Skip to content

Rollback failed main validation b1d638136fc3 #78

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
github-actions wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Rollback failed main validation b1d638136fc3 #78

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 2 additions & 42 deletions .github/agents/fixlab-autofix.agent.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,19 +100,6 @@ validation with identical command and repository state. Never reuse startup,
health, authentication, browser or live-environment checks, external-data
checks, dependency installation, deployments, or mutating commands.

Use the dashboard job's saved delivery policy first, otherwise the repository's
`workflow` settings. The product default is `mode: "efficient"`,
`publication: "draft"`, `unitTestsAfterPr: false`, `optionalBuilds: false`. Save overrides in Repository
Settings once; do not repeat workflow questions for each job or stage.
After focused regression checks and diff review, create or update the authorized
draft PR. Ready-for-review publication requires explicit `publication: "ready"`.
Broad tests and builds run only by saved preference or explicit selection;
update the same PR with actual results.
Explicit `validation.gates[].required: true`, repository instructions, managed
approvals and CI/merge policies remain mandatory. Pending or failed optional
checks remain pending or failed; publication never authorizes merging.
An explicit saved strict workflow retains the following draft-first behavior:

When the developer authorizes pull-request publication, do not wait for every
independent validation command to finish before creating review visibility.
After the scoped production change and its smallest focused regression checks
Expand All @@ -123,10 +110,7 @@ push later reviewed checkpoints to the same branch, and never mark the PR ready
until every required local gate passes or the developer explicitly accepts the
recorded outcome.

Honor an explicit publication choice in every mode: strict plus draft stays
draft, with provider `isDraft: true` verified. Legacy strict policy with no
publication preference retains ready intent. Strict required checks never change.
Only for saved ready publication (including that legacy default), after required local validation and approval gates pass or have an explicitly
After required local validation and approval gates pass or have an explicitly
accepted outcome, publish the authorized PR by marking it ready for review.
Do not wait for remote PR CI or build completion before publication; publication
can trigger those checks. Verify the PR is no longer draft before reporting the
Expand All @@ -136,35 +120,13 @@ policies intact. Use `gh pr ready <number>` for GitHub or
`isDraft` from the provider to confirm it is false. If publication or state
verification fails, report the PR stage blocked or failed, not passed.

Reduce redundant regression cases, not correctness. Reuse existing test files
and fixtures; move punctuation, length and duplicate matrices to fast pure
unit checks. Browser coverage uses representative distinct flows, preserving
safety, permissions, lease/queue and real bug reproductions. Measure comparable
baseline and final elapsed time; never claim savings from count alone.
Keep Jest and Playwright discovery separate. Bare Jest may collect E2E specs
and bare Playwright may select all projects: use repository-owned unit selectors
and explicitly selected authenticated browser projects. Do not silently edit
consumer repositories to repair discovery.

Prefix FixLab-created pull-request titles with `FLAB:` followed by a concise
description of the coding change. Use the repository's PR template and clear
Markdown sections for the problem, changes, validation and risks. Keep
validation checkboxes accurate; do not describe a pending gate as passed.

## Connected dashboard recovery

Use normal Copilot reasoning and native tools; stage markers report work, not
a recipe requiring extra commands. For explicit browser-only reproduction or
deployed-result checks, select `playwright-only` and first reuse an approved
existing application and authorized validation session when supported. Skip
unnecessary local-stack work honestly; do not clone, restore or run broad
unit/build gates merely to repeat deployed behavior. Never copy browser state,
bypass a profile lock, take over another browser or silently change targets.
Keep sign-in and mutation guards. A deployed baseline does not prove local
changes or a PR; those require the matching source commit and application.
For fix requests, start with the smallest known reproduction and prepare
applications only when needed to exercise changed code.

