Commit Graph

134 Commits

Author SHA1 Message Date
gsxdsm
8bc3d7b0a5 FN-6042: raise dependency security floors
Harden dependency floors and update the Vitest toolchain to patched releases.

- upgrade workspace vitest and @vitest/coverage-v8 dependencies to the 4.1 line across packages and plugins
- pin transitive protobufjs via pnpm overrides and lockfile updates to patched versions
- adapt Vitest configs, engine test helpers, and security-floor coverage for the new dependency baselines
- add the published CLI changeset and related workspace/package metadata updates included in the task branch

Files changed:
 .changeset/fn-6042-security-dependencies.md        |   5 +
 AGENTS.md                                          |   4 +
 Dockerfile                                         |   3 +
 docs/PLUGIN_AUTHORING.md                           |   2 -
 package.json                                       |   3 +-
 packages/cli/package.json                          |   4 +-
 packages/cli/vitest.config.ts                      |   2 +-
 packages/core/package.json                         |   4 +-
 packages/core/vitest.config.ts                     |   2 +-
 packages/dashboard/app/test/mockApi.ts             |   4 +-
 packages/dashboard/package.json                    |   4 +-
 packages/dashboard/vitest.config.ts                |   2 +-
 packages/desktop/package.json                      |   4 +-
 packages/desktop/vitest.config.ts                  |   2 +-
 packages/droid-cli/package.json                    |   2 +-
 packages/droid-cli/vitest.config.ts                |   2 +-
 packages/engine/package.json                       |   4 +-
 .../engine/src/__tests__/executor-test-helpers.ts  |  29 +-
 .../engine/src/__tests__/gridlock-detector.test.ts |   5 +-
 .../src/__tests__/heartbeat-scheduler.test.ts      |   3 +-
 packages/engine/src/__tests__/scheduler.test.ts    |  24 +-
 packages/engine/src/__tests__/self-healing.test.ts |   5 +
 packages/engine/tsconfig.json                      |   3 +-
 packages/engine/vitest.config.ts                   |  10 +-
 packages/i18n/package.json                         |   2 +-
 packages/i18n/vitest.config.ts                     |   7 +
 packages/mobile/package.json                       |   2 +-
 packages/mobile/vitest.config.ts                   |   2 +-
 packages/pi-claude-cli/package.json                |   2 +-
 packages/pi-claude-cli/vitest.config.ts            |   2 +-
 packages/pi-llama-cpp/package.json                 |   2 +-
 packages/pi-llama-cpp/vitest.config.ts             |   2 +-
 packages/plugin-sdk/package.json                   |   2 +-
 packages/plugin-sdk/vitest.config.ts               |   2 +-
 .../examples/fusion-plugin-auto-label/package.json |   2 +-
 .../fusion-plugin-auto-label/vitest.config.ts      |   2 +-
 .../examples/fusion-plugin-ci-status/package.json  |   2 +-
 .../fusion-plugin-ci-status/vitest.config.ts       |   2 +-
 .../fusion-plugin-notification/package.json        |   2 +-
 .../fusion-plugin-notification/vitest.config.ts    |   2 +-
 .../fusion-plugin-settings-demo/package.json       |   2 +-
 .../fusion-plugin-settings-demo/vitest.config.ts   |   2 +-
 plugins/fusion-plugin-acp-runtime/package.json     |   2 +-
 plugins/fusion-plugin-acp-runtime/vitest.config.ts |   2 +-
 plugins/fusion-plugin-agent-browser/package.json   |   2 +-
 .../fusion-plugin-agent-browser/vitest.config.ts   |   2 +-
 .../fusion-plugin-cli-printing-press/package.json  |   2 +-
 .../vitest.config.ts                               |   2 +-
 .../package.json                                   |   2 +-
 .../src/__tests__/orchestrator-live-output.test.ts |   4 +-
 .../vitest.config.ts                               |   2 +-
 plugins/fusion-plugin-cursor-runtime/package.json  |   4 +-
 .../fusion-plugin-dependency-graph/package.json    |   4 +-
 .../vitest.config.ts                               |   2 +-
 plugins/fusion-plugin-droid-runtime/package.json   |   2 +-
 .../fusion-plugin-droid-runtime/vitest.config.ts   |   2 +-
 plugins/fusion-plugin-even-cards/package.json      |   2 +-
 plugins/fusion-plugin-even-cards/vitest.config.ts  |   2 +-
 .../package.json                                   |   2 +-
 .../vitest.config.ts                               |   2 +-
 plugins/fusion-plugin-hermes-runtime/package.json  |   2 +-
 .../fusion-plugin-hermes-runtime/vitest.config.ts  |   2 +-
 .../fusion-plugin-openclaw-runtime/package.json    |   2 +-
 .../vitest.config.ts                               |   2 +-
 .../fusion-plugin-paperclip-runtime/package.json   |   2 +-
 .../vitest.config.ts                               |   2 +-
 plugins/fusion-plugin-reports/package.json         |   2 +-
 .../src/__tests__/review-panel.test.ts             |   6 +-
 plugins/fusion-plugin-reports/vitest.config.ts     |   2 +-
 plugins/fusion-plugin-roadmap/package.json         |   2 +-
 plugins/fusion-plugin-roadmap/vitest.config.ts     |   2 +-
 plugins/fusion-plugin-whatsapp-chat/package.json   |   2 +-
 .../fusion-plugin-whatsapp-chat/vitest.config.ts   |   2 +-
 pnpm-lock.yaml                                     | 626 ++++++++-------------
 .../__tests__/dependency-security-floor.test.mjs   |  95 ++++
 75 files changed, 475 insertions(+), 491 deletions(-)

