Replace raw dashboard RGB alpha colors with color-mix token expressions and guard the global CSS surface.
- Converted global theme shadow, state, mission, event, and theme-data alpha colors from raw rgba() to color-mix() expressions.
- Added CSS fixture loading for theme-data.css and a regression test banning raw rgb/rgba outside var() fallbacks across global app CSS.
- Documented the stricter dashboard styling rule for global and theme token CSS.
Files changed:
docs/dashboard-guide.md | 2 +-
.../__tests__/global-theme-css-no-raw-rgba.test.ts | 68 +++
packages/dashboard/app/public/theme-data.css | 573 +++++++++++----------
packages/dashboard/app/styles.css | 49 +-
packages/dashboard/app/test/cssFixture.ts | 7 +
5 files changed, 389 insertions(+), 310 deletions(-)
Fusion-Task-Id: FN-6489
Fusion-Task-Lineage: 7c466971-d15c-4382-a24b-1b32eea71974
Rescue the same-day core and CLI flaky quarantines by fixing their fixture seams instead of appeasing timeouts.
- Make the core concurrent-write lock helper release synchronously inside its child process so package load cannot delay the transient lock release.
- Close real CLI TaskStore fixtures before removing temp roots and switch mock cleanup to non-hoisted unmocking.
- Remove both test files from package quarantine excludes and clear the quarantine ledger while documenting the rescue pattern.
Files changed:
docs/testing.md | 2 ++
packages/cli/src/__tests__/extension-task-tools.test.ts | 17 +++++++++++++----
packages/cli/vitest.config.ts | 4 +++-
.../core/src/__tests__/store-concurrent-writes.test.ts | 8 +++++++-
packages/core/vitest.config.ts | 4 +++-
scripts/lib/test-quarantine.json | 13 +------------
6 files changed, 29 insertions(+), 19 deletions(-)
Fusion-Task-Id: FN-6486
Fusion-Task-Lineage: c90358c4-0549-4c68-8d17-2e2a336433b5
- P1 (Greptile): a tool-use break-early turn released the warm connection
(inUse=false) while conn.prompt() was still pending, letting the next turn
launch a concurrent prompt on the same ACP session (protocol corruption).
keepWarm now requires !sawToolCall, so a tool-use turn tears the connection
down like the non-reuse path; only a clean stop turn (prompt fully resolved
before finish) keeps it warm. + test.
- buildBridgeEnv: treat a whitespace-only auth var as absent (v.trim()), so a
blank higher-preference token can't shadow a real lower-preference one and we
never forward a useless blank token. + test.
- Auth-forwarding tests: clear ambient auth vars in beforeEach so a runner-env
token can't shadow the case under test (CodeRabbit).
- Doc: clarify the allow-list never carries API keys by default; the single
FUSION_CLAUDE_ACP_FORWARD_AUTH opt-in (default OFF) is the only exception.
348/348 pass, tsc clean.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Compound learning: the claude-code-cli-acp bridge returned 'Not logged in'
despite a working claude -p, due to (1) a too-thin spawn env (needs XDG_*/USER/
SHELL beyond HOME/PATH) and (2) macOS login-Keychain session isolation for
detached/headless processes. Six headless tasks misdiagnosed it as an upstream
gap. Cross-linked from the ACP runtime integration pattern doc.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Two-reviewer pass (security + architecture) on KTD10 + the full Route A
increment: no code defects, no P0, merge-ready as a dormant increment. Applying
the P1 follow-ups:
- Add the feature changeset (@runfusion/fusion minor) — the one convention gap.
- KTD10 tests: fail-closed (bridge not resolved -> env stays unset -> -p) and
idempotency (second onLoad keeps the first published path).
- Document the two intentional, parallel MCP-forwarding paths (U10 engine-adapter
vs U11 provider-driver) so nobody double-forwards, and the known
ACP-path-token-usage=0 residual so U12 doesn't treat it as a bug.
