FLAB: Consolidate session recovery and Copilot model selection by MonaDevAI · Pull Request #66 · microsoft/FixLab

MonaDevAI · 2026-10-13T14:21:15Z

Problem

The frontend pre-start run left Linux frontend descendants running after their launcher exited. Users also need reliable session recovery, exclusive executor admission, quieter chat output, browser-profile handoff, and explicit Copilot model selection without losing saved job context.

Change

Area	Behavior
Session lifecycle	Repository-scoped discovery, reconnect, saved-context resume, confirmed stop/shutdown, and parallel local React warm-up. Refuse changed owners and reused ports.
Executor admission	Atomic, worktree-shared reservation before starting a runner. Retain partial or crashed reservations; logical timeout alone cannot authorize a new executor.
Windows containment	Launch suspended into a non-breakaway Job Object, terminate owned descendants, and require nonce-bound quiescence proof before lease release. Owner death stops the owned tree without reclaiming its lease.
Windows console visibility	Give ordinary tooling descendants one inherited hidden console, retain piped stdin/stdout/stderr and containment, and hide noninteractive CLI probes and setup helpers without hiding interactive agent terminals.
Process cleanup	Retain frontend ownership after launcher exit; attempt all shutdown cleanup steps and aggregate failures. Wait for executor termination before closing the dashboard.
Frontend input	Keep long-running frontend stdin open so React-style servers do not shut down on EOF. Preserve one-shot helper EOF and owned termination.
Browser behavior	Browser opening remains opt-in. Owned processes inherit `BROWSER=none`; automated fixtures never invoke the real browser opener. Block live-test retries while authentication holds the profile.
Chat	Batch output, strip terminal controls, and deduplicate polling errors to reduce prompt flicker.
Guided setup	Make chat inspect profile readiness, open an explicit interactive onboarding request, and verify Doctor before starting a new dashboard. Lead user documentation with install plus one chat command.
Worktree setup	Add plan-first `onboard --from SOURCE`, provision only the reviewed profile and declared non-sensitive configuration, preserve customized files, and reject symlink escapes, credentials and browser-state paths.
Setup preflight	Name missing browser `--config` files before validation. Discover linked dependency directories for explicit setup approval, persist exact path grants, and retain runtime deny rules and human sign-in/MFA.
Copilot models	Add CLI `--model` and `FIXLAB_MODEL`, a Copilot-only dashboard selector, and job-specific persistence through queueing, retry and history recovery. Reject Agency model overrides and unsafe identifiers.
HydraFusion	Incorporate model selection and adjacent-marker parsing from #33. Add `--experimental` only for HydraFusion. Request stage markers before tools and support markers split across output chunks.
Agent efficiency	Keep Agency and Copilot agent definitions equivalent. Prefer compact evidence, verified context reuse, bounded direct work and focused retries without weakening required gates.
PR presentation	Require `FLAB:` titles and properly formatted problem, changes, validation and risk sections.
PR publication	After required local validation and approval, clear draft status and verify `isDraft=false`. Do not wait for remote PR builds that publication may trigger; report CI as pending and preserve merge policies. Read-only validation never publishes a PR.

Shutdown leaves the dashboard available and targets only its tracked agent, frontend and authentication resources. Repository-specific Edge authentication changes and private application configuration are not included.
Snapshots persist their originating runtime; incompatible or ambiguous legacy contexts remain in history rather than silently resuming through another runtime.

Validation

Risk

Windows containment: uses built-in Windows PowerShell and C# compilation. Missing containment or termination proof fails closed. Ordinary tooling inherits a hidden console; third-party tools explicitly creating their own windows are not guaranteed to remain hidden. Updated hosted containment checks are pending.
Manual frontend lifetime: Windows agent descendants stop when the executor ends. A manual browser gate requires a separately dashboard-managed frontend serving the validated checkout; missing checkout evidence blocks completion.
POSIX ownership: cleanup covers the captured process group, not arbitrary descendants that escape into another session.
Preview model: HydraFusion is account-dependent. Availability, progress buffering, elapsed time and billed usage are runtime-dependent; no cost or token-saving percentage is claimed.
Authentication: profile reuse does not prove a valid sign-in. Interactive account selection, MFA or expiry can still block business validation.
Compatibility: no browser opens by default. An explicitly configured model is honored; selecting Copilot default removes the per-job override.
Validation boundary: browser coverage uses local fixtures, not an authenticated consumer application's live business backend.
Merge policy: main requires successful test and analyze checks, an approving review, resolved review threads and squash merge. No protection bypass is authorized.

Fix owned process-tree cleanup and make dashboard browser opening opt-in. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: fa54f8e0-47eb-4686-99dd-fc2e63d0239c

Copilot

🟡 Changes recommended

Concurrent ownership races and incomplete process-tree tracking can still allow duplicate sessions or leave owned descendants running.

6 open findings

What changed in this PR

Adds cross-dashboard session controls, process-tree cleanup, parallel React warm-up, opt-in browser opening, and PR-format guidance.

Changes:

Adds repository-scoped session discovery, stop, shutdown, reconnect, and resume controls.
Introduces cross-platform process-tree cleanup and local React warm-up.
Makes browser opening opt-in and documents/tests the new workflows.

File	Description
`dashboard/server.js`	Implements lifecycle, ownership, cleanup, and warm-up orchestration.
`dashboard/sessions.js`	Adds the loopback session registry.
`dashboard/public/app.js`	Adds session-control UI behavior.
`dashboard/public/index.html`	Adds session and warm-up controls.
`bin/fixlab.js`	Makes browser opening opt-in.
`test/dashboard-server.test.js`	Tests lifecycle, cleanup, and warm-up behavior.
`test/dashboard-sessions.test.js`	Tests registry validation and ownership checks.
`test/fixlab-cli.test.js`	Tests browser opt-in behavior.
`test/agent-rules.test.js`	Tests PR guidance across agent files.
`e2e/dashboard-readiness.spec.js`	Covers session controls end-to-end.
`docs/architecture.md`	Documents session ownership architecture.
`docs/getting-started.md`	Documents lifecycle and warm-up workflows.
`docs/installation.md`	Documents browser-opening behavior.
`agents/fixlab.md`	Adds PR presentation guidance.
`com.github.copilot/agents/fixlab.agent.md`	Mirrors packaged-agent guidance.
`templates/fixlab-autofix.agent.md`	Updates initialized autofix guidance.
`.github/agents/fixlab.agent.md`	Updates repository agent guidance.
`.github/agents/fixlab-autofix.agent.md`	Mirrors autofix guidance.

🧠 Review effort: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: fa54f8e0-47eb-4686-99dd-fc2e63d0239c

Copilot

🔵 Needs a closer look

Session ownership remains race-prone, shutdown cleanup can abort partially, and cross-runtime guidance is incomplete.

6 open findings

Previously missed (2)

In code that hasn't changed since last review

Unreclaimed crash records permanently block new ownership

dashboard/sessions.js:90

Unclean dashboard exits retain records indefinitely, and this limit is checked before any record is inspected or reclaimed. After 101 crashes/forced exits, every ownership lookup permanently fails, blocking job and frontend starts until the temp directory is manually cleared. Add bounded aging or garbage collection for verified-unavailable records while preserving live owners.

Refresh sessions repeatedly registers browser event handlers

dashboard/public/app.js:661

Registering each control handler inside refreshSessions violates the repository's browser-event rule requiring event registration at module scope. Since this function runs every five seconds, render controls with action data and handle them through one module-scope delegated listener on sessionsList.

🧠 Review effort: Balanced

Keep Windows descendant containment as an explicit draft-only merge gate. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: fa54f8e0-47eb-4686-99dd-fc2e63d0239c

github-actions · 2026-10-13T17:12:33Z

FixLab CI failed and was contained without modifying source. Evidence is retained in the workflow artifacts: https://github.com/MonaDevAI/FixLab/actions/runs/38436643148

Copilot

🟡 Changes recommended

Process groups can still survive launcher exit, recovered jobs can cross runtimes, and Windows containment remains unresolved.

7 open findings

1 resolved since last review

Use an atomic per-repository lease before starting executors

🧠 Review effort: Balanced

Contain executors and managed resources in Windows Job Objects; require quiescence proof before lease release. Preserve frontend ownership, complete all shutdown cleanup, isolate saved runtimes, and fix Linux idle-test cancellation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: fa54f8e0-47eb-4686-99dd-fc2e63d0239c

Copilot

🟡 Changes recommended

POSIX cleanup can remain unconfirmed or permanently stale, and accumulated crashed-session records can eventually block admission.

