@passioncode-ai/fabric-agent-adapter 0.6.0 → 0.6.1

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.6.1 - 2026-10-03
+
+### Fixed
+
+- **`check_service.py` no longer fails every online service hosted behind a platform router.**
+  `network.host-check` required the service's own `403`, but Heroku, Fly, Render and CDNs route
+  by `Host`: a foreign one is answered by the router (`404`/`421`) and never reaches the process.
+  For a remote placement that answer now passes, unless its body is the well-known document. The
+  Origin and cross-site checks are unchanged — they reach the service and need its `403`. Found on
+  the first real online service: 26 PASS and 1 false FAIL before, 0 FAIL after (`guard_verdict`,
+  `test/test_fabric_service_remote.py::GuardVerdict`, 4 mutations killed).
+
 ## 0.6.0 - 2026-10-02
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/fabric-agent-adapter",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Create Fabric-compatible agents, run them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract. This package is the installer CLI.",
   "scripts": {
     "test": "python3 test/validate.py && python3 -m unittest discover -s test -q && node --test 'test/*.test.mjs'"

package/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles.",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.6.0"
+  version: "0.6.1"
   contract-version: "0.1.0"
   contract-commit: "2ce392291c6668598d12cd38327e24696b5ca15c"
 ---

package/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -15,7 +15,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits; the probe needs Python 3.9+. launchd steps are macOS-only (Linux services use lifecycle manager none until a systemd adapter exists). Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.6.0"
+  version: "0.6.1"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
   extension-commit: "2ce392291c6668598d12cd38327e24696b5ca15c"

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/remote-placement.md

@@ -44,6 +44,14 @@ same objects — well-known document, events feed, login code — at the same pa
 - **Behind a router**: check the platform-set forwarded scheme; `Host` is preserved by common
   platforms and must equal the origin's host.
 
+## Checking it
+
+`check_service.py <id>` probes a remote placement over verified TLS. Behind a platform router
+(Heroku, Fly, Render, a CDN) a request that names a foreign `Host` never reaches the process: the
+router answers it, usually `404` or `421`. The probe counts that as the refusal it is, as long as
+the body is not the well-known document. The Origin and cross-site checks name the right `Host`,
+reach the service, and still need its own `403`.
+
 ## What a host does and will not do
 
 | Situation | Host |

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_service.py

@@ -79,6 +79,23 @@ def priority_problems(plist: dict) -> list:
     return out
 
 
+# A platform router (Heroku, Fly, Render, a CDN) routes by Host, so a request naming a foreign
+# Host never reaches an online service: the router itself answers, typically 404 or 421. That is
+# still a refusal — the service disclosed nothing — so for a remote placement the host check
+# accepts it, as long as the body is not the well-known document. Every other guard request names
+# the right Host, reaches the service, and must be the service's own 403.
+PLATFORM_HOST_REFUSALS = (400, 404, 421)
+
+
+def guard_verdict(rule: str, remote: bool, status: int, body: bytes) -> Tuple[str, str]:
+    if status == 403:
+        return "PASS", "HTTP 403"
+    disclosed = b"fabric-service/" in (body or b"")
+    if rule == "network.host-check" and remote and status in PLATFORM_HOST_REFUSALS and not disclosed:
+        return "PASS", "HTTP %d from the platform router: a foreign Host never reaches the service" % status
+    return "FAIL", "HTTP %d%s" % (status, ", and the body is the well-known document" if disclosed else "")
+
+
 class _PinnedHTTPS(http.client.HTTPSConnection):
     """HTTPS to the origin's name (SNI, certificate, Host) over a socket dialled elsewhere."""
 
@@ -243,8 +260,9 @@ class Probe:
                     sent.update(self.auth_headers())
                     if "Origin" in sent:
                         sent["Origin"] = "https://evil.example"
-                status, _, _ = self.request("GET", "/.well-known/fabric-service", sent)
-                self.add(rule, "PASS" if status == 403 else "FAIL", "HTTP %d" % status)
+                status, _, body = self.request("GET", "/.well-known/fabric-service", sent)
+                verdict, evidence = guard_verdict(rule, self.remote, status, body)
+                self.add(rule, verdict, evidence)
             except (OSError, ssl.SSLError) as exc:
                 self.add(rule, "NOT_RUN", str(exc))
         if self.remote:

package/plugins/fabric-agent-adapter/skills/creating-fabric-agents/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode. Ships in one plugin with adapting-projects-to-fabric, whose scripts it reuses.
 metadata:
   author: PassionCode.ai
-  version: "0.6.0"
+  version: "0.6.1"
   contract-version: "0.1.0"
   contract-commit: "2ce392291c6668598d12cd38327e24696b5ca15c"
 ---