The CLI-binary panel's "Install with npm" button (POST /system/fn-binary/install) ran
`spawn("npm", ["install","-g","runfusion.ai"], { shell: false })`. On Windows npm resolves to
npm.cmd, which Node refuses to spawn without a shell (spawn npm ENOENT / EINVAL, CVE-2024-27980),
so the button failed with "spawn npm ENOENT". Use shell on win32; the command/args are fixed
constants with no caller input, so shell quoting is safe. (The npx spawns in cli skills/extension
already set shell:true.)
Verified on Windows: spawn("npm",["--version"],{shell:false}) -> ENOENT; {shell:true} -> ok.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
After the runtime starts, the packaged renderer was left on its file:// page and only had
?serverBaseUrl=… appended. But the dashboard client issues RELATIVE /api requests, so on a
file:// origin they resolve to file:///api/… and fail ("Can't reach the Fusion backend /
Failed to fetch"); the embedded server also sends no CORS header, so a cross-origin fetch
would be blocked as well. (The server itself is fine — verified it serves both /api/health
and the client HTML at /.)
Fix: once the runtime is running, navigate the window to the runtime's OWN origin
(http://127.0.0.1:<port>/), which the embedded server serves — making /api same-origin.
This mirrors how remote mode already navigates to its server URL. The gate now treats "page
served over http(s)" as the ready signal (protocol check) instead of a serverBaseUrl URL
param; that also supersedes the previous cached-context handoff check (04fd91f6) and keeps
the reload loop closed, since bootstrapShellHostContext() strips shell query params at load.
Regression tests: navigates to the runtime origin exactly once from file://; renders the app
without navigating when already served over http; starts the runtime first when it isn't
running, then navigates.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
After the runtime starts, DesktopLaunchGate calls applyServerBaseUrl() which reloads the
page with ?serverBaseUrl=… so the shell-host bootstrap can route API calls to the embedded
server. But main.tsx runs bootstrapShellHostContext() at module load — BEFORE the gate's
effect — and it strips every shell query param from the URL via history.replaceState. The
gate then checked window.location.search for serverBaseUrl (after an await), always missed
it, and re-ran the handoff → window.location.replace → reload → strip → an infinite reload
loop that renders as rapid "Starting local Fusion runtime…" flashing that never connects.
This was latent until the split-brain fix (78f0bc31) let the runtime actually start and
reach the handoff.
Fix: detect the completed handoff from the CACHED shell-host context
(getShellHostContext().serverUrl), which the bootstrap preserves, instead of the stripped
URL (URL param kept only as a fallback).
Adds a DesktopLaunchGate regression test: with serverUrl present in the cached context but
stripped from the URL, the gate renders children and does NOT reload; on first load it
performs the handoff exactly once. Verified the test fails against the pre-fix gate.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Two Windows-only breakages in the build path:
- scripts/build-workspace.mjs: the "run as main" guard compared import.meta.url
to `file://${process.argv[1]}`, which never matches on Windows (import.meta.url
is file:///C:/… with forward slashes and a triple slash; argv[1] is C:\… with
backslashes and no scheme). So `pnpm build` at the repo root silently no-opped
(exit 0, no output, no dist) and packaging shipped empty/stale dist. Compare
against pathToFileURL(process.argv[1]).href instead.
- scripts/build-workspace.mjs runPlannedBuilds and packages/cli/tsup.config.ts
runWorkspaceCommand spawned `pnpm` without shell:true; on Windows pnpm is a
.cmd shim Node refuses to spawn without a shell (ENOENT/EINVAL, CVE-2024-27980),
failing with `spawn pnpm ENOENT`. Pass shell on win32 (args are fixed repo build
invocations with no shell metacharacters).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Desktop startup used two independent persisted sources of truth that could
disagree: desktop-launch-mode.json decided whether main STARTS the embedded
local runtime, while shell-connections.json (desktopMode) decided whether the
renderer launch gate WAITS for it. shell:setDesktopMode persists shell settings
before the fallible startLocalRuntimeOnce()/saveDesktopLaunchMode(), so a first
"local" selection whose runtime start failed or was interrupted left
shell=local / launch-mode=choose permanently. Every subsequent launch then sat
at "Starting local Fusion runtime…" polling a runtime nobody started, timing out
after 30s.
Fix (defense in depth):
- initializeApp reconciles: a completed shell "local" selection is authoritative;
it heals the launch-mode file and starts the runtime.
- onDesktopModeChange/onDesktopLaunchModeChange persist launch-mode BEFORE the
fallible start so an interrupted start cannot re-create the desync.