Fusion-Task-Id: FN-6042

Fusion-Task-Lineage: fff6a1cb-8937-435c-9a91-b7c7a59cc80e
2026-06-08 15:19:27 -07:00
gsxdsm
693ed6290a Merge remote-tracking branch 'origin/main' into gsxdsm/cli-agent-interface
# Conflicts:
#	CONCEPTS.md
#	packages/core/src/__tests__/db-migrate.test.ts
#	packages/core/src/__tests__/db.test.ts
#	packages/core/src/__tests__/goals-schema.test.ts
#	packages/core/src/__tests__/insight-store.test.ts
#	packages/core/src/__tests__/merge-request-record.test.ts
#	packages/core/src/__tests__/mission-store.test.ts
#	packages/core/src/__tests__/run-audit.test.ts
#	packages/core/src/__tests__/store-merge-queue.test.ts
#	packages/core/src/__tests__/task-documents.test.ts
#	packages/core/src/db.ts
#	packages/dashboard/src/__tests__/agent-onboarding.test.ts
#	packages/dashboard/src/__tests__/ai-refine.test.ts
#	packages/dashboard/src/__tests__/chat-attachment-routes.test.ts
#	packages/dashboard/src/__tests__/experiment-routes.finalize.test.ts
#	packages/dashboard/src/__tests__/milestone-slice-interview.test.ts
#	packages/dashboard/src/__tests__/mission-interview.test.ts
#	packages/dashboard/src/__tests__/pr-metadata-generator.test.ts
#	packages/dashboard/src/__tests__/project-pause-resume-routes.test.ts
#	packages/dashboard/src/__tests__/routes-approval-sandbox-provisioning.test.ts
#	packages/dashboard/src/__tests__/routes-approval-secrets.test.ts
#	packages/dashboard/src/__tests__/routes-approval.test.ts
#	packages/dashboard/src/__tests__/routes-worktrunk.test.ts
#	packages/dashboard/src/__tests__/session-error-recovery.test.ts
#	packages/dashboard/src/__tests__/session-persistence-roundtrip.test.ts
#	packages/dashboard/src/__tests__/session-reconnect.test.ts
#	packages/dashboard/src/__tests__/session-resume-history.test.ts
#	packages/dashboard/src/__tests__/setup-routes.test.ts
#	packages/dashboard/src/__tests__/subtask-breakdown.test.ts
#	packages/dashboard/src/routes/__tests__/agent-avatar-routes.test.ts
#	packages/dashboard/src/routes/__tests__/custom-providers.test.ts
#	packages/dashboard/src/routes/__tests__/docker-node-routes.test.ts
#	packages/i18n/locales/en/app.json
#	plugins/fusion-plugin-roadmap/src/store/__tests__/roadmap-store.test.ts
2026-06-05 15:30:59 -07:00
gsxdsm
98d5d83e95 feat(test): add curated engine-core gate suite and test:gate command 2026-06-05 08:55:43 -07:00
gsxdsm
57631c749f feat(cli): TUI full-screen attach to cli-agent sessions (U14)
Suspend-and-handoff passthrough from the Ink TUI to a cli-agent PTY session:
mint an attach ticket, open the cli-session WebSocket, enter the alternate
screen + raw mode, stream WS scrollback/data frames to stdout, frame stdin
bytes into input messages, propagate resizes, and ACK consumed bytes for flow
control. Detach chord Ctrl-] restores the terminal and remounts Ink; a dropped
WS surfaces the error and restores the terminal cleanly.

