Bump Microsoft.Agents.AI.Workflows from 1.17.0 to 1.20.0

.config/dotnet-tools.json

@@ -3,16 +3,16 @@
   "isRoot": true,
   "tools": {
     "cake.tool": {
-      "version": "6.1.0",
+      "version": "6.2.0",
       "commands": [
         "dotnet-cake"
       ]
     },
     "minver-cli": {
-      "version": "6.0.0",
+      "version": "7.0.0",
       "commands": [
         "minver"
       ]
     }
   }
-}
+}

.fuseraft/config/agents/eval-assistant.yaml

@@ -0,0 +1,11 @@
+Name: EvalAssistant
+Description: General-purpose agent for eval cases; completes tasks and signals TASK_COMPLETE.
+Instructions: |
+  You are a capable, helpful assistant. Complete the task clearly and directly.
+  When you are fully done, end your response with: TASK_COMPLETE
+Model:
+  ModelId: grok-4.3
+  Endpoint: https://api.x.ai/v1
+Plugins:
+  - FileSystem
+FunctionChoice: auto

.fuseraft/config/eval.yaml

@@ -0,0 +1,20 @@
+Orchestration:
+  Name: Eval Assistant
+  Description: Minimal single-agent config for eval cases; no multi-step pipeline or contracts.
+
+  Security:
+    FileSystemSandboxPath: .
+
+  Agents:
+    - AgentFile: agents/eval-assistant.yaml
+
+  Selection:
+    Type: sequential
+
+  Termination:
+    Type: composite
+    Strategies:
+      - Type: regex
+        Pattern: TASK_COMPLETE
+      - Type: maxiterations
+        MaxIterations: 10

.fuseraft/evals/suite.yaml

@@ -0,0 +1,58 @@
+name: Suite
+# Suite-level default config. Override per-case with the 'config' key.
+config: .fuseraft/config/eval.yaml
+
+cases:
+  # Smoke test: quick sanity check that the team responds at all.
+  - id: smoke-basic
+    task: "Say hello and confirm you are ready."
+    must_succeed: true
+    expect_keywords:
+      - hello
+    max_turns: 3
+    tags:
+      - smoke
+
+  # Keyword check: verify the output contains required content.
+  - id: code-generation
+    task: "Write a Python function named reverse_string that returns the reverse of its input."
+    must_succeed: true
+    expect_keywords:
+      - def reverse_string
+      - return
+    expect_regex:
+      - "def reverse_string\\("
+    max_turns: 5
+    tags:
+      - coding
+
+  # Forbidden-keyword check: guard against undesirable response patterns.
+  - id: no-refusal
+    task: "List three benefits of automated testing."
+    must_succeed: true
+    forbidden_keywords:
+      - "I cannot"
+      - "I'm unable"
+      - "I am unable"
+    tags:
+      - quality
+
+  # Task from file: useful for long or multi-line prompts.
+  # Create the file at the path below before running this case.
+  # - id: file-task
+  #   task_file: .fuseraft/evals/tasks/my-task.txt
+  #   must_succeed: true
+  #   max_turns: 10
+  #   tags:
+  #     - file-task
+
+  # Full dev-team pipeline: use config: orchestration.yaml for tasks that
+  # require Planner → PlannerCritic → Developer → Tester → Reviewer routing.
+  # - id: full-pipeline-check
+  #   config: .fuseraft/config/orchestration.yaml
+  #   task: "Add a hello_world() function to src/hello.py that prints 'Hello, world!'."
+  #   must_succeed: true
+  #   expect_keywords:
+  #     - hello_world
+  #   tags:
+  #     - pipeline

.github/SECURITY.md

@@ -65,13 +65,13 @@ The following areas are in scope for security reports:
 
 | Area | Notes |
 |------|-------|
-| **API key / credential storage** | Keychain integration (`SecretToolKeyStore`, `MacOsKeychainStore`, `WindowsCredentialManagerStore`, `PlainTextFallbackKeyStore`) and `~/.fuseraft/config` handling |
+| **API key / credential storage** | Keychain integration (`SecretToolKeyStore`, `MacOsKeychainStore`, `WindowsCredentialManagerStore`, `UnavailableKeyStore`) and `~/.fuseraft/config` handling. fuseraft never writes API keys to disk in plaintext — a report that it does (or that it can be made to) is in scope. |
 | **Shell plugin** | Command injection, sandbox bypass, `sudo` protection bypass |
 | **FileSystem plugin** | Path traversal, sandbox escape |
 | **HTTP plugin** | SSRF, allowlist bypass, private-IP filter bypass |
 | **Skills execution** | Malicious scripts in project-scoped skill directories (`<cwd>/.agents/skills/`, `<cwd>/.fuseraft/skills/`) executing without user consent; credential exfiltration via subprocess env inheritance |
 | **Prompt injection** | Adversarial tool results that override agent instructions |
-| **Session files** | Permission issues in `~/.fuseraft/sessions/` or `repl_events.jsonl` |
+| **Session files** | Permission issues in `~/.fuseraft/sessions/` or `~/.fuseraft/logs/{project_slug}/repl_events/` |
 | **MCP server integration** | Malicious tool schemas, argument injection from connected servers |
 | **Dependency vulnerabilities** | Known CVEs in direct NuGet dependencies that are exploitable via fuseraft-cli |
 

