@passioncode-ai/fabric-agent-adapter 0.40.0 → 0.42.1

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_dashboard_layout.mjs

@@ -13,15 +13,22 @@
 // scroll box) and ED-5 (sticky chrome within min(120 px, a quarter of the height), anchors landing
 // below it, no nested full-height scroller). What it cannot measure is NOT_RUN with the reason,
 // never a pass. WebKit is the default engine (Safari's). Exit 0 when nothing FAILs, 1 when
-// something does, 2 on a usage error. It reads; it never clicks a control of the page.
-import { readFileSync, existsSync } from 'node:fs';
+// something does, 2 on a usage error or a report with no rule in it. It reads; it never clicks a control of the page.
+import { readFileSync, existsSync, realpathSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { homedir, platform } from 'node:os';
 import path from 'node:path';
-import { pathToFileURL } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 
 const EXTENSION_KEY = 'https://fabric.passioncode.ai/agent-contract/extensions/dashboard/0.1';
 const RULES = ['ED-1', 'ED-2', 'ED-3', 'ED-4', 'ED-5'];
+// The most elements ED-4 and ED-5 walk on one page; past it they say how much they did not see.
+const ELEMENT_CAP = 6000;
+
+// A one-time login code is a credential: no report, error or evidence line carries one.
+export function scrub(text) {
+  return String(text).replace(/([?&#;]code=)[^&#\s"']*/gi, '$1<redacted>');
+}
 
 function usage(message) {
   if (message) process.stderr.write(message + '\n');
@@ -103,7 +110,7 @@ async function serviceTarget(spec, dir) {
 }
 
 // Runs inside the page. Everything it reports is measured from the rendered layout.
-function measure(floor) {
+function measure([floor, cap]) {
   const de = document.documentElement;
   const vw = de.clientWidth;
   const vh = window.innerHeight;
@@ -111,6 +118,9 @@ function measure(floor) {
   const cs = (el) => getComputedStyle(el);
   const scrollsX = (el) => /(auto|scroll)/.test(cs(el).overflowX);
   const clipsX = (el) => cs(el).overflowX !== 'visible';
+  // Vertically a scroll box (auto, scroll) still lets the reader reach what it holds; hidden and clip do not.
+  const clipsY = (el) => /(hidden|clip)/.test(cs(el).overflowY);
+  const pinned = (el) => { for (let a = el; a && a !== de; a = a.parentElement) if (cs(a).position === 'fixed') return true; return false; };
   const label = (el) => {
     const id = el.id ? '#' + el.id : '';
     const cls = typeof el.className === 'string' && el.className.trim() ? '.' + el.className.trim().split(/\s+/).join('.') : '';
@@ -118,16 +128,22 @@ function measure(floor) {
   };
   const visible = (el) => { const r = el.getBoundingClientRect(); return r.width > 0 && r.height > 0 && cs(el).visibility !== 'hidden'; };
 
