@passioncode-ai/fabric-agent-adapter 0.43.0 → 0.44.0

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # Changelog
 
+## 0.44.0 (2026-10-22)
+
+### Added
+
+- **What an agent uses, `fabric-connections/0.1`** (FAA-62, contract DEC-0096, FAC-SEM-127; asked by Fabric Dashboards
+  on board thread `131648c0`). A new kit module in both twins, `fabric_connections` / `fabric-connections.mjs`:
+  `connections_extension(declared, degraded, states)` / `connectionsExtension(declared, {degraded, states})` builds
+  the `extensions` entry, each connection's `state` from the service's own checks, else `degraded` when `degraded[]`
+  names it, else `unknown`, and refuses a declaration a host would hide (the schema, an id twice, a credential).
+  `connections_view` / `connectionsView` read a peer's list as the contract's reference does; both answer all 127
+  cases of the contract's `fixtures/vectors/connections.json`, vendored by `make_connections_vectors.mjs`.
+  `build_well_known` / `buildWellKnown` refuse an invalid declaration passed in by hand, `check_service.py` reports
+  `well-known.connections`, and the `fabric_service` facades re-export the four names. The Python twin reads
+  credentials with the reference's ECMAScript semantics (ASCII case folding and word boundary, ECMAScript's whitespace,
+  a URL WHATWG refuses read as text only, its query and fragment read as WHATWG serializes them, a name's leading
+  `?` dropped as `URLSearchParams` drops it, an unpaired surrogate read as U+FFFD); 1,073 more inputs, answered by the
+  contract's reader into `connections-extra-vectors.json`, hold both twins to it. Inputs whose answer changes with the
+  Node release (the reference parses URLs with the runtime's own `new URL`) are left out of that set. Where Python cannot tell whether WHATWG refuses a URL (a
+  non-ASCII host), it reads the URL's credentials anyway, so a doubt hides a declaration rather than publish one
+  (FAA-98 ports UTS46 to close that gap).
+
+### Changed
+
+- **`check_dashboard_layout.mjs` exits 3 when no rule was measured** (FAA-96): every rule `NOT_RUN` (no Playwright, a
+  browser that does not start, a service it cannot open) or no rule at all. It exited 0, and 2 for an empty report
+  since 0.42.1. 0 still needs at least one rule measured and none failing.
+
+### Fixed
+
+- **The session worker waits for an exit status to its deadline after a closed pipe** (FAA-97): a `fabric-mcp` that
+  closed its stdin and exited 3 more than a second later was logged as `outcome=unknown` and its spool kept.
+- **OpenClaw `--remove` drops our load path when its folder is gone** (FAA-90): the ownership check read a manifest
+  that no longer existed, so the dead path stayed.
+
 ## 0.43.0 (2026-10-22)
 
 ### Changed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/fabric-agent-adapter",
-  "version": "0.43.0",
+  "version": "0.44.0",
   "description": "Create Fabric-compatible agents, run them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract. This package is the installer CLI.",
   "scripts": {
     "test": "python3 test/validate.py && python3 -m unittest discover -s test -q && node --test 'test/*.test.mjs'"

package/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks.",
-  "version": "0.43.0",
+  "version": "0.44.0",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.43.0"
+  version: "0.44.0"
   contract-version: "0.1.0"
   contract-commit: "bfa9a67aa3c6cb808c093e7d83cd59799f1ee7d0"
 ---

package/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -14,7 +14,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits (Node.js 22+ for a Linux service's instance lock); the probe needs Python 3.9+. launchd steps are macOS-only; Linux services install a systemd user unit and Windows ones a per-user Scheduled Task with the kits' writers. Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.43.0"
+  version: "0.44.0"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
   extension-commit: "bfa9a67aa3c6cb808c093e7d83cd59799f1ee7d0"
@@ -248,6 +248,11 @@ and declare it with `extensions=fs.dashboard_extension()`. Read
 declaration and how to upgrade a dashboard built before the kit: an upgrade you may make yourself,
 which the plugin's session-start notice offers in a repository that owns the service.
 
+**Say what the agent uses** (`fabric-connections/0.1`, DEC-0096) so Fabric Dashboards draws its chain: the other
+agents, models, connectors, stores and channels, each with its state, from
+`connections_extension()` / `connectionsExtension()` in `fabric_connections`. Never a credential in it, never a call
+count (that is the usage report); the details are in [the wire reference](references/protocol.md).
+
 The events feed is a **view over the log you already keep** (a jobs table, a JSONL
 journal), not a second store. Each event is one sentence a person reads; set
 `notify: true` only when the operator must decide, or something failed or degrades their
@@ -284,7 +289,7 @@ propagation, event trace pairs, and `board.responder` for a service that declare
 any `FAIL`. A `NOT_RUN` is not a pass;
 name it in the report. A service with a dashboard also runs the layout probe,
 `node <skill-dir>/scripts/check_dashboard_layout.mjs --service <id>` (WebKit at 360, 480, 768
-and 1280 px; needs Playwright, else `NOT_RUN`).
+and 1280 px; needs Playwright, else `NOT_RUN` and exit 3: nothing was measured).
 
 Then prove the lock: start a second copy by hand against the same data directory; it
 must exit 75 while the first keeps serving. Prove recovery: `kill -9` the launchd pid;

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/dashboard-kit.md

@@ -137,7 +137,8 @@ the floor minus 40 and at 360, 480, 768 and 1280 px, and reports ED-1…ED-5 per
 Playwright where it runs (`npm i -D playwright && npx playwright install webkit`, or `--playwright
 <dir>`); without it every rule is `NOT_RUN`, and the probe asks for no login code. ED-3 also fails a link clipped
 vertically by the viewport or a clipping ancestor; ED-4 is `NOT_RUN` on a page past its 6000-element cap. It does not measure edge shades or that a refresh keeps
-the scroll position: say so in the report. A `NOT_RUN` is not a pass.
+the scroll position: say so in the report. A `NOT_RUN` is not a pass. Exit codes: 0 when no rule fails and at least
+one passed, 1 on a `FAIL`, 2 on a usage error, 3 when no rule was measured (every rule `NOT_RUN`, since 0.44.0).
 
 ## Upgrading an existing dashboard
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/kit-modules.md

@@ -63,6 +63,7 @@ A module imports only modules listed before it in `kit.json`, so the kit has no
 | L3 | `fabric_platform` | Windows: named pipes, owner-only files (DEC-0032) |
 | L3 | `fabric_paths` | the services directory, a service's folders, atomic and private writes |
 | L3 | `fabric_protocols` | protocol revisions (DEC-0067) and feed data (DEC-0070) |
+| L3 | `fabric_connections` | what an agent uses, `fabric-connections/0.1`: the reference reading and the declaration (DEC-0096, FAC-SEM-127) |
 | L3 | `fabric_lock` | the instance lock and the supervisor marker (LC-01, DEC-0057) |
 | L3 | `fabric_usage` | usage receipts, the ledger, the usage report, attribution, spending limits ([usage](usage.md)) |
 | L3 | `fabric_backups` | settings backups (DEC-0025) |

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/protocol.md

@@ -93,6 +93,26 @@ No auth; the Host/Origin guard applies; answered from memory in under 100 ms.
   ED-9): `minWidth` 360…1280 (required), `appearance` ⊆ `scheme`, `theme`, `themes`, `kit`
   (`name@semver`), nothing else. The kits build it with `dashboard_extension()` /
   `dashboardExtension()`; see [the dashboard kit reference](dashboard-kit.md).
+- `extensions` MAY say what the service uses under
+  `https://fabric.passioncode.ai/agent-contract/extensions/connections/0.1` (`fabric-connections/0.1`, DEC-0096):
+  `{connections: [...]}`, at most 64, each `{id, kind, target, state}` with `kind` one of `service`, `model`,
+  `connector`, `store`, `channel`, `state` one of `ok`, `degraded`, `down`, `unknown`, and optionally `capability`
+  (a `service` only), `label`, `purpose`, `reason`, `lastAt`. No member carries a credential, and each `id` is named
+  once: a host hides a list that breaks either rule (FAC-SEM-127). A `degraded[].source` equal to an `id` is that
+  connection failing. The kits build it with `connections_extension(declared, degraded, states)` /
+  `connectionsExtension(declared, {degraded, states})`: `state` comes from the service's own checks (`states`, by
+  `id`), else `degraded` when `degraded[]` names it, else `unknown`; a declaration a host would hide is refused with
+  `ServiceError`, and `build_well_known` refuses one passed in by hand. `connections_view` / `connectionsView` read
+  a peer's list as Fabric Dashboards does, and `check_service.py` reports `well-known.connections`. Build it each
+  time the well-known document is built, from the same `degraded` list:
+
+  ```python
+  ext = fs.dashboard_extension()
+  ext.update(connections_extension(
+      [{"id": "router", "kind": "model", "target": "openai/gpt-5.1", "purpose": "drafts replies"},
+       {"id": "notify", "kind": "service", "target": "communicator.default", "capability": "communicator.notify"}],
+      degraded=degraded, states={"router": "ok" if model_answered else "down"}))
+  ```
 - `surfaces.mcp.auth`: `descriptor` (default), `own` (DEC-0024) or `delegation` (DEC-0039, DL-16):
   the MCP surface takes only the estate's delegation tokens, and the top-level
   `auth.delegation {issuer, jwks}` is then required. With `own` or `delegation` the descriptor's

