- writeActiveMergerStatus: writes .git/.fusion-merger-active.json
(taskId, pid, hostname, startedAt) at merge entry, deleted in finally.
Not a lock — purely informational so dashboards / status lines /
pre-Edit hooks can warn devs that rootDir is volatile during the run.
readActiveMergerStatus(rootDir) is exported for consumers.
- runObservedDestructiveSyncOp: snapshot-before/after wrapper around
destructive rootDir ops that are *supposed* to preserve unrelated
working-tree edits. resetMergeWithWarn now uses it — any future
silent wipe of dirty paths surfaces as an actionable warning instead
of going unnoticed. Not applied to the autostash's own reset
--hard / clean -fd; those are intentionally destructive and already
protected by the race-rescue stash.
- Race-rescue stashes from stashUnrelatedRootDirChanges are now
attached to the AutostashHandle and surfaced via store.logEntry so
the recovery command lands on the task feed instead of only
mergerLog.warn.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- deriveDeterministicSubjectSummary now picks the lowest-numbered
`complete Step N` headline (or the oldest commit) instead of the most
recent commit, so trailing quality-gate revisions stop hijacking the
squash-merge subject (FN-3617 landed as "align mailbox modal css..."
when 4 of 5 commits were the actual Claude OAuth fix).
- AI subject + body system prompts in ai-summarize.ts now weight by
commit theme rather than file size, so a small token cleanup that
touches a large CSS file no longer dominates the summary.
- stashUnrelatedRootDirChanges adds a bounded re-snapshot loop after
the primary stash is persisted but before \`git reset --hard\`. Any
late-dirty paths (concurrent dev edits during a long merger run,
parallel merger runs racing on rootDir, late test/build artifacts)
get captured in labeled \`race-rescue-N\` stashes recoverable from
\`git stash list\`, instead of being wiped by the destructive reset.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Add eval score category types and exports in core with store support and coverage
- Implement engine evaluator evidence extraction and persistence with dedicated tests
- Update evaluator flow and cron wiring to record evidence alongside eval runs
- Refresh architecture, storage, and eval docs for evidence and categorization behavior
Fusion-Task-Id: FN-3391
Merges five commits implementing centralized runtime skill forwarding that preserves Fusion context across the Hermes runtime layer. The engine's `agent-runtime` and `agent-session-helpers` were updated to forward skills at runtime, with `runtime-adapter.ts` and its types extended to carry context.
Fusion-Task-Id: FN-3612
Two cuts to wasted work in the merge verification loop:
1. After the in-merge fix agent runs, fingerprint the working tree
(`git diff HEAD` + `git status --porcelain`, sha256). If the post-fix
fingerprint matches pre-fix and is non-empty, the agent didn't actually
change anything — re-running the same failing command can only yield
the same failure, so log and report the attempt as unsuccessful without
paying the test/build cost. Empty fingerprints (snapshot tooling failed)
fall through to the existing re-run path so we never silently swallow a
real fix.
2. Inside `syncDependenciesForMerge`, hash the active lockfile and compare
against `node_modules/.fusion-install-marker` (written after each
successful install). When they match, skip `pnpm install
--frozen-lockfile` even if `package.json` is staged. Covers the common
case where `package.json` changes but the lockfile doesn't, and
amortizes install across auto-recovery re-enqueues that hit the same
worktree.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Exported the eval score category type from `@fusion/core` and added a defensive guard in the evaluator to prevent edge-case failures in the score evaluation switch.
Fusion-Task-Id: FN-3390
This merge restores the canonical agent lifecycle with termination scoped at the run level (FN-3580, 4 steps), adds sender-side wake recipient override for messages, and introduces test isolation CI enforcement with a stuck-requeue race fix. UI changes remove terminated-agent indicators from AgentDe
Fusion-Task-Id: FN-3580
Documents the live reviewer override behavior in the settings reference and task management guides, adding two lines to each file for a total of 4 lines of documentation.