- DesktopLaunchGate no longer assumes main started the runtime; if it is not
running/starting it actively (re)starts via setDesktopMode("local") before polling.
- Add env-gated startup trace (FUSION_STARTUP_TRACE) so packaged builds, which
otherwise log nothing, can diagnose this class of stall.
Regression tests assert the invariant (split-brain -> runtime starts + file heals;
agreement-on-choose -> no start). flushPromises now drains via a macrotask so
run()-based tests observe a fully-initialized app regardless of async chain length.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
When a task adds/removes a dependency without regenerating the lockfile,
the inferred `pnpm install --frozen-lockfile` (and yarn/bun equivalents)
in the AI-merge clean room fails with ERR_PNPM_OUTDATED_LOCKFILE, dead-
ending the merge. Detect that specific frozen-refusal and retry once
non-frozen (pnpm gets explicit --no-frozen-lockfile to override any CI
default), regenerating the lockfile and recomputing the install marker.
A configured worktreeInitCommand keeps its authoritative frozen intent
and still hard-fails. Surfaced via the merge:ai-deps-sync run-audit event.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Prevent duplicate Refine Further activations from interrupting an active completed-summary refinement stream.
- Add a synchronous single-flight guard and loading state for summary refinement.
- Preserve the connected planning stream when a same-turn generation-in-progress response is reported.
- Cover rapid desktop/mobile activation and active-stream conflict behavior with regression tests.
- Add a patch changeset for the published Fusion package.
Files changed:
.../fn-7431-planning-refine-single-flight.md | 7 +
.../dashboard/app/components/PlanningModeModal.tsx | 41 +++++-
.../PlanningModeModal.planning-flow.test.tsx | 156 +++++++++++++++++++++
3 files changed, 201 insertions(+), 3 deletions(-)
Fusion-Task-Id: FN-7431
Fusion-Task-Lineage: fc876022-da86-409e-818d-8c4798b49aa5
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Refresh the test velocity baseline and coverage so quarantine counts come from the live ledger.\n\n- Update the weekly baseline report to show zero active quarantines and a neutral delta.\n- Strengthen the report-only regression test to cover stale report and history quarantine values.\n- Document the FN-7420 requirement near the regression scenario.\n\nFiles changed:\n docs/test-velocity-baseline.md | 10 +++++-----\n scripts/__tests__/test-velocity-baseline.test.mjs | 10 +++++++---\n 2 files changed, 12 insertions(+), 8 deletions(-)
Fusion-Task-Id: FN-7420
Fusion-Task-Lineage: 9144ddb5-3a72-4a37-a1d1-471871f3cbc4
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Keep dashboard project selection in the URL so refreshing or sharing the page retains the active project.
- Hydrate current project state from the existing ?project= query parameter before falling back to cached or global defaults.
- Update project selection, setup completion, overview, and unregister flows to preserve or clear the project URL parameter without dropping other URL state.
- Cover URL-driven project persistence and query/hash preservation with hook tests.
- Document the refresh-safe project URL behavior and add a patch changeset.
Files changed:
.changeset/fn-7416-project-url-persistence.md | 7 +++
docs/dashboard-guide.md | 2 +
packages/dashboard/app/App.tsx | 2 +-
.../app/hooks/__tests__/useCurrentProject.test.ts | 64 ++++++++++++++++++++++
.../app/hooks/__tests__/useProjectActions.test.ts | 40 +++++++++++++-
packages/dashboard/app/hooks/useCurrentProject.ts | 54 ++++++++++++++++--
packages/dashboard/app/hooks/useProjectActions.ts | 5 ++
packages/dashboard/app/utils/projectUrlState.ts | 24 ++++++++
8 files changed, 190 insertions(+), 8 deletions(-)
Fusion-Task-Id: FN-7416
Fusion-Task-Lineage: 2d640ae6-629f-4632-9014-986320acfef5
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Refresh the velocity baseline artifacts so live quarantine counts are reflected consistently.
- Add regression coverage for live quarantine ledger counts overriding stale report and history values.
- Update the weekly velocity baseline report to show the current quarantine count and deltas.
- Append the latest measured velocity history row with quarantine count one.
Files changed:
docs/test-velocity-baseline.md | 22 ++---
scripts/__tests__/test-velocity-baseline.test.mjs | 75 +++++++++++++++
scripts/test-velocity-history.json | 112 ++++++++++++++++++++++
3 files changed, 198 insertions(+), 11 deletions(-)
Fusion-Task-Id: FN-7414
Fusion-Task-Lineage: 7c6cd47c-482d-426c-a714-79da33d4591d
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
## Summary
Fixes all failing tests in the non-blocking full-suite CI run
[28561416741](https://github.com/Runfusion/Fusion/actions/runs/28561416741)
on main.
