@passioncode-ai/fabric-agent-adapter 0.81.0 → 0.82.0

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_secrets.py

@@ -10,8 +10,11 @@ U+001C to U+001F, and not U+FEFF), `.` stopping at every line terminator, ASCII
 
 from __future__ import annotations
 
+import bisect
+import ipaddress
 import re
-from typing import Dict, List, Tuple
+from typing import Dict, List, Optional, Sequence, Tuple
+import unicodedata
 import urllib.parse
 
 CREDENTIAL_WORDS = (
@@ -30,6 +33,34 @@ CREDENTIAL_PAIRS: Dict[str, tuple] = {
 JS_SPACE = "\t\n\x0b\x0c\r \xa0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff"
 _NOT_LINE_END = "[^\n\r\u2028\u2029]"  # ECMAScript's `.` without the s flag
 JWT_SHAPE = re.compile(r"eyJ[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]*")
+_URL_BASE64_RUN = re.compile(r"[A-Za-z0-9_-]*")
+
+
+def jwt_spans(text: str, first: bool = False) -> List[Tuple[int, int]]:
+    """The spans JWT_SHAPE matches in a text, leftmost and not overlapping, read in one pass (the contract's `jwtSpans`,
+    FAA-313): the regular expression backtracks from every `eyJ` of a long run, quadratic in it, while every `eyJ` of
+    one run shares that run's end, so only its first is tried, and a match ends where its third segment's run ends.
+    `first` stops at the first match."""
+    spans: List[Tuple[int, int]] = []
+    at = text.find("eyJ")
+    while at >= 0:
+        one = _URL_BASE64_RUN.match(text, at + 3).end()
+        resume = one
+        if one - at - 3 >= 2 and text[one:one + 1] == ".":
+            two = _URL_BASE64_RUN.match(text, one + 1).end()
+            if two - one - 1 >= 2 and text[two:two + 1] == ".":
+                three = _URL_BASE64_RUN.match(text, two + 1).end()
+                spans.append((at, three))
+                if first:
+                    break
+                resume = three
+        at = text.find("eyJ", resume)
+    return spans
+
+
+def has_jwt(text: str) -> bool:
+    """Whether JWT_SHAPE matches anywhere in a text, read in one pass (the contract's `hasJwt`, FAA-313)."""
+    return bool(jwt_spans(text, True))
 #: Where a provider key's prefix may start (DEC-0151): the start of a value, a character that is no ASCII letter or
 #: digit, or an escape (a percent-escape, single or double, a backslash escape, an octal, `\\x` with two hex digits,
 #: `\\u` with four, an ESC colour sequence, raw or escaped). A consuming group, as the contract writes it.
@@ -83,7 +114,7 @@ def _long_secret(value: str) -> bool:
 
 def secret_value(value: str) -> bool:
     """A JWT anywhere, a provider key or `Bearer …`, or a long base64 run mixing upper case, lower case and digits."""
-    return bool(JWT_SHAPE.search(value) or SECRET_VALUE.search(value) or _long_secret(value))
+    return bool(has_jwt(value) or SECRET_VALUE.search(value) or _long_secret(value))
 
 
 def _path_like(piece: str) -> bool:
@@ -95,7 +126,7 @@ def _path_like(piece: str) -> bool:
 def secret_argument(value: str) -> bool:
     """The same for a launch argument or a server's command and URL: a long run is looked for between path separators,
     so a folder path holding a session id is not taken for a key."""
-    if JWT_SHAPE.search(value) or SECRET_VALUE.search(value) or _BEARER_INSIDE.search(value):
+    if has_jwt(value) or SECRET_VALUE.search(value) or _BEARER_INSIDE.search(value):
         return True
     for piece in _ARGUMENT_SPLIT.split(value):
         if _path_like(piece):
@@ -141,6 +172,155 @@ _C0_OR_SPACE = "".join(map(chr, range(0x21)))
 _LONE_SURROGATE = re.compile("[\ud800-\udfff]")
 
