- Trigger model loading when the dialog opens instead of only on initial mount
- Guard NewAgentDialog effects with isOpen to avoid late async state updates after close/unmount
- Update AgentsView dialog tests to await settled UI state before asserting controls
- Harden NewAgentDialog tests with async act/waitFor patterns around render, reopen, and fetch side effects
The bearer-token middleware was mounted globally on the Express app, so
the initial GET /?token=<token> request for index.html was rejected with
401 before the frontend JS could even load and capture the token from
the URL. The server-side query-string fallback only accepts fn_token=,
while the banner URL uses ?token= (which only the frontend captures), so
the bootstrap request had no valid auth path.
Fix: gate auth on /api/* only. The SPA shell (index.html, /assets/*,
favicon) is public — it contains no secrets, and the frontend auth.ts
module captures the token into localStorage and installs a fetch wrapper
that injects Authorization: Bearer on every /api/* call.
Also: add .env / .env.local to .gitignore so local FUSION_DAEMON_TOKEN
values don't accidentally get committed.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Pre-release polish. Two related changes bundled because they both land the
project on public-release footing:
Dashboard auth
- fn dashboard now gates the HTTP API + terminal/badge WebSockets behind a
bearer token by default. Token resolution order: --token flag,
FUSION_DASHBOARD_TOKEN env, FUSION_DAEMON_TOKEN env (back-compat), or an
auto-generated fn_<32 hex>. --no-auth disables. The startup banner prints
a click-to-open URL with ?token=<token> embedded.
- Auth middleware now also accepts fn_token=<token> as a query-string
fallback so EventSource and WebSocket clients (which can't set custom
headers) still authenticate.
- setupTerminalWebSocket / setupBadgeWebSocket now refuse unauthenticated
upgrades with a proper 401 + socket close.
- Frontend: new auth.ts module captures ?token= off the URL into
localStorage (key fn.authToken), strips it from the visible URL via
replaceState, and installs a window.fetch wrapper that injects
Authorization: Bearer <token> on every same-origin /api/* request.
EventSource/WebSocket URL builders (api.ts, sse-bus.ts, useTerminal,
useBadgeWebSocket) route through appendTokenQuery().
MIT license
- LICENSE file at repo root.
- license: "MIT" on root package.json and every packages/*/package.json,
plus description/bugs metadata on the CLI package.
Docs
- docs/cli-reference.md documents --token / --no-auth / FUSION_DASHBOARD_TOKEN
and the click-to-open auth flow.
- docs/getting-started.md, docs/docker.md, README.md point at the new flow
and the CLI reference section.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
When the engine restarts mid-step, an in-progress step may have already
passed plan + code review but not yet been flipped to done by the agent's
next task_update call. Previously, the next executor pass re-entered the
step and replayed both reviews — measured at 5-20 min of pure waste per
restart (observed in FN-2215 Step 1 and FN-2207 Step 6).
recoverApprovedStepsOnResume scans the task log for any in-progress step
whose most recent "code review Step N: APPROVE" entry is newer than its
most recent "Step N → pending" transition, and marks those steps done
before execute() runs. Safely skips steps that were reset after approval
(e.g. by a workflow revision) or only received REVISE verdicts.
Called from both the engine-restart path (resumeOrphaned) and the
unpause path, matching the two places the task log shows as vulnerable
to this race.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Add stateDerived metadata to AgentHealthStatus to indicate when health text only mirrors agent.state
- Update getAgentHealthStatus to set stateDerived consistently across terminated, error, paused, running, heartbeat, idle, and disabled paths
- Update AgentDetailView, AgentListModal, and AgentsView to render icon-only health badges when labels are state-derived while preserving full labels via title tooltips
- Expand agentHealth tests with explicit stateDerived assertions and a table-driven semantics suite for representative states
- Extend isEphemeralAgent to treat metadata.internal agents as internal system agents
- Add legacy fallback detection for executor agents named verification-agent with no reportsTo
- Update AgentsView list and org tree filtering to honor the Show system agents toggle
- Add regression coverage in core and dashboard tests for default filtering and includeEphemeral visibility
- Move the assigned agent badge out of the card header into a dedicated metadata row below task details
- Add a new .card-agent-row container to control spacing and alignment for the badge block
- Update .card-agent-badge styling to use token-aligned pill radius and color-mix backgrounds while removing monospace/fixed-width conventions
- Expand TaskCard agent badge tests to verify new DOM placement and enforced badge style rules
- Update the dashboard dev-server API client for compatibility with multiple backend response shapes
- Refine useDevServer polling and SSE lifecycle handling to improve status/action reliability
- Gate dev server navigation in header/mobile overflow and fix mobile preview header wrapping styles
- Expand DevServerView and useDevServer test coverage with isolated mocks and log/status assertions
- Document the devServerView experimental feature flag in settings reference
- Add typed dev server models and constants for configs, session state, runtime metadata, and bounded log history
- Add JSON persistence helpers for .fusion/devserver.json with tolerant parsing and session reconstruction
