@passioncode-ai/fabric-agent-adapter 0.61.0 → 0.62.0

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_service_rules.py

@@ -18,6 +18,36 @@ from typing import Any, Dict, Iterable, List, Optional, Tuple
 
 sys.path.insert(0, str(Path(__file__).resolve().parent))
 import fabric_service as fs  # noqa: E402 - beside this file
+from fabric_http import redact_url  # noqa: E402
+from fabric_secrets import ascii_decoded, repository_name, secret_argument  # noqa: E402
+
+_LOCAL_PATH = re.compile(r"[/~.\\]|[A-Za-z]:[/\\]")  # how a local path starts, never a user before an `@`
+_SCP_HOST = re.compile(r"[^@/:\\]+:")  # what follows the `@` of user[:password]@host:path
+_SPECIAL = re.compile(r"(?:https?|wss?|ftp|file):", re.I)  # the URL standard's special schemes, read with or without `//`
+_URL = re.compile(r"[A-Za-z][A-Za-z0-9+.-]*://")  # a scheme that starts the value; a later `://` is path text (unit reading 9)
+
+
+def shown_repository(value: str) -> str:
+    """A repository or git origin as evidence: a URL through redact_url, which drops its user information as written
+    first (git's reading, `https://h\\u:pw@x/r`); a local path (one that starts with `/`, `~`, `.`,
+    `\\` or a drive) by its name; an scp form (user[:password]@host:path) from its host, its user and password dropped
+    whatever they hold, up to the last `@` that a host and `:` follow; anything else by its name. Then a query and a
+    fragment. A value with a piece shaped like a credential that is no name (fabric_secrets.repository_name) is not
+    printed (0.62.0 readings 2 to 11). Read first as redact_url reads it: C0 controls and space off its ends, every tab,
+    CR and LF out, so `https:/<tab>/u:pw@h` is the URL it is (unit reading 11)."""
+    value = re.sub(r"[\t\n\r]", "", value.strip("".join(map(chr, range(0x21)))))
+    if _URL.match(value) or _SPECIAL.match(value):  # `https:user@host/x` is a URL too, as the URL standard reads it
+        shown = redact_url(value)  # which drops the user information as written first (seam readings 10 and 11)
+    else:
+        cut = 0
+        if not _LOCAL_PATH.match(value):
+            ats = [i for i, c in enumerate(value) if c == "@"]
+            hosts = [at for at in ats if _SCP_HOST.match(value, at + 1)]
+            cut = (hosts or ats or [-1])[-1] + 1  # the last `@` a host and `:` follow, else the last `@` (unit reading 8)
+        shown = re.split(r"[?#]", value[cut:], maxsplit=1)[0]
+    pieces = [piece for written in (shown, ascii_decoded(shown)) for piece in re.split(r"[/\\:]", written)
+              if piece and not repository_name(piece)]  # as written and decoded, `%73k-` being `sk-` (readings 11)
+    return "<a repository shaped like a credential>" if any(secret_argument(piece) for piece in pieces) else shown
 import fabric_actions as fa  # noqa: E402 - beside this file (DEC-0121)
 import fabric_a2a as fa2  # noqa: E402 - beside this file (DEC-0122)
 
@@ -177,7 +207,7 @@ def board_responder_verdict(wk: Any, kit: Optional[str] = None) -> Tuple[str, st
             path = Path(kit) if kit else Path(__file__).resolve().parent / "fabric_board.py"
             code = ("import json, sys; sys.path.insert(0, sys.argv[1]); import %s as board; "
                     "print(json.dumps(board.self_check()))" % path.stem)
-            out = subprocess.run([sys.executable, "-E", "-s", "-c", code, str(path.resolve().parent)], capture_output=True,
+            out = subprocess.run([sys.executable, "-E", "-s", "-B", "-c", code, str(path.resolve().parent)], capture_output=True,
                                  text=True, timeout=60, cwd=str(path.resolve().parent))
             problems = json.loads(out.stdout.strip().splitlines()[-1]) if out.returncode == 0 and out.stdout.strip() else ["the kit did not run: %s" % out.stderr.strip()[-200:]]
     except Exception as exc:  # noqa: BLE001 - a kit that cannot run its conversation fails the rule
@@ -658,5 +688,5 @@ def service_checkout(descriptor: Any, repo: Optional[str]) -> Tuple[Optional[Pat
             continue
         seen.add(top)
         if same_repository(_git_out(Path(top), "remote", "get-url", "origin") or "", source):
-            return Path(top), "the checkout of %s that holds %s" % (source, place)
-    return None, "no checkout of %s holds the descriptor's commands, manifest or launchd job; pass --repo" % source
+            return Path(top), "the checkout of %s that holds %s" % (shown_repository(source), place)
+    return None, "no checkout of %s holds the descriptor's commands, manifest or launchd job; pass --repo" % shown_repository(source)