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_dashboard_layout.mjs

@@ -13,7 +13,8 @@
 // scroll box) and ED-5 (sticky chrome within min(120 px, a quarter of the height), anchors landing
 // below it, no nested full-height scroller). What it cannot measure is NOT_RUN with the reason,
 // never a pass. WebKit is the default engine (Safari's). Exit 0 when nothing FAILs, 1 when
-// something does, 2 on a usage error or a report with no rule in it. It reads; it never clicks a control of the page.
+// something does, 2 on a usage error, 3 when no rule was measured (every rule NOT_RUN). It reads; it never clicks a
+// control of the page.
 import { readFileSync, existsSync, realpathSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { homedir, platform } from 'node:os';
@@ -261,11 +262,13 @@ export function report(rows, opts, target) {
     for (const r of rows) process.stdout.write(`${r.verdict.padEnd(8)} ${(r.rule + (r.width ? '@' + r.width : '')).padEnd(10)} ${r.evidence}\n`);
     process.stdout.write(`\n${rows.length} rule(s), ${failed} FAIL, ${rows.filter((r) => r.verdict === 'NOT_RUN').length} NOT_RUN\n`);
   }
-  if (!rows.length) {
-    process.stderr.write('no rule ran: nothing was measured, so nothing passed\n');
-    return 2;
+  if (failed) return 1;
+  // Nothing measured is never a pass (FAA-96): no rule, or every rule NOT_RUN, exits 3.
+  if (!rows.some((r) => r.verdict === 'PASS')) {
+    process.stderr.write('no rule was measured, so nothing passed\n');
+    return 3;
   }
-  return failed ? 1 : 0;
+  return 0;
 }
 
 async function main(argv) {

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_service.py

@@ -52,6 +52,7 @@ from typing import Any, Dict, List, Optional, Tuple
 
 sys.path.insert(0, str(Path(__file__).resolve().parent))
 import fabric_service as fs  # noqa: E402
+import fabric_connections as fcn  # noqa: E402
 import fabric_interop as fi  # noqa: E402
 
 Result = Dict[str, str]
@@ -238,6 +239,14 @@ class Probe:
             findings = fs.protocols_findings(wk["protocols"])
             self.add("well-known.protocols", "FAIL" if findings else "PASS",
                      "; ".join("%s %s" % (f["instancePath"], f["message"]) for f in findings) or ", ".join(wk["protocols"]))
+        extensions = wk.get("extensions") if isinstance(wk.get("extensions"), dict) else {}
+        if fcn.CONNECTIONS_EXTENSION_KEY in extensions:
+            # DEC-0096, FAC-SEM-127: what it uses, valid, each id once, no credential; a host hides an invalid list.
+            view = fcn.connections_view(wk)
+            failing = sum(1 for c in view["connections"] if c["failing"])
+            self.add("well-known.connections", "FAIL" if view["reported"] else "PASS",
+                     "; ".join(f["message"] for f in fcn.connections_rules(wk)[:5]) or
+                     "%d connection(s), %d named in degraded[]" % (len(view["connections"]), failing))
         self.configuration_rule()
         svc = wk.get("service") or {}
         answered = "%s.%s" % (svc.get("id"), svc.get("instance"))

