Add explicit OpenAI Codex pricing so token analytics can estimate Codex run costs.
- Add openai-codex pricing entries for GPT-5 Codex variants and codex-mini-latest.
- Bump the pricing verification date and document why Codex keys must use the openai-codex provider.
- Cover Codex pricing and lookup behavior in model-pricing tests.
- Add a changeset for the published Fusion package.
Files changed:
.changeset/fn-6869-codex-pricing.md | 7 ++++
packages/core/src/__tests__/model-pricing.test.ts | 37 ++++++++++++++++++-
packages/core/src/model-pricing.ts | 44 ++++++++++++++++++++++-
3 files changed, 86 insertions(+), 2 deletions(-)
Fusion-Task-Id: FN-6869
Fusion-Task-Lineage: 4bf119db-0401-4b18-b389-4a762e665cfc
stuckKillCount is a lifetime counter — incremented by self-healing on each stuck-kill
and reset ONLY by a manual retry — so a long task that genuinely advances between
intermittent stalls could be terminalized by accumulation toward maxStuckKills (default 6),
even though it is making progress.
Reset the streak in TaskStore.updateStep when a step reaches a terminal forward status
(done/skipped), the single chokepoint every step-completion surface routes through (legacy
fn_task_update, graph markStepDone, fn_task_done). It deliberately does NOT rescue a task
wedged re-running the same failing step — no step completes between those kills, so it still
terminalizes as designed; it only bounds the budget to consecutive stalls. Complements the
verification fan-out cap (PR #1708) that keeps verification fast in the first place.
New regression suite asserts reset on done/skipped/graph-source-done and NO reset on
in-progress advance or ignored out-of-order transitions. Merge gate + full @fusion/core
suite (6242 tests) + engine self-healing/stuck-detector (442 tests) green.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Tighten the executor agent guidance and the fn_run_verification tool guidance so
verification stays scoped to changed files instead of running the full workspace
test suite, which (for a foundational-package edit) reverse-expands across the
whole workspace and stalls the task.
- agent-prompts.ts: remove the "during final integration" blanket permission to
run workspace-wide suites; name the forbidden full-run commands explicitly.
- run-verification-tool.ts: strengthen BOUNDED_VERIFICATION_GUIDANCE to forbid
`pnpm test:full` / `pnpm verify:workspace` / whole-package runs as verification.
Engine + core typecheck pass; run-verification-command and executor-review-verdicts
prompt-assertion suites stay green (93 tests).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The per-test `createTaskStoreTestHarness` recreated a TaskStore from scratch
every test — mkdtemp ×2 + new store + recursive rm with retry backoff — which
dominated wall-clock across these high-test-count files. Switch the files that
tolerate a shared store to `createSharedTaskStoreTestHarness`, which builds the
store once and resets state between tests via full table truncation + FTS
rebuild + filesystem reset, preserving isolation.
Measured on store-create.test.ts (53 tests): 4.44s → 1.78s wall
(test execution 3.59s → 0.93s, ~3.9x). Full @fusion/core suite stays green
(346 files, 6236 tests) and typecheck passes.
19 files that test disk persistence / migration / workflow-definition state are
incompatible with a shared in-memory store and were intentionally left on the
per-test harness.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- FNXC requirement-trace comments on the stepwise workflow-step seam,
the flowToIr v2-signal/byte-identity contract, and TaskForm's
optional-steps create-mode behavior
Resolve conflicts from main's analytics schema additions (plugin
activations, per-model token buckets) against the PR's contract-assertion
type column:
- db.ts: renumber behavioral-verification migration 124 -> 126, bump
SCHEMA_VERSION to 126 so it follows main's migrations 124/125
- core/roadmap tests: adopt main's SCHEMA_VERSION-constant assertions
instead of stale literal 124
- test-quarantine.json: keep all four quarantine entries from both sides
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- step() test helper now carries skillName, so the WS-6 round-trip fixture
actually exercises the INVERSION CONTRACT for skillName (was silently dropped).
- executeWorkflowStep now strips an inherited FUSION_HEADLESS on board runs
(unattended=false), preserving the U3 default-safe invariant — a board step
nested under a headless-env parent could otherwise skip user questions.
Added a regression test for the inherited-env strip.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The stepwise-coding IR had no workflow-step seam node, so a per-task
enabledWorkflowSteps entry (e.g. browser verification) would never execute.
Add the seam node on the success path (steps -> workflow-step -> review,
once post-foreach) and declare browser-verification as an optional step,
matching the coding workflow. Covers the dead-toggle gap with resolver and
engine execution-divergence tests.
Address confirmed code-review findings on the CE workflow-step change:
- Graph-path spawn lifecycle (adversarial A-1/A-2): the graph path returns from
execute() before its outer finally that calls terminateAllChildren, so U8's new
coding-mode fn_spawn_agent children orphaned their sessions/worktrees and their
ids accumulated in the per-parent spawn budget, starving later steps' fan-out.
Call terminateAllChildren in maybeExecuteWorkflowGraph's finally (mirrors the
non-graph cleanup).
