@passioncode-ai/fabric-agent-adapter 0.15.0 → 0.17.0

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_secrets.py

@@ -0,0 +1,132 @@
+#!/usr/bin/env python3
+"""The contract's one credential detector (Fabric Agent Contract DEC-0044, `src/secret-shape.ts` at the pin): a name
+that can only carry a credential, a value shaped like one, a launch argument that carries one, and a URL that does
+(LC-21). A port held to the contract's own answers by test/fixtures/contract/profile-vectors.json. Standard library
+only. The dashboard kit's fabric-button.js carries its own copy of the name and value checks (FL-4)."""
+
+from __future__ import annotations
+
+import re
+from typing import Dict, List
+import urllib.parse
+
+CREDENTIAL_WORDS = (
+    "token", "secret", "password", "passwd", "pass", "passphrase", "credential", "credentials", "cookie", "authorization",
+    "bearer", "jwt", "otp", "apikey", "signature", "sig",
+    "accesstoken", "idtoken", "authtoken", "refreshtoken", "sessionid", "sessiontoken", "logincode", "authcode", "privatekey",
+    "clientsecret", "secretkey", "accesskey",
+)
+CREDENTIAL_PAIRS: Dict[str, tuple] = {
+    "key": ("private", "api", "access", "secret", "session", "auth", "signing", "encryption", "master", "client", "login", "refresh"),
+    "auth": ("token", "code", "header"),
+    "session": ("token", "id"),
+    "code": ("login", "auth", "access", "session"),
+}
+JWT_SHAPE = re.compile(r"eyJ[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]*")
+SECRET_VALUE = re.compile(r"(^bearer\s.+|sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|xox[abposr]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|glpat-[A-Za-z0-9_-]{20,})",
+                          re.IGNORECASE | re.DOTALL)
+_LONG_RUN = re.compile(r"[A-Za-z0-9+/=_-]{40,}")
+_BEARER_INSIDE = re.compile(r"\bbearer\s+(?=[A-Za-z0-9._~+/-]*\d)[A-Za-z0-9._~+/-]{12,}=*", re.IGNORECASE)
+_PATH_LIKE = re.compile(r"^(?:[/~.]|[A-Za-z]:[\\/]|[a-z][a-z0-9+.-]*://)", re.IGNORECASE)
+_SCHEME = re.compile(r"^[A-Za-z][A-Za-z0-9+.-]*:")
+
+
+def name_words(name: str) -> List[str]:
+    """A name's words: split at `.`, `_`, `-` and camelCase humps, lowercased (`APIKey` is `api key`)."""
+    spaced = re.sub(r"([a-z0-9])([A-Z])", r"\1 \2", name)
+    spaced = re.sub(r"([A-Z]+)([A-Z][a-z])", r"\1 \2", spaced)
+    return [w.lower() for w in re.split(r"[\s._-]+", spaced) if w]
+
+
+def _with_singulars(words: List[str]) -> List[str]:
+    return words + [w[:-1] for w in words if len(w) > 2 and w.endswith("s")]
+
+
+def credential_name(name: str) -> bool:
+    """Whether a name — a parameter, a header, an environment variable, a config key — can only carry a credential."""
+    split = name_words(name)
+    words = _with_singulars(split)
+    if any(w in CREDENTIAL_WORDS for w in words):
+        return True
+    if len(split) == 1 and any(w in CREDENTIAL_PAIRS for w in words):
+        return True
+    return any(word in words and any(p in words for p in partners) for word, partners in CREDENTIAL_PAIRS.items())
+
+
+def _long_secret(value: str) -> bool:
+    return any(re.search(r"[a-z]", run) and re.search(r"[A-Z]", run) and re.search(r"[0-9]", run) for run in _LONG_RUN.findall(value))
+
+
+def secret_value(value: str) -> bool:
+    """A JWT anywhere, a provider key or `Bearer …`, or a long base64 run mixing upper case, lower case and digits."""
+    return bool(JWT_SHAPE.search(value) or SECRET_VALUE.search(value) or _long_secret(value))
+
+
+def _path_like(piece: str) -> bool:
+    return bool(_PATH_LIKE.match(piece)) or (
+        bool(re.search(r"[\\/]", piece))
+        and (bool(re.search(r"\.[A-Za-z0-9]{1,8}$", piece)) or any(re.fullmatch(r"[a-z][a-z0-9_-]{2,}", s) for s in re.split(r"[\\/]", piece))))
+
+
+def secret_argument(value: str) -> bool:
+    """The same for a launch argument or a server's command and URL: a long run is looked for between path separators,
+    so a folder path holding a session id is not taken for a key."""
+    if JWT_SHAPE.search(value) or SECRET_VALUE.search(value) or _BEARER_INSIDE.search(value):
+        return True
+    for piece in re.split(r"[\s=]", value):
+        if _path_like(piece):
+            if any(_long_secret(part) for part in re.split(r"[\\/]", piece)):
+                return True
+        elif _long_secret(piece):
+            return True
+    return False
+
+
+def _decode_keeping_plus(raw: str) -> str:
+    """decodeURIComponent: a malformed escape or bytes that are not UTF-8 leave the raw text."""
+    if re.search(r"%(?![0-9A-Fa-f]{2})", raw):
+        return raw
+    try:
+        return urllib.parse.unquote_to_bytes(raw).decode("utf-8")
+    except UnicodeDecodeError:
+        return raw
+
+
+def _form_name(text: str) -> str:
+    pairs = urllib.parse.parse_qsl(text, keep_blank_values=True)
+    return pairs[0][0] if pairs else ""
+
+
+def raw_values(query: str) -> Dict[str, List[str]]:
+    """Each query or fragment piece's raw value by its decoded name, with `+` kept."""
+    values: Dict[str, List[str]] = {}
+    for piece in query.split("&"):
+        if piece == "":
+            continue
+        at = piece.find("=")
+        name = _form_name(piece if at < 0 else piece[:at])
+        values.setdefault(name, []).append("" if at < 0 else _decode_keeping_plus(piece[at + 1:]))
+    return values
+
+
+def secret_url(value: str) -> bool:
+    """Whether a URL an MCP entry or a launch names carries a credential (LC-21): anything secret_argument finds, a
+    password in its user information, or a query or fragment parameter whose name can only carry a credential and has
+    a value, or whose value is shaped like one. A string that is not an absolute URL is checked as an argument only."""
+    if secret_argument(value):
+        return True
+    if not _SCHEME.match(value.strip()):
+        return False  # not an absolute URL (WHATWG URL parsing refuses it)
+    try:
+        parts = urllib.parse.urlsplit(value.strip())
+    except ValueError:
+        return False
+    if not parts.scheme:
+        return False
+    if parts.password:
+        return True
+    for part in (parts.query, parts.fragment):
+        for name, raws in raw_values(part).items():
+            if any((raw != "" and credential_name(name)) or secret_value(raw) for raw in raws):
+                return True
+    return False

