Harden dependency floors and update the Vitest toolchain to patched releases. - upgrade workspace vitest and @vitest/coverage-v8 dependencies to the 4.1 line across packages and plugins - pin transitive protobufjs via pnpm overrides and lockfile updates to patched versions - adapt Vitest configs, engine test helpers, and security-floor coverage for the new dependency baselines - add the published CLI changeset and related workspace/package metadata updates included in the task branch Files changed: .changeset/fn-6042-security-dependencies.md | 5 + AGENTS.md | 4 + Dockerfile | 3 + docs/PLUGIN_AUTHORING.md | 2 - package.json | 3 +- packages/cli/package.json | 4 +- packages/cli/vitest.config.ts | 2 +- packages/core/package.json | 4 +- packages/core/vitest.config.ts | 2 +- packages/dashboard/app/test/mockApi.ts | 4 +- packages/dashboard/package.json | 4 +- packages/dashboard/vitest.config.ts | 2 +- packages/desktop/package.json | 4 +- packages/desktop/vitest.config.ts | 2 +- packages/droid-cli/package.json | 2 +- packages/droid-cli/vitest.config.ts | 2 +- packages/engine/package.json | 4 +- .../engine/src/__tests__/executor-test-helpers.ts | 29 +- .../engine/src/__tests__/gridlock-detector.test.ts | 5 +- .../src/__tests__/heartbeat-scheduler.test.ts | 3 +- packages/engine/src/__tests__/scheduler.test.ts | 24 +- packages/engine/src/__tests__/self-healing.test.ts | 5 + packages/engine/tsconfig.json | 3 +- packages/engine/vitest.config.ts | 10 +- packages/i18n/package.json | 2 +- packages/i18n/vitest.config.ts | 7 + packages/mobile/package.json | 2 +- packages/mobile/vitest.config.ts | 2 +- packages/pi-claude-cli/package.json | 2 +- packages/pi-claude-cli/vitest.config.ts | 2 +- packages/pi-llama-cpp/package.json | 2 +- packages/pi-llama-cpp/vitest.config.ts | 2 +- packages/plugin-sdk/package.json | 2 +- packages/plugin-sdk/vitest.config.ts | 2 +- .../examples/fusion-plugin-auto-label/package.json | 2 +- .../fusion-plugin-auto-label/vitest.config.ts | 2 +- .../examples/fusion-plugin-ci-status/package.json | 2 +- .../fusion-plugin-ci-status/vitest.config.ts | 2 +- .../fusion-plugin-notification/package.json | 2 +- .../fusion-plugin-notification/vitest.config.ts | 2 +- .../fusion-plugin-settings-demo/package.json | 2 +- .../fusion-plugin-settings-demo/vitest.config.ts | 2 +- plugins/fusion-plugin-acp-runtime/package.json | 2 +- plugins/fusion-plugin-acp-runtime/vitest.config.ts | 2 +- plugins/fusion-plugin-agent-browser/package.json | 2 +- .../fusion-plugin-agent-browser/vitest.config.ts | 2 +- .../fusion-plugin-cli-printing-press/package.json | 2 +- .../vitest.config.ts | 2 +- .../package.json | 2 +- .../src/__tests__/orchestrator-live-output.test.ts | 4 +- .../vitest.config.ts | 2 +- plugins/fusion-plugin-cursor-runtime/package.json | 4 +- .../fusion-plugin-dependency-graph/package.json | 4 +- .../vitest.config.ts | 2 +- plugins/fusion-plugin-droid-runtime/package.json | 2 +- .../fusion-plugin-droid-runtime/vitest.config.ts | 2 +- plugins/fusion-plugin-even-cards/package.json | 2 +- plugins/fusion-plugin-even-cards/vitest.config.ts | 2 +- .../package.json | 2 +- .../vitest.config.ts | 2 +- plugins/fusion-plugin-hermes-runtime/package.json | 2 +- .../fusion-plugin-hermes-runtime/vitest.config.ts | 2 +- .../fusion-plugin-openclaw-runtime/package.json | 2 +- .../vitest.config.ts | 2 +- .../fusion-plugin-paperclip-runtime/package.json | 2 +- .../vitest.config.ts | 2 +- plugins/fusion-plugin-reports/package.json | 2 +- .../src/__tests__/review-panel.test.ts | 6 +- plugins/fusion-plugin-reports/vitest.config.ts | 2 +- plugins/fusion-plugin-roadmap/package.json | 2 +- plugins/fusion-plugin-roadmap/vitest.config.ts | 2 +- plugins/fusion-plugin-whatsapp-chat/package.json | 2 +- .../fusion-plugin-whatsapp-chat/vitest.config.ts | 2 +- pnpm-lock.yaml | 626 ++++++++------------- .../__tests__/dependency-security-floor.test.mjs | 95 ++++ 75 files changed, 475 insertions(+), 491 deletions(-) Fusion-Task-Id: FN-6042 Fusion-Task-Lineage: fff6a1cb-8937-435c-9a91-b7c7a59cc80e
Settings Demo Plugin
Example Fusion plugin demonstrating settings schema, hooks, and tools with configurable behavior.