- INVERSION CONTRACT parity (api-contract AC-2 + testing TF-001): add skillName to
the workflow-steps-to-ir round-trip projections + a skill-step fixture, so the
contract the comment claims is actually asserted.
- Silent skill-load degradation (adversarial A-3 / Risk-4): warn when a step names
a skill but FUSION_CE_SKILLS_DIR is unset, instead of failing silent.
- Dead branch (maintainability M-01): drop the always-false unattendedRun guard;
keep the delete + extension-point comment.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
plan and code-review need coding so ce-plan/ce-code-review can fan out to their
persona subagents via fn_spawn_agent; document needs coding so ce-compound can
write docs/solutions. Test asserts the tool modes and that skillName is carried
onto the compiled steps.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add skillName to WorkflowStep and WorkflowStepInput, and round-trip it through
nodeToStepInput / stepInputToNode so a skill-executor node's skill is available
to the step session. Honors the compiler INVERSION CONTRACT (parity test).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add the Shadcn color family to dashboard theme selection and persisted theme validation.
- Register blue, green, red, purple, pink, orange, yellow, mono, and black Shadcn theme IDs across core and dashboard selectors.
- Add swatches and CSS token blocks for light and dark variants, including bootstrap loading coverage.
- Document the expanded theme count and include a minor changeset for the published CLI package.
Files changed:
.changeset/shadcn-color-variants.md | 5 +
docs/dashboard-guide.md | 2 +-
packages/core/src/types.ts | 10 +
.../dashboard/app/components/ThemeSelector.css | 126 +++
packages/dashboard/app/components/themeOptions.ts | 9 +
.../dashboard/app/hooks/__tests__/useTheme.test.ts | 41 +
packages/dashboard/app/index.html | 2 +-
packages/dashboard/app/public/theme-data.css | 1177 ++++++++++++++++++++
8 files changed, 1370 insertions(+), 2 deletions(-)
Fusion-Task-Id: FN-6756
Fusion-Task-Lineage: 143e717a-9718-419f-a6c5-34305e53c65d
Addresses review feedback (Greptile P1/P2, CodeRabbit) on the async
background integrity check. All three issues shared one root cause:
state read/cleared from a pre-await snapshot across the async boundary.
- Closed-instance race (P1): runBackgroundIntegrityCheck guards `this.closed`
before every in-process integrityCheck() call (both before the offload and
after the await). A connection closing mid-offload no longer throws out of
the scheduler.
- Stuck-pending on throw + late-subscriber race (P1/P2): the scheduler now
clears integrityCheckPending UNCONDITIONALLY in a finally, iterating the
CURRENT shared.subscribers set rather than a pre-await snapshot. A thrown
check, or a Database that subscribed during the seconds-long await window,
can no longer be left pinned at integrityCheckPending=true forever.
- No spawn timeout (P2): integrityCheckSqliteFileAsync now passes
AbortSignal.timeout(5m); a disk-stalled/hung sqlite3 child always settles
the promise (→ verified:false fallback) instead of leaking and stranding
the shared entry. AbortSignal.timeout's timer is unref'd, so it never keeps
the process alive at shutdown.
- FNXC markers added to the two new symbols (per AGENTS.md convention).
Rejected: the suggestion to remove the `// FNXC:Database` marker — FNXC is a
mandatory project convention (AGENTS.md), and a prior review flagged the
absence of these markers as a defect.
Tests: regression test that pending clears for all participants when the
check throws; test that runBackgroundIntegrityCheck returns ok without
throwing on a closed instance; strengthened the healthy-DB assertion.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The boot-time integrity check (scheduleBackgroundIntegrityCheck, ~60s
after init) ran PRAGMA integrity_check on the live connection, walking
every page and freezing the event loop for several seconds — the largest
single read-contention stall in normal operation.
Offload it to the sqlite3 CLI in a child process (async spawn), matching
the existing out-of-process pattern used by quickCheckSqliteFile and
.recover. The CLI connection is opened -readonly so it can never
checkpoint or write the live WAL; this works because the live process
holds the DB open (so the -shm exists). When the CLI is unavailable or
can't open read-only, fall back to the in-process check (verified=false),
preserving today's behavior on those environments.
- New integrityCheckSqliteFileAsync(dbPath, limit) module helper.
- New private runBackgroundIntegrityCheck() seam (offload + fallback) so
the scheduler has one testable, deterministic policy point.
- Background scheduler callback is now async (IIFE + finally) with errors
swallowed so a background timer can't crash the process.
VACUUM is intentionally NOT offloaded: the call graph shows it is invoked
only by the `fn db vacuum` CLI command and tests, never from the periodic
maintenance loop, so it is not a background event-loop stall — and an
out-of-process VACUUM on a live WAL DB would add corruption surface for no
hot-path benefit.