-  // ED-3: a link is reachable when it is fully inside the viewport and not clipped by an ancestor,
-  // or when it sits in a closed <details> whose summary is reachable, or in a menu a visible
+  // ED-3: a link is reachable when it is fully inside the viewport's width, inside the page's height
+  // (the viewport's, for something fixed to it) and not clipped by an ancestor on either axis, or
+  // when it sits in a closed <details> whose summary is reachable, or in a menu a visible
   // aria-controls button opens.
   const inViewport = (el) => {
     const r = el.getBoundingClientRect();
     if (r.width <= 0 || r.height <= 0 || r.left < -1 || r.right > vw + 1) return false;
+    const [top, bottom] = pinned(el) ? [0, vh] : [-window.scrollY, de.scrollHeight - window.scrollY];
+    if (r.top < top - 1 || r.bottom > bottom + 1) return false;
     for (let a = el.parentElement; a && a !== de; a = a.parentElement) {
-      if (!clipsX(a)) continue;
+      const x = clipsX(a);
+      const y = clipsY(a);
+      if (!x && !y) continue;
       const ar = a.getBoundingClientRect();
-      if (r.left < ar.left - 1 || r.right > ar.right + 1) return false;
+      if (x && (r.left < ar.left - 1 || r.right > ar.right + 1)) return false;
+      if (y && (r.top < ar.top - 1 || r.bottom > ar.bottom + 1)) return false;
     }
     return true;
   };
@@ -155,9 +171,11 @@ function measure(floor) {
   // unless it is inside a scroll box or clipped by an ancestor that is itself inside the viewport.
   const all = document.body ? document.body.querySelectorAll('*') : [];
   const FOCUSABLE = 'a[href], button, input, select, textarea, [tabindex]';
+  out.elements = all.length;
+  out.measured = Math.min(all.length, cap);
   let n = 0;
   for (const el of all) {
-    if (++n > 6000) break;
+    if (++n > cap) break;
     if (!visible(el)) continue;
     if (scrollsX(el) && el.scrollWidth > el.clientWidth + 1) {
       const keyboard = el.tabIndex >= 0 || !!el.querySelector(FOCUSABLE);
@@ -214,21 +232,28 @@ export function verdicts(width, floor, m) {
   else add('ED-3', m.nav.unreachable.length ? 'FAIL' : 'PASS',
     m.nav.unreachable.length ? `${m.nav.unreachable.length} of ${m.nav.total} links unreachable: ${m.nav.unreachable.slice(0, 6).join(', ')}` : `${m.nav.total} links reachable`);
   const badBoxes = m.boxes.filter((b) => !b.keyboard || !b.named);
+  // A page larger than the walk: what the walk saw can fail, but it cannot pass for the whole page.
+  const capped = m.elements > m.measured ? `only the first ${m.measured} of ${m.elements} elements measured` : '';
   const problems = [];
   if (m.past.length) problems.push(`past the viewport, not in a scroll box: ${m.past.slice(0, 4).join(', ')}`);
   if (badBoxes.length) problems.push(`scroll box without keyboard access or a name: ${badBoxes.slice(0, 4).map((b) => b.el).join(', ')}`);
-  add('ED-4', problems.length ? 'FAIL' : 'PASS', problems.join('; ') || `${m.boxes.length} overflowing box(es), each keyboard-reachable; edge shades not measured`);
+  if (problems.length) add('ED-4', 'FAIL', problems.join('; ') + (capped ? `; ${capped}` : ''));
+  else if (capped) add('ED-4', 'NOT_RUN', `${capped}: ${m.boxes.length} overflowing box(es) keyboard-reachable among them, the rest not seen`);
+  else add('ED-4', 'PASS', `${m.boxes.length} overflowing box(es), each keyboard-reachable; edge shades not measured`);
   const limit = Math.min(120, m.vh / 4);
   const ed5 = [];
   if (m.chrome > limit) ed5.push(`sticky chrome ${m.chrome} px > ${Math.round(limit)} px`);
   if (m.nested.length) ed5.push(`nested full-height scroller: ${m.nested.slice(0, 3).join(', ')}`);
   if (m.anchor && m.anchor.top < m.chrome - 1) ed5.push(`anchor ${m.anchor.el} lands at ${m.anchor.top} px, under the ${m.chrome} px chrome`);
   add('ED-5', ed5.length ? 'FAIL' : 'PASS', ed5.join('; ') ||
-    `sticky chrome ${m.chrome} px ≤ ${Math.round(limit)} px` + (m.anchor ? `; anchor lands at ${m.anchor.top} px` : '; no in-page anchor to jump to') + '; refresh keeps scroll: not measured');
+    `sticky chrome ${m.chrome} px ≤ ${Math.round(limit)} px` + (m.anchor ? `; anchor lands at ${m.anchor.top} px` : '; no in-page anchor to jump to') + '; refresh keeps scroll: not measured' +
+    (capped ? `; nested scrollers: ${capped}` : ''));
   return rows;
 }
 
-function report(rows, opts, target) {
+export function report(rows, opts, target) {
+  rows = rows.map((r) => ({ ...r, evidence: scrub(r.evidence) }));
+  target = scrub(target);
   const failed = rows.filter((r) => r.verdict === 'FAIL').length;
   if (opts.json) {
     process.stdout.write(JSON.stringify({ target, browser: opts.browser, results: rows, failed }, null, 2) + '\n');
@@ -236,32 +261,40 @@ function report(rows, opts, target) {
     for (const r of rows) process.stdout.write(`${r.verdict.padEnd(8)} ${(r.rule + (r.width ? '@' + r.width : '')).padEnd(10)} ${r.evidence}\n`);
     process.stdout.write(`\n${rows.length} rule(s), ${failed} FAIL, ${rows.filter((r) => r.verdict === 'NOT_RUN').length} NOT_RUN\n`);
   }
+  if (!rows.length) {
+    process.stderr.write('no rule ran: nothing was measured, so nothing passed\n');
+    return 2;
+  }
   return failed ? 1 : 0;
 }
 