 
+# The WHATWG host parser, enough to know when `new URL` refuses a host (FAA-98, moved here from fabric_connections for
+# secret_url in FAA-309, so the module still ships alone in adapting-projects-to-fabric).
+_FORBIDDEN_HOST = set("\x00\t\n\r #/:<>?@[\\]^|")
+_FORBIDDEN_DOMAIN = _FORBIDDEN_HOST | set(chr(c) for c in range(0x20)) | {"%", "\x7f"}
+
+
+# FAA-98: UTS46 narrowed, not ported. A non-ASCII host is refused only where every Node from 20 to 26 refuses it, so
+# the doubt stays on the closed side (its URL's credentials are read). The two tables are measured by
+# test/fixtures/idna/make_idna_tables.mjs (idna-tables.json, held equal by test_the_idna_tables_are_the_measured_ones):
+# code points refused in every context, and code points removed between letters. The contextual rules read Unicode 3.2
+# classes (`unicodedata.ucd_3_2_0`) and skip what that Unicode does not know, since Node's own UTS46 data lags its
+# Unicode: an Arabic letter of Unicode 14 is no right-to-left letter to it.
+_IDNA_DISALLOWED = (
+    (0x80, 0xa0), (0xa8, 0xa8), (0xaf, 0xaf), (0xb4, 0xb4), (0xb8, 0xb8), (0x2d8, 0x2dd), (0x37a, 0x37a),
+    (0x384, 0x385), (0x600, 0x605), (0x61c, 0x61c), (0x6dd, 0x6dd), (0x70f, 0x70f), (0x890, 0x891), (0x8e2, 0x8e2),
+    (0x1680, 0x1680), (0x1fbd, 0x1fbd), (0x1fbf, 0x1fc1), (0x1fcd, 0x1fcf), (0x1fdd, 0x1fdf), (0x1fed, 0x1fee),
+    (0x1ffd, 0x1ffe), (0x2000, 0x200a), (0x200e, 0x200f), (0x2017, 0x2017), (0x2024, 0x2026), (0x2028, 0x202f),
+    (0x203e, 0x203e), (0x2047, 0x2049), (0x205f, 0x205f), (0x2066, 0x2069), (0x2100, 0x2101), (0x2105, 0x2106),
+    (0x2488, 0x249b), (0x2a74, 0x2a74), (0x2ff0, 0x3000), (0x309b, 0x309c), (0x31ef, 0x31ef), (0x33c2, 0x33c2),
+    (0x33c7, 0x33c7), (0x33d8, 0x33d8), (0xe000, 0xf8ff), (0xfc5e, 0xfc63), (0xfdfa, 0xfdfb), (0xfe12, 0xfe13),
+    (0xfe16, 0xfe16), (0xfe19, 0xfe19), (0xfe30, 0xfe30), (0xfe47, 0xfe4c), (0xfe52, 0xfe52), (0xfe55, 0xfe56),
+    (0xfe5f, 0xfe5f), (0xfe64, 0xfe65), (0xfe68, 0xfe68), (0xfe6a, 0xfe6b), (0xfe70, 0xfe70), (0xfe72, 0xfe72),
+    (0xfe74, 0xfe74), (0xfe76, 0xfe76), (0xfe78, 0xfe78), (0xfe7a, 0xfe7a), (0xfe7c, 0xfe7c), (0xfe7e, 0xfe7e),
+    (0xff03, 0xff03), (0xff05, 0xff05), (0xff0f, 0xff0f), (0xff1a, 0xff1a), (0xff1c, 0xff1c), (0xff1e, 0xff20),
+    (0xff3b, 0xff3e), (0xff5c, 0xff5c), (0xffe3, 0xffe3), (0xfff9, 0xfffd), (0x110bd, 0x110bd), (0x110cd, 0x110cd),
+    (0x13430, 0x1343f), (0x1f100, 0x1f100), (0xe0001, 0xe0001), (0xe0020, 0xe007f), (0xf0000, 0xffffd),
+    (0x100000, 0x10fffd),
+)
+_IDNA_IGNORED = (
+    (0xad, 0xad), (0x34f, 0x34f), (0x180b, 0x180d), (0x180f, 0x180f), (0x200b, 0x200b), (0x2060, 0x2060),
+    (0x2064, 0x2064), (0xfe00, 0xfe0f), (0xfeff, 0xfeff), (0x1bca0, 0x1bca3), (0xe0100, 0xe01ef),
+)
+_IDNA_DOTS = re.compile("[.\u3002\uff0e\uff61]")
+_U32 = unicodedata.ucd_3_2_0
+_RTL_OK = {"R", "AL", "AN", "EN", "ES", "CS", "ET", "ON", "BN", "NSM"}
+_JOINERS = "\u200c\u200d"
+
+
+def _in_ranges(ranges: Sequence[tuple], cp: int) -> bool:
+    i = bisect.bisect_right(ranges, (cp, 0x10ffff)) - 1
+    return i >= 0 and ranges[i][0] <= cp <= ranges[i][1]
+
+
+def _known(c: str) -> bool:
+    return _U32.category(c) != "Cn" and unicodedata.category(c) != "Cn"
+
+
+def _joiner_refused(label: str, i: int) -> bool:
+    """CheckJoiners as Node 20 to 26 all read it: they find a joining context, or a virama, anywhere in the label
+    (`\u0628a\u200c\u0627` and `\u0628\u200c\u0627\u200d` parse), so only a joiner with nothing but ASCII beside it
+    in its label has none for certain."""
+    return all(c.isascii() for j, c in enumerate(label) if j != i)
+
+
+def _bidi_refused(label: str) -> bool:
+    """RFC 5893 as Node 20 to 26 all read it: only a label holding R, AL or AN is judged, and its first code point is
+    not (Node 26 alone refuses a label opening with a digit or a hyphen)."""
+    if not label or not all(_known(c) for c in label) or any(c in _JOINERS for c in label):
+        return False  # Node 20 to 26 pass a label holding a joiner over (`\u05d0a\u094d\u200d` parses)
+    k = [_U32.bidirectional(c) for c in label]
+    if not any(x in ("R", "AL", "AN") for x in k):
+        return False
+    body = list(k)
+    while body and body[-1] == "NSM":
+        body.pop()
+    if not body or body[-1] not in ("R", "AL", "EN", "AN"):
+        return True
+    return k[0] in ("R", "AL") and (any(x not in _RTL_OK for x in k) or ("EN" in k and "AN" in k))
+
+
+def _idna_host(host: str) -> Optional[str]:
+    """None where WHATWG's domain-to-ASCII refuses a non-ASCII host for certain; else the host as UTS46 maps it, read
+    as NFKC with case folding (exact enough for the ASCII rules that follow, which read digits and dots)."""
+    if any(_in_ranges(_IDNA_DISALLOWED, ord(c)) for c in host):
