@passioncode-ai/fabric-agent-adapter 0.40.0 → 0.42.1

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-estate.mjs

@@ -238,6 +238,7 @@ export function verifyEstateRecord(record, trust) {
  * undefined when the record places no such agent there in that context.
  */
 export function placementTrust(record, machineId, agentRef, context = PERSONAL_CONTEXT) {
+  if (!isObject(record)) return undefined; // a record that is no object places nothing, as in the Python twin
   const machine = list(record.machines).find((entry) => entry.id === machineId);
   const placement = list(machine?.packages).find((entry) => entry.agentRef === agentRef && contextOf(entry) === context);
   if (!placement) return undefined;
@@ -378,7 +379,8 @@ function keys(value, flag) {
     if (deviceKeys.filter((key) => key.use === 'sig').length !== 1) flag(`${at}/deviceKeys`, 'a machine has exactly one signing device key, <id>#sig');
     if (deviceKeys.filter((key) => key.use === 'kem').length > 1) flag(`${at}/deviceKeys`, 'a machine has at most one key-agreement device key, <id>#kem');
     const seen = new Set();
-    deviceKeys.forEach((key, k) => {
+    // The index is the key's position in the list as written, non-objects counted, as the contract and the Python twin name it.
+    indexed(machine.deviceKeys).forEach(([key, k]) => {
       if (key.kid !== `${show(machine.id)}#${show(key.use)}`) flag(`${at}/deviceKeys/${k}/kid`, 'a device key is listed as <machine id>#sig or <machine id>#kem, by its role');
       // A key with no canonical fingerprint could be read as two keys by two readers, and no key reference names it (DEC-0084).
       if (deviceKeyFingerprint(key) === undefined) flag(`${at}/deviceKeys/${k}/publicKey`, "a device key's octets are written in canonical padded base64, the one form a key reference can name (DEC-0084)");

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-interop.mjs

@@ -347,6 +347,15 @@ export function urlRequest(message, url) {
 }
 
 // --- C3.2 jobs: the same file format as fabric_interop.JobStore ------------------------------
+const LONE_SURROGATE = /[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/;
+
+/** What a key is kept beside (FAA-77): sha256 of the RFC 8785 form of [capability, input]; an input with none is refused. */
+export function intentDigest(capability, input) {
+  let form;
+  try { form = jcs([capability, input]); } catch { throw new InteropError("A job's input with an idempotency key needs a JSON form (RFC 8785)."); }
+  return `sha256:${crypto.createHash('sha256').update(form, 'utf8').digest('hex')}`;
+}
+
 export class JobStore {
   constructor(dir) { this.dir = dir; }
 
@@ -370,36 +379,63 @@ export class JobStore {
 
   // With idempotencyKey the key is kept per caller (the authenticated caller, DEC-0087): a key that already names a job
   // starts nothing and throws, unless repeat() answers 'run'; then the key names the new job.
+  // The key is kept beside the intent's digest (FAA-77): a key that names a job of another intent is idempotency-conflict.
+  // A key file a kit before 0.41.0 wrote carries no intent: it is answered with its job as 0.40.0 answered it (see repeat).
   create(capability, input, { traceparent, pollIntervalMs, caller = null, idempotencyKey, now, limitHolds, approvalGranted = false } = {}) {
+    let intent = null;
     if (idempotencyKey !== undefined) {
-      const decision = this.repeat(caller, idempotencyKey, now ?? nowIso(), { limitHolds, approvalGranted });
+      intent = intentDigest(capability, input);
+      const decision = this.repeat(caller, idempotencyKey, now ?? nowIso(), { limitHolds, approvalGranted, capability, input });
+      if (decision.decision === 'conflict') throw new InteropError(`idempotency-conflict: key ${idempotencyKey} names a job of another intent; send the same capability and input, or a new key.`);
       if (decision.decision === 'same') throw new InteropError(`Key ${idempotencyKey} already names job ${decision.job.id}; answer with that job (JobStore.repeat).`);
     }
     const id = `job_${crypto.randomBytes(12).toString('hex')}`;
     const job = { id, status: 'working' };
     if (pollIntervalMs) job.pollIntervalMs = Math.trunc(pollIntervalMs);
     this.save({ job, private: { capability, input, traceparent: parseTraceparent(traceparent) ? traceparent : null } });
-    if (idempotencyKey !== undefined) atomicWrite(this.keyFile(caller, idempotencyKey), `${JSON.stringify({ job: id })}\n`, 0o600);
+    if (idempotencyKey !== undefined) atomicWrite(this.keyFile(caller, idempotencyKey), `${JSON.stringify({ job: id, intent })}\n`, 0o600);
     return { job: { id, status: 'working' } };
   }
 
   keyFile(caller, key) {
     if (typeof key !== 'string' || key.length === 0) throw new InteropError('An idempotency key is a non-empty string.');
+    if (LONE_SURROGATE.test(key) || (typeof caller === 'string' && LONE_SURROGATE.test(caller))) throw new InteropError('An idempotency key and its caller are Unicode text; a lone surrogate is refused.');
     const dir = path.join(this.dir, 'keys');
     ensurePrivateDir(dir);
     return path.join(dir, `${crypto.createHash('sha256').update(JSON.stringify([caller ?? null, key]), 'utf8').digest('hex')}.json`);
   }
 
