@passioncode-ai/fabric-agent-adapter 0.81.0 → 0.82.0

package/CHANGELOG.md

@@ -1,5 +1,83 @@
 # Changelog
 
+## 0.82.0 (2026-11-12)
+
+Wave 4 of the backlog sweep of 2026-11-12. The contract pin stays at `93e7db16` (`v0.1.0+2026-11-08.1`). Kit modules
+change: `fabric_secrets`, `fabric_connections`, `fabric_peer_owner` (`1.2.0+kit.6`), `fabric_descriptor`,
+`fabric_holds`, `fabric_hub`, `fabric_lock`, the facade `fabric_service`, `fabric-delegation.mjs`, and their Node twins;
+dashboard kit 1.1.7.
+
+### Changed
+
+- **working-with-fabric answers a board request as contract DEC-0152 SA-6 says** (FAA-311): a session reads the
+  capability's slot in `com.status` first; at an `active` slot, or an enroll refused `fenced`, it leaves the request to
+  that holder, sends nothing and asks no one; it declines only at a slot `absent` at generation 0, and asks the operator
+  with `fabric_question_ask` after any refusal that is not retryable. A session without the slot does no work on a
+  request and gives it no state. The exit contract, the preamble, `SKILL.md` and the references say so, the exit
+  contract within Hermes' 4000 characters (3996).
+- **The peer owner reads DEC-0155's restricted table** (FAA-312): a `netstat` that fails or exits non-zero, a macOS
+  table with no row of another uid (sysctl) or process (netstat), and one without the reader's own connection read
+  `table-restricted` (RT-1); Linux and Windows keep `no-row`. Under a restricted table a listener is this account's only
+  on exactly `127.0.0.1` (RT-4). The launchd vouch takes only a listen on exactly `127.0.0.1` (RT-3), never the IPv4
+  wildcard or `::1`, and nothing from a set-uid reader: the kit's wildcard departure ends. `PEER_OWNER_VERSION` is
+  `1.2.0+kit.6`.
+- **The kit's hub locator answers a pid another OS account holds as the session hooks do** (FAA-304, after FAA-254):
+  `pid_alive` / `pidAlive` give None / null and `locate_hub` / `locateHub` refuse with `not-a-hub`, retryable, "not
+  verified", never `not-running`.
+- **`fabric_secrets.secret_url` refuses a URL whose host or port `new URL` refuses** (FAA-309), as `secretUrl` does:
+  the WHATWG host reading and the IDNA tables of FAA-98 move into `fabric_secrets` (`fabric_connections` imports them;
+  new `url_refused`). `repository_credential` still reads a repository's parameters whatever its host.
+- **One-pass JWT reading** (FAA-313): `has_jwt` / `jwt_spans` (Node `hasJwt` / `jwtSpans`), the same answers in linear
+  time; `secret_value`, `secret_argument`, the channel-agent check and `fabric_source_tree` use it.
+- **The holds twins agree on whitespace** (FAA-316): both squash a `statusMessage` with one ECMAScript class, so
+  U+001C, U+0085 and U+FEFF read the same; four vectors in `test/fixtures/holds/waiting-vectors.json`.
+- **The probe's `lifecycle.one-copy` finds a LaunchDaemon's leftover LaunchAgent** (FAA-317) in its `UserName`'s
+  `gui/<uid>` first, then in the probe's own; `in_launch_daemons` is `fabric_supervisors._in_daemons`, imported.
+- **Dashboard kit 1.1.7** (FAA-314): `fabric-button.js` reads credentials with DEC-0151's `SECRET_VALUE`, held to the
+  contract's `secretValue` and `credentialName` vectors.
+
+### Fixed
+
+- **A copy holding the instance lock stops when its lock file is replaced** (FAA-303, the 0.79.0 seam reading). On
+  macOS `flock` and `O_EXLOCK` lock an inode, so a data folder swapped under a running copy let a second copy lock the
+  new file and start. `hold_single_instance` / `holdSingleInstance` now start `InstanceLock.watch` /
+  `InstanceLock#watch` there: every `LOCK_WATCH_SECONDS` (2 s) it compares the locked inode with the file at the path,
+  and once the path names another file the copy exits 75 with one sentence naming the path (`lost_lock_message` /
+  `lostLockMessage`; `on_lost` / `onLost` replaces that reaction). The two copies overlap for at most one interval.
+  Linux and Windows keep their path-keyed name and are unchanged.
+- **Tests that failed under load** (FAA-308): the linear-time tests for `raw_values` and the minified JSON line read the
+  thread's CPU time, not the wall clock (kept on Windows), so a load near 110 no longer fails them, while a quadratic
+  implementation still does; the board sample's probe test lets `well-known.fast`, which times the machine, go either
+  way, as `test_probe_interop` does.
+- A flaky test drew a SAS signature without a digit about once in 1500 runs, a shape the long-run rule excludes by its
+  definition; it now draws one in the rule's shape.
+
+- **What the 0.82.0 seam reading found, fixed before the release**: Python's credential readers
+  (`fabric_secrets.url_refused` and its copy, `fabric_connections._whatwg_parts`, `check_service_channel_agent.url_parts`)
+  refuse a URL whose empty host is followed by `:`, with or without a port, as `new URL` does (`foo://:/?token=...`;
+  four shared vectors in both suites). `adapt_project`'s LC-21 gates read a stored URL's credential without the host
+  check, so a password in a manifest or `plugin.json` URL is found whatever its host. Every other reader of the JWT rule
+  reads it in one pass too (`fabric_source_check`, `fabric_connections` and its Node twin, the three
+  `check_dashboard_link.py` copies, `fabric-button.js`). Python `pid_alive` on Windows (`fabric_hub`,
+  `fabric_session_env`) answers None when OpenProcess is refused with access denied, as Node's EPERM does. The README
+  states the preamble's request rule; the exit contract's closing checkpoint names its `status` again (done if
+  completed, blocked if failed_known); the hub and HTTP docstrings say a missing row on macOS is `table-restricted`.
+  New rows FAA-320 to FAA-323.
+
+### Added
+
+- **`fabric_peer_owner.py listener <port> [--json]`** and **`fabric-peer-owner.mjs listener <port>`** print the
+  listener's kind (FAA-315): the route for the dashboard link gate's `listener_owner`, named in the three
+  `dashboard-links.md`.
+
+### Documented
+
+- On a host with a restricted socket table the dashboard layout probe measures nothing: every rule `NOT_RUN`, exit 3
+  (FAA-318). It does not vouch by the service's pid, which DEC-0155 RT-3 reserves for the caller that started it.
+- FAA-292's decision: RT-2 through libproc waits for an L0 module of its own, as `fabric_peer_owner.py` is at the
+  1000-line cap (`docs/evidence/specs/2026-11-12-faa-292-libproc-decision.md`); the row stays open.
+- `fabric-delegation.mjs` carries the `<https>` legend; `HTTPS_LEGEND_PENDING` in `test/validate.py` is empty (FAA-306).
+
 ## 0.81.0 (2026-11-12)
 
