- SSRF: Add IPv6 private range checks (loopback, ULA, link-local,
IPv4-mapped) after DNS resolution, closing the IPv6 bypass
- Deduplication: Add Set-based dedup in CustomProvidersSection
handleDetectModels to prevent duplicate model accumulation
- Bump type: change changeset from patch to minor for new feature
- Reasoning: Narrow Anthropic sonnet reasoning detection to only
flag models containing both 'sonnet' and 'think'
- Docs: Add JSDoc to all undocumented functions in route file,
raising docstring coverage above the 80% threshold
- Test: Update sonnet reasoning expectation (standard sonnet is not
a thinking model)
The bare catch {} swallowed the ApiError thrown by the private-IP
checks, defeating the entire DNS-based SSRF protection. Now catches
and re-throws ApiError so security rejections propagate correctly;
only DNS-lookup failures fall through.
- Add google-generative-ai to CustomProvider.apiType union type
- Update assertApiType to accept google-generative-ai in create/update
- Fix createCustomProvider mapping in legacy.ts for Google type
- Fix fetchCustomProviders mapping for Google type
- Add google-generative-ai to CustomProvidersSection API_TYPES
- Add SSRF protection to probeProviderModels (block private/loopback)
- Add body validation to probe-models route handler
- Update stale JSDoc in legacy.ts
Implements the `experiment-finalize` CLI command (FN-4222) and its companion dashboard API route, wiring the feature through the pi extension as a new callable tool. Includes the command implementation, extension tooling, API integration, and corresponding test coverage.
Fusion-Task-Id: FN-4222
Add 'Detect Models' button to custom provider forms that calls the
provider's /models endpoint to discover available models automatically.
- Supports OpenAI-compatible, Anthropic-compatible, and Google
Generative AI providers
- Auto-fills context window and max tokens from provider response
- Filters out embedding, reranking, and non-text models
- Removes empty default model rows after detection
- Added comprehensive backend and frontend test coverage
This merge implements room message notifications across the system, adding a core room event type, wiring the notification dispatcher to room activity, and delivering notifications via ntfy and webhook providers with updated settings UI and API routes.
Fusion-Task-Id: FN-4178
Adds user-facing warnings before OAuth login flows in both onboarding and settings, surfacing that manual code authentication is available as an alternative, with corresponding documentation updates and test coverage for the new warning UI.
Fusion-Task-Id: FN-4160
Adds GitHub tracking title derivation so tasks can display meaningful titles when PR/issue tracking data is incomplete, falling back to the task description. The core implementation lives in `github-tracking.ts` with expanded test coverage across the tracking suite, and the feature is wired into pla
Fusion-Task-Id: FN-4148
Fusion-Task-Lineage: d57c6279-1b4f-4ade-9c3f-e20ac391ea45
Adds zero-step retry classification to the task workflow routes and pi extension, with test coverage in both packages and documentation updates.
Fusion-Task-Id: FN-4130
Adds ntfy access token support to Fusion's notification system, wiring the token through the core settings schema, dashboard UI (SettingsModal), engine notifier, and notification pipeline, with corresponding tests across core, dashboard, and engine packages; also updates settings and storage documen
Fusion-Task-Id: FN-4078
Merges FN-4076: tightens the mobile Agents header and aligns the controls popup on smaller screens, while also introducing compact planning breakdown task creation with preserved payload coverage — tests for scoped and empty-generated planning payloads were added alongside fixes to the legacy API an
Fusion-Task-Id: FN-4076
Unifies task ID allocation under a single store-owned distributed allocator, removing redundant ID-generation logic from dashboard route handlers and simplifying the overall flow; Step 1 merges the allocation authority into the store, Step 3 removes the now-unnecessary mixed-path routing, and tests
Fusion-Task-Id: FN-4053
Centralized routing policy helpers in core and aligned both direct assignment and delegation to route engineer-role agents consistently, ensuring assigned tasks respect explicit engineer routing the same way delegated tasks do. Added comprehensive test coverage across core, CLI, dashboard, and engin
Fusion-Task-Id: FN-3935
Fusion-Task-Lineage: 069f4d54-f7a8-4bd3-a2c3-4de830de042f
The merge adds a GitHub integration retry lifecycle to the task tracking system, including an actionable retry mechanism for failed issue creation, fixes to tracking and auth retry flow, and corresponding tests in the dashboard and engine packages. Documentation is updated in `docs/architecture.md`
Fusion-Task-Id: FN-4032
Heartbeat timer repair sweep — adds a registration repair mechanism that detects and flags stale timers via agent updates, with tests covering the new sweep behavior. Documentation updated in agents.md to reflect the repair flow.
Fusion-Task-Id: FN-3959
Fusion-Task-Lineage: 40708b6b-01e1-4673-93e1-299678de2879
Merged FN-4014 to fix dual-scope GitHub tracking settings persistence and validation (mission vs task scope), scoped repo saves to the relevant section, and documented the dual defaults. Also landed FN-4018 to isolate split merger temp workspaces and add regression checks for split-suite test isolat
Fusion-Task-Id: FN-4018
The merge adds comprehensive test coverage for dashboard routing infrastructure — custom providers tests, setup routes tests, and chat manager tests — while making a minor adjustment to chat room route registration. The CLI side sees a small bundle output test update tied to the same FN-4012 work.
Fusion-Task-Id: FN-4012
The merge implements post-merge model resolution, using the merger's own session model for executing post-merge prompt workflow steps instead of falling back to executor model defaults. Tests cover the resolution hierarchy, and documentation clarifies the precedence order for downstream consumers.
Fusion-Task-Id: FN-3905
Merged commits stabilize the Fusion roadmap plugin's identity and routing surface, establishing a canonical plugin ID and compatibility routes so the roadmap plugin integrates cleanly with the dashboard's plugin system. Added new roadmap-routes and roadmap-suggestions modules in the dashboard packag
Fusion-Task-Id: FN-3637
Adds task lineage commit associations: a new API route stores and exposes which commits belong to which task, the `TaskChangesTab` surfaces these lineage links visually, and documentation covers the reconciliation model. Includes comprehensive tests for both the route and component.
Fusion-Task-Id: FN-3998
