@passioncode-ai/fabric-agent-adapter 0.8.0 → 0.8.1

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 0.8.1 - 2026-10-08
+
+The contract pin moves to Fabric Agent Contract `main` `623bf61` (DEC-0025 through DEC-0031); bundles issued
+under the DEC-0024, DEC-0021, DEC-0020 and DEC-0019 revisions stay valid. And a fix for `Mcp-Name` values outside
+plain ASCII.
+
+### Changed
+
+- **Default contract pin `23f9fda4` → `623bf61358c339cb10297807b3f024b5d9f1f327`** (FAA-14). `23f9fda4` (DEC-0024)
+  joins `SUPPORTED_CONTRACT_COMMITS`. The revisions between add only optional surfaces: settings backups and the
+  feed token header (DEC-0025), runner routes (DEC-0026, DEC-0029), spending limits in the usage report
+  (DEC-0027), activity telemetry (DEC-0030) and devices (DEC-0031). The kits emit none of them yet, which stays
+  valid; adopting DEC-0025 and DEC-0027 is FAA-13, runner routes FAA-11. Checked: `npm test`; both compiled-schema
+  arms against clean checkouts at `2ce3922` and `623bf61` (11/11); a kit usage report validates against the new
+  `service-usage.schema.json`.
+
+### Fixed
+
+- **`Mcp-Name` values outside plain ASCII follow the spec's Base64 sentinel.** MCP 2026-07-28
+  Streamable HTTP ("Value Encoding") requires a name or URI with non-ASCII characters, control
+  characters, leading or trailing spaces, or the sentinel's own shape to travel as
+  `=?base64?<UTF-8 base64>?=`, and a server to decode it before comparing it with the body. Both kits
+  sent the raw value and compared the raw header, so such a call was refused by a conforming server
+  and a conforming client was refused by ours. `encode_header_value` / `encodeHeaderValue` and
+  `decode_header_value` / `decodeHeaderValue` now do both; a malformed sentinel or a raw non-ASCII
+  header is refused as `-32020`. Tested with the spec's own five examples in both kits. This is the
+  part of PR #24 that FAA-08 had not already shipped.
+
 ## 0.8.0 - 2026-10-04
 
 Agents report what they spend (Fabric Agent Contract DEC-0021), and a service may keep its MCP

package/COMMERCIAL-LICENSE.md

@@ -5,7 +5,7 @@ This repository is open source under the [GNU Affero General Public License v3.0
 meet the AGPL's terms — for example inside a closed-source product, or as a modified hosted
 service whose source is not published.
 
-To obtain a commercial license, write to **contact@passioncode.ai**.
+To obtain a commercial license, tell us about your use at **https://passioncode.ai/business/**, or write to **commercial@passioncode.ai**.
 
 SPDX: `AGPL-3.0-only OR LicenseRef-PassionCode-Commercial`. Copyright (c) 2026 Siarhei Sheleh.
 Contributions are accepted under [CLA.md](CLA.md), which allows this dual licence.

package/README.md

@@ -191,7 +191,7 @@ Scaffolding is non-destructive by default. It writes only the paths declared in
 The default pin for new bundles is [`fabric-contract.lock.json`](fabric-contract.lock.json):
 
 - version: `0.1.0`
-- commit: `23f9fda4c05f8a3852246ee98d4f2adf74ed0875`
+- commit: `623bf61358c339cb10297807b3f024b5d9f1f327`
 