Features
- Settings Schema: Four different setting types (string, number, boolean, enum)
- Lifecycle Hooks:
onLoad,onTaskCreated,onTaskCompletedthat read settings at runtime - Plugin Tools: Two AI-agent-callable tools that expose settings-driven functionality
Installation via Dashboard Settings
Method 1: Settings → Plugins (Recommended)
- Open the Fusion dashboard
- Navigate to Settings (gear icon in header)
- Click Plugins in the sidebar
- Click the Install button
- Enter the absolute path to this plugin directory:
/absolute/path/to/plugins/examples/fusion-plugin-settings-demo - Click Install to register the plugin
- The plugin will appear in the list with state "installed"
- Click the toggle to enable the plugin
- Click the Settings (gear) icon to configure the plugin:
- Greeting Message: Custom message shown when plugin loads
- Max Tags: Maximum tags to suggest per task (1-10)
- Enable Logging: Toggle console logging on/off
- Log Level: Minimum log level (debug, info, warn, error)
- Click Save Settings to apply configuration
- The plugin will reload with the new settings
Method 2: Manual Installation
# Clone the repository
git clone https://github.com/gsxdsm/fusion.git
cd fusion/plugins/examples/fusion-plugin-settings-demo
Then use the dashboard Settings → Plugins UI to install from the local path.
Settings
| Setting | Type | Default | Description |
|---|---|---|---|
greetingMessage |
string | "Hello from Settings Demo!" | Custom greeting shown on load |
maxTags |
number | 3 | Maximum tags to suggest per task |
enableLogging |
boolean | true | Enable/disable console logging |
logLevel |
enum | "info" | Minimum log level: debug, info, warn, error |
Tools
settings_demo_suggest_tags
Analyze a task description and suggest relevant tags based on keyword matching.
Parameters:
taskDescription(string, required): The task description to analyze
Returns: Suggested tags separated by commas
settings_demo_status
Get the current plugin configuration status.
Parameters: None
Returns: Current settings values
Hooks
| Hook | When | What it does |
|---|---|---|
onLoad |
Plugin starts | Logs greeting message and configuration |
onTaskCreated |
New task created | Suggests tags for tasks with descriptions |
onTaskCompleted |
Task reaches "done" | Logs completion message |
Development
# Install dependencies
pnpm install
# Run tests
pnpm test
# Build (if needed)
pnpm build
Project Structure
fusion-plugin-settings-demo/
├── manifest.json # Plugin metadata and settings schema
├── package.json # Package configuration
├── tsconfig.json # TypeScript configuration
├── vitest.config.ts # Test configuration
├── README.md # This file
└── src/
├── index.ts # Plugin implementation
└── __tests__/
└── index.test.ts # Plugin tests
Testing
The plugin includes unit tests that verify:
- Manifest correctness and metadata consistency
- Plugin export validity
- Settings schema definition
- Hook behavior with different configuration values
- Tool execution with settings-driven output
Run tests:
pnpm test
Example Usage
After installing and configuring the plugin:
- Create a new task with description mentioning keywords like "bug", "fix", "performance"
- The plugin will suggest relevant tags based on the content
- Check the console logs (if enabled) to see plugin activity
- Use the
/settings_demo_suggest_tagstool to get tag suggestions - Use the
/settings_demo_statustool to see current configuration
Notes
- The plugin uses
src/index.tsas the entrypoint for local installation - Settings changes trigger a plugin reload automatically
- Hook errors are isolated and won't crash the host system
- Tools use the current settings values at execution time