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-connections.mjs

@@ -0,0 +1,186 @@
+// What an agent uses: fabric-connections/0.1, the extension keyed extensions/connections/0.1 (DEC-0096, FAC-SEM-127).
+// connectionsView reads a well-known document as the contract's connectionsView does (it never throws);
+// connectionsExtension builds the `extensions` entry a service declares, `state` from its own checks and its degraded[].
+// Part of the Node service kit (FAA-62, layer L3); the twin of fabric_connections.py. Node 20+, no dependency.
+import { ServiceError } from './fabric-base.mjs';
+import { BEARER_INSIDE, JWT_SHAPE, longSecret, secretUrl } from './fabric-secrets.mjs';
+import { isObject } from './fabric-jsvalue.mjs';
+
+export const CONNECTIONS_EXTENSION_KEY = 'https://fabric.passioncode.ai/agent-contract/extensions/connections/0.1';
+export const KINDS = Object.freeze(['service', 'model', 'connector', 'store', 'channel']);
+export const STATES = Object.freeze(['ok', 'degraded', 'down', 'unknown']);
+export const MAX_CONNECTIONS = 64;
+const MEMBERS = ['id', 'kind', 'target', 'capability', 'state', 'label', 'purpose', 'reason', 'lastAt'];
+const STRING_MEMBERS = ['id', 'target', 'capability', 'label', 'purpose', 'reason'];
+
+const ID = /^[a-z0-9][a-z0-9._-]{0,63}$/u;
+const TARGET = /^[^\s]+$/u;
+const SERVICE_TARGET = /^[a-z0-9][a-z0-9-]{0,63}(\.[a-z0-9][a-z0-9-]{0,63})?$/u;
+const CAPABILITY = /^[a-z][a-z0-9._-]{1,127}$/u;
+const LINE = /^[^\n\r]+$/u;
+
+// ajv-formats `date-time` in its full mode (the contract's validator): a date, `t` or a space, a time with a zone.
+const DATE = /^(\d\d\d\d)-(\d\d)-(\d\d)$/;
+const TIME = /^(\d\d):(\d\d):(\d\d(?:\.\d+)?)(z|([+-])(\d\d)(?::?(\d\d))?)?$/i;
+const DAYS = [0, 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+function fullDate(value) {
+  const m = DATE.exec(value);
+  if (!m) return false;
+  const [year, month, day] = [+m[1], +m[2], +m[3]];
+  const leap = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+  return month >= 1 && month <= 12 && day >= 1 && day <= (month === 2 && leap ? 29 : DAYS[month]);
+}
+function fullTime(value) {
+  const m = TIME.exec(value);
+  if (!m) return false;
+  const [hour, minute, second] = [+m[1], +m[2], +m[3]];
+  const sign = m[5] === '-' ? -1 : 1;
+  const [zoneH, zoneM] = [+(m[6] || 0), +(m[7] || 0)];
+  if (zoneH > 23 || zoneM > 59 || !m[4]) return false;
+  if (hour <= 23 && minute <= 59 && second < 60) return true;
+  const utcMin = minute - zoneM * sign; // a leap second, at 23:59 UTC only
+  const utcHour = hour - zoneH * sign - (utcMin < 0 ? 1 : 0);
+  return (utcHour === 23 || utcHour === -1) && (utcMin === 59 || utcMin === -1) && second < 61;
+}
+/** The `date-time` format as the contract's validator (ajv-formats, full mode) reads it. */
+export function dateTime(value) {
+  const parts = value.split(/t|\s/i);
+  return parts.length === 2 && fullDate(parts[0]) && fullTime(parts[1]);
+}
+
+const length = (value) => [...value].length; // code points, as ajv counts them
+
+/** service-connections-extension.schema.json, read as the contract's validator reads it. */
+function shapeProblems(value) {
+  if (!isObject(value)) return ['/ type: must be object'];
+  // A member's name is never echoed: a secret-shaped name would reach the error text and a probe's evidence.
+  const problems = Object.keys(value).filter((key) => key !== 'connections').map(() => '/ additionalProperties: a member other than connections');
+  if (!Object.hasOwn(value, 'connections')) return [...problems, '/ required: connections'];
+  const connections = value.connections;
+  if (!Array.isArray(connections)) return [...problems, '/connections type: must be array'];
+  if (connections.length > MAX_CONNECTIONS) problems.push(`/connections maxItems: at most ${MAX_CONNECTIONS}`);
+  connections.forEach((item, index) => {
+    const at = `/connections/${index}`;
+    if (!isObject(item)) { problems.push(`${at} type: must be object`); return; }
+    for (const key of ['id', 'kind', 'target', 'state']) if (!Object.hasOwn(item, key)) problems.push(`${at} required: ${key}`);
+    for (const key of Object.keys(item)) if (!MEMBERS.includes(key)) problems.push(`${at} additionalProperties: a member the schema does not name`);
+    for (const key of [...STRING_MEMBERS, 'lastAt']) if (Object.hasOwn(item, key) && typeof item[key] !== 'string') problems.push(`${at}/${key} type: must be string`);
+    const text = (key) => (Object.hasOwn(item, key) && typeof item[key] === 'string' ? item[key] : undefined);
+    if (text('id') !== undefined && !ID.test(text('id'))) problems.push(`${at}/id pattern`);
+    if (Object.hasOwn(item, 'kind') && !KINDS.includes(item.kind)) problems.push(`${at}/kind enum`);
+    if (Object.hasOwn(item, 'state') && !STATES.includes(item.state)) problems.push(`${at}/state enum`);
+    const target = text('target');
+    if (target !== undefined && !(length(target) >= 1 && length(target) <= 200 && TARGET.test(target))) problems.push(`${at}/target length or pattern`);
+    if (text('capability') !== undefined && !CAPABILITY.test(text('capability'))) problems.push(`${at}/capability pattern`);
+    for (const key of ['label', 'purpose', 'reason']) {
+      const line = text(key);
+      if (line !== undefined && !(length(line) >= 1 && length(line) <= 300 && LINE.test(line))) problems.push(`${at}/${key} length or pattern`);
+    }
+    if (text('lastAt') !== undefined && !dateTime(text('lastAt'))) problems.push(`${at}/lastAt format: date-time`);
+    if (Object.hasOwn(item, 'kind')) {
+      if (item.kind !== 'service' && Object.hasOwn(item, 'capability')) problems.push(`${at}/capability: only a service connection names a capability`);
+      if (item.kind === 'service' && target !== undefined && !SERVICE_TARGET.test(target)) problems.push(`${at}/target pattern: a service target is an id.instance key or a product id`);
+    }
+  });
+  return problems;
+}
+
+// The contract's KEY_SHAPE (src/connections.ts): a provider key where it starts a word, case-sensitive prefixes, the
+// `sk-` rules and a Telegram bot token.
+const KEY_SHAPE = /(?:^|[^A-Za-z0-9])(?:sk-(?=[A-Za-z0-9_-]*\d)(?:(?=[A-Za-z0-9_-]*[A-Z])[A-Za-z0-9_-]{16,}|[A-Za-z0-9_-]{32,})|gh[pousr]_[A-Za-z0-9]{20,}|xox[abposr]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|glpat-[A-Za-z0-9_-]{20,}|(?:bot)?\d{6,12}:(?=[A-Za-z0-9_-]*[A-Z])(?=[A-Za-z0-9_-]*[a-z])[A-Za-z0-9_-]{34,35}(?![A-Za-z0-9_-]))/;
+const SCHEME = /[a-z][a-z0-9+.-]*:\/\//gi;
+const CLOSING = /[)\]}>"'.,;:!?]/;
+const TRIED_BACK = 1;
+/** The URLs a member may hold, from every scheme in each whitespace-delimited piece, without the closing brackets,
+ * quotes and punctuation that end a sentence, and with TRIED_BACK of them put back (`]` closes an IPv6 host). */
+function urlsIn(value) {
+  const urls = [];
+  for (const piece of value.split(/\s+/)) {
+    for (const match of piece.matchAll(SCHEME)) {
+      const url = piece.slice(match.index);
+      let end = url.length;
+      while (end > 0 && CLOSING.test(url[end - 1])) end -= 1;
+      for (let back = 0; back <= TRIED_BACK && end + back <= url.length; back += 1) urls.push(url.slice(0, end + back));
+    }
+  }
+  return urls;
+}
+/** A long secret-shaped run in a piece read whole; in a piece that holds a URL, the text before its first scheme's `://`. */
+const longRun = (value) =>
+  value.split(/\s+/).some((piece) => {
+    const at = piece.search(SCHEME);
+    const cut = at < 0 ? -1 : piece.indexOf('://', at);
+    return longSecret(cut < 0 ? piece : piece.slice(0, cut));
+  });
+const credential = (value, runs) =>
+  JWT_SHAPE.test(value) || KEY_SHAPE.test(value) || BEARER_INSIDE.test(value) || (runs && longRun(value)) || urlsIn(value).some(secretUrl);
+
+/** What the schema cannot state: an id named twice, a credential in any string member. */
+function beyondShape(list) {
+  const errors = [];
+  const seen = new Set();
+  list.forEach((connection, index) => {
+    if (seen.has(connection.id)) errors.push(`/connections/${index}/id duplicate: it is named twice`);
+    seen.add(connection.id);
+    for (const member of STRING_MEMBERS) {
+      const value = connection[member];
+      const runs = member !== 'id' && member !== 'capability' && !(member === 'target' && connection.kind === 'model');
+      if (typeof value === 'string' && credential(value, runs)) errors.push(`/connections/${index}/${member} credential: a connection never carries a credential`);
+    }
+  });
+  return errors;
+}
+
+const none = () => ({ declared: false, reported: false, connections: [], errors: [] });
+
+/** A host's reading of a well-known document's connections (the contract's connectionsView): never throws. */
+export function connectionsView(wellKnown) {
+  const extensions = isObject(wellKnown) && isObject(wellKnown.extensions) ? wellKnown.extensions : undefined;
+  if (extensions === undefined || !Object.hasOwn(extensions, CONNECTIONS_EXTENSION_KEY)) return none();
+  const value = extensions[CONNECTIONS_EXTENSION_KEY];
+  let errors = shapeProblems(value);
+  if (!errors.length) errors = beyondShape(value.connections);
+  if (errors.length) return { ...none(), reported: true, errors };
+  const degraded = Array.isArray(wellKnown.degraded) ? wellKnown.degraded : [];
+  const failing = new Set(degraded.filter(isObject).map((entry) => entry.source).filter((source) => typeof source === 'string'));
+  return { declared: true, reported: false, connections: value.connections.map((c) => ({ ...c, failing: failing.has(c.id) })), errors: [] };
+}
+
+const pointerToken = (token) => token.replace(/~/g, '~0').replace(/\//g, '~1');
+
+/** FAC-SEM-127: the connections a well-known document declares are valid, each id once, no credential. */
+export function connectionsRules(wellKnown) {
+  const view = connectionsView(wellKnown);
+  const at = `/extensions/${pointerToken(CONNECTIONS_EXTENSION_KEY)}`;
+  return view.errors.map((error) => ({ code: 'FAC-SEM-127', instancePath: at, message: `the connections declaration is invalid (${error}); a host treats it as not declared and reports it (DEC-0096)` }));
+}
+
+/**
+ * The `extensions` entry a service declares (DEC-0096): what it uses, each connection's `state` from the service's
+ * own checks (`states`, by id), else `degraded` when a degraded[].source names it, else `unknown`; a declared `state`
+ * is kept. Throws ServiceError on a declaration a host would hide: a service never publishes one that reads as
+ * "declared nothing".
+ */
+export function connectionsExtension(declared, options = {}) {
+  const { degraded: givenDegraded, states: givenStates } = options ?? {};
+  const degraded = givenDegraded ?? [];
+  const states = givenStates ?? {};
+  if (!Array.isArray(declared) || !Array.isArray(degraded) || !isObject(states)) {
+    throw new ServiceError('Connections declaration: declared and degraded are lists, states an object by id.');
+  }
+  const failing = new Set(degraded.filter(isObject).map((entry) => entry.source).filter((source) => typeof source === 'string'));
+  const connections = declared.map((item) => {
+    if (!isObject(item)) return item; // the shape check names it and the declaration is refused
+    const connection = { ...item };
+    if (!Object.hasOwn(connection, 'state')) {
+      const id = typeof connection.id === 'string' ? connection.id : undefined;
+      // An invalid check value is refused by the shape check, never read as a missing one.
+      connection.state = id !== undefined && Object.hasOwn(states, id) ? states[id] : (failing.has(id) ? 'degraded' : 'unknown');
+    }
+    return connection;
+  });
+  const value = { connections };
+  const view = connectionsView({ extensions: { [CONNECTIONS_EXTENSION_KEY]: value } });
+  if (view.reported) throw new ServiceError(`Connections declaration: ${view.errors.join('; ')}.`);
+  return { [CONNECTIONS_EXTENSION_KEY]: value };
+}

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-descriptor.mjs

@@ -6,6 +6,7 @@ import { credentialName, secretArgument, secretUrl, secretValue } from './fabric
 import { ID, INSTANCE, LOCAL_PATH, PROTOCOL, ServiceError, TASK, UNIT, expand } from './fabric-base.mjs';
 import { atomicWrite, ensurePrivateDir, servicesDir } from './fabric-paths.mjs';
 import { protocolsFindings } from './fabric-protocols.mjs';
+import { CONNECTIONS_EXTENSION_KEY, connectionsView } from './fabric-connections.mjs';
 import { ROUTES } from './fabric-usage.mjs';
 
 // The embedded dashboard declaration (fabric-dashboard/0.1, DEC-0036 ED-9), under the well-known
@@ -369,6 +370,11 @@ export function buildWellKnown({ id, instance, name, version, build, startedAt,
       const problems = dashboardExtensionProblems(extensions[DASHBOARD_EXTENSION_KEY]);
       if (problems.length) throw new ServiceError(`Dashboard declaration: ${problems.join('; ')}.`);
     }
+    if (Object.hasOwn(extensions, CONNECTIONS_EXTENSION_KEY)) {
+      // DEC-0096: a host hides an invalid declaration (FAC-SEM-127); a service never publishes one.
+      const view = connectionsView({ extensions: { [CONNECTIONS_EXTENSION_KEY]: extensions[CONNECTIONS_EXTENSION_KEY] } });
+      if (view.reported) throw new ServiceError(`Connections declaration: ${view.errors.join('; ')}.`);
+    }
     doc.extensions = { ...extensions };
   }
   if (configuration !== undefined) {

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-secrets.mjs

@@ -41,12 +41,12 @@ export const JWT_SHAPE = /eyJ[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]
 /** A value that says it is a credential, or a provider key's shape. */
 export const SECRET_VALUE = /(^bearer\s.+|sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|xox[abposr]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|glpat-[A-Za-z0-9_-]{20,})/i;
 const LONG_RUN = /[A-Za-z0-9+/=_-]{40,}/g;
-const longSecret = (value) => (value.match(LONG_RUN) ?? []).some((run) => /[a-z]/.test(run) && /[A-Z]/.test(run) && /[0-9]/.test(run));
+export const longSecret = (value) => (value.match(LONG_RUN) ?? []).some((run) => /[a-z]/.test(run) && /[A-Z]/.test(run) && /[0-9]/.test(run));
 