 Wave 3 of the backlog sweep of 2026-11-12. **The contract pin moves to `93e7db16` (`v0.1.0+2026-11-08.1`)**: DEC-0149

package/README.md

@@ -23,10 +23,12 @@ The skills are `adapting-projects-to-fabric`, `creating-fabric-agents`,
 `working-with-fabric` is for the other side: a coding agent (Claude Code, Codex, Kimi Code, Kilo, Hermes) opened in
 a terminal that works in a project through Fabric. It finds Fabric (`hub.json`, its `pid`), has the machine's
 lifecycle broker start it when it is down, registers `fabric-mcp` once with no secret, calls `fabric_whoami`
-first, reads the project board (`com.status`, `com.list`, `com.read_ack` only what was read), answers what waits on its
-Project in the same turn with its state (the result later; a request its Project's service should take stays queued; before Fabric 0.3.17 a run Fabric starts
+first, reads the project board (`com.status`, `com.list`, `com.read_ack` only what was read): an announcement or
+question waiting on its Project gets its state in the same turn (the result later), and a request to its Project is
+read through its capability's slot in `com.status` (`active` is left to its holder and nobody is asked; otherwise
+`com.enroll`, and only the slot's holder gives the request its state; before Fabric 0.3.17 a run Fabric starts
 declines a request no session can take and the asker resends, and from 0.3.17 the session's own Project is granted
-`board.respond` at `com.enroll`, CO-506), and asks other
+`board.respond` at `com.enroll`, CO-506). It asks other
 Projects only through `com.submit`, asks who is working on what and claims its task before it starts
 (`fabric_work_list`, `fabric_work_claim`, Fabric v0.3.5 and later), links tasks to backlog rows instead of copying them, and
 releases at the end (`fabric_work_release`). `scripts/fabric_session.py status` prints where Fabric stands and one

package/SECURITY.md

@@ -57,7 +57,8 @@ bounded and non-publishing until explicit scoped grants exist in a project bindi
   short-lived child of its own interpreter listening on a random `127.0.0.1` port; when the
   table is restricted (macOS 27.2, FAA-267) the launchd installers also run `/usr/sbin/lsof
   -nP -a -p <pid> -i4TCP -sTCP:LISTEN -Fn` on their own job's pid. That vouch shows the job listens on the port, not that it accepted
-  the connection (a more specific bind by root over a wildcard job would pass; the pin's DEC-0155 RT-3 vouches only for exactly `127.0.0.1`, a departure FAA-258 filed). A LaunchDaemon's root
+  the connection; it counts only a listen on exactly `127.0.0.1`, as the pin's DEC-0155 RT-3 asks (since FAA-312; a wildcard
+  or `::1` listener is never vouched for, and a set-uid reader vouches for nothing). A LaunchDaemon's root
   installer runs that `lsof` and `ps -o uid=` on its job's pid before it accepts an answer, and reads, never changes, every other
   plist in `/Library/LaunchDaemons` (to find another holder of its label, `plutil -convert xml1` for a binary one in
   Node), `launchctl print system/<label>` and the `UserName`'s uid (`pwd`, or `id -u` in Node). The kit's loopback server reads the table once per accepted
@@ -80,7 +81,8 @@ bounded and non-publishing until explicit scoped grants exist in a project bindi
   connected peer's address, so the Authorization header never reaches another account's proxy (FAA-260 items 1, 8).
 - The layout probe (`check_dashboard_layout.mjs`) reads a raw loopback page's listener from the socket table just
   before its headless browser opens it, the one-time login URL included, and opens nothing on another account's,
-  root's or an untellable listener (FAA-260 items 2, 14). The browser then connects on its own: a listener swapped
+  root's or an untellable listener (FAA-260 items 2, 14); under a restricted table (DEC-0155) that is every listener,
+  so it measures nothing there and never vouches by a pid it did not start (FAA-318). The browser then connects on its own: a listener swapped
   between the read and the browser's connect is a residue, bounded by the login code's 120 s and single use.
 - The agents database (FAA-275): creating-fabric-agents, adapting-projects-to-fabric, building-fabric-services and
   working-with-fabric may send board requests to whichever Project the board lists under an `agents-db.*` capability