## Root causes and fixes
### 1. Missing `formatModelMarkerDetails` mock export (5 files, 17
tests)
Production code in `reviewer.ts` and `triage.ts` calls
`formatModelMarkerDetails()` after resolving an agent session to build a
model-marker log line. Five test files mocked `../pi.js` without
exporting this function, so every reviewer/triage/restart path threw
`[vitest] No "formatModelMarkerDetails" export is defined` before
reaching finalization assertions.
**Files:** `reviewer-prompt-single-source`,
`plan-review-unavailable-recovery`, `triage-fast-mode-workflow-variant`,
`triage-stuck-requeue-preserve-draft`, `restart.integration`
### 2. Outdated worktree acquisition assertions (2 files, 5 tests)
A production fix added `git symbolic-ref --short
refs/remotes/origin/HEAD` resolution to ensure fresh task worktrees
never inherit the root checkout's ambient HEAD. The tests didn't account
for this new exec call or the appended start point.
**Files:** `worktree-acquisition-backend`,
`worktree-acquisition-worktrunk`
### 3. Stale workflow compiler tests (1 file, 2 tests)
FN-7360 removed the linear `WorkflowStep` compiler and `/compile`
endpoint, making `parseWorkflowIr` the sole validity gate. Branching
custom workflows are now valid on the graph interpreter. Two dashboard
tests still asserted 422 for branching IR.
**File:** `workflow-routes`
### 4. Graph cutover production fixes + test migrations (from closed PR
#1869)
- `executor.ts`: `safeLogEntry()` wrapper prevents synchronous
`store.logEntry` throws from aborting pause/abort/finalize control flow
- `workflow-authoritative-driver.ts`: built-in auxiliary custom nodes
(completion-summary, optional-groups) pass through as success instead of
throwing
- Test migrations across engine, CLI, dashboard, and desktop for
graph-native runtime paths
## Verification
- All affected tests pass: engine (87 tests across 7 files), dashboard
(53 tests), plus the cherry-picked migration tests
- Merge gate (`pnpm test:gate`): 319 engine-core + 63 CI-shape tests
green
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for branching workflow content in more places, including
workflow creation and selection.
* Added a new shared runtime tool available to plan/review agents for
writing task prompts.
* **Bug Fixes**
* Improved task failure handling so retries now end cleanly instead of
bouncing through extra states.
* Made pause, recovery, and worktree-related behavior more reliable
during long-running operations and restarts.
* Updated Android release automation to use JDK 21.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Missing mock export (5 files, 17 tests):
- reviewer-prompt-single-source, plan-review-unavailable-recovery,
triage-fast-mode-workflow-variant, triage-stuck-requeue-preserve-draft,
restart.integration: add formatModelMarkerDetails to the ../pi.js mock.
Production code calls this after resolving an agent session, but the test
mocks were missing the export, causing all reviewer/triage/restart paths
to throw before reaching finalization assertions.
Outdated worktree assertions (2 files, 5 tests):
- worktree-acquisition-backend, worktree-acquisition-worktrunk: update
assertions for the new git symbolic-ref origin/HEAD resolution call and
the appended start point in git worktree add (worktree isolation fix).
Stale workflow compiler tests (1 file, 2 tests):
- workflow-routes: FN-7360 removed the linear compiler /compile endpoint
and made parseWorkflowIr the sole validity gate. Branching custom
workflows are now valid on the graph interpreter. Updated the two stale
tests that asserted 422 for branching IR to assert 201/200 instead.
Restore the board/list search affordance after users dismiss an active desktop search.
- Keep the non-mobile open-search button available once a closed search has an empty query.
- Cover empty-close and parent-cleared populated search flows in Header tests.
- Add a patch changeset for the published Fusion package.
Files changed:
.changeset/restore-board-search-trigger.md | 7 ++++
packages/dashboard/app/components/Header.tsx | 13 +++++---
.../app/components/__tests__/Header.test.tsx | 38 ++++++++++++++++++----
3 files changed, 46 insertions(+), 12 deletions(-)
Fusion-Task-Id: FN-7409
Fusion-Task-Lineage: 9cb4ff80-8490-43be-8d18-a3f292603ecb
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Prevent task-bound callers from soft-deleting the task they are currently executing.
- Add a TaskSelfDeleteError guard in TaskStore.deleteTask before mutation or audit emission.
- Pass the current task id through the fn_task_delete audit context so CLI tool calls inherit the store invariant.
- Cover self-delete rejection and cross-task deletion allowance in core and CLI tests.
