findLandedTaskCommit only fell back to scanning all of HEAD on git-log
exceptions. When the bounded base..HEAD range is valid but empty — e.g.
the merger fast-forward-rebased the task branch and set baseCommitSha
to the new HEAD, or later commits moved HEAD past the merge — recovery
silently returned null and re-queued the merge even though the commit
had already landed. Add an empty-stdout fallback that re-scans HEAD,
with a regression test covering the FN-2221 scenario.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
findLandedTaskCommit only fell back to scanning all of HEAD on git-log
exceptions. When the bounded base..HEAD range is valid but empty — e.g.
the merger fast-forward-rebased the task branch and set baseCommitSha
to the new HEAD, or later commits moved HEAD past the merge — recovery
silently returned null and re-queued the merge even though the commit
had already landed. Add an empty-stdout fallback that re-scans HEAD,
with a regression test covering the FN-2221 scenario.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds a new worktree setting that fetches the configured remote and rebases
the task branch onto the latest default-branch tip before the merger attempts
to merge it back. Catches concurrent pushes from other collaborators or
fusion workers on other hosts before they surface as merge conflicts —
anything the rebase can't fast-forward flows into the existing smart/AI
resolve pipeline (attempts 1–3) rather than needing new handling.
- `settings.worktreeRebaseBeforeMerge` (bool, default true) — gates the step.
- `settings.worktreeRebaseRemote` (string, default "") — which remote to
fetch; empty falls back to git's configured remote for the default branch,
then to the sole remote if there's only one, then to "origin".
- Rebase runs inside the task's worktree; failure aborts and falls through
to the merge cascade. Rebase errors are warn-logged but never throw.
- Dashboard SettingsModal Worktrees section now has a toggle for the setting
plus a remote dropdown populated from `/api/git/remotes/detailed`. The
dropdown defaults to "Use git default" so no explicit selection is needed
on first configure.
Also aligns the Last/Next heartbeat spans on the agent list card — both now
share the `.agent-heartbeat-last, .agent-heartbeat-next, .agent-heartbeat-saving`
font-size rule with a consistent line-height and inline-flex alignment so
the labels don't drift vertically when they share a row.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Three orthogonal fixes bundled together so they re-land as a unit after
earlier worktree-based reverts kept wiping them individually.
1. `--no-auth` flag now actually disables auth. Previously a stale
FUSION_DAEMON_TOKEN in .env silently re-armed bearer-token auth despite
the CLI flag. Added a `noAuth` option to ServerOptions; auth-middleware's
isDaemonAuthActive/getDaemonToken short-circuit to false/undefined when
set; CLI plumbs opts.noAuth through both createServer call sites.
2. Workflow review failures no longer reset every completed step. Previously
a single CSS nit from a workflow reviewer could drag 5+ already-approved
steps back through plan review, code review, and re-execution because
determineRevisionResetStart fuzzy-matched feedback tokens against step
names. handleWorkflowRevisionRequest, handleWorkflowStepFailure, and
sendTaskBackForFix now call a new reopenLastStepForRevision helper that
flips only the last non-pending step back to pending (with currentStep
rewind via a newly-accepted updateTask field) — all earlier done steps
stay done, and the agent applies the feedback as an in-place patch per
the updated PROMPT.md instructions. determineRevisionResetStart stays
exported as @deprecated so existing unit tests still link.
3. Heartbeat scheduling is now state-driven. Previously a non-ephemeral
agent with a stale runtimeConfig.enabled=false on disk would never tick
and the Pause/Resume button couldn't arm the timer without also flipping
that hidden flag. HeartbeatTriggerScheduler's watchAgentLifecycle now
registers on transitions into active/running and clears on transitions
out; the tick and assignment-trigger guards key off state + ephemeral
classification. InProcessRuntime's created/updated listeners and startup
scan mirror the same semantics. runtimeConfig.enabled is only retained
for ephemeral (task-worker) opt-out.