 Every other mention of the default contract revision — this section, the skills' metadata, the
 skill card, `adapt_project.py` — must equal it; `python3 test/validate.py` fails a tree
@@ -218,13 +218,13 @@ FABRIC_CONTRACT_OLD=/path/to/legacy-contract FABRIC_CONTRACT_NEW=/path/to/curren
 ```
 
 Without both environment variables, those tests explicitly skip as `NOT_RUN`.
-This source checkout is 0.8.0 pending release (0.7.0 was never released); the verified published GitHub/npm version
-on 2026-10-04 is 0.6.3. Source delivery does not update installed skills or live sessions.
+This source checkout is 0.8.1. 0.8.0 is the latest published GitHub/npm release (2026-10-05; 0.7.0 was never
+released); 0.8.1 is published by its `v0.8.1` tag. Source delivery does not update installed skills or live sessions.
 
 ## License
 
 Open source under the [GNU AGPL-3.0](LICENSE). A [commercial license](COMMERCIAL-LICENSE.md) is
-available for use that does not meet the AGPL's terms — contact@passioncode.ai.
+available for use that does not meet the AGPL's terms — [passioncode.ai/business](https://passioncode.ai/business/).
 Versions before 0.5.3 were released under PolyForm Noncommercial or Internal Use (v0.4.3 to
 v0.5.2) and MIT (v0.4.2 and earlier); each keeps the licence it was released under.
 Contributions are accepted under [CLA.md](CLA.md) ([CONTRIBUTING.md](CONTRIBUTING.md)).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/fabric-agent-adapter",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Create Fabric-compatible agents, run them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract. This package is the installer CLI.",
   "scripts": {
     "test": "python3 test/validate.py && python3 -m unittest discover -s test -q && node --test 'test/*.test.mjs'"

package/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles.",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,9 +5,9 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.8.0"
+  version: "0.8.1"
   contract-version: "0.1.0"
-  contract-commit: "23f9fda4c05f8a3852246ee98d4f2adf74ed0875"
+  contract-commit: "623bf61358c339cb10297807b3f024b5d9f1f327"
 ---
 
 # Adapting projects to Fabric
@@ -70,7 +70,7 @@ Use exactly:
 
 - contract version `0.1.0`;
 - repository `https://github.com/passioncode-ai/fabric-agent-contract`;
-- commit `23f9fda4c05f8a3852246ee98d4f2adf74ed0875`.
+- commit `623bf61358c339cb10297807b3f024b5d9f1f327`.
 
 This is the default for new bundles. When checking an issued legacy bundle, preserve its
 explicit supported lock and use that exact clean checkout. Never silently upgrade or

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/adapt_project.py

@@ -16,10 +16,10 @@ from urllib.parse import urlparse
 
 CONTRACT_VERSION = "0.1.0"
 CONTRACT_REPOSITORY = "https://github.com/passioncode-ai/fabric-agent-contract"
-CONTRACT_COMMIT = "23f9fda4c05f8a3852246ee98d4f2adf74ed0875"
+CONTRACT_COMMIT = "623bf61358c339cb10297807b3f024b5d9f1f327"
 # #region supported-contract-revisions — docs: README.md#contract-pin
 # Only this declaration may name a legacy revision in live files.
-SUPPORTED_CONTRACT_COMMITS = (CONTRACT_COMMIT, "9091d3d6606b0c4b5591a38c3674356a01fd7f55", "df55c8c54a23251342a7ee57ba95642b7eb39e61", "2ce392291c6668598d12cd38327e24696b5ca15c")
+SUPPORTED_CONTRACT_COMMITS = (CONTRACT_COMMIT, "23f9fda4c05f8a3852246ee98d4f2adf74ed0875", "9091d3d6606b0c4b5591a38c3674356a01fd7f55", "df55c8c54a23251342a7ee57ba95642b7eb39e61", "2ce392291c6668598d12cd38327e24696b5ca15c")
 # #endregion supported-contract-revisions
 INTEROP_KEY = "https://fabric.passioncode.ai/agent-contract/extensions/interop/0.1"
 MCP_REVISION = "2026-07-28"

package/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -16,10 +16,10 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits; the probe needs Python 3.9+. launchd steps are macOS-only (Linux services use lifecycle manager none until a systemd adapter exists). Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.8.0"
+  version: "0.8.1"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
-  extension-commit: "23f9fda4c05f8a3852246ee98d4f2adf74ed0875"
