The bare catch {} swallowed the ApiError thrown by the private-IP
checks, defeating the entire DNS-based SSRF protection. Now catches
and re-throws ApiError so security rejections propagate correctly;
only DNS-lookup failures fall through.
- Add google-generative-ai to CustomProvider.apiType union type
- Update assertApiType to accept google-generative-ai in create/update
- Fix createCustomProvider mapping in legacy.ts for Google type
- Fix fetchCustomProviders mapping for Google type
- Add google-generative-ai to CustomProvidersSection API_TYPES
- Add SSRF protection to probeProviderModels (block private/loopback)
- Add body validation to probe-models route handler
- Update stale JSDoc in legacy.ts
Add 'Detect Models' button to custom provider forms that calls the
provider's /models endpoint to discover available models automatically.
- Supports OpenAI-compatible, Anthropic-compatible, and Google
Generative AI providers
- Auto-fills context window and max tokens from provider response
- Filters out embedding, reranking, and non-text models
- Removes empty default model rows after detection
- Added comprehensive backend and frontend test coverage
This merge implements room message notifications across the system, adding a core room event type, wiring the notification dispatcher to room activity, and delivering notifications via ntfy and webhook providers with updated settings UI and API routes.
Fusion-Task-Id: FN-4178
Adds user-facing warnings before OAuth login flows in both onboarding and settings, surfacing that manual code authentication is available as an alternative, with corresponding documentation updates and test coverage for the new warning UI.
Fusion-Task-Id: FN-4160
Adds GitHub tracking title derivation so tasks can display meaningful titles when PR/issue tracking data is incomplete, falling back to the task description. The core implementation lives in `github-tracking.ts` with expanded test coverage across the tracking suite, and the feature is wired into pla
Fusion-Task-Id: FN-4148
Fusion-Task-Lineage: d57c6279-1b4f-4ade-9c3f-e20ac391ea45
Adds zero-step retry classification to the task workflow routes and pi extension, with test coverage in both packages and documentation updates.
Fusion-Task-Id: FN-4130
Adds ntfy access token support to Fusion's notification system, wiring the token through the core settings schema, dashboard UI (SettingsModal), engine notifier, and notification pipeline, with corresponding tests across core, dashboard, and engine packages; also updates settings and storage documen
Fusion-Task-Id: FN-4078
Merges FN-4076: tightens the mobile Agents header and aligns the controls popup on smaller screens, while also introducing compact planning breakdown task creation with preserved payload coverage — tests for scoped and empty-generated planning payloads were added alongside fixes to the legacy API an
Fusion-Task-Id: FN-4076
Unifies task ID allocation under a single store-owned distributed allocator, removing redundant ID-generation logic from dashboard route handlers and simplifying the overall flow; Step 1 merges the allocation authority into the store, Step 3 removes the now-unnecessary mixed-path routing, and tests
Fusion-Task-Id: FN-4053
Centralized routing policy helpers in core and aligned both direct assignment and delegation to route engineer-role agents consistently, ensuring assigned tasks respect explicit engineer routing the same way delegated tasks do. Added comprehensive test coverage across core, CLI, dashboard, and engin
Fusion-Task-Id: FN-3935
Fusion-Task-Lineage: 069f4d54-f7a8-4bd3-a2c3-4de830de042f
The merge adds a GitHub integration retry lifecycle to the task tracking system, including an actionable retry mechanism for failed issue creation, fixes to tracking and auth retry flow, and corresponding tests in the dashboard and engine packages. Documentation is updated in `docs/architecture.md`
Fusion-Task-Id: FN-4032
Heartbeat timer repair sweep — adds a registration repair mechanism that detects and flags stale timers via agent updates, with tests covering the new sweep behavior. Documentation updated in agents.md to reflect the repair flow.
Fusion-Task-Id: FN-3959
Fusion-Task-Lineage: 40708b6b-01e1-4673-93e1-299678de2879
Merged FN-4014 to fix dual-scope GitHub tracking settings persistence and validation (mission vs task scope), scoped repo saves to the relevant section, and documented the dual defaults. Also landed FN-4018 to isolate split merger temp workspaces and add regression checks for split-suite test isolat
Fusion-Task-Id: FN-4018
The merge adds comprehensive test coverage for dashboard routing infrastructure — custom providers tests, setup routes tests, and chat manager tests — while making a minor adjustment to chat room route registration. The CLI side sees a small bundle output test update tied to the same FN-4012 work.