Fusion-Task-Id: FN-3595
This merge lands five FN-3593 commits establishing a test isolation contract with a new `scripts/check-test-isolation.mjs` guard that scans for accidental `beforeEach`/`afterEach`/`beforeAll`/`afterAll` in setup helpers, plus per-package `setup-test-isolation.ts` bootstraps that canonicalize the pat
Fusion-Task-Id: FN-3593
Senders can now force the recipient agent to wake on receipt regardless
of the recipient's `messageResponseMode`. Surfaced as a "Wake recipient
immediately" checkbox in MessageComposer and as a `wake_recipient`
boolean param on the `fn_send_message` agent tool. Carried as
`metadata.wakeRecipient: true` on the message; the heartbeat hook
treats forced wakes as `message_received_urgent` in the wake delta so
agents can distinguish them from normal `messageResponseMode: immediate`
wakes.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
When SelfHealingManager.recoverCompletedTasks moved a task from
in-progress to in-review, the executor's stuck-kill cleanup running in
execute()'s finally block could fire 20s later, see a stale captured
task.column = "in-progress", and overwrite the recovery by tearing down
the worktree and moving the task back to todo with all step progress
reset. Both the outer-finally and step-session requeue blocks (and the
force-requeue setTimeout in markStuckAborted) now re-read the latest
column and skip cleanup entirely if the task has moved past
in-progress/todo.
Adds a new preserveProgressOnStuckRequeue setting (default: true,
toggle in Settings near the Stuck Task Timeout) so stuck-requeue passes
{ preserveProgress: true } to moveTask. Completed step statuses now
survive the bounce so the agent resumes from where it left off instead
of restarting every step from pending.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The InProcessRuntime constructed its AgentStore with only `rootDir`, leaving
task-claim/checkout/release operations unconfigured. As a result, the
heartbeat auto-claim scan logged "TaskStore not configured for task-claim
operations" whenever a relevant todo was found. Pass the runtime's TaskStore
through to the AgentStore so claimTaskForAgent succeeds.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This merge introduces a memory file markdown preview feature (FN-3584) with corresponding documentation, refines the AgentDetailView and AgentLogViewer components in the dashboard, and adds defensive collision handling for worktree operations during manual task moves (FN-3583).
Fusion-Task-Id: FN-3584
Two related bugs let two in-progress tasks share a single
.worktrees/<name> directory:
1. The dashboard POST /tasks/:id/move route promoted tasks to
in-progress without allocating a fresh worktree path, so a queued
task carrying a stale worktree field from a prior preserveResumeState
requeue could land in-progress on a directory already held by another
active task.
2. moveTask({preserveResumeState:true}) kept the worktree pointer on
requeue. When the on-disk checkout was later removed or reassigned,
the next dispatch collided with a worktree the scheduler had handed
to another task.
moveTask now releases the worktree pointer on every reopen-to-todo hop
(branch is kept so committed progress survives via git worktree add
<path> <branch>). A new preserveWorktree option opts internal bounces
out of the release. moveTask also accepts an allocateWorktree callback
that runs under a new cross-task allocation lock in TaskStore, so two
concurrent moves cannot pick the same name from a stale snapshot. Both
the manual-move route and the scheduler dispatch path flow through the
allocator and share the lock.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Convert the dynamic await import("./agent-session-helpers.js") and
await import("./session-skill-context.js") calls inside the heartbeat
executor to static top-level imports, matching the rationale of
38933c770 (which already made the sibling pi.js import static).
This surfaces ERR_MODULE_NOT_FOUND at engine load time rather than
mid-heartbeat when a worktree is on a branch missing the helpers.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Completes typing for the scheduled evaluator integration in the cron runner and project engine, with corresponding test updates in the evaluator test file.