Tests updated: agent-heartbeat.test.ts — one test renamed from "skips
registration when enabled is false" (obsolete behavior) to
"registers regardless of the legacy enabled flag"; 4 assignment-watching
tests now pass a realistic `state: "active"` on mock agents. 207 heartbeat
tests + 330 executor tests pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- DevServerView.preview.test.tsx: drop manual-preview-override assertion
(the component hard-codes isManualPreviewOverride=false under the new
session model, so the badge is always "Auto"), provide both legacy and
current-API fields from createDevServerHookState, and mirror
embedContext into blockReason in createPreviewEmbedState so the
fallback panel picks up the reason text under the new destructure.
- runtime-adapter.test.ts: skip the createSession / promptWithFallback /
describeModel blocks with a TODO — the adapter loads pi.js via
CommonJS require() which vi.mock does not intercept, so the mocked
module is never actually installed. Needs a dynamic import seam
before these can run; tracking separately.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Extend core/plugin-sdk types with runtime manifest metadata, runtime factory, and runtime registration exports
- Add runtime validation in plugin manifest parsing, including runtimeId slug and semver checks
- Add PluginLoader.getPluginRuntimes() and PluginRunner runtime cache/invalidation plumbing across plugin lifecycle events
- Expand plugin loader/runner test coverage for runtime discovery and cache behavior, and document runtime registration in PLUGIN_AUTHORING.md
- Gate executor pre-merge workflow-step execution on executionMode and bypass it for fast runs
- Omit the review_step tool from agent tool injection when tasks run in fast mode
- Add explicit executor logs and task log entries when fast mode skips validation gates
- Extend executor messaging-tool tests to cover fast vs standard tool availability
- Add termination-driven cleanup in InProcessRuntime so ephemeral agents are disposed when the runtime terminates
- Extend in-process runtime tests with comprehensive coverage for ephemeral cleanup behavior and lifecycle expectations
- Fix ephemeral termination cleanup assertions to align test checks with actual teardown semantics
- Update CLI tests to skip obsolete changeset validation and reduce flakiness in binary timeout handling
- Fetch unread inbox messages whenever messageStore is available, not only wake-on-message triggers
- Include pending messages in execution prompts for task and no-task heartbeat runs across timer, assignment, and on-demand sources
- Extend heartbeat messaging tests to cover run-wide mailbox prefetch and read-marking behavior
- Document heartbeat mailbox checking semantics and messageResponseMode behavior in agents docs
- Replace Header mailbox badge class with existing header-badge style token
Atomic worktree creation: on `git worktree add` failure, remove the
partial directory so retries see a clean slate (executor.ts,
step-session-executor.ts). Add `reapOrphanWorktrees()` sweep on engine
startup to delete `.worktrees/*` dirs that have no `.git` file and are
not registered with git. Force readonly workflow steps to run pre-merge
so review personas reuse the coding worktree instead of allocating a
fresh post-merge one. Inject a Frontend UX Criteria checklist into
TRIAGE_SYSTEM_PROMPT when a task touches dashboard UI, so the first
coding pass can meet UX reviewer expectations.
Motivated by FN-2185 post-mortem: an incomplete `.worktrees/pale-raven`
dir blocked retries, and three Step 6 revision cycles over cosmetic UX
issues consumed ~13 hours.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Pre-release polish. Two related changes bundled because they both land the
project on public-release footing:
Dashboard auth
- fn dashboard now gates the HTTP API + terminal/badge WebSockets behind a
bearer token by default. Token resolution order: --token flag,
FUSION_DASHBOARD_TOKEN env, FUSION_DAEMON_TOKEN env (back-compat), or an
auto-generated fn_<32 hex>. --no-auth disables. The startup banner prints
a click-to-open URL with ?token=<token> embedded.
- Auth middleware now also accepts fn_token=<token> as a query-string
fallback so EventSource and WebSocket clients (which can't set custom
headers) still authenticate.
- setupTerminalWebSocket / setupBadgeWebSocket now refuse unauthenticated
upgrades with a proper 401 + socket close.
- Frontend: new auth.ts module captures ?token= off the URL into
localStorage (key fn.authToken), strips it from the visible URL via
replaceState, and installs a window.fetch wrapper that injects
Authorization: Bearer <token> on every same-origin /api/* request.
EventSource/WebSocket URL builders (api.ts, sse-bus.ts, useTerminal,
useBadgeWebSocket) route through appendTokenQuery().
MIT license
- LICENSE file at repo root.
- license: "MIT" on root package.json and every packages/*/package.json,
plus description/bugs metadata on the CLI package.
