@passioncode-ai/fabric-agent-adapter 0.72.0 → 0.74.0

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-supervisors.mjs

@@ -9,6 +9,8 @@ import { DRAIN_SECONDS, SUPERVISOR_ENV, ServiceError, TASK, UNIT } from './fabri
 import { atomicWrite, instanceDirs } from './fabric-paths.mjs';
 import { SUPERVISOR_ARG, markerArguments } from './fabric-lock.mjs';
 import { URI } from './fabric-backups.mjs';
+import { CheckedAgent, ListenerRefused } from './fabric-peer-owner.mjs';
+import http from 'node:http';
 
 export const DEFAULT_EXIT_TIMEOUT = 15;
 
@@ -316,13 +318,41 @@ export function launchdOverride(label, { run = defaultRun, platform = process.pl
   return null;
 }
 
-async function wellKnownOf(origin) {
-  try {
-    const response = await fetch(`${origin}/.well-known/fabric-service`, { signal: AbortSignal.timeout(2000) });
-    return response.ok ? await response.json() : null;
-  } catch {
-    return null;
+// A refused listener, as the installer's poll sees it: never a document, whatever keys a service's JSON carries.
+export class ForeignUserAnswer {
+  constructor(reason) { this.reason = reason; }
+}
+
+// The well-known answer at a loopback origin, read only on a connection whose server end is this OS account's process
+// (DEC-0154 HA-2): null when nothing answers or the answer is not JSON, a ForeignUserAnswer when the listener is another
+// account's or its owner cannot be told.
+export async function wellKnownOf(origin) {
+  const m = /^http:\/\/127\.0\.0\.1:([0-9]{1,5})$/.exec(origin);
+  if (!m) {
+    try {
+      const response = await fetch(`${origin}/.well-known/fabric-service`, { signal: AbortSignal.timeout(2000) });
+      return response.ok ? await response.json() : null;
+    } catch {
+      return null;
+    }
   }
+  // A CheckedAgent without keep-alive: the request goes on the very socket it checked, and the socket closes after the
+  // answer, so a poll leaves no connection open behind it.
+  const agent = new CheckedAgent({ keepAlive: false });
+  return new Promise((resolve) => {
+    const req = http.request({ host: '127.0.0.1', port: Number(m[1]), path: '/.well-known/fabric-service', agent,
+      timeout: 2000 }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        try { resolve(res.statusCode === 200 ? JSON.parse(Buffer.concat(chunks).toString('utf8')) : null); } catch { resolve(null); }
+      });
+      res.on('error', () => resolve(null));
+    });
+    req.on('timeout', () => req.destroy());
+    req.on('error', (err) => resolve(err instanceof ListenerRefused ? new ForeignUserAnswer(`foreign-user: ${err.message}`) : null));
+    req.end();
+  }).finally(() => agent.destroy());
 }
 
 /**
@@ -359,11 +389,17 @@ export async function launchdInstall(label, plistPath, plistText, { origin, serv
     await sleep(1000);
   }
   const deadline = Date.now() + timeout * 1000;
+  let foreign = null;
   while (Date.now() < deadline) {
     const doc = await fetchWellKnown(origin);
-    if (doc?.service?.id === serviceId && doc?.service?.instance === instance) return doc;
+    foreign = doc instanceof ForeignUserAnswer ? doc.reason : null;
+    if (!foreign && doc?.service?.id === serviceId && doc?.service?.instance === instance) return doc;
     await sleep(500);
   }
+  // DEC-0154 HA-2 and service.md's Install row: a listener of another account is never a successful install.
+  if (foreign) {
+    throw new ServiceError(`${origin} is not this service's: ${foreign} (DEC-0154 HA-2); the port is another OS account's or its owner cannot be told.`);
+  }
   throw new ServiceError(`${origin} did not answer as ${serviceId}.${instance} within ${timeout} s; read its log.`);
 }
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_http.py

@@ -19,6 +19,10 @@ Rules (FAA-65 REQ-06):
 - **Secrets.** A plain `http://` URL is refused unless the host is loopback or `insecure=True`: a bearer token never
   crosses a network in clear. An error names the method and the URL without its userinfo, query and fragment
   (`redact_url`); it never carries a request header or a request body.
+- **A loopback server is this account's** (DEC-0154 HA-2, FAA-226). Before a byte goes to a plain `http://` loopback
+  URL, the server end of the connection is told from the computer's socket table (`fabric_peer_owner`): another OS
+  account's, root's or SYSTEM's process, or one whose owner cannot be told, is `HttpError` of kind `foreign-user`,
+  nothing sent and never retried.
 