 /** Whether a value could be a credential: a JWT anywhere, a provider key or `Bearer …`, or a long secret-shaped run. */
 export const secretValue = (value) => JWT_SHAPE.test(value) || SECRET_VALUE.test(value) || longSecret(value);
 
-const BEARER_INSIDE = /\bbearer\s+(?=[A-Za-z0-9._~+/-]*\d)[A-Za-z0-9._~+/-]{12,}=*/i;
+export const BEARER_INSIDE = /\bbearer\s+(?=[A-Za-z0-9._~+/-]*\d)[A-Za-z0-9._~+/-]{12,}=*/i;
 const PATH_LIKE = /^(?:[/~.]|[A-Za-z]:[\\/]|[a-z][a-z0-9+.-]*:\/\/)/i;
 const pathLike = (piece) =>
   PATH_LIKE.test(piece) ||

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-service.mjs

@@ -40,6 +40,7 @@ export {
   feedDataFindings,
   feedDataProblems,
 } from './fabric-protocols.mjs';
+export { CONNECTIONS_EXTENSION_KEY, connectionsExtension, connectionsRules, connectionsView } from './fabric-connections.mjs';
 export {
   EXIT_ALREADY_RUNNING,
   LOCK_WAIT_SUPERVISED_SECONDS,

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_connections.py

@@ -0,0 +1,448 @@
+"""What an agent uses: `fabric-connections/0.1`, the extension keyed extensions/connections/0.1 (DEC-0096, FAC-SEM-127).
+`connections_view` reads a well-known document as the contract's `connectionsView` does (it never raises);
+`connections_extension` builds the `extensions` entry a service declares, `state` from its own checks and its
+`degraded[]`. Part of the service kit (FAA-62, layer L3). Standard library only."""
+from __future__ import annotations
+
+import ipaddress
+import re
+import urllib.parse
+from typing import Any, Dict, Iterable, List, Mapping, Optional, Sequence
+
+import sys as _sys  # noqa: E402
+from pathlib import Path as _Path  # noqa: E402
+if str(_Path(__file__).resolve().parent) not in _sys.path:  # the kit loads from any working directory (FAA-65)
+    _sys.path.insert(0, str(_Path(__file__).resolve().parent))
+
+from fabric_base import ServiceError  # noqa: E402
+from fabric_secrets import CREDENTIAL_PAIRS, CREDENTIAL_WORDS, JWT_SHAPE, _long_secret, raw_values  # noqa: E402
+
+CONNECTIONS_EXTENSION_KEY = "https://fabric.passioncode.ai/agent-contract/extensions/connections/0.1"
+KINDS = ("service", "model", "connector", "store", "channel")
+STATES = ("ok", "degraded", "down", "unknown")
+MAX_CONNECTIONS = 64
+_MEMBERS = ("id", "kind", "target", "capability", "state", "label", "purpose", "reason", "lastAt")
+_STRING_MEMBERS = ("id", "target", "capability", "label", "purpose", "reason")
+
+# ECMAScript's \s, which the schema's patterns and the contract's splits use: Python's \s differs (it takes \x1c-\x1f
+# and \x85, and leaves U+FEFF out).
+_JS_SPACE = "\t\n\x0b\x0c\r    - 