-  // The answer to a key this caller sent before: {decision: 'new'|'same'|'run', job}.
-  repeat(caller, key, now, options = {}) {
-    let id;
-    try { id = JSON.parse(fs.readFileSync(this.keyFile(caller, key), 'utf8')).job; } catch (e) {
-      if (e.code === 'ENOENT') return { decision: 'new', job: null };
-      throw new InteropError(`Key ${key} is unreadable on disk.`);
+  keyRecord(caller, key) {
+    let record;
+    try { record = JSON.parse(fs.readFileSync(this.keyFile(caller, key), 'utf8')); } catch (e) {
+      if (e.code === 'ENOENT') return null;
+      if (e instanceof InteropError) throw e;
     }
+    if (record === null || typeof record !== 'object' || Array.isArray(record)) throw new InteropError(`Key ${key} is unreadable on disk.`);
+    return record;
+  }
+
+  // The answer to a key this caller sent before: {decision: 'new'|'same'|'run'|'conflict', job}. 'same': answer with
+  // that job; 'run': the intent runs again, once; 'conflict': given options.capability (and options.input), the key was
+  // kept beside another intent (idempotency-conflict, FAA-77). A key file a kit before 0.41.0 wrote holds only
+  // {"job": id}, no intent: it never answers 'conflict', and 'run' only for the intent its job stored; otherwise 'same'.
+  repeat(caller, key, now, options = {}) {
+    const record = this.keyRecord(caller, key);
+    if (record === null) return { decision: 'new', job: null };
+    const id = record.job;
+    if (typeof id !== 'string') throw new InteropError(`Key ${key} is unreadable on disk.`);
     let job;
     try { job = this.get(id); } catch (e) { if (e instanceof UnknownJob) return { decision: 'new', job: null }; throw e; }
-    return { decision: repeatedKeyDecision(job, now, options), job };
+    let decision = repeatedKeyDecision(job, now, options);
+    if (options.capability === undefined || options.capability === null) return { decision, job };
+    const intent = intentDigest(options.capability, options.input ?? null);
+    if (Object.hasOwn(record, 'intent')) return { decision: record.intent !== intent ? 'conflict' : decision, job };
+    // A 0.40.0 key runs only the intent its job stored (an input with no JSON form is refused, as the Python kit refuses it).
+    if (decision === 'run') {
+      const stored = this.load(id).private ?? {};
+      if (intentDigest(stored.capability ?? null, stored.input ?? null) !== intent) decision = 'same';
+    }
+    return { decision, job };
   }
 
   get(jobId) { return { ...this.load(jobId).job }; }
@@ -448,11 +484,9 @@ export class JobStore {
   // A job a limit paused and its provider will resume: working, the pause grammar, pollIntervalMs reaching the reset.
   pause(jobId, { resetsAt, text } = {}) {
     const statusMessage = pauseMessage({ resetsAt, text });
-    if (resetsAt !== undefined) {
-      const wait = utcTime(resetsAt) - Date.now();
-      if (wait > 0) { const record = this.load(jobId); record.job.pollIntervalMs = Math.trunc(Math.min(wait, 3600000)); this.save(record); }
-    }
-    return this.transition(jobId, 'working', { statusMessage });
+    const wait = resetsAt === undefined ? 0 : utcTime(resetsAt) - Date.now();
+    // One write, after the terminal check: a terminal job does not change, pollIntervalMs included (finding 11).
+    return this.transition(jobId, 'working', { statusMessage, pollIntervalMs: wait > 0 ? Math.trunc(Math.min(wait, 3600000)) : undefined });
   }
 
   // A job a limit stopped and its provider will not resume: failed, quota-exhausted, data {retryable, resetsAt?}.

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-lock.mjs

@@ -1,5 +1,5 @@
 // One copy of a service, locked before any side effect (LC-01, DEC-0057): the instance lock and the supervisor marker.
-// Part of the Node service kit (FAA-65, layer L3); the twin of fabric_lock.py. Node 20+, no dependency.
+// Part of the Node service kit (FAA-65, layer L3); the twin of fabric_lock.py. Node 20+ (22+ for the Linux lock), no dependency.
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import net from 'node:net';
@@ -52,6 +52,12 @@ export class InstanceLock {
     // with the process. The Python kit holds the same name beside its file lock (fabric_service.lock_name).
     const name = lockName(this.path);
     if (!name) throw new ServiceError(`No instance lock on ${process.platform}: the kit supports macOS, Linux and Windows.`);
+    const names = process.platform === 'linux' ? await abstractNames() : 'exact';
+    if (names === 'none' || names === 'padded') {
+      // Node 18 and 20 cannot bind the name the Python kit binds: 18 and early 20 make every name 108 NUL bytes (one lock
+      // for every service on the machine), later 20 pads it with NUL bytes (a name no Python copy or probe sees).
+      throw new ServiceError(`Node ${process.version} cannot hold the instance lock's abstract socket name on Linux; run the service on Node 22 or later.`);
+    }
     this.server = net.createServer();
     await new Promise((resolve, reject) => {
       // Windows reports a held pipe as EADDRINUSE (access denied) or, when its holder capped the instances, EBUSY.
@@ -72,6 +78,33 @@ export class InstanceLock {
   }
 }
 