 The transport is injected in tests: `transport(method, url, headers, body, timeout_s, max_bytes)` returns
 `(status, headers, body_bytes)` or raises `OSError` (a connection error, `TimeoutError` included) or `HttpError`.
@@ -45,6 +49,7 @@ from pathlib import Path as _Path  # noqa: E402
 if str(_Path(__file__).resolve().parent) not in _sys.path:  # the kit loads from any working directory (FAA-65)
     _sys.path.insert(0, str(_Path(__file__).resolve().parent))
 from fabric_jsvalue import json_stringify  # noqa: E402 - beside this file
+import fabric_peer_owner as _po  # noqa: E402 - beside this file: the listener's owner (DEC-0154 HA-2)
 
 RETRY_STATUSES = (408, 425, 429, 500, 502, 503, 504)
 IDEMPOTENT_METHODS = ("GET", "HEAD", "OPTIONS", "PUT", "DELETE")
@@ -66,7 +71,7 @@ class HttpError(Exception):
         self.attempts = attempts
         self.retry_after_s = retry_after_s
         self.body = bytes(body[:2048])
-        self.kind = kind  # http (an answer), connection, timeout, too-large, refused
+        self.kind = kind  # http (an answer), connection, timeout, too-large, refused, foreign-user
 
 
 class Response:
@@ -340,14 +345,30 @@ def _watched(base: type, watchdog: _Watchdog) -> type:
     return Watched
 
 
-def _opener(watchdog: _Watchdog) -> urllib.request.OpenerDirector:
+class _CheckedHTTPConnection(_po.CheckedHTTPConnection):
+    """Plain http to a loopback host (DEC-0154 HA-2): `fabric_peer_owner.CheckedHTTPConnection`, whose every connect, a
+    reconnect included, tells the server end's owner and refuses (closed, nothing sent) unless it is this OS account's
+    process, built the way urllib builds a connection (`host` as `host:port`, `timeout` by keyword)."""
+
+    def __init__(self, host: str, port: Optional[int] = None, timeout: Any = socket._GLOBAL_DEFAULT_TIMEOUT,
+                 **kwargs: Any) -> None:
+        http.client.HTTPConnection.__init__(self, host, port, timeout=timeout, **kwargs)
+        self.expect_pid = None
+
+
+def _opener(watchdog: _Watchdog, direct: bool = False) -> urllib.request.OpenerDirector:
+    """`direct`: a loopback URL never goes through a proxy from the environment (`http_proxy`), so the connection the
+    owner check reads is the one to the URL's own port (DEC-0154 HA-2), and a bearer never reaches a proxy."""
     class Http(urllib.request.HTTPHandler):
         def http_open(self, req):
-            return self.do_open(_watched(http.client.HTTPConnection, watchdog), req)
+            local = _is_loopback((urllib.parse.urlsplit(req.full_url).hostname or "").lower())
+            return self.do_open(_watched(_CheckedHTTPConnection if local else http.client.HTTPConnection, watchdog), req)
 
     class Https(urllib.request.HTTPSHandler):
         def https_open(self, req):
             return self.do_open(_watched(http.client.HTTPSConnection, watchdog), req, context=self._context)
+    if direct:
+        return urllib.request.build_opener(urllib.request.ProxyHandler({}), _NoRedirect, Http, Https)
     return urllib.request.build_opener(_NoRedirect, Http, Https)
 
 
@@ -361,6 +382,9 @@ def urllib_transport(method: str, url: str, headers: Dict[str, str], body: Optio
     watchdog = _Watchdog(end)
     try:
         return _send(req, timeout_s, max_bytes, end, watchdog)
+    except _po.ListenerRefused as exc:
+        where = "%s %s" % (method, redact_url(url))
+        raise HttpError("%s: foreign-user: %s" % (where, exc), url=redact_url(url), kind="foreign-user") from None
     except (OSError, http.client.HTTPException) as exc:
         if watchdog.fired:
             raise TimeoutError("the answer did not arrive within the deadline")
@@ -372,7 +396,8 @@ def urllib_transport(method: str, url: str, headers: Dict[str, str], body: Optio
 def _send(req: urllib.request.Request, timeout_s: float, max_bytes: int, end: float,
           watchdog: _Watchdog) -> Tuple[int, Dict[str, str], bytes]:
     try:
-        resp = _opener(watchdog).open(req, timeout=timeout_s)
+        resp = _opener(watchdog, direct=_is_loopback((urllib.parse.urlsplit(req.full_url).hostname or "").lower())).open(
+            req, timeout=timeout_s)
     except urllib.error.HTTPError as answer:  # a status outside 2xx is an answer, not a failure of the transport
         resp = answer
     except urllib.error.URLError as exc:

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_hub.py

@@ -9,6 +9,9 @@ hub, and this module does exactly those, standard library only:
    FIFO; protocol `fabric-hub/0.1`; the origin exactly `http://127.0.0.1:<port>`; MCP at `/mcp`; a door token file
    inside the registry root; and a `pid` that is alive. The port does not prove who holds it: while Fabric is down any
    program can listen there, so a binding credential is sent only after this check passes, re-done before each send.
+   The pid is never the proof (DEC-0154 HA-2): every connection to the door is checked from the computer's socket table
+   before a byte goes out, and a listener of another OS account, or one whose owner cannot be told, is
+   `HubError("foreign-user")` with nothing sent (`fabric_peer_owner`).
 2. **Ask once, keep the credential in a file.** `request_board_access()` asks the operator through the door for the
    `board.respond` grant (callee `fabric`, resources `board:<project>/<capability>`); `poll_access()` writes the binding
    credential, shown once, to a 0600 file and returns the status without it. Tokens live in files and headers only:
@@ -21,7 +24,7 @@ hub, and this module does exactly those, standard library only:
 When Fabric is down every call raises `HubError` with `retryable=True`; `Backoff` gives the bounded, jittered wait a
 loop sleeps before trying again (2 s doubling to 5 minutes), so nothing spins.
 
-fabric-hub/0.1 publishes no hub key, so the door is trusted by the pid check alone. If a later `hub.json` names
+fabric-hub/0.1 publishes no hub key; the door is trusted once its listener is this OS account's. If a later `hub.json` names
 `hubKey {kid, x}` and the caller passes an estate record (DEC-0055), `locate_hub(estate=…)` checks it with
 `fabric_estate.hub_key_certified` and refuses with DEC-0060's own detail (`kid-not-certified`, `estate-outside-window`,
 `estate-rolled-back`, `estate-forked`, `estate-unreadable`, `no-clock`)."""
@@ -40,6 +43,7 @@ from typing import Any, Callable, Dict, List, Optional, Sequence, Tuple
 
 sys.path.insert(0, str(Path(__file__).resolve().parent))
 import fabric_service as _fs  # noqa: E402 - beside this file: token files, atomic writes
+import fabric_peer_owner as _po  # noqa: E402 - DEC-0154 HA-2: the hub's listener is this OS account's before a bearer
 
 HUB_PROTOCOL = "fabric-hub/0.1"
 MCP_PROTOCOL_VERSION = "2025-06-18"
@@ -51,7 +55,7 @@ CAPABILITY = re.compile(r"[a-z][a-z0-9._-]{1,127}")
 
 
 class HubError(Exception):
-    """A typed refusal or fault: `code` (`not-running`, `not-a-hub`, `hub-unavailable`, `credential`, `protocol`,
+    """A typed refusal or fault: `code` (`not-running`, `not-a-hub`, `hub-unavailable`, `foreign-user`, `credential`, `protocol`,
     `hub-key-refused`, or the hub tool's own code such as `not_authorized`), a one-sentence `message`, `retryable`, and
     `data` (never a secret). `str()` is the sentence."""
 
@@ -210,7 +214,9 @@ def post_mcp(origin: str, body: Dict[str, Any], bearer: str, session: Optional[s
              method: str = "POST", protocol_version: Optional[str] = None) -> Tuple[int, Dict[str, str], Any]:
     """One MCP request to `<origin>/mcp` with a bearer in the header. Only `http://127.0.0.1:<port>` is accepted; no
     proxy is consulted. Answers (status, lower-cased headers, parsed JSON or None); an SSE answer is read to its first
-    `data:` line. A refused connection is `HubError("hub-unavailable", retryable=True)`."""
+    `data:` line. A refused connection is `HubError("hub-unavailable", retryable=True)`; a listener that is not this OS
+    account's process is `HubError("foreign-user", retryable=True)` before the bearer is sent (DEC-0154 HA-2): Fabric
+    may come back on its port, and every retry checks again."""
     match = LOOPBACK_ORIGIN.fullmatch(origin)
     if not match:
         raise HubError("not-a-hub", "Only the hub's loopback origin is used.")
@@ -220,12 +226,15 @@ def post_mcp(origin: str, body: Dict[str, Any], bearer: str, session: Optional[s
         headers["mcp-session-id"] = session
     if protocol_version:
         headers["mcp-protocol-version"] = protocol_version
-    conn = http.client.HTTPConnection("127.0.0.1", int(match.group(1)), timeout=timeout)
+    conn = _po.CheckedHTTPConnection("127.0.0.1", int(match.group(1)), timeout=timeout)
     try:
         conn.request(method, "/mcp", body=None if method == "DELETE" else json.dumps(body).encode(), headers=headers)
         resp = conn.getresponse()
         raw = resp.read(4 * 1024 * 1024)
         got = {k.lower(): v for k, v in resp.getheaders()}
+    except _po.ListenerRefused as exc:
+        raise HubError("foreign-user", "The hub's port is not held by this OS account's process (%s); nothing was sent."
+                       % (exc.owner.kind if exc.owner else exc.code), True) from None
     except (OSError, http.client.HTTPException) as exc:
         raise HubError("hub-unavailable", "Fabric's hub did not answer (%s)." % exc.__class__.__name__, True) from None
     finally: