Pre-release polish. Two related changes bundled because they both land the
project on public-release footing:
Dashboard auth
- fn dashboard now gates the HTTP API + terminal/badge WebSockets behind a
bearer token by default. Token resolution order: --token flag,
FUSION_DASHBOARD_TOKEN env, FUSION_DAEMON_TOKEN env (back-compat), or an
auto-generated fn_<32 hex>. --no-auth disables. The startup banner prints
a click-to-open URL with ?token=<token> embedded.
- Auth middleware now also accepts fn_token=<token> as a query-string
fallback so EventSource and WebSocket clients (which can't set custom
headers) still authenticate.
- setupTerminalWebSocket / setupBadgeWebSocket now refuse unauthenticated
upgrades with a proper 401 + socket close.
- Frontend: new auth.ts module captures ?token= off the URL into
localStorage (key fn.authToken), strips it from the visible URL via
replaceState, and installs a window.fetch wrapper that injects
Authorization: Bearer <token> on every same-origin /api/* request.
EventSource/WebSocket URL builders (api.ts, sse-bus.ts, useTerminal,
useBadgeWebSocket) route through appendTokenQuery().
MIT license
- LICENSE file at repo root.
- license: "MIT" on root package.json and every packages/*/package.json,
plus description/bugs metadata on the CLI package.
Docs
- docs/cli-reference.md documents --token / --no-auth / FUSION_DASHBOARD_TOKEN
and the click-to-open auth flow.
- docs/getting-started.md, docs/docker.md, README.md point at the new flow
and the CLI reference section.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
When the engine restarts mid-step, an in-progress step may have already
passed plan + code review but not yet been flipped to done by the agent's
next task_update call. Previously, the next executor pass re-entered the
step and replayed both reviews — measured at 5-20 min of pure waste per
restart (observed in FN-2215 Step 1 and FN-2207 Step 6).
recoverApprovedStepsOnResume scans the task log for any in-progress step
whose most recent "code review Step N: APPROVE" entry is newer than its
most recent "Step N → pending" transition, and marks those steps done
before execute() runs. Safely skips steps that were reset after approval
(e.g. by a workflow revision) or only received REVISE verdicts.
Called from both the engine-restart path (resumeOrphaned) and the
unpause path, matching the two places the task log shows as vulnerable
to this race.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Extend isEphemeralAgent to treat metadata.internal agents as internal system agents
- Add legacy fallback detection for executor agents named verification-agent with no reportsTo
- Update AgentsView list and org tree filtering to honor the Show system agents toggle
- Add regression coverage in core and dashboard tests for default filtering and includeEphemeral visibility
- Extend dev server store with config defaults, normalization, and JSON persistence alongside runtime state.
- Add GET/PUT /api/dev-server/config endpoints with strict request validation for nullable fields and preview URLs.
- Add dashboard API helpers plus a useDevServerConfig hook to load and update selected script, source, command, and preview override.
- Update DevServerView and styles to support saved script selection, change/clear actions, and synchronized command/preview inputs.
- Expand dev server store/routes/component tests and document the config endpoint in architecture docs.
Fixes two classes of task failures found while investigating stuck in-review
tasks FN-2165 (worktree base ref missing) and FN-2152 (stray .tmp-fn-2152
gitlink accidentally committed via merger amend).
FN-2165 — stale baseBranch:
- resolveWorktreeStartPoint now returns null instead of throwing
NonRetryableWorktreeError when the stored baseBranch is gone. Caller clears
task.baseBranch and falls back to branching from the default base (HEAD) so
the task self-heals instead of failing permanently.
- New TaskStore.clearStaleBaseBranchReferences() nulls baseBranch on any
dependent task when its upstream branch is deleted. Wired into
cleanupBranchForTask (archive/delete), merger branch cleanup, self-healing
orphan-branch sweep, executor dep-abort and conflict-cleanup paths, and
stale-branch recovery.
Nested worktrees:
- assertWorktreePathNotNested guard in tryCreateWorktree refuses to create a
worktree inside another registered worktree (previously produced pathological
paths like .worktrees/green-finch/.worktrees/amber-panda when rootDir pointed
at a worktree instead of the main repo).
Context-overflow recovery (FN-2182 class):
- Reduced-prompt retry budget raised from 1 → 3 within the same session.
- Adds a fresh-session requeue path when same-session retries still overflow:
task moves back to todo with worktree retained, bounded by
computeRecoveryDecision / MAX_RECOVERY_RETRIES. Prevents late-step context
exhaustion from becoming terminal.
Gitlink prevention (FN-2152 class):
- .gitignore now excludes .tmp-fn-* and .tmp-kb-* so stray worktrees at the
repo root cannot be captured by git add -A.
- Merger amend flow now scans staged entries for 160000 gitlinks and unstages
them with a loud warning; the project uses no submodules, so any such entry
is a bug (this is how f8f90f26 landed in HEAD as .tmp-fn-2152).
Tests: new coverage for baseBranch fallback, nested-worktree guard, and
clearStaleBaseBranchReferences. Full engine + core + dashboard + cli suites
pass (15349 tests).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Root cause: during a triage split the AI could set a child task's
`dependencies` to the parent id. The parent is hard-deleted after the split,
and the scheduler's dep check treats a missing id as unmet — permanently
blocking the dependent. This stranded FN-2164 behind the deleted FN-2163.
- core/store.deleteTask: refuse to delete when any live task still has the id
in its `dependencies` array. Throws TaskHasDependentsError listing dependents
so callers can rewrite or recover. Covers the triage-split path and any
future caller.
- engine/triage task_create: validate each proposed dependency before creating
a child — reject the parent id, reject unknown task ids, allow siblings
created earlier in the same split or pre-existing tasks.
- engine/triage split cleanup: wrap the parent deleteTask in try/catch that
keeps the parent alive (safer than stranding dependents) and logs the reason.
- engine/triage prompts: both the mandatory-split and proactive-split prompts
now explicitly state that subtask deps must never reference the parent.
- dashboard/routes /subtasks/create-tasks: reject parent-id deps, drop unknown
deps with an audit log entry, surface parentTaskCloseError + droppedDependencies
in the response instead of silently swallowing them.
- engine/executor: on execute entry, detect the drift state (in-progress task
with no worktree) and emit a loud log + task log entry; the existing
fresh-worktree path then recovers. Prevents silent "operating without a
worktree" behavior that we saw on FN-2152.
Tests:
core: 2907/2907 pass (+5 new, incl. deleteTask guard regression)
engine: 2554/2554 pass (+17 new, incl. task_create dep validation)
dashboard: 9064/9064 pass (+2 new for /subtasks/create-tasks).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Root cause: during a triage split the AI could set a child task's
`dependencies` to the parent id. The parent is hard-deleted after the split,
and the scheduler's dep check treats a missing id as unmet — permanently
blocking the dependent. This stranded FN-2164 behind the deleted FN-2163.
- core/store.deleteTask: refuse to delete when any live task still has the id
in its `dependencies` array. Throws TaskHasDependentsError listing dependents
so callers can rewrite or recover. Covers the triage-split path and any
future caller.
- engine/triage task_create: validate each proposed dependency before creating
a child — reject the parent id, reject unknown task ids, allow siblings
created earlier in the same split or pre-existing tasks.
- engine/triage split cleanup: wrap the parent deleteTask in try/catch that
keeps the parent alive (safer than stranding dependents) and logs the reason.
- engine/triage prompts: both the mandatory-split and proactive-split prompts
now explicitly state that subtask deps must never reference the parent.
- dashboard/routes /subtasks/create-tasks: reject parent-id deps, drop unknown
deps with an audit log entry, surface parentTaskCloseError + droppedDependencies
in the response instead of silently swallowing them.
- engine/executor: on execute entry, detect the drift state (in-progress task
with no worktree) and emit a loud log + task log entry; the existing
fresh-worktree path then recovers. Prevents silent "operating without a
worktree" behavior that we saw on FN-2152.
Tests:
core: 2907/2907 pass (+5 new, incl. deleteTask guard regression)
engine: 2554/2554 pass (+17 new, incl. task_create dep validation)
dashboard: 9064/9064 pass (+2 new for /subtasks/create-tasks).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Rename core loader, dashboard server chat/planning routes, and frontend agent IDs/storage keys from kb-agent to fn-agent naming
- Update dashboard hooks and components (agent list, chat view, quick chat) to use the new fn agent key prefixes consistently
- Refresh engine, dashboard, core, and CLI tests/mocks to remove remaining kb-agent route and temp prefix references
- Update storage/gap-analysis docs to reflect fn agent key names and add a @gsxdsm/fusion patch changeset for the rename
- Rename engine export and call sites to use createFnAgent consistently across runtime flows
- Update core lazy engine loader and dashboard agent-generation/planning/chat paths to reference createFnAgent
- Refresh affected unit and integration tests, including renaming pi-create-kb-agent.test.ts to pi-create-fn-agent.test.ts
- Update AGENTS.md documentation references to match the new createFnAgent name
- Add an agentLogEntries table and schema migration updates for SQLite-backed agent log persistence
- Persist appended agent logs in SQLite and read task agent logs from the database instead of filesystem-only JSONL
- Import legacy agent log JSONL data into SQLite with type-safe handling for older log field shapes
- Preserve agent logs across task updates and archive flows, and update docs plus tests (including schema assertions) to cover the new behavior
- Add a changeset for @gsxdsm/fusion describing the agent log storage migration
- Add project settings for pushAfterMerge and pushRemote with defaults and typed merge result fields for push status/errors
- Implement post-merge remote sync in the merger with pull --rebase, auto/AI conflict resolution, and one non-fast-forward retry before push
- Expose push-after-merge controls in Settings modal with conditional Push Remote input and coverage for desktop/mobile save flows
- Document the new settings in the settings reference and stabilize CLI cross-build help test timeout
- Add an autoMerge prop to PrSection and show an auto-merge hint instead of manual PR actions
- Pass project autoMerge settings from TaskDetailModal into PrSection
- Preserve active automation messaging when PR creation is already in progress
- Expand PrSection tests to cover auto-merge enabled and disabled behavior
- Increase core RunMutationContext log entry bounds test timeout to reduce flakiness
- Add core helpers to list, read, and write .fusion/agent-memory/{agentId} files with strict path validation and exports
- Add dashboard API routes and client methods for agent memory file listing and single-file read/write operations
- Expand AgentDetailView memory tab with file selection, editing, save states, and inline validation feedback
- Add route/backend coverage for agent memory file endpoints and include a @gsxdsm/fusion minor changeset
- Add constructor guards in AgentStore and ReflectionStore that throw when rootDir is omitted under Vitest
- Keep default .fusion root resolution for non-test execution paths
- Prevent accidental test writes to unintended filesystem locations by forcing explicit paths
- Default AgentStore rootDir to resolve(".fusion") so agent data paths are absolute by default
- Default ReflectionStore rootDir to resolve(".fusion") for consistent absolute root resolution
- Validate Database kbDir is absolute and throw a descriptive error when a relative path is provided
- Update executor, reviewer, core prompt templates, and path-boundary messaging to reference the .fusion/memory/ directory instead of a single MEMORY.md file
- Broaden worktree boundary checks in pi path validation to allow .fusion/memory/ directory access from task worktrees
- Align memory backend metadata and dashboard backend labels to display file backend storage as .fusion/memory/
- Refresh core/engine tests to assert the new directory-based memory wording and boundary behavior
- Run memory-layer bootstrap before backend exists checks so legacy migrations seed canonical files during upgrades
- Preserve first-run MEMORY.md scaffold creation when long-term memory was created from the default migration scaffold
- Remove legacy direct file-exists fallback from backend ensure flow and rely on backend canonical paths
- Add tests for canonical read precedence in file/qmd backends and migration-preserving project-memory bootstrap
- Add heartbeatIntervalMultiplier to shared settings schema/types with settings parity coverage
- Apply heartbeat multiplier in engine scheduling logic while preserving explicit per-agent interval behavior
- Add Settings modal and Agents view controls for heartbeat multiplier and per-agent interval overrides, including new styling
- Expand dashboard and engine test coverage for multiplier/heartbeat controls and document the new setting
- Switch PluginLoader bypass-cache imports from a query string to a hash fragment for reload-safe module differentiation
- Update inline documentation to reflect hash-based cache busting semantics in Node ESM imports
- Close AgentStore in the affected agent-store test afterEach hook to ensure cleanup alongside TaskStore teardown
- Add "source" export entries for @fusion/core, @fusion/dashboard, and @fusion/engine package exports
- Configure tsup/esbuild to include the "source" condition when resolving workspace dependencies
- Pass --conditions=source to bun compile so compiled CLI binaries resolve source-conditioned exports consistently
- Update memory docs and contracts to reference canonical .fusion/memory files while treating the legacy top-level memory file as compatibility-only
- Tighten memory backend path normalization messaging and map stale qmd legacy top-level memory results back to .fusion/memory/MEMORY.md
- Remove legacy memory read/write fallback branches from backend initialization paths and rely on ensureOpenClawMemoryFiles() migration behavior
- Preserve migration-seeded legacy content during ensureMemoryFile() bootstrap and add regression coverage for seeded long-term memory creation
- Add test setup files in core and CLI that override HOME to a per-worker temp directory
- Wire the new isolation setup into core and CLI vitest setupFiles before existing test bootstrap
- Add a core canary test to verify HOME, homedir(), and defaultGlobalDir() resolve under isolated temp paths
- Document how global HOME isolation complements per-fixture isolation in test-project utilities
- Add a reusable createLogger utility in @fusion/core for prefixed log/warn/error output
- Replace plugin-loader console logging with structured logger calls across load, reload, stop, and hook paths
- Route plugin-scoped logger methods through createLogger, including debug gating on DEBUG=plugins
- Add regression tests that mock logger.js and verify key structured log emissions and error logging flows
- Update HEARTBEAT_NO_TASK_SYSTEM_PROMPT copy to emphasize inbox, memory, delegation, and heartbeat_done usage
- Expand heartbeat monitor tests to assert no-task prompt/tool alignment and preserve task-scoped prompt behavior
- Harden first-run and App view tests by using a safe cwd fallback and more robust async UI waits
- Add best-effort dashboard performance reporting hooks in App and useProjects via a new reportDashboardPerf API helper
The perf logs were temporary diagnostics used to identify that slow
reloads were caused by a registered remote node timing out in
/projects/across-nodes. Root cause is resolved and the short-circuit
for zero-remote setups (already committed in 7ea60382a) remains.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Introduce a shared test-utils module and global vitest setup that
guarantee tests never write to the real .fusion directory or leak temp
directories under /tmp.