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/fabric-agent-adapter",
-  "version": "0.81.0",
+  "version": "0.82.0",
   "description": "Create Fabric-compatible agents, run them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract. This package is the installer CLI.",
   "scripts": {
     "test": "python3 test/validate.py && python3 -m unittest discover -s test -q && node --test 'test/*.test.mjs'"

package/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles; and teach a coding agent to work in a project through Fabric (fabric-mcp, fabric_whoami, claim and release), with Claude Code session hooks; and put an agent on a standing watch over a product (observer mode).",
-  "version": "0.81.0",
+  "version": "0.82.0",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -9,7 +9,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.81.0"
+  version: "0.82.0"
   contract-version: "0.1.0"
   contract-commit: "93e7db164c7829e2783b4b7705c4113bb5201131"
 ---

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/references/dashboard-links.md

@@ -123,7 +123,15 @@ if_absent policy, the same device and `"listener_owner": "this-account"`: the ki
 the host read for the listener on http_url's port (`fabric_peer_owner`'s
 `this-account`, `another-account`, `system`, `unknown`, `none`, or
 `check_service.py`'s `foreign-user`); any other, or none given, refuses the
-browser (DEC-0154 PL-3, FAA-251). The native link does not take it: Fabric
+browser (DEC-0154 PL-3, FAA-251). The host reads that kind right before it opens
+the page with the adapter's
+`python3 building-fabric-services/scripts/fabric_peer_owner.py listener <port>`
+(or `node building-fabric-services/scripts/fabric-peer-owner.mjs listener <port>`),
+which prints it on one line (`--json` prints the whole owner) and sends nothing
+to the port (FAA-315). Where the socket table is restricted (macOS 27.2 for an
+ad-hoc-signed Python or Node, DEC-0155 RT-4) only this account's listener on
+exactly `127.0.0.1` reads `this-account`; a wildcard or `::1` bind reads
+`unknown` (`table-restricted`), and the browser is refused. The native link does not take it: Fabric
 Dashboards checks its own listener. Contract DEC-0123 PL-3 also allows a browser
 on `unsupported` (a system the host does not ship for); the gate treats
 `unsupported` as no fallback, by the operator's rule that a browser opens only on a

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/adapt_project.py

@@ -659,6 +659,13 @@ import {SCHEMA_PREFIX} from './src/contract.ts';
     return "PASS", ["manifest validated by selected contract schema at %s" % selected_commit]
 
 
+def _stored_url_credential(url: str) -> bool:
+    """A credential in a URL a manifest or plugin.json STORES (LC-21): secret_url's reading with the host not checked,
+    as repository_credential reads a repository. secret_url reads a URL whose host `new URL` refuses as an argument only
+    (FAA-309), right for a reader, but storage is the closed side: a password stays a password whatever its host."""
+    return _secrets._url_credential(url, hosts=False)
+
+
 def _credential_problems(manifest: Dict[str, Any]) -> List[str]:
     """LC-21 (FAA-23): no credential in a launch argument or in a URL the manifest names."""
     problems: List[str] = []
@@ -670,7 +677,7 @@ def _credential_problems(manifest: Dict[str, Any]) -> List[str]:
             if isinstance(arg, str) and _secrets.secret_argument(arg):
                 problems.append("LC-21: capability[%d] passes a credential in a launch argument; argv is visible to every process" % index)
         for field in ("url", "agentCardUrl"):
-            if isinstance(connection.get(field), str) and _secrets.secret_url(connection[field]):
+            if isinstance(connection.get(field), str) and _stored_url_credential(connection[field]):
                 problems.append("LC-21: capability[%d].%s carries a credential in the URL; a query lands in every log" % (index, field))
     return problems
 
@@ -712,7 +719,7 @@ def _plugin_problems(root: Path) -> List[str]:
             if "command" in entry:
                 problems.append("LC-19: plugin %s declares the stdio MCP server %s, which starts in every session that enables the plugin; serve it over HTTP from one resident process or register it at project scope" % (name, server))
             argv = [entry.get("command")] + list(entry.get("args") or [])
-            if any(isinstance(a, str) and _secrets.secret_argument(a) for a in argv) or (isinstance(entry.get("url"), str) and _secrets.secret_url(entry["url"])):
+            if any(isinstance(a, str) and _secrets.secret_argument(a) for a in argv) or (isinstance(entry.get("url"), str) and _stored_url_credential(entry["url"])):
                 problems.append("LC-21: plugin %s's MCP server %s carries a credential in its argv or URL" % (name, server))
             env = entry.get("env") if isinstance(entry.get("env"), dict) else {}
             if any(isinstance(v, str) and _secret_env_value(v) for v in env.values()):  # path-aware for a path (FAA-266)

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/check_dashboard_link.py

@@ -28,6 +28,24 @@ CREDENTIAL_PAIRS = {
     'session': {'token', 'id'},
     'code': {'login', 'auth', 'access', 'session'}}
 JWT_SHAPE = re.compile(r'eyJ[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]*')
+URL_BASE64_RUN = re.compile(r'[A-Za-z0-9_-]*')
+
+
+def has_jwt(text):
+    # Whether JWT_SHAPE matches anywhere, read in one pass (the contract's hasJwt, FAA-313): the expression backtracks
+    # from every `eyJ` of a long run, quadratic in it, while every `eyJ` of one run shares that run's end, so only its
+    # first is tried. The kit's fabric_secrets.has_jwt reads the same way; this file stands alone, so it has its own.
+    at = text.find('eyJ')
+    while at >= 0:
+        one = URL_BASE64_RUN.match(text, at + 3).end()
+        if one - at - 3 >= 2 and text[one:one + 1] == '.':
+            two = URL_BASE64_RUN.match(text, one + 1).end()
+            if two - one - 1 >= 2 and text[two:two + 1] == '.':
+                return True
+        at = text.find('eyJ', one)
+    return False
+
+
 # The contract's SECRET_VALUE at the pin (DEC-0151): `Bearer ` at a value's start in any case, or a provider key with its
 # prefix in its canonical case after a boundary (the start, a character that is no ASCII letter or digit, or an escape);
 # an `sk-` key holds a digit and an upper-case letter with 16 or more characters, or a digit with 32 or more.
@@ -58,7 +76,7 @@ def credential_name(name):
 def secret_value(value):
     long_secret = any(re.search(r'[a-z]', run) and re.search(r'[A-Z]', run) and re.search(r'[0-9]', run)
                       for run in LONG_RUN.findall(value))
-    return bool(JWT_SHAPE.search(value) or SECRET_VALUE.search(value) or long_secret)
+    return bool(has_jwt(value) or SECRET_VALUE.search(value) or long_secret)
 
 
 def carries_credential(text):

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/fabric_secrets.py

@@ -10,8 +10,11 @@ U+001C to U+001F, and not U+FEFF), `.` stopping at every line terminator, ASCII
 
 from __future__ import annotations
 
+import bisect
+import ipaddress
 import re
-from typing import Dict, List, Tuple
+from typing import Dict, List, Optional, Sequence, Tuple
+import unicodedata
 import urllib.parse
 
 CREDENTIAL_WORDS = (
@@ -30,6 +33,34 @@ CREDENTIAL_PAIRS: Dict[str, tuple] = {
 JS_SPACE = "\t\n\x0b\x0c\r \xa0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff"
 _NOT_LINE_END = "[^\n\r\u2028\u2029]"  # ECMAScript's `.` without the s flag
 JWT_SHAPE = re.compile(r"eyJ[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]*")
+_URL_BASE64_RUN = re.compile(r"[A-Za-z0-9_-]*")
+
+
+def jwt_spans(text: str, first: bool = False) -> List[Tuple[int, int]]:
+    """The spans JWT_SHAPE matches in a text, leftmost and not overlapping, read in one pass (the contract's `jwtSpans`,
+    FAA-313): the regular expression backtracks from every `eyJ` of a long run, quadratic in it, while every `eyJ` of
+    one run shares that run's end, so only its first is tried, and a match ends where its third segment's run ends.
+    `first` stops at the first match."""
+    spans: List[Tuple[int, int]] = []
+    at = text.find("eyJ")
+    while at >= 0:
+        one = _URL_BASE64_RUN.match(text, at + 3).end()
+        resume = one
+        if one - at - 3 >= 2 and text[one:one + 1] == ".":
+            two = _URL_BASE64_RUN.match(text, one + 1).end()
+            if two - one - 1 >= 2 and text[two:two + 1] == ".":
+                three = _URL_BASE64_RUN.match(text, two + 1).end()
+                spans.append((at, three))
+                if first:
+                    break
+                resume = three
+        at = text.find("eyJ", resume)
+    return spans
+
+
+def has_jwt(text: str) -> bool:
+    """Whether JWT_SHAPE matches anywhere in a text, read in one pass (the contract's `hasJwt`, FAA-313)."""
+    return bool(jwt_spans(text, True))
 #: Where a provider key's prefix may start (DEC-0151): the start of a value, a character that is no ASCII letter or
 #: digit, or an escape (a percent-escape, single or double, a backslash escape, an octal, `\\x` with two hex digits,
 #: `\\u` with four, an ESC colour sequence, raw or escaped). A consuming group, as the contract writes it.
@@ -83,7 +114,7 @@ def _long_secret(value: str) -> bool:
 
 def secret_value(value: str) -> bool:
     """A JWT anywhere, a provider key or `Bearer …`, or a long base64 run mixing upper case, lower case and digits."""
-    return bool(JWT_SHAPE.search(value) or SECRET_VALUE.search(value) or _long_secret(value))
+    return bool(has_jwt(value) or SECRET_VALUE.search(value) or _long_secret(value))
 
 
 def _path_like(piece: str) -> bool:
@@ -95,7 +126,7 @@ def _path_like(piece: str) -> bool:
 def secret_argument(value: str) -> bool:
     """The same for a launch argument or a server's command and URL: a long run is looked for between path separators,
     so a folder path holding a session id is not taken for a key."""
-    if JWT_SHAPE.search(value) or SECRET_VALUE.search(value) or _BEARER_INSIDE.search(value):
+    if has_jwt(value) or SECRET_VALUE.search(value) or _BEARER_INSIDE.search(value):
         return True
     for piece in _ARGUMENT_SPLIT.split(value):
         if _path_like(piece):
@@ -141,6 +172,155 @@ _C0_OR_SPACE = "".join(map(chr, range(0x21)))
 _LONE_SURROGATE = re.compile("[\ud800-\udfff]")
 