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-auth.mjs

@@ -7,7 +7,7 @@ import { PROTOCOL, ServiceError, nowIso } from './fabric-base.mjs';
 import { tokenMatches, windowsTokenProblem } from './fabric-platform.mjs';
 import { atomicWrite, ensurePrivateDir, servicesDir } from './fabric-paths.mjs';
 import { isPlainObject } from './fabric-usage.mjs';
-import { validateDescriptor, writeDescriptor } from './fabric-descriptor.mjs';
+import { descriptorPath, namesRepository, sourceRefusal, validateDescriptor, writeDescriptor } from './fabric-descriptor.mjs';
 
 export const SESSION_COOKIE = 'fabric_session';
 
@@ -275,8 +275,17 @@ export function registerRemote({ id, instance = 'default', name, summary, origin
     installedAt: nowIso(), installedBy, ...(runner ? { runner: { ...runner } } : {}), ...(peer ? { peer: { ...peer } } : {}),
     ...(source != null ? { source: isPlainObject(source) ? { ...source } : source } : {}),
   };
+  if (source == null) { // a rotation that names no source keeps the installed one (0.62.0 seam reading 1)
+    let installed = null;
+    try { installed = JSON.parse(fs.readFileSync(descriptorPath(id, instance, dir), 'utf8'))?.source; } catch { /* none installed */ }
+    // Only one the kit accepts: a hand-edited source never blocks a rotation; it is dropped with the warning.
+    const base = new Set(validateDescriptor(d));
+    if (namesRepository({ source: installed }) && validateDescriptor({ ...d, source: installed }).every((p) => base.has(p))) d.source = { ...installed };
+  }
   const problems = validateDescriptor(d);
   if (problems.length) throw new ServiceError(`Descriptor is invalid: ${problems.join('; ')}.`);
+  const refusal = sourceRefusal(d, dir); // before the token is written: a refused install leaves nothing (FAA-198)
+  if (refusal) throw new ServiceError(refusal);
   ensurePrivateDir(path.dirname(tokenFile));
   atomicWrite(tokenFile, String(token).trim(), 0o600);
   return writeDescriptor(d, dir);

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-delegation.mjs

@@ -432,7 +432,9 @@ export class JwksCache {
     if (typeof source !== 'string' || !source) throw new Error('the key set needs a source');
     if (/^https?:\/\//.test(source)) {
       const url = new URL(source);
-      if (url.username || url.password) throw new Error('a key set URL carries no credentials');
+      const text = source.replace(/^[\x00-\x20]+|[\x00-\x20]+$/g, '').replace(/[\t\n\r]/g, '');
+      // the authority as written too, as Python's netloc reads it (`https://h\\u:p@x/j`, `https://@x/j`: seam reading 13)
+      if (url.username || url.password || /^[a-z][a-z0-9+.-]*:[/\\]*[^/?#]*@/i.test(text)) throw new Error('a key set URL carries no credentials');
       if (url.protocol === 'http:' && !loopback(url.hostname)) throw new Error('a key set is read over https, or over http on loopback only');
     } else if (source.includes('://')) {
       throw new Error('a key set is an https URL, a loopback http URL or a file path');

