flutter_agent_harness

• repin: factory a0e3a47 — machine-loop dead-end fixes (#458) (#725)

• chore: repin factory 24082c9 (token-URL silent push) (#723)
• chore: repin factory 05315d42640a15d04c65e67d686828ebb2b5b398 (target-repo silent update) (#722)
• chore: repin factory 5e275aa (git-merge silent update) (#721)
• chore: repin factory 19d60ef (update-branch PUT) (#717)
• chore: repin factory f1073c5 (REST update-branch) (#716)
• fix(sm): contents:write — update-branch pushes onto the head branch (#715)

Latest

Latest

Compare

• chore: repin factory 5519dc7 (deterministic merge state + version floor) (#714)
• chore: repin factory a0feb83 (REST shapes + budget-free localActions) (#711)
• chore: repin factory 3cae1d2 (REST mergeable_state + direct silent token) (#708)

• chore: repin factory 4b5b1be (silent-update-behind) (#707)
• fix(#687): silent token via factory input + repin 1274089 (#703)
• fix(cli): fit-preserving table column sizing (#686) (#688)
• feat(#687): machine-author passthrough via vars.MACHINE_AUTHOR + repin ceddca5 (#699)
• fix(#687): repin factory 40dd6f0 (dup-guard) + pr-aware stub run-name (#698)

• fix(#687): stub issue input must accept empty (PR-anchored dispatches) (#697)
• fix(#693): declare pr dispatch input; human-assigned issues are review-only (#696)
• feat(#687): PR-owned lifecycle wiring (pin dmtools-agents#442) (#694)
• fix(cube): gate web tool egress behind the cube network policy (#685)
• feat(agent): automatic tool-result spilling with symmetric previews (#684)

• fix(cli): hermetic resolveEffectiveCliArgs env + skip missing browser-ext artifact (#681)

• gh-671 TUI Theme switcher (#674)
• chore: untrack agent runtime input/outputs + gitignore
• fix(agent): survive starved hidden ranges on the auto-compact continuation (#677)
• ci: pin ubuntu-24.04 in the gate + repin factory (f23ef09)

• chore(factory): repin to the job-marker gap fix (ed77b3c)
• fix(cli): coalesce pre-run TUI output; exit hint keeps the session name (#503) (#672)
• chore(factory): repin to node24 actions bump (1818fe62ea748455f8c4090d36239c8c98da76d5)
• fix(release): annotated tag created with actions-bot identity — no more empty-ident exit 128 (run 35426119831) (#669)
• chore(factory): declare input modalities [text,image] in fa runner configs

• fix(release): AAB legs pin the store flavor (#665)
• Nightly red 2/2: 35418633939 — crap4dart pin, cli-visual stable pair, hub_overlay settle (#663)
• ci(nightly): fix four deterministic nightly-red failures (#662)

• feat(622): Android mobile.* automation ships as two release flavors — store (applicationId dev.fa1.app, the Play pipeline) and god (dev.fa1.app.god, sideload only, same release key) — with ONE CI variable driving both the gradle flavor and the FA_FLAVOR dart-define so the pair cannot drift. build-mobile.yml grows a store|god APK matrix (both APKs attach to the GitHub release; the Play AAB job is unchanged) plus a store-APK size-delta report against the previous release artifact (UT-CI-1, +10% fail threshold) and a disabled (if: false) emulator job pinning the shape for the six channel ITs (IT-flavor-1, IT-floor-1, IT-observe-1, IT-gesture-1, IT-shell-1, IT-consent-1). Tool tiers: store exposes mobile.launch/mobile.logs (own-app deep links + launcher); god adds mobile.hierarchy/mobile.tap/mobile.swipe/mobile.text/ mobile.screenshot (AccessibilityService + MediaProjection); mobile.shell rides an opt-in Shizuku bridge and fails with the named error Shizuku not running when absent. Everything is gated through the issue #19 availability floor with the honest reason "requires the god tier (sideload build) — get it at https://fa1.dev/android". Binding threat model: consent screen before accessibility activation, one-tap disable in Settings, redaction on extracted screen text, exec-tier approval + critical patterns on mobile.shell, god never ships to Play. Tier table, sideload + Shizuku steps, consent notes and the manual E2E checklist: docs/android-automation.md.