  　"
+_SPACES = re.compile("[%s]+" % _JS_SPACE)
+_ID = re.compile(r"[a-z0-9][a-z0-9._-]{0,63}")
+_TARGET = re.compile("[^%s]+" % _JS_SPACE)
+_SERVICE_TARGET = re.compile(r"[a-z0-9][a-z0-9-]{0,63}(?:\.[a-z0-9][a-z0-9-]{0,63})?")
+_CAPABILITY = re.compile(r"[a-z][a-z0-9._-]{1,127}")
+_LINE = re.compile("[^\n\r]+")
+
+# ajv-formats `date-time` in its full mode (the contract's validator): a date, `t` or a space, a time with a zone.
+_DT_SEPARATOR = re.compile("[tT%s]" % _JS_SPACE)
+_DATE = re.compile(r"([0-9]{4})-([0-9]{2})-([0-9]{2})")
+_TIME = re.compile(r"([0-9]{2}):([0-9]{2}):([0-9]{2}(?:\.[0-9]+)?)(z|([+-])([0-9]{2})(?::?([0-9]{2}))?)?", re.IGNORECASE | re.ASCII)
+_DAYS = (0, 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31)
+
+# The contract's KEY_SHAPE (src/connections.ts): a provider key where it starts a word, case-sensitive prefixes, the
+# `sk-` rules and a Telegram bot token.
+_KEY_SHAPE = re.compile(
+    r"(?:^|[^A-Za-z0-9])(?:sk-(?=[A-Za-z0-9_-]*[0-9])(?:(?=[A-Za-z0-9_-]*[A-Z])[A-Za-z0-9_-]{16,}|[A-Za-z0-9_-]{32,})"
+    r"|gh[pousr]_[A-Za-z0-9]{20,}|xox[abposr]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|glpat-[A-Za-z0-9_-]{20,}"
+    r"|(?:bot)?[0-9]{6,12}:(?=[A-Za-z0-9_-]*[A-Z])(?=[A-Za-z0-9_-]*[a-z])[A-Za-z0-9_-]{34,35}(?![A-Za-z0-9_-]))")
+_URL_SCHEME = re.compile(r"[a-z][a-z0-9+.-]*://", re.IGNORECASE | re.ASCII)
+_CLOSING = ")]}>\"'.,;:!?"
+_TRIED_BACK = 1
+
+
+def _date(value: str) -> bool:
+    match = _DATE.fullmatch(value)
+    if not match:
+        return False
+    year, month, day = (int(g) for g in match.groups())
+    leap = year % 4 == 0 and (year % 100 != 0 or year % 400 == 0)
+    return 1 <= month <= 12 and 1 <= day <= (29 if month == 2 and leap else _DAYS[month])
+
+
+def _time(value: str) -> bool:
+    match = _TIME.fullmatch(value)
+    if not match:
+        return False
+    hour, minute, second = int(match.group(1)), int(match.group(2)), float(match.group(3))
+    zone, sign = match.group(4), -1 if match.group(5) == "-" else 1
+    zone_h, zone_m = int(match.group(6) or 0), int(match.group(7) or 0)
+    if zone_h > 23 or zone_m > 59 or not zone:
+        return False
+    if hour <= 23 and minute <= 59 and second < 60:
+        return True
+    utc_min = minute - zone_m * sign  # a leap second, at 23:59 UTC only
+    utc_hour = hour - zone_h * sign - (1 if utc_min < 0 else 0)
+    return utc_hour in (23, -1) and utc_min in (59, -1) and second < 61
+
+
+def date_time(value: str) -> bool:
+    """The `date-time` format as the contract's validator (ajv-formats, full mode) reads it."""
+    parts = _DT_SEPARATOR.split(value)
+    return len(parts) == 2 and _date(parts[0]) and _time(parts[1])
+
+
+def _length(value: str) -> int:
+    return len(value)  # code points, as ajv counts them
+
+
+def _shape_problems(value: Any) -> List[str]:
+    """service-connections-extension.schema.json, read as the contract's validator reads it."""
+    if not isinstance(value, dict):
+        return ["/ type: must be object"]
+    # A member's name is never echoed: a secret-shaped name would reach the error text and a probe's evidence.
+    problems = ["/ additionalProperties: a member other than connections" for key in value if key != "connections"]
+    if "connections" not in value:
+        return problems + ["/ required: connections"]
+    connections = value["connections"]
+    if not isinstance(connections, list):
+        return problems + ["/connections type: must be array"]
+    if len(connections) > MAX_CONNECTIONS:
+        problems.append("/connections maxItems: at most %d" % MAX_CONNECTIONS)
+    for index, item in enumerate(connections):
+        at = "/connections/%d" % index
+        if not isinstance(item, dict):
+            problems.append("%s type: must be object" % at)
+            continue
+        problems += ["%s required: %s" % (at, key) for key in ("id", "kind", "target", "state") if key not in item]
+        problems += ["%s additionalProperties: a member the schema does not name" % at for key in item if key not in _MEMBERS]
+        for key in _STRING_MEMBERS + ("lastAt",):
+            if key in item and not isinstance(item[key], str):
+                problems.append("%s/%s type: must be string" % (at, key))
+        text = {k: v for k, v in item.items() if isinstance(v, str)}
+        if "id" in text and not _ID.fullmatch(text["id"]):
+            problems.append("%s/id pattern" % at)
+        if "kind" in item and item["kind"] not in KINDS:
+            problems.append("%s/kind enum" % at)
+        if "state" in item and item["state"] not in STATES:
+            problems.append("%s/state enum" % at)
+        if "target" in text and not (1 <= _length(text["target"]) <= 200 and _TARGET.fullmatch(text["target"])):
+            problems.append("%s/target length or pattern" % at)
+        if "capability" in text and not _CAPABILITY.fullmatch(text["capability"]):
+            problems.append("%s/capability pattern" % at)
+        for key in ("label", "purpose", "reason"):
+            if key in text and not (1 <= _length(text[key]) <= 300 and _LINE.fullmatch(text[key])):
+                problems.append("%s/%s length or pattern" % (at, key))
+        if "lastAt" in text and not date_time(text["lastAt"]):
+            problems.append("%s/lastAt format: date-time" % at)
+        if "kind" in item:
+            if item["kind"] != "service" and "capability" in item:
+                problems.append("%s/capability: only a service connection names a capability" % at)
+            if item["kind"] == "service" and "target" in text and not _SERVICE_TARGET.fullmatch(text["target"]):
+                problems.append("%s/target pattern: a service target is an id.instance key or a product id" % at)
+    return problems
+
+
+def _urls_in(value: str) -> List[str]:
+    """The URLs a member may hold, from every scheme in each whitespace-delimited piece, without the closing brackets,
+    quotes and punctuation that end a sentence, and with _TRIED_BACK of them put back (`]` closes an IPv6 host)."""
+    urls: List[str] = []
+    for piece in _SPACES.split(value):
+        for match in _URL_SCHEME.finditer(piece):
+            url = piece[match.start():]
+            end = len(url)
+            while end > 0 and url[end - 1] in _CLOSING:
+                end -= 1
+            back = 0
+            while back <= _TRIED_BACK and end + back <= len(url):
+                urls.append(url[:end + back])
+                back += 1
+    return urls
+
+
+def _long_run(value: str) -> bool:
+    """A long secret-shaped run in a piece read whole; in a piece that holds a URL, the text before its first scheme's
+    `://` (the URL itself is read by secret_url)."""
+    for piece in _SPACES.split(value):
+        found = _URL_SCHEME.search(piece)
+        cut = piece.find("://", found.start()) if found else -1
+        if _long_secret(piece if cut < 0 else piece[:cut]):
+            return True
+    return False
+
+
+# The shared detector (DEC-0044) as the contract's ECMAScript reads it: ASCII case folding, ECMAScript's \s and `.`,
+# an ASCII word boundary. The kit's fabric_secrets keeps Python's semantics for its other callers (LC-21); FAC-SEM-127
+# is held to the reference, so this module reads with the reference's (blind reading of 0.44.0, finding 1).
+_NOT_LINE_END = "[^\n\r\u2028\u2029]"
+_SECRET_VALUE = re.compile(r"(^bearer[%s]%s+|sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|xox[abposr]-[A-Za-z0-9-]{10,}"
+                           r"|AKIA[0-9A-Z]{16}|glpat-[A-Za-z0-9_-]{20,})" % (_JS_SPACE, _NOT_LINE_END), re.IGNORECASE | re.ASCII)
+_BEARER = re.compile(r"(?<![A-Za-z0-9_])bearer[%s]+(?=[A-Za-z0-9._~+/-]*[0-9])[A-Za-z0-9._~+/-]{12,}=*" % _JS_SPACE,
+                     re.IGNORECASE | re.ASCII)
+_PATH_LIKE = re.compile(r"(?:[/~.]|[A-Za-z]:[\\/]|[a-z][a-z0-9+.-]*://)", re.IGNORECASE | re.ASCII)
+_ARGUMENT_SPLIT = re.compile("[%s=]" % _JS_SPACE)
+
+
+def _credential_name(name: str) -> bool:
+    """fabric_secrets.credential_name with ECMAScript's whitespace in the word split (U+FEFF splits a name there)."""
+    spaced = re.sub(r"([a-z0-9])([A-Z])", r"\1 \2", name)
+    spaced = re.sub(r"([A-Z]+)([A-Z][a-z])", r"\1 \2", spaced)
+    split = [w.lower() for w in re.split("[%s._-]+" % _JS_SPACE, spaced) if w]
+    words = split + [w[:-1] for w in split if len(w) > 2 and w.endswith("s")]
+    if any(w in CREDENTIAL_WORDS for w in words) or (len(split) == 1 and any(w in CREDENTIAL_PAIRS for w in words)):
+        return True
+    return any(word in words and any(p in words for p in partners) for word, partners in CREDENTIAL_PAIRS.items())
+
+
+def _secret_value(value: str) -> bool:
+    return bool(JWT_SHAPE.search(value) or _SECRET_VALUE.search(value) or _long_secret(value))
+
+
+def _path_like(piece: str) -> bool:
+    return bool(_PATH_LIKE.match(piece)) or (
+        bool(re.search(r"[\\/]", piece))
+        and (bool(re.search(r"\.[A-Za-z0-9]{1,8}\Z", piece))
+             or any(re.fullmatch(r"[a-z][a-z0-9_-]{2,}", segment) for segment in re.split(r"[\\/]", piece))))
+
+
+def _secret_argument(value: str) -> bool:
+    if JWT_SHAPE.search(value) or _SECRET_VALUE.search(value) or _BEARER.search(value):
+        return True
+    return any(any(_long_secret(part) for part in re.split(r"[\\/]", piece)) if _path_like(piece) else _long_secret(piece)
+               for piece in _ARGUMENT_SPLIT.split(value))
+
+
+_SPECIAL = ("http", "https", "ws", "wss", "ftp", "file")
+_FORBIDDEN_HOST = set("\x00\t\n\r #/:<>?@[\\]^|")
+_FORBIDDEN_DOMAIN = _FORBIDDEN_HOST | set(chr(c) for c in range(0x20)) | {"%", "\x7f"}
+
+
+def _ipv4_number(part: str) -> Optional[int]:
+    if part == "":
+        return None  # an empty part fails WHATWG's IPv4 parser (`1..2`); `0x` alone is 0
+    base = 10
+    if part[:2].lower() == "0x":
+        part, base = part[2:], 16
+    elif len(part) > 1 and part[0] == "0":
+        part, base = part[1:], 8
+    if part == "":
+        return 0
+    digits = {10: "0123456789", 16: "0123456789abcdefABCDEF", 8: "01234567"}[base]
+    return int(part, base) if all(c in digits for c in part) else None
+
+
+def _domain_ok(host: str) -> bool:
+    """The WHATWG host parser on a special scheme's host, enough to know when `new URL` refuses it."""
+    if host.startswith("["):
+        return host.endswith("]") and _ipv6_ok(host[1:-1])
+    if re.search(r"%(?![0-9A-Fa-f]{2})", host) is None:
+        try:
+            host = urllib.parse.unquote_to_bytes(host).decode("utf-8")
+        except UnicodeDecodeError:
+            return False
+    if any(c in _FORBIDDEN_DOMAIN for c in host):
+        return False
+    # A non-ASCII host goes through UTS46 in WHATWG; this module does not port it. When unsure, the host is taken as
+    # valid, so its URL's credentials are read: the doubt then hides a list rather than publish one (round-2 reading).
+    if any(ord(c) > 0x7f for c in host):
+        return True