+let abstractNamesSeen = null;
+
+/**
+ * How this Node binds an abstract unix socket name on Linux, learned once by binding a random one and reading
+ * /proc/net/unix: 'exact' (Node 21 and later: the name the Python kit binds and fabric_lock.lock_name_held reads),
+ * 'padded' (Node 20.x: the name followed by NUL bytes to the whole sun_path) or 'none' (Node 18 and early 20: every
+ * name becomes 108 NUL bytes). 'unknown' when the table cannot be read.
+ */
+export async function abstractNames() {
+  if (abstractNamesSeen !== null) return abstractNamesSeen;
+  const probe = `fabric-probe-${crypto.randomBytes(8).toString('hex')}`;
+  const server = net.createServer();
+  try {
+    await new Promise((resolve, reject) => { server.once('error', reject); server.listen(`\0${probe}`, resolve); });
+    const rows = fs.readFileSync('/proc/net/unix', 'utf8').split('\n').map((row) => row.trimEnd().split(' ').pop());
+    if (rows.includes(`@${probe}`)) abstractNamesSeen = 'exact';
+    else if (rows.includes(`@${probe}`.padEnd(108, '@'))) abstractNamesSeen = 'padded';
+    else abstractNamesSeen = 'none';
+  } catch (error) {
+    // A random name already in use means every name collapses to one: another such Node holds it.
+    abstractNamesSeen = error?.code === 'EADDRINUSE' ? 'none' : 'unknown';
+  } finally {
+    server.close();
+  }
+  return abstractNamesSeen;
+}
+
 /** The name the lock is held under on Linux (abstract socket) and Windows (named pipe); null on macOS. */
 export function lockName(lockPath, platform = process.platform) {
   const digest = (text) => crypto.createHash('sha256').update(text).digest('hex').slice(0, 32);

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-package.mjs

@@ -15,7 +15,7 @@
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
-import { fileURLToPath, pathToFileURL } from 'node:url';
+import { fileURLToPath } from 'node:url';
 import { isSmallOrderKey, jcs } from './fabric-delegation.mjs';
 import { secretArgument, secretValue } from './fabric-secrets.mjs';
 
@@ -31,6 +31,13 @@ const SECRET_FILE = /^(\.env(\..+)?|.*\.(pem|key|p12|pfx|jks|keystore)|id_(rsa|d
 const SECRET_FILE_OK = /^\.env\.(example|sample|template)$/;
 const B64URL = /^[A-Za-z0-9_-]+$/;
 const PKCS8_ED25519 = Buffer.from('302e020100300506032b657004220420', 'hex');
+/**
+ * How deep a document read from disk may nest. Python's recursion limit and Node's stack give out at different depths,
+ * so both readers refuse past this one, well below either (FAA-78, finding 43); no package document comes near it.
+ */
+export const MAX_NESTING = 256;
+/** Strict UTF-8: invalid bytes are a refusal, never replaced, so the bytes read are the bytes signed (finding 43). */
+const strictUtf8 = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true });
 import { isObject, objects, jsonEqual } from './fabric-jsvalue.mjs'; // the core's (FAA-65)
 import { isString } from './fabric-jsvalue.mjs'; // the core's (FAA-65)
 
@@ -48,7 +55,15 @@ export const sha256Of = (data) => `sha256:${crypto.createHash('sha256').update(d
 /** SHA-256 over the UTF-8 RFC 8785 form of the package without digest and signatures (DEC-0050). */
 export function packageDigest(pkg) {
   const { digest: _d, signatures: _s, ...covered } = pkg;
-  return sha256Of(Buffer.from(jcs(covered), 'utf8'));
+  let text;
+  try {
+    text = jcs(covered);
+  } catch (error) {
+    // Nested past the stack: no form this kit can write, as Python's RecursionError is none.
+    if (error instanceof RangeError) throw new TypeError('the package nests too deeply to have an RFC 8785 form');
+    throw error;
+  }
+  return sha256Of(Buffer.from(text, 'utf8'));
 }
 
 /** The bytes a package signature covers (DEC-0051); the role is inside, so no signature stands for another role. */
@@ -117,7 +132,9 @@ const schema = () => (schemaCache ??= JSON.parse(fs.readFileSync(SCHEMA_FILE, 'u
 
 
 const typeOf = (v) => (v === null ? 'null' : Array.isArray(v) ? 'array' : typeof v === 'number' ? (Number.isInteger(v) ? 'integer' : 'number') : typeof v);
-const DATE_TIME = /^(\d{4})-(\d{2})-(\d{2})[Tt](\d{2}):(\d{2}):(\d{2})(\.\d+)?([Zz]|[+-](\d{2}):(\d{2}))$/;
+const DATE_TIME = /^([0-9]{4})-([0-9]{2})-([0-9]{2})[Tt]([0-9]{2}):([0-9]{2}):([0-9]{2})(\.[0-9]+)?([Zz]|[+-]([0-9]{2}):([0-9]{2}))$/;
+const MONTH_DAYS = [0, 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+const leap = (year) => year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
 