• fix(machine): drop accidental factory-agents gitlink; ignore the runtime clone (#655)
• fix(647): messaging delivery SLO <=2s — warm wake, universal yield, steering/Ctrl+S AC1-AC6 (#661)
• perf(503): boundary walk reads single-pass blocks instead of capped chunks — readBefore's doubling window re-decoded its whole buffer per pass (a 396 MB tail-after-compaction walked 10.3s; the linear block walk does it in 3.0s, 3.4x, byte-identical branch semantics); readBlockBefore reads one strip per page with per-page doubling bounded at 64MB/4096 records (#660)
• fix(653): stale auto-compacted marker on the busy row after the fold finishes (#658)

• fix(479): every rendered chrome region pays into the TUI viewport budget (#657)
• chore: repin factory to job task-list markers + exclude fix (2eaa5e17b) (#651)
• chore(factory): repin to timer-workingdir-fallback (#645)
• fix(503): windowed resume keeps the tail anchored while paging to the compaction boundary — the loadOlder loop slid the leaf out of residency on the first chunk, the branch read empty, and every deep-boundary resume fell back to a full open (38s on a 1.4 GB live session); growOlderUntil suspends eviction for the walk (#654)
• fix(640): lazy interpreter WASM loading + MemoryShell fallback — mobile cold boot no longer black-screens (#656)
• fix(643): claim-free store copy (en+ru) + Play metadata compliance gate (#652)
• gh-623 [BUG] After success authorization codemie auth request still presented in the session message (#646)
• feat: resume-timing caller attribution — full opens log the calling frames (names who bypassed the windowed path) (#649)

• feat: resume-timing instrumentation — session-open phases logged (resume_timing lines) (#648)
• fix(machine): dev runners carry targetRepository so the timer auto-save works (#644)

• --quiet (#641)
• fix(633): Outlook add-in sends - bridge/hub relay chain + empty-model guard (#639)
• fix(638): env-preconfig vision (input modalities end-to-end) + viewport-width command clipping (#642)
• fix(632): confine cube bash - SBPL write/read rules, redirect-target checks, loud degradation (#636)
• chore(factory): repin to c85468de — timer, excludes, flutter, 120-min timeout (#635)

• chore: ignore machine-loop workspace artifacts (codegraph, dmtools logs) (#637)
• fix(machine): wire the autocommit timer into all four runners (#634)
• fix(machine): runner path overrides — factory-agents/ layout for fa (#631)

• chore(factory): repin to dmtools-agents 4bbc817a (FA_VERSION=latest fix) (#626)
• feat(media): add DialImageDialect and same-host key fallback for image generation (#629)
• fix(cli): improve secret prompt layout, glass cropping, and waiting busy indicator (#627)
• fix(cli): sanitize and clip multiline shell job commands in waiting rows and job board (#628)
• fix(615): waiting row never clears after its job settles (#618)
• feat(machine): assignment-driven trigger — assign to ai-teammate starts the loop (#625)

• fix(613): staged publish tree analyzes clean (staging anchors + hosted dart_tui resolution + dry-run gate) (#617)
• fix(466): nightly auto-issue leg repo-pinning + green-run sunset (#616)
• feat(machine): dmtools-agents factory rollout — ai-teammate-author gated (#614)

• fix(597): staged publish self-contained + PR-time staged dry-run + dead-tag fix (#600)
• fix(611): poll pub.dev post-upload verify up to 11 min instead of failing at ~16s (#612)