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-descriptor.mjs

@@ -2,7 +2,7 @@
 // Part of the Node service kit (FAA-65, layer L3); the twin of fabric_descriptor.py. Node 20+, no dependency.
 import fs from 'node:fs';
 import path from 'node:path';
-import { credentialName, secretArgument, secretUrl, secretValue } from './fabric-secrets.mjs';
+import { credentialName, repositoryCredential, secretArgument, secretUrl, secretValue } from './fabric-secrets.mjs';
 import { ID, INSTANCE, LOCAL_PATH, PROTOCOL, ServiceError, TASK, UNIT, expand } from './fabric-base.mjs';
 import { atomicWrite, ensurePrivateDir, servicesDir } from './fabric-paths.mjs';
 import { protocolsFindings } from './fabric-protocols.mjs';
@@ -182,7 +182,7 @@ export function descriptorMemberProblems(d) {
     for (const k of Object.keys(runner)) if (!['kind', 'credentialKind'].includes(k)) problems.push(`runner has no member ${k}`);
     if (!CREDENTIAL_KINDS.includes(runner.credentialKind)) problems.push('runner.credentialKind is subscription, key, platform-metered or none');
     if ('kind' in runner && !(typeof runner.kind === 'string' && RUNNER_KIND_NAME.test(runner.kind))) problems.push("runner.kind is a runner kind's name");
-    if (runner.credentialKind === 'subscription' && !Object.hasOwn(SUBSCRIPTION_RUNNERS, runner.kind)) problems.push("a subscription runs only in its vendor's runner: runner.kind claude-code, kimi-code or codex");
+    if (runner.credentialKind === 'subscription' && !(typeof runner.kind === 'string' && Object.hasOwn(SUBSCRIPTION_RUNNERS, runner.kind))) problems.push("a subscription runs only in its vendor's runner: runner.kind claude-code, kimi-code or codex");
     for (const [k, v] of Object.entries(runner)) places.push([`/runner/${pointer(k)}`, v]);
   }
   if ('source' in d) {
@@ -194,7 +194,8 @@ export function descriptorMemberProblems(d) {
       if (!(typeof repository === 'string' && SOURCE_URI.test(repository.replace(IP_LITERAL, '$1h')))) problems.push('source.repository is a URI (RFC 3986), such as https://github.com/owner/name');
       else if (URI_PASSWORD.test(repository)) problems.push('source.repository carries no password: it names the repository, never a credential'); // before the host
       else if (!authorityOk(repository)) problems.push('source.repository names a host, and a port of digits up to 65535 when it has one');
-      places.push(['/source/repository', repository]);
+      else if (repository.includes('@') && !HIERARCHICAL.test(repository)) problems.push('source.repository with a user is a URL with an authority (https://user@host/path), never an scp form'); // readings 7
+      else if (repositoryCredential(repository)) problems.push('FAC-SEM-086: /source/repository holds a value shaped like a credential; it names a repository'); // its name is no key (seam 6)
     }
   }
   if ('peer' in d) {
@@ -290,10 +291,39 @@ export function portOf(origin) {
   return Number(m[1]);
 }
 
+export const NO_SOURCE_REPOSITORY = 'names no source.repository, the repository its code is built from '
+  + '(https://github.com/owner/name): it links the agent to its project (FAA-198)';
+const PASS_SOURCE = 'Name it in this call: source: { repository } in the descriptor writeDescriptor writes, or in '
+  + 'registerRemote\'s options; one written after the call returns is too late for a new install.';
+
+const HIERARCHICAL = /^[A-Za-z][A-Za-z0-9+.-]*:\/\//;
+
+// FAA-198: why a new install of this (valid) descriptor is refused, or null: it names no source.repository and no
+// descriptor of its id.instance is installed yet. An installer checks it before it writes anything else.
+export const namesRepository = (d) => d?.source !== null && typeof d?.source === 'object' && !Array.isArray(d.source)
+  && typeof d.source.repository === 'string' && d.source.repository !== '';
+
+// An installed descriptor is a regular file, whatever it holds; a folder, a broken link or a path that cannot be
+// examined is none.
+export function sourceRefusal(d, dir = servicesDir()) {
+  if (namesRepository(d)) return null;
+  const instance = d?.instance ?? 'default';
+  // An id or instance that is no string names no installed file, in both kits (seam reading 3).
+  try { if (typeof d?.id === 'string' && typeof instance === 'string' && fs.statSync(descriptorPath(d.id, instance, dir)).isFile()) return null; } catch { /* not installed */ }
+  return `Descriptor ${d?.id}.${instance} ${NO_SOURCE_REPOSITORY}. ${PASS_SOURCE}`;
+}
+
+// FAA-198: a new descriptor names its source.repository; rewriting one already installed without it only warns
+// (process.emitWarning, code FABRIC_NO_SOURCE_REPOSITORY), so an installed agent's update keeps working.
 export function writeDescriptor(d, dir = servicesDir()) {
   const problems = validateDescriptor(d);
   if (problems.length) throw new ServiceError(`Descriptor is invalid: ${problems.join('; ')}.`);
   const me = `${d.id}.${d.instance}`;
+  const refusal = sourceRefusal(d, dir);
+  if (refusal) throw new ServiceError(refusal);
+  if (!namesRepository(d)) {
+    process.emitWarning(`Descriptor ${me} ${NO_SOURCE_REPOSITORY}; a new install is refused without it.`, { code: 'FABRIC_NO_SOURCE_REPOSITORY' });
+  }
   // DEC-0019: only a local placement claims a port on this computer; DEC-0069: an app's descriptor names none.
   const port = placementOf(d) === 'remote' || d.origin === undefined ? null : portOf(d.origin);
   for (const [file, other] of readDescriptors(dir)) {