 function formatOk(format, value) {
   if (!isString(value)) return true;
@@ -125,8 +142,9 @@ function formatOk(format, value) {
     const m = DATE_TIME.exec(value);
     if (!m) return false;
     const [y, mo, d, h, mi, s] = m.slice(1, 7).map(Number);
-    const days = new Date(Date.UTC(y, mo, 0)).getUTCDate();
-    if (mo < 1 || mo > 12 || d < 1 || d > days || h > 23 || mi > 59 || s > 59) return false;
+    // The proleptic calendar the contract's ajv-formats checks: year 0000 exists and is a leap year (0000-02-29 holds).
+    // Counted here, not with Date.UTC, which reads years 0 to 99 as 1900 to 1999.
+    if (mo < 1 || mo > 12 || d < 1 || d > (mo === 2 && leap(y) ? 29 : MONTH_DAYS[mo]) || h > 23 || mi > 59 || s > 59) return false;
     return m[8] === 'Z' || m[8] === 'z' || (Number(m[9]) < 24 && Number(m[10]) < 60);
   }
   if (format === 'uri') return /^[A-Za-z][A-Za-z0-9+.-]*:\S*$/.test(value);
@@ -289,6 +307,50 @@ function mcpRoles(value) {
   return findings;
 }
 
+// --- the path rule (FAA-78, finding 40; decision D5) -------------------------------------------------------------------
+
+/** C0 and C1 controls, DEL, and the two Unicode line terminators JavaScript's `.` stops at. */
+const control = (code) => code < 0x20 || (code >= 0x7f && code <= 0x9f) || code === 0x2028 || code === 0x2029;
+
+/**
+ * Why `p` is no packaged path, or null. The schema's pattern says the same in one expression, but JavaScript's `.`
+ * stops at U+2028 and U+2029, so here and in the contract's own ajv its look-aheads never see a `..`, a backslash or a
+ * `//` after one (`a\u2028/../../etc/passwd` passes there). This rule reads the path character by character in both
+ * kits, and refuses C1 controls, DEL and the line terminators besides. A non-string is the schema's to refuse.
+ */
+export function pathProblem(p) {
+  if (!isString(p)) return null;
+  const chars = [...p];
+  if (chars.length < 1 || chars.length > 256) return 'a path is 1 to 256 characters';
+  if (chars.some((ch) => control(ch.codePointAt(0)))) return 'a path carries no control character and no line or paragraph separator';
+  if (p[0] === '/' || p[0] === '~') return 'a path is relative to the package folder: it never starts with / or ~';
+  if (p.includes('\\') || p.includes(':')) return 'a path is written with forward slashes and no colon';
+  if (p.includes('//') || p.endsWith('/')) return 'a path names a file: no empty segment and no trailing slash';
+  if (p.split('/').some((segment) => segment === '.' || segment === '..')) return 'a path never steps through . or ..';
+  return null;
+}
+
+/** Every member the schema types as a path, by its JSON pointer. */
+function pathFields(pkg) {
+  const fields = [['/provider', pkg.provider]];
+  if (isObject(pkg.evals)) fields.push(['/evals/suite', pkg.evals.suite]);
+  for (const name of ['state', 'dependencies', 'files']) {
+    (Array.isArray(pkg[name]) ? pkg[name] : []).forEach((entry, index) => { if (isObject(entry)) fields.push([`/${name}/${index}/path`, entry.path]); });
+  }
+  return fields.filter(([, value]) => value !== undefined);
+}
+
+/** The path rule over every path the package names: `{instancePath, message}` per path refused. */
+export function pathProblems(pkg) {
+  if (!isObject(pkg)) return [];
+  const out = [];
+  for (const [instancePath, value] of pathFields(pkg)) {
+    const message = pathProblem(value);
+    if (message !== null) out.push({ instancePath, message });
+  }
+  return out;
+}
+
 /** FAC-SEM-064 (whole), 065 (no secret), 066 (agentRef derived) and 102 (one role, one server), in that order. */
 export const packageFindings = (pkg) => [...whole(pkg), ...noSecret(pkg), ...agentRefRule(pkg), ...mcpRoles(pkg)];
 
@@ -297,7 +359,7 @@ export const packageFindings = (pkg) => [...whole(pkg), ...noSecret(pkg), ...age
 const parsed = (bytes) => {
   if (bytes === undefined) return undefined;
   try {
-    const value = JSON.parse(Buffer.from(bytes).toString('utf8'));
+    const value = JSON.parse(strictUtf8.decode(bytes)); // invalid UTF-8 is no manifest, in both kits
     return isObject(value) ? value : undefined;
   } catch {
     return undefined;
@@ -389,10 +451,37 @@ export function consumerPlacement(pkg, configured) {
 const litter = (name) => (JUNK.test(name) ? 'litter' : SECRET_FILE.test(name) && !SECRET_FILE_OK.test(name) ? 'a credential file' : null);
 const utf16Order = (a, b) => (a < b ? -1 : a > b ? 1 : 0); // JavaScript compares strings by UTF-16 code units
 