+    labels = host.split(".")
+    if labels and labels[-1] == "" and len(labels) > 1:
+        labels = labels[:-1]
+    last = labels[-1] if labels else ""
+    if not (last and (last.isdigit() and last.isascii() or re.fullmatch(r"0[xX][0-9A-Fa-f]*", last))):
+        return host != ""
+    numbers = [_ipv4_number(label) for label in labels]
+    if len(numbers) > 4 or any(n is None for n in numbers):
+        return False
+    return all(n <= 255 for n in numbers[:-1]) and numbers[-1] < 256 ** (5 - len(numbers))
+
+
+def _ipv6_ok(text: str) -> bool:
+    if "%" in text:
+        return False  # a zone id: `ipaddress` takes one, WHATWG does not
+    try:
+        ipaddress.IPv6Address(text)
+        return True
+    except ValueError:
+        return False
+
+
+_SURROGATE = re.compile("[\ud800-\udfff]")
+_QUERY_ENCODE = set(chr(c) for c in range(0x21)) | set('"#<>')
+_FRAGMENT_ENCODE = set(chr(c) for c in range(0x21)) | set('"<>`')
+
+
+def _serialize(text: str, encode: set) -> str:
+    """A query or fragment as WHATWG serializes it (`url.search`, `url.hash`): the set's ASCII and every code point
+    above U+007E as UTF-8 percent-escapes in upper-case hex; `%` stays as written (round-3 reading of 0.44.0)."""
+    out = []
+    for c in text:
+        if c in encode or ord(c) > 0x7e:
+            out.append("".join("%%%02X" % b for b in c.encode("utf-8")))
+        else:
+            out.append(c)
+    return "".join(out)
+
+
+def _whatwg_parts(value: str) -> Optional[Dict[str, str]]:
+    """The password, query and fragment `new URL(value)` gives, or None where it throws. A subset of the WHATWG URL
+    parser: an absolute URL with `//` authority, as the members that reach it are (_urls_in starts each at a scheme)."""
+    # A JavaScript string becomes a USV string first: an unpaired surrogate is U+FFFD (json.loads keeps one).
+    value = _SURROGATE.sub("\ufffd", value)
+    value = re.sub(r"[\t\n\r]", "", value.strip("".join(chr(c) for c in range(0x21))))
+    match = re.match(r"([A-Za-z][A-Za-z0-9+.-]*):", value)
+    if not match:
+        return None
+    scheme, rest = match.group(1).lower(), value[match.end():]
+    special = scheme in _SPECIAL
+    if special:
+        cut = min([i for i in (rest.find("?"), rest.find("#")) if i >= 0] or [len(rest)])
+        rest = rest[:cut].replace("\\", "/") + rest[cut:]  # a backslash is a slash before the query only
+    if not rest.startswith("//"):
+        return {"password": "", "query": "", "fragment": ""} if not special else None
+    rest = rest[2:].lstrip("/") if special and scheme != "file" else rest[2:]
+    end = len(rest)
+    for stop in "/?#":
+        at = rest.find(stop)
+        if at >= 0:
+            end = min(end, at)
+    authority, tail = rest[:end], rest[end:]
+    fragment = _serialize(tail.split("#", 1)[1], _FRAGMENT_ENCODE) if "#" in tail else ""
+    before = tail.split("#", 1)[0]
+    query = _serialize(before.split("?", 1)[1], _QUERY_ENCODE | ({"'"} if special else set())) if "?" in before else ""
+    if scheme == "file":
+        # A drive letter (`C:`, `c|`) is an empty host and the start of the path.
+        if authority == "" or re.fullmatch(r"[A-Za-z][:|]", authority) or _domain_ok(authority):
+            return {"password": "", "query": query, "fragment": fragment}
+        return None
+    userinfo, _, hostport = authority.rpartition("@")
+    password = userinfo.split(":", 1)[1] if ":" in userinfo else ""
+    if hostport.startswith("["):
+        close = hostport.find("]")
+        if close < 0:
+            return None
+        host, after = hostport[:close + 1], hostport[close + 1:]
+        if after and not after.startswith(":"):
+            return None
+        port = after[1:]
+    else:
+        host, _, port = hostport.partition(":")
+    if port and not (port.isascii() and port.isdigit() and int(port) <= 65535):
+        return None
+    if special:
+        if host == "" or not _domain_ok(host):
+            return None
+    elif host.startswith("["):
+        if not _ipv6_ok(host[1:-1]):
+            return None
+    elif any(c in _FORBIDDEN_HOST for c in host):
+        return None
+    elif host == "" and ("@" in authority or port):
+        return None
+    return {"password": password, "query": query, "fragment": fragment}
+
+
+def _raw_values(query: str) -> Dict[str, List[str]]:
+    """fabric_secrets.raw_values with the name read as URLSearchParams reads it: one leading `?` of the raw piece is
+    dropped before decoding (`??token` names `?token`, `%3Ftoken` names `?token`; round-3 reading)."""
+    values: Dict[str, List[str]] = {}
+    for piece in query.split("&"):
+        if piece == "":
+            continue
+        at = piece.find("=")
+        raw_name = piece if at < 0 else piece[:at]
+        merged = raw_values(raw_name[1:] if raw_name.startswith("?") else raw_name)
+        name = next(iter(merged), "")
+        values.setdefault(name, []).extend(raw_values("x" + piece[at:])["x"] if at >= 0 else [""])
+    return values
+
+
+def _secret_url(value: str) -> bool:
+    """The contract's secretUrl (DEC-0044): what _secret_argument finds, a password, or a query or fragment value
+    named or shaped like a credential, in a URL WHATWG parses; one it refuses is read as an argument only."""
+    if _secret_argument(value):
+        return True
+    parts = _whatwg_parts(value)
+    if parts is None:
+        return False
+    if parts["password"]:
+        return True
+    return any((raw != "" and _credential_name(name)) or _secret_value(raw)
+               for part in (parts["query"], parts["fragment"]) for name, raws in _raw_values(part).items() for raw in raws)
+
+
+def _credential(value: str, runs: bool) -> bool:
+    return bool(JWT_SHAPE.search(value) or _KEY_SHAPE.search(value) or _BEARER.search(value)
+                or (runs and _long_run(value)) or any(_secret_url(url) for url in _urls_in(value)))
+
+
+def _beyond_shape(connections: Sequence[Dict[str, Any]]) -> List[str]:
+    """What the schema cannot state: an id named twice, a credential in any string member."""
+    problems: List[str] = []
+    seen = set()
+    for index, connection in enumerate(connections):
+        if connection["id"] in seen:
+            problems.append("/connections/%d/id duplicate: it is named twice" % index)
+        seen.add(connection["id"])
+        for member in _STRING_MEMBERS:
+            value = connection.get(member)
+            runs = member not in ("id", "capability") and not (member == "target" and connection.get("kind") == "model")
+            if isinstance(value, str) and _credential(value, runs):
+                problems.append("/connections/%d/%s credential: a connection never carries a credential" % (index, member))
+    return problems
+
+
+def connections_view(well_known: Any) -> Dict[str, Any]:
+    """A host's reading of a well-known document's connections (the contract's connectionsView): never raises. Without
+    the key nothing is declared; an invalid value (the schema, a repeated id, a credential) is not declared and is
+    `reported`; a valid list comes back with `failing` set on each connection a `degraded[].source` names."""
+    none: Dict[str, Any] = {"declared": False, "reported": False, "connections": [], "errors": []}
+    extensions = well_known.get("extensions") if isinstance(well_known, dict) else None
+    if not isinstance(extensions, dict) or CONNECTIONS_EXTENSION_KEY not in extensions:
+        return none
+    value = extensions[CONNECTIONS_EXTENSION_KEY]
+    errors = _shape_problems(value)
+    if not errors:
+        errors = _beyond_shape(value["connections"])
+    if errors:
+        return dict(none, reported=True, errors=errors)
+    degraded = well_known.get("degraded")
+    failing = {entry["source"] for entry in (degraded if isinstance(degraded, list) else [])
+               if isinstance(entry, dict) and isinstance(entry.get("source"), str)}
+    return {"declared": True, "reported": False, "errors": [],
+            "connections": [dict(c, failing=c["id"] in failing) for c in value["connections"]]}
+
+
+def connections_rules(well_known: Any) -> List[Dict[str, str]]:
+    """FAC-SEM-127: the connections a well-known document declares are valid, each id once, no credential."""
+    view = connections_view(well_known)
+    at = "/extensions/" + CONNECTIONS_EXTENSION_KEY.replace("~", "~0").replace("/", "~1")
+    return [{"code": "FAC-SEM-127", "instancePath": at,
+             "message": "the connections declaration is invalid (%s); a host treats it as not declared and reports it "
+                        "(DEC-0096)" % error} for error in view["errors"]]
+
+
+def connections_extension(declared: Iterable[Mapping[str, Any]], degraded: Sequence[Mapping[str, Any]] = (),
+                          states: Optional[Mapping[str, str]] = None) -> Dict[str, Any]:
+    """The `extensions` entry a service declares (DEC-0096): what it uses, each connection's `state` from the service's
+    own checks (`states`, by id), else `degraded` when a `degraded[].source` names it, else `unknown`. A declared
+    `state` is kept. Raises ServiceError on a declaration a host would hide (the schema, a repeated id, a credential):
+    a service never publishes one that reads as "declared nothing"."""
+    if declared is None or isinstance(declared, (str, bytes, Mapping)) or not isinstance(declared, Iterable):
+        raise ServiceError("Connections declaration: declared is a list of connections.")
+    if degraded is None:
+        degraded = ()
+    if states is None:
+        states = {}
+    if isinstance(degraded, (str, bytes, Mapping)) or not isinstance(degraded, Iterable) or not isinstance(states, Mapping):
+        raise ServiceError("Connections declaration: degraded is a list of entries and states a mapping by id.")
+    failing = {entry.get("source") for entry in degraded if isinstance(entry, Mapping) and isinstance(entry.get("source"), str)}
+    connections: List[Any] = []
+    for item in declared:
+        if not isinstance(item, Mapping):
+            connections.append(item)  # the shape check names it and the declaration is refused
+            continue
+        connection = dict(item)
+        if "state" not in connection:
+            ident = connection.get("id") if isinstance(connection.get("id"), str) else None
+            if ident is not None and ident in states:
+                connection["state"] = states[ident]  # an invalid check value is refused by the shape check
+            else:
+                connection["state"] = "degraded" if ident in failing else "unknown"
+        connections.append(connection)
+    value = {"connections": connections}
+    view = connections_view({"extensions": {CONNECTIONS_EXTENSION_KEY: value}})
+    if view["reported"]:
+        raise ServiceError("Connections declaration: %s." % "; ".join(view["errors"]))
+    return {CONNECTIONS_EXTENSION_KEY: value}