 
+# The WHATWG host parser, enough to know when `new URL` refuses a host (FAA-98, moved here from fabric_connections for
+# secret_url in FAA-309, so the module still ships alone in adapting-projects-to-fabric).
+_FORBIDDEN_HOST = set("\x00\t\n\r #/:<>?@[\\]^|")
+_FORBIDDEN_DOMAIN = _FORBIDDEN_HOST | set(chr(c) for c in range(0x20)) | {"%", "\x7f"}
+
+
+# FAA-98: UTS46 narrowed, not ported. A non-ASCII host is refused only where every Node from 20 to 26 refuses it, so
+# the doubt stays on the closed side (its URL's credentials are read). The two tables are measured by
+# test/fixtures/idna/make_idna_tables.mjs (idna-tables.json, held equal by test_the_idna_tables_are_the_measured_ones):
+# code points refused in every context, and code points removed between letters. The contextual rules read Unicode 3.2
+# classes (`unicodedata.ucd_3_2_0`) and skip what that Unicode does not know, since Node's own UTS46 data lags its
+# Unicode: an Arabic letter of Unicode 14 is no right-to-left letter to it.
+_IDNA_DISALLOWED = (
+    (0x80, 0xa0), (0xa8, 0xa8), (0xaf, 0xaf), (0xb4, 0xb4), (0xb8, 0xb8), (0x2d8, 0x2dd), (0x37a, 0x37a),
+    (0x384, 0x385), (0x600, 0x605), (0x61c, 0x61c), (0x6dd, 0x6dd), (0x70f, 0x70f), (0x890, 0x891), (0x8e2, 0x8e2),
+    (0x1680, 0x1680), (0x1fbd, 0x1fbd), (0x1fbf, 0x1fc1), (0x1fcd, 0x1fcf), (0x1fdd, 0x1fdf), (0x1fed, 0x1fee),
+    (0x1ffd, 0x1ffe), (0x2000, 0x200a), (0x200e, 0x200f), (0x2017, 0x2017), (0x2024, 0x2026), (0x2028, 0x202f),
+    (0x203e, 0x203e), (0x2047, 0x2049), (0x205f, 0x205f), (0x2066, 0x2069), (0x2100, 0x2101), (0x2105, 0x2106),
+    (0x2488, 0x249b), (0x2a74, 0x2a74), (0x2ff0, 0x3000), (0x309b, 0x309c), (0x31ef, 0x31ef), (0x33c2, 0x33c2),
+    (0x33c7, 0x33c7), (0x33d8, 0x33d8), (0xe000, 0xf8ff), (0xfc5e, 0xfc63), (0xfdfa, 0xfdfb), (0xfe12, 0xfe13),
+    (0xfe16, 0xfe16), (0xfe19, 0xfe19), (0xfe30, 0xfe30), (0xfe47, 0xfe4c), (0xfe52, 0xfe52), (0xfe55, 0xfe56),
+    (0xfe5f, 0xfe5f), (0xfe64, 0xfe65), (0xfe68, 0xfe68), (0xfe6a, 0xfe6b), (0xfe70, 0xfe70), (0xfe72, 0xfe72),
+    (0xfe74, 0xfe74), (0xfe76, 0xfe76), (0xfe78, 0xfe78), (0xfe7a, 0xfe7a), (0xfe7c, 0xfe7c), (0xfe7e, 0xfe7e),
+    (0xff03, 0xff03), (0xff05, 0xff05), (0xff0f, 0xff0f), (0xff1a, 0xff1a), (0xff1c, 0xff1c), (0xff1e, 0xff20),
+    (0xff3b, 0xff3e), (0xff5c, 0xff5c), (0xffe3, 0xffe3), (0xfff9, 0xfffd), (0x110bd, 0x110bd), (0x110cd, 0x110cd),
+    (0x13430, 0x1343f), (0x1f100, 0x1f100), (0xe0001, 0xe0001), (0xe0020, 0xe007f), (0xf0000, 0xffffd),
+    (0x100000, 0x10fffd),
+)
+_IDNA_IGNORED = (
+    (0xad, 0xad), (0x34f, 0x34f), (0x180b, 0x180d), (0x180f, 0x180f), (0x200b, 0x200b), (0x2060, 0x2060),
+    (0x2064, 0x2064), (0xfe00, 0xfe0f), (0xfeff, 0xfeff), (0x1bca0, 0x1bca3), (0xe0100, 0xe01ef),
+)
+_IDNA_DOTS = re.compile("[.\u3002\uff0e\uff61]")
+_U32 = unicodedata.ucd_3_2_0
+_RTL_OK = {"R", "AL", "AN", "EN", "ES", "CS", "ET", "ON", "BN", "NSM"}
+_JOINERS = "\u200c\u200d"
+
+
+def _in_ranges(ranges: Sequence[tuple], cp: int) -> bool:
+    i = bisect.bisect_right(ranges, (cp, 0x10ffff)) - 1
+    return i >= 0 and ranges[i][0] <= cp <= ranges[i][1]
+
+
+def _known(c: str) -> bool:
+    return _U32.category(c) != "Cn" and unicodedata.category(c) != "Cn"
+
+
+def _joiner_refused(label: str, i: int) -> bool:
+    """CheckJoiners as Node 20 to 26 all read it: they find a joining context, or a virama, anywhere in the label
+    (`\u0628a\u200c\u0627` and `\u0628\u200c\u0627\u200d` parse), so only a joiner with nothing but ASCII beside it
+    in its label has none for certain."""
+    return all(c.isascii() for j, c in enumerate(label) if j != i)
+
+
+def _bidi_refused(label: str) -> bool:
+    """RFC 5893 as Node 20 to 26 all read it: only a label holding R, AL or AN is judged, and its first code point is
+    not (Node 26 alone refuses a label opening with a digit or a hyphen)."""
+    if not label or not all(_known(c) for c in label) or any(c in _JOINERS for c in label):
+        return False  # Node 20 to 26 pass a label holding a joiner over (`\u05d0a\u094d\u200d` parses)
+    k = [_U32.bidirectional(c) for c in label]
+    if not any(x in ("R", "AL", "AN") for x in k):
+        return False
+    body = list(k)
+    while body and body[-1] == "NSM":
+        body.pop()
+    if not body or body[-1] not in ("R", "AL", "EN", "AN"):
+        return True
+    return k[0] in ("R", "AL") and (any(x not in _RTL_OK for x in k) or ("EN" in k and "AN" in k))
+
+
+def _idna_host(host: str) -> Optional[str]:
+    """None where WHATWG's domain-to-ASCII refuses a non-ASCII host for certain; else the host as UTS46 maps it, read
+    as NFKC with case folding (exact enough for the ASCII rules that follow, which read digits and dots)."""
+    if any(_in_ranges(_IDNA_DISALLOWED, ord(c)) for c in host):