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-http.mjs

@@ -52,8 +52,17 @@ export class Response {
 
 // The URL as it may appear in an error or a log line: scheme, host, port and path; no userinfo, query or fragment.
 export function redactUrl(url) {
+  let text = String(url).replace(/^[\x00-\x20]+|[\x00-\x20]+$/g, '').replace(/[\t\n\r]/g, '');
+  // The user information as written goes first, as the Python twin drops it: `https://h\\u:pw@x/r` would print `pw` in
+  // its path, a backslash being a slash to WHATWG (0.62.0 seam reading 11).
+  const written = /^([A-Za-z][A-Za-z0-9+.-]*:[/\\]*)([^/?#]*)/.exec(text); // after any run of slashes (seam reading 13)
+  if (written && written[2].includes('@')) text = written[1] + written[2].slice(written[2].lastIndexOf('@') + 1) + text.slice(written[0].length);
   let parts;
-  try { parts = new URL(String(url)); } catch { return '<unparseable url>'; }
+  try { parts = new URL(text); } catch {
+    // a scheme other than a special one keeps its name, as the Python twin prints it whatever follows (unit reading 14)
+    const scheme = /^([A-Za-z][A-Za-z0-9+.-]*):/.exec(text)?.[1].toLowerCase();
+    return scheme && !['http', 'https', 'ws', 'wss', 'ftp'].includes(scheme) ? `${scheme}:<redacted>` : '<unparseable url>';
+  }
   // Only http and https are sent; any other scheme keeps no more than its name (0.56.0 product r10).
   if (parts.protocol !== 'http:' && parts.protocol !== 'https:') return `${parts.protocol}<redacted>`;
   return `${parts.protocol}//${parts.host}${parts.pathname}`;
@@ -74,7 +83,10 @@ export function checkUrl(url, { insecure = false } = {}) {
   if (!['http:', 'https:'].includes(parts.protocol) || !parts.hostname) {
     throw new HttpError('only http and https URLs with a host are sent', { url: redactUrl(url), kind: 'refused' });
   }
-  if (parts.username || parts.password || /^[a-z]+:\/*[^/?#]*@/i.test(String(url).trim())) {
+  // the user information as written, read on the text `new URL` reads (C0 and space off its ends, tab, CR and LF out),
+  // so `ht\ttps://h\\u:pw@x/r` is refused as the Python twin refuses it (0.62.0 unit reading 12)
+  const text = String(url).replace(/^[\x00-\x20]+|[\x00-\x20]+$/g, '').replace(/[\t\n\r]/g, '');
+  if (parts.username || parts.password || /^[a-z][a-z0-9+.-]*:[/\\]*[^/?#]*@/i.test(text)) {
     throw new HttpError('credentials in a URL are refused: send them in a header', { url: redactUrl(url), kind: 'refused' });
   }
   if (parts.protocol === 'http:' && !insecure && !isLoopback(parts.hostname)) {

