
<h2>v7 - What's new</h2>
<blockquote>
<p>[!IMPORTANT]
actions/download-artifact@v7 now runs on Node.js 24 (<code>runs.using:
node24</code>) and requires a minimum Actions Runner version of 2.327.1.
If you are using self-hosted runners, ensure they are updated before
upgrading.</p>
</blockquote>
<h3>Node.js 24</h3>
<p>This release updates the runtime to Node.js 24. v6 had preliminary
support for Node 24, however this action was by default still running on
Node.js 20. Now this action by default will run on Node.js 24.</p>
<h2>What's Changed</h2>
<ul>
<li>Update GHES guidance to include reference to Node 20 version by <a
href="https://github.com/patrikpolyak"><code>@​patrikpolyak</code></a>
in <a
href="https://redirect.github.com/actions/download-artifact/pull/440">actions/download-artifact#440</a></li>
<li>Download Artifact Node24 support by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/download-artifact/pull/415">actions/download-artifact#415</a></li>
<li>fix: update <code>@​actions/artifact</code> to fix Node.js 24
punycode deprecation by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/download-artifact/pull/451">actions/download-artifact#451</a></li>
<li>prepare release v7.0.0 for Node.js 24 support by <a
href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a
href="https://redirect.github.com/actions/download-artifact/pull/452">actions/download-artifact#452</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/patrikpolyak"><code>@​patrikpolyak</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/download-artifact/pull/440">actions/download-artifact#440</a></li>
<li><a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/download-artifact/pull/415">actions/download-artifact#415</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/download-artifact/compare/v6.0.0...v7.0.0">https://github.com/actions/download-artifact/compare/v6.0.0...v7.0.0</a></p>
<h2>v6.0.0</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="3e5f45b2cf"><code>3e5f45b</code></a>
Add regression tests for CJK characters (<a
href="https://redirect.github.com/actions/download-artifact/issues/471">#471</a>)</li>
<li><a
href="e6d03f6737"><code>e6d03f6</code></a>
Add a regression test for artifact name + content-type mismatches (<a
href="https://redirect.github.com/actions/download-artifact/issues/472">#472</a>)</li>
<li><a
href="70fc10c6e5"><code>70fc10c</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/download-artifact/issues/461">#461</a>
from actions/danwkennedy/digest-mismatch-behavior</li>
<li><a
href="f258da9a50"><code>f258da9</code></a>
Add change docs</li>
<li><a
href="ccc058e5fb"><code>ccc058e</code></a>
Fix linting issues</li>
<li><a
href="bd7976ba57"><code>bd7976b</code></a>
Add a setting to specify what to do on hash mismatch and default it to
<code>error</code></li>
<li><a
href="ac21fcf45e"><code>ac21fcf</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/download-artifact/issues/460">#460</a>
from actions/danwkennedy/download-no-unzip</li>
<li><a
href="15999bff51"><code>15999bf</code></a>
Add note about package bumps</li>
<li><a
href="974686ed50"><code>974686e</code></a>
Bump the version to <code>v8</code> and add release notes</li>
<li><a
href="fbe48b1d27"><code>fbe48b1</code></a>
Update test names to make it clearer what they do</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/download-artifact/compare/v4...v8">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/download-artifact&package-manager=github_actions&previous-version=4&new-version=8)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: gsxdsm <gsxdsm@users.noreply.github.com>
 2026-08-02 22:53:56 -07:00
dependabot[bot]
0583f1684b chore(deps): bump ink from 7.0.5 to 7.1.1 (#3306) 
Bumps [ink](https://github.com/vadimdemedes/ink) from 7.0.5 to 7.1.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vadimdemedes/ink/releases">ink's
releases</a>.</em></p>
<blockquote>
<h2>v7.1.1</h2>
<ul>
<li>Fix: Preserve last <code>&lt;Static&gt;</code> line erased after a
full-clear frame (<a
href="https://redirect.github.com/vadimdemedes/ink/issues/974">#974</a>)
e51dfdd</li>
<li>Make <code>measureElement()</code> also return position coordinates
(<a
href="https://redirect.github.com/vadimdemedes/ink/issues/968">#968</a>)
c073b27</li>
</ul>
<hr />
<p><a
href="https://github.com/vadimdemedes/ink/compare/v7.1.0...v7.1.1">https://github.com/vadimdemedes/ink/compare/v7.1.0...v7.1.1</a></p>
<h2>v7.1.0</h2>
<ul>
<li>Add <a
href="https://github.com/vadimdemedes/ink#suspendterminalcallback"><code>suspendTerminal()</code></a>
to hand the terminal to a child process (<a
href="https://redirect.github.com/vadimdemedes/ink/issues/972">#972</a>)
9e8ed1f</li>
</ul>
<hr />
<p><a
href="https://github.com/vadimdemedes/ink/compare/v7.0.6...v7.1.0">https://github.com/vadimdemedes/ink/compare/v7.0.6...v7.1.0</a></p>
<h2>v7.0.6</h2>
<ul>
<li>Fix stale frames on Windows when output exactly fills the terminal
(<a
href="https://redirect.github.com/vadimdemedes/ink/issues/971">#971</a>)
2c08d55</li>
</ul>
<hr />
<p><a
href="https://github.com/vadimdemedes/ink/compare/v7.0.5...v7.0.6">https://github.com/vadimdemedes/ink/compare/v7.0.5...v7.0.6</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="70af033dbd"><code>70af033</code></a>
7.1.1</li>
<li><a
href="e51dfdd314"><code>e51dfdd</code></a>
Fix: Preserve last <code>\&lt;Static&gt;</code> line erased after a
full-clear frame (<a
href="https://redirect.github.com/vadimdemedes/ink/issues/974">#974</a>)</li>
<li><a
href="665eb44038"><code>665eb44</code></a>
Fix docs</li>
<li><a
href="c073b27fe3"><code>c073b27</code></a>
Make <code>measureElement()</code> also return position coordinates (<a
href="https://redirect.github.com/vadimdemedes/ink/issues/968">#968</a>)</li>
<li><a
href="25766aec61"><code>25766ae</code></a>
7.1.0</li>
<li><a
href="9e8ed1f005"><code>9e8ed1f</code></a>
Add <code>suspendTerminal()</code> to hand the terminal to a child
process (<a
href="https://redirect.github.com/vadimdemedes/ink/issues/972">#972</a>)</li>
<li><a
href="c41a7a0970"><code>c41a7a0</code></a>
7.0.6</li>
<li><a
href="2c08d55b90"><code>2c08d55</code></a>
Fix stale frames on Windows when output exactly fills the terminal (<a
href="https://redirect.github.com/vadimdemedes/ink/issues/971">#971</a>)</li>
<li>See full diff in <a
href="https://github.com/vadimdemedes/ink/compare/v7.0.5...v7.1.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ink&package-manager=npm_and_yarn&previous-version=7.0.5&new-version=7.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: gsxdsm <gsxdsm@users.noreply.github.com>
 2026-08-02 22:52:55 -07:00
gsxdsm
a3bb584bff chore(release): v0.74.0 
Version bump via changesets.
 2026-08-02 20:31:14 -07:00
gsxdsm
bc34b724ac chore(release): v0.74.0-beta.9 
Version bump via changesets.
 2026-08-02 20:00:46 -07:00
gsxdsm
0ae6c396d0 chore(release): v0.74.0-beta.8 
Version bump via changesets.
 2026-08-02 18:32:41 -07:00
gsxdsm
546a19aef6 chore(release): v0.74.0-beta.7 
Version bump via changesets.
 2026-08-01 20:22:07 -07:00
gsxdsm
006cc40454 FN-8685: add durable cross-process task deletion consumers 
Deliver durable, replay-safe cross-process task deletion observation.

- Add PostgreSQL lifecycle consumer cursors, leases, acknowledgements, retention, and recovery.
- Start named consumers in dashboard, serve, and engine runtime paths.
- Preserve delete integration metadata while suppressing replayed GitHub and GitLab side effects.
- Cover outbox identity, observed delivery, fencing, and reconciliation behavior.

Files changed:
 ...fn-8685-cross-process-task-deleted-observers.md |   7 +
 .../fn-8685-task-deleted-outbox-consumers.md       |   7 +
 docs/architecture.md                               |   8 +-
 ...tgres-cross-process-task-deleted-observation.md |   8 +-
 docs/storage.md                                    |  10 +-
 packages/cli/src/commands/dashboard.ts             |   9 +-
 packages/cli/src/commands/serve.ts                 |   9 +-
 packages/cli/src/project-context.ts                |   9 +-
 .../task-deleted-outbox-consumer.pg.test.ts        | 157 ++++++++
 ...-deleted-observed-dispatch-side-effects.test.ts |  36 ++
 .../task-lifecycle-consumer-identity.test.ts       |  22 ++
 packages/core/src/index.ts                         |  11 +
 .../0041_fn_8685_task_lifecycle_consumers.sql      |  88 +++++
 packages/core/src/postgres/schema-applier.ts       |  16 +-
 packages/core/src/postgres/schema/project.ts       |  45 +++
 packages/core/src/postgres/startup-factory.ts      |   4 +
 packages/core/src/store.ts                         |  54 ++-
 .../__tests__/lifecycle-outbox-writer.test.ts      |   4 +-
 .../core/src/task-store/archive-lifecycle-2.ts     |   1 +
 packages/core/src/task-store/lifecycle-ops.ts      |  13 +-
 packages/core/src/task-store/lifecycle-outbox.ts   |   2 +
 packages/core/src/task-store/project-store-ops.ts  |   4 +-
 .../src/task-store/task-deleted-outbox-consumer.ts | 333 +++++++++++++++++
 .../task-store/task-lifecycle-consumer-identity.ts |  32 ++
 .../task-store/task-lifecycle-consumer-registry.ts | 396 +++++++++++++++++++++
 .../task-store/task-lifecycle-event-retention.ts   | 104 ++++++
 packages/core/src/task-store/task-mutation-ops.ts  |   1 +
 packages/dashboard/src/github-tracking-state.ts    |  12 +-
 packages/dashboard/src/gitlab-delete-close.ts      |   3 +
 packages/dashboard/src/gitlab-split-close.ts       |   7 +-
 packages/dashboard/src/project-store-resolver.ts   |   9 +-
 packages/engine/src/project-manager.ts             |   4 +-
 packages/engine/src/project-runtime.ts             |   2 +-
 packages/engine/src/runtimes/in-process-runtime.ts |  17 +-
 packages/engine/src/self-healing.ts                |  27 ++
 35 files changed, 1439 insertions(+), 32 deletions(-)

Fusion-Task-Id: FN-8685
Fusion-Task-Lineage: 63eca9ac-d2af-44b0-ba79-388a950148d3
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
 2026-08-01 06:09:04 -07:00
gsxdsm
1e83dcceec chore(release): v0.74.0-beta.6 
Version bump via changesets.
 2026-08-01 00:55:04 -07:00
gsxdsm
56e16d9dea test(cli): pin the board glyph's terminal-lane resolve (extract seam + pin) (#3238) 
## What

Pins the CLI board glyph's terminal-lane resolve — **the last flagged
site in the repo-wide resolver audit.**

Two commits: a behaviour-preserving extraction, then the test.

## I was wrong to flag this as unpinnable

In #3236 I recorded this site as not pinnable, reasoning that
*"extracting a pure helper and testing it would look like coverage and
would not be."*

That is true of a helper that **receives** the lane set — such a test
passes with the resolve blinded, which is exactly the `reads.ts` trap
the audit note records. It is **not** true of one that **resolves** it.
Building `resolveReliabilityLanes` in #3237 made the distinction
obvious: the seam has to contain the resolve, and then blinding fails a
test of it.

So the flag was too broad, and correcting it closes the site rather than
leaving a permanent excuse. That is the same failure mode I corrected in
someone else's note earlier today — a caution that hardens into a reason
not to look.

## Measured

```
converted: Tests 5 passed (5)
blinded:   Tests 2 failed | 3 passed (5)
```

The two failures are the **renamed complete** and **renamed archive**
lanes. The three survivors are the default-vocabulary control, the
active-lane negative, and the degrade path — all of which should
survive.

```
task-list-board-columns + bin: 82 passed
typecheck clean; lint clean; fnxc-future-dates: none added
```

## Why the sibling file did not cover it

`task-list-board-columns.test.ts` pins `boardColumnsForDisplay`, which
decides **which** lanes print. That function takes no lane set, so it
cannot fail when this resolve is blinded — and its own header says so
honestly. Two tests about the same command, one of which cannot see the
other's bug.

## What breaks without the conversion

On a board whose complete lane is `shipped`, a finished lane renders `●`
— the same glyph as active work. The board says work is in flight when
it shipped. Cosmetic next to the blank-board bug this area already
fixed, but wrong in the direction an operator reads at a glance.

## Also pinned

Two contracts the surrounding comments assert but nothing tested:

- **Cards come from the TASKS, not a resolved IR** — a card must never
depend on resolution succeeding to be *visible*. Asserted with an
unreadable workflow list.
- **A failed resolve degrades to the legacy pair**, with an unresolved
custom lane rendering as active — the documented fail-open direction.

Plus the paired negative: an ACTIVE lane keeps the active glyph under
both vocabularies, so widening the terminal set cannot mark the whole
board finished.

## Audit complete

Every `resolveProjectColumnsForRoles` call site in the repository —
`engine`, `core`, `dashboard`, `cli` — has now been blinded
individually, and every uncovered one is either pinned or has a recorded
reason it cannot be. Nothing is left flagged.
 2026-07-31 13:34:03 -07:00
gsxdsm
6646c1b95d docs: regenerate synced skill tool tables (unblocks all four full-suite shards) 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 2026-07-31 12:27:11 -07:00
gsxdsm
d6079970e8 fix(self-healing): 18 recovery rebounds hardcoded todo and THREW on a renamed board (#3150, first slice) (#3152) 
First slice of #3150. `self-healing.ts` held **26** `moveTask` calls
with a legacy literal target; this converts the **18 `todo` rebounds**.

## Why this is worse than a guard, and documented already

`task-store/moves.ts` records it from a previous incident:

> `moveTaskInternal` **REJECTS** a target the workflow does not declare
(`TransitionRejectionError: unknown-column`) … completion handoff did
not silently no-op — it **THREW**.

Every one of these 18 is a **recovery**. On a renamed board they threw
instead of rebounding, so the strand each sweep exists to clear survived
*and* the sweep reported failure. The reliability layer meant to be the
backstop was the layer that broke.

## Why the census never saw it

It counts **comparisons** against legacy ids. A move target is an
**argument**. That is the third blind spot of the same instrument, and
all three have now produced real defects found by hand:

| blind spot | found this session |
|---|---|
| definitions | `GITHUB_TRACKING_EDITABLE_COLUMNS` — tracking
unreachable on renamed boards (#3149) |
| collections | swept: 30 sites, 29 already correct, 1 defect (the
above) |
| **targets** | **this** — 26 in one file, 31 tree-wide |

## Why 18 sites at once is safe

`resolveReboundTargetForTask` **degrades to `"todo"`** when no workflow
resolves, and `self-healing.ts` already used it at line 745. On every
board we ship, the resolved answer *is* `todo` — so default behaviour is
unchanged **by construction**, not by inspection. The control case pins
exactly that, and it is the reason this can land as one change rather
than eighteen.

## Scope, and what I deliberately did not touch

Converted: the 18 `todo` rebounds.

**Not** converted: the `done`, `archived` and `in-review` targets. They
need different helpers and genuine reasoning about which lane a
completion or an archive belongs in — converting them by analogy is
exactly the half-conversion this program keeps paying for. Sites with no
resolver in scope are unchanged.

The audit behind the split is in the commit: of 26 sites, 5 had resolved
lanes in scope, 4 had an IR, 17 had nothing — and `lanesOfReclaim`
returns **Sets**, which is the wrong arity for a target (a move takes
exactly one column, per the `moves.ts` note).

## Verification

| | result |
|---|---|
| engine `tsc` | **0 errors** |
| **all 43 self-healing suites** | **843 passed** |
| census `--strict` | exit 0, **unchanged** — invisible to it |
| `check-inert-sync-lanes` | exit 0 |
| differential | restoring the literal → **1 failed \| 1 passed**,
renamed case only |

The new test drives a **public entry point**
(`reconcileInReviewUnmetDependencies`, the FN-6793 contract) rather than
calling the helper directly, so it covers the producer path too.

One harness note worth keeping: the first version of the test failed
**upstream** of the target, because the sweep selects rows via
`resolveProjectColumnsForRoles` — a *project-level* resolver reading
`listWorkflowDefinitions`, not the task's own selection. Without that
mocked, the renamed card was never considered and the failure looked
like the fix not working. That distinction (project-level vocabulary vs
per-task IR) will bite the next slices too.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Tasks now move to workflow-specific rebound, completion, and archive
columns instead of fixed default destinations.
* Retrying and recovering tasks works correctly on boards with renamed
lifecycle columns.
* Added safe fallback behavior for workflows without custom lifecycle
settings.
* **Tests**
* Added coverage to prevent legacy hardcoded task destinations and
verify renamed-column recovery scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-07-31 10:24:22 -07:00
gsxdsm
7d9d097acf fix(cli): the TUI board fell back to the LEGACY workflow — it rendered a triage lane the default no longer has (#3178) 
Found by following an unexplained number rather than by a sweep: while
re-verifying #3141 the resolver reported `intake: "todo"` where
`BUILTIN_CODING_WORKFLOW_IR` resolves `intake: "triage"`. That
divergence is correct and intentional inside core — and wrong here.

## The defect

`dashboard.ts` resolved a task's columns as `def?.ir ??
BUILTIN_CODING_WORKFLOW_IR`, and its card-chip fields the same way. That
constant is the **legacy** monolithic IR (`builtin:legacy-coding`); the
catalog's actual default is `resolveDefaultWorkflowIr()`. Post-U11 they
differ **by a whole column**:

```
default  todo, in-progress, in-review, done, archived          (planning merged into todo)
legacy   triage, todo, in-progress, in-review, done, archived
```

So a task with **no workflow selection row** was rendered against a
six-column board including `triage` — a lane the real default no longer
declares.

## The same drift is already documented as fixed elsewhere

`builtin-workflows.ts` records it:

> `prepareWorkflowMovePolicyPreflightImpl` resolved the default through
the catalog while `resolveTaskWorkflowIrForMove` used the raw constant,
so a task with NO selection row produced two different workflow
signatures and every flag-ON move threw *"workflow move policy preflight
is stale"*. Both sides (and the sync resolver) now call this helper so
the default cannot drift again.

This surface was missed, and it is the **last non-test consumer of the
legacy constant outside core**.

## Test scope, stated because it is narrow

Driving the TUI end-to-end needs a rendered terminal and a live store.
That harness does not exist here, and building one to assert a fallback
would be testing the harness. So the test pins the two facts that make
the bug possible and the fix meaningful:

1. **the two IRs genuinely disagree, about `triage` specifically** — if
a future change re-merges them, this reports it rather than leaving the
fix silently pointless;
2. **the source no longer reaches for the legacy constant.**

(2) is a source assertion, weaker than driving the code. It is used for
the same reason as the `FloatingWindow` aria-label scan: the defect is a
**value at a call site**, there is no single render that reaches both
sites, and a per-site render test would pin the one someone bothered to
write. Both assertions are anti-vacuity guarded — the IR comparison
fails if either side stops resolving to a v2 column set.

## Verification

| | result |
|---|---|
| cli `tsc` | **0 errors** |
| new test | **2 passed** |
| mutation — restore `?? BUILTIN_CODING_WORKFLOW_IR` | **1 failed / 2**
|
| census `--strict`, `check-fnxc-future-dates` | exit 0 (this class is
invisible to the census — an argument, not a comparison) |

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-07-31 08:13:57 -07:00
gsxdsm
25b3c06d2d fix(plugins): compound-engineering pipelines stalled forever on a renamed board (#3022) 
Closes #3020 — which I filed **instead of** fixing, on a rationale that
turned out to be wrong.

I said the plugin had no scaffolding for faking `CePipelineStore` +
`taskStore` together. It does: `_harness.ts` already builds a real
`PluginContext` over a live PostgreSQL layer. The gap was **two missing
readers on its task-store stub**, not missing infrastructure. I checked
the harness only after filing.

## The defect

`TERMINAL_COLUMNS` is `{in-review, done}`, and the reconciler advances a
pipeline only when **every** current-stage board task is in that set. On
a board whose review and completion lanes are renamed that's false for
every task, permanently:

- the pipeline never advances a stage
- it never creates its outbound task
- it sits `running` indefinitely

Nothing errors, so it reads as work that hasn't finished. Unlike the
display defects in this family (#3014, #3017), the CE flow actually
**stops**.

## Shape

The decision is extracted to an exported `isStageTerminalColumn` because
it *is* the whole decision. Left private it could only be reached
through a pipeline-state + links + board-tasks fixture, and the half
that needed proving is that a renamed board resolves to its own lanes
through this store.

It uses `resolveReviewColumns` rather than re-deriving the union — that
helper is the documented review **set** (`mergeOrchestration ∪
mergeBlocker ∪ humanReview`), so a board splitting those across a merge
lane and a human lane is covered without this site drifting from it.

## Two things my first attempt got wrong

**The fixture spelled traits in camelCase** — `{ trait: "humanReview"
}`. Trait **ids** are kebab-case (`human-review`, `merge-blocker`,
`wip`); the camelCase names are the resolved **flags**. Those columns
therefore resolved to *no roles at all*, silently, because an unknown
trait isn't an error. `complete` is spelled identically in both
vocabularies, which is exactly what made the first run look like
*"complete works, review is broken"* rather than *"the fixture is
wrong"* — I nearly went debugging the production union.

**The harness extension is additive** and inert until a test seeds it,
so all 24 existing plugin suites see the previous shape.

## Measured

| check | result |
|---|---|
| new suite | **4/4** |
| reverting to the literal-only gate | fails **exactly 2** — the
renamed-terminal case, and a board declaring a NON-terminal column named
`done` — while the legacy control and the WIP/intake negative still pass
|
| plugin suite | **24 files, 184 tests green** |
| `tsc` + all five gates | clean |

That second row is the one that matters: the `done`-without-`complete`
board is the only shape where a real resolution and a legacy fallback
disagree, so it's what separates the fix from a lucky agreement.

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-07-31 01:20:04 -07:00
gsxdsm
f8155cafd7 fix(cli): the node-override guard saw only the FIRST wip lane (#3023) 
Follow-up to #3019, which merged with an incomplete fix. I found this
while sitting down to write the test that PR was missing.

## The guard still never fired, one lane over

#3019 wired `fn_task_update`'s guard like this:

```ts
const nodeOverrideLifecycle = await resolveTaskLifecycleColumns(store, task.id);
wipColumns: nodeOverrideLifecycle?.wip ? new Set([nodeOverrideLifecycle.wip]) : undefined,
```

`resolveTaskLifecycleColumns` → `resolveLifecycleColumns`, whose
per-role accessor is **first match**
(`workflow-lifecycle-traits.ts:353`):

```ts
const first = (flag) => resolved.find((c) => c.flags[flag] === true)?.id;
```

The guard's contract is **every** column carrying the trait — its own
resolver uses `columnsWithFlag(ir, "countsTowardWip")`. So on a board
with a build lane beside a verify lane, a task sitting in the **second**
wip lane still slipped the mid-flight check, and an operator could still
repoint the node of a running task. That is the defect #3019 set out to
close.

Interchangeable on any single-wip-lane board, which is exactly why it
read as correct — the same arity trap #2975 removed from the surfacing
family.

## The fix

Use `resolveNodeOverrideLanes`, the guard's own resolver, which
`task-update.ts` and `branch-and-pr-entities.ts` already call. All three
callers now resolve identically and the V1/unresolvable fallback lives
in one place. Needed a one-line re-export from `@fusion/core`.

**Mutation:** forcing the resolver to first-match (`.slice(0, 1)`) fails
the new case, 1 of 32.

The new test names **two** wip lanes, because that is the only shape
that separates the two resolutions — a single-wip-lane test passes
against both, which is why #3019's gap was invisible and why I would
have written a useless test if I had not read the implementation first.

## A gate constraint worth recording

My first version passed the resolved object straight through:

```ts
validateNodeOverrideChange(task, normalizedNodeId ?? null, overrideLanes)
```

Identical at runtime, and it turned the lane-wiring gate **red**:
`check-lane-wiring` matches an object-literal argument and cannot see
through a variable, so the correct call reads as UNWIRED. #3019's header
records hitting the same constraint — and it is what pushed that PR
toward resolving the lanes inline, which is where the first-match bug
entered.

So the gate's shape requirement steered a correct instinct into a subtly
wrong implementation. The fix here spells both keys explicitly,
satisfying the gate without the bespoke resolution. Worth someone
deciding whether the census should follow a variable to its initializer
— but that is a change to a shared ratchet, and I have noted it at the
call site rather than making it.

**Verified:** 32/32 core guard suite, `tsc` 0 errors for both packages,
lane-wiring gate exit 0, FNXC gate exit 0, lint clean.

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-07-31 01:08:54 -07:00
gsxdsm
5659ccace9 test(cli): pin the node-override error contract on a renamed board, which is what #3019 actually changed (#3024) 
## What #3019 actually changed, pinned — and a correction to my own
claim

I described #3019 as closing a hole where an operator could re-route a
running task on a renamed board. **That was wrong.**
`TaskStore.updateTask` runs the same guard with its own resolved lanes
(`resolveNodeOverrideLanes`) and throws, so the change was refused
either way.

This test is how I found out: I wrote it to cover #3019's wiring and it
passed against a tree with that wiring removed. A test that passes with
the change reverted is not a test, so I went looking for what was really
refusing — and it was the store.

## But the two paths *are* distinguishable, which my correction then got
wrong in the other direction

In correcting myself on #3019 I said the paths were externally
indistinguishable and no test could separate them. Also wrong. Measured
both ways:

| | `details.error` |
| --- | --- |
| pre-check fires (wired) | `"task-in-progress"` — machine-readable
reason code |
| pre-check misses (unwired) | `"Cannot change node override for KB-001
while it is in progress…"` — the store's thrown prose |

So on a **legacy** board a caller could branch on `task-in-progress`; on
a **renamed** board it silently got a sentence instead. That is a real
API inconsistency, visible only to whoever was parsing it — the kind of
thing nobody notices until it breaks.

That is what these cases pin, and it is the honest description of
#3019's value: an error-contract fix, not a security fix.

## Revert proof

With #3019's wiring removed:

```
Expected: "task-in-progress"
Received: "Cannot change node override for KB-001 while it is in progress. …"
      Tests  1 failed | 1 passed (2)
```

Verified by actually reverting, not by reading the source — which is the
discipline that caught both of my wrong claims above.

The paired case ("still allows the override once the card leaves that
wip lane") passes both ways by design; it guards against over-refusal,
so I am not counting it as coverage of the contract.

## Also closes the gap I named in #3019

That PR shipped with `check-lane-wiring` as its only regression proof,
and I said a behavioural test was owed. The two are complementary and
fail for different reasons: **the ratchet** fails if the argument stops
being passed; **this** fails if it is passed and the contract still
degrades.