Reviewers confirmed: dormancy invariant holds end-to-end (nothing sets
FUSION_CLAUDE_ACP=1; both flag+path required; -p is the default); OAuth pi path
untouched. 206/206 plugin tests, 333/333 pi-claude-cli tests, typecheck clean.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Live run: forwarded MCP tools and native Bash both refuse to execute when we
return cancelled to session/request_permission (no TOCTOU). streamViaAcp's
deny-by-default + break-early is verified safe. Env allow-list (incl. XDG/USER)
validated as required for the bridged claude to authenticate.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Reverse-engineered the streamViaCli contract and locked the U11 build plan:
AssistantMessageEventStream shape to match, the kill-switch branch point in
streamSimple, the KTD10 injection seam (pi-claude-cli adds @agentclientprotocol/sdk;
bridge path injected like mcpConfigPath), MCP-server construction reusing
ensureMcpConfig, full-history prompting (R13), ACP->pi event translation
paralleling event-bridge.ts, and live-bridge verification via the U9 harness.
No transport change yet — the live `claude -p` path is untouched.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Route A unblock + the first Route A code increment.
- U9 verdict recorded (plan OQ1 + docs/acp-contract.md): in an authenticated
interactive session the pinned claude-code-cli-acp 0.1.1 bridge forwards
session/new mcpServers to Claude, Claude invokes the forwarded Fusion tool,
and the call traverses the ACP permission gate (session/request_permission).
Both security-critical answers resolve positively — overturns the headless
NOT-GO chain (FN-6466/6467/6473/6476), whose only blocker was running
detached from the login keychain session.
- R17 (daemon auth) recorded and closed for the supported setup: creds are
macOS Keychain-only; the user's login-session fn daemon has keychain access
(the existing claude -p provider authenticates there), so the bridge does too.
- U10: thread an optional mcpServers list through the ACP runtime contract.
newAcpSession now forwards it (was hardcoded []); AgentRuntimeOptions (engine
+ plugin-local copy) gains the field; defaults to [] to preserve Route B's
read-only ask posture. Tool calls still route through the U5 permission floor.
Plugin typechecks clean; provider-session tests 12/12 (incl. 2 new forwarding
tests). U11-U13 (provider transport swap, picker/auth, workflow verify) remain.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Index the upstream ACP MCP forwarding sponsorship doc so the docs README and CLI index test keep it discoverable.
- Add the upstream ACP MCP passthrough and permission forwarding sponsorship doc link under Audit Reports.
- Add the upstream doc to the required docs README index coverage.
- Guard that CLI Printing Press docs remain indexed in Audit Reports only, not duplicated under Plugins.
Files changed:
docs/README.md | 5 +++++
.../cli/src/__tests__/docs-readme-index.test.ts | 21 +++++++++++++++++++++
2 files changed, 26 insertions(+)
Fusion-Task-Id: FN-6479
Fusion-Task-Lineage: f23afeba-a989-4552-8857-fe2984df6081
Document the authenticated ACP bridge rerun attempt and preserve the Route A blocked verdict.
- Update the ACP contract with FN-6476 readiness proof results showing the pinned bridge still reports an unauthenticated Claude session.
- Keep OQ1 answers unresolved because no forwarded Fusion tool invocation or permission-gate traversal was observed.
- Add FN-6476 status notes to the Claude ACP runtime plan so U9 remains NOT GO without a claude -p fallback.
Files changed:
docs/acp-contract.md | 11 ++++++++++-
docs/plans/2026-06-14-001-feat-claude-acp-runtime-plan.md | 3 +++
2 files changed, 13 insertions(+), 1 deletion(-)
Fusion-Task-Id: FN-6476
Fusion-Task-Lineage: f37dcc62-9758-47af-bb50-169e902211a5
Record the upstream sponsorship package for ACP MCP passthrough and permission gating while keeping Route A blocked.\n\n- Add a ready-to-file upstream issue for claude-code-cli-acp MCP passthrough and permission-forwarding support.\n- Link the filed upstream issue from the ACP contract and runtime plan.\n- Preserve the OQ1/U9 NOT GO status until authenticated reruns prove forwarded tool invocation and gating.\n\nFiles changed:\n docs/acp-contract.md | 5 +\n .../2026-06-14-001-feat-claude-acp-runtime-plan.md | 3 +\n ...laude-code-cli-acp-mcp-permission-forwarding.md | 121 +++++++++++++++++++++\n 3 files changed, 129 insertions(+)
Fusion-Task-Id: FN-6475
Fusion-Task-Lineage: 3cbd14e3-9388-4cf4-b256-3678459eb926
Record the authenticated Route A ACP escalation rerun and keep U9 blocked.