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-secrets.mjs

@@ -84,3 +84,60 @@ export function secretUrl(value) {
   }
   return false;
 }
+
+const REPOSITORY_URI = /^([A-Za-z][A-Za-z0-9+.-]*:(?:\/\/[^/?#]*)?)([^?#]*)([\s\S]*)$/;
+const REPOSITORY_NAME = /^(?:[a-z0-9._-]+|[A-Za-z._-]+)$/; // lower case, or letters with no digit (readings 8)
+const REPOSITORY_AUTHORITY = /^[A-Za-z][A-Za-z0-9+.-]*:\/\//;
+const KEY_AT_A_WORD = new RegExp(`(?:^|(?<=[._-]))(?:${SECRET_VALUE.source})`, 'i');
+const JWT_AT_A_WORD = new RegExp(`(?:^|(?<=[._-]))${JWT_SHAPE.source}`);
+const SPECIAL_QUERY = /^(?:https?|wss?|ftp|file):/i; // whose query also encodes `'`, as the URL standard does
+
+/** Whether a path segment reads as a repository's name: lower case, or letters with no digit, with no provider key's
+ * or JWT's shape at its start or after a `.`, `_` or `-` (0.62.0 readings 9 and 10), so a letters-only key is a key. */
+export const repositoryName = (piece) => REPOSITORY_NAME.test(piece) && !KEY_AT_A_WORD.test(piece) && !JWT_AT_A_WORD.test(piece);
+
+/** Every `%XX` escape of an ASCII character decoded, the rest as written (fabric_secrets.ascii_decoded, readings 11). */
+export const asciiDecoded = (text) => text.replace(/%([0-7][0-9A-Fa-f])/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)));
+
+/** Whether a repository URI's user information holds a password: every slash and backslash after the colon skipped,
+ * then up to the next `/`, `?` or `#` (fabric_secrets.repository_password, 0.62.0 readings 10 to 14). */
+export function repositoryPassword(value) {
+  const text = value.replace(/^[\x00-\x20]+|[\x00-\x20]+$/g, '').replace(/[\t\n\r]/g, '');
+  const colon = text.indexOf(':');
+  const rest = colon < 0 ? '' : text.slice(colon + 1); // as Python's partition leaves it (unit reading 12)
+  const authorities = colon < 0 ? [] : [/^[^/?#]*/.exec(rest.replace(/^[/\\]+/, ''))[0]];
+  const users = authorities.map((authority) => authority.slice(0, Math.max(authority.lastIndexOf('@'), 0)));
+  return [...users, ...users.map(asciiDecoded)].some((user) => user.includes(':') && user.slice(user.indexOf(':') + 1) !== '');
+}
+
+// A repository's parameters, read as fabric_secrets.secret_url reads them, by hand: `new URL`
+// refuses a host it cannot parse and a special scheme written without `//` (`https:host/r?access_token=...`), where
+// the Python twin still reads them (0.62.0 readings 8 and 9, FAA-200 (17)).
+function repositoryParts(head, tail) {
+  const text = tail.replace(/[\x00-\x20]+$/, '').replace(/[\t\n\r]/g, '');
+  const hash = text.indexOf('#');
+  const before = hash < 0 ? text : text.slice(0, hash);
+  const query = before.startsWith('?') ? before.slice(1) : '';
+  const fragment = hash < 0 ? '' : text.slice(hash + 1);
+  try { // percent-encode them as `new URL` does, on a host it always reads
+    const url = new URL(`${SPECIAL_QUERY.test(head) ? 'https://h.invalid/' : 'x-repository://h/'}?${query}#${fragment}`);
+    return [url.search.slice(1), url.hash.slice(1)];
+  } catch { return [query, fragment]; }
+}
+
+// FAA-198 (0.62.0 readings 6 and 7): whether a repository URI carries a credential: in its scheme and authority (a
+// user), in its query or fragment as secretUrl reads them, or as a path segment shaped like a key. A path segment in
+// lower case, or of letters with no digit (task-pipeline-dashboard, Task-Pipeline-Dashboard), is the repository's
+// name, never a key, though it reads as an `sk-` shape, unless a key's shape starts it or follows a `.`, `_` or `-` in
+// it (repositoryName); a segment is read as written and asciiDecoded. A
+// user outside a URL's authority (an scp form, `https:user@host/path`) counts as one: a user is an authority's.
+export function repositoryCredential(value) {
+  if (value.includes('@') && !REPOSITORY_AUTHORITY.test(value)) return true;
+  const match = REPOSITORY_URI.exec(value);
+  if (!match) return secretArgument(value);
+  const [, head, path, tail] = match;
+  const odd = [path, asciiDecoded(path)].flatMap((written) => written.split(/[/\\:]/)).filter((piece) => piece && !repositoryName(piece));
+  if (repositoryPassword(value) || secretArgument(head + tail) || secretArgument(asciiDecoded(head)) || odd.some((piece) => secretArgument(piece))) return true; // the authority decoded too (unit reading 12)
+  return repositoryParts(head, tail).some((part) => [...rawValues(part)].some(([name, values]) =>
+    values.some((raw) => (raw !== '' && credentialName(name)) || secretValue(raw))));
+}

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-service.mjs

@@ -118,6 +118,9 @@ export {
   placementOf,
   remoteOriginProblems,
   portOf,
+  NO_SOURCE_REPOSITORY,
+  namesRepository,
+  sourceRefusal,
   writeDescriptor,
   removeDescriptor,
   dashboardExtensionProblems,