+  extension-commit: "623bf61358c339cb10297807b3f024b5d9f1f327"
 ---
 
 # Building Fabric services

package/plugins/fabric-agent-adapter/skills/building-fabric-services/references/protocol.md

@@ -1,6 +1,6 @@
 # fabric-service/0.1 — wire reference
 
-Pinned to `fabric-agent-contract` commit `23f9fda4c05f8a3852246ee98d4f2adf74ed0875`
+Pinned to `fabric-agent-contract` commit `623bf61358c339cb10297807b3f024b5d9f1f327`
 (`docs/specification/service.md`, DEC-0015; the usage report DEC-0021). The contract's schemas are normative;
 this page is the working summary. Extension key:
 `https://fabric.passioncode.ai/agent-contract/extensions/service/0.1`.

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-interop.mjs

@@ -226,6 +226,37 @@ export class JobStore {
 export const NAMED_METHODS = { 'tools/call': 'name', 'prompts/get': 'name', 'resources/read': 'uri' };
 export const HEADER_MISMATCH = -32020; // the code the official 2026-07-28 server SDK answers a header/body mismatch with
 
+const SENTINEL = ['=?base64?', '?='];
+
+/**
+ * A body value as an HTTP header value, by MCP 2026-07-28 Streamable HTTP "Value Encoding": as it
+ * is when it is printable ASCII without leading or trailing whitespace, otherwise — and for a plain
+ * value that itself looks like the sentinel — `=?base64?<base64 of its UTF-8>?=`.
+ */
+export function encodeHeaderValue(value) {
+  const s = String(value);
+  const plain = /^[\x20-\x7e]*$/.test(s) && s === s.replace(/^ +| +$/g, '') && !(s.startsWith(SENTINEL[0]) && s.endsWith(SENTINEL[1]));
+  if (plain) return s;
+  let binary = '';
+  for (const byte of new TextEncoder().encode(s)) binary += String.fromCharCode(byte);
+  return SENTINEL[0] + btoa(binary) + SENTINEL[1];
+}
+
+/** The body value a header carries, decoding the Base64 sentinel; null for invalid characters or a
+ *  sentinel that is not valid Base64 of UTF-8 (a server rejects both). */
+export function decodeHeaderValue(value) {
+  const s = String(value);
+  if (s.startsWith(SENTINEL[0]) && s.endsWith(SENTINEL[1]) && s.length >= SENTINEL[0].length + SENTINEL[1].length) {
+    const body = s.slice(SENTINEL[0].length, -SENTINEL[1].length);
+    if (body.length % 4 !== 0 || !/^[A-Za-z0-9+/]*={0,2}$/.test(body)) return null;
+    try {
+      const bytes = Uint8Array.from(atob(body), (c) => c.charCodeAt(0));
+      return new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+    } catch { return null; }
+  }
+  return /^[\x20-\x7e\t]*$/.test(s) ? s : null;
+}
+
 /**
  * MCP 2026-07-28 Streamable HTTP mirrors the body in `Mcp-Method` (every request and
  * notification) and `Mcp-Name` (`params.name` or `params.uri` of tools/call, prompts/get,
@@ -250,7 +281,11 @@ export function mcpHeaderProblem(message, headers) {
   if (field) {
     const named = header('Mcp-Name');
     if (named === null && declared) return `the body carries params.${field} but the required Mcp-Name header is absent`;
-    if (named !== null && named !== String(message.params?.[field])) return `Mcp-Name disagrees with the body's params.${field}`;
+    if (named !== null) {
+      const decoded = decodeHeaderValue(named);
+      if (decoded === null) return 'Mcp-Name is malformed: invalid characters or a broken =?base64?…?= value';
+      if (decoded !== String(message.params?.[field])) return `Mcp-Name disagrees with the body's params.${field}`;
+    }
   }
   return null;
 }
@@ -259,6 +294,6 @@ export function mcpHeaderProblem(message, headers) {
 export function mcpRequestHeaders(method, params = {}) {
   const out = { 'MCP-Protocol-Version': MCP_REVISION, 'Mcp-Method': method };
   const field = NAMED_METHODS[method];
-  if (field && params[field] !== undefined && params[field] !== null) out['Mcp-Name'] = String(params[field]);
+  if (field && params[field] !== undefined && params[field] !== null) out['Mcp-Name'] = encodeHeaderValue(params[field]);
   return out;
 }

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_interop.py

@@ -17,6 +17,7 @@ Normative source: fabric-agent-contract docs/specification/interop.md (DEC-0016,
 
 from __future__ import annotations
 
+import base64
 import json
 from pathlib import Path