• feat(app): pin-only widget publish PRs — retire per-widget submodules app-side (#232) (#268)
• fix(147): CA roots in task images, honest summary verdicts, gpu-tagged job names (#272)
• fix(147): CA roots in task images, honest summary verdicts, gpu-tagged job names (#272)
• fix(app): device-code connect — no unconsented auto-open, transient poll retries, lifecycle-aware polling (#229) (#269)
• feat(messaging): wall-clock catch-up for scheduled wake-ups (#259) (#265)
• ci: shard fa_ui tests ×3 + cap the 220s virtualisation soak (#283) (#285)
• ci(daily-publish): pin Flutter 3.47.x in the macOS/iOS legs — drop reliance on runner-local SDKs (#260, #261) (#281)
• fix(cli): TUI scheduled countdown ticks on the minute boundary while idle (#213) (#264)

Latest

Latest

Compare

• feat(app): setting to disable chat image preview downscale (#207) (#267)
• test: fix the flutter_app 3.47.4 macOS fallout that #248 did not cover — #233 (3 commits) (#251)
• fix(147): emit fully-qualified task ids into the harbor matrix (#263)
• fix(147): default CPU shards to Modal — the runner mac has no docker (#258)

• feat(200): session search field pinned atop the session lists (#246)
• fix(238): close migration-ordering data-loss window, stop deleted-session resurrection (#240)
• feat(199): session loading off the UI isolate - background parse, parallel listing, quick names, generation guards (#243)
• feat(239): store automation — daily EXTERNAL TestFlight + manual release-appstore.yml (App Store review) (#252)
• feat(147): Harbor adapter for fa + Terminal-Bench 4.0 run (self-hosted + Modal + Hub upload) (#254)
• fix(app): web IndexedDB session persistence — per-record keys, migration, quota isolation (#237) (#249)

• fix(142): unblock tb runs — LPT shards, doubled timeouts, buildable debian task images (#253)
• fix(fa_ui): hide the "Load earlier" banner on empty sessions (#223) (#247)
• test(233): triage + fix the 13+4 integration-failure clusters (#248)
• feat(224): apps collapse toggle - Apps icon in the chat header actions (#245)
• fix(215): split agent_service.dart and settings.dart under the 2800-line gate (#244)
• fix(234): latch the web boot signal; e2e waits on it, not the transient splash class (#242)

• feat(198): tree-grouped session listings (core + CLI) (#220)
• fix(ext): sessions survive reload/update/restart — issue #228 persistence vectors (#236)
• fix(config): merge-before-write + atomic save for ~/.fah/config.yaml (#221) (#235)
• fix(catalog): web installs widgets from CORS-friendly raw URLs (#231)
• fix(ctx): footer meter, over-window guard and compaction share one request-size basis (#217)

• chore(flutter): raise Flutter floor to 3.47 + js_widget_runtime ^0.4.121 (#230)
• fix(apps): unmute JSR media widgets on iOS — audio session category drift (#227)
• feat(apps): widget manifest i18n — additive nameI18n/descriptionI18n keys (#226)
• fix(catalog): single-slash URL join for all release-asset fetches (#219)

• feat(178): honor FA_LOG_FILE env var as the default for --log-file (#216)
• fix(197): four minor windowing defects from the round-4 review (#211)
• fix(196): HEP follow-up from #193 review (#210)
• fix(195): images follow-up - stale citation renumbering guard + F3/F4/F5 + config tests (#205)

• fix(327): provider connections can no longer assemble a model from one provider row and auth from another — the app-level guard (restorableBootConfig + AgentService) refuses mismatched model/auth entries up front with a ProviderConnectionException naming the entry, and 401-style auth failures surface the entry name ([<entry>] decoration) instead of a bare provider error. The Settings Providers section marks each saved row with a provenance badge — [local] for entries added on this surface, [synced] for seeds synced from the CLI (pre-provenance rows read as local) — and the office-host-bound outlook.* family now renders as a gated Tools row with the "available in the Outlook add-in host only" reason on every other surface (app, relay/SW registry, CLI tools listing) instead of staying silent. The drawer session selection debug line prints on CHANGE only (issue #327 AC6: the 3 s idle poll no longer spams 20 identical lines per minute). docs/tool-availability.md documents the outlook family row.