+        return None
+    kept = "".join(c for c in host if not _in_ranges(_IDNA_IGNORED, ord(c)))
+    if kept == "":
+        return None  # nothing left: an empty host
+    if not all(_known(c) for c in kept):
+        return host  # a code point this Python's Unicode does not know: the contextual rules are not read
+    mapped = unicodedata.normalize("NFC", unicodedata.normalize("NFKC", unicodedata.normalize("NFKC", kept).casefold()))
+    for label in _IDNA_DOTS.split(mapped):
+        first = label[:1]
+        if first and first not in "\u17b4\u17b5" and _U32.category(first)[0] == "M" and unicodedata.category(first)[0] == "M":
+            return None  # a label opening with a mark (U+17B4 and U+17B5 are ignored by the newer Nodes)
+        if any(c in _JOINERS and _joiner_refused(label, i) for i, c in enumerate(label)):
+            return None
+        if _bidi_refused(label):
+            return None
+    return _IDNA_DOTS.sub(".", mapped)
+
+
+def _ipv4_number(part: str) -> Optional[int]:
+    if part == "":
+        return None  # an empty part fails WHATWG's IPv4 parser (`1..2`); `0x` alone is 0
+    base = 10
+    if part[:2].lower() == "0x":
+        part, base = part[2:], 16
+    elif len(part) > 1 and part[0] == "0":
+        part, base = part[1:], 8
+    if part == "":
+        return 0
+    digits = {10: "0123456789", 16: "0123456789abcdefABCDEF", 8: "01234567"}[base]
+    return int(part, base) if all(c in digits for c in part) else None
+
+
+def _domain_ok(host: str) -> bool:
+    """The WHATWG host parser on a special scheme's host, enough to know when `new URL` refuses it."""
+    if host.startswith("["):
+        return host.endswith("]") and _ipv6_ok(host[1:-1])
+    if re.search(r"%(?![0-9A-Fa-f]{2})", host) is None:
+        try:
+            host = urllib.parse.unquote_to_bytes(host).decode("utf-8")
+        except UnicodeDecodeError:
+            return False
+    if any(c in _FORBIDDEN_DOMAIN for c in host):
+        return False
+    # A non-ASCII host goes through UTS46 in WHATWG; this module reads it narrowly (_idna_host, FAA-98). When unsure,
+    # the host is taken as valid, so its URL's credentials are read: the doubt then hides a list rather than publish one
+    # (round-2 reading). A host UTS46 maps to ASCII is read by the ASCII rules below (`１２７.０.０.１` is an address).
+    if any(ord(c) > 0x7f for c in host):
+        mapped = _idna_host(host)
+        if mapped is None:
+            return False
+        if not mapped.isascii() or any(c in _FORBIDDEN_DOMAIN for c in mapped):
+            return True
+        host = mapped
+    labels = host.split(".")
+    if labels and labels[-1] == "" and len(labels) > 1:
+        labels = labels[:-1]
+    last = labels[-1] if labels else ""
+    if not (last and (last.isdigit() and last.isascii() or re.fullmatch(r"0[xX][0-9A-Fa-f]*", last))):
+        return host != ""
+    numbers = [_ipv4_number(label) for label in labels]
+    if len(numbers) > 4 or any(n is None for n in numbers):
+        return False
+    return all(n <= 255 for n in numbers[:-1]) and numbers[-1] < 256 ** (5 - len(numbers))
+
+
+def _ipv6_ok(text: str) -> bool:
+    if "%" in text:
+        return False  # a zone id: `ipaddress` takes one, WHATWG does not
+    try:
+        ipaddress.IPv6Address(text)
+        return True
+    except ValueError:
+        return False
+
+
 def _percent_encode(text: str, also: str) -> str:
     """WHATWG's percent-encoding of a query or a fragment: every C0 control, space, `"`, `<`, `>`, every code point
     above U+007E and the characters in `also`, as UTF-8 %XX (a lone surrogate as U+FFFD, as a USVString reads it).
@@ -162,8 +342,8 @@ def url_parts(value: str) -> Tuple[str, str, str]:
     after every slash or backslash that follows `scheme:` (the special authority ignore slashes state) and ends at the
     next slash, backslash, `?` or `#`, so `<https>:u:p@h` and `<https>:\\u:p@h` carry the password p; any other scheme
     has an authority only after `//`, and `file` has no user information. The user information ends at the authority's
-    last `@`, and the password follows its first `:`. A host `new URL` would refuse is not checked: such a URL is read
-    for its password and parameters all the same, the safe direction for a detector."""
+    last `@`, and the password follows its first `:`. The host is not checked here: secret_url refuses first a URL
+    whose host or port `new URL` refuses (url_refused, FAA-309)."""
     scheme, _, rest = value.partition(":")
     rest, _, fragment = rest.partition("#")
     rest, _, query = rest.partition("?")
@@ -182,10 +362,60 @@ def url_parts(value: str) -> Tuple[str, str, str]:
 _url_parts = url_parts  # the name before FAA-250, kept for code that reached it
 
