Compound learning: the claude-code-cli-acp bridge returned 'Not logged in'
despite a working claude -p, due to (1) a too-thin spawn env (needs XDG_*/USER/
SHELL beyond HOME/PATH) and (2) macOS login-Keychain session isolation for
detached/headless processes. Six headless tasks misdiagnosed it as an upstream
gap. Cross-linked from the ACP runtime integration pattern doc.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Two-reviewer pass (security + architecture) on KTD10 + the full Route A
increment: no code defects, no P0, merge-ready as a dormant increment. Applying
the P1 follow-ups:
- Add the feature changeset (@runfusion/fusion minor) — the one convention gap.
- KTD10 tests: fail-closed (bridge not resolved -> env stays unset -> -p) and
idempotency (second onLoad keeps the first published path).
- Document the two intentional, parallel MCP-forwarding paths (U10 engine-adapter
vs U11 provider-driver) so nobody double-forwards, and the known
ACP-path-token-usage=0 residual so U12 doesn't treat it as a bug.
Reviewers confirmed: dormancy invariant holds end-to-end (nothing sets
FUSION_CLAUDE_ACP=1; both flag+path required; -p is the default); OAuth pi path
untouched. 206/206 plugin tests, 333/333 pi-claude-cli tests, typecheck clean.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Live run: forwarded MCP tools and native Bash both refuse to execute when we
return cancelled to session/request_permission (no TOCTOU). streamViaAcp's
deny-by-default + break-early is verified safe. Env allow-list (incl. XDG/USER)
validated as required for the bridged claude to authenticate.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Reverse-engineered the streamViaCli contract and locked the U11 build plan:
AssistantMessageEventStream shape to match, the kill-switch branch point in
streamSimple, the KTD10 injection seam (pi-claude-cli adds @agentclientprotocol/sdk;
bridge path injected like mcpConfigPath), MCP-server construction reusing
ensureMcpConfig, full-history prompting (R13), ACP->pi event translation
paralleling event-bridge.ts, and live-bridge verification via the U9 harness.
No transport change yet — the live `claude -p` path is untouched.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Route A unblock + the first Route A code increment.
- U9 verdict recorded (plan OQ1 + docs/acp-contract.md): in an authenticated
interactive session the pinned claude-code-cli-acp 0.1.1 bridge forwards
session/new mcpServers to Claude, Claude invokes the forwarded Fusion tool,
and the call traverses the ACP permission gate (session/request_permission).
Both security-critical answers resolve positively — overturns the headless
NOT-GO chain (FN-6466/6467/6473/6476), whose only blocker was running
detached from the login keychain session.
- R17 (daemon auth) recorded and closed for the supported setup: creds are
macOS Keychain-only; the user's login-session fn daemon has keychain access
(the existing claude -p provider authenticates there), so the bridge does too.
- U10: thread an optional mcpServers list through the ACP runtime contract.
newAcpSession now forwards it (was hardcoded []); AgentRuntimeOptions (engine
+ plugin-local copy) gains the field; defaults to [] to preserve Route B's
read-only ask posture. Tool calls still route through the U5 permission floor.
Plugin typechecks clean; provider-session tests 12/12 (incl. 2 new forwarding
tests). U11-U13 (provider transport swap, picker/auth, workflow verify) remain.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Index the upstream ACP MCP forwarding sponsorship doc so the docs README and CLI index test keep it discoverable.
- Add the upstream ACP MCP passthrough and permission forwarding sponsorship doc link under Audit Reports.
- Add the upstream doc to the required docs README index coverage.
- Guard that CLI Printing Press docs remain indexed in Audit Reports only, not duplicated under Plugins.
Files changed:
docs/README.md | 5 +++++
.../cli/src/__tests__/docs-readme-index.test.ts | 21 +++++++++++++++++++++
2 files changed, 26 insertions(+)
Fusion-Task-Id: FN-6479
Fusion-Task-Lineage: f23afeba-a989-4552-8857-fe2984df6081
Document the authenticated ACP bridge rerun attempt and preserve the Route A blocked verdict.
- Update the ACP contract with FN-6476 readiness proof results showing the pinned bridge still reports an unauthenticated Claude session.
- Keep OQ1 answers unresolved because no forwarded Fusion tool invocation or permission-gate traversal was observed.