- Add dev command auto-detection across root and workspace package.json scripts with framework inference and priority sorting
- Implement DevServerManager lifecycle controls, preview URL detection, port probing fallback, and singleton manager helpers
- Add Vitest coverage for devserver types, detection/persistence behavior, and manager lifecycle/events
- Add preview embed diagnostics with richer error classification and fallback state handling
- Improve PreviewIframe and DevServerView retry UX for timeout and iframe failure states
- Adjust preview layout/styles to prevent clipping and header overflow while keeping fallback panels centered
- Expand dashboard tests to cover fallback transitions, retry flows, and responsive CSS behavior
- Add usePreviewEmbed hook to derive preview embed URLs and availability state
- Add PreviewIframe component with iframe load/error wiring and deduplicated error callbacks
- Integrate preview panel actions, fallback messaging, and embedded iframe rendering in DevServerView
- Expand test coverage for usePreviewEmbed, PreviewIframe, and DevServerView preview integration scenarios
- Display heartbeat interval and timeout in seconds while persisting runtimeConfig in milliseconds
- Convert derived and persisted heartbeat values before dirty-state comparison so unchanged settings keep Save Settings disabled
- Update heartbeat validation minimums, placeholders, and hints to align with seconds-based inputs
- Expand AgentDetailView tests for pre-filled values, unchanged-state save disabling, validation, and payload conversion
- Replace the silent stale-session eviction catch with a terminal error log in setupTerminalWebSocket
- Add regression tests that assert evictStaleSessions runs on each 60s interval tick
- Verify eviction errors are logged without stopping future ticks and interval cleanup runs on server close
- Show Run Now controls in AgentsView for active and running agents without requiring taskId
- Rename Run Heartbeat copy to Run Now and update runs-tab accessibility labels in AgentDetailView
- Add AgentsView coverage for Run Now visibility and startAgentRun invocation when no task is assigned
- Update agent runs UI static-analysis tests and add a patch changeset for @gsxdsm/fusion
- Add dev-server port detection utilities and wire detected preview state into process/manager lifecycle
- Normalize dev-server status API responses with preview URL, detected port, and manual override compatibility
- Introduce useDevServerLogs and DevServerLogViewer, and integrate them into the DevServer dashboard view
- Expand dashboard test coverage for detection edges, process/routes behavior, log history handling, and CSS regressions
- Add DevServerView with command detection, start/stop/restart controls, live logs, and preview URL management
- Implement useDevServer with SSE log streaming, running-state polling, manual URL updates, and candidate detection support
- Extend dashboard API client mappings for dev-server candidate metadata, status fields, and preview URL helpers
- Integrate dev server navigation in header/mobile nav, normalize devserver view state persistence, and add feature-flag wiring
- Add/refresh DevServerView and useDevServer tests and replace legacy dev-server CSS with the new component styles
- Refresh AgentDetailView on agent:updated SSE events while preserving local unsaved config edits
- Resync heartbeat and budget form state from latest runtime config when agent data changes
- Centralize heartbeat interval defaults/formatting in shared utilities and reuse them in AgentsView selectors
- Add dashboard tests for default heartbeat hints, unset runtime fallback behavior, and custom interval options
- Add docs/skipped-test-inventory.md with the current intentional skip patterns and rationale across test suites
- Link the skipped-test inventory from docs/README.md for easier discovery
- Record reconciliation of older skip follow-up tasks that are now covered and no longer active backlog
- Stabilize PlanningModeModal conversation-history resume testing by overriding stream behavior in the targeted test case
- Extend dev server store with config defaults, normalization, and JSON persistence alongside runtime state.
- Add GET/PUT /api/dev-server/config endpoints with strict request validation for nullable fields and preview URLs.
- Add dashboard API helpers plus a useDevServerConfig hook to load and update selected script, source, command, and preview override.
- Update DevServerView and styles to support saved script selection, change/clear actions, and synchronized command/preview inputs.
- Expand dev server store/routes/component tests and document the config endpoint in architecture docs.
Resume paths (unpause, drift recovery, engine restart) bypassed the
scheduler's todo->in-progress clear, leaving actively executing tasks
labeled status="queued" with a lingering blockedBy. Broadened
clearResumeFailureState to null both fields alongside the existing
failure cleanup, and added a defensive UI backstop so the "Queued"
badge no longer renders for tasks in the in-progress column.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Add horizontal padding to the prompt manager container for consistent desktop gutters
- Add top margin to separate the prompt manager from surrounding sections
- Add a mobile-specific prompt manager padding override at the 768px breakpoint
On iOS Safari/PWA, tapping the terminal opened the keyboard but typed
keys produced no output. Focus landed on a 1×1 opacity-0.01 helper
textarea overlapped by the xterm canvas, and capture-phase gesture
handlers re-focused on every tap — a combination iOS silently drops
input events on.