.github/dependabot.yml

@@ -0,0 +1,14 @@
+version: 2
+updates:
+  # NuGet packages (PackageReference in .csproj)
+  - package-ecosystem: "nuget"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+
+  # GitHub Actions used in .github/workflows (checkout, setup-dotnet, etc.)
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/ci.yml

@@ -7,19 +7,22 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read   # minimum needed for actions/checkout on all jobs
+
 jobs:
   # Build & Test — runs on every push and PR
   build:
     name: Build & Test
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # MinVer needs full history to derive the version from git tags
 
       - name: Set up .NET 10
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: '10.0.x'
 
@@ -54,32 +57,15 @@ jobs:
             archive: tar
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # MinVer needs full history to derive the version from git tags
 
       - name: Set up .NET 10
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: '10.0.x'
 
-      - name: Restore
-        run: dotnet restore src/FuseraftCli.csproj --verbosity quiet
-
-      - name: Publish self-contained binary
-        run: |
-          dotnet publish src/FuseraftCli.csproj \
-            --configuration Release \
-            --runtime ${{ matrix.rid }} \
-            --self-contained true \
-            -p:PublishSingleFile=true \
-            -p:EnableCompressionInSingleFile=true \
-            -p:DebugType=none \
-            -p:DebugSymbols=false \
-            --output publish/${{ matrix.rid }} \
-            --nologo \
-            --verbosity minimal
-
       - name: Resolve version
         id: ver
         run: |
@@ -94,20 +80,26 @@ jobs:
           fi
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
+      # Publish is delegated to build.cake — it's the single source of truth for what
+      # ships in a release (e.g. bundling fuseraft-update.exe alongside fuseraft.exe on
+      # Windows). Tests already ran in the build job, so skip re-running them per RID.
+      - name: Publish via build.cake
+        run: ./build.sh --target=Publish --runtime=${{ matrix.rid }} --skipTests=true
+
       - name: Archive (tar)
         if: matrix.archive == 'tar'
         run: |
           tar -czf fuseraft-${{ steps.ver.outputs.version }}-${{ matrix.rid }}.tar.gz \
-            -C publish/${{ matrix.rid }} fuseraft
+            -C bin fuseraft
 
       - name: Archive (zip)
         if: matrix.archive == 'zip'
         run: |
-          cd publish/${{ matrix.rid }}
-          zip ../../fuseraft-${{ steps.ver.outputs.version }}-${{ matrix.rid }}.zip fuseraft.exe
+          cd bin
+          zip ../fuseraft-${{ steps.ver.outputs.version }}-${{ matrix.rid }}.zip fuseraft.exe fuseraft-update.exe
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: fuseraft-${{ matrix.rid }}
           path: fuseraft-${{ steps.ver.outputs.version }}-${{ matrix.rid }}.*
@@ -126,13 +118,13 @@ jobs:
 
     steps:
       - name: Download all platform artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: artifacts
           merge-multiple: true
 
       - name: Create release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           files: artifacts/*
           generate_release_notes: true

.github/workflows/docs.yml

@@ -16,9 +16,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.x'
 

.gitignore

@@ -9,6 +9,7 @@ site/
 artifacts/
 src/bin/
 src/obj/
+src/*/obj/
 tools/*/bin/
 tools/*/obj/
 
@@ -34,7 +35,6 @@ tools/*.pdb
 # Session data
 .fuseraft-repl-sessions.json
 .fuseraft-plan.json
-.fuseraft
 
 .env
 *.env
@@ -43,6 +43,20 @@ repo-summary.sh
 tests/FuseraftCli.Tests/obj/**
 .venv/
 analyze.kiwi
-PLAN.md
+PLAN*.md
 DEBUGGING.md
 *.lscache
+
+hashnode/
+
+# .fuseraft/ — user-authored content is tracked; runtime artifacts live in ~/.fuseraft/
+# Stale local runtime dirs written before the global migration — delete once confirmed empty
+.fuseraft/red-team/
+.fuseraft/logs/
+.fuseraft/state/
+.fuseraft/sessions/
+.fuseraft/knowledge/repository/
+.fuseraft/memory/
+temp/TestMetadata/
+CHECKLIST.md
+.fuseraft/

.vscode/tasks.json

@@ -7,7 +7,7 @@
             "type": "process",
             "args": [
                 "build",
-                "${workspaceFolder}/src/FuseraftCli.csproj",
+                "${workspaceFolder}/src/fuseraft.csproj",
                 "/property:GenerateFullPaths=true",
                 "/consoleloggerparameters:NoSummary"
             ],