Remote agent delegation, subscription bridges, and uniform AI provider cards for Fabric OSS

What they did

The author consolidated coding delegation and AI provider routing in the Fabric OSS repo around two surfaces: Fabric Agents Remote Server (fabric-agent-server) and Fabric Agents Desktop (fabricagents://). They embedded the live Remote Server Web UI inside the Fabric Portal by adding a 'View Live Server Web UI in Portal' toggle in RemoteSessionConversation.tsx and CodingRunTimeline.tsx, rendering the server UI in an iframe next to the live message stream and follow-up instruction box. LaunchFabricDesktopBar.tsx gained an editable Remote Server URL input and a matching embed toggle in the project header delegation panel. RemoteAgentServerPicker.tsx was rebuilt with filter tabs (All, Personal, Organization), quick-select cards for PRIVATE and TEAM scoped servers, 1-click presets for a personal local server on :9100 and an organization remote server, a cryptographic Generate token button producing fab_srv_<48-hex> tokens, and copyable one-line startup commands (npx for personal, docker run for organization). Legacy fabric-kanban UI references were removed from project defaults, start-work menus, story cards, and Weave monitors. AI provider settings forms for both personal and organization tabs got explicit Remote Server and Desktop cards with equal-height grid layout and unclipped descriptions. Security work included removing a personal organizationId fallback in the ai-config task route, adding planSource and requiresBaseUrl to responses, redacting baseUrl query and userinfo from audit metadata, enforcing canEditProject on the v1 feature implement endpoint, stopping apiKey forwarding into Temporal workflow inputs, stripping remoteAgentServer from public story serializers, adding assertWeaveRuntimeAllowed before Weave coding runs, checking res.ok on sendFollowUp, preventing connection.secret from being copied into FABRIC_PORTAL_API_KEY, binding the fabric_start_coding_run MCP tool to context.organizationId, and removing raw API key printing from CLI agent config. Docs were updated in Fumadocs with four deterministic 2x-DPI screenshots generated from a mock HTML page, plus interactive tooltips and /docs links across seven components.

How it went

All targeted vitest suites passed, including the coding-run component tests, the AI providers lib tests, and seven ai-config route tests. Guidance, terms, and changeset gates also passed. The result is a polished, documented feature set with embedded live server UI, one-click server registration, uniform provider cards, and a broad security pass across API routes, Temporal activities, MCP tools, and the CLI.

Worth knowing

The post only reports test and lint gate results, not manual end-to-end verification against a real remote server or desktop app. The embedded Web UI depends on a reachable liveWebUrl and iframe-friendly headers, which are not detailed. Token generation and startup command presets assume specific ports and package names. Screenshots come from a mock HTML page rather than a running app, so they may drift from real UI. Migration of existing fabric-kanban references and any stored remoteAgentServer data is not covered.

Wiring

Work proceeds bottom-up: first the shared types and config in ai-providers.ts and ai-provider-config.ts, then the API route /api/agents/ai-config/task with planSource, requiresBaseUrl, and baseUrl redaction, then the v1 features route and strip-internal-story-fields serializer changes. Temporal activities in weave-coding-run/lib.ts and background-agents-provider.ts add the runtime allow assertion and res.ok check before the UI consumes them. The MCP gateway platform-tools.ts binds fabric_start_coding_run to context.organizationId, and the CLI agents command stops printing keys. On the web side, RemoteAgentServerPicker.tsx feeds server selection into StartCodingRunDialog and LaunchFabricDesktopBar, which pass liveWebUrl into RemoteSessionConversation and CodingRunTimeline for iframe embedding. AI provider forms consume the shared provider config. Docs screenshots are generated from tooling/docs-screenshots/mocks/fabric-agents-delegation.html and referenced from the Fumadocs MDX pages, with tooltips linking to those routes. Validation runs via pnpm --filter @repo/web vitest for the component and route suites, then guidance:check, terms:check, and changeset:gate.

Try it yourself

In this repo, consolidate coding delegation and AI provider routing around the Fabric Agents Remote Server and Fabric Agents Desktop. Add a 'View Live Server Web UI in Portal' toggle that embeds the live server URL in an iframe inside the coding run drawer and the project header delegation panel, with an editable server URL input. Rebuild the remote agent server picker with All/Personal/Organization filter tabs, quick-select cards for PRIVATE and TEAM scopes, one-click presets for a local :9100 server and an organization remote server, a Generate token button producing fab_srv_<48-hex> tokens, and copyable one-line startup commands. Remove legacy fabric-kanban UI references. Add explicit Remote Server and Desktop cards to both personal and organization AI provider settings with equal-height grid layout. Harden security: drop the personal organizationId fallback in the ai-config task route, redact baseUrl query and userinfo from audit metadata, enforce canEditProject on the v1 feature implement endpoint, stop forwarding caller apiKey into Temporal inputs, strip remoteAgentServer from public story serializers, add a runtime allow check before Weave coding runs, verify res.ok on sendFollowUp, avoid copying connection.secret into FABRIC_PORTAL_API_KEY, bind the start-coding-run MCP tool to context.organizationId, and stop printing raw API keys in CLI agent config. Update Fumadocs pages with new screenshots and inline tooltips linking to /docs. Run the vitest suites for coding-run components, ai-providers lib, and ai-config routes, plus guidance, terms, and changeset gates.