- Add FN-6476 status notes to the Claude ACP runtime plan so U9 remains NOT GO without a claude -p fallback.
Files changed:
docs/acp-contract.md | 11 ++++++++++-
docs/plans/2026-06-14-001-feat-claude-acp-runtime-plan.md | 3 +++
2 files changed, 13 insertions(+), 1 deletion(-)
Fusion-Task-Id: FN-6476
Fusion-Task-Lineage: f37dcc62-9758-47af-bb50-169e902211a5
Record the upstream sponsorship package for ACP MCP passthrough and permission gating while keeping Route A blocked.\n\n- Add a ready-to-file upstream issue for claude-code-cli-acp MCP passthrough and permission-forwarding support.\n- Link the filed upstream issue from the ACP contract and runtime plan.\n- Preserve the OQ1/U9 NOT GO status until authenticated reruns prove forwarded tool invocation and gating.\n\nFiles changed:\n docs/acp-contract.md | 5 +\n .../2026-06-14-001-feat-claude-acp-runtime-plan.md | 3 +\n ...laude-code-cli-acp-mcp-permission-forwarding.md | 121 +++++++++++++++++++++\n 3 files changed, 129 insertions(+)
Fusion-Task-Id: FN-6475
Fusion-Task-Lineage: 3cbd14e3-9388-4cf4-b256-3678459eb926
Record the authenticated Route A ACP escalation rerun and keep U9 blocked.
- Update the ACP contract OQ1 status to FN-6473 with the observed unauthenticated bridge result.
- Capture the explicit request-permission instrumentation outcome: zero forwarded tool calls and zero permission callbacks.
- Extend the Claude ACP runtime plan with the escalation status and upstream bridge/ACP permission-forwarding requirement.
Files changed:
docs/acp-contract.md | 13 +++++++++++--
docs/plans/2026-06-14-001-feat-claude-acp-runtime-plan.md | 3 +++
2 files changed, 14 insertions(+), 2 deletions(-)
Fusion-Task-Id: FN-6473
Fusion-Task-Lineage: 2e6ec23b-a9cd-4fd0-b24e-72ee8bb145ac
Record the FN-6467 U9 rerun outcome so Route A remains gated on authenticated ACP bridge evidence.
- Document the second direct bridge attempt against claude 2.1.177 and claude-code-cli-acp 0.1.1.
- Preserve the accepted 62-tool custom-tools MCP payload details and lockfile integrity evidence.
- Mark forwarded tool invocation and ACP permission-gate traversal as unresolved because the bridge still reports Not logged in.
Files changed:
docs/acp-contract.md | 15 ++++++++++-----
docs/plans/2026-06-14-001-feat-claude-acp-runtime-plan.md | 3 +++
2 files changed, 13 insertions(+), 5 deletions(-)
Fusion-Task-Id: FN-6467
Fusion-Task-Lineage: fa2c1e16-7822-421b-80cf-e4ab247641a5
Record the real Route A U9 bridge attempt and keep OQ1 at NOT GO.
- Document that claude-code-cli-acp accepted a non-empty Fusion MCP server declaration.
- Capture the unauthenticated claude blocker before forwarded tool invocation or permission telemetry.
- Keep FN-6460 blocked until an authenticated rerun proves tool forwarding and ACP permission traversal.
Files changed:
docs/acp-contract.md | 13 +++++++++++--
docs/plans/2026-06-14-001-feat-claude-acp-runtime-plan.md | 3 +++
2 files changed, 14 insertions(+), 2 deletions(-)
Fusion-Task-Id: FN-6466
Fusion-Task-Lineage: 0bce3b9f-fbab-4562-9a7b-9d5551335fa4
Record the unrecovered Route A U9 verdict and the design-only U14 confirmation so follow-up work preserves the ACP permission-gate blocker.\n\n- Add an ACP contract open-question entry that marks Route A as NOT GO until real MCP forwarding and ACP permission-gate traversal are proven.\n- Capture the FN-6465 recovery outcome in the Claude ACP runtime plan, including the missing FN-6459 evidence and required rerun criteria.\n- Confirm the internal Route A design mechanisms while keeping implementation blocked on U9.\n\nFiles changed:\n docs/acp-contract.md | 24 ++++++++++++++++++++++\n .../2026-06-14-001-feat-claude-acp-runtime-plan.md | 9 ++++++++\n 2 files changed, 33 insertions(+)
Fusion-Task-Id: FN-6465
Fusion-Task-Lineage: d4762440-cbb9-4206-b4b2-be578eba30dd
Document the restored FN-6437 proof-point results in the external plugin runbook.