Infrastructure:
- packages/core/src/__test-utils__/workspace.ts — tempWorkspace(),
useIsolatedCwd(), trackForCleanup(), assertOutsideRealFusion() with
auto-cleanup in afterEach.
- packages/core/src/__test-utils__/vitest-setup.ts — per-worker guard:
chdirs each worker into an isolated tmp dir, wraps process.chdir to
refuse the real .fusion, scopes tmp dirs under fusion-test-workers/
(skips cwd change in thread-pool workers where chdir isn't supported).
- packages/core/src/__test-utils__/vitest-teardown.ts — globalSetup
hook that wipes the shared parent even when workers are SIGKILLed.
- scripts/check-test-isolation.mjs + `test:isolated` / `test:check-
isolation` scripts for CI.
- @fusion/test-utils alias + setupFiles + globalSetup wired into core,
cli, engine, dashboard, tui vitest configs; matching tsconfig paths.
Test refactors (no behavior change):
- cli provider-settings, auth-paths, provider-auth — switch leaking
mkdtempSync calls to tempWorkspace().
- core migration, first-run, store-backward-compat — replace manual
process.chdir save/restore with useIsolatedCwd().
- tui fusion-context — replace 9 hardcoded tmp paths (collision-prone
under parallelism) with tempWorkspace().
- dashboard useTheme, FileBrowser, TaskCard — resolve source-file reads
against a PACKAGE_ROOT computed from import.meta.url instead of cwd,
so tests don't depend on the process working directory.
Verified: full suite (~15,500 tests across 8 packages + plugins) passes
and the orphan-detector reports zero leaked temp directories after a
complete run.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Remove legacy .fusion/memory.md fallback references and normalize prompts/docs to .fusion/memory/MEMORY.md
- Stop legacy mirror writes and fallback reads in core memory backend and project memory flows
- Update engine worktree boundary checks and tests for canonical memory file handling
- Align dashboard memory/settings surfaces and route tests with canonical memory behavior
- Add model-favorites persistence test coverage for mission interview and new agent dialogs
- Update core and engine prompt text to reference .fusion/memory/ with MEMORY.md and daily-note guidance
- Allow worktree tool boundary access to .fusion/memory/ files while preserving legacy .fusion/memory.md compatibility
- Revise memory compaction/insight extraction messaging and related type/docs comments to use canonical memory paths
- Refresh dashboard and test expectations across core/engine/dashboard/docs for the new memory path wording
- Convert seed-sample-nodes into a test-only helper and remove direct execution against the real central database
- Replace private-looking host examples with RFC 5737 test-net addresses in node connection docs and ConnectNodeModal expectations
- Add Vitest aliases for @fusion/core and @fusion/engine to stabilize cross-package test imports
- Load AgentReflectionService via local engine source path in in-process runtime to avoid alias resolution failures
- Recompute slice status when adding a feature so stale "complete" slices cascade back to milestone and mission statuses
- Require checkMissionCompletion to verify every feature is done before marking a mission complete
- Add mission-wide status-chain recomputation when stale complete slices or milestones are detected during reconciliation
- Expand core and engine tests to cover addFeature downgrades, stale complete states, and feature-level completion checks
- Emit chat:session:updated from ChatStore when message deletion mutates a session and cover deleteMessage false returns
- Pass ChatStore into SSE setup and forward chat session update events to connected clients
- Update useChat to consume SSE updates in real time with safer EnrichedChatSession typing
- Add core and dashboard tests for chat-store emissions, SSE forwarding, route wiring, and hook behavior
Adds a SelfHealingManager scan that finds tasks parked in in-review with
a failed pre-merge workflow step and no active session, and sends them
back through the existing sendTaskBackForFix flow (PROMPT.md injection,
step reset, todo → in-progress). Bounded by a new maxPostReviewFixes
setting (default 1) and a per-task postReviewFixCount so a persistently-
failing verifier cannot ping-pong a task indefinitely.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
