@passioncode-ai/fabric-agent-adapter 0.80.2 → 0.82.0

package/plugins/fabric-agent-adapter/skills/creating-fabric-agents/schemas/template/connections.schema.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/passioncode-ai/fabric-agent-adapter/schemas/template/connections.schema.json",
+  "title": "connections.json of an agent template: the source classes it reads and writes, each with its connector and grant",
+  "type": "array",
+  "items": {
+    "type": "object",
+    "required": ["source_class", "connector", "grant", "required", "direction"],
+    "additionalProperties": false,
+    "properties": {
+      "source_class": {"type": "string", "minLength": 1, "description": "a class of source (a tracker, a chat, a store), never one installation"},
+      "connector": {"type": "string", "minLength": 1},
+      "grant": {"type": "string", "minLength": 1, "description": "the grant or scope it needs, by name; never a value"},
+      "required": {"type": "boolean"},
+      "when": {"type": "string", "minLength": 1, "description": "the condition under which an optional connection is needed, or under which a required one applies"},
+      "direction": {"enum": ["read", "write", "read-write", "call"]},
+      "scope": {"type": "string", "minLength": 1, "description": "what the direction covers, in words (\"draft pull requests only\")"},
+      "spends": {"type": "boolean", "description": "true when a call through it costs money (rule A6)"},
+      "variants": {"type": "array", "items": {"type": "string"}, "minItems": 1, "uniqueItems": true},
+      "notes": {"type": "string"}
+    }
+  }
+}

package/plugins/fabric-agent-adapter/skills/creating-fabric-agents/schemas/template/data-rooms.schema.json

@@ -0,0 +1,74 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/passioncode-ai/fabric-agent-adapter/schemas/template/data-rooms.schema.json",
+  "title": "data-rooms.json of an agent template: the rooms and blocks it reads or writes ([] when none)",
+  "type": "array",
+  "items": {
+    "type": "object",
+    "required": [
+      "room",
+      "blocks",
+      "access"
+    ],
+    "additionalProperties": false,
+    "properties": {
+      "room": {
+        "type": "string",
+        "minLength": 1
+      },
+      "blocks": {
+        "type": "array",
+        "items": {
+          "type": "string",
+          "minLength": 1
+        },
+        "minItems": 1,
+        "uniqueItems": true
+      },
+      "access": {
+        "enum": [
+          "read",
+          "write",
+          "read-write"
+        ]
+      },
+      "scope": {
+        "type": "string",
+        "minLength": 1,
+        "description": "what the access covers, in words (\"its own block\", \"aggregate cells only\")"
+      },
+      "classes": {
+        "type": "array",
+        "items": {
+          "type": "string",
+          "minLength": 1
+        },
+        "minItems": 1,
+        "uniqueItems": true,
+        "description": "the data classes it may touch in the block"
+      },
+      "level": {
+        "type": "string",
+        "minLength": 1,
+        "description": "whose level bounds the read (\"the asker's level\")"
+      },
+      "required": {
+        "type": "boolean"
+      },
+      "variants": {
+        "type": "array",
+        "items": {
+          "type": "string"
+        },
+        "minItems": 1,
+        "uniqueItems": true
+      },
+      "use": {
+        "type": "string"
+      },
+      "notes": {
+        "type": "string"
+      }
+    }
+  }
+}

package/plugins/fabric-agent-adapter/skills/creating-fabric-agents/schemas/template/manifest.schema.json