Fusion-Task-Id: FN-4012
The merge implements post-merge model resolution, using the merger's own session model for executing post-merge prompt workflow steps instead of falling back to executor model defaults. Tests cover the resolution hierarchy, and documentation clarifies the precedence order for downstream consumers.
Fusion-Task-Id: FN-3905
Merged commits stabilize the Fusion roadmap plugin's identity and routing surface, establishing a canonical plugin ID and compatibility routes so the roadmap plugin integrates cleanly with the dashboard's plugin system. Added new roadmap-routes and roadmap-suggestions modules in the dashboard packag
Fusion-Task-Id: FN-3637
Adds task lineage commit associations: a new API route stores and exposes which commits belong to which task, the `TaskChangesTab` surfaces these lineage links visually, and documentation covers the reconciliation model. Includes comprehensive tests for both the route and component.
Fusion-Task-Id: FN-3998
Adds an "All Agents" unified mailbox view to the dashboard, including a new aggregate API endpoint in `@fusion/core`, updated MailboxView UI with selection controls, CSS styling, and comprehensive tests across core and dashboard packages, with documentation updates.
Fusion-Task-Id: FN-3971
The merge completes Step 1 of agent provisioning approval followthrough, executing provisioning actions when approval decisions are made, with supporting documentation in AGENTS.md and docs/agents.md. Test coverage spans provisioning policy, approval routes, gating classifications, extension integra
Fusion-Task-Id: FN-3956
Implements a typed mesh snapshot API in `@fusion/core` (`CentralCore.getMeshSnapshot`, `MeshSnapshot` type) and wires it through the dashboard nodes view via a new `useMeshState` hook, substantially simplifying `MeshTopology.tsx` by replacing internal state management with the centralized snapshot.
Fusion-Task-Id: FN-3454
Completes FN-3939 audit work for PR #59 residual defects by refactoring the mission execution loop in the engine (halving its complexity), adding self-healing test coverage, and wiring in task workflow route improvements. Retry and validation behavior updates are documented in the changeset and skil
Fusion-Task-Id: FN-3939
Implements GitHub tracking issue creation on PATCH operations for FN-3953, with accompanying test coverage and documentation updates for edit-time tracking.
Fusion-Task-Id: FN-3953
Exposed full mesh state aggregation via mesh routes with corresponding tests, refined the dependency graph to decouple node selection from opening task details, and documented the new aggregation API.
Fusion-Task-Id: FN-3952
The merger gains a safeguard that automatically stashes work when a finalize-reset leaves orphaned records, preventing merge-state corruption. Core exports the new orphan record type, project-engine wires the safeguard, and documentation traces the provenance flow; tests were added for the recovery
Fusion-Task-Id: FN-3932
Implements a tracking auth resolver with forced GitHub client authentication mode, wiring it across the GitHub tracking lifecycle and settings UI. The feature spans six steps: adding the resolver, forced auth mode, routing tracking issue creation through the resolver, and wiring into lifecycle and s
Fusion-Task-Id: FN-3875
Added a GitHub tracking state service (`GitHubTrackingStateService`) and `setIssueState` client method to support closing and reopening tracked issues, with test coverage for both the client and the service, wired into the GitHub routes, and documented in the architecture docs.
Fusion-Task-Id: FN-3873
Added a GitHub tracking comments service that posts automated comments to GitHub PRs, with a full test suite and documentation. The service is wired into the GitHub registration flow and ships as a changeset patch.
Fusion-Task-Id: FN-3872
Restored the room reply verification path and documented the room responder flow in the dashboard chat module, adding 168 lines of new chat logic, comprehensive tests for chat-manager and chat-room-routes, and updating architecture and dashboard documentation.