 async function main(argv) {
   const opts = parseArgs(argv);
+  // What the report names: the service, never the login URL its one-time code is in.
+  const shown = opts.service || opts.url;
   let target = opts.url;
   let floor = opts.floor;
-  const notRun = (why) => report(RULES.map((rule) => ({ rule, width: 0, verdict: 'NOT_RUN', evidence: why })), opts, target || opts.service);
+  const notRun = (why) => report(RULES.map((rule) => ({ rule, width: 0, verdict: 'NOT_RUN', evidence: why })), opts, shown);
+  // The browser first: a run that cannot measure must not spend a one-time code.
+  const pw = await loadPlaywright(opts.playwright);
+  if (!pw) return notRun('Playwright is not installed here: npm i -D playwright && npx playwright install webkit (or pass --playwright DIR)');
+  let browser;
+  try {
+    browser = await pw[opts.browser].launch();
+  } catch (err) {
+    return notRun(`the ${opts.browser} browser does not start: ${String(err.message).split('\n')[0]} (npx playwright install ${opts.browser})`);
+  }
   if (opts.service) {
     try {
       const t = await serviceTarget(opts.service, opts.servicesDir);
       target = t.url;
       if (floor === undefined && Number.isInteger(t.declared?.minWidth)) floor = t.declared.minWidth;
     } catch (err) {
+      await browser.close();
       return notRun(`could not open the service's dashboard: ${err.message}`);
     }
   }
   floor = floor ?? 360;
-  const pw = await loadPlaywright(opts.playwright);
-  if (!pw) return notRun('Playwright is not installed here: npm i -D playwright && npx playwright install webkit (or pass --playwright DIR)');
-  let browser;
-  try {
-    browser = await pw[opts.browser].launch();
-  } catch (err) {
-    return notRun(`the ${opts.browser} browser does not start: ${String(err.message).split('\n')[0]} (npx playwright install ${opts.browser})`);
-  }
   const rows = [];
   try {
     const context = await browser.newContext({ viewport: { width: Math.max(...opts.widths), height: opts.height } });
@@ -279,7 +312,7 @@ async function main(argv) {
       await page.evaluate(() => new Promise((r) => requestAnimationFrame(() => requestAnimationFrame(r))));
       await page.waitForTimeout(250);
       await page.evaluate(() => new Promise((r) => requestAnimationFrame(() => requestAnimationFrame(r))));
-      const m = await page.evaluate(measure, floor);
+      const m = await page.evaluate(measure, [floor, ELEMENT_CAP]);
       rows.push(...verdicts(width, floor, m));
     }
   } catch (err) {
@@ -287,9 +320,20 @@ async function main(argv) {
   } finally {
     await browser.close();
   }
-  return report(rows, opts, opts.service || target);
+  return report(rows, opts, shown);
+}
+
+// Whether node was started on this file. Real paths, not URLs: the launcher installs the plugin under a symlinked
+// folder (~/.passioncode/current), and comparing import.meta.url (resolved) with argv[1] (the link) never ran main
+// (board thread b42e16b7).
+function startedDirectly() {
+  try {
+    return Boolean(process.argv[1]) && realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url));
+  } catch {
+    return false;
+  }
 }
 
-if (import.meta.url === pathToFileURL(process.argv[1] || '').href) {
+if (startedDirectly()) {
   main(process.argv.slice(2)).then((code) => process.exit(code), (err) => { process.stderr.write(String(err?.stack || err) + '\n'); process.exit(2); });
 }

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_dashboard_link.py

@@ -7,7 +7,7 @@ This is an output correctness gate, not authentication, discovery, or a relay.
 import json
 import re
 import sys
-from urllib.parse import parse_qs, urlsplit
+from urllib.parse import parse_qs, parse_qsl, unquote, urlsplit
 
 
 def require(condition, reason):
@@ -15,6 +15,63 @@ def require(condition, reason):
         raise ValueError(reason)
 
 
+# Credential names and values: the same rules as fabric-button.js (credentialName, secretValue).
+CREDENTIAL_WORDS = {
+    'token', 'secret', 'password', 'passwd', 'pass', 'passphrase', 'credential', 'credentials', 'cookie',
+    'authorization', 'bearer', 'jwt', 'otp', 'apikey', 'signature', 'sig', 'accesstoken', 'idtoken', 'authtoken',
+    'refreshtoken', 'sessionid', 'sessiontoken', 'logincode', 'authcode', 'privatekey', 'clientsecret', 'secretkey',
+    'accesskey'}
+CREDENTIAL_PAIRS = {
+    'key': {'private', 'api', 'access', 'secret', 'session', 'auth', 'signing', 'encryption', 'master', 'client', 'login',
+            'refresh'},
+    'auth': {'token', 'code', 'header'},
+    'session': {'token', 'id'},
+    'code': {'login', 'auth', 'access', 'session'}}
+JWT_SHAPE = re.compile(r'eyJ[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]*')
+SECRET_VALUE = re.compile(r'(^bearer\s.+|sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|xox[abposr]-[A-Za-z0-9-]{10,}'
+                          r'|AKIA[0-9A-Z]{16}|glpat-[A-Za-z0-9_-]{20,})', re.I | re.S)
+LONG_RUN = re.compile(r'[A-Za-z0-9+/=_-]{40,}')
+
+
+def name_words(name):
+    name = re.sub(r'([a-z0-9])([A-Z])', r'\1 \2', name)
+    name = re.sub(r'([A-Z]+)([A-Z][a-z])', r'\1 \2', name)
+    return [w.lower() for w in re.split(r'[\s._-]+', name) if w]
+
+
+def credential_name(name):
+    split = name_words(name)
+    words = set(split) | {w[:-1] for w in split if len(w) > 2 and w.endswith('s')}
+    if words & CREDENTIAL_WORDS:
+        return True
+    if len(split) == 1 and words & set(CREDENTIAL_PAIRS):
+        return True
+    return any(w in words and words & pairs for w, pairs in CREDENTIAL_PAIRS.items())
+
+
+def secret_value(value):
+    long_secret = any(re.search(r'[a-z]', run) and re.search(r'[A-Z]', run) and re.search(r'[0-9]', run)
+                      for run in LONG_RUN.findall(value))
+    return bool(JWT_SHAPE.search(value) or SECRET_VALUE.search(value) or long_secret)
+
+
+def carries_credential(text):
+    # A query or fragment whose names or values could be a credential: refused even with an empty value.
+    return (secret_value(text) or secret_value(unquote(text))
+            or any(credential_name(name) or secret_value(name) or secret_value(value)
+                   for name, value in parse_qsl(text, keep_blank_values=True)))
+
+
+def login_path(path):
+    # The path a server routes: refuse what normalises differently in different servers, then compare.
+    decoded = unquote(path)
+    require(not re.search(r'%2f|%5c', path, re.I) and '\\' not in decoded, 'encoded_separator')
+    segments = decoded.split('/')[1:]
+    require(not any(seg in ('.', '..') for seg in segments), 'dot_segment')
+    require(all(seg for seg in segments[:-1]), 'empty_segment')
+    return '/'.join([''] + [seg for seg in segments if seg]).lower() == '/fabric/v1/login'
+
+
 def safe_path(path):
     return (isinstance(path, str) and path.startswith('/') and not path.startswith('//')
             and len(path) <= 2048 and not re.search(r'[\\\x00-\x1f\x7f]', path))
@@ -42,10 +99,14 @@ def check(data):
             and not plain.username and not plain.password, 'invalid_http_fallback')
     http_page = plain.path + ('?' + plain.query if plain.query else '') + ('#' + plain.fragment if plain.fragment else '')
     require(safe_path(http_page) and http_page == (page or '/'), 'mismatched_page')
-    sensitive = {'token', 'access_token', 'refresh_token', 'password', 'secret', 'login_code'}
-    page_query = parse_qs(urlsplit(http_page).query)
-    require(not sensitive.intersection(k.lower() for k in page_query), 'credential_query')
-    require(urlsplit(http_page).path != '/fabric/v1/login', 'login_link_is_not_dashboard')
+    sensitive = {'token', 'access_token', 'refresh_token', 'password', 'secret', 'login_code', 'code', 'api_key',
+                 'apikey', 'key', 'auth'}
+    parts = urlsplit(http_page)
+    places = [parts.query, parts.fragment] + parts.fragment.split('?', 1)[1:]
+    require(not any(sensitive.intersection(k.lower() for k in parse_qs(p, keep_blank_values=True)) for p in places),
+            'credential_query')
+    require(not any(carries_credential(p) for p in places), 'credential_query')
+    require(not login_path(parts.path), 'login_link_is_not_dashboard')
     state = host.get('state')
     require(state in ('available', 'not_installed', 'unknown', 'incompatible', 'handler_mismatch', 'unsupported'), 'unknown_host_state')
     target, viewer = data.get('target_device'), data.get('viewer_device')

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_service.py

@@ -318,7 +318,7 @@ class Probe:
         self.events = events
         bad = []
         for e in events:
-            if e.get("level") not in fs.LEVELS or not re.match(r"^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)*$", str(e.get("kind", ""))):
+            if e.get("level") not in fs.LEVELS or not re.match(r"^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)*\Z", str(e.get("kind", ""))):
                 bad.append(str(e.get("id")))
             elif " " not in str(e.get("text", "")).strip():
                 bad.append("%s (text is not a sentence)" % e.get("id"))

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_service_rules.py

@@ -29,7 +29,7 @@ def plist_problems(plist: dict, label: object, token: object = None) -> list:
     if plist.get("KeepAlive") is not True:
         problems.append("KeepAlive is %r, not true" % plist.get("KeepAlive"))
     for key, value in (plist.get("EnvironmentVariables") or {}).items():
-        if re.search(r"(TOKEN|SECRET|PASSWORD|KEY)$", key) and not key.endswith("_FILE"):
+        if re.search(r"(TOKEN|SECRET|PASSWORD|KEY)\Z", key) and not key.endswith("_FILE"):
             problems.append("secret-like variable %s in the plist" % key)
         if token and token in str(value):
             problems.append("the service token itself is in the plist")

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/dashboard_kit.py

@@ -23,6 +23,7 @@ from pathlib import Path
 import re
 import subprocess
 import sys
+import time
 from typing import Any, Dict, List, Optional, Sequence, Tuple
 
 KIT_DIR = Path(__file__).resolve().parent.parent / "assets" / "dashboard-kit"
@@ -34,6 +35,9 @@ JS_BEGIN, JS_END = "/* fabric-dashboard-kit:theme-ids:begin */", "/* fabric-dash
 TOKEN_ORDER = ("bg", "panel", "panel-2", "ink", "muted", "border", "border-strong", "edge", "accent",
                "accent-weak", "accent-ink", "ok", "ok-weak", "warn", "warn-weak", "danger", "danger-weak",
                "info", "info-weak")
+#: The SessionStart notice's total for every git call and the tree walk together: under the hook's 5 s (FAA-69).
+NOTICE_BUDGET_S = 3.5
+
 SKIP_DIRS = {".git", "node_modules", "dist", "build", ".venv", "venv", "__pycache__", ".next", "out"}
 EXTENSION_KEY = "https://fabric.passioncode.ai/agent-contract/extensions/dashboard/0.1"
 
@@ -187,27 +191,44 @@ def is_kit_source(path: Path) -> bool:
         return False
 
 
-def git(repo: Path, *args: str, timeout: float = 2.0) -> Optional[str]:
+class OutOfTime(Exception):
+    """A shared deadline (`until`, a time.monotonic() value) passed before the answer was known."""
+
+
+def git(repo: Path, *args: str, timeout: float = 2.0, until: Optional[float] = None) -> Optional[str]:
+    """git's stdout, or None. With `until`, the call gets at most what is left of that deadline, and a call the
+    deadline cuts short raises OutOfTime instead of answering None."""
+    if until is not None:
+        left = until - time.monotonic()
+        if left <= 0:
+            raise OutOfTime()
+        timeout = min(timeout, left)
     try:
         done = subprocess.run(["git", "-C", str(repo)] + list(args), capture_output=True, text=True, timeout=timeout)
+    except subprocess.TimeoutExpired:
+        if until is not None and time.monotonic() >= until - 0.05:
+            raise OutOfTime()
+        return None
     except (OSError, subprocess.SubprocessError):
         return None
     return done.stdout if done.returncode == 0 else None
 
 
-def repo_root(start: Path) -> Optional[Path]:
-    out = git(start, "rev-parse", "--show-toplevel")
+def repo_root(start: Path, until: Optional[float] = None) -> Optional[Path]:
+    out = git(start, "rev-parse", "--show-toplevel", until=until)
     return Path(out.strip()) if out and out.strip() else None
 