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_service.py

@@ -758,12 +758,45 @@ def dashboard_extension(min_width: int = 360, appearance: Sequence[str] = ("sche
     return {DASHBOARD_EXTENSION_KEY: value}
 
 
+_PROFILE_ID = re.compile(r"^[a-z][a-z0-9-]{0,62}$")
+_RUNNER_KIND = re.compile(r"^[a-z][a-z0-9-]{1,62}$")
+_MODEL_ID = re.compile(r"^[a-z0-9][a-z0-9._-]{0,63}/[a-z0-9][a-z0-9._:-]{0,127}$")
+ROUTES = ("subscription", "key")
+
+
+def configuration_problems(doc: Any) -> List[str]:
+    """DEC-0046: the well-known `configuration` — {slots, resolved} as service-well-known.schema.json types it."""
+    if not isinstance(doc, dict):
+        return ["configuration is an object"]
+    problems = ["configuration has no member %s" % k for k in doc if k not in ("slots", "resolved")]
+    slots = doc.get("slots")
+    if not isinstance(slots, list) or len(slots) > 2 or len(set(map(str, slots))) != len(slots) or not all(s in ("runner", "model") for s in slots):
+        problems.append("slots is a list of runner and model, each once")
+    resolved = doc.get("resolved")
+    if not isinstance(resolved, dict):
+        return problems + ["resolved is an object"]
+    for k, v in resolved.items():
+        ok = {"from": lambda x: x in ("request", "agent", "binding", "estate"),
+              "runnerProfile": lambda x: isinstance(x, str) and bool(_PROFILE_ID.match(x)),
+              "modelProfile": lambda x: isinstance(x, str) and bool(_PROFILE_ID.match(x)),
+              "runnerKind": lambda x: isinstance(x, str) and bool(_RUNNER_KIND.match(x)),
+              "route": lambda x: x in ROUTES,
+              "models": lambda x: isinstance(x, list) and len(x) <= 16 and all(isinstance(m, str) and _MODEL_ID.match(m) for m in x)}.get(k)
+        if ok is None:
+            problems.append("resolved has no member %s" % k)
+        elif not ok(v):
+            problems.append("resolved.%s is not valid" % k)
+    return problems
+
+
 def build_well_known(*, service_id: str, instance: str, name: str, version: str, build: Dict[str, Any],
                      started_at: str, status: str, degraded: Sequence[Dict[str, str]],
                      surfaces: Dict[str, Any], summary: Optional[Sequence[Dict[str, Any]]] = None,
                      update_available: Optional[str] = None, pid: Optional[int] = None,
-                     extensions: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
+                     extensions: Optional[Dict[str, Any]] = None,
+                     configuration: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
     """The unauthenticated identity answer. `degraded` is always present; ready means empty.
+    `configuration` (DEC-0046) says what the operator can configure and what applies now; fabric_profiles builds it.
     `extensions` is kept as given (a reader ignores keys it does not know); a dashboard declaration
     in it must be valid (dashboard_extension builds one)."""
     if status not in STATUSES:
@@ -790,6 +823,11 @@ def build_well_known(*, service_id: str, instance: str, name: str, version: str,
             if problems:
                 raise ServiceError("Dashboard declaration: %s." % "; ".join(problems))
         doc["extensions"] = dict(extensions)
+    if configuration is not None:
+        problems = configuration_problems(configuration)
+        if problems:
+            raise ServiceError("configuration: %s." % "; ".join(problems))
+        doc["configuration"] = configuration
     return doc
 
 
@@ -896,7 +934,7 @@ _PROVIDER = re.compile(r"^[a-z][a-z0-9._-]{0,63}$")
 def make_usage_receipt(provider: str, model: str, *, input_tokens: int, output_tokens: int,
                        cache_read_tokens: int = 0, cache_write_tokens: int = 0,
                        cost_usd: Optional[float] = None, cost_basis: Optional[str] = None,
-                       at: Optional[str] = None) -> Dict[str, Any]:
+                       at: Optional[str] = None, route: Optional[str] = None) -> Dict[str, Any]:
     """One model call, from the provider's own usage numbers. No prompt, output or caller.
 
     `cost_usd` is None when the call cannot be priced: the report counts it as unpriced and
@@ -917,8 +955,13 @@ def make_usage_receipt(provider: str, model: str, *, input_tokens: int, output_t
     basis = cost_basis or ("unknown" if cost_usd is None else "provider")
     if basis not in COST_BASES or (cost_usd is None) != (basis == "unknown"):
         raise ServiceError("cost_basis is provider or price-list with a cost, unknown without one.")
-    return {"at": at or now_iso(), "provider": provider, "model": model, **counts,
-            "costUsd": None if cost_usd is None else float(cost_usd), "costBasis": basis}
+    if route is not None and route not in ROUTES:
+        raise ServiceError("route is subscription or key (DEC-0046).")
+    receipt = {"at": at or now_iso(), "provider": provider, "model": model, **counts,
+               "costUsd": None if cost_usd is None else float(cost_usd), "costBasis": basis}
+    if route is not None:
+        receipt["route"] = route  # the operator's own login in its vendor's runner, or an issued key
+    return receipt
 
 
 def _add_totals(row: Dict[str, Any], receipt: Dict[str, Any]) -> None:
@@ -952,20 +995,22 @@ def usage_report(receipts: Iterable[Dict[str, Any]], *, service_id: str, instanc
         date = str(r.get("at", ""))[:10]
         if not (first <= date <= last):
             continue
-        key = (r["provider"], r["model"])
-        row = days.setdefault(date, {}).setdefault("%s\u0000%s" % key, {
+        key = (r["provider"], r["model"], r.get("route") or "")
+        row = days.setdefault(date, {}).setdefault("%s\u0000%s\u0000%s" % key, {
             "provider": r["provider"], "model": r["model"], "calls": 0, "unpricedCalls": 0,
             "inputTokens": 0, "outputTokens": 0, "cacheReadTokens": 0, "cacheWriteTokens": 0, "_cost": 0.0})
+        if r.get("route"):
+            row["route"] = r["route"]  # DEC-0046: rows of one model on two routes stay apart
         _add_totals(row, r)
         bases.setdefault((date,) + key, set()).add(r.get("costBasis") or "unknown")
     out_days = []
     for date in sorted(days):
         models = []
         for row in days[date].values():
-            seen = bases[(date, row["provider"], row["model"])]
+            seen = bases[(date, row["provider"], row["model"], row.get("route") or "")]
             row["costBasis"] = next(iter(seen)) if len(seen) == 1 else "mixed"
             models.append(_close_totals(row))
-        models.sort(key=lambda m: (m["provider"], m["model"]))
+        models.sort(key=lambda m: (m["provider"], m["model"], m.get("route") or ""))
         day = {"date": date, "calls": 0, "unpricedCalls": 0, "inputTokens": 0, "outputTokens": 0,
                "cacheReadTokens": 0, "cacheWriteTokens": 0, "_cost": 0.0}
         for m in models:

package/plugins/fabric-agent-adapter/skills/creating-fabric-agents/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode. Ships in one plugin with adapting-projects-to-fabric, whose scripts it reuses.
 metadata:
   author: PassionCode.ai
-  version: "0.15.0"
+  version: "0.17.0"
   contract-version: "0.1.0"
   contract-commit: "0cacd08b0e95b6abf131eae1206b60792138bc3c"
 ---