Fusion-Task-Id: FN-3389
This merge adds a complete plugin management system to Fusion: a new `fn plugin` CLI command for installing/removing plugins, a plugin loader in core, a plugin runner in engine, and dashboard routes for plugin management UI, along with a plugin management guide in docs. It also documents task evalua
Fusion-Task-Id: FN-3565
Merged branch removes the duplicate desktop "Todos" nav entry from the Header, syncs the `allowParallelExecution` runtime toggle into `AgentDetailView`, and updates the corresponding docs (agents.md, settings-reference.md, todo-view.md, dashboard-guide.md) to reflect the navigation change. Tests wer
Fusion-Task-Id: FN-3539
This merge completes the agent terminated state alignment (FN-3535), adding "running → terminated" transition support with consistent styling and lifecycle controls across the heartbeat engine, agent store, and dashboard UI, plus plugin author documentation improvements (FN-3537) and plugin loader t
Fusion-Task-Id: FN-3535
Refactored plugin-loader tests and implementation to isolate plugin test contamination, improving test independence in `@fusion/core`.
Fusion-Task-Id: FN-3564
TriageProcessor.stop() previously only halted the polling loop, so
in-flight specify sessions and their reviewer subagents kept streaming
past shutdown. Extracted the existing global-pause teardown into
abortAndDisposeActiveSessions() and call it from stop() too.
aiMergeTask creates three sessions during a merge — autostash resolver,
in-merge verification fix agent, and pull-rebase conflict resolver — but
only the autostash one was registered via onSession. The other two are
now registered (with onSession threaded through pushToRemoteAfterMerge
into the rebase resolver chain), so ProjectEngine.stop() actually
disposes whichever merger session is running when shutdown lands.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Update enginePaused setting docs to specify stuck-task timers are suspended while pauses are active
- Document that paused wall-clock time does not count toward taskStuckTimeoutMs, including shared globalPause windows
- Clarify that unpausing restores scheduling and grants active sessions a fresh stuck-task grace window before detection resumes
Fusion-Task-Id: FN-3538
Merges FN-3534 to surface task provenance in CLI extension outputs (task list/show) with corresponding tests and a changeset for the published `@runfusion/fusion` package. Also includes FN-3297 test coverage for incomplete runtime distribution trees in the test-artifacts script.
Fusion-Task-Id: FN-3534
Recovery path now calls completeRun(terminated) so the canonical agent-state
transition runs, and reconcileOrphanedRunningAgents both catches stale-heartbeat
cases and runs every poll so pre-existing stuck rows self-heal post-upgrade.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Permanent agents now run heartbeats regardless of bound-task block state.
The prior queued+blockedBy early-exit and its state-tracking machinery are
removed; HEARTBEAT_SYSTEM_PROMPT is rewritten to scope heartbeats to
ambient coordination (messaging, memory, finding work, delegation,
surfacing/chasing blockers, status). Task body work continues via the
executor path. Ephemeral agents are unchanged.
New allowParallelExecution flag (default true, permanent agents only) on
AgentHeartbeatConfig. When false, heartbeat and executor paths serialize
symmetrically: a heartbeat will not start while the agent's bound task
has an active executor session, and an executor session will not start
while the agent has an active heartbeat run. Either side re-dispatches
the other's deferred work on completion. UI toggle surfaces in the
agent's Heartbeat Settings tab.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
When a permanent agent has allowParallelExecution=false, TaskExecutor.execute()
defers if the agent has an active heartbeat run, and HeartbeatScheduler defers
a heartbeat if the agent's bound task has an active executor session. Each side
re-dispatches the other's deferred work on completion via resumeTaskForAgent
and the in-process runtime's onRunCompleted hook.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The CLI proxy already had a remove() trap, but the engine's
createFusionAuthStorage was missing it. Without this trap, calling
remove() on a provider would delete the credential from storage but
not add it to loggedOutProviders, allowing fallback credentials to
resurrect the provider on the next read.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Reorder logout/set/remove traps so in-memory loggedOutProviders is only
updated after the underlying storage write succeeds. If target.logout()
or target.set() throws, the tombstone set now stays consistent with the
actual storage state.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The list() trap now applies a final filter against loggedOutProviders,
matching the defensive approach used in the CLI layer. While target.logout()
removes entries from underlying storage, this prevents any edge case where
a logged-out provider could appear in list() results.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- get() now returns undefined for logged-out providers instead of
delegating to target.get() which could bypass the guard
- getCredential() in provider-auth returns undefined for logged-out
providers instead of falling through to authStorage.get()
- getAll() skips logged-out providers at top of loop
- list() filters modelsJsonApiKeys against loggedOutProviders
- Added remove() trap in provider-auth for clearApiKey flow
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The logout flow had two bugs causing credentials to reappear immediately:
1. The codebase has two separate auth storage Proxy chains:
- createFusionAuthStorage (engine, for agents)
- mergeAuthStorageReads (CLI, for dashboard UI)
Neither had a logout trap, so supplemental credentials from
~/.claude/.credentials.json were never excluded after logout.