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_descriptor.py

@@ -35,6 +35,7 @@ from fabric_paths import (
 from fabric_protocols import (
     protocols_findings,
 )
+from fabric_connections import CONNECTIONS_EXTENSION_KEY, connections_view  # noqa: E402 - the kit (FAA-62)
 from fabric_usage import (
     ROUTES,
 )
@@ -570,6 +571,11 @@ def build_well_known(*, service_id: str, instance: str, name: str, version: str,
             problems = dashboard_extension_problems(extensions[DASHBOARD_EXTENSION_KEY])
             if problems:
                 raise ServiceError("Dashboard declaration: %s." % "; ".join(problems))
+        if CONNECTIONS_EXTENSION_KEY in extensions:
+            # DEC-0096: a host hides an invalid declaration (FAC-SEM-127); a service never publishes one.
+            view = connections_view({"extensions": {CONNECTIONS_EXTENSION_KEY: extensions[CONNECTIONS_EXTENSION_KEY]}})
+            if view["reported"]:
+                raise ServiceError("Connections declaration: %s." % "; ".join(view["errors"]))
         doc["extensions"] = dict(extensions)
     if configuration is not None:
         problems = configuration_problems(configuration)

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_service.py

@@ -179,6 +179,12 @@ from fabric_backups import (  # noqa: F401
     newest_intact_backup,
     restore_plan,
 )
+from fabric_connections import (  # noqa: F401
+    CONNECTIONS_EXTENSION_KEY,
+    connections_extension,
+    connections_rules,
+    connections_view,
+)
 from fabric_descriptor import (  # noqa: F401
     DASHBOARD_EXTENSION_KEY,
     DASHBOARD_KIT,

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/kit.json

@@ -1,6 +1,6 @@
 {
  "name": "fabric-service-kit",
- "version": "0.43.0",
+ "version": "0.44.0",
  "about": "The service kit's modules in dependency order: a module imports only modules listed before it. Written by fabric_kit.py build; edit the order and layers by hand, never the digests.",
  "python": [
   {
@@ -141,6 +141,16 @@
    ],
    "sha256": "71482284e57334b2d364a44596fc4183baddfe61a80083d3099b7ef423dc6f38"
   },
+  {
+   "module": "fabric_connections",
+   "file": "fabric_connections.py",
+   "layer": "L3",
+   "imports": [
+    "fabric_base",
+    "fabric_secrets"
+   ],
+   "sha256": "77d3ccf863c70e9209d21ef45c46a6db9c06237019bc20d54f8d3946873f3f11"
+  },
   {
    "module": "fabric_lock",
    "file": "fabric_lock.py",
@@ -182,12 +192,13 @@
    "layer": "L3",
    "imports": [
     "fabric_base",
+    "fabric_connections",
     "fabric_paths",
     "fabric_protocols",
     "fabric_secrets",
     "fabric_usage"
    ],
-   "sha256": "43c59437502a1af6c6305f0d4dddfbb9e616e81441d6ad7137f9d96b7a918a06"
+   "sha256": "5f6c8f3593fe0cef92d866109cd9def807f67dd5beae2c4bca05452f50521080"
   },
   {
    "module": "fabric_auth",
@@ -242,6 +253,7 @@
     "fabric_auth",
     "fabric_backups",
     "fabric_base",
+    "fabric_connections",
     "fabric_descriptor",
     "fabric_events",
     "fabric_jsvalue",
@@ -254,7 +266,7 @@
     "fabric_time",
     "fabric_usage"
    ],
-   "sha256": "3c8f69e139ee6fe714cad78c30de1a076ac7fbf9f7f419cd2cd131e95d889f6a"
+   "sha256": "d411433ce6ff3e81189b10b2c1a8462335a97cd99574ab0ee7d1c28cf48e1694"
   },
   {
    "module": "fabric_profiles",
@@ -393,7 +405,7 @@
    "file": "fabric-secrets.mjs",
    "layer": "L0",
    "imports": [],
-   "sha256": "2f7baaebfd08daf8b9c9ae1b75ba8ca04997d9dbf113897b4fb1464391c2d66d"
+   "sha256": "6ad8ab18ac899ecc2384e8ec6a3fb689b92be3b9a5ce3a59b92a37d52da5d766"
   },
   {
    "module": "fabric-crypto",
@@ -501,6 +513,17 @@
    ],
    "sha256": "0ecc3c19bb0bd0393ff3a9ec503034e0ab251eaaf0254edf353e15d1b561f761"
   },
+  {
+   "module": "fabric-connections",
+   "file": "fabric-connections.mjs",
+   "layer": "L3",
+   "imports": [
+    "fabric-base",
+    "fabric-jsvalue",
+    "fabric-secrets"
+   ],
+   "sha256": "303432e547ce563e90ca9ffcd827f5612f51d3582929834e1add0fdaf6485dcc"
+  },
   {
    "module": "fabric-lock",
    "file": "fabric-lock.mjs",
@@ -542,12 +565,13 @@
    "layer": "L3",
    "imports": [
     "fabric-base",
+    "fabric-connections",
     "fabric-paths",
     "fabric-protocols",
     "fabric-secrets",
     "fabric-usage"
    ],
-   "sha256": "b9304be4cba4fedddc6a0da83eef861f045691c8309ff614a5522946af4069b0"
+   "sha256": "e75b16bbf15ee72a3c581df8164533ea84270f6167e7a0d2527e15bf4b78457d"
   },
   {
    "module": "fabric-auth",
@@ -603,6 +627,7 @@
     "fabric-auth",
     "fabric-backups",
     "fabric-base",
+    "fabric-connections",
     "fabric-descriptor",
     "fabric-events",
     "fabric-lock",
@@ -613,7 +638,7 @@
     "fabric-supervisors",
     "fabric-usage"
    ],
-   "sha256": "fd31188c1709b0cebbcea995fc817ad7b6ad4fe21f2af12f65d001309f6baacc"
+   "sha256": "bc67550e52aa6aa9c6d2ed6cbae52418a3e836623e17164166699f953d8aafa8"
   },
   {
    "module": "fabric-profiles",
@@ -1822,6 +1847,78 @@
    "fabric-openrouter.mjs": "f8f0168691f968b7cd85f36aa98e2167e88cc44f1104ff514fd0c7699b339253",
    "fabric-package.schema.json": "2ba799f576fad0f608029223c4ccccd122152f1c5dbfa8ce8b31cd63ac92ad44",
    "share-registration.schema.json": "0df979d5973809d194723b23a0d18e520d9f1badc0f4a9e557aa33cbe7bc2922"
+  },
+  "0.44.0": {
+   "fabric_jsvalue.py": "0cd4eab0a5d6ae35d097f7c59a08dc29173cb61c561c49e5291a8dad15d36779",
+   "fabric_time.py": "588f383da4ac6a243ea95b6ffc3a0aa99ca94245732dc4937734f190b7af4ae9",
+   "fabric_identifiers.py": "0fd814d521ac3aa39907458265870753046a73f48af3d8581ab864b93b211607",
+   "fabric_secrets.py": "68a0b5e9e90c468ec9ac67b2f0fd1848e08813d6ec1ec14a2a47337eb1a98911",
+   "fabric_crypto.py": "9c34aee20dbe4d6742e4fdbaab68ceb934bbe7dbd3a904c0010824ace16cdeaa",
+   "fabric_estate.py": "50cc12166a00b680ba5b2e458200912d7bcfbef70bd73ec4edf57c7fcfa9b687",
+   "fabric_delegation.py": "350e30cc0fb527bce1739c5f96bb9bec9028144def9d1b2630d1478529f8f996",
+   "fabric_share.py": "78506fe1a60829c525dbf6266a0aa0749a2164290ed94da8249a20b4e9be5605",
+   "fabric_ceremonies.py": "a59e83cf4adb2669a9b98008e3d3a0cba991a35cbff97bc604fc82fe81cfd49f",
+   "fabric_package.py": "09e5b4d20564ccb318f5a5e4f33df0359873fa8239cf4f5fcd21c8af481fd211",
+   "fabric_base.py": "684533b3a2aa3acd9b9e645a7a443427d279408f9f12f13456a0a991d57954ce",
+   "fabric_platform.py": "8b0cd89193bc55da204a4a1850665c96929c6778523a8715b8156c5643745288",
+   "fabric_paths.py": "0d87e572bde2b930391b27aa370d808e093ce45cfba6148706f5318219906d30",
+   "fabric_protocols.py": "71482284e57334b2d364a44596fc4183baddfe61a80083d3099b7ef423dc6f38",
+   "fabric_connections.py": "77d3ccf863c70e9209d21ef45c46a6db9c06237019bc20d54f8d3946873f3f11",
+   "fabric_lock.py": "ba2399d2137c7a7791b7133b9db9cca36693f4eb7e30955b25a75ade814e95ba",
+   "fabric_usage.py": "ce685cb9fdfd62ea75fff8b1b2be12a2ba758da783e4bfb4dcebe47bcbeb832b",
+   "fabric_backups.py": "02dc5eb66ec956723d3ddba07b6dd15f6a9726d901f4d60edfd02eee57880ceb",
+   "fabric_descriptor.py": "5f6c8f3593fe0cef92d866109cd9def807f67dd5beae2c4bca05452f50521080",
+   "fabric_auth.py": "55794587750f6c9f40935b74295d83d7096cb4b26a0b36ac292334cd87d8f853",
+   "fabric_events.py": "0086886c2c29dbd5c9d152be9d375c5bdf4a29f89b8095baff8490c2bcd64e47",
+   "fabric_logs.py": "86dc55bfafa2a57264722e2403510a249b95de0e4a722b2e4bc3948e3bd93da9",
+   "fabric_supervisors.py": "a2dbf15aa1c4eb9de42996b413103fa4814afd2e4e66d1ab7315f30e06ab6841",
+   "fabric_service.py": "d411433ce6ff3e81189b10b2c1a8462335a97cd99574ab0ee7d1c28cf48e1694",
+   "fabric_profiles.py": "26e21ec29c016000f8ca8053b7b489184854a73be1b7fdc0a18d12990203db9b",
+   "fabric_interop.py": "67a78026ad434bb638c8230b6bfadc9cbe67561842ae7493c77d912855f38d61",
+   "fabric_hub.py": "b9ac852e601b1d54cf61351677a628afc69faeed7d1fc74ebe541c1cf38e0c2a",
+   "fabric_board_shapes.py": "a8daefdc9283219206875b5d964b49552b6b3ba7e69c925abe08a44afc91c234",
+   "fabric_board_link.py": "b5bff994cb615c6a4bb0d88d020e3a59504166180e1fa1aea3be93224f2aeccb",
+   "fabric_board_session.py": "878ceed970a84087a320fd8eb971c210613a0fa2c524b68793fb32042910581e",
+   "fabric_board_fixture.py": "69761ce205ec640762ec9b591c6903e5a87f844e8d423b041681924027e39d1e",
+   "fabric_board.py": "0f075894b3e352194fcaf3fc7d08dee4e9f1c215e859769ed85fa5010e4a1599",
+   "fabric_http.py": "5d7f72af3a73fdbe8c1f487ecf60cef23a7c46289eba542b03aff4706b8218d4",
+   "fabric_openrouter.py": "2017d898c17001d7275f58267de653be7ecf6acd17ad8d9b24ecb7a43e5617d4",
+   "fabric-jsvalue.mjs": "dfbdb8c41584972c9389750a41719374a1cfc5652ed438dd1623025190b0106e",
+   "fabric-time.mjs": "3ff932069038a720df1c68c6492976906737b2e67e5c12d9c81c418597f661de",
+   "fabric-identifiers.mjs": "a18c2a501a4aa170bfd3d99e571ad6b7662649b4d3b9d2a540c002ea42811bbf",
+   "fabric-secrets.mjs": "6ad8ab18ac899ecc2384e8ec6a3fb689b92be3b9a5ce3a59b92a37d52da5d766",
+   "fabric-crypto.mjs": "038e03689701e3c9721a1e7f8e0a4d02a52d6a5d1661b0dc84035edc3ebbfcf6",
+   "fabric-estate.mjs": "912b1ceab57ed20f946986bf14ae2faf41fb8ea539e818164496874f3749ef65",
+   "fabric-delegation.mjs": "2bc4310c6c7f0f6a11ba29d8bad2341feb0e0285758c33080e879e0a3a5cf128",
+   "fabric-share.mjs": "d40a7405d7bd4c3213ed691330b7549afe8e023db0753b582e249714e672010d",
+   "fabric-ceremonies.mjs": "117d4374c9e95c930a38de7adbd4323774798f4fe6ec6f24afcd6f2c7298ca44",
+   "fabric-package.mjs": "34590076b2c6939b2892e86ed24b62cc5973315ec7a322de19c553336b049bf2",
+   "fabric-base.mjs": "17a92f5e9b71a855648e39e06388bad7f1b969605bd7b1f534ddf67b41a2fb5d",
+   "fabric-platform.mjs": "1349e3638c21caf7da7937ef6a5dfeefe05a8ee733520f0d581624095efeb388",
+   "fabric-paths.mjs": "e6f5e2ce7c8e7a1452d6ee69977489f4c09ca6f1d3100df9c303274f0b7b16b1",
+   "fabric-protocols.mjs": "0ecc3c19bb0bd0393ff3a9ec503034e0ab251eaaf0254edf353e15d1b561f761",
+   "fabric-connections.mjs": "303432e547ce563e90ca9ffcd827f5612f51d3582929834e1add0fdaf6485dcc",
+   "fabric-lock.mjs": "ac219ab0a326d5c43c7c4c255e0c3843d4794de795a60e3af661e7d5350ea052",
+   "fabric-usage.mjs": "e413569620bbc8221bc59e24b27e22d1483825ed18457801ed58d54a57de8114",
+   "fabric-backups.mjs": "849acdc6eba0fff648c8158e61f6b68cccd7bedf0880f7d5ec03a6a20f1e7005",
+   "fabric-descriptor.mjs": "e75b16bbf15ee72a3c581df8164533ea84270f6167e7a0d2527e15bf4b78457d",
+   "fabric-auth.mjs": "3ea6796470fcd829bc72a772fb7e4c37532a09d1e37ff41592dcf1a1a3074ca2",
+   "fabric-events.mjs": "c463d6ffcae24229a5c608d8fcea4268d2ccc5024b19fa10e5a452284068fa71",
+   "fabric-logs.mjs": "58467e5719c16e099d05bbedec47a95712506ab03c33f3cd4be1252e8498a946",
+   "fabric-supervisors.mjs": "9d61c1a17538a5e2453e33e5ae347337336748041bc054478a96dd51f3d4fc51",
+   "fabric-service.mjs": "bc67550e52aa6aa9c6d2ed6cbae52418a3e836623e17164166699f953d8aafa8",
+   "fabric-profiles.mjs": "314376cf2deb87f235fb18b11d3b532e211f585b9af0a9302b5f4cc39971b532",
+   "fabric-interop.mjs": "81c0b09045ada54f6645f40d935c0de06119793631b3240b1a613f4f2afd9d84",
+   "fabric-hub.mjs": "c005115a864cfd67daa4862097bb14acfe5a60bf653897e5bf8a570dd80f1070",
+   "fabric-board-shapes.mjs": "ad1094397540862b104d9317d6902031d35e64b16c12bf849fb883e12cb78d45",
+   "fabric-board-link.mjs": "4cd6d4e21713a38c8e56f7d59db3148638b8c27c08e774d96a0f6283c6049e0a",
+   "fabric-board-session.mjs": "744a8c9a518c27f2ddfd20b1b22afebc3ccc4f59aeeb7a38d7c12c2ddcae158d",
+   "fabric-board-fixture.mjs": "83c4b7e33ee47b68385faf2569d38d5c8a0c5cb0f8656090f41e1b0eed2f436e",
+   "fabric-board.mjs": "9e7bfe4d412521982224ef12bebfc2ff255eeeaf8d96cf40234ac18de68e7a59",
+   "fabric-http.mjs": "f886bcb49c4353d039387ac9568738dda26697a94dd07fc6a6204500f0bc27bf",
+   "fabric-openrouter.mjs": "f8f0168691f968b7cd85f36aa98e2167e88cc44f1104ff514fd0c7699b339253",
+   "fabric-package.schema.json": "2ba799f576fad0f608029223c4ccccd122152f1c5dbfa8ce8b31cd63ac92ad44",
+   "share-registration.schema.json": "0df979d5973809d194723b23a0d18e520d9f1badc0f4a9e557aa33cbe7bc2922"
   }
  },
  "data": {