• fix(259): sleep-resilient scheduled wake-ups for schedule_message. All due-time math in ScheduledMessageQueue now rides an injectable wall clock (clock:), long waits are split into ≤60s timer legs that recompute the remaining delay from the wall clock on every fire (no duration-drift accumulation across OS sleep), and both hosts run a wall-clock catch-up sweep at every turn start (CLI _beginUserPrompt, app sendText) on top of the existing idle inbox-tick sweeps — the first post-sleep turn delivers every overdue record immediately. Catch-up is exactly-once per record (no replay of missed cycles); recurring self-re-arming cycles resume from "now" after a clock jump. Docs (AGENTS.md messaging section) describe an optional external cron/launchd pinger for delivery during lid sleep.

• feat(287): compaction 2.0 is the DEFAULT — every resolution point now falls back to the structured engine (judge-hide → checkpoint + expand, #148) instead of the classic lossy prefix summary: the core resolver (resolveCompactionEngine), the AutoCompactorFactory default, the CLI compaction host (config.compactionEngine ?? structured), the /settings summary line, and the app's per-compaction resolution. Classic 1.0 stays fully supported as the in-settings rollback — an explicit compaction.engine: classic (user or project yaml) or --compaction-engine classic is always honored, never rewritten. Migration: users without a compaction: section get structured on upgrade; nothing is rewritten on read. The app's Settings gained a Compaction section (issue #287): an engine picker — Structured (recommended) / Classic (legacy 1.0) — with honest one-line tradeoffs (structured: hidden-in-place + expandable, requires a configured model for the judge pass; classic: lossy summary, zero extra calls), the effective engine plus its source layer (project .fah/config.yaml

  user ~/.fah/config.yaml > structured default), a docs link, and writes that go through the core config service (surgical line edits validated before persisting — unrelated comments survive byte-for-byte). The choice applies at the next compaction (the per-compaction re-resolution, no restart needed). On the web there is no config yaml: the picker renders disabled with a note and the structured default applies. The CLI /settings summary mirrors the default in its compaction: line.

• fix(hub): boot online from the persisted DAP credential — with no DAP_MASTER_SECRET/DAP_CLIENT_SECRET in the environment, the CLI now seeds the hub kill switch from ~/.dap/config.json clientSecret (the explicit prior opt-in from /dap start), restoring the documented "the next boot is online by itself" behavior: hub mail delivery and hub peers in agent_directory (the browser extension, embedded hosts) work on a fresh boot. The fabric gate also reads the mutable environment overlay the plugin actually uses, not the read-only process environment.

• fix(195): images follow-up from the #190 review. F2: a stale [Image N] citation in history no longer silently rebinds to the WRONG image after compaction renumbering — once a renumbering boundary (compaction summary, structured marker, local-trim note) exists in the window, authored history citations degrade to the (image no longer available) note while generated content-keyed refs, carrier labels and the current message stay intact. F3: the current message's in-place images now carry their [Image N] label so the model can cite what it sees. F4: the app logs per-request cap drops through AppLog (logs/app.log) instead of silently dropping. F5: estimateContextTokens charges repeated images at the wire-replacement cost (first occurrence full, repeats ~32 chars), fixing the transcript-vs-wire estimation asymmetry; per-message estimateTokens is unchanged. F1: the images: config section gained the previously claimed tests — CLI parse/round-trip/strictness (bad bools, unknown keys, non-positive ints, malformed sections) and the config-service validator dispatch pin.

• feat(169): declarative-only secured theme API — theme packs (theme.json + optional wallpaper image in a .zip; strict schema validation with unknown-key rejection, path-traversal/symlink/size screens, WCAG contrast warnings), a Settings section to import, switch and remove packs (a colors-only apply keeps the current wallpaper; removing the active pack reverts atomically), wallpaper layers in the chat, apps grid and launcher screens, and the jsr.fa.theme bridge — list/current/apply behind the theme permission with a consent dialog per apply. Apps can never install or delete packs (no such API exists; pinned by a byte-scan test).