Untrusted terminal output is neutralized through the same hardening filter the
dashboard WS bridge uses (re-exported from @fusion/dashboard) so OSC 52, non-
http(s) OSC 8 links, and device-status queries are stripped before reaching the
host TTY — the riskiest leg, since the host terminal honors more sequences than
xterm.js. CJK/double-width bytes pass through verbatim.

- packages/cli/src/commands/dashboard-tui/terminal-attach.ts (passthrough loop +
  injectable WS transport for tests)
- controller.openTerminalAttach() Ink integration (unmount/run/remount)
- adds `ws` runtime dep to packages/cli
- re-exports neutralizeTerminalOutput/flushTerminalOutput from @fusion/dashboard

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-04 23:56:10 -07:00
gsxdsm
f48602500f merge main: i18n branch + auto-merge override/log-retention work; union CONCEPTS.md vocabularies and docs/solutions reference line 2026-06-03 13:32:26 -07:00
gsxdsm
454b6cd0e9 feat(cli): add terminal-UI i18n runtime and upgrade Ink to 7 (U6)
Add a synchronous Node-side i18next instance built from the generated
@fusion/i18n CLI catalog map (no async backend, first frame localized), with
locale precedence --lang flag -> GlobalSettings.language -> env (LC_ALL/LANG/..)
-> en. Wrap the Ink DashboardApp render in <I18nextProvider> and thread a
--lang flag through runDashboard.

Upgrade ink 6.8 -> 7.0 (native CJK double-width measurement) and raise the
react/@types/react peer floor to ^19.2.0. A spike test confirms react-i18next
works under Ink's custom reconciler: localized first frame + re-render on
changeLanguage (including CJK), retiring the KTD1 unknown.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-03 08:28:52 -07:00
gsxdsm
9072d71306 feat(i18n): add @fusion/i18n package, catalogs, and i18next-cli tooling (U2)
Create the @fusion/i18n package as the authored source-of-truth: shared
i18next config (namespace split, script-aware zh-CN/zh-TW fallback, plural
setup), en base catalogs, and a generated CLI static-import map so the
terminal surface is drop-in for new locales. Add the i18next-cli workflow
(extract/sync/types/status/lint) wired as root i18n:* scripts, install the
i18next stack into dashboard + CLI, strip @fusion/i18n from the published CLI
manifest, gitignore the generated dashboard catalog tree, and add a changeset.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-03 08:00:31 -07:00
gsxdsm
e33dadd77a FN-5916: fix CLI bin targets for pnpm install
Use a committed launcher for published CLI bin links to avoid fresh-install warnings.

- point the published fn and fusion bin entries at a committed bin.mjs launcher
- add a launcher that checks for dist/bin.js and forwards execution to the built CLI
- cover bin target invariants across workspace packages and update CLI package config tests
- add a patch changeset for the published @runfusion/fusion package

Files changed:
 .changeset/fn-5916-cli-bin-launcher.md            |  5 ++
 packages/cli/bin.mjs                              | 20 ++++++
 packages/cli/package.json                         |  5 +-
 packages/cli/src/__tests__/bin-targets.test.ts    | 85 +++++++++++++++++++++++
 packages/cli/src/__tests__/package-config.test.ts |  8 ++-
 5 files changed, 118 insertions(+), 5 deletions(-)

Fusion-Task-Id: FN-5916

Fusion-Task-Lineage: 59d40654-ff77-4655-b9ce-3f3421521b2c
2026-06-02 21:54:14 -07:00
gsxdsm
de23db3789 FN-5862: bump pi coding agent dependencies to 0.78
Update Fusion to the latest pi coding agent and pi AI dependency release.