+/** Opening a packaged file: never through a link (where the platform can say so), never waiting on a pipe (finding 42). */
+const FILE_FLAGS = fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0) | (fs.constants.O_NONBLOCK ?? 0);
+/** What open() answers for a link it was told not to follow: ELOOP on Linux and macOS, EMLINK on FreeBSD. */
+const LINK_CODES = new Set(['ELOOP', 'EMLINK']);
+
+const unreadable = (where, error) => new PackageError(`Cannot read ${where || '.'}: ${error.code ?? error.message}.`);
+
+/** The file's bytes, or the reason it is not read: a link, or not a regular file. Throws the system's error. */
+function readRegular(file) {
+  let fd;
+  try {
+    fd = fs.openSync(file, FILE_FLAGS);
+  } catch (error) {
+    if (fs.constants.O_NOFOLLOW !== undefined && LINK_CODES.has(error.code)) return { why: 'a symlink' };
+    throw error;
+  }
+  try {
+    if (!fs.fstatSync(fd).isFile()) return { why: 'not a regular file' };
+    return { bytes: fs.readFileSync(fd) };
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
 /**
  * Every regular file under `folder` by its forward-slash path. Refuses a symlink, a special file, version-control or
- * cache litter, and a file that is a credential by its name — each named, so the person can remove it or pack a clean
- * copy.
+ * cache litter, and a file that is a credential by its name, each named, so the person can remove it or pack a clean
+ * copy. A file or folder it cannot read is a refusal naming it (`Cannot read <path>: EACCES.`), never a crash (FAA-78,
+ * finding 41); a file is opened without following a link and read only when it is a regular file (finding 42). Node
+ * has no openat, so a folder swapped for a link mid-walk is checked by lstat before and after it is listed; the Python
+ * twin holds each folder open instead.
  */
 export function readFolder(folder) {
   let stat;
@@ -401,12 +490,31 @@ export function readFolder(folder) {
   const files = new Map();
   const refused = [];
   const walk = (dir, rel) => {
-    for (const entry of fs.readdirSync(dir, { withFileTypes: true }).sort((a, b) => utf16Order(a.name, b.name))) {
+    let entries;
+    let before;
+    try {
+      before = rel ? fs.lstatSync(dir) : null;
+      entries = fs.readdirSync(dir, { withFileTypes: true }).sort((a, b) => utf16Order(a.name, b.name));
+    } catch (error) {
+      throw unreadable(rel, error);
+    }
+    if (before && !before.isDirectory()) { refused.push(`${rel} (a symlink)`); return; }
+    for (const entry of entries) {
       const where = rel ? `${rel}/${entry.name}` : entry.name;
-      const why = entry.isSymbolicLink() ? 'a symlink' : litter(entry.name) ?? (entry.isDirectory() || entry.isFile() ? null : 'not a regular file');
-      if (why) { refused.push(`${where} (${why})`); continue; }
-      if (entry.isDirectory()) walk(path.join(dir, entry.name), where);
-      else files.set(where, fs.readFileSync(path.join(dir, entry.name)));
+      let why = entry.isSymbolicLink() ? 'a symlink' : litter(entry.name) ?? (entry.isDirectory() || entry.isFile() ? null : 'not a regular file');
+      if (!why && entry.isDirectory()) { walk(path.join(dir, entry.name), where); continue; }
+      if (!why) {
+        let read;
+        try { read = readRegular(path.join(dir, entry.name)); } catch (error) { throw unreadable(where, error); }
+        if (read.why === undefined) { files.set(where, read.bytes); continue; }
+        why = read.why;
+      }
+      refused.push(`${where} (${why})`);
+    }
+    if (before) {
+      let after;
+      try { after = fs.lstatSync(dir); } catch (error) { throw unreadable(rel, error); }
+      if (!after.isDirectory() || after.ino !== before.ino || after.dev !== before.dev) refused.push(`${rel} (a symlink)`);
     }
   };
   walk(folder, '');
@@ -414,8 +522,15 @@ export function readFolder(folder) {
   return files;
 }
 