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_auth.py

@@ -36,6 +36,9 @@ from fabric_paths import (
     services_dir,
 )
 from fabric_descriptor import (
+    descriptor_path,
+    names_repository,
+    source_refusal,
     validate_descriptor,
     write_descriptor,
 )
@@ -393,6 +396,15 @@ def register_remote(*, service_id: str, name: str, origin: str, token: str, inst
         descriptor["runner"] = dict(runner)
     if peer is not None:
         descriptor["peer"] = dict(peer)
+    if source is None:  # a rotation that names no source keeps the installed one (0.62.0 seam reading 1)
+        try:
+            installed = json.loads(descriptor_path(service_id, instance, root).read_text(encoding="utf-8")).get("source")
+        except (OSError, ValueError, AttributeError):
+            installed = None
+        # Only one the kit accepts: a hand-edited source never blocks a rotation; it is dropped with the warning.
+        base = set(validate_descriptor(descriptor))
+        source = installed if names_repository({"source": installed}) and set(
+            validate_descriptor(dict(descriptor, source=installed))) <= base else None
     if source is not None:
         descriptor["source"] = dict(source) if isinstance(source, dict) else source
     if doctor:
@@ -400,9 +412,12 @@ def register_remote(*, service_id: str, name: str, origin: str, token: str, inst
     problems = validate_descriptor(descriptor)
     if problems:
         raise ServiceError("Descriptor is invalid: %s." % "; ".join(problems))
+    refusal = source_refusal(descriptor, root)  # before the token is written: a refused install leaves nothing (FAA-198)
+    if refusal:
+        raise ServiceError(refusal)
     ensure_private_dir(token_file.parent)
     atomic_write(token_file, token.strip().encode(), 0o600)
-    return write_descriptor(descriptor, root)
+    return write_descriptor(descriptor, root, _stacklevel=3)  # the warning names the installer's call
 
 
 def cookie_value(cookie_header: Optional[str], name: str = SESSION_COOKIE) -> Optional[str]:

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_descriptor.py

@@ -9,6 +9,7 @@ import os
 import re
 import socketserver
 import subprocess
+import warnings
 from pathlib import Path
 from typing import Any, Dict, List, Optional, Sequence, Tuple
 
@@ -294,7 +295,9 @@ def descriptor_member_problems(descriptor: Dict[str, Any]) -> List[str]:
             problems.append("runner.credentialKind is subscription, key, platform-metered or none")
         if "kind" in runner and not (isinstance(runner["kind"], str) and _RUNNER_KIND_NAME.match(runner["kind"])):
             problems.append("runner.kind is a runner kind's name")
-        if runner.get("credentialKind") == "subscription" and runner.get("kind") not in SUBSCRIPTION_RUNNERS:
+        # a kind that is no string is no runner's (a list would raise as a key: 0.62.0 unit reading 17)
+        if runner.get("credentialKind") == "subscription" and not (isinstance(runner.get("kind"), str)
+                                                                    and runner["kind"] in SUBSCRIPTION_RUNNERS):
             problems.append("a subscription runs only in its vendor's runner: runner.kind claude-code, kimi-code or codex")
         places += [("/runner/%s" % _pointer(k), v) for k, v in runner.items()]
     if "source" in descriptor:
@@ -311,7 +314,10 @@ def descriptor_member_problems(descriptor: Dict[str, Any]) -> List[str]:
                 problems.append("source.repository carries no password: it names the repository, never a credential")
             elif not _authority_ok(repository):
                 problems.append("source.repository names a host, and a port of digits up to 65535 when it has one")
-            places.append(("/source/repository", repository))
+            elif "@" in repository and not _HIERARCHICAL.match(repository):  # 0.62.0 readings 7: never an scp form's user
+                problems.append("source.repository with a user is a URL with an authority (https://user@host/path), never an scp form")
+            elif fabric_secrets.repository_credential(repository):  # its name is no key (0.62.0 seam reading 6)
+                problems.append("FAC-SEM-086: /source/repository holds a value shaped like a credential; it names a repository")
     if "peer" in descriptor:
         peer = descriptor.get("peer")
         if not isinstance(peer, dict):
@@ -434,13 +440,58 @@ def port_of(origin: str) -> int:
     return int(match.group(1))
 