- bump @earendil-works/pi-coding-agent from ^0.77.0 to ^0.78.0 in the CLI, dashboard, and engine packages
- bump @earendil-works/pi-ai from ^0.77.0 to ^0.78.0 where it is consumed
- add a patch changeset documenting the published @runfusion/fusion update and refresh the lockfile

Files changed:
 .changeset/fn-5862-pi-coding-agent-0.78.md |   5 +
 packages/cli/package.json                  |   4 +-
 packages/dashboard/package.json            |   2 +-
 packages/engine/package.json               |   4 +-
 pnpm-lock.yaml                             | 193 +++++++++++++++++++----------
 5 files changed, 138 insertions(+), 70 deletions(-)

Fusion-Task-Id: FN-5862

Fusion-Task-Lineage: abdfa987-7ba5-45f7-8bea-3db3329a760c
2026-06-01 23:55:20 -07:00
gsxdsm
a8c920daf9 chore(release): v0.39.0
Version bump via changesets.
2026-05-31 20:05:32 -07:00
gsxdsm
f659a07a25 chore(release): v0.38.1
Version bump via changesets.
2026-05-30 00:18:41 -07:00
gsxdsm
45d22586dc chore(release): v0.38.0
Version bump via changesets.
2026-05-29 23:17:31 -07:00
gsxdsm
a960bb1031 chore(release): v0.37.0
Version bump via changesets.
2026-05-29 08:09:33 -07:00
gsxdsm
6c44ed16e7 chore(release): v0.36.0
Version bump via changesets.
2026-05-28 23:40:25 -07:00
gsxdsm
cec191eac3 FN-5638: migrate pi-ai and pi-coding-agent packages to @earendil-works scope
Fusion-Task-Id: FN-5638

Fusion-Task-Lineage: 6e99c156-5f6c-42e6-bd26-618e08ffd05f
2026-05-28 21:23:48 -07:00
gsxdsm
0a04837e7a chore(release): v0.35.0
Version bump via changesets.
2026-05-28 08:20:50 -07:00
gsxdsm
2f80c6ea7b chore(release): v0.34.0
Version bump via changesets.
2026-05-26 23:45:59 -07:00
gsxdsm
2d04cbe09d chore(release): v0.33.0
Version bump via changesets.
2026-05-23 23:12:21 -07:00
gsxdsm
959f7cd4eb chore(release): v0.32.0
Version bump via changesets.
2026-05-19 22:09:26 -07:00
gsxdsm
6ab2c3430d chore(release): v0.31.0
Version bump via changesets.
2026-05-15 08:41:59 -07:00
gsxdsm
ed5269d2a2 chore(release): v0.30.0
Version bump via changesets.
2026-05-15 01:50:08 -07:00
gsxdsm
f7eeb3b887 chore(release): v0.29.0
Version bump via changesets.
2026-05-13 21:39:15 -07:00
gsxdsm
8b5df5c79d chore(release): v0.28.1
Version bump via changesets.
2026-05-12 23:05:47 -07:00
gsxdsm
b967967e90 chore(release): v0.28.0
Version bump via changesets.
2026-05-12 22:53:17 -07:00
gsxdsm
9732f5f6f6 chore(release): v0.27.1
Version bump via changesets.
2026-05-12 07:48:21 -07:00
gsxdsm
35c0da57e3 chore(release): v0.27.0
Version bump via changesets.
2026-05-11 21:52:56 -07:00
gsxdsm
369b1ef572 chore(release): v0.26.0
Version bump via changesets.
2026-05-10 08:55:51 -07:00
gsxdsm
3958502f19 chore(release): v0.25.0
Version bump via changesets.
2026-05-09 17:07:29 -07:00
gsxdsm
5202b8e68f chore(release): v0.24.0
Version bump via changesets.
2026-05-09 13:56:53 -07:00
Aron Prins
55d8e87cc4 test(FN-000): harden local test suite 2026-05-07 17:26:51 +02:00
gsxdsm
e9b0aa48de chore(release): v0.23.0
Version bump via changesets.
2026-05-06 22:47:53 -07:00
gsxdsm
1ada98b53f chore(release): v0.22.0
Version bump via changesets.
2026-05-06 00:11:20 -07:00
gsxdsm
86ac019886 feat(FN-3299): auto-install bundled runtime plugins on first save
Hermes / OpenClaw / Paperclip runtime cards in Settings now lazily
register themselves on first Save instead of failing with `Plugin
"fusion-plugin-...-runtime" not found`. The CLI also bundles each
runtime plugin (with @fusion/plugin-sdk inlined via esbuild) into
dist/plugins/<id>/bundled.js so npm/npx-installed Fusion can load them
without the workspace SDK dependency.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-05 20:47:38 -07:00
gsxdsm
59eeb68198 chore(release): v0.21.0
Version bump via changesets.
2026-05-05 15:31:33 -07:00
gsxdsm
995cb294f6 fix(cli): declare node-pty as runtime dep so npx runfusion.ai terminal works on clean install
node-pty was previously only present transitively via the workspace
@fusion/dashboard devDependency, which is stripped at publish time. Fresh
users running `npx runfusion.ai` hit a 503 "PTY module could not be loaded"
when opening the dashboard terminal. Tightened the package-config guard so
this regression is caught next time.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-05 15:02:41 -07:00
gsxdsm
e27e423194 chore(release): v0.20.0
Version bump via changesets.
2026-05-05 14:56:34 -07:00
Fusion
6c59bdabb6 fix(FN-3433): restore workspace llama-cpp docs index integrity
- Restore workspace llama-cpp extension path resolution in CLI command handling
- Add missing docs/README.md index entries and keep README/doc links aligned
- Add regression coverage for docs README index completeness and docker docs references
- Carry forward related workspace stability updates and test hardening from the branch

