Two defects in my own previous commit, both visible in one screenshot of the dashboard.
IT DID NOTHING ON A WIDE TERMINAL. The escape was added inside the single-pane layout, which
is the NARROW one. A wide terminal renders the grid layout instead — System / Stats /
Utilities / Settings beside Logs — so the toggle flipped state and the screen did not change.
The whole point is that no chrome survives a rectangular selection, and chrome is drawn by
both layouts plus the header, so the escape has to happen before either is chosen. It now
replaces the entire frame, above the layout choice, and a test pins that ordering plus the
fact that only one place may render it.
IT SHADOWED AN EXISTING LEGEND. The Utilities panel already advertises `[v] Auto-Kill Vitest`
on the same screen. The two handlers are mutually exclusive at runtime — utility actions
require the Utilities section, this branch requires log focus — so nothing actually clashed,
but two different `[v]` legends visible at once is a UI anyone would misread. Raw mode is now
Shift+V; lowercase v stays with auto-kill.
pnpm lint 0 errors, CLI typecheck clean, dashboard-tui suites 138/138, test:gate green.
Reported: the logs cannot be highlighted and copied without column artifacts.
Two things cause that, and the code already named the second one: the Logs panel keeps a
border, a title and a filter row, and sits between a header and a status bar — so a
rectangular drag captures box-drawing characters and unrelated rows — while mouse reporting
is deliberately ON for that panel to drive wheel scrolling, which swallows the click-drag
before the terminal ever sees it.
`[v]` now shows the log lines alone: no border, no title, no filter row, no header, no status
bar, every line starting at column 0, and mouse reporting released so the terminal's own
selection works. One trailing hint row stays, because a full-screen view with no visible way
out is worse than one extra row. `[v]` or Esc returns, and the escape is ordered ahead of the
expanded-entry escape so the two modes cannot fight.
The rendered line shape matches the existing `[c]` single-line copy, so selecting with the
mouse and copying with the keyboard produce the same text. `[c]` remains the path for one
line; this is the path for a range, which no keyboard shortcut can express.
pnpm lint 0 errors, CLI typecheck clean, dashboard-tui suites 134/134, test:gate green.
Bumps [sharp](https://github.com/lovell/sharp) from 0.33.5 to 0.35.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/lovell/sharp/releases">sharp's
releases</a>.</em></p>
<blockquote>
<h2>v0.35.3</h2>
<ul>
<li>
<p>Tighten verification of <code>text</code> dimensions, TIFF tile
dimensions and <code>extend</code> values.</p>
</li>
<li>
<p>Improve code bundler support by resolving path to libvips binary.</p>
</li>
<li>
<p>Increase default concurrency when use of
<code>MALLOC_ARENA_MAX</code> is detected.</p>
</li>
<li>
<p>Emit warning about binaries provided by Electron for use on
Linux.</p>
</li>
<li>
<p>Add <code>hasAlpha</code> property to output <code>info</code>.
<a
href="https://redirect.github.com/lovell/sharp/issues/4500">#4500</a></p>
</li>
<li>
<p>TypeScript: Return more precise
<code>Buffer<ArrayBuffer></code> from <code>toBuffer</code>.
<a href="https://redirect.github.com/lovell/sharp/pull/4520">#4520</a>
<a href="https://github.com/Andarist"><code>@Andarist</code></a></p>
</li>
<li>
<p>Bound <code>clahe</code> width and height to avoid signed overflow.
<a href="https://redirect.github.com/lovell/sharp/pull/4551">#4551</a>
<a
href="https://github.com/metsw24-max"><code>@metsw24-max</code></a></p>
</li>
<li>
<p>Bound <code>trim</code> margin to avoid signed overflow.
<a href="https://redirect.github.com/lovell/sharp/pull/4552">#4552</a>
<a
href="https://github.com/metsw24-max"><code>@metsw24-max</code></a></p>
</li>
<li>
<p>Reject infinite values when validating numbers.
<a href="https://redirect.github.com/lovell/sharp/pull/4553">#4553</a>
<a
href="https://github.com/metsw24-max"><code>@metsw24-max</code></a></p>
</li>
<li>
<p>Bound extract region to libvips coordinate limit.