 
-def write_descriptor(descriptor: Dict[str, Any], directory: Optional[Path] = None) -> Path:
-    """Installer-only. Refuses a port or id.instance another descriptor claims (a port is a claim)."""
+NO_SOURCE_REPOSITORY = ("names no source.repository, the repository its code is built from "
+                        "(https://github.com/owner/name): it links the agent to its project (FAA-198)")
+PASS_SOURCE = ("Name it in this call: \"source\": {\"repository\": ...} in the descriptor write_descriptor writes, or "
+               "source= to register_remote; one written after the call returns is too late for a new install.")
+
+
+class NoSourceRepositoryWarning(UserWarning):
+    """FAA-198: an installed descriptor rewritten without source.repository (Node: process.emitWarning, code
+    FABRIC_NO_SOURCE_REPOSITORY). A new install without it is refused instead."""
+
+
+def names_repository(descriptor: Any) -> bool:
+    source = descriptor.get("source") if isinstance(descriptor, dict) else None
+    return isinstance(source, dict) and isinstance(source.get("repository"), str) and bool(source["repository"])
+
+
+_HIERARCHICAL = re.compile(r"\A[A-Za-z][A-Za-z0-9+.-]*://")
+
+
+def source_refusal(descriptor: Dict[str, Any], directory: Optional[Path] = None) -> Optional[str]:
+    """FAA-198: why a new install of this descriptor is refused, or None: it names no source.repository and no
+    descriptor of its id.instance is installed yet (a regular file, whatever it holds; a folder, a broken link or a path
+    that cannot be examined is none). An installer may check it before it validates or writes anything else."""
+    if names_repository(descriptor):
+        return None
+    d = descriptor if isinstance(descriptor, dict) else {}
+    instance = d.get("instance") if d.get("instance") is not None else "default"  # as Node's `??` reads it
+    me = "%s.%s" % (d.get("id"), instance)
+    try:  # an id or instance that is no string names no installed file, in both kits (seam reading 3)
+        if isinstance(d.get("id"), str) and isinstance(instance, str) and descriptor_path(d["id"], instance, directory).is_file():
+            return None
+    except (OSError, ValueError):  # an unsearchable folder reads as not installed, as Node's statSync does
+        pass
+    return "Descriptor %s %s. %s" % (me, NO_SOURCE_REPOSITORY, PASS_SOURCE)
+
+
+def write_descriptor(descriptor: Dict[str, Any], directory: Optional[Path] = None, *, _stacklevel: int = 2) -> Path:
+    """Installer-only. Refuses a port or id.instance another descriptor claims (a port is a claim).
+
+    FAA-198: a new descriptor names its ``source.repository``; rewriting one already installed without it only
+    warns (``NoSourceRepositoryWarning``), so an installed agent's update keeps working."""
     problems = validate_descriptor(descriptor)
     if problems:
         raise ServiceError("Descriptor is invalid: %s." % "; ".join(problems))
     root = directory or services_dir()
     me = "%s.%s" % (descriptor["id"], descriptor["instance"])
+    refusal = source_refusal(descriptor, root)
+    if refusal:
+        raise ServiceError(refusal)
+    if not names_repository(descriptor):
+        warnings.warn("Descriptor %s %s; a new install is refused without it." % (me, NO_SOURCE_REPOSITORY),
+                      NoSourceRepositoryWarning, stacklevel=_stacklevel)
     # DEC-0019: only a local placement claims a port on this computer; DEC-0069: an app's descriptor names none.
     port = None if placement_of(descriptor) == "remote" or "origin" not in descriptor else port_of(descriptor["origin"])
     for path, other in read_descriptors(root):

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_http.py

@@ -157,6 +157,11 @@ def redact_url(url: str) -> str:
     # then remove every tab, CR and LF, so ` https://u:pw@h` and `ht\ttps:u:pw@h` lose their password too (0.56.0
     # seam r10; Python 3.9's urlsplit keeps a leading space in the scheme).
     url = re.sub(r"[\t\n\r]", "", str(url).strip("".join(map(chr, range(0x21)))))
+    # The user information as written goes first, as git and urllib read it, where WHATWG reads a backslash as a slash:
+    # `https://h\\u:pw@x/r` would print `pw` in its path (0.62.0 seam reading 11). The Node twin does the same.
+    written = re.match(r"([A-Za-z][A-Za-z0-9+.-]*:[/\\]*)([^/?#]*)", url)  # after any run of slashes (seam reading 13)
+    if written and "@" in written.group(2):
+        url = written.group(1) + written.group(2).rpartition("@")[2] + url[written.end():]
     scheme, colon, rest = url.partition(":")
     if colon and scheme.lower() in ("http", "https", "ws", "wss", "ftp"):
         # A special scheme as WHATWG reads it: the authority starts after every slash or backslash that follows the