- Replace the pending-verification placeholder with the recorded NOT MET verdict for @runfusion/fusion@0.43.0.
- Add package, integrity, environment, command, scaffold, and TypeScript failure evidence from the restored report.
- Preserve explicit gaps for list/enable proof and follow-up checks that were blocked by the released scaffold failure.
Files changed:
docs/plugins/external-proof-point-runbook.md | 132 +++++++++++++++++++++++++--
1 file changed, 124 insertions(+), 8 deletions(-)
Fusion-Task-Id: FN-6452
Fusion-Task-Lineage: 14d3b848-59cd-43bb-b725-6586182906ee
Add a durable proof-point runbook for validating external plugins against released Fusion CLI builds.
- Document release selection, npm integrity capture, scaffold/build/test/install/enable validation, and pass/fail criteria for external plugin proof points.
- Link the runbook from the docs index so it remains discoverable with other plugin authoring docs.
- Extend the docs README index test to require the new proof-point runbook entry.
Files changed:
docs/README.md | 1 +
docs/plugins/external-proof-point-runbook.md | 211 +++++++++++++++++++++
.../cli/src/__tests__/docs-readme-index.test.ts | 1 +
3 files changed, 213 insertions(+)
Fusion-Task-Id: FN-6438
Fusion-Task-Lineage: 5c768d7e-4465-42ac-9535-f16dc42ab6d0
Add a fast guard that rejects Vitest timeout bumps in tracked test files.
- Add a test-timeout appeasement scanner with a temporary allowlist for legacy exemptions.
- Run the scanner in pretest, pretest:full, and test:gate so merge gates catch timeout bumps.
- Cover the scanner behavior with node:test cases and document the policy/remediation path.
Files changed:
docs/testing.md | 6 ++
package.json | 6 +-
.../check-no-test-timeout-appeasement.test.mjs | 49 +++++++++
scripts/check-no-test-timeout-appeasement.mjs | 119 +++++++++++++++++++++
.../lib/test-timeout-appeasement-allowlist.json | 10 ++
5 files changed, 187 insertions(+), 3 deletions(-)
Fusion-Task-Id: FN-6434
Fusion-Task-Lineage: deb46a27-b0c9-4644-b8bb-34ce98e7acde
Prevent the terminal symbols font from corrupting ASCII cell measurement on mobile.\n\n- Add unicode-range scoping to the Fusion terminal Nerd Font symbols face.\n- Cover the CSS contract so symbols ranges include Nerd Font blocks and exclude printable ASCII.\n- Document the xterm font-loading regression and required verification path.\n\nFiles changed:\n .../xterm-symbols-nerd-font-unicode-range.md | 63 ++++++++++++++++++++++\n .../dashboard/app/__tests__/terminal-input.test.ts | 49 +++++++++++++++++\n .../dashboard/app/components/TerminalModal.css | 5 ++\n 3 files changed, 117 insertions(+)
Fusion-Task-Id: FN-6424
Fusion-Task-Lineage: 7350c926-1d51-474b-bfc3-a17f922b9322
Enable the task-detail Chat composer to submit messages with standard Enter behavior.
- Submit non-empty task chat drafts on plain Enter while preserving Shift+Enter newline entry and IME composition safety.
- Keep Cmd/Ctrl+Enter as a supported send path through the same handler.
- Document the composer keyboard shortcuts and add dashboard tests for steering, refinement, newline, shortcut, and composition behavior.
- Add a patch changeset for the published Fusion package.
Files changed:
.changeset/tiny-tasks-chat-enter.md | 5 +
docs/dashboard-guide.md | 2 +-
packages/dashboard/app/components/TaskChatTab.tsx | 13 ++-
.../app/components/__tests__/TaskChatTab.test.tsx | 120 +++++++++++++++++++++
4 files changed, 136 insertions(+), 4 deletions(-)
Fusion-Task-Id: FN-6415
Fusion-Task-Lineage: 7d200bf6-5130-4fb8-b59c-66bccffe4265
Document the root cause (offset-less position:absolute sr-only utility
escaping the kanban board's overflow clip and inflating
documentElement.scrollWidth → iOS shrink-to-fit zoom), the top/left:0 fix,
and the CSS-fixture regression guard. Cross-links the sibling mobile
viewport-containment learnings.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Ensure workflow-mode boards fill the mobile viewport while preserving internal column scrolling.