- Add a patch changeset for the published CLI package.
Files changed:
.changeset/fn-7411-self-delete-guard.md | 7 +++
.../task-delete-allow-resurrection.test.ts | 48 ++++++++++++++++-
packages/cli/src/extension.ts | 2 +
.../src/__tests__/store-self-delete-guard.test.ts | 60 ++++++++++++++++++++++
packages/core/src/store.ts | 22 +++++++-
5 files changed, 136 insertions(+), 3 deletions(-)
Fusion-Task-Id: FN-7411
Fusion-Task-Lineage: 50028769-5396-4435-84fb-2ae182315e81
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Reviews no longer fail on formatting. Three changes to how reviewer/gate
verdicts are parsed and how retries reset state:
- Approval leniency: a review that clearly approves in prose passes even
without a structured verdict (proseSignalsClearApproval, with a
revise/reject/negated-approval guard so a rejection is never flipped). Any
APPROVE*/APPROVAL verdict token classifies as approved. Shared by the
reviewer/plan-review parser and the code-review/browser-verification gate.
- Prose + trailing JSON: extractJsonObjectCandidates does a string-aware
balanced-brace scan and prefers the last object, so a model that emits
reasoning prose then a trailing {"verdict":...} payload parses correctly.
An explicit "Verdict:" heading/line still takes precedence over an
incidental/example JSON object.
- Malformed handling: executeWorkflowStep retries the fallback model on
malformed output (not just timeout); malformed gate output becomes a
non-blocking advisory (a genuine parsed REVISE still blocks).
- Retry clears prior terminal step failures (incl. optional gate nodes like
code-review) after the task leaves the mergeable in-review column, so a
retry starts clean without an auto-merge race.
Fail-closed merge / PR-review / mission-verification gates are unchanged.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The initial-plan textarea gated duplicate createPlanningDraft calls only
on draftSessionIdRef, which is populated after the create round-trip
resolves. Keystrokes arriving while a create was in flight each passed the
guard and spawned a fresh draft. Add a synchronous draftCreateInFlightRef
sentinel that suppresses concurrent creates and clears on failure so a
later keystroke can retry. Includes an in-flight-concurrency regression test.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add TaskExecutor.blockOuterDispatchWhenEphemeralDisabled, gating all three
workflow dispatch paths (graph / authoritative / work-engine) on
ephemeralAgentsEnabled at the top of execute(). Previously the toggle was
enforced only on the legacy scheduler/EphemeralWorkerManager path — whose
onTaskStart spawn refusal is a fire-and-forget callback that runs after
execution begins — so unassigned tasks reaching execute() off a non-scheduler
path still ran. Unassigned tasks are now re-queued for permanent-agent
assignment; permanent-agent-bound tasks still run. Adds regression coverage
across all three entry points.
Also includes the ephemeralAgentsCanCreateTasks project setting (default on)
gating fn_task_create for ephemeral callers in both the pi extension and the
executor task-worker tool.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
A pre-merge-remediation/plan-replan node (e.g. code-review-remediation) is a
fire-and-forget async scheduler with no failure out-edge. When its schedule call
can't re-arm (missing rehydrated failureContext after restart,
remediation-not-scheduled, or an exhausted rework budget), the failure bubbled
out as the terminal graph outcome and handleGraphFailure stamped status:"failed"
— surfacing a spurious "Task Failed" even while the previously-scheduled
fix/reviewer session was still live.
Guard the terminal sink: skip the failed park when the failed node is a
remediation node AND a live agent session surface is still registered for the
task. Scoped via isRemediationGraphNode (IR workflowAction + built-in node-id
fallback) and hasLiveTaskSessionSurface; genuine execute/merge failures and
remediation failures with no live session still park failed unchanged.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The Activity view menu (Live/Feed/Raw) is position:fixed and portaled to
<body>, so it is anchored to the layout viewport. It was clamped using
window.visualViewport width/offset, which under pinch-zoom or an open mobile
keyboard diverges from the layout viewport and shoved the popup to the left of
the modal. Position it purely from the layout viewport
(document.documentElement.clientWidth/clientHeight) with no visual-viewport
offset so it stays under the "Activity" trigger.
Adds a regression test asserting the menu anchors under the trigger even when
the visual viewport diverges.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Desktop "Local" mode crashed with ERR_MODULE_NOT_FOUND because electron-builder's
pnpm collector drops `deduped` subtrees, so engine's transitive closure
(@modelcontextprotocol/sdk, pi-ai provider SDKs, etc.) was never packed. Stage the
complete flat prod closure with `pnpm deploy --legacy --config.node-linker=hoisted`
and package it via `electron-builder --projectDir deploy`, bypassing the lossy
collector entirely.