- On touch-primary devices, expand .xterm-helper-textarea to cover the
entire terminal surface (100% × 100%, opacity 0, z-index 2) via
@media (hover: none) and (pointer: coarse). Taps land on the
textarea directly, so iOS grants keyboard + input events natively.
- Desktop keeps the 1×1 rule so xterm's canvas-level drag-to-select
and mouse tracking continue to work.
- Revert onPointerDownCapture/onTouchStartCapture/onClickCapture back
to bubble-phase onPointerDown/onTouchStart; capture phase was
confusing iOS's focus attribution and is no longer needed now that
taps reach the textarea directly.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Rename the dashboard markdown files route to /files/markdown-list.
- Update fetchProjectMarkdownFiles to call the new markdown-list endpoint.
- Adjust useDocuments test mocks and assertions to match the renamed route.
- Extend auth status API typing to include optional ghCli availability/authentication metadata.
- Update /api/auth/status to return ghCli readiness using isGhAvailable() and isGhAuthenticated().
- Treat setup GitHub readiness as satisfied when either GitHub OAuth or authenticated gh CLI is present.
- Add hook tests covering gh CLI authenticated, unauthenticated, combined OAuth, and missing-ghCli fallback cases.
- Add optional summary payload support to planning create-task and start-breakdown API client calls
- Pass edited summary data from PlanningModeModal when creating a task or starting breakdown
- Parse and validate summary overrides in planning routes and prioritize override data when present
- Add and update dashboard tests to verify override handling and modal call expectations
- Keep only one optional tab (Skills or Roadmaps) in the top-level mobile nav to preserve touch-target width
- Move overflowed optional destinations into the More sheet and mark More active when those views are selected
- Add MobileNavBar tests covering Skills/Roadmaps overflow behavior and More-sheet routing
- Add mobile nav CSS guards (min-width and label ellipsis) to avoid clipping on narrow screens
- Emit tool_start/tool_end SSE events from dashboard chat backend and parse them in streaming client helpers
- Track in-flight and completed tool calls in useChat/useQuickChat to preserve tool output summaries alongside assistant messages
- Render collapsed tool call preview blocks in ChatView and QuickChatFAB with dedicated tokenized styles for compact output summaries
- Expand frontend and backend test coverage for SSE tool events, hook state transitions, and collapsed preview rendering behavior
- Add a changeset for @gsxdsm/fusion documenting the new tool-call display behavior
- Show formatted model names in sidebar metadata for fn assistant sessions with a Fusion fallback
- Use the resolved model name as the thread header title and assistant avatar label for fn sessions
- Suppress duplicate model tags when the primary label already displays the model while keeping tags for non-fn sessions
- Expand ChatView tests to cover sidebar, header, and avatar model-label and fallback behavior
Root cause: during a triage split the AI could set a child task's
`dependencies` to the parent id. The parent is hard-deleted after the split,
and the scheduler's dep check treats a missing id as unmet — permanently
blocking the dependent. This stranded FN-2164 behind the deleted FN-2163.
- core/store.deleteTask: refuse to delete when any live task still has the id
in its `dependencies` array. Throws TaskHasDependentsError listing dependents
so callers can rewrite or recover. Covers the triage-split path and any
future caller.
- engine/triage task_create: validate each proposed dependency before creating
a child — reject the parent id, reject unknown task ids, allow siblings
created earlier in the same split or pre-existing tasks.
- engine/triage split cleanup: wrap the parent deleteTask in try/catch that
keeps the parent alive (safer than stranding dependents) and logs the reason.
- engine/triage prompts: both the mandatory-split and proactive-split prompts
now explicitly state that subtask deps must never reference the parent.
- dashboard/routes /subtasks/create-tasks: reject parent-id deps, drop unknown
deps with an audit log entry, surface parentTaskCloseError + droppedDependencies
in the response instead of silently swallowing them.
- engine/executor: on execute entry, detect the drift state (in-progress task
with no worktree) and emit a loud log + task log entry; the existing
fresh-worktree path then recovers. Prevents silent "operating without a
worktree" behavior that we saw on FN-2152.