 
-def find_copies(repo: Path) -> List[Path]:
+def find_copies(repo: Path, until: Optional[float] = None) -> List[Path]:
     listed = git(repo, "ls-files", "-z", "--cached", "--others", "--exclude-standard", "--",
-                 "*fabric-dashboard.css", "*fabric-dashboard.js", "*fabric-button.js")
+                 "*fabric-dashboard.css", "*fabric-dashboard.js", "*fabric-button.js", until=until)
     if listed is not None:
         paths = [repo / p for p in listed.split("\0") if p]
     else:
         paths = []
         for top, dirs, files in os.walk(repo):
+            if until is not None and time.monotonic() >= until:
+                raise OutOfTime()
             dirs[:] = [d for d in dirs if d not in SKIP_DIRS]
             if len(Path(top).relative_to(repo).parts) > 6:
                 dirs[:] = []
@@ -256,9 +277,9 @@ def same_repository(a: str, b: str) -> bool:
     return bool(a and b) and norm(a) == norm(b)
 
 
-def services_of(repo: Path, directory: Optional[Path] = None) -> List[str]:
+def services_of(repo: Path, directory: Optional[Path] = None, until: Optional[float] = None) -> List[str]:
     """The services whose descriptor names this repository as its source (`source.repository`)."""
-    origin = (git(repo, "config", "--get", "remote.origin.url") or "").strip()
+    origin = (git(repo, "config", "--get", "remote.origin.url", until=until) or "").strip()
     if not origin:
         return []
     found = []
@@ -277,19 +298,24 @@ def services_of(repo: Path, directory: Optional[Path] = None) -> List[str]:
     return found
 
 
-def declares_dashboard(repo: Path) -> bool:
+def declares_dashboard(repo: Path, until: Optional[float] = None) -> bool:
     """Whether the repository's code declares a dashboard surface (a quick git grep, no network)."""
     out = git(repo, "grep", "--untracked", "-l", "-I", "-E", r"""["']?dashboard["']?[[:space:]]*[:=][[:space:]]*\{?[[:space:]]*["']?path""", "--",
-              "*.py", "*.mjs", "*.js", "*.ts", "*.json", timeout=2.0)
+              "*.py", "*.mjs", "*.js", "*.ts", "*.json", timeout=2.0, until=until)
     return bool(out and out.strip())
 
 
-def status(repo: Path, manifest: Optional[Dict[str, Any]] = None, directory: Optional[Path] = None) -> Dict[str, Any]:
+def status(repo: Path, manifest: Optional[Dict[str, Any]] = None, directory: Optional[Path] = None,
+           services: Optional[List[str]] = None, until: Optional[float] = None) -> Dict[str, Any]:
+    """The kit copies in `repo`, the services it owns and whether it has a dashboard. `services`, when the caller has
+    them already; `until`, a shared deadline (OutOfTime when it passes)."""
     manifest = manifest or load_manifest()
-    copies = [copy_state(p, manifest) for p in find_copies(repo)]
-    services = services_of(repo, directory)
+    if services is None:
+        services = services_of(repo, directory, until=until)
+    copies = [copy_state(p, manifest) for p in find_copies(repo, until=until)]
     return {"repository": str(repo), "kit": "%s@%s" % (KIT_NAME, manifest["version"]), "copies": copies,
-            "services": services, "dashboard": bool(copies) or (bool(services) and declares_dashboard(repo))}
+            "services": services,
+            "dashboard": bool(copies) or (bool(services) and declares_dashboard(repo, until=until))}
 
 
 def notice_line(report: Dict[str, Any], script: Path) -> Optional[str]:
@@ -364,14 +390,22 @@ def hook_cwd(stdin_text: str) -> Path:
 
 
 def notice() -> int:
+    """The SessionStart hook. Asks first whether the repository owns a service and says nothing, having looked at
+    nothing else, when it owns none; every git call and the tree walk share NOTICE_BUDGET_S, and a notice that runs
+    out of it says nothing rather than a half-measured line (FAA-69)."""
+    until = time.monotonic() + NOTICE_BUDGET_S
     try:
         stdin_text = "" if sys.stdin is None or sys.stdin.isatty() else sys.stdin.read(65536)
-        root = repo_root(hook_cwd(stdin_text))
-        if root is not None:
-            line = notice_line(status(root), Path(__file__).resolve())
-            if line:
-                print(line)
-    except Exception:  # noqa: BLE001 — a hook never breaks a session
+        root = repo_root(hook_cwd(stdin_text), until=until)
+        if root is None:
+            return 0
+        services = services_of(root, until=until)
+        if not services:
+            return 0
+        line = notice_line(status(root, services=services, until=until), Path(__file__).resolve())
+        if line:
+            print(line)
+    except Exception:  # noqa: BLE001 - a hook never breaks a session; OutOfTime included
         pass
     return 0
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-auth.mjs