+        return None
+    kept = "".join(c for c in host if not _in_ranges(_IDNA_IGNORED, ord(c)))
+    if kept == "":
+        return None  # nothing left: an empty host
+    if not all(_known(c) for c in kept):
+        return host  # a code point this Python's Unicode does not know: the contextual rules are not read
+    mapped = unicodedata.normalize("NFC", unicodedata.normalize("NFKC", unicodedata.normalize("NFKC", kept).casefold()))
+    for label in _IDNA_DOTS.split(mapped):
+        first = label[:1]
+        if first and first not in "\u17b4\u17b5" and _U32.category(first)[0] == "M" and unicodedata.category(first)[0] == "M":
+            return None  # a label opening with a mark (U+17B4 and U+17B5 are ignored by the newer Nodes)
+        if any(c in _JOINERS and _joiner_refused(label, i) for i, c in enumerate(label)):
+            return None
+        if _bidi_refused(label):
+            return None
+    return _IDNA_DOTS.sub(".", mapped)
+
+
+def _ipv4_number(part: str) -> Optional[int]:
+    if part == "":
+        return None  # an empty part fails WHATWG's IPv4 parser (`1..2`); `0x` alone is 0
+    base = 10
+    if part[:2].lower() == "0x":
+        part, base = part[2:], 16
+    elif len(part) > 1 and part[0] == "0":
+        part, base = part[1:], 8
+    if part == "":
+        return 0
+    digits = {10: "0123456789", 16: "0123456789abcdefABCDEF", 8: "01234567"}[base]
+    return int(part, base) if all(c in digits for c in part) else None
+
+
+def _domain_ok(host: str) -> bool:
+    """The WHATWG host parser on a special scheme's host, enough to know when `new URL` refuses it."""
+    if host.startswith("["):
+        return host.endswith("]") and _ipv6_ok(host[1:-1])
+    if re.search(r"%(?![0-9A-Fa-f]{2})", host) is None:
+        try:
+            host = urllib.parse.unquote_to_bytes(host).decode("utf-8")
+        except UnicodeDecodeError:
+            return False
+    if any(c in _FORBIDDEN_DOMAIN for c in host):
+        return False
+    # A non-ASCII host goes through UTS46 in WHATWG; this module reads it narrowly (_idna_host, FAA-98). When unsure,
+    # the host is taken as valid, so its URL's credentials are read: the doubt then hides a list rather than publish one
+    # (round-2 reading). A host UTS46 maps to ASCII is read by the ASCII rules below (`１２７.０.０.１` is an address).
+    if any(ord(c) > 0x7f for c in host):
+        mapped = _idna_host(host)
+        if mapped is None:
+            return False
+        if not mapped.isascii() or any(c in _FORBIDDEN_DOMAIN for c in mapped):
+            return True
+        host = mapped
+    labels = host.split(".")
+    if labels and labels[-1] == "" and len(labels) > 1:
+        labels = labels[:-1]
+    last = labels[-1] if labels else ""
+    if not (last and (last.isdigit() and last.isascii() or re.fullmatch(r"0[xX][0-9A-Fa-f]*", last))):
+        return host != ""
+    numbers = [_ipv4_number(label) for label in labels]
+    if len(numbers) > 4 or any(n is None for n in numbers):
+        return False
+    return all(n <= 255 for n in numbers[:-1]) and numbers[-1] < 256 ** (5 - len(numbers))
+
+
+def _ipv6_ok(text: str) -> bool:
+    if "%" in text:
+        return False  # a zone id: `ipaddress` takes one, WHATWG does not
+    try:
+        ipaddress.IPv6Address(text)
+        return True
+    except ValueError:
+        return False
+
+
 def _percent_encode(text: str, also: str) -> str:
     """WHATWG's percent-encoding of a query or a fragment: every C0 control, space, `"`, `<`, `>`, every code point
     above U+007E and the characters in `also`, as UTF-8 %XX (a lone surrogate as U+FFFD, as a USVString reads it).
@@ -162,8 +342,8 @@ def url_parts(value: str) -> Tuple[str, str, str]:
     after every slash or backslash that follows `scheme:` (the special authority ignore slashes state) and ends at the
     next slash, backslash, `?` or `#`, so `<https>:u:p@h` and `<https>:\\u:p@h` carry the password p; any other scheme
     has an authority only after `//`, and `file` has no user information. The user information ends at the authority's
-    last `@`, and the password follows its first `:`. A host `new URL` would refuse is not checked: such a URL is read
-    for its password and parameters all the same, the safe direction for a detector."""
+    last `@`, and the password follows its first `:`. The host is not checked here: secret_url refuses first a URL
+    whose host or port `new URL` refuses (url_refused, FAA-309)."""
     scheme, _, rest = value.partition(":")
     rest, _, fragment = rest.partition("#")
     rest, _, query = rest.partition("?")
@@ -182,10 +362,60 @@ def url_parts(value: str) -> Tuple[str, str, str]:
 _url_parts = url_parts  # the name before FAA-250, kept for code that reached it
 
