Sonnet 5 had disappeared from every surface: pi-ai 0.79.9 (the installed
version) lacks it, and FN-7374 removed the static row expecting the live
registry to carry it. Live-verified that claude-sonnet-5 returns 200 on
api.anthropic.com/v1 with a raw ANTHROPIC_API_KEY and runs via the Claude
CLI (it 403s on subscription-OAuth /v1 — scope-gated; runtime fallback
applies). Note: pi-ai 0.80.3 ships sonnet-5 natively, so this SUPPLEMENTAL
row dedupes once the install catches up.
- core: re-add claude-sonnet-5 to SUPPLEMENTAL_ANTHROPIC_PROVIDER_REGISTRATION
and restore its static pricing (revert FN-7374); update pricing tests.
- engine/dashboard tests: flip the FN-7374 "withheld" assertions to the
restored "advertised" behavior.
PR feedback:
- Trim the two FNXC comments (auth-storage.ts, pi.ts) to concise
requirement prose per coding guidelines (CodeRabbit).
- Replace the now-inert getApiKey mock in two subscription routing tests
with a clarifying note (Greptile).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude subscription (Max/Pro) chats regressed to 404/502/429 because
FN-7396 rerouted subscription OAuth to a /v1-based `anthropic-subscription`
runtime provider — reintroducing issue #1857 that FN-7391 had fixed. Both
routed the OAuth token to api.anthropic.com/v1, the surface that broke.
Proven in code that v0.51.0 (working) sent subscription OAuth directly to
/v1 via pi-ai's built-in `anthropic` provider (Claude Code impersonation:
Bearer + anthropic-beta oauth headers), NOT through the CLI. Restore that:
- auth-storage: getApiKey("anthropic") resolves subscription/legacy OAuth
again (raw API key still wins), so the built-in provider gets the token.
- pi.ts: remove the runtime reroute and the /v1 `anthropic-subscription`
execution provider so anthropic/* selections stay on the built-in provider.
- register-model-routes: advertise `anthropic` for OAuth users so direct
OAuth is selectable in the picker.
Three independent surfaces, no rerouting: direct OAuth, raw ANTHROPIC_API_KEY
(precedence), and explicit pi-claude-cli.
Fixes#1857
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Keep Anthropic OAuth subscription credentials away from the direct /v1 provider while preserving raw API-key routing.
- Treat direct anthropic auth as raw API-key-only in auth storage and model discovery.
- Re-route persisted anthropic model selections to the Claude CLI provider when no raw Anthropic API key is configured.
- Add regression coverage for OAuth-only routing, raw API-key preservation, and provider list separation.
- Document the distinct raw API key, OAuth subscription, and Claude CLI routes.
Files changed:
.../fn-7391-anthropic-subscription-cli-routing.md | 7 ++
docs/settings-reference.md | 2 +-
.../dashboard/src/__tests__/routes-auth.test.ts | 74 ++++++++++++++
.../dashboard/src/routes/register-model-routes.ts | 27 +++++-
packages/engine/src/__tests__/auth-storage.test.ts | 108 +++++++--------------
.../src/__tests__/pi-create-fn-agent.test.ts | 100 +++++++++++++++++++
packages/engine/src/auth-storage.ts | 45 ++++-----
packages/engine/src/pi.ts | 61 ++++++++++++
8 files changed, 319 insertions(+), 105 deletions(-)
Fusion-Task-Id: FN-7391
Fusion-Task-Lineage: d1fecc2d-7f31-408c-bf65-0e65b7fd88b1
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
## Summary
- add an opt-in `allowAnswerQuestionIdDrift` flag for interactive AI
sessions
- keep strict question-id validation by default
- enable the tolerance only for Compound Engineering recovered sessions
so persisted session rows can answer after dashboard
restarts/non-deterministic rehydration
## Test Plan
- `corepack pnpm --filter @fusion/engine exec vitest run
src/__tests__/interactive-ai-session.test.ts --silent=passed-only
--reporter=dot`
- `corepack pnpm --filter @fusion/engine typecheck`
- `corepack pnpm --filter @fusion-plugin-examples/compound-engineering
build`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Improved interactive session recovery so persisted answers can
continue after dashboard restarts, even if the question ID changes
during rehydration.
* Keeps strict question-ID validation by default; mismatches still fail
unless drift is explicitly allowed.
* **New Features**
* Added `allowAnswerQuestionIdDrift` option to permit accepting the
persisted question ID during recovered session answering.
* **Tests**
* Added/updated coverage for strict mismatch error behavior and the
successful completion path when drift is enabled.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
The step execution engine was already gone (runWorkflowSteps deleted,
workflow_steps table dropped in migration 132). This removes what remained:
the linear step compiler (compileWorkflowToSteps/validateLinearity/
WorkflowCompileError), which survived only as a validator + step-preview
generator.
parseWorkflowIr/validateV2 (which accepts branching graphs) is now the sole
workflow validity gate at save/select/refine and in the graph task runner.
Custom branching workflows are now selectable and run on the graph
interpreter instead of being rejected as non-linear.