## Verification (measured)

- **2 passed / 0 failed**
- `tsc --noEmit` clean; `eslint` clean (one pre-existing warning, no
errors)
- `check-fnxc-future-dates`, `lifecycle-column-census --strict`,
`check-lane-wiring` — green

Tests only; no product file touched. No changeset.

## Note on the harness, for whoever writes the next one of these

Seeding a card into a renamed lane has two traps, both inherited from
`merge-blocker-renamed-review-lane.test.ts` and both recorded in this
file's header: the real API is `createWorkflowDefinition` +
`selectTaskWorkflow` (the plausible `saveWorkflowDefinition?.()` does
not exist and the optional call swallows it silently), and moving a card
takes `moveTask`, not `updateTask({ column })`. Both are guarded here by
asserting the card really is in `building` before the subject runs.
 2026-07-31 01:06:09 -07:00
gsxdsm
6f936f2de7 fix(cli): the node-override guard never fired on a renamed board, so mid-flight changes were allowed (#3019) 
## The node-override guard never fired on a renamed board

`fn_task_update` called the guard with no options:

```ts
const validation = validateNodeOverrideChange(task, normalizedNodeId ?? null);
```

so `wipColumns` fell back to its documented default of
`{"in-progress"}`. On a board whose WIP lane is named anything else,
`wipColumns.has(task.column)` is false, the mid-flight check passes, and
**an operator can change the node override on a running task** —
precisely what that guard exists to refuse, in its own words:

> "Is this task executing right now?" — keyed on the literal, a renamed
board let an operator change the node override MID-FLIGHT on a running
task, which is exactly what this guard exists to refuse.

That note is attached to the `wipColumns` option added for this purpose.
The CLI simply never passed it.

## Two assumptions in the guard's own docs that did not hold

```
Both callers supply them. An omitted set keeps the legacy id, which is what a caller
without cheap IR access (a CLI tool, a route with only a task row) still gets.
```

1. **"Both callers"** — this is a *third* one, and it was in
`check-lane-wiring`'s known-unwired baseline the whole time.
2. **"a CLI tool … without cheap IR access"** — this handler is async
and has already awaited `store.getTask`, so one more resolve costs
exactly what `resolveTaskLifecycleColumns` already costs elsewhere **in
this same file** (the linked-lineage label at ~1239). The assumption was
reasonable in general and wrong here.

Passed present-but-conditionally-valued rather than as a conditional
argument: an omitted set still keeps the documented legacy default, and
only that shape is visible to `lane-wiring-census`, which matches an
object-literal argument and cannot see a ternary.

## Coverage — stated rather than implied

**There is no new unit test.** The regression guard is the ratchet
itself, and it is a real revert-proof: with the wiring removed,

```
[check-lane-wiring] call sites not passing a resolved lane argument INCREASED:
  packages/cli/src/extension.ts: 1 unwired now, baseline allows 0
```

Verified by actually reverting it, not by assuming. Baseline re-recorded
19 → 18 in the same commit, so the allowance cannot be regrown into.

A behavioural test would need a custom workflow definition persisted
*and* selected inside the integration harness to get a card resting in a
renamed WIP lane. That is worth doing and I would take it as follow-up
harness work — but it is not part of this fix, and I would rather name
the gap than let "85 passed" imply coverage I did not write.

## Verification (measured)

- **85 passed** across `extension.test.ts`,
`extension-experiment-finalize.test.ts`,
`task-list-board-columns.test.ts`
- `tsc --noEmit`, `eslint` — clean
- `check-lane-wiring` (18, none added), `lifecycle-column-census
--strict`, `check-inert-flag-seams`, `check-fnxc-future-dates`,
`check:changesets` — green

Changeset included (`patch`): `packages/cli` is the published
`@runfusion/fusion` and this changes guard behaviour operators rely on.
 2026-07-31 00:52:50 -07:00