---
title: "Mid-run steering, cancellable agents, and GitHub permissions"
date: "2026-05-05"
---

<Warning>
**Breaking API and configuration changes.** GitHub token permissions moved from `[server.integrations.github.permissions]` to `[run.integrations.github.permissions]`. `RunStage` also now uses per-visit stage identity: `id` contains values like `verify@2`, `node_id` contains the workflow node name, `visit` contains the visit number, and `dot_id` has been removed.

To migrate:
1. Move GitHub permission tables to `[run.integrations.github.permissions]`.
2. Use `RunStage.id` for per-visit links and API calls.
3. Replace `RunStage.dot_id` with `RunStage.node_id` when you need graph-node identity.
</Warning>

## Steer running agents

You can now send guidance to a running API-mode agent from the CLI, web UI, or API without stopping the run. Plain steering is queued for the agent's next turn, while interrupting steering cancels the active round first and delivers your message as the next user turn.

```bash
fabro steer <run> "Focus on the failing integration test"
fabro steer --interrupt <run> "Stop that approach and try the smaller fix"
```

The web app now includes a steering composer on run detail and board views, and steering events flow through the same run event stream so accepted, delivered, and dropped messages are visible.

## Cancellation reaches active agent work

Cancelling a run now reaches in-flight CLI and API agent stages instead of waiting for the stage to finish. Fabro propagates cancellation through workflow services, manager-loop child runs, sandbox streaming commands, CLI agent invocations, and API agent sessions.

Cancelled CLI agents now emit typed cancellation events, while timed-out agents emit separate timeout events. That distinction keeps user cancellation, node timeouts, and stall timeouts from collapsing into the same failed-stage behavior.

## Run-level GitHub permissions

GitHub `GITHUB_TOKEN` permissions are now part of run configuration, so workflow, project, and user settings can tighten or override the permissions a run requests. This makes scoped GitHub tokens usable from bundled workflows and local CLI-launched runs instead of being trapped in server-only configuration.

```toml title="workflow.toml"
[run.integrations.github.permissions]
contents = "write"
pull_requests = "write"
```

Higher layers can set `permissions = {}` to clear inherited permissions for a workflow that should not receive a token.

## More

<Accordion title="API">
- New `POST /api/v1/runs/{id}/steer` endpoint sends append or interrupt steering to running API-mode agents
- New `POST /api/v1/runs/{id}/interrupt` endpoint interrupts an active API-mode agent round without steering text
- New `GET /api/v1/system/repair/runs` endpoint lists runs that cannot be loaded from durable storage
- `RunStage` now exposes per-visit `id`, `node_id`, and `visit` fields so repeated workflow nodes do not collapse together
- Run billing and run stage responses now read from projection data with live runtime updates
</Accordion>

<Accordion title="CLI">
- Added `fabro steer` with `--interrupt` and `--text-stdin`
- Added `fabro system repair runs` for listing unreadable durable runs
- `fabro rm --force <run_id>` can delete unreadable runs by ID
</Accordion>

<Accordion title="Workflows">
- Stage URLs now preserve visits with IDs like `verify@1` and `verify@2`
- Stage activity now renders from scoped stage event streams
- Silent fallback warnings now appear in run logs and run events
- Added the bundled `gh-list` workflow for verifying GitHub token injection with `gh pr list` and `gh issue list`
</Accordion>

<Accordion title="Improvements">
- Files Changed now consistently uses virtualized diff rendering and Pierre worker assets in production builds
- Run board metadata is cached to avoid repeated durable-store reads
- The run board and run detail views can share SSE subscriptions while still handling steering toasts and query invalidation
</Accordion>

<Accordion title="Fixes">
- Fixed Anthropic forced-tool calls including thinking blocks
- Fixed repeated stage visits sharing sidebar links, graph selections, event streams, or turns views
- Fixed large Files Changed views mounting every diff at once
- Fixed run file diff workers missing from production web builds
</Accordion>