-/** JSON.parse that refuses a member named twice in one object, as the Python kit's reader does. */
-function parseStrict(text, what) {
+/**
+ * A JSON object from strict UTF-8 bytes (a string is taken as decoded already): no member named twice, nesting at most
+ * MAX_NESTING deep, as the Python kit's reader. Every refusal is a PackageError.
+ */
+function parseStrict(input, what) {
+  let text = input;
+  if (typeof input !== 'string') {
+    try { text = strictUtf8.decode(input); } catch (error) { throw new PackageError(`${what} is not JSON: ${error.message}`); }
+  }
   let value;
   try { value = JSON.parse(text); } catch (error) { throw new PackageError(`${what} is not JSON: ${error.message}`); }
   const stack = [];
@@ -423,6 +538,7 @@ function parseStrict(text, what) {
   const skipString = () => { i += 1; let s = ''; while (text[i] !== '"') { if (text[i] === '\\') { s += text.slice(i, i + 2); i += 2; } else { s += text[i]; i += 1; } } i += 1; return JSON.parse(`"${s}"`); };
   while (i < text.length) {
     const c = text[i];
+    if ((c === '{' || c === '[') && stack.length >= MAX_NESTING) throw new PackageError(`${what} nests deeper than ${MAX_NESTING} levels.`);
     if (c === '{') { stack.push({ keys: new Set(), expectKey: true }); i += 1; } else if (c === '[') { stack.push(null); i += 1; } else if (c === '}' || c === ']') { stack.pop(); i += 1; } else if (c === ',') { const top = stack.at(-1); if (top) top.expectKey = true; i += 1; } else if (c === '"') {
       const top = stack.at(-1);
       const s = skipString();
@@ -451,20 +567,28 @@ export function compose(draft, files) {
     throw new PackageError(`agentRef is derived, never chosen: it is ${agentRefOf(draft.publisher, draft.id)} for this publisher and id (FAC-SEM-066). Remove agentRef or fix publisher/id.`);
   }
   const pkg = {};
+  // A member is defined, never assigned: `pkg.__proto__ = v` would set the prototype and drop the member, where the
+  // Python twin keeps it for the schema to refuse (finding 43).
+  const put = (key, value) => Object.defineProperty(pkg, key, { value, enumerable: true, writable: true, configurable: true });
   for (const [key, value] of Object.entries(draft)) {
     if (key === 'files' || key === 'digest' || key === 'signatures' || (agent && key === 'agentRef')) continue;
-    pkg[key] = value;
-    if (agent && key === 'publisher') pkg.agentRef = agentRefOf(draft.publisher, draft.id);
+    put(key, value);
+    if (agent && key === 'publisher') put('agentRef', agentRefOf(draft.publisher, draft.id));
   }
   if (Array.isArray(draft.signatures) && draft.signatures.length) notes.push(`dropped ${draft.signatures.length} signature(s): a repacked package is signed again`);
   pkg.files = [...files.keys()].filter((p) => p !== PACKAGE_FILE).sort(utf16Order).map((p) => ({ path: p, sha256: sha256Of(files.get(p)) }));
-  pkg.digest = packageDigest(pkg);
+  try {
+    pkg.digest = packageDigest(pkg);
+  } catch (error) {
+    throw new PackageError(`fabric.package.json has no RFC 8785 form, so it has no digest: ${error.message}`);
+  }
   return { pkg, notes };
 }
 
 function allProblems(pkg, files) {
   return [
     ...schemaProblems(pkg).map((p) => ({ ...p, rule: 'schema' })),
+    ...pathProblems(pkg).map((p) => ({ ...p, rule: 'path' })),
     ...packageFindings(pkg).map((p) => ({ ...p, rule: p.code })),
     ...checkPackageFolder(pkg, files).map((p) => ({ rule: 'folder', problem: p.problem, instancePath: p.path, message: p.problem })),
   ];
@@ -483,7 +607,7 @@ export function pack(folder, { apply = false } = {}) {
   if (!files.has(PACKAGE_FILE)) {
     throw new PackageError(`Write ${PACKAGE_FILE} in the folder first: schema, kind, id, version, publisher, licence and, for an agent, resultSignal and evals with its receipt. pack fills in agentRef, files[] and digest.`);
   }
-  const draft = parseStrict(files.get(PACKAGE_FILE).toString('utf8'), PACKAGE_FILE);
+  const draft = parseStrict(files.get(PACKAGE_FILE), PACKAGE_FILE);
   const { pkg, notes } = compose(draft, files);
   const problems = allProblems(pkg, files);
   const suite = isObject(pkg.evals) ? pkg.evals.suite : undefined;
@@ -501,7 +625,7 @@ export function pack(folder, { apply = false } = {}) {
 function packed(folder) {
   const files = readFolder(folder);
   if (!files.has(PACKAGE_FILE)) throw new PackageError(`${folder} has no ${PACKAGE_FILE}: pack it first.`);
-  return { pkg: parseStrict(files.get(PACKAGE_FILE).toString('utf8'), PACKAGE_FILE), files };
+  return { pkg: parseStrict(files.get(PACKAGE_FILE), PACKAGE_FILE), files };
 }
 
 /**
@@ -565,7 +689,7 @@ export function main(argv, print = (line) => process.stdout.write(`${line}\n`))
       answer = sign(folder, flags.key, { role: flags.role ?? 'publisher', kid: flags.kid, apply: Boolean(flags.apply) });
     } else {
       let trustText;
-      try { trustText = fs.readFileSync(flags.trust, 'utf8'); } catch (error) { throw new PackageError(`Cannot read ${flags.trust}: ${error.code ?? error.message}.`); }
+      try { trustText = fs.readFileSync(flags.trust); } catch (error) { throw new PackageError(`Cannot read ${flags.trust}: ${error.code ?? error.message}.`); }
       answer = verify(folder, parseStrict(trustText, flags.trust), { countersigned: Boolean(flags.countersigned) });
     }
   } catch (error) {
@@ -577,4 +701,15 @@ export function main(argv, print = (line) => process.stdout.write(`${line}\n`))
   return answer.ok ? 0 : 1;
 }
 