2. The upstream AuthStorage.hasAuth() checks environment variables
(ANTHROPIC_API_KEY), which always returns true regardless of logout.
Fix: Add loggedOutProviders tracking to both Proxy chains. All query
traps (has, hasAuth, get, getAll, list, getApiKey) return false/undefined
for logged-out providers instead of delegating to the underlying storage.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
When rootDir is the developer's primary checkout, the merger stashes
uncommitted edits before its hard resets and applies them back at the
end. Previously a pop conflict logged a single warning and silently
left the stash in place — a subsequent merge would push another
autostash on top, burying the first. Recent FN-3299 work was lost this
way and surfaced two side-by-side fusion-merger-autostash entries in
the local stash list.
Three changes:
- AI auto-resolve on apply conflict. The new
runAiAgentForAutostashConflict spawns the same createResolvedAgentSession
path as the in-merge fix-agent, instructs it to clear conflict markers
in place without committing, and verifies markers are gone post-run.
On verified success the stash is dropped; on any failure or remaining
markers the stash is left intact for manual recovery.
- Outcome surfaced via new MergeResult.autostash (AutostashOutcome)
field so dashboard / CLI / daemon can show developers whether their
work was reapplied cleanly, AI-resolved, or needs manual recovery.
- Deterministic stash identity. Replaced `git stash push` + label-grep
(which races against concurrent stashing tools) with `git stash create`
+ `git stash store`, capturing SHA atomically with snapshot creation
and using it for apply / drop. Untracked files captured via `git add
-A` before create; cleanup via `git reset --hard` + `git clean -fd`.
Also surfaces orphaned `fusion-merger-autostash:*` entries from prior
runs at merge entry, so they can no longer be silently buried.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Drops "terminated" from AGENT_STATES. The agent lifecycle now runs through
idle | active | running | paused | error. paused (carrying a pauseReason)
absorbs every former terminated use case — manual stop, heartbeat run
termination, spawned-child cleanup. Run status (agentRuns.status) is
unchanged: "terminated" stays a valid run-status value.
AGENT_VALID_TRANSITIONS allows direct any→idle transitions so resetAgent
no longer needs the intermediate hop.
Stack-wide:
- core/agent-store: lastError clearing + resetAgent simplified.
- engine/agent-heartbeat, executor, in-process-runtime: terminated state
writes → paused; halt-state listener fires on paused/error.
- dashboard: AgentsView/AgentListModal/AgentDetailView lose the Terminated
badge/option/state-block; agent pickers no longer filter terminated;
agentHealth drops the Terminated branch; routes/state cast widened to
the new AgentState union.
Tests across core and engine updated to assert paused for AgentState and
left "terminated" intact for run-status assertions.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Two related leaks in the agent lifecycle plus a refactor:
- Governance-skip paths in executeHeartbeat (budget/global-pause/engine-paused)
were leaving agents permanently stuck in `running` because they ran startRun
first and then short-circuited with skipStateTransition: true. Removed the
flag from those four paths so they flow through running → active. Added
HeartbeatMonitor.reconcileOrphanedRunningAgents() on start to recover any
rows already trapped in this state.