3 open findings

7 resolved since last review

🧠 Review effort: Balanced

  }
-  child.kill();
+  try {
+    process.kill(-child.pid, "SIGTERM");


+      if (entries.length > 100) {
+        throw new Error("too many retained FixLab session ownership records");


+                  finishedAt: new Date().toISOString()
+                };
+              }
+              return;


Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7abe2986-7e86-4d73-8fbe-794c17d46468

Copilot

🔵 Needs a closer look

Retained authentication descendants can leave the profile permanently marked busy after they exit, and command documentation is incomplete.

3 open findings

Previously missed (2)

In code that hasn't changed since last review

Clear stale Playwright handle after descendant process exits

dashboard/server.js:4320

If the authentication launcher exits while a profile-owning descendant is still alive, this close handler runs only once and leaves playwrightConnection.handle set. Nothing rechecks the process group after the user closes that descendant, so /api/playwright/status continues reporting running: true and every live-test resume remains blocked until the whole session is manually shut down. Monitor the retained tree to quiescence (or revalidate it when status is read) and clear the handle once it is actually empty.

Document dashboard --model option in command reference

docs/commands.md:77

The command reference still omits the newly supported dashboard --model option, so users relying on this canonical syntax cannot discover model selection here. Include the runtime and model arguments in the signature, matching the CLI help.

🧠 Review effort: Balanced

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7abe2986-7e86-4d73-8fbe-794c17d46468

Copilot

🟡 Changes recommended

Authentication cleanup, stale session retention, temporary-directory security, and browser-state copying remain unresolved.

5 open findings

Previously missed (1)

In code that hasn't changed since last review

Stale Playwright handle blocks status after launcher exit

dashboard/server.js:4328

When the authentication launcher exits while a descendant still owns the browser profile, this branch leaves playwrightConnection.handle set. No later event fires on the already-closed launcher, so even after the descendant exits /api/playwright/status continues reporting running: true and every live-test resume remains blocked. Keep watching the retained process group (or recheck it during status polling) and clear the handle once it becomes quiescent.

🧠 Review effort: Balanced

+    if (
+      /(?:^|[/\\])(?:\.git|node_modules|\.auth|\.edge-profile|\.npmrc|\.env(?:\.[^/\\]*)?)(?:[/\\]|$)|\.(?:pem|key|pfx|p12)$/iu.test(name)
+    ) {
+      throw new Error(`Worktree setup must not copy credentials, dependencies or browser state: ${name}`);


+    register(url) {
+      mkdirSync(directory, { recursive: true, mode: 0o700 });
+      owner = validateOwner({ id, url }, id);
+      writeFileSync(path, JSON.stringify(owner), { flag: "wx", mode: 0o600 });


Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7abe2986-7e86-4d73-8fbe-794c17d46468

Copilot

🔵 Needs a closer look

Direct CLI browser suppression, chat runtime validation, and confirmed POSIX process cleanup remain incomplete.

5 open findings

🧠 Review effort: Balanced

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7abe2986-7e86-4d73-8fbe-794c17d46468

Copilot

🟡 Changes recommended

Process ownership can become stale or be cleared before termination, and worktree setup can copy sensitive or duplicate-path files.

7 open findings

🧠 Review effort: Balanced

+  if (!Array.isArray(configuredFiles) || configuredFiles.some((value) => typeof value !== "string")) {
+    throw new Error("worktreeSetup.files must be an array of repository-relative non-sensitive file paths");
+  }
+  const files = [...new Set([SETUP_PROFILE_PATH, ...configuredFiles])].map((name) => {


+        try {
+          if (ownedTreeRunning(child)) {
+            playwrightConnection.lastResult = {
+              ok: false,
+              message: "Authentication descendants remain owned; retry must wait for confirmed termination.",
+              finishedAt: new Date().toISOString()
+            };
+            return;


FLAB: Add session lifecycle controls and parallel React warm-up

a11e8f6

Fix owned process-tree cleanup and make dashboard browser opening opt-in. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: fa54f8e0-47eb-4686-99dd-fc2e63d0239c

Copilot AI balanced review requested due to automatic review settings October 13, 2026 14:21

Copilot started reviewing on behalf of MonaDevAI October 13, 2026 14:22

View session