- Update the ACP contract OQ1 status to FN-6473 with the observed unauthenticated bridge result.
- Capture the explicit request-permission instrumentation outcome: zero forwarded tool calls and zero permission callbacks.
- Extend the Claude ACP runtime plan with the escalation status and upstream bridge/ACP permission-forwarding requirement.
Files changed:
docs/acp-contract.md | 13 +++++++++++--
docs/plans/2026-06-14-001-feat-claude-acp-runtime-plan.md | 3 +++
2 files changed, 14 insertions(+), 2 deletions(-)
Fusion-Task-Id: FN-6473
Fusion-Task-Lineage: 2e6ec23b-a9cd-4fd0-b24e-72ee8bb145ac
Record the FN-6467 U9 rerun outcome so Route A remains gated on authenticated ACP bridge evidence.
- Document the second direct bridge attempt against claude 2.1.177 and claude-code-cli-acp 0.1.1.
- Preserve the accepted 62-tool custom-tools MCP payload details and lockfile integrity evidence.
- Mark forwarded tool invocation and ACP permission-gate traversal as unresolved because the bridge still reports Not logged in.
Files changed:
docs/acp-contract.md | 15 ++++++++++-----
docs/plans/2026-06-14-001-feat-claude-acp-runtime-plan.md | 3 +++
2 files changed, 13 insertions(+), 5 deletions(-)
Fusion-Task-Id: FN-6467
Fusion-Task-Lineage: fa2c1e16-7822-421b-80cf-e4ab247641a5
Record the real Route A U9 bridge attempt and keep OQ1 at NOT GO.
- Document that claude-code-cli-acp accepted a non-empty Fusion MCP server declaration.
- Capture the unauthenticated claude blocker before forwarded tool invocation or permission telemetry.
- Keep FN-6460 blocked until an authenticated rerun proves tool forwarding and ACP permission traversal.
Files changed:
docs/acp-contract.md | 13 +++++++++++--
docs/plans/2026-06-14-001-feat-claude-acp-runtime-plan.md | 3 +++
2 files changed, 14 insertions(+), 2 deletions(-)
Fusion-Task-Id: FN-6466
Fusion-Task-Lineage: 0bce3b9f-fbab-4562-9a7b-9d5551335fa4
Record the unrecovered Route A U9 verdict and the design-only U14 confirmation so follow-up work preserves the ACP permission-gate blocker.\n\n- Add an ACP contract open-question entry that marks Route A as NOT GO until real MCP forwarding and ACP permission-gate traversal are proven.\n- Capture the FN-6465 recovery outcome in the Claude ACP runtime plan, including the missing FN-6459 evidence and required rerun criteria.\n- Confirm the internal Route A design mechanisms while keeping implementation blocked on U9.\n\nFiles changed:\n docs/acp-contract.md | 24 ++++++++++++++++++++++\n .../2026-06-14-001-feat-claude-acp-runtime-plan.md | 9 ++++++++\n 2 files changed, 33 insertions(+)
Fusion-Task-Id: FN-6465
Fusion-Task-Lineage: d4762440-cbb9-4206-b4b2-be578eba30dd
Document the restored FN-6437 proof-point results in the external plugin runbook.
- Replace the pending-verification placeholder with the recorded NOT MET verdict for @runfusion/fusion@0.43.0.
- Add package, integrity, environment, command, scaffold, and TypeScript failure evidence from the restored report.
- Preserve explicit gaps for list/enable proof and follow-up checks that were blocked by the released scaffold failure.
Files changed:
docs/plugins/external-proof-point-runbook.md | 132 +++++++++++++++++++++++++--
1 file changed, 124 insertions(+), 8 deletions(-)
Fusion-Task-Id: FN-6452
Fusion-Task-Lineage: 14d3b848-59cd-43bb-b725-6586182906ee
Add a durable proof-point runbook for validating external plugins against released Fusion CLI builds.
- Document release selection, npm integrity capture, scaffold/build/test/install/enable validation, and pass/fail criteria for external plugin proof points.
- Link the runbook from the docs index so it remains discoverable with other plugin authoring docs.
- Extend the docs README index test to require the new proof-point runbook entry.