- Ephemeral task-workers piled up across runtime restarts because taskAgentMap
was in-memory only and the startup sweep ignored ephemerals with no taskId.
Now: spawn dedup via findAgentByName before create, on-disk fallback in
finalize when the in-memory map is empty, and the sweep deletes any
ephemeral not bound to an in-progress task.
- Extracted the lifecycle into EphemeralWorkerManager
(packages/engine/src/ephemeral-worker-manager.ts). InProcessRuntime drops
~140 lines and delegates via onTaskStart/onTaskComplete/onTaskError/
attachStateChangeListener/reconcileOrphaned. ChildProcessRuntime and
RemoteNodeRuntime inherit the fix because they delegate execution to a
worker that runs InProcessRuntime.
Durable assigned agents now return to `active` after task completion (was
`terminated` in the old contract).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Clarify task memory scope behavior across core types, project memory logic, engine tool prompts, and related docs
- Add regression coverage for memory scope and runtime plugin alias handling in core/dashboard/engine tests
- Add agent avatar API routes and dashboard UI support for avatar display and storage documentation
- Add line-number gutter toggle support in FileEditor and Files modal with accompanying component tests
- Include changeset for @runfusion/fusion documenting memory scope guidance update
Fusion-Task-Id: FN-3485
Raise checkForChanges slow-poll warn threshold from 100ms to 750ms so
warnings only fire when cycles approach the 1s poll interval, and route
skill-resolver info diagnostics through log() instead of warn().
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Documents the race called out in code review: when recovery samples a
stale run id and a fresh run is spawned for the same agent before
endHeartbeatRun() lands, only the sampled id is terminated — never the
freshly-spawned run.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
When the dashboard crashes mid-heartbeat, the agentRuns row is left in
status='active' forever. HeartbeatTriggerScheduler.onTimerTick treats
any active run as "still running" and skips every subsequent tick, so
agents go silent indefinitely (observed: 6+ hours). The existing
in-memory missed-heartbeat watchdog can't help — its trackedAgents map
is wiped on process restart.
SelfHealingManager.recoverStaleHeartbeatRuns now reconciles these on
startup and during periodic maintenance: terminates active runs whose
processPid does not match the current process, has no recorded pid, or
has been active for more than 6 hours.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The MissionLoop calls this.missionStore.listMissions() during startup
recovery, but the mock TaskStore's getMissionStore() return value didn't
include this method. When the runtime startup sequence raced ahead, it
would hit "listMissions is not a function" — making the test flaky.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The merge completes FN-3498 across three steps: adds ownership-aware done-task reconciliation to the merger, prevents branch-missing head SHA pollution during merge operations, and restores workspace typecheck compatibility. Core changes touch the merger (103 lines) and self-healing module (67 lines
Fusion-Task-Id: FN-3498
Merged four commits implementing comment-driven retriage: triage rules now respond to specific comment patterns (Step 1) and surface needs-replan feedback inputs in the UI (Step 2), with documentation for the new behavior and a bug fix restoring workspace typecheck defaults. Changes span the core ta
Fusion-Task-Id: FN-3502
This merge adds three major features: an eval domain (`eval-store.ts`, `eval-types.ts`) with persistence schema for evaluation data; a plugin dashboard view registry with navigation integration for third-party dashboard extensions; and GitHub source metadata traceability that locks and enforces issu
Fusion-Task-Id: FN-3513
Merges three major changesets: ephemeral agent cleanup for FN-3481 (runtime and spawned agent teardown), a fix for planning-mode refine continuation flow (FN-3209) plus a new local startup script, and chat SSE broadcast isolation with QuickChat backend unification. Key components affected include th
Fusion-Task-Id: FN-3481
Auto-archive previously wiped .fusion/tasks/{id}/ for stale done tasks
even while downstream agents (triage/todo/in-progress/in-review) still
needed to read those sibling specs from disk. Now the sweep skips any
done task that has an active dependent. The executor prompt also
instructs the agent to fall back to fn_task_show when sibling spec
files are missing on disk (e.g., manually archived deps).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