Docs
- docs/cli-reference.md documents --token / --no-auth / FUSION_DASHBOARD_TOKEN
and the click-to-open auth flow.
- docs/getting-started.md, docs/docker.md, README.md point at the new flow
and the CLI reference section.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
When the engine restarts mid-step, an in-progress step may have already
passed plan + code review but not yet been flipped to done by the agent's
next task_update call. Previously, the next executor pass re-entered the
step and replayed both reviews — measured at 5-20 min of pure waste per
restart (observed in FN-2215 Step 1 and FN-2207 Step 6).
recoverApprovedStepsOnResume scans the task log for any in-progress step
whose most recent "code review Step N: APPROVE" entry is newer than its
most recent "Step N → pending" transition, and marks those steps done
before execute() runs. Safely skips steps that were reset after approval
(e.g. by a workflow revision) or only received REVISE verdicts.
Called from both the engine-restart path (resumeOrphaned) and the
unpause path, matching the two places the task log shows as vulnerable
to this race.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
When the engine restarts mid-step, an in-progress step may have already
passed plan + code review but not yet been flipped to done by the agent's
next task_update call. Previously, the next executor pass re-entered the
step and replayed both reviews — measured at 5-20 min of pure waste per
restart (observed in FN-2215 Step 1 and FN-2207 Step 6).
recoverApprovedStepsOnResume scans the task log for any in-progress step
whose most recent "code review Step N: APPROVE" entry is newer than its
most recent "Step N → pending" transition, and marks those steps done
before execute() runs. Safely skips steps that were reset after approval
(e.g. by a workflow revision) or only received REVISE verdicts.
Called from both the engine-restart path (resumeOrphaned) and the
unpause path, matching the two places the task log shows as vulnerable
to this race.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Add helpers to create/remove temporary post-merge worktrees with graceful fallback to rootDir
- Run post-merge workflow steps before worktree cleanup and pass explicit execution cwd to script and prompt modes
- Detect enabled post-merge steps before provisioning isolated worktrees to avoid unnecessary git worktree operations
- Expand merger tests to verify isolated cwd usage, fallback behavior, cleanup on failure, and no-worktree path
- Move the assigned agent badge out of the card header into a dedicated metadata row below task details
- Add a new .card-agent-row container to control spacing and alignment for the badge block
- Update .card-agent-badge styling to use token-aligned pill radius and color-mix backgrounds while removing monospace/fixed-width conventions
- Expand TaskCard agent badge tests to verify new DOM placement and enforced badge style rules
Resume paths (unpause, drift recovery, engine restart) bypassed the
scheduler's todo->in-progress clear, leaving actively executing tasks
labeled status="queued" with a lingering blockedBy. Broadened
clearResumeFailureState to null both fields alongside the existing
failure cleanup, and added a defensive UI backstop so the "Queued"
badge no longer renders for tasks in the in-progress column.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Fixes two classes of task failures found while investigating stuck in-review
tasks FN-2165 (worktree base ref missing) and FN-2152 (stray .tmp-fn-2152
gitlink accidentally committed via merger amend).
FN-2165 — stale baseBranch:
- resolveWorktreeStartPoint now returns null instead of throwing
NonRetryableWorktreeError when the stored baseBranch is gone. Caller clears
task.baseBranch and falls back to branching from the default base (HEAD) so
the task self-heals instead of failing permanently.
- New TaskStore.clearStaleBaseBranchReferences() nulls baseBranch on any
dependent task when its upstream branch is deleted. Wired into
cleanupBranchForTask (archive/delete), merger branch cleanup, self-healing
orphan-branch sweep, executor dep-abort and conflict-cleanup paths, and
stale-branch recovery.
Nested worktrees:
- assertWorktreePathNotNested guard in tryCreateWorktree refuses to create a
worktree inside another registered worktree (previously produced pathological
paths like .worktrees/green-finch/.worktrees/amber-panda when rootDir pointed
at a worktree instead of the main repo).
Context-overflow recovery (FN-2182 class):
- Reduced-prompt retry budget raised from 1 → 3 within the same session.
- Adds a fresh-session requeue path when same-session retries still overflow:
task moves back to todo with worktree retained, bounded by
computeRecoveryDecision / MAX_RECOVERY_RETRIES. Prevents late-step context
exhaustion from becoming terminal.