Use `fixlab_dashboard_control` for user-authorized job/queue, configured gate,
frontend/authentication session, scoped permission and intake operations.
Read status first and bind its instance and current job. Do not ask again for
Expand All @@ -183,9 +145,7 @@ existing PR and preserve uncommitted work. A changed fingerprint requires a
new review. Folder permissions and human authentication remain separate.
An idle, unconnected Copilot session cannot receive injected questions.
Honor user-selected scoped iteration: full regression is explicitly deferred,
not passed; in strict workflow PR readiness stays blocked, whereas efficient
workflow permits publication after focused checks and explicitly required
pre-publication gates. Continue independent safe checks
not passed, and PR readiness stays blocked. Continue independent safe checks
after unrelated failures without bypassing dependencies. Do not delete or edit
transient test artifacts while validation is discovering or executing them;
wait for the owned validation to finish before cleanup.
Expand Down
31 changes: 1 addition & 30 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,36 +2,7 @@

All notable changes to FixLab are documented in this file.

## 0.7.4 - Unreleased

- Make browser-only reproduction and deployed-result checks existing-application
first, with mode-aware runner/authentication preflight instead of unused
backend toolchain requirements. Preserve target, commit and data-safety
boundaries and native Copilot reasoning/tools across entry points.
- Default new editing jobs to focused checks and a ready-for-review PR, with
broader local unit tests afterward and optional builds saved once in
Repository Settings. Preserve explicit required checks and strict delivery.
- Keep optional validation pending, failed or stale honestly; retain legacy
saved-job policy until an explicitly confirmed stopped-job migration.
- Add reviewed, persistent job-bound source/test read-write trust and narrowly
owned validation-gate/output access without granting secrets, arbitrary shell
commands, other jobs or managed-approval exceptions.
- Classify JavaScript/TypeScript `auth.spec` and `auth.test` source as tests
under reviewed file trust, without admitting saved authentication state,
sensitive directories, credential markers or configured protected paths.
- Keep the permission display limit from invalidating reviewed source-edit
trust; larger writes require bounded full-content safety scanning and retain
all job, checkout, path, managed-policy and sandbox boundaries.
- Hide input-token budget controls by default behind a Show budget checkbox;
preserve existing limits, usage reporting and stopped-job review.
- Simplify the dashboard around chat, with advanced controls in Run options and
the sidebar, responsive navigation, and preserved unsent messages.
- Limit fullscreen header requests to two visible lines while retaining the
complete title on hover and keeping the exit control accessible.
- Recover stopped shared-worktree jobs through an explicitly reviewed,
fingerprint-bound stash of eligible untracked source files and a new job
branch from the latest configured base. Preserve the previous branch, job,
and verified stash without automatically restoring files or reusing grants.
## Unreleased

- Keep managed frontend input open so React-style development servers do not
stop on EOF; preserve one-shot helper behavior and owned process cleanup.
Expand Down
65 changes: 1 addition & 64 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,52 +33,11 @@ FixLab runs through **Agency Copilot** or directly through

## Get started

With a supported runtime installed and signed in:

```powershell
npm install --global github:MonaDevAI/FixLab
fixlab chat C:\source\application --runtime copilot
```

Replace the path with your clone; use `--runtime agency` for Agency.
Review guided setup when prompted, then describe your request in the dashboard.
Use **Menu** on small screens. **Run options** and the sidebar reveal advanced
controls only when needed; **Back to chat** returns to your unsent message.
See [Installation](docs/installation.md) for prerequisites and troubleshooting.

<details>
<summary>Delivery and validation defaults</summary>

**Efficient delivery is the product default:** focused regression checks and
diff review, then an authorized draft PR. Broad unit tests and optional builds
are off by default; run them by saved preference or explicit selection. Save preferences
once in **Repository Settings**, not for every job or stage.
Explicitly required repository checks, organization approvals and CI/merge
policies are never waived; a ready PR does not mean every check passed.
Set `workflow.publication: "ready"` only when ready-for-review publication is intended.
Keep Jest discovery separate from Playwright, explicitly selecting authenticated
browser projects; do not use bare commands that accidentally collect browser specs.
Consolidate duplicate regressions and move value matrices to pure unit tests,
while retaining representative browser flows and critical safety boundaries.
Use `workflow.mode: "strict"` to retain full local validation before readiness.
Existing saved jobs retain their recorded policy; migrating one requires an
explicit stopped-job review.