@@ -228,9 +228,11 @@ export const expiredSessionCookieHeader = (remote = false) => (remote ? remoteSe
  */
 export function checkRemoteRequest(origin, host, requestOrigin, secFetchSite, forwardedProto) {
   const own = new URL(origin);
-  if (String(host ?? '').toLowerCase() !== own.host) return `Host ${host} is not this service.`;
+  // A default port, written or not, names the same host (finding 15): the URL drops it from `own`; drop it from the request too.
+  const dropped = (value) => { const port = { 'https:': ':443', 'http:': ':80' }[own.protocol]; return port && value.endsWith(port) ? value.slice(0, -port.length) : value; };
+  if (dropped(String(host ?? '').toLowerCase()) !== own.host) return `Host ${host} is not this service.`;
   if (forwardedProto !== undefined && forwardedProto !== null && String(forwardedProto).split(',')[0].trim() !== 'https') return 'This service answers over https only.';
-  if (requestOrigin !== undefined && requestOrigin !== null && requestOrigin !== own.origin) return `Origin ${requestOrigin} is not this service.`;
+  if (requestOrigin !== undefined && requestOrigin !== null && dropped(String(requestOrigin)) !== own.origin) return `Origin ${requestOrigin} is not this service.`;
   if (secFetchSite === 'cross-site') return 'Cross-site requests are refused.';
   return null;
 }