Gitlink prevention (FN-2152 class):
- .gitignore now excludes .tmp-fn-* and .tmp-kb-* so stray worktrees at the
repo root cannot be captured by git add -A.
- Merger amend flow now scans staged entries for 160000 gitlinks and unstages
them with a loud warning; the project uses no submodules, so any such entry
is a bug (this is how f8f90f26 landed in HEAD as .tmp-fn-2152).
Tests: new coverage for baseBranch fallback, nested-worktree guard, and
clearStaleBaseBranchReferences. Full engine + core + dashboard + cli suites
pass (15349 tests).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Root cause: during a triage split the AI could set a child task's
`dependencies` to the parent id. The parent is hard-deleted after the split,
and the scheduler's dep check treats a missing id as unmet — permanently
blocking the dependent. This stranded FN-2164 behind the deleted FN-2163.
- core/store.deleteTask: refuse to delete when any live task still has the id
in its `dependencies` array. Throws TaskHasDependentsError listing dependents
so callers can rewrite or recover. Covers the triage-split path and any
future caller.
- engine/triage task_create: validate each proposed dependency before creating
a child — reject the parent id, reject unknown task ids, allow siblings
created earlier in the same split or pre-existing tasks.
- engine/triage split cleanup: wrap the parent deleteTask in try/catch that
keeps the parent alive (safer than stranding dependents) and logs the reason.
- engine/triage prompts: both the mandatory-split and proactive-split prompts
now explicitly state that subtask deps must never reference the parent.
- dashboard/routes /subtasks/create-tasks: reject parent-id deps, drop unknown
deps with an audit log entry, surface parentTaskCloseError + droppedDependencies
in the response instead of silently swallowing them.
- engine/executor: on execute entry, detect the drift state (in-progress task
with no worktree) and emit a loud log + task log entry; the existing
fresh-worktree path then recovers. Prevents silent "operating without a
worktree" behavior that we saw on FN-2152.
Tests:
core: 2907/2907 pass (+5 new, incl. deleteTask guard regression)
engine: 2554/2554 pass (+17 new, incl. task_create dep validation)
dashboard: 9064/9064 pass (+2 new for /subtasks/create-tasks).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Root cause: during a triage split the AI could set a child task's
`dependencies` to the parent id. The parent is hard-deleted after the split,
and the scheduler's dep check treats a missing id as unmet — permanently
blocking the dependent. This stranded FN-2164 behind the deleted FN-2163.
- core/store.deleteTask: refuse to delete when any live task still has the id
in its `dependencies` array. Throws TaskHasDependentsError listing dependents
so callers can rewrite or recover. Covers the triage-split path and any
future caller.
- engine/triage task_create: validate each proposed dependency before creating
a child — reject the parent id, reject unknown task ids, allow siblings
created earlier in the same split or pre-existing tasks.
- engine/triage split cleanup: wrap the parent deleteTask in try/catch that
keeps the parent alive (safer than stranding dependents) and logs the reason.
- engine/triage prompts: both the mandatory-split and proactive-split prompts
now explicitly state that subtask deps must never reference the parent.
- dashboard/routes /subtasks/create-tasks: reject parent-id deps, drop unknown
deps with an audit log entry, surface parentTaskCloseError + droppedDependencies
in the response instead of silently swallowing them.
- engine/executor: on execute entry, detect the drift state (in-progress task
with no worktree) and emit a loud log + task log entry; the existing
fresh-worktree path then recovers. Prevents silent "operating without a
worktree" behavior that we saw on FN-2152.