<a href="https://redirect.github.com/lovell/sharp/pull/4555">#4555</a>
<a
href="https://github.com/metsw24-max"><code>@metsw24-max</code></a></p>
</li>
<li>
<p>Verify background colour values are numbers.
<a href="https://redirect.github.com/lovell/sharp/pull/4556">#4556</a>
<a
href="https://github.com/metsw24-max"><code>@metsw24-max</code></a></p>
</li>
<li>
<p>Bound create and raw input dimensions to coordinate limit.
<a href="https://redirect.github.com/lovell/sharp/pull/4558">#4558</a>
<a
href="https://github.com/metsw24-max"><code>@metsw24-max</code></a></p>
</li>
<li>
<p>Tighten recomb and affine matrix verification.
<a href="https://redirect.github.com/lovell/sharp/pull/4560">#4560</a>
<a
href="https://github.com/chatman-media"><code>@chatman-media</code></a></p>
</li>
<li>
<p>Verify cache memory limit to avoid overflow.
<a href="https://redirect.github.com/lovell/sharp/pull/4561">#4561</a>
<a
href="https://github.com/metsw24-max"><code>@metsw24-max</code></a></p>
</li>
</ul>
<h2>v0.35.3-rc.2</h2>
<ul>
<li>Tighten verification of <code>text</code> dimensions, TIFF tile
dimensions and <code>extend</code> values.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="1018449164"><code>1018449</code></a>
Release v0.35.3</li>
<li><a
href="ba303a799d"><code>ba303a7</code></a>
Prerelease v0.35.3-rc.2</li>
<li><a
href="4f94fc5162"><code>4f94fc5</code></a>
Upgrade to sharp-libvips v1.3.2</li>
<li><a
href="c5e7a3ff20"><code>c5e7a3f</code></a>
Bump devDeps, fix Deno/Windows smoke tests</li>
<li><a
href="9a8d002688"><code>9a8d002</code></a>
Docs: Add changelog entry and note about transferable <a
href="https://redirect.github.com/lovell/sharp/issues/4520">#4520</a></li>
<li><a
href="8694db0bac"><code>8694db0</code></a>
TypeScript: Return more precise <code>Buffer\<ArrayBuffer></code>
from <code>toBuffer</code> (<a
href="https://redirect.github.com/lovell/sharp/issues/4520">#4520</a>)</li>
<li><a
href="e000d0b5e1"><code>e000d0b</code></a>
Prerelease v0.35.3-rc.1</li>
<li><a
href="9554ca9553"><code>9554ca9</code></a>
Prerelease v0.35.3-rc.0</li>
<li><a
href="6a29fd55db"><code>6a29fd5</code></a>
Emit warning about native binaries on Linux Electron</li>
<li><a
href="540d2eada4"><code>540d2ea</code></a>
Increase default concurrency when use of MALLOC_ARENA_MAX detected</li>
<li>Additional commits viewable in <a
href="https://github.com/lovell/sharp/compare/v0.33.5...v0.35.3">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new
releaser for sharp since your current version.</p>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: gsxdsm <gsxdsm@users.noreply.github.com>
## What
After an operator **finishes** onboarding, Fusion asks once whether they
want to star the repo. If they dismiss it, nothing asks again — on any
surface.
## Why
Nothing asked at the right moment. The dashboard already had a
`GitHubStarPrompt` banner, but it only fired when a task first reached
*done*, so someone who completed setup and stopped there was never
asked. The CLI (`fn onboard`) had no ask at all.
## How
**CLI — `fn onboard`**
- The ask runs *after* the completion marker is stamped, so declining
(or Ctrl-C on the question) can never cost the operator the setup work
they just did.
- It prints `https://github.com/Runfusion/Fusion`; it never opens a
browser on their behalf.
- The non-interactive auto-launch path asks nothing — that flow fires
while someone is starting a dev server, and a prompt there is exactly
the ambush
[b67e3aa](b67e3aa8bc)
removed.