- core: delete workflow-compiler.ts; rework store.validateWorkflowCompilable
onto parseWorkflowIr; move MERGE_REGION_NODE_KINDS into
workflow-lifecycle-validation; retag workflow-steps-to-ir as legacy lowering
- engine: drop the compiler double-validation in workflow-graph-task-runner
- dashboard: remove POST /api/workflows/:id/compile + client wrapper; drop the
interpreterOnly response field and editor banner; no post-save compile check
- i18n: remove the orphaned workflowNodes.interpreterOnly key across locales
- tests: reframe two workflow-selection tests whose premise inverted; fix a
pre-existing red in builtin-lead-generation (completion-summary node)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Auto-merge finalization now ignores stale branch-only residue once durable merge proof exists, so squash-landed tasks do not stay stuck in review because their task branch history is noisy.
Fusion-Task-Id: FN-7360
Pin fresh task worktree creation to the resolved integration branch when no explicit executionStartBranch is present, so ambient root checkout state cannot leak sibling task commits into new branches.
Use task baseCommitSha for merge-finalization branch proof when available, allowing already-landed mergeConfirmed tasks to finalize even if historical branch ancestry contains foreign commits.
Fusion-Task-Id: FN-7360
Classify structured provider model-not-found payloads as model-selection failures so configured fallback models run when Claude Sonnet 5 is unavailable on an account or API surface.
Anthropic model requests now resolve subscription OAuth credentials when no raw API key is present.
- Route Anthropic runtime auth through raw API keys, legacy OAuth, subscription OAuth, models.json, and fallback resolver sources with explicit logout precedence.
- Refresh subscription OAuth using the Anthropic OAuth provider while persisting rotated tokens under the subscription storage id.
- Cover subscription alias resolution, logout behavior, fallback visibility, refresh persistence, and reload behavior with auth-storage tests.
- Add a patch changeset for the published Fusion CLI package.
Files changed:
.../fn-7292-anthropic-subscription-runtime-auth.md | 7 +
packages/engine/src/__tests__/auth-storage.test.ts | 357 +++++++++++++++++++++
packages/engine/src/auth-storage.ts | 266 ++++++++++++---
3 files changed, 577 insertions(+), 53 deletions(-)
Fusion-Task-Id: FN-7292
Fusion-Task-Lineage: c98c2f1c-8297-4473-ba66-5b6320bc0c00
Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>
Block the merge requester when fast workflow traversal reaches merge before implementation steps are complete, and recover stale no-op merge proof by requeuing executable work instead of looping in blocked finalization.
Fusion-Task-Id: FN-7261
reconcilePhantomCommittedReservations emitted a task:reconcile-phantom-committed-reservation audit row every maintenance tick for the same orphaned committed reservations even when zero child rows were pruned (~19k no-op writes/day). Gate the audit emission on actual pruned work; the FN-7069 contract is unchanged (committed reservation stays committed so the ID is never reused).
clearPhantomExecutorBinding unconditionally unregistered held worktree paths from activeSessionRegistry, defeating the moveTask(preserveWorktree:true) the self-healing phantom reclaim pairs it with: re-dispatch then acquired a brand-new worktree instead of reattaching (FN-7249 lost its first worktree this way). Add a preserveWorktrees option that clears only the stale in-memory executor/lock bookkeeping and leaves the session-registry path entries intact; the self-healing caller opts in. Non-self-healing callers keep the default full-clear behavior.
## Summary
Task image artifacts can now complete the full loop: agents and chat
flows can register base64 image bytes, and task details can display
those artifacts with an expandable preview instead of leaving them as
undiscoverable metadata.
This keeps binary payloads on the existing managed artifact storage
path, validates that base64 payloads are real non-empty image data, and
documents the new `dataBase64` field for engine-tool callers. The task
details artifacts gallery now treats image cards as expandable while
leaving document, audio, video, and generic artifact cards on their
existing behavior.
## Validation
- `pnpm --filter @fusion/dashboard exec vitest run
app/components/__tests__/TaskDocumentsTab.test.tsx
src/routes/__tests__/artifacts-route-integration.test.ts
--silent=passed-only --reporter=dot`
- `pnpm --filter @fusion/engine exec vitest run
src/__tests__/agent-artifact-tools.test.ts --silent=passed-only
--reporter=dot`
---
[](https://github.com/EveryInc/compound-engineering-plugin)
<!-- stage-review-badge-begin -->
---
<a href="https://stagereview.app/Runfusion/Fusion/pull/1821">
<picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://stagereview.app/assets/gh-open-in-stage-dark.svg">
<img src="https://stagereview.app/assets/gh-open-in-stage-light.svg"
alt="Open in Stage">
</picture>
</a>
<!-- stage-review-badge-end -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added inline base64 (`dataBase64`) support for registering image
artifacts from agent tools, including task-scoped chat registration.
* Task details now allow expanding image media artifacts in a preview
lightbox with accessible keyboard interaction.
* **Bug Fixes**
* Improved verification for media streaming by validating raw binary
responses; added HTTP 200/404 coverage for image endpoints.
* **Documentation**
* Updated `fn_artifact_register` tool documentation to include the
optional `dataBase64` parameter.
* **Tests**
* Added coverage for base64 validation/error handling and lightbox
expand/close behavior (including Escape and Tab focus trapping).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