For **browser-only reproduction or deployed-result checks**, use the browser
reproduction/result-check mode (`playwright-only`). FixLab first checks the
approved existing application and validation session; it does not require
local-stack toolchains or broad unit/build gates merely to repeat a deployed
scenario. Copilot keeps its native tools and reasoning; stage markers report
work rather than impose extra tasks. Existing deployment results never stand
in for validation of an unpublished local fix or a different PR commit.

</details>

Already inside Copilot? Follow the
[Copilot installation steps](docs/installation.md#starting-from-an-existing-copilot-session)
without opening a separate terminal.

### 1. Install a supported runtime (manual setup)
### 1. Install a supported runtime

Agency is the default compatibility runtime:

Expand All @@ -92,25 +51,6 @@ For direct mode, install and authenticate GitHub Copilot CLI, then use

Direct Copilot dashboard jobs use the official Copilot SDK and its bundled
runtime to show live **Allow once / Deny** permission prompts and agent questions.
Bounded read-only exceptions cover native filename discovery, provenance-bound
source search in one canonical checkout directory, and
`node <this-installed-fixlab.js> --help`. Source search requires one matching
live native `rg` event, an explicit source glob and bounded output; multi-root
searches and arbitrary directory reads remain manual. Managed human approvals
and sandbox escalation still require review.
Eligible requests also offer separately confirmed, executor-local repository-file
read or exact test-command grants. Manual review remains the default, and
organization policy stays authoritative. Optional per-job input-token ceilings
default to unlimited; all native modes use earlier context compaction.
Budget controls are hidden by default; select **Show budget** in Current job
details to reveal them. Hiding them never changes an existing job's ceiling.
For a stopped Copilot job, **Current job details > Repository file trust** can
separately authorize non-sensitive source/test reads and edits for that exact
job and canonical checkout, including resumes and dashboard restart. Other
jobs never inherit it. The same review can optionally trust dashboard-owned
validation gates bound to this job, checkout and current dashboard port.
Sensitive files, configuration edits and other shell commands remain separately
controlled; read-only jobs cannot acquire edit trust.
Your response continues the same executor; human wait does not trigger the idle
timeout. Authentication stays in the normal browser. Agency and unclassified
text denials retain the existing fail-closed folder-review flow. See
Expand Down Expand Up @@ -356,9 +296,6 @@ Read the complete [security model](docs/security.md).

## Current availability

The next version being prepared is **v0.7.4**; updating local installations does
not publish a GitHub release or npm package.

The current GitHub release is **v0.7.3**. It includes:

- The dependency-free FixLab CLI.
Expand Down
57 changes: 2 additions & 55 deletions agents/fixlab.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,29 +19,6 @@ Turn a defect or pull request into a verified engineering outcome:

Never report a skipped or timed-out check as passed.

## Copilot-first execution

Use normal Copilot reasoning and native tools to choose the shortest
evidence-backed path. Stage markers report work; they are not a recipe
requiring extra setup or commands. Start with the known symptom and nearest
relevant test, reuse verified context, and adapt to evidence. Do not ask users
to direct routine work already authorized.

For explicit browser-only reproduction or deployed-result checks, select
`playwright-only`. First check the approved existing application for the
selected environment and reuse its authorized validation browser connection
when supported. Do not clone, restore dependencies, start another local stack
or run broad unit/build gates just to repeat a deployed UI scenario. Mark
unnecessary local-stack work skipped, not passed. Keep authentication, profile
locks and mutation guards; never copy browser state or take over another
browser. Do not silently change an unavailable target or environment.