Fusion-Task-Id: FN-3914
Implements GitHub tracking issue creation (FN-3870) for the dashboard, wiring new routes for planning subtasks and task workflows, adding a dedicated `github-tracking` module with issue creation and auth fallback logic, and updating the main `github.ts` with enhanced capabilities — backed by compreh
Fusion-Task-Id: FN-3870
Implements durable branch context tracking across the mission planning lifecycle (FN-3216): adds branch context persistence to the core store and mission store, propagates branch context through planning subtasks into triaged tasks, and exposes the merge context via dashboard API routes with tests c
Fusion-Task-Id: FN-3216
Adds branch selection and assignment to the planning workflow: defines a branch selection contract, wires it through subtask creation in SubtaskBreakdownModal, and applies the contract in planning route handlers, with corresponding test coverage. A minor typing fix in the bundled plugin views loader
Fusion-Task-Id: FN-3214
Merged FN-3863 brings stash recovery to the dashboard via three coordinated steps: engine-side orphan stash surfacing API in `merger.ts`, dashboard API routes for stash recovery data, and a new `StashRecoveryView` component with mobile support and inspect-diff row actions, integrated into the header
Fusion-Task-Id: FN-3863
- Add secure archive subPath handling to company package parsing, including traversal/absolute-path validation
- Parse GitHub website tree URLs from companies.sh metadata to derive preferred branch and nested subPath
- Wire dashboard company import flow to download the correct branch archive and parse nested manifests with clear API errors
- Add parser and route tests for subPath success/failure cases and include changeset for @runfusion/fusion
Fusion-Task-Id: FN-3896
- Persist per-provider notification test results and render inline success/error feedback blocks
- Add ntfy "Test message notification" action wired to message-event test payload
- Keep toast notifications while also showing provider-specific status text with aria-live feedback
- Update SettingsModal tests to verify ntfy message-event call path and inline webhook/ntfy feedback rendering
Fusion-Task-Id: FN-3825
- Increase the member role text sizing in CreateRoomModal for better readability
- Update CreateRoomModal.css with the adjusted typography value
- Keep the change scoped to create-room role styling only
Fusion-Task-Id: FN-3808
Added pending-approval badge indicators across the agent detail view, agents overview, mailbox, header, and mobile nav, wired through new and existing agent/mailbox APIs, with test coverage and documentation updates.
Fusion-Task-Id: FN-3550
- Add dashboard approvals APIs and route handlers for listing requests, fetching detail, and submitting approve/deny decisions
- Emit approval SSE events and subscribe mailbox refresh logic to keep approval lists and badges live
- Extend Mailbox view with an Approvals tab, pending/history filters, request detail history, and approve/deny actions
- Update mailbox styles, approval route tests, and docs for the new approvals workflow
Fusion-Task-Id: FN-3549
Added canonical task review data endpoints (FN-3283) with new core types, expanded task workflow API routes, and updated GitHub integration (removing deprecated git-github routes in favor of consolidated github.ts). New API tests added for the task endpoints.
Fusion-Task-Id: FN-3283
This merge adds two substantial features: a rooms and chat sidebar system (FN-3806) with a new `CreateRoomModal` and enriched `ChatView`, wired through plugin routes and a new `listTasksModifiedSince` core API; and a durable review addressing workflow (FN-3282) that persists snapshots, renders addre
Fusion-Task-Id: FN-3282
Completes the FN-3166 multi-step removal of the legacy dashboard roadmap feature (backend routes, frontend API wrappers, nav state), along with FN-3792 deep-link URL support, and initial reports plugin scaffold with WhatsApp dedupe retention pruning.
Fusion-Task-Id: FN-3166
Merges the FN-3548 approval pause/resume system: agents now stall at workflow gates pending approval, with a full lifecycle spanning gate context lookup, action-gate pause/retry, executor and heartbeat pause callbacks, and dedicated approval decision routes. Also lands FN-3744 agent action routes an
Fusion-Task-Id: FN-3548
The merge delivers two major features: mesh auth snapshot synchronization across nodes (FN-3707 steps 2/4/5, including core types, central-core plumbing, peer-exchange updates, and settings/node sync route helpers) and a bundled roadmap plugin with chat UX improvements (FN-3162, FN-3756, FN-3771, FN
Fusion-Task-Id: FN-3707
Merges reviewState hardening (FN-3280 steps 2-3: hardened persistence, API fixes, and PR feedback sync), stepIndex reconciliation for task updates (FN-3757), roadmap route context extraction into the fusion-plugin-roadmap plugin (FN-3160), and shared state snapshots for mesh sync with autostash hard
Fusion-Task-Id: FN-3280