@@ -0,0 +1,170 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/passioncode-ai/fabric-agent-adapter/schemas/template/manifest.schema.json",
+  "title": "manifest.json of an agent template: placement, contract, doors, dashboard, base model per task, budget",
+  "description": "placement, doors, models, dashboard and budget sit at the top level, or in every entry of `variants` when the variants differ. Their inner shape is the template's own in schema 1.",
+  "type": "object",
+  "required": [
+    "template",
+    "version",
+    "contract"
+  ],
+  "additionalProperties": false,
+  "patternProperties": {
+    "^x-[a-z0-9-]+$": {}
+  },
+  "properties": {
+    "template": {
+      "type": "string",
+      "pattern": "^[a-z][a-z0-9-]{1,63}$",
+      "description": "equals TEMPLATE.md's template.id"
+    },
+    "version": {
+      "type": "string",
+      "pattern": "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)$",
+      "description": "equals TEMPLATE.md's template.version"
+    },
+    "contract": {
+      "description": "one protocol the template was checked against, or a map of them by role",
+      "oneOf": [
+        {
+          "$ref": "#/$defs/protocol"
+        },
+        {
+          "type": "object",
+          "minProperties": 1,
+          "additionalProperties": {
+            "$ref": "#/$defs/protocol"
+          }
+        }
+      ]
+    },
+    "placement": {
+      "type": [
+        "object",
+        "string"
+      ]
+    },
+    "doors": {
+      "type": [
+        "object",
+        "array"
+      ]
+    },
+    "models": {
+      "type": [
+        "object",
+        "array"
+      ]
+    },
+    "dashboard": {
+      "type": [
+        "object",
+        "string"
+      ]
+    },
+    "budget": {
+      "type": [
+        "object",
+        "string"
+      ]
+    },
+    "schedules": {
+      "type": [
+        "array",
+        "object",
+        "string"
+      ]
+    },
+    "limits": {
+      "type": "object"
+    },
+    "events": {
+      "type": "array"
+    },
+    "variants": {
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": {
+        "type": "object",
+        "properties": {
+          "placement": {
+            "type": [
+              "object",
+              "string"
+            ]
+          },
+          "doors": {
+            "type": [
+              "object",
+              "array"
+            ]
+          },
+          "models": {
+            "type": [
+              "object",
+              "array"
+            ]
+          },
+          "dashboard": {
+            "type": [
+              "object",
+              "string"
+            ]
+          },
+          "budget": {
+            "type": [
+              "object",
+              "string"
+            ]
+          }
+        }
+      }
+    },
+    "notes": {
+      "type": "string"
+    }
+  },
+  "$defs": {
+    "protocol": {
+      "type": "object",
+      "required": [
+        "name",
+        "home",
+        "checked_against"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "name": {
+          "type": "string",
+          "minLength": 1
+        },
+        "home": {
+          "type": "string",
+          "minLength": 1
+        },
+        "checked_against": {
+          "type": "string",
+          "minLength": 1,
+          "description": "the version or date checked against: \"checked against\", never \"requires\""
+        },
+        "extensions": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "uniqueItems": true,
+          "description": "the protocol's extensions the template uses, by name"
+        },
+        "applies_to": {
+          "type": "string",
+          "minLength": 1
+        },
+        "notes": {
+          "type": "string"
+        }
+      }
+    }
+  }
+}

package/plugins/fabric-agent-adapter/skills/creating-fabric-agents/schemas/template/template-header.schema.json

@@ -0,0 +1,25 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/passioncode-ai/fabric-agent-adapter/schemas/template/template-header.schema.json",
+  "title": "The `template:` header of an agent template's TEMPLATE.md (fabric-workspace S2, decision W0-Q8)",
+  "type": "object",
+  "required": ["template"],
+  "additionalProperties": false,
+  "properties": {
+    "template": {
+      "type": "object",
+      "required": ["id", "name", "version", "family", "checked", "readiness", "variants"],
+      "additionalProperties": false,
+      "properties": {
+        "id": {"type": "string", "pattern": "^[a-z][a-z0-9-]{1,63}$", "description": "equals the folder's name"},
+        "name": {"type": "string", "minLength": 1, "maxLength": 120},
+        "version": {"type": "string", "pattern": "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)$"},
+        "family": {"type": "string", "pattern": "^[a-z]+(-[a-z]+)*$"},
+        "checked": {"type": "string", "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}$"},
+        "readiness": {"enum": ["draft", "validated", "proven"]},
+        "sources": {"type": "integer", "minimum": 0},
+        "variants": {"type": "array", "items": {"type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$"}, "uniqueItems": true}
+      }
+    }
+  }
+}

package/plugins/fabric-agent-adapter/skills/creating-fabric-agents/scripts/check_dashboard_link.py

@@ -28,8 +28,32 @@ CREDENTIAL_PAIRS = {
     'session': {'token', 'id'},
     'code': {'login', 'auth', 'access', 'session'}}
 JWT_SHAPE = re.compile(r'eyJ[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]*')
-SECRET_VALUE = re.compile(r'(^bearer\s.+|sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|xox[abposr]-[A-Za-z0-9-]{10,}'
-                          r'|AKIA[0-9A-Z]{16}|glpat-[A-Za-z0-9_-]{20,})', re.I | re.S)
+URL_BASE64_RUN = re.compile(r'[A-Za-z0-9_-]*')
+
+
+def has_jwt(text):
+    # Whether JWT_SHAPE matches anywhere, read in one pass (the contract's hasJwt, FAA-313): the expression backtracks
+    # from every `eyJ` of a long run, quadratic in it, while every `eyJ` of one run shares that run's end, so only its
+    # first is tried. The kit's fabric_secrets.has_jwt reads the same way; this file stands alone, so it has its own.
+    at = text.find('eyJ')
+    while at >= 0:
+        one = URL_BASE64_RUN.match(text, at + 3).end()
+        if one - at - 3 >= 2 and text[one:one + 1] == '.':
+            two = URL_BASE64_RUN.match(text, one + 1).end()
+            if two - one - 1 >= 2 and text[two:two + 1] == '.':
+                return True
+        at = text.find('eyJ', one)
+    return False
+
+
+# The contract's SECRET_VALUE at the pin (DEC-0151): `Bearer ` at a value's start in any case, or a provider key with its
+# prefix in its canonical case after a boundary (the start, a character that is no ASCII letter or digit, or an escape);
+# an `sk-` key holds a digit and an upper-case letter with 16 or more characters, or a digit with 32 or more.
+SECRET_VALUE = re.compile(r'(^[Bb][Ee][Aa][Rr][Ee][Rr]\s.+|(?:^|[^A-Za-z0-9]|%[0-9A-Fa-f]{2}|\\[nrt"\']|\\u[0-9A-Fa-f]{4}'
+                          r'|\\x[0-9A-Fa-f]{2}|\\[bfv0ae]|\\[0-7]{1,3}|%25[0-9A-Fa-f]{2}|\x1b\[[0-9;:]*m'
+                          r'|(?:\\u001[bB]|\\x1[bB]|\\e|\\033|\\33)\[[0-9;:]*m)'
+                          r'(?:sk-(?=[A-Za-z0-9_-]{0,255}?[0-9])(?:(?=[A-Za-z0-9_-]{0,255}?[A-Z])[A-Za-z0-9_-]{16,}|[A-Za-z0-9_-]{32,})'
+                          r'|gh[pousr]_[A-Za-z0-9]{20,}|xox[abposr]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|glpat-[A-Za-z0-9_-]{20,}))', re.S)
 LONG_RUN = re.compile(r'[A-Za-z0-9+/=_-]{40,}')
 
 
@@ -52,7 +76,7 @@ def credential_name(name):
 def secret_value(value):
     long_secret = any(re.search(r'[a-z]', run) and re.search(r'[A-Z]', run) and re.search(r'[0-9]', run)
                       for run in LONG_RUN.findall(value))
-    return bool(JWT_SHAPE.search(value) or SECRET_VALUE.search(value) or long_secret)
+    return bool(has_jwt(value) or SECRET_VALUE.search(value) or long_secret)
 
 
 def carries_credential(text):
@@ -115,6 +139,11 @@ def check(data):
     require(all(isinstance(v, str) and 0 < len(v) <= 200 for v in (target, viewer)), 'missing_device')
     fallback = data.get('fallback', 'if_absent')
     require(fallback in ('if_absent', 'never'), 'invalid_fallback')
+    # DEC-0154 PL-3 and HA-2 (FAA-251): who listens on http_url's port, as the host read it from the socket table
+    # (fabric_peer_owner's kinds, or check_service.py's foreign-user). A browser opens a raw loopback address only
+    # after that listener is this OS account's; absent, it is unknown.
+    owner = data.get('listener_owner', 'unknown')
+    require(owner in ('this-account', 'another-account', 'system', 'unknown', 'none', 'foreign-user'), 'invalid_listener_owner')
     kind = action.get('kind')
     if kind == 'remote_open':
         require(set(action) <= {'kind', 'device_id', 'service', 'path'}, 'unexpected_action_field')
@@ -128,6 +157,7 @@ def check(data):
         require(set(action) == {'kind', 'url'} and action.get('url') == http, 'not_resolved_http_url')
         require(viewer == target, 'wrong_viewer_device')
         require(state == 'not_installed' and fallback == 'if_absent', 'browser_fallback_forbidden')
+        require(owner == 'this-account', 'listener_not_this_account')
     else:
         raise ValueError('unsupported_dashboard_action')
     return {'ok': True, 'kind': kind}