For a fix request, use the smallest known reproduction before preparing
applications needed for changed code. An existing deployment or baseline does
not prove an unpublished fix or PR: validate those against the matching source
commit and correct application. Explicit manual-localhost requests retain
their local prerequisites.

## Repository contract

Look for `.github/fixlab/repository-profile.json` before running repository
Expand Down Expand Up @@ -94,21 +71,6 @@ and stage are unchanged. Never reuse application startup, health checks,
authentication, browser or live-environment validation, external-data checks,
dependency installation, deployments, or mutating commands.

Use the dashboard job's saved delivery policy first, otherwise the repository's
`workflow` settings. The product default is `mode: "efficient"`,
`publication: "draft"`, `unitTestsAfterPr: false`, `optionalBuilds: false`. Do not ask users to select
these again for each job or stage. Repository Settings saves overrides once.
Efficient delivery runs the focused regression checks and reviews the effective
diff, then creates or updates the authorized **draft** PR before optional broad
validation. Ready-for-review publication requires the explicit saved
`publication: "ready"` preference. Broad tests and builds run only by saved
preference or explicit selection; update the same PR with actual results.
Keep not-run and failed checks visible;
ready for review never means fully validated or authorized to merge.
Explicit `validation.gates[].required: true`, repository instructions,
organization/managed approvals, and CI/merge policies remain mandatory.
An explicit saved strict workflow retains the following draft-first behavior:

When pull-request publication is already authorized, do not wait for every
independent validation command to finish before creating review visibility.
After the scoped production change and its smallest focused regression checks
Expand All @@ -120,10 +82,7 @@ keep validation status and risks current in the PR, and never mark it ready for
review until every required local gate passes or repository policy records an
explicitly accepted outcome.

Honor an explicit publication choice in every mode: strict plus draft stays
draft, with provider `isDraft: true` verified. Legacy strict policy with no
publication preference retains ready intent. Strict required checks never change.
Only for saved ready publication (including that legacy default), after required local validation and approval gates pass or have an explicitly
After required local validation and approval gates pass or have an explicitly
accepted outcome, publish the authorized PR by marking it ready for review.
Do not wait for remote PR CI or build completion before publication; publication
can trigger those checks. Verify the PR is no longer draft before reporting the
Expand All @@ -133,16 +92,6 @@ policies intact. Use `gh pr ready <number>` for GitHub or
`isDraft` from the provider to confirm it is false. If publication or state
verification fails, report the PR stage blocked or failed, not passed.

Reduce redundant regression cases, not correctness. Reuse existing test files
and fixtures; move punctuation, length and duplicate matrices to fast pure
unit checks. Browser coverage uses representative distinct flows, preserving
safety, permissions, lease/queue and real bug reproductions. Measure comparable
baseline and final elapsed time; never claim savings from count alone.
Keep Jest and Playwright discovery separate. Bare Jest may collect E2E specs
and bare Playwright may select all projects: use repository-owned unit selectors
and explicitly selected authenticated browser projects. Do not silently edit
consumer repositories to repair discovery.

Prefix FixLab-created pull-request titles with `FLAB:` followed by a concise
description of the coding change. Use the repository's PR template and clear
Markdown sections for the problem, changes, validation and risks. Keep
Expand Down Expand Up @@ -215,9 +164,7 @@ separate approvals. The dashboard cannot inject questions into an idle,
unconnected Copilot session; read status when the user requests progress.

Honor user-selected scoped iteration: full regression is explicitly deferred,
not passed; in strict workflow PR readiness stays blocked. Efficient delivery
permits publication after focused checks and explicitly required pre-publication
gates. Continue independent safe checks
not passed, and PR readiness stays blocked. Continue independent safe checks
after unrelated failures, while preserving their exact outcomes and honoring
dependencies. Do not delete or edit transient test artifacts while validation
is discovering or executing them; wait for the owned validation to finish
Expand Down
Loading