• chore(flutter): raise the Flutter floor to 3.47 (>=3.47.0) across flutter_app, packages/fa_ui, packages/fa_llm_flutter and yoclip; drop the meta: 1.18.0 dependency overrides (the 3.47 SDK declares meta ^1.18.3, so 1.19.0 resolves for dart_tui without an override); regenerate the flutter_app goldens for the 3.47.4 rendering (text/geometry drift only); clean up new-SDK lints in two config tests; ios Podfile now forces the iOS 16 deployment floor on pod TARGET-level build configs too (podspec-declared 15.0 targets broke the build against 16.0-only Promises under the newer toolchain).

• chore(deps): js_widget_runtime ^0.4.121 — typed fallback hardening for legacy manifest keys, widget manifest i18n compatibility, and the JSR video onError bridge.

• ci(merge-trigger): prefer PAT_TOKEN so machine merges land as the owner (#164)
• ci(159): skip mobile release cleanly when no binaries were built (#162)
• docs(backend-mode): reconnect semantics — turns survive client disconnect
• docs(backend-mode): memory mapping for backend mode
• docs(backend-mode): memory mapping for backend mode

• docs(backend-mode): pin MVP shape with mermaid architecture
• DAP slash-flow + CodeMie SSO expiry detection & auto re-auth (extension/app/CLI) (#145)

• docs(143): KB for the Monarch VersionOverrides manifest fix (#156)
• docs: backend agent mode research — fa behind product Go backends
• fix(143): manifest VersionOverrides command surface for Monarch/new OWA (#151)
• docs(144): real Outlook add-in installation guide (#149)

• feat(aiin): use the hosted AIIN sign-in page as the connect entry

• fix(publish): assemble the redaction e2e PEM fixture at runtime — pub.dev's key-leak validator rejected the 0.1.303 upload because the archive carried a literal (fake) private-key block in test/integration/redaction_e2e_test.dart; the file now builds the same byte-identical string from chunks.
• fix(roles): 500-class gateway errors ("Internal network failure, please try again later") now classify as transient transport failures and retry in place with backoff before failing over (previously only 502/503/504 did).
• feat(messaging): agent_directory rows show an 8-char short id, session names, last-activity ("active 2m ago" vs "asleep") and home-shortened cwd; agent_message to an asleep target launches a detached headless run of that session so pending mail is processed immediately (wake: false opts out).
• test(cli): pin session-start memory maintenance off in boot-race tests (CI flake: consolidate() consumed the scripted turn before /exit).

• feat(aiin): paste-key fallback — the service now blocks our redirects
• memory: session notes
• feat(skills): bundled create-goal skill — goal-writing discipline as /create-goal

• fix(aiin): open the web sign-in popup inside the tap gesture
• fix(app): drop the duplicate aiin_connect_flow golden-guard exemption
• fix(app): drop a duplicate golden-guard exemption key; memory: session notes
• feat(aiin): one-click web sign-in — the OpenRouter-style popup flow
• test(redact): pin the agent file-reading scenarios end to end
• docs(AGENTS.md): name-based addressing in the messaging fabric bullet
• fix(redact): entropy layer stops shredding paths, hashes and lockfile integrity
• test(app): regenerate goldens after AIIN-hosted form changes