Fusion-Task-Id: FN-3433
2026-05-04 23:59:52 -07:00
gsxdsm
9415d33f72 chore(release): v0.19.0
Version bump via changesets.
2026-05-04 15:54:42 -07:00
Fusion
b7ac46ecef feat(FN-3195): document llama.cpp provider setup and onboarding
Docs(FN-3195): adds llama.cpp provider setup and onboarding documentation to the main and dashboard READMEs.

Fusion-Task-Id: FN-3195
2026-05-04 10:18:38 -07:00
gsxdsm
1321830800 chore(release): v0.18.1
Version bump via changesets.
2026-05-04 09:55:19 -07:00
gsxdsm
625c5c5f4d chore(release): v0.18.0
Version bump via changesets.
2026-05-04 09:21:08 -07:00
Fusion
9e1790b58a feat(FN-3262): harden CLI native bundle externalization with tests
The merge adds Step 2 of the native externalization hardening for the CLI package, including a minor changeset for `@runfusion/fusion` and tests validating bundle output and package configuration behavior. The changes strengthen the contract governing how native modules are handled during the build

Fusion-Task-Id: FN-3262
2026-05-04 06:18:16 -07:00
gsxdsm
eb21d84fa3 chore(release): v0.17.2
Version bump via changesets.
2026-05-04 00:49:34 -07:00
gsxdsm
4a4028f526 chore(release): v0.17.1
Version bump via changesets.
2026-05-03 19:37:04 -07:00
gsxdsm
7bccf6860b chore(release): v0.17.0
Version bump via changesets.
2026-05-03 17:26:39 -07:00
gsxdsm
abeeec53bd chore(release): v0.16.0
Version bump via changesets.
2026-05-03 02:09:54 -07:00
Fusion
3fbe3eeb85 feat(FN-3239): auto-install dependency graph plugin in CLI daemon, dashboar
Merged the three-step FN-3239 feature: auto-installing the dependency graph plugin on first run across the `daemon`, `dashboard`, and `serve` commands, with the core logic centralized in `bundled-plugin-install.ts`, bundling configuration in `tsup.config.ts`, and a documentation file for the default

Fusion-Task-Id: FN-3239
2026-05-02 22:28:37 -07:00
gsxdsm
99f5ca3fb3 chore(deps): bump pi-ai and pi-coding-agent from 0.70.0 to 0.72.1
Refreshes the built-in model catalog feeding ModelRegistry with the
latest entries upstream pi-ai generates from models.dev (Anthropic,
OpenAI, Codex, Bedrock, etc.). No Fusion-side API changes; upgrades
applied in cli, dashboard, and engine package.json plus lockfile.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-02 15:49:07 -07:00
Fusion
e3f2cab798 feat(FN-3189): add explicit slow-lane CI gating and inline priority picker
Merges FN-3183/FN-3186 (priority picker in quick-entry box) and FN-3189 (CLI slow-lane test gating and CI lane) into the codebase. The quick-entry box gains inline priority selection, while the test suite introduces explicit slow/pre-release lane classification and a corresponding CI gate in the wor

Fusion-Task-Id: FN-3189
2026-05-02 03:48:04 -07:00
gsxdsm
1729f52d63 chore(release): v0.15.0
Version bump via changesets.
2026-05-01 23:38:03 -07:00