 
+def url_refused(value: str) -> bool:
+    """Whether `new URL` refuses an absolute URL (trimmed as secret_url trims it) for its host or port (FAA-309), read
+    with the same authority url_parts reads: a special scheme's host through the WHATWG host parser and the IDNA reading
+    of FAA-98 (`_domain_ok`), never empty; `file`'s host, after `//`, the same, empty allowed; another scheme's host,
+    after `//`, without a forbidden host code point, and empty only with no user information and no `:` after it (an
+    empty port is refused too); a port of ASCII digits up to 65535. Where the reading is unsure, the host is taken as
+    valid (the detector's safe side)."""
+    value = _LONE_SURROGATE.sub("\ufffd", value)
+    scheme, _, rest = value.partition(":")
+    rest = rest.partition("#")[0].partition("?")[0]
+    lowered = scheme.lower()
+    if lowered in _SPECIAL:
+        authority = rest.replace("\\", "/").lstrip("/").partition("/")[0]
+    elif lowered == "file":
+        rest = rest.replace("\\", "/")
+        if not rest.startswith("//"):
+            return False
+        host = rest[2:].partition("/")[0]
+        return not (host == "" or re.fullmatch(r"[A-Za-z][:|]", host) or _domain_ok(host))
+    elif rest.startswith("//"):
+        authority = rest[2:].partition("/")[0]
+    else:
+        return False
+    hostport = authority.rpartition("@")[2]
+    if hostport.startswith("["):
+        close = hostport.find("]")
+        if close < 0:
+            return True
+        host, after = hostport[:close + 1], hostport[close + 1:]
+        if after and not after.startswith(":"):
+            return True
+        port = after[1:]
+    else:
+        host, _, port = hostport.partition(":")
+    if port and not (port.isascii() and port.isdigit() and int(port) <= 65535):
+        return True
+    if lowered in _SPECIAL:
+        return host == "" or not _domain_ok(host)
+    if host.startswith("["):
+        return not _ipv6_ok(host[1:-1])
+    return any(c in _FORBIDDEN_HOST for c in host) or (host == "" and ("@" in authority or ":" in hostport))
+
+
 def secret_url(value: str) -> bool:
     """Whether a URL an MCP entry or a launch names carries a credential (LC-21): anything secret_argument finds, a
     password in its user information, or a query or fragment parameter whose name can only carry a credential and has
-    a value, or whose value is shaped like one. A string that is not an absolute URL is checked as an argument only."""
+    a value, or whose value is shaped like one. A string that is not an absolute URL, or one whose host or port
+    `new URL` refuses (url_refused, FAA-309), is checked as an argument only, as the Node twin's secretUrl reads it."""
+    return _url_credential(value, hosts=True)
+
+
+def _url_credential(value: str, hosts: bool) -> bool:
+    """secret_url; with `hosts` False the host is not checked, as repository_credential reads a repository's parameters
+    whatever its host (the Node twin's repositoryParts)."""
     if secret_argument(value):
         return True
     # What WHATWG URL parsing does first: trim C0 controls and space from the ends (never other Unicode spaces, which it
@@ -193,6 +423,8 @@ def secret_url(value: str) -> bool:
     value = re.sub(r"[\t\n\r]", "", value.strip(_C0_OR_SPACE))
     if not _SCHEME.match(value):
         return False  # not an absolute URL (WHATWG URL parsing refuses it)
+    if hosts and url_refused(value):
+        return False  # `new URL` refuses its host or port, so the Node twin reads it as an argument only (FAA-309)
     password, query, fragment = url_parts(value)
     if password:
         return True
@@ -260,4 +492,4 @@ def repository_credential(value: str) -> bool:
     odd = [piece for written in (path, ascii_decoded(path)) for piece in re.split(r"[/\\:]", written)
            if piece and not repository_name(piece)]
     # the scheme and authority decoded too: git sends `https://%67hp_...@h` with its user decoded (unit reading 12)
-    return secret_url(head + tail) or secret_argument(ascii_decoded(head)) or any(secret_argument(piece) for piece in odd)
+    return _url_credential(head + tail, hosts=False) or secret_argument(ascii_decoded(head)) or any(secret_argument(piece) for piece in odd)