• feat(browser): the browser extension (issue #23) — browser_ext/ (Chrome MV3) pairs a local fa with the browser over a loopback WebSocket bridge (fa serve --bridge [--port N] [--token T], /browser connect|status): wire protocol v1 client (hello/welcome, 1s→30s reconnect backoff, offline outbox, msgId dedupe, ping keepalive), one-time 32-byte pairing tokens (.fah/bridge/token, mode 0600, rotated by every connect, constant-time compare, non-chrome-extension:// origins refused, AC15), two-way mail relay over the file messaging fabric (browser-ext/<agentId> mailboxes). Eleven browser_* tools over the bridge (navigate/tabs/switch_tab/click/type/press_key/select/read_dom/ eval/screenshot/wait_for, exec tier, availability-gated under the browser + browser_eval ids — hidden until an extension pairs, docs/tool-availability.md). Two control planes: quiet content-script DOM ops by default, per-call trusted: true chrome.debugger path (E23 denied when DevTools owns the tab, any-tab screenshots via Page.captureScreenshot, AC16) with the debugging infobar as the honesty signal; task tab groups (fa — <task>) close agent-opened tabs on task_end or bridge disconnect (AC17). Self-contained mode: dart2js build of browser_ext/dart/ (scripts/build_browser_ext.sh → sw/agent.js + build/fa-extension.zip) runs the agent core inside the service worker — panel provider form (OpenAI-compatible endpoints; deterministic fake: provider for tests), approval banner (30s timeout = deny), JSONL session
  • compaction in chrome.storage, no shell (shellUnavailable), keys read only inside the SW (AC8). The embedded agent joins the DAP hub with an E2E-encrypted CLI-compatible identity (faDapKey): dap_peers/dap_dm tools, one mail deduper across bridge + hub links (AC18). Headless CI: test/browser_ext/ (real Chrome via --load-extension, --headless=new; integration-tagged) in .github/workflows/ browser-ext.yml; unit layers dart test test/browser/, browser_ext/dart dart test, node --test browser_ext/test/. Docs: docs/browser-extension.md.

• test(ollama): diagnose live forced-tool-call null args instead of a bare cast

• fix(tui): a long thinking burst froze the whole TUI (typing dead, spinner stuck — user report: "пиздец как тормозит" on a glm-5.3 session). Root cause: the CLI wrapped every thinking delta in inline markdown, and the escape-dense result drove AnsiMarkdown's inline link regex into quadratic backtracking — measured 10.9 s of synchronous work per coalesced 185 KB flush. Two fixes: thinking deltas now dim verbatim (spans cannot pair across deltas anyway), and inline span substitution is skipped for lines over 4 KB (AnsiMarkdown.inlineFormatMaxChars) — degenerate spans render verbatim, fences/rules/tables unchanged. Regression-tested by the new tool/thinking_lag_probe.dart PTY probe (burst streams: keypress echo p95 stays under budget) and a markdown unit test.
• docs(readme): reflect the shipped surface — status, design contract, what's inside (agent core, providers, sessions, tools, skills, approval gate, trajectory, messaging), CLI slash commands.

• feat(bash): automatic transient-failure retry — timeout-class failures (the model's per-call cap, or an outer future cap on a hung transport, e.g. a stalled gh API call) are retried up to 2 times (3 attempts total) with a 1s backoff before the error surfaces. Retries are visible as [bash attempt N/3 ... — retrying] notices in the tool output, and the final error carries them too. Aborts and real command failures (non-zero exit, exec errors, shell unavailable) are never retried.
• fix(app): the macOS/iOS app could boot to a black screen — the native Firebase SDK auto-configures the [DEFAULT] app from GoogleService-Info.plist at plugin registration, so the Dart Firebase.initializeApp threw an unhandled [core/duplicate-app] that killed main() before the first frame. The duplicate-app case now reuses the natively configured app.

• style(env): brace single-statement if in CwdOverrideEnv.backgroundJobsSupported

• fix(bench): drop stale fa_tui show-import from tui_stream_bench
• fix(tui): open-table boundary invariant — streamed tables never lose rows
• feat(site): widgets gallery page + machine index; widgets GOAL
• perf(tui): incremental transcript markdown+wrap — streaming flush x729 faster
• fix(cli,app): attach delivery, pasted-path attachments; split cli inbox part file

• fix(cli): a pasted filesystem path is not a slash command

• ci(mobile): skip the iOS artifact download when the IPA build was skipped

• feat(attach): live CLI sessions in the app — presence, 1:1 view, input handover