package/plugins/fabric-agent-adapter/skills/creating-fabric-agents/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode. Ships in one plugin with adapting-projects-to-fabric, whose scripts it reuses.
 metadata:
   author: PassionCode.ai
-  version: "0.43.0"
+  version: "0.44.0"
   contract-version: "0.1.0"
   contract-commit: "bfa9a67aa3c6cb808c093e7d83cd59799f1ee7d0"
 ---

package/plugins/fabric-agent-adapter/skills/working-with-fabric/SKILL.md

@@ -19,7 +19,7 @@ compatibility: >-
   this plugin; Codex/Kimi use command hooks; Hermes/OpenCode/OpenClaw/Pi use native context plugins after opt-in.
 metadata:
   author: PassionCode.ai
-  version: "0.43.0"
+  version: "0.44.0"
 ---
 
 # Working with Fabric

package/plugins/fabric-agent-adapter/skills/working-with-fabric/scripts/fabric_session_env.py

@@ -57,7 +57,7 @@ SESSION_ID = re.compile(r"[A-Za-z0-9._:-]{1,128}")
 LOOPBACK_ORIGIN = re.compile(r"http://127\.0\.0\.1:(\d{1,5})")
 
 
-VERSION = "0.43.0"
+VERSION = "0.44.0"
 
 
 HOSTS = {"claude": "Claude Code", "codex": "Codex", "kimi": "Kimi Code",

package/plugins/fabric-agent-adapter/skills/working-with-fabric/scripts/fabric_session_mcp.py

@@ -191,11 +191,12 @@ class McpStdio:
         try:
             self.proc.stdin.write((json.dumps(message) + "\n").encode("utf-8"))
             self.proc.stdin.flush()
-        except OSError:  # a server that exited closed its stdin: say why it exited, never a broken pipe
+        except OSError:  # a server that closed its stdin: say why it exits, never a broken pipe
+            # Its exit status may come later than the pipe's end (FAA-97): wait for it up to the deadline.
             try:
-                self.proc.wait(timeout=max(0.0, min(1.0, self.deadline - time.monotonic())))
+                self.proc.wait(timeout=max(0.0, self.deadline - time.monotonic()))
             except subprocess.TimeoutExpired:
-                pass
+                raise TimeoutError("fabric-mcp closed its stdin and did not exit") from None
             self._ended()
 
     def notify(self, method: str, params: Optional[Dict[str, Any]] = None) -> None:

package/plugins/fabric-agent-adapter/skills/working-with-fabric/scripts/host_hooks.py

@@ -59,8 +59,10 @@ def openclaw_edit(data, script, remove):
             return True
         if not value.replace('\\', '/').endswith('/working-with-fabric/scripts/hosts/openclaw'):
             return False
+        if remove and not Path(value).expanduser().exists():
+            return True  # our layout, its folder gone (FAA-90): no manifest left to read, and a dead load path
         try:
-            manifest = fs.read_small(Path(value) / 'openclaw.plugin.json')
+            manifest = fs.read_small(Path(value).expanduser() / 'openclaw.plugin.json')
             return isinstance(manifest, str) and json.loads(manifest).get('id') == IDENTITY
         except (ValueError, AttributeError):
             return False