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/fabric_source_check.py

@@ -234,7 +234,7 @@ def _url_secret(url: str, depth: int = 0) -> bool:
                 if not _real(value):
                     continue
                 if (_secrets.credential_name(name) and _secrets._long_secret(value)) or \
-                        _secrets.JWT_SHAPE.search(value) or URL_SECRET_VALUE.search(value):
+                        _secrets.has_jwt(value) or URL_SECRET_VALUE.search(value):
                     return True
     return False
 
@@ -287,7 +287,7 @@ def _secret_in(line: str) -> Optional[str]:
         return "a private key block"
     if any(_real(m.group(1)) for m in JWK_PRIVATE.finditer(line)):
         return "a private key (a JWK's `d`)"
-    if any(_real(m.group(0)) for m in _secrets.JWT_SHAPE.finditer(line)):
+    if any(_real(line[a:b]) for a, b in _secrets.jwt_spans(line)):  # one pass (FAA-313)
         return "a token shaped like a JWT"
     # The detector reads one configuration value; across a line, `sk-` needs a word start of its own, or every name
     # with a segment ending in `sk` (`task-management-service`) would read as a key.
@@ -486,7 +486,7 @@ def _secret_spans(text: str) -> List[Tuple[int, int]]:
 
 def _raw_secret_spans(text: str) -> List[Tuple[int, int]]:
     spans = [m.span() for m in PRIVATE_KEY.finditer(text)]
-    spans += [m.span() for m in _secrets.JWT_SHAPE.finditer(text) if _real(m.group(0))]
+    spans += [(a, b) for a, b in _secrets.jwt_spans(text) if _real(text[a:b])]  # one pass (FAA-313)
     spans += [m.span(1) for m in JWK_PRIVATE.finditer(text) if _real(m.group(1))]
     spans += list(_provider_keys(text))
     spans += [m.span() for m in _overlapping(_secrets._BEARER_INSIDE, text) if _real(m.group(0))]

package/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/scripts/fabric_source_tree.py

@@ -328,20 +328,7 @@ def _credential_in(written: str) -> int:
 
 def _jwt_spans(text: str) -> List[Tuple[int, int]]:
     """`jwtSpans`: `JWT_SHAPE`'s leftmost, non-overlapping matches, read as the contract's one pass reads them."""
-    spans = []
-    run = re.compile(r"[A-Za-z0-9_-]*")
-    at = text.find("eyJ")
-    while at >= 0:
-        one = run.match(text, at + 3).end()
-        start_next = one
-        if one - at - 3 >= 2 and text[one:one + 1] == ".":
-            two = run.match(text, one + 1).end()
-            if two - one - 1 >= 2 and text[two:two + 1] == ".":
-                three = run.match(text, two + 1).end()
-                spans.append((at, three))
-                start_next = three
-        at = text.find("eyJ", start_next)
-    return spans
+    return _secrets.jwt_spans(text)
 
 
 def credential_at(line: str) -> int:
@@ -366,7 +353,7 @@ def _credential_url_spans(line: str) -> List[Tuple[int, int]]:
 
 
 def _own_secret_value(text: str) -> bool:
-    return bool(_secrets.JWT_SHAPE.search(text) or _check.URL_SECRET_VALUE.search(text) or _secrets._long_secret(text))
+    return bool(_secrets.has_jwt(text) or _check.URL_SECRET_VALUE.search(text) or _secrets._long_secret(text))
 
 
 def credential_shaped(text: str) -> bool:
@@ -374,7 +361,7 @@ def credential_shaped(text: str) -> bool:
 
 
 def _prose_secret_value(text: str) -> bool:
-    return bool(_secrets.JWT_SHAPE.search(text) or any(True for _ in _check._provider_keys(text))
+    return bool(_secrets.has_jwt(text) or any(True for _ in _check._provider_keys(text))
                 or _secrets._BEARER_INSIDE.search(text) or _secrets._long_secret(text))
 
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -9,7 +9,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits (Node.js 22+ for a Linux service's instance lock); the probe needs Python 3.9+. launchd steps are macOS-only; Linux services install a systemd user unit and Windows ones a per-user Scheduled Task with the kits' writers. Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.81.0"
+  version: "0.82.0"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
   extension-commit: "93e7db164c7829e2783b4b7705c4113bb5201131"
@@ -310,7 +310,8 @@ reference's *A2A for remote agents* section), `channel-agent.declaration` (DEC-0
 `board.responder` for a service that declares the project board) and exits 1 on any `FAIL`. A `NOT_RUN` is not a pass;
 name it in the report. A service with a dashboard also runs the layout probe,
 `node <skill-dir>/scripts/check_dashboard_layout.mjs --service <id>` (WebKit at 360, 480, 768
-and 1280 px; needs Playwright, else `NOT_RUN` and exit 3: nothing was measured).
+and 1280 px; needs Playwright, else `NOT_RUN` and exit 3: nothing was measured; also `NOT_RUN`
+and exit 3 where the socket table is restricted, `table-restricted`, since 0.81.0: FAA-318).
 
 Then prove the lock: start a second copy by hand against the same data directory; it
 must exit 75 while the first keeps serving. Prove recovery: `kill -9` the launchd pid;