Files changed:
docs/README.md | 1 +
docs/plugins/external-proof-point-runbook.md | 211 +++++++++++++++++++++
.../cli/src/__tests__/docs-readme-index.test.ts | 1 +
3 files changed, 213 insertions(+)
Fusion-Task-Id: FN-6438
Fusion-Task-Lineage: 5c768d7e-4465-42ac-9535-f16dc42ab6d0
Add a fast guard that rejects Vitest timeout bumps in tracked test files.
- Add a test-timeout appeasement scanner with a temporary allowlist for legacy exemptions.
- Run the scanner in pretest, pretest:full, and test:gate so merge gates catch timeout bumps.
- Cover the scanner behavior with node:test cases and document the policy/remediation path.
Files changed:
docs/testing.md | 6 ++
package.json | 6 +-
.../check-no-test-timeout-appeasement.test.mjs | 49 +++++++++
scripts/check-no-test-timeout-appeasement.mjs | 119 +++++++++++++++++++++
.../lib/test-timeout-appeasement-allowlist.json | 10 ++
5 files changed, 187 insertions(+), 3 deletions(-)
Fusion-Task-Id: FN-6434
Fusion-Task-Lineage: deb46a27-b0c9-4644-b8bb-34ce98e7acde
Prevent the terminal symbols font from corrupting ASCII cell measurement on mobile.\n\n- Add unicode-range scoping to the Fusion terminal Nerd Font symbols face.\n- Cover the CSS contract so symbols ranges include Nerd Font blocks and exclude printable ASCII.\n- Document the xterm font-loading regression and required verification path.\n\nFiles changed:\n .../xterm-symbols-nerd-font-unicode-range.md | 63 ++++++++++++++++++++++\n .../dashboard/app/__tests__/terminal-input.test.ts | 49 +++++++++++++++++\n .../dashboard/app/components/TerminalModal.css | 5 ++\n 3 files changed, 117 insertions(+)
Fusion-Task-Id: FN-6424
Fusion-Task-Lineage: 7350c926-1d51-474b-bfc3-a17f922b9322
Enable the task-detail Chat composer to submit messages with standard Enter behavior.
- Submit non-empty task chat drafts on plain Enter while preserving Shift+Enter newline entry and IME composition safety.
- Keep Cmd/Ctrl+Enter as a supported send path through the same handler.
- Document the composer keyboard shortcuts and add dashboard tests for steering, refinement, newline, shortcut, and composition behavior.
- Add a patch changeset for the published Fusion package.
Files changed:
.changeset/tiny-tasks-chat-enter.md | 5 +
docs/dashboard-guide.md | 2 +-
packages/dashboard/app/components/TaskChatTab.tsx | 13 ++-
.../app/components/__tests__/TaskChatTab.test.tsx | 120 +++++++++++++++++++++
4 files changed, 136 insertions(+), 4 deletions(-)
Fusion-Task-Id: FN-6415
Fusion-Task-Lineage: 7d200bf6-5130-4fb8-b59c-66bccffe4265
Document the root cause (offset-less position:absolute sr-only utility
escaping the kanban board's overflow clip and inflating
documentElement.scrollWidth → iOS shrink-to-fit zoom), the top/left:0 fix,
and the CSS-fixture regression guard. Cross-links the sibling mobile
viewport-containment learnings.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Ensure workflow-mode boards fill the mobile viewport while preserving internal column scrolling.
- Reassert the mobile flex fill chain for project content, workflow board wrappers, and workflow columns.
- Extend mobile board regression coverage across empty/populated workflow states with and without the toolbar.
- Document the workflow board collapse root cause and add a transient temp-dir isolation guard test.
Files changed:
docs/dashboard-guide.md | 1 +
.../ui-bugs/mobile-workflow-board-fill-chain.md | 61 +++++++++++++
.../__tests__/board-mobile-initial-render.test.tsx | 101 +++++++++++++++++++++
packages/dashboard/app/styles.css | 52 +++++++++++
scripts/__tests__/check-test-isolation.test.mjs | 23 +++++
scripts/check-test-isolation.mjs | 12 ++-
6 files changed, 249 insertions(+), 1 deletion(-)
Fusion-Task-Id: FN-6397
Fusion-Task-Lineage: ddee773d-6d3a-46d1-b1c7-f601a961365e