-if (import.meta.url === pathToFileURL(process.argv[1] || '').href) process.exitCode = main(process.argv.slice(2));
+// Whether node was started on this file. Real paths, not URLs: the launcher installs the plugin under a symlinked
+// folder (~/.passioncode/current), and comparing import.meta.url (resolved) with argv[1] (the link) never ran main
+// (board thread b42e16b7).
+function startedDirectly() {
+  try {
+    return Boolean(process.argv[1]) && fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url));
+  } catch {
+    return false;
+  }
+}
+
+if (startedDirectly()) process.exitCode = main(process.argv.slice(2));

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-supervisors.mjs

@@ -67,7 +67,11 @@ function checkRun(result, what) {
   if (result?.status !== 0) throw new ServiceError(`${what} failed: ${String(result?.stderr || result?.stdout || result?.error?.message || '').trim().slice(0, 200)}`);
 }
 
-const systemdQuote = (value) => `"${plain(value, 'An argument').replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/%/g, '%%').replace(/\$/g, '$$$$')}"`;
+// ExecStart= expands $VAR, so its $ is doubled; Environment= expands none, so `dollar` false leaves it alone (finding 17).
+const systemdQuote = (value, dollar = true) => {
+  const escaped = plain(value, 'An argument').replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/%/g, '%%');
+  return `"${dollar ? escaped.replace(/\$/g, '$$$$') : escaped}"`;
+};
 
 /**
  * A systemd user unit (DEC-0032): Restart=always, RestartSec=10, TimeoutStopSec above the drain time,
@@ -87,10 +91,10 @@ export function systemdUnit(unit, programArguments, { workingDirectory, environm
   if (!cwd.startsWith('/')) throw new ServiceError("A systemd unit's working directory is absolute.");
   return [
     '[Unit]', `Description=${plain(description ?? unit, 'The description').replace(/%/g, '%%')}`, '',
-    '[Service]', 'Type=simple', `ExecStart=${argv.map(systemdQuote).join(' ')}`,
+    '[Service]', 'Type=simple', `ExecStart=${argv.map((a) => systemdQuote(a)).join(' ')}`,
     // Not quoted: systemd reads WorkingDirectory= as the rest of the line, quotes included.
     `WorkingDirectory=${cwd.replace(/%/g, '%%')}`,
-    ...Object.keys(env).sort().map((k) => `Environment=${systemdQuote(`${k}=${env[k]}`)}`),
+    ...Object.keys(env).sort().map((k) => `Environment=${systemdQuote(`${k}=${env[k]}`, false)}`),
     'Restart=always', 'RestartSec=10', `TimeoutStopSec=${Math.trunc(stopTimeout)}`, 'KillMode=mixed', '',
     '[Install]', 'WantedBy=default.target', '',
   ].join('\n');

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_auth.py

@@ -13,7 +13,7 @@ import secrets
 import stat
 import threading
 import time
-import urllib.request
+import urllib.parse
 from pathlib import Path
 from typing import Any, Callable, Dict, List, Optional, Tuple
 
@@ -51,7 +51,7 @@ OPERATOR_SESSION_IDLE_SECONDS = 12 * 60 * 60
 OPERATOR_SESSION_MAX_SECONDS = 7 * 24 * 60 * 60
 
 
-_CODE = re.compile(r"^[A-Za-z0-9_-]{16,256}$")
+_CODE = re.compile(r"^[A-Za-z0-9_-]{16,256}\Z")
 
 
 def ensure_token(path: Path) -> str:
@@ -330,18 +330,24 @@ def expired_session_cookie_header(remote: bool = False) -> str:
     return (remote_session_cookie_header if remote else session_cookie_header)("", 0)
 
 
+def _default_port_dropped(scheme: str, value: str) -> str:
+    """A host or an origin as a WHATWG URL writes it (finding 15): the scheme's default port (https 443, http 80) left out."""
+    default = {"https": ":443", "http": ":80"}.get(scheme.lower())
+    return value[:-len(default)] if default and value.endswith(default) else value
+
+
 def check_remote_request(origin: str, host: Optional[str], request_origin: Optional[str] = None,
                          sec_fetch_site: Optional[str] = None, forwarded_proto: Optional[str] = None) -> Optional[str]:
     """DEC-0019: the request guard of an online service; returns the refusal sentence or None.
     ``forwarded_proto`` is the platform-set scheme where TLS ends before the process; pass None
-    when the process terminates TLS itself."""
+    when the process terminates TLS itself. A default port, written or not, names the same host."""
     own = urllib.parse.urlsplit(origin)
-    own_host = own.netloc.lower()
-    if str(host or "").lower() != own_host:
+    own_host = _default_port_dropped(own.scheme, own.netloc.lower())
+    if _default_port_dropped(own.scheme, str(host or "").lower()) != own_host:
         return "Host %s is not this service." % host
     if forwarded_proto is not None and str(forwarded_proto).split(",")[0].strip() != "https":
         return "This service answers over https only."
-    if request_origin is not None and request_origin != "%s://%s" % (own.scheme, own_host):
+    if request_origin is not None and _default_port_dropped(own.scheme, str(request_origin)) != "%s://%s" % (own.scheme, own_host):
         return "Origin %s is not this service." % request_origin
     if sec_fetch_site == "cross-site":
         return "Cross-site requests are refused."