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_secrets.py

@@ -185,3 +185,60 @@ def secret_url(value: str) -> bool:
             if any((raw != "" and credential_name(name)) or secret_value(raw) for raw in raws):
                 return True
     return False
+
+
+_REPOSITORY_URI = re.compile(r"\A([A-Za-z][A-Za-z0-9+.-]*:(?://[^/?#]*)?)([^?#]*)(.*)\Z", re.S)
+_REPOSITORY_NAME = re.compile(r"(?:[a-z0-9._-]+|[A-Za-z._-]+)\Z")  # lower case, or letters with no digit (readings 8)
+_REPOSITORY_AUTHORITY = re.compile(r"[A-Za-z][A-Za-z0-9+.-]*://")
+_KEY_AT_A_WORD = re.compile(r"(?:\A|(?<=[._-]))(?:%s)" % SECRET_VALUE.pattern, re.IGNORECASE | re.ASCII)
+_JWT_AT_A_WORD = re.compile(r"(?:\A|(?<=[._-]))%s" % JWT_SHAPE.pattern)
+
+
+def repository_name(piece: str) -> bool:
+    """Whether a path segment reads as a repository's name: lower case, or letters with no digit, with no provider
+    key's or JWT's shape (`sk-`, `ghp_`, `xoxb-`, `AKIA`, `eyJ`) at its start or after a `.`, `_` or `-` (0.62.0
+    readings 9 and 10), so a letters-only key is still a key while `task-pipeline-dashboard`, which holds an `sk-` shape
+    inside a word, is a name."""
+    return bool(_REPOSITORY_NAME.match(piece)) and not _KEY_AT_A_WORD.search(piece) and not _JWT_AT_A_WORD.search(piece)
+
+
+def ascii_decoded(text: str) -> str:
+    """Every `%XX` escape of an ASCII character decoded, the rest left as written: how a repository's path and user
+    information are read as well as written, since git and hosts decode them (`%73k-` is `sk-`, `u%3Apw` is `u:pw`;
+    0.62.0 readings 11). The Node twin is asciiDecoded."""
+    return re.sub(r"%([0-7][0-9A-Fa-f])", lambda escape: chr(int(escape.group(1), 16)), text)
+
+
+def repository_password(value: str) -> bool:
+    """Whether a repository URI's user information holds a password, in any scheme, `file` too: every slash and
+    backslash after the colon skipped, then up to the next `/`, `?` or `#`, a backslash kept in the user. That one
+    reading holds git's (`https://h\\u:pw@x/r`), curl's (`https:///h\\u:pw@x`) and the URL standard's
+    (`https:///u:pw@h`, which stops at a backslash, a prefix of it) (0.62.0 readings 10 to 14). The user information
+    ends at the last `@`; a password follows its first `:`, as written or ascii_decoded. The Node twin is
+    repositoryPassword."""
+    value = re.sub(r"[\t\n\r]", "", value.strip(_C0_OR_SPACE))
+    scheme, colon, rest = value.partition(":")
+    authorities = [re.match(r"[^/?#]*", rest.lstrip("/\\")).group(0)] if colon else []
+    users = [authority.rpartition("@")[0] for authority in authorities]
+    return any(user.partition(":")[2] for user in users + [ascii_decoded(user) for user in users])
+
+
+def repository_credential(value: str) -> bool:
+    """FAA-198 (0.62.0 readings 6 and 7): whether a repository URI carries a credential: in its scheme and authority (a
+    user), in its query or fragment as secret_url reads them, or as a path segment shaped like a key. A path segment in
+    lower case, or of letters with no digit (task-pipeline-dashboard, Task-Pipeline-Dashboard), is the repository's
+    name, never a key, though it reads as an `sk-` shape, unless a key's shape starts it or follows a `.`, `_` or `-` in
+    it (repository_name); a segment is read as written and ascii_decoded. A
+    user outside a URL's authority (an scp form, `https:user@host/path`) counts as one: a user is an authority's."""
+    if "@" in value and not _REPOSITORY_AUTHORITY.match(value):
+        return True
+    match = _REPOSITORY_URI.match(value)
+    if not match:
+        return secret_argument(value)
+    head, path, tail = match.groups()
+    if repository_password(value):
+        return True
+    odd = [piece for written in (path, ascii_decoded(path)) for piece in re.split(r"[/\\:]", written)
+           if piece and not repository_name(piece)]
+    # the scheme and authority decoded too: git sends `https://%67hp_...@h` with its user decoded (unit reading 12)
+    return secret_url(head + tail) or secret_argument(ascii_decoded(head)) or any(secret_argument(piece) for piece in odd)

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_service.py

@@ -231,6 +231,10 @@ from fabric_descriptor import (  # noqa: F401
     placement_of,
     remote_origin_problems,
     port_of,
+    NO_SOURCE_REPOSITORY,
+    NoSourceRepositoryWarning,
+    names_repository,
+    source_refusal,
     write_descriptor,
     remove_descriptor,
     build_info,