**Dashboard**
- `ModelOnboardingModal.onComplete` now reports an outcome, and
`useProjectActions` fires the star prompt only for a *finished*
onboarding. Dismissing the flow does not ask: closing it is the operator
saying to leave them alone.
**One ask per operator, not per surface**
- New global setting `githubStarPromptDismissedAt`. localStorage stays
the fast local record (suppresses the prompt without waiting on a
request); the setting is the durable, cross-surface one. Both surfaces
read and write it, so answering in either retires the ask in both, and a
CLI dismissal is honoured by a dashboard opened later. The settings
write is best-effort — losing it costs at most one repeat ask on another
browser, never a broken dismissal locally.
## Verification
- `pnpm test:gate` — green, 716 tests / 29 files
- CLI `onboard` + `onboard-autolaunch` — 37 passed (new cases: asks and
stamps on accept; never asks again after dismissal, including `--force`;
silent on the non-interactive path)
- Dashboard `useGitHubStarPrompt`, `useProjectActions`,
`DashboardBanners`, `AppModals` — 72 passed (new cases: dismissal
recorded globally; a dismissal from another surface adopted; no re-read
once the local record is set; local dismissal survives a failed settings
write; finished-vs-dismissed routing)
- Typechecks clean for `@fusion/core`, dashboard `tsconfig.app.json`,
`@runfusion/fusion`
- `pnpm lint` — 0 errors (2 pre-existing warnings)
Changeset included (`@runfusion/fusion`: minor).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a one-time GitHub star prompt after onboarding.
* Supports accepting, dismissing, or cancelling the prompt, with
responses remembered across sessions and interfaces.
* Skips the prompt during non-interactive onboarding or after a previous
response.
* Dashboard onboarding now distinguishes completed and dismissed
outcomes.
* **Bug Fixes**
* Improved prompt synchronization and loading behavior to prevent
duplicate displays.
* Preserved successful onboarding when settings cannot be saved or
retrieved.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Tests must assert behavior, not source text. A test that pins an FNXC block, a
date stamp, or comment prose guards documentation — and AGENTS.md tells authors
to keep those comments current, so the two rules fight and the test loses in the
worst way.
Measured today: grok-runtime-bootstrap.test.ts asserted runTaskMerge's body
contained "FNXC:GrokCliRouting 2026-07-15-10:17". FN-9167 legitimately rewrote
that function and dropped the block while leaving behavior intact; the test went
red, and the fix applied earlier in this sweep was to RE-ADD THE COMMENT to
packages/cli/src/commands/task.ts. A comment returned to shipped source not
because it documented anything true, but to appease a test. Four more such
assertions sat in dashboard CSS tests, each beside a real assertion, each adding
nothing.
- Drops the two prose pins from grok-runtime-bootstrap; its real structural
guard (`not.toContain("mergePluginRunner")`) stays. The product comment stays
too — it is accurate documentation, it was simply never a test's business.
- Adds scripts/check-no-comment-assertions-in-tests.mjs, wired into pretest,
pretest:full, and test:gate:static. It flags the unambiguous case; an earlier
draft that also matched `/*` produced 24 false positives and zero true ones,
because a regex cannot separate comment prose from a path glob.
- Adds the standing rule to AGENTS.md, with an explicit boundary: prose,
comments, and date stamps are never a test subject, while code-construct and
call-site-allowlist guards (no-blocking-shellout, vi-mock resolution, durable
write and emit-surface inventories, legacy tombstones) are a different
category and stay.
Also carries a product fix that the agent-generation tests surfaced: the
system prompt exists in two copies, and `resolvePrompt` returns core's catalog
default, so FN-021 adding the xhigh/max thinking levels to the dashboard copy
alone left every real generation run advertising levels that stop at "high".
Core's copy is synced and both literals now say they must move together.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Core 32 failures -> 0 (5,981 passing); CLI 46 -> 0 (2,021 passing). Three
agents per package, root-cause fixes only.
One product defect, same class as FN-9059 and found the same way — by a test
that leaked state between runs:
`projectTableNames` was missing SEVENTEEN tables the schema declares
(current_plan_evidence, spec_locks, spec_drift_reports, symbol_locks,
configuration_revisions, chat_tags, chat_session_tags, mission_lineage_stops,
task_verification_requests, unplanned_execution_blocks,
workflow_agent_capacity_leases and the six task_lifecycle_* tables). That list
drives BOTH the PG test-harness per-test reset and production health
compaction, so those tables were never truncated between tests (a plan-evidence
version counter carried forward, making whole-file runs disagree with isolated
ones) and never VACUUM/ANALYZEd in production. Registered, with
project-table-registry.test.ts as a ratchet — verified it fails on an
unregistered new table naming the offender.
Everything else was drift behind deliberate changes: branch-write provenance,
FN-073 dependency validation, the FN-9191 pre-merge merge gate, U11's triage/
planning lane merge, refinement workflow coming from the ORIGIN selection,
async-converted provider registration, a barrel mock missing exports a guard
added, and several source-pinned inventories broken by module moves. Tests for
removed features were deleted with their removing commit cited.
Also fixes a vitest config gap where @fusion/core/mcp-builtin-servers resolved
only to dist/, which was breaking test COLLECTION in unrelated CLI files and had
been misread as transient cross-agent noise.
Quarantines mission-store.pg's concurrent-claim race (second sighting): it holds
a transaction open, sleeps 250ms and asserts the rival has not settled, which
fails under parallel load. An A/B against the registry change above looked
causal on one run and did not reproduce on three — that coincidence is the flake
itself, and rescue needs a real lock-wait probe rather than a longer sleep.
Core's config now inlines its exclude array, because check-quarantine-ledger.mjs
cannot resolve a variable reference and silently reported the ledger unpaired.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
## Summary
Adds [OrcaRouter](https://www.orcarouter.ai) as a first-class named
model provider, mirroring the existing OpenRouter integration.
OrcaRouter is an OpenAI-compatible gateway —
`https://api.orcarouter.ai/v1` — that routes to models from many
providers (Anthropic, OpenAI, DeepSeek, Google, Grok, Qwen, Zhipu, and
more) through a single API key. It also runs gateway-level, zero-trust
security for AI agents on the same endpoint — screening every
prompt/response and governing every tool call on a default-deny basis,
with no application code changes.
What this PR does:
- **Catalog sync**: `syncStartupModels` now fetches the OrcaRouter
`/v1/models` catalog at startup (gated by a new `orcarouterModelSync`
global setting, default enabled) and registers an `openai-completions`
provider at `https://api.orcarouter.ai/v1`. The key resolves from the
`ORCAROUTER_API_KEY` environment variable.
- **Auth + onboarding**: OrcaRouter appears in the API-key auth catalog,
onboarding setup copy + key hints, and quick-start provider list (key
format `sk-orca-...`, dashboard link to `https://www.orcarouter.ai`).
- **Icons**: New OrcaRouter brand mark (`OrcaRouterIcon`) with a
dedicated color token, wired into `ProviderIcon` and
`inferProviderIconKey` so `orcarouter/...` model ids render the brand
mark everywhere.
- **Settings**: Startup-sync toggle under **Settings → Global Models**,
settings search entry, and save-split allowlists.
- **Docs + i18n**: `docs/settings-reference.md` / `docs/storage.md` rows
and `en` + secondary-locale catalog keys.
- **Changeset**: `.changeset/add-orcarouter-provider.md` (minor).
Disclosure: I'm an engineer on the OrcaRouter team.
## Test plan
- `pnpm --filter @runfusion/fusion exec vitest run
src/commands/__tests__/startup-model-sync.test.ts` — 18 passed
- `pnpm --filter @fusion/core exec vitest run
src/__tests__/settings-parity.test.ts` — 80 passed
- `pnpm --filter @fusion/dashboard exec vitest run
app/components/__tests__/ProviderIcon.test.tsx` — 115 passed
- `pnpm --filter @fusion/dashboard exec vitest run
app/components/__tests__/AuthenticationSection.test.tsx
app/components/__tests__/ModelOnboardingModal.test.tsx` — 222 passed
- `tsc --noEmit` in `@fusion/cli`, `@fusion/core`, `@fusion/dashboard`,
`@fusion/engine` — all clean
- `pnpm lint` on changed files — clean
- `pnpm check:changesets` — clean
- **L3 live test**: exercised the production `syncStartupModels` path
against the live OrcaRouter API — catalog sync registered 209 models and
a real chat completion returned **HTTP 200** (`finish_reason: "stop"`).
Note: `pnpm i18n:status` reports pre-existing Jira key-parity gaps in
the `app.json` catalogs on a clean checkout (unrelated to this change);
the `common.json` catalogs touched here are in parity.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Added OrcaRouter as a built-in OpenAI-compatible provider.
- Added API-key setup, validation, authentication, onboarding guidance,
provider branding, and model catalog visibility.
- Added automatic startup synchronization of OrcaRouter models, enabled
by default.
- Added a global setting to enable or disable model synchronization.
- **Documentation**
- Documented the new synchronization setting and its configuration.
- **Localization**
- Added OrcaRouter setup and usage text across supported languages.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Signed-off-by: XiaoHuo888-hue <jinhao.song@myflashcloud.com>
Co-authored-by: XiaoHuo888-hue <jinhao.song@myflashcloud.com>
Co-authored-by: Claude <noreply@anthropic.com>
Expand post-landing QA coverage for dashboard concurrency settings callbacks.
- Exercise unset, configured, and worktree-bound settings across all TUI callback paths.
- Verify pause callbacks use project defaults while the task store is still initializing.
- Extend the dashboard harness with live settings events and a startup barrier.
Files changed:
.../dashboard-concurrency-settings.test.ts | 104 ++++++++++++++++++---
1 file changed, 92 insertions(+), 12 deletions(-)
Fusion-Task-Id: FN-9189
Fusion-Task-Lineage: c373954a-7316-47d2-9821-75e0d34b22d4
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Working on Fusion from inside a machine that already runs one, a plain
`pnpm dev` shares that instance's LIVE database. Everything durable hangs off
$HOME/.fusion — settings, credentials, central DB, the embedded Postgres data
dir — and a process pointed at a data dir whose postmaster is already running
attaches to it instead of starting its own.
--isolated spawns the dev child with HOME pointed at a sandbox, so it gets its
own settings, credentials and Postgres cluster on its own port. It also moves
the child's cwd, which is the half that is easy to miss: `fn dashboard`
derives its project from the working directory and has no project flag, so
isolating HOME alone leaves both instances on `<repo>/.fusion` — including
`.fusion/tasks/<id>/`, which the orphaned-task-dir sweep re-imports, so a
fresh dev database would adopt the real instance's tasks.
The sandbox defaults to ~/.fusion-dev/<checkout-name>/{home,project}: outside
the work tree so it neither shows up in git status nor dies on a clean
checkout, and keyed by checkout so two clones cannot collide. The project dir
is git init-ed on first use because Fusion projects are git work trees.
Changing cwd is safe because PRELOAD/LOADER/ENTRY are already absolute.
Verified in a container beside a running Fusion: the isolated instance
reported zero projects while the real one reported two, on separate Postgres
clusters (ports 42617 and 38311).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
## What this PR does
Closes three lifecycle gaps in the Mission → Milestone → Slice →
**Feature** model, where a feature links to exactly one delivery task
(single-valued `feature.taskId`, one-feature-one-task):
1. **Reverse-lineage done-credit** — a terminal, non-failed task
carrying a feature's reverse `missionLineage`
(featureId/sliceId/missionId) now credits the feature as satisfying its
acceptance criteria, independent of where the forward `feature.taskId`
points (e.g. a newer follow-up task). Credit is only applied when
**none** of the feature's lineage candidates is live, so a live
follow-up keeps the feature active. Fixes features that otherwise sit
"in-progress" forever after their delivering task completes.