Tests:
core: 2907/2907 pass (+5 new, incl. deleteTask guard regression)
engine: 2554/2554 pass (+17 new, incl. task_create dep validation)
dashboard: 9064/9064 pass (+2 new for /subtasks/create-tasks).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Rename core loader, dashboard server chat/planning routes, and frontend agent IDs/storage keys from kb-agent to fn-agent naming
- Update dashboard hooks and components (agent list, chat view, quick chat) to use the new fn agent key prefixes consistently
- Refresh engine, dashboard, core, and CLI tests/mocks to remove remaining kb-agent route and temp prefix references
- Update storage/gap-analysis docs to reflect fn agent key names and add a @gsxdsm/fusion patch changeset for the rename
- Render full template prompt text in cards with a scrollable preview area instead of truncation
- Add expand controls for built-in and custom templates to open a single fullscreen dialog view with Escape/collapse handling
- Align template expand buttons to shared icon-button styling for consistent UI behavior
- Extend AgentPromptsManager tests to cover preview overflow styles and fullscreen interactions across built-in/custom templates
- Rename engine export and call sites to use createFnAgent consistently across runtime flows
- Update core lazy engine loader and dashboard agent-generation/planning/chat paths to reference createFnAgent
- Refresh affected unit and integration tests, including renaming pi-create-kb-agent.test.ts to pi-create-fn-agent.test.ts
- Update AGENTS.md documentation references to match the new createFnAgent name
- Introduce DevServerStore and DevServerProcessManager with a simplified store API contract
- Add dev-server script detection and route legacy manager behavior through the new process manager
- Add a dedicated dev-server router with start/stop/status/log endpoints and SSE event streaming
- Wire dev-server routes into the main route table and hook manager shutdown into server teardown
- Expand tests and architecture docs for store, process, route, detection, and SSE coverage
- Add the `skillsView` entry to the known experimental feature display-name map in SettingsModal.
- Show "Skills View" as the user-facing label in the experimental features list instead of a raw feature key.
- Add a durable dev-server store and manager with persisted state/log history, process reconciliation, and SSE event buffering
- Wire new backend lifecycle APIs for status/history/start/stop/restart/stream and initialize/shutdown manager handling in server startup
- Add dashboard Dev Server view, hook-based hydration/stream handling, nav integration, and supporting styles
- Expand coverage with backend persistence/route tests and frontend DevServerView/useDevServer tests
- Document the dev-server persistence architecture in docs/architecture.md
- Limit background session inclusion to active statuses (generating and awaiting_input)
- Remove sessions from local state when SSE updates deliver complete or error terminal statuses
- Update useBackgroundSessions tests to assert terminal sessions are filtered out and removed on SSE updates
- Adjust session count expectations to reflect active-only tracking
- Add DevServerManager service to start/stop/restart dev processes, persist state, stream logs, and detect preview URLs
- Add dev server candidate detection across root/workspace package scripts with caching and invalidation helpers
- Expose /api/dev-server routes for candidates, status, lifecycle actions, manual preview URL, and SSE log/status stream
- Initialize and tear down dev server managers from dashboard server lifecycle
- Add unit and route tests covering detection, manager lifecycle, URL parsing/fallback probes, and API validation
- Render SetupWarningBanner from App only in project view when setup readiness reports warnings
- Persist dismiss state per project via scoped storage and restore it when switching projects
- Add optional dismiss action to SetupWarningBanner with close button UI and responsive styles
- Remove inline banner from QuickEntryBox and add tests covering dismiss button behavior
- Add project settings for pushAfterMerge and pushRemote with defaults and typed merge result fields for push status/errors
- Implement post-merge remote sync in the merger with pull --rebase, auto/AI conflict resolution, and one non-fast-forward retry before push
- Expose push-after-merge controls in Settings modal with conditional Push Remote input and coverage for desktop/mobile save flows
- Document the new settings in the settings reference and stabilize CLI cross-build help test timeout
- Make .settings-layout fill available space and allow shrinking with flex: 1 and min-height: 0
- Enable vertical scrolling on .settings-sidebar in desktop layout to prevent content clipping
- Add a SettingsModal regression test that loads styles.css and asserts desktop overflow/scroll computed styles
- Add an autoMerge prop to PrSection and show an auto-merge hint instead of manual PR actions
- Pass project autoMerge settings from TaskDetailModal into PrSection
- Preserve active automation messaging when PR creation is already in progress
- Expand PrSection tests to cover auto-merge enabled and disabled behavior
- Increase core RunMutationContext log entry bounds test timeout to reduce flakiness
- Update reflection trigger API typing to allow null responses from manual generation
- Handle null results in AgentReflectionsTab with a clear insufficient-history toast
- Normalize reflection trigger errors to show specific UX for deleted agents and insufficient history
- Return a clear 500 error when manual reflection generation yields no reflection payload
- Expand dashboard reflection route/UI tests to lock in null and not-found regression behavior