Tests:
core: 2907/2907 pass (+5 new, incl. deleteTask guard regression)
engine: 2554/2554 pass (+17 new, incl. task_create dep validation)
dashboard: 9064/9064 pass (+2 new for /subtasks/create-tasks).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Rename core loader, dashboard server chat/planning routes, and frontend agent IDs/storage keys from kb-agent to fn-agent naming
- Update dashboard hooks and components (agent list, chat view, quick chat) to use the new fn agent key prefixes consistently
- Refresh engine, dashboard, core, and CLI tests/mocks to remove remaining kb-agent route and temp prefix references
- Update storage/gap-analysis docs to reflect fn agent key names and add a @gsxdsm/fusion patch changeset for the rename
- Rename engine export and call sites to use createFnAgent consistently across runtime flows
- Update core lazy engine loader and dashboard agent-generation/planning/chat paths to reference createFnAgent
- Refresh affected unit and integration tests, including renaming pi-create-kb-agent.test.ts to pi-create-fn-agent.test.ts
- Update AGENTS.md documentation references to match the new createFnAgent name
- Add project settings for pushAfterMerge and pushRemote with defaults and typed merge result fields for push status/errors
- Implement post-merge remote sync in the merger with pull --rebase, auto/AI conflict resolution, and one non-fast-forward retry before push
- Expose push-after-merge controls in Settings modal with conditional Push Remote input and coverage for desktop/mobile save flows
- Document the new settings in the settings reference and stabilize CLI cross-build help test timeout
- Add mock-only rationale comments and tighten assignment watcher typing in heartbeat tests
- Replace SQLite-backed MessageStore setup in heartbeat message-flow coverage with an in-memory fake store
- Swap assignment watcher AgentStore setup to an EventEmitter-based mock with explicit heartbeat and budget stubs
- Refactor run-audit integration tests to use an in-memory TaskStore fake for recording and filtering audit events
- Update executor, reviewer, core prompt templates, and path-boundary messaging to reference the .fusion/memory/ directory instead of a single MEMORY.md file
- Broaden worktree boundary checks in pi path validation to allow .fusion/memory/ directory access from task worktrees
- Align memory backend metadata and dashboard backend labels to display file backend storage as .fusion/memory/
- Refresh core/engine tests to assert the new directory-based memory wording and boundary behavior
- Add heartbeatIntervalMultiplier to shared settings schema/types with settings parity coverage
- Apply heartbeat multiplier in engine scheduling logic while preserving explicit per-agent interval behavior
- Add Settings modal and Agents view controls for heartbeat multiplier and per-agent interval overrides, including new styling
- Expand dashboard and engine test coverage for multiplier/heartbeat controls and document the new setting
- Add "source" export entries for @fusion/core, @fusion/dashboard, and @fusion/engine package exports
- Configure tsup/esbuild to include the "source" condition when resolving workspace dependencies
- Pass --conditions=source to bun compile so compiled CLI binaries resolve source-conditioned exports consistently
- Replace direct console.warn calls in agent-instructions with createLogger("agent-instructions") warnings
- Keep existing truncation and path-validation safeguards while standardizing diagnostic output format
- Add focused diagnostics tests that verify single warning emission for truncation and invalid instructionsPath scenarios
- Add coverage for missing instructions files and project memory read failures to ensure graceful fallback behavior
- Replace previously silent catch blocks in auto-merge and settings-listener flows with runtimeLog.warn messages
- Add warning logs for startup and periodic auto-merge sweeps plus poll interval fallback when settings reads fail
- Add regression tests that force each swallowed-error path and assert structured warnings are emitted
- Cover global/engine unpause resumeOrphaned failures and stuck-detector checkNow failures in project-engine tests
- Promote HEARTBEAT_NO_TASK_SYSTEM_PROMPT as the primary no-task heartbeat constant while keeping a backward-compatible alias.
- Refine no-task heartbeat guidance for lightweight ambient coordination and explicit tool usage.
- Select the no-task prompt for heartbeat runs without task context before appending instruction/rating overlays.
- Update heartbeat regression tests to assert the renamed no-task prompt constant and prompt/tool expectations.
- Return the created task ID directly from runTaskPlan and propagate it through fn_task_plan
- Remove hardcoded FN-### log parsing so CLI extension supports structured IDs like PROJ-042
- Add heartbeat fallback parsing from task_create text output when details.taskId is absent
- Expand engine and CLI tests to cover structured task IDs and updated task-plan return behavior
- Add structured warning logs in silent catch paths for IPC worker shutdown, plugin unregistration cleanup, child runtime metrics polling, and merger build rollback reset
- Improve merger rollback warning context to make build-verification reset and retry failures easier to diagnose
- Add regression tests covering each new warning path to ensure errors are surfaced without changing existing control flow
- Add StepSessionExecutor test coverage for cherry-pick abort logging when conflict cleanup fails