2. **Re-point / unlink surface** — new `fn_feature_repoint_task` /
`fn_feature_unlink_task` agent tools (engine + CLI) backed by an atomic
`repointFeatureToTask` store primitive, so a mis-linked feature can be
re-attached to the correct delivery task or unlinked — without a manual
DB edit. Single-valued `feature.taskId` and one-feature-one-task
invariants are preserved; unlinking an already-unlinked feature errors
clearly. Classified as mutation tools, same class as the existing
`fn_feature_link_task`.
3. **Live SSE update** — the `feature:unlinked` store event is now
emitted over SSE (`event: feature:unlinked`) so the dashboard refreshes
immediately after a re-point/unlink instead of waiting for the next
poll.
## Why
The forward-only `feature.taskId` link made three real failure modes
unrecoverable from the product surface: stale done-features after task
replacement, permanently mis-linked features, and a stale dashboard
after a repair. This closes the feature lifecycle end-to-end.
## Invariants
- `feature.taskId` stays single-valued; one feature is linked to at most
one task at any time (atomic store primitive).
- Done-credit requires: terminal column, non-failed, and no live lineage
candidate.
- No new run-audit prose; store events carry ids/counts/outcomes only.
## Tests
- `mission-state-reconcile.test.ts` — reverse-lineage credit matrix
(live vs. terminal vs. failed candidates)
- `mission-store.pg.test.ts` — `repointFeatureToTask` atomicity +
invariants (PG; gate-safe auto-skip without Postgres)
- `agent-mission-tools.test.ts` — tool delegation (unlink / re-point
exactly once)
- `heartbeat-executor.test.ts`, `extension.test.ts` — tool exposure and
heartbeat interaction
- Changeset: `@runfusion/fusion: minor`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Added tools to reassign a feature to another live task or remove its
task link.
- Unlinking resets the feature to a defined state and provides clear
errors when applicable.
- Added live updates for feature unlink events.
- Improved reconciliation to recognize completed reverse-lineage work
while respecting active follow-up tasks and failures.
- Improved relationship consistency when concurrent task-link operations
occur.
- **Documentation**
- Documented feature linking, unlinking, reassignment, lifecycle events,
and reconciliation behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Fusion <noreply@runfusion.ai>
Enter on the System panel killed the TUI. It opens the dashboard URL with a
detached spawn, and a MISSING opener — xdg-open on any slim Linux container,
exactly where Fusion runs headless — is reported asynchronously as an 'error'
event rather than a synchronous throw. The try/catch around spawn never saw
it, so Node re-threw an 'error' with no listener and took the dashboard down.
The tunnel row now covers any tunnel, not just `pnpm dev --tunnel`:
SystemInfo.devTunnelUrl becomes tunnelUrl, fed by the dev wrapper's IPC
hand-off AND by the engine's TunnelProcessManager status subscription. An
operator's remote tunnel URL previously lived only in the Settings UI and
/remote/status, so a headless terminal could not read the address its own
Fusion was reachable at. A dev tunnel wins when both exist, and a stopped
tunnel clears the row rather than stranding a dead URL.
And the panel measures the row it draws. estimateSystemContentRows accounted
for URL and Token but not Tunnel, so a wrapping trycloudflare hostname was
squeezed out of the panel it had just been added to.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Covers the render both ways: the Tunnel row appears with its URL when a
tunnel is published, and is absent for an ordinary `fn dashboard` run.
Verified by mutation — deleting the row from app.tsx fails the first test.
Driving this through a real TTY proved impractical from a non-interactive
shell (isTTYAvailable needs stdin AND stdout to be TTYs, which neither
`docker exec -t` nor a detached `script` provides), so the render is pinned
here instead of by observation.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
`pnpm dev --tunnel` printed its banner to stdout, and a TTY run then handed
the screen to DashboardTUI, which repainted over it. The public URL — the
entire output of the flag — was unreadable.
The wrapper forwards the URL to the dev child over the IPC channel it already
uses for the listening report, and the dashboard renders a Tunnel row in the
system panel beside URL and Token.
Capture is order-independent. cloudflared can publish before or after the TUI
is constructed, and an IPC message that arrives with no listener attached is
lost, so the URL is stored at run scope on arrival and applied by whichever
half completes second.