 import re
@@ -386,6 +387,33 @@ NAMED_METHODS = {"tools/call": "name", "prompts/get": "name", "resources/read":
 HEADER_MISMATCH = -32020  # the code the official 2026-07-28 server SDK answers a header/body mismatch with
 
 
+_SENTINEL = ("=?base64?", "?=")
+
+
+def encode_header_value(value: str) -> str:
+    """A body value as an HTTP header value, by MCP 2026-07-28 Streamable HTTP "Value Encoding": as
+    it is when it is printable ASCII without leading or trailing whitespace, otherwise — and for a
+    plain value that itself looks like the sentinel — `=?base64?<base64 of its UTF-8>?=`."""
+    plain = (all(0x20 <= ord(c) <= 0x7E for c in value) and value == value.strip(" ")
+             and not (value.startswith(_SENTINEL[0]) and value.endswith(_SENTINEL[1])))
+    if plain:
+        return value
+    return _SENTINEL[0] + base64.b64encode(value.encode("utf-8")).decode("ascii") + _SENTINEL[1]
+
+
+def decode_header_value(value: str) -> Optional[str]:
+    """The body value a header carries, decoding the Base64 sentinel; None for a header value with
+    invalid characters or a sentinel that is not valid Base64 of UTF-8 (a server rejects both)."""
+    if value.startswith(_SENTINEL[0]) and value.endswith(_SENTINEL[1]) and len(value) >= len(_SENTINEL[0]) + len(_SENTINEL[1]):
+        try:
+            return base64.b64decode(value[len(_SENTINEL[0]):-len(_SENTINEL[1])], validate=True).decode("utf-8")
+        except ValueError:  # binascii.Error and UnicodeDecodeError are both ValueErrors
+            return None
+    if any(not (0x20 <= ord(c) <= 0x7E or c == "\t") for c in value):
+        return None
+    return value
+
+
 def mcp_header_problem(message: Any, headers: Any) -> Optional[str]:
     """MCP 2026-07-28 Streamable HTTP mirrors the body in `Mcp-Method` (every request and
     notification) and `Mcp-Name` (`params.name` or `params.uri` of tools/call, prompts/get,
@@ -414,8 +442,12 @@ def mcp_header_problem(message: Any, headers: Any) -> Optional[str]:
         named = header("Mcp-Name")
         if named is None and declared:
             return "the body carries params.%s but the required Mcp-Name header is absent" % field
-        if named is not None and named != str(value):
-            return "Mcp-Name disagrees with the body's params.%s" % field
+        if named is not None:
+            decoded = decode_header_value(named)
+            if decoded is None:
+                return "Mcp-Name is malformed: invalid characters or a broken =?base64?…?= value"
+            if decoded != str(value):
+                return "Mcp-Name disagrees with the body's params.%s" % field
     return None
 
 
@@ -424,7 +456,7 @@ def mcp_request_headers(method: str, params: Dict[str, Any]) -> Dict[str, str]:
     out = {"MCP-Protocol-Version": MCP_REVISION, "Mcp-Method": method}
     field = NAMED_METHODS.get(method)
     if field and params.get(field) is not None:
-        out["Mcp-Name"] = str(params[field])
+        out["Mcp-Name"] = encode_header_value(str(params[field]))
     return out
 
 

package/plugins/fabric-agent-adapter/skills/creating-fabric-agents/SKILL.md

@@ -5,9 +5,9 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode. Ships in one plugin with adapting-projects-to-fabric, whose scripts it reuses.
 metadata:
   author: PassionCode.ai
-  version: "0.8.0"
+  version: "0.8.1"
   contract-version: "0.1.0"
-  contract-commit: "23f9fda4c05f8a3852246ee98d4f2adf74ed0875"
+  contract-commit: "623bf61358c339cb10297807b3f024b5d9f1f327"
 ---
 
 # Creating Fabric-compatible agents
@@ -119,7 +119,7 @@ python3 <plugin-dir>/skills/adapting-projects-to-fabric/scripts/adapt_project.py
   --schema-base <immutable-base-uri>
 ```
 
-Pin exactly contract `0.1.0` at commit `23f9fda4c05f8a3852246ee98d4f2adf74ed0875` and
+Pin exactly contract `0.1.0` at commit `623bf61358c339cb10297807b3f024b5d9f1f327` and
 read the pinned guide before implementing protocol details. If this skill is installed
 without its sibling, the scaffolder is absent: create the bundle by hand from the pinned
 contract's `docs/guides/connecting-compatible-agents.md` and mark the structural check