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-board-link.mjs

@@ -0,0 +1,145 @@
+// The board link (DEC-0078, FAA-12b): the board session over the hub, the fsynced checkpoint and a claimed request as data.
+// Part of the Node board connector (FAA-65, layer L4), below the responder in fabric-board-session.mjs, which re-exports
+// these names; the twin of fabric_board_link.py. Node 18+, no dependency.
+import fs from 'node:fs';
+import path from 'node:path';
+import { HubError, MCP_PROTOCOL_VERSION, postMcp, toolAnswer } from './fabric-hub.mjs';
+import { atomicWrite, ensurePrivateDir } from './fabric-service.mjs';
+import { BoardError, RESPOND_TOOLS, isObj, refusalProblems } from './fabric-board-shapes.mjs';
+
+/** MCP over HTTP with a board session's one-session bearer; calls are serialised; close() sends the session's DELETE. */
+export class BoardSession {
+  constructor(grant, { timeout = 15000, post = postMcp } = {}) {
+    Object.assign(this, { grant, timeout, post });
+    this.mcpSession = null;
+    this.protocolVersion = MCP_PROTOCOL_VERSION;
+    this.rpc = 0;
+    this.queue = Promise.resolve();
+  }
+
+  #serial(fn) {
+    const run = this.queue.then(fn, fn);
+    this.queue = run.catch(() => {});
+    return run;
+  }
+
+  async #send(body, method = 'POST') {
+    try {
+      return await this.post(this.grant.origin, body, this.grant.bearer(), { session: this.mcpSession, timeout: this.timeout, method, protocolVersion: this.mcpSession ? this.protocolVersion : undefined });
+    } catch (e) {
+      if (e instanceof HubError) throw new BoardError('unreachable', 'Fabric\'s hub did not answer; a write may have been stored, so send it again with the same idempotency key.', true);
+      throw e;
+    }
+  }
+
+  open() {
+    return this.#serial(async () => {
+      this.rpc += 1;
+      const answer = await this.#send({ jsonrpc: '2.0', id: this.rpc, method: 'initialize', params: { protocolVersion: MCP_PROTOCOL_VERSION, capabilities: {}, clientInfo: { name: 'fabric-agent-adapter-board', version: '1' } } });
+      if (answer.status === 401) throw new BoardError('session-ended', 'Fabric refused the board session\'s bearer; join again.', true);
+      const sid = answer.headers['mcp-session-id'];
+      if (answer.status !== 200 || !isObj(answer.body) || !isObj(answer.body.result) || !sid) throw new BoardError('unreachable', `Fabric did not open the board session (HTTP ${answer.status}).`, true);
+      this.mcpSession = String(sid);
+      if (typeof answer.body.result.protocolVersion === 'string') this.protocolVersion = answer.body.result.protocolVersion;
+      await this.#send({ jsonrpc: '2.0', method: 'notifications/initialized' });
+    });
+  }
+
+  call(tool, args) {
+    if (!RESPOND_TOOLS.has(tool)) return Promise.reject(new BoardError('not-in-scope', `${tool} is not served to a board session; use a Project session for it.`, false, tool));
+    return this.#serial(async () => {
+      if (!this.mcpSession) throw new BoardError('session-ended', 'The board session is not open.', true, tool);
+      this.rpc += 1;
+      const answer = await this.#send({ jsonrpc: '2.0', id: this.rpc, method: 'tools/call', params: { name: tool, arguments: args } });
+      if (answer.status === 401) throw new BoardError('session-ended', 'Fabric ended the board session (it left, was revoked or expired); join again.', true, tool);
+      let value;
+      try {
+        value = toolAnswer(answer, tool);
+      } catch (e) {
+        throw new BoardError(e.retryable ? 'unreachable' : 'receipt-shape', e.message, e.retryable, tool);
+      }
+      if ('error' in value) {
+        if (refusalProblems(value).length) throw new BoardError('receipt-shape', `Fabric refused ${tool} in a form the contract does not name.`, false, tool);
+        throw new BoardError(value.error.code, value.error.message, value.error.retryable, tool);
+      }
+      return value;
+    });
+  }
+
+  close() {
+    return this.#serial(async () => {
+      if (!this.mcpSession) return;
+      try {
+        await this.#send({}, 'DELETE');
+      } catch {
+        // best effort: the lease lapses in 60 s anyway
+      }
+      this.mcpSession = null;
+    });
+  }
+}
+
+/** The responder's journal (0600 JSON, the same file fabric_board.py writes), fsynced before the step it announces. */
+export class Checkpoint {
+  constructor(file) {
+    this.file = file;
+    this.entries = this.#load();
+  }
+  #load() {
+    let text;
+    try {
+      text = fs.readFileSync(this.file, 'utf8');
+    } catch (e) {
+      if (e.code === 'ENOENT') return {};
+      throw new BoardError('checkpoint', `The board checkpoint ${this.file} cannot be read (${e.code}); fix or move it before answering requests.`);
+    }
+    let doc;
+    try {
+      doc = JSON.parse(text);
+    } catch {
+      doc = null;
+    }
+    if (!isObj(doc) || doc.version !== 1 || !isObj(doc.requests)) throw new BoardError('checkpoint', `The board checkpoint ${this.file} is not one this kit writes.`);
+    return doc.requests;
+  }
+  #write(entries) {
+    try {
+      ensurePrivateDir(path.dirname(this.file));
+      const sorted = Object.fromEntries(Object.keys(entries).sort().map((k) => [k, entries[k]]));
+      atomicWrite(this.file, `${JSON.stringify({ requests: sorted, version: 1 }, null, 1)}\n`, 0o600);
+    } catch (e) {
+      throw new BoardError('checkpoint', `The board checkpoint could not be written (${e.code ?? e.message}); nothing was sent.`);
+    }
+  }
+  put(entry) {
+    const entries = { ...this.entries, [entry.request]: JSON.parse(JSON.stringify(entry)) };
+    this.#write(entries);
+    this.entries = entries;
+  }
+  drop(requestId) {
+    if (!(requestId in this.entries)) return;
+    const { [requestId]: _gone, ...entries } = this.entries;
+    this.#write(entries);
+    this.entries = entries;
+  }
+}
+
+/** A claimed request as data: never an instruction. */
+export class BoardRequest {
+  constructor(message, capability) {
+    const req = isObj(message.request) ? message.request : {};
+    const body = isObj(message.body) ? message.body : {};
+    this.requestId = req.id;
+    this.messageId = message.id;
+    this.capability = capability;
+    this.body = typeof body.text === 'string' ? body.text : null;
+    this.bodyFormat = body.format ?? 'text/plain';
+    this.artifacts = Array.isArray(message.artifacts) ? [...message.artifacts] : [];
+    this.sender = isObj(message.sender) ? message.sender : {};
+    this.deadline = req.deadline;
+    this.thread = message.thread;
+  }
+  toJSON() {
+    return { requestId: this.requestId, capability: this.capability }; // never the body
+  }
+}