Watch-mode restarts reuse the tunnel (a fresh quick tunnel would hand out a
new hostname on every reload), but the new child knows nothing about it, so
the wrapper re-announces on each listening report.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Auditing for repeats of the `pnpm dev --tunnel` bugs turned up the same
mistakes elsewhere.
Remote tunnels assumed 4040. ProjectEngine's Cloudflare quick tunnel
hardcoded http://localhost:4040, so a dashboard on an explicit --port, a PORT
override, or runDashboard's EADDRINUSE rebind published a PUBLIC tunnel to
whatever else held 4040. The dashboard now records its bound port
(setLocalDashboardPort, from both runDashboard and headless serve) and the
tunnel reads it, keeping 4040 only as the pre-report default.
register-discovery-routes already derived its port from req.socket.localPort
and is untouched.
Stopping the dev wrapper orphaned everything it started. It installed no
signal handlers, so teardown only ran from the child's close handler:
signalling the wrapper left the dev server AND its cloudflared alive —
observed twice, four surviving processes each time, including a public
trycloudflare URL still serving a dev server believed to be down. Ctrl-C hid
it by signalling the whole process group.
SessionTerminal appended scrollback instead of clearing first, though the
server sends it as a separate frame precisely so the client can clear. Latent
today because every reattach builds a fresh xterm; a duplicated-history bug
the moment an in-place reconnect appears.
And BackupManager's centralDbPath is gone: written, never read, and a
leftover of the removed SQLite backup — the same class of stale artifact that
onboarding was using as evidence about a Postgres install.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Two defects, both visible as "why is it asking me about AI provider setup
when I just started a dev server?".
The auto-launch gate probed ~/.fusion/fusion-central.db to decide whether the
install was initialized. SQLite central was removed, so a Postgres install
never creates that file and the probe was permanently false: onboarding
auto-launched on every interactive start of a completely working Fusion,
until something happened to stamp the completion marker. The probe now also
accepts the embedded Postgres data directory.
And auto-launched onboarding ran the full interactive flow. It fires while
the operator is starting something else, so its questions interrupt work
nobody asked to interrupt — and a dev server stopped on a prompt never
listens, which is why `pnpm dev --tunnel` produced no dev server and so no
tunnel link. Auto-launch is now non-interactive: create the central database,
stamp the marker, point at the dashboard, ask nothing. `fn onboard` still
runs every step.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The step was a skippable prompt, but declining left an install Fusion cannot
run on — reported by a line that described the breakage without fixing it.
There is no useful negative answer.
It also blocked non-interactive startup: `pnpm dev --tunnel` sat on "Run
central db now? (Y/n)", never reached listening, and so served nothing at all
while the tunnel had no dev server to point at.
The database is now created unconditionally when absent; the already-exists
path is untouched. Scripted onboarding tests lose their leading central-DB
answer, and the skip-every-step case now asserts the database is still
created.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The banner re-derived the token from ~/.fusion/settings.json. That is simply
the wrong source: on a real run the file contained no daemonToken while the
dashboard's own banner, two lines above, printed a working one — so the
tunnel claimed no token existed next to a token that plainly did.
The dashboard already holds the resolved token at the point where it reports
its bound port, so it now reports both over the same IPC message and the
wrapper prefers that over anything it could derive. The env/settings lookup
survives only for targets that report nothing, such as an explicit
--tunnel=PORT aimed at a server the dev child knows nothing about. The token
crosses the existing parent/child channel only; it is never logged or sent
onward.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The tunnel target was resolved from PORT/4040 before anything bound, but an
occupied port makes the dashboard silently rebind to an ephemeral one
(server.listen(0) on EADDRINUSE). With a normal Fusion already running on
4040, `pnpm dev --tunnel` therefore published THAT instance under a
dev-looking URL while the dev server sat unreachable on a random port.
The dashboard now reports the port it actually bound to the dev supervisor
over IPC, and the wrapper tunnels that:
- IPC is enabled whenever --tunnel is set, not only in watch mode; a plain
tunnel run previously had no channel at all.
- The tunnel waits for the report (60s cap, then falls back to the configured
port with a warning), so it also cannot come up against a port nothing is
serving yet.