Tests updated to the async/offloaded seam (deterministic regardless of
whether the sqlite3 CLI exists in the environment), plus coverage for the
new helper.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Investigation of reported DB read contention found two cross-process
contention sources in the SQLite layer (single synchronous node:sqlite
connection per process, WAL mode):
- Unbounded WAL on central-db and archive-db. Neither set
journal_size_limit, so their WAL never truncated back down after a
checkpoint and every reader paid an ever-growing WAL-index scan. Add
journal_size_limit=4MB (matching db.ts) plus explicit
synchronous=FULL/wal_autocheckpoint=1000 for intent. central-db is the
most cross-process-shared DB; archive-db had the same latent gap.
- vacuum() held the EXCLUSIVE lock past its own runtime. Resetting
locking_mode to NORMAL does not drop the WAL exclusive lock until the
connection next touches the DB, so other processes stayed locked out of
reads (SQLITE_BUSY) until some unrelated query ran. A plain read does
NOT release it in WAL mode (verified); a PASSIVE checkpoint does. Run
one in the finally, guard the locking_mode reset so it can't mask the
original error or skip the release, and log swallowed failures.
Tests: assert the new PRAGMAs on central-db and archive-db, and that a
second connection can read immediately after vacuum() returns.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Addresses findings from a multi-agent review of the two prior fixes.
P0 (executor.ts): the stale-conflict recovery force-removed worktreePath with
no bounds check; that path can come from a git admin entry resolving outside
.worktrees/. Now refuses unless the path is inside the worktrees dir, not a
symlink (realpathSync), not a registered worktree, and not actively owned, and
re-verifies liveness in the catch instead of trusting the error string. Also
excludes spawn failures (spawn git ENOENT) from the stale-path classification.
worktree-pool.ts: resolveGitdirPointer -> dotGitPointerIsDangling. Reaps only
when a .git link's gitdir target is confirmed missing; a real .git dir,
unparseable pointer, or any read/stat failure is treated as NOT dangling
(conservative) so a transient read error on a live worktree can't trigger rm.
Drops the string|"directory"|null sentinel union.
core store.ts: bypass the reconcile recency window when the live task table is
empty (corruption/restore: surviving task.json keep old mtimes) and when
fusion.db was auto-recovered on startup, so .recover row loss isn't stranded.
Adds an ignoreRecencyWindow option.
Tests: executor recovery + out-of-bounds refusal, unparseable .git skip,
recency boundary, empty-DB/forced bypass. engine 135 + core 12 green.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
On restart, reconcileOrphanedTaskDirs re-imported ancient .fusion/tasks/<id>/
directories that had no DB row, surfacing old low-numbered tasks (FN-001, ...)
onto the live board — looking like "all task IDs reset / starting over".
The sweep is meant to recover dirs that appear after store init (heartbeat
races) or rows lost to recent DB corruption. Modern deletes leave a soft-delete
tombstone (caught by taskIdExistsAnywhere), but legacy hard-deletes left none,
so a months-old task.json with no DB row was silently re-imported.
Gate recovery on a 7-day recency window (task.json mtime). Older orphans are
skipped (reason: stale-orphan-dir-beyond-recency-window) and left for explicit
recovery or directory cleanup; heartbeat-race and recent-corruption recovery
still work. Adds a regression test for the stale-dir skip.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add a selectable business workflow for managing lead-generation tasks.
- Register a built-in lead-generation workflow with custom business columns, lead fields, and stage prompts.
- Cover workflow registration, column traits, field metadata, compilation, and IR round-tripping with core tests.
- Document the workflow catalog entry and add a minor changeset for the published CLI package.
Files changed:
.changeset/fn-6759-lead-generation-workflow.md | 5 +
docs/workflow-steps.md | 4 +
.../builtin-lead-generation-workflow-ir.test.ts | 123 ++++++++++++++++++
.../core/src/__tests__/builtin-workflows.test.ts | 10 ++
.../src/builtin-lead-generation-workflow-ir.ts | 141 +++++++++++++++++++++
packages/core/src/builtin-workflows.ts | 20 +++
packages/core/src/index.ts | 1 +
7 files changed, 304 insertions(+)
Fusion-Task-Id: FN-6759
Fusion-Task-Lineage: 6c724f84-a6a6-4b01-93ec-cabb9387be2f
Add a built-in workflow path for UI-heavy implementation work with a required design review gate.
- Register builtin:design as a selectable built-in workflow after implementation and before standard review/merge.
- Define design review criteria covering hierarchy, spacing, typography, design tokens, component reuse, responsiveness, and design-language fit.
- Add catalog coverage and update workflow documentation to list the new Design workflow.
- Add a minor changeset for the published Fusion package.
Files changed:
.changeset/fn-6760-design-workflow.md | 5 +++++
docs/getting-started.md | 2 +-
docs/workflow-editor.md | 4 ++++
docs/workflow-steps.md | 1 +
.../core/src/__tests__/builtin-workflows.test.ts | 23 +++++++++++++++++++++
packages/core/src/builtin-workflows.ts | 24 ++++++++++++++++++++++
6 files changed, 58 insertions(+), 1 deletion(-)
Fusion-Task-Id: FN-6760
Fusion-Task-Lineage: 2682ce3f-a89d-4237-b2cf-675439eea1d6