Also make the dashboard-imported example plugins loadable under plain Node (the
Electron main runtime): cursor/droid/roadmap now expose compiled `dist` on the
`import` condition (keeping `source`→src for the bun CLI) and are built during the
desktop build. Add `source` conditions to paperclip/agent-browser/even-cards/
even-realities-glasses/whatsapp-chat so the bun `--conditions=source` Windows CLI
compile resolves them from source.
Validated on macOS: @fusion/core|engine|dashboard import cleanly from the staged
deploy; packing yields a complete 705-package asar; bun-windows-x64 cross-compiles
with all plugin dist removed.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The CLI bun `--compile --conditions=source` build could not resolve
@fusion-plugin-examples/hermes-runtime and openclaw-runtime (statically imported
by dashboard routes.ts): those plugins lacked a `source` export condition and
fell through to `import`->dist/index.js, absent on the Windows runner. Add
`"source": "./src/index.ts"` (matching core/dashboard/engine/plugin-sdk) so bun
bundles their TS source directly, independent of dist.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The packaged desktop "Local" runtime dynamically imports @fusion/engine, whose
tsc dist is gitignored. desktop-windows.yml built only `@fusion/desktop build`
(no root `pnpm build`), so it packaged an empty engine/dist and the app crashed
on Local mode with ERR_MODULE_NOT_FOUND for app.asar/node_modules/@fusion/engine.
Make the desktop build self-contained (build core then engine before packaging)
and add the parity `pnpm build` step to desktop-windows.yml.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Fixes#1863.
The issue conflated **two distinct v0.52.0 regressions** (the reporter's
i18n root-cause guess was only half of it).
## 1. The real triage loop — engine (primary fix)
The `completion-summary` graph node was added to every built-in workflow
in v0.52.0 (FN-7228/FN-7233), wired with a **success-only edge — no
failure edge**. It's a *best-effort* node
(`ensureWorkflowCompletionSummary` already backfills `task.summary`),
but two failure paths bypass its advisory `!blocking → success`
coercion:
- a **thrown handler exception** (e.g. missing worktree) →
`executeNodeWithRetries` returns `value:"exception"`
- a **failed summary projection write** →
`publishTaskProjectionFromResult` returns `value:"projection-error"`
With no failure edge, either **terminates the graph at
`completion-summary`**. `routeGraphFailureToExecutionResume` then treats
the in-review failure as recoverable and moves the task back to `todo`,
which replays the already-passed nodes (0 new tokens) and fails again —
the **infinite `triage → in-progress → todo` loop** in the report (token
usage 0, execution NOT STARTED).
**Fix:** the graph executor now degrades a `completion-summary` node
failure to `success` so the graph always advances, with a
`routeGraphFailureToExecutionResume` backstop that parks `failed`
instead of looping. Shared `isCompletionSummaryNode` predicate exported
from `@fusion/core`.
## 2. The i18n crash the reporter saw — dashboard
`t("taskDetail.executionMode")` resolves to a **nested object** (the
inline mode-toggle copy), so i18next returns *"key
'taskDetail.executionMode (en)' returned an object instead of string"*
and crashes the Stats tab — the exact error in the report. Surface
enumeration found **two more** callers of the same class:
`routing.source` and `nodes.dockerHost`. Added leaf label keys across
all 6 locales and switched the callers.
## Tests
- `workflow-graph-completion-summary-nonfatal.test.ts` — a failing
summary node (both modes) never terminates/loops the graph, a
non-summary node still fails, and all 5 built-ins have no failure edge.
**Fails without the engine fix.**
- `i18n-string-keys-not-objects.test.ts` — invariant guard scanning
every `t("literal")` caller against the real `en/app.json`. **Catches a
reverted caller.**
- `TaskTokenStatsPanel.test.tsx` — reproduces the exact i18next error
against the real bundle.
## Verification
- Merge gate: **317 engine-core + 63 CI-shape pass**
- Core/engine typecheck clean; i18n parity + typecheck pass; changeset
validates
- All touched dashboard/core/engine suites green
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed an issue where completion-summary failures could cause tasks to
loop indefinitely during resume.
* Made completion-summary behavior best-effort so workflows keep
progressing even when summary handling fails.
* Prevented dashboard crashes by ensuring UI labels use leaf translation
keys (not nested objects).
* **New Features**
* Added missing i18n label keys for Docker host, routing source, and
execution mode across multiple languages.
* **Tests**
* Added regression coverage for completion-summary non-fatal handling
and translation-key validation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