- A mismatch is logged instead of silent.
- A reported port is treated as the dashboard whatever its number, so the
banner keeps printing the bearer token; without that, the ephemeral case
would classify the dev dashboard as a foreign port and drop it.
- An explicit --tunnel=PORT names a target the dev child knows nothing about,
so it never waits and is still compared against the configured port.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
`pnpm dev --tunnel` published a bare URL under a "public, unauthenticated"
header. That label was wrong for the flag's own default target: --tunnel with
no port aims at the dashboard, which is bearer-token gated, so the recipient
of a shared link got a 401 with no token to supply.
resolveDevTunnelAuth() now classifies the target and the banner says what is
actually true of it:
token dashboard with auth on — prints the token and a ?token= link,
resolved from FUSION_DASHBOARD_TOKEN, FUSION_DAEMON_TOKEN,
then ~/.fusion/settings.json
token-pending first run, token not minted yet — defers to the dashboard's
own startup banner
no-auth --no-auth is on; the dashboard really is open
foreign a non-dashboard port; Fusion has no auth to lend it, the only
genuinely ungated case
Auth resolves at banner time rather than flag-parse time so a token the dev
child mints on a first authenticated run is already readable.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Operator case: someone works inside a remote Fusion (a container, a shared box),
starts a dev server there, and needs to view it from their own browser. The dev
server binds inside that machine, so without a tunnel the only options are port
publishing or a VPN — both needing cooperation from whoever owns the host.
pnpm dev --tunnel # tunnels the dashboard port (PORT, default 4040)
pnpm dev --tunnel=5173 # tunnels a Vite dev server instead
pnpm dev --tunnel dashboard # tunnel the default port AND run the dashboard
FUSION_DEV_TUNNEL=1 pnpm dev
Cloudflare QUICK tunnels are usable here precisely because a dev server is HTTP:
no account, no domain, no card. The TCP endpoints that SSH would have needed
require a card (ngrok) or a domain plus Zero Trust (Cloudflare) — that asymmetry
is why this exists for HTTP only, and it is recorded in the module header so the
next person does not retry the SSH variant.
Design decisions:
- Tunnel failure is NON-FATAL. A missing cloudflared or a tunnel that never
publishes a URL logs and is skipped; losing a preview URL must never cost the
operator their dev loop.
- Watch-mode restarts reuse the existing tunnel. A fresh quick tunnel hands out a
different hostname each time, which would invalidate an already-shared link.
- `--tunnel` consumes a following token only when it is numeric, so
`--tunnel dashboard` forwards `dashboard` to the dev command rather than
tunnelling port NaN. That is the bug this flag shape invites, so it is tested.
Verified end to end in a container: a dev server bound to 127.0.0.1 inside it was
fetched from the public internet through the tunnel (200, correct body). Also
confirmed that tunnelling the DASHBOARD port does not weaken auth — unauthenticated
requests through the tunnel return 401 for /api/tasks, /api/settings and
/api/artifacts, with only /api/health open by design.
Adding two fields to parseDevWrapperArgs' return broke two existing strict toEqual
assertions; those were updated rather than loosened to toMatchObject. 27 tests pass.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The Cursor provider card's Enable action only flips useCursorCli in
settings and never registers fusion-plugin-cursor-runtime, so
getRuntimeById("cursor") missed and every cursor-cli selection hit the
runtime-routed fail-fast error even with an authenticated cursor-agent.
Mirror the FN-7761 Grok eager bootstrap in serve, dashboard, and daemon,
guarded by the same source-scan regression test.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
## Summary
- replaces newly added future-dated FNXC metadata with the actual UTC
change time
- tightens the FNXC future-date baseline to zero known exceptions
## Test plan
- `pnpm check:fnxc-future-dates`
- `pnpm check:lifecycle-columns`
- `pnpm check:changesets`
- `pnpm --filter @runfusion/fusion exec vitest run
src/__tests__/staged-plugin-core-imports.test.ts --silent=passed-only
--reporter=dot`
- `pnpm --filter @fusion/engine typecheck`
- `pnpm lint`