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_backups.py

@@ -46,22 +46,22 @@ _STALE_TEMP_SECONDS = 60 * 60
 _SAFE_INTEGER = 2 ** 53 - 1
 
 
-_TABLE = re.compile(r"^[a-z][a-z0-9_]{0,62}$")
+_TABLE = re.compile(r"^[a-z][a-z0-9_]{0,62}\Z")
 
 
-_SECRET_TABLE = re.compile(r"^((.+_)?(account_connections?|account_connection_drafts?|tokens?|secrets?|credentials?|passwords?|login_codes?)|(operator_)?sessions?)$")
+_SECRET_TABLE = re.compile(r"^((.+_)?(account_connections?|account_connection_drafts?|tokens?|secrets?|credentials?|passwords?|login_codes?)|(operator_)?sessions?)\Z")
 
 
-_COLUMN = re.compile(r"^[A-Za-z_][A-Za-z0-9_]{0,62}$")
+_COLUMN = re.compile(r"^[A-Za-z_][A-Za-z0-9_]{0,62}\Z")
 
 
-_SECRET_COLUMN = re.compile(r"^(?:.+_)?(?:[Tt]oken|[Ss]ecret|[Pp]assword|[Pp]assphrase|[Aa]pi_?[Kk]ey|[Pp]rivate_[Kk]ey|[Cc]ookie|[Ll]ogin_[Cc]ode|[Oo]tp|[Cc]redential)s?$")
+_SECRET_COLUMN = re.compile(r"^(?:.+_)?(?:[Tt]oken|[Ss]ecret|[Pp]assword|[Pp]assphrase|[Aa]pi_?[Kk]ey|[Pp]rivate_[Kk]ey|[Cc]ookie|[Ll]ogin_[Cc]ode|[Oo]tp|[Cc]redential)s?\Z")
 
 
-_REASON = re.compile(r"^[a-z][a-z0-9_.-]{0,63}$")
+_REASON = re.compile(r"^[a-z][a-z0-9_.-]{0,63}\Z")
 
 
-_SHA256 = re.compile(r"^[0-9a-f]{64}$")
+_SHA256 = re.compile(r"^[0-9a-f]{64}\Z")
 
 
 _SURROGATE = re.compile("[\ud800-\udfff]")

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_base.py

@@ -5,7 +5,9 @@ from __future__ import annotations
 import datetime as _dt
 import os
 import re
+import threading
 from pathlib import Path
+from typing import Dict
 
 
 PROTOCOL = "fabric-service/0.1"
@@ -26,10 +28,10 @@ SUPERVISOR_ENV = "FABRIC_SERVICE_SUPERVISOR"
 DRAIN_SECONDS = 8.0
 
 
-_ID = re.compile(r"^[a-z][a-z0-9-]{1,62}$")
+_ID = re.compile(r"^[a-z][a-z0-9-]{1,62}\Z")
 
 
-_INSTANCE = re.compile(r"^[a-z][a-z0-9-]{0,31}$")
+_INSTANCE = re.compile(r"^[a-z][a-z0-9-]{0,31}\Z")
 
 
 # DEC-0032: a local path is POSIX (`/…`, `~/…`) or Windows (`C:\…`, `C:/…`, `~\…`); a network
@@ -38,10 +40,10 @@ _INSTANCE = re.compile(r"^[a-z][a-z0-9-]{0,31}$")
 _LOCAL_PATH = re.compile(r"^(~[\\/]|/(?![\\/])|[A-Za-z]:[\\/])")
 
 
-_UNIT = re.compile(r"^[A-Za-z0-9][A-Za-z0-9:_.@-]{0,250}\.service$")
+_UNIT = re.compile(r"^[A-Za-z0-9][A-Za-z0-9:_.@-]{0,250}\.service\Z")
 
 
-_TASK = re.compile(r"^\\[A-Za-z0-9 ._\\-]{1,254}$")
+_TASK = re.compile(r"^\\[A-Za-z0-9 ._\\-]{1,254}\Z")
 
 
 WINDOWS = os.name == "nt"
@@ -70,6 +72,17 @@ def expand(path: str) -> Path:
     return p
 
 
+_STORE_LOCKS: Dict[str, threading.RLock] = {}
+_STORE_LOCKS_GUARD = threading.Lock()
+
+
+def store_lock(path: Path) -> threading.RLock:
+    """One lock per store path in this process (R3): a ThreadingHTTPServer runs a store's load-modify-save callers side
+    by side (the job store, the event log), and two store instances on one path share it."""
+    with _STORE_LOCKS_GUARD:
+        return _STORE_LOCKS.setdefault(str(Path(path).resolve()), threading.RLock())
+
+
 def _require_id(service_id: str) -> None:
     if not (isinstance(service_id, str) and _ID.fullmatch(service_id)):
         raise ServiceError("Service id %r must match %s." % (service_id, _ID.pattern))