- Reassert the mobile flex fill chain for project content, workflow board wrappers, and workflow columns.
- Extend mobile board regression coverage across empty/populated workflow states with and without the toolbar.
- Document the workflow board collapse root cause and add a transient temp-dir isolation guard test.
Files changed:
docs/dashboard-guide.md | 1 +
.../ui-bugs/mobile-workflow-board-fill-chain.md | 61 +++++++++++++
.../__tests__/board-mobile-initial-render.test.tsx | 101 +++++++++++++++++++++
packages/dashboard/app/styles.css | 52 +++++++++++
scripts/__tests__/check-test-isolation.test.mjs | 23 +++++
scripts/check-test-isolation.mjs | 12 ++-
6 files changed, 249 insertions(+), 1 deletion(-)
Fusion-Task-Id: FN-6397
Fusion-Task-Lineage: ddee773d-6d3a-46d1-b1c7-f601a961365e
Resolves the onLoad conflict in the compound-engineering plugin by keeping both
the bundled ce-* persona-def install (this branch) and main's
recoverStaleSessionsForContext call.
Also addresses PR #1672 review feedback:
- executor: sentinel resume now guards on !live.paused (mirrors
runAwaitInputNode) so a still-paused task can't consume a reply and re-enter
the skill early.
- TaskCard: make the Answer-questions button text/title/aria-label fallbacks
consistent ("Answer questions") for label-in-name a11y; update test.
- ce-work: replace the unshipped `skill: ce-worktree` reference with the real
git worktree commands so Option B can't dead-end.
- ce-resolve-pr-feedback: invoke bundled scripts by absolute path via the new
FUSION_CE_SKILLS_DIR env (sessions run with cwd=projectRoot); add the Fusion
await-input sentinel path instead of AskUserQuestion for workflow steps;
normalize whitespace-only review bodies like PR comments.
- plugin: expose FUSION_CE_SKILLS_DIR (installed skills root) to step sessions.
- plan doc: add language to fenced block (markdownlint MD040).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
main's workflow-graph-executor now collapses the merge-policy region
(merge-gate, branch-group-*, merge-attempt) into a single synthetic
`merge` node. Reconcile the S05 work-item-driver test's visitedNodeIds
assertion to match, and union the `observed` recording-primitive fields
from both branches (executedTasks + merge attempt/run/workflow ids).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- watchdog: escalate forwarded SIGINT/SIGTERM/SIGHUP to SIGKILL after grace so
external cancellation can't hang for the full budget (coderabbit major)
- watchdog: route onProcExit through signalGroup for injection consistency (greptile)
- watchdog: add cwd option; test-changed passes rootDir so pnpm runs from repo
root regardless of invocation cwd (coderabbit major — preserved original run() cwd)
- dashboard runner: validate/clamp FUSION_RUN_VITEST_* env so a malformed value
can't NaN-disable the watchdog (coderabbit)
- tests: verify exit-listener cleanup, forwarded-signal escalation, cwd passthrough
- plan doc: per-class-ceiling fallback wording (not median); label Output Structure fence
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Styles the simple workflow editor so its mobile-style controls are available and documented across desktop and narrow layouts.
- Move simple editor tab, add, action, and touch-target styling out of the mobile-only media query.
- Cover desktop simple editor affordances for custom and built-in workflows with regression tests.
- Document desktop simple editor tabs and the surfaced workflow action buttons.
Files changed:
docs/dashboard-guide.md | 6 +-
.../app/components/WorkflowNodeEditor.css | 286 +++++++++++----------
.../__tests__/WorkflowNodeEditor.test.tsx | 53 ++++
3 files changed, 201 insertions(+), 144 deletions(-)
Fusion-Task-Id: FN-6381
Fusion-Task-Lineage: fd7f1ada-6e50-4d92-b455-7f38fb46c1e2