 
+def url_refused(value: str) -> bool:
+    """Whether `new URL` refuses an absolute URL (trimmed as secret_url trims it) for its host or port (FAA-309), read
+    with the same authority url_parts reads: a special scheme's host through the WHATWG host parser and the IDNA reading
+    of FAA-98 (`_domain_ok`), never empty; `file`'s host, after `//`, the same, empty allowed; another scheme's host,
+    after `//`, without a forbidden host code point, and empty only with no user information and no `:` after it (an
+    empty port is refused too); a port of ASCII digits up to 65535. Where the reading is unsure, the host is taken as
+    valid (the detector's safe side)."""
+    value = _LONE_SURROGATE.sub("\ufffd", value)
+    scheme, _, rest = value.partition(":")
+    rest = rest.partition("#")[0].partition("?")[0]
+    lowered = scheme.lower()
+    if lowered in _SPECIAL:
+        authority = rest.replace("\\", "/").lstrip("/").partition("/")[0]
+    elif lowered == "file":
+        rest = rest.replace("\\", "/")
+        if not rest.startswith("//"):
+            return False
+        host = rest[2:].partition("/")[0]
+        return not (host == "" or re.fullmatch(r"[A-Za-z][:|]", host) or _domain_ok(host))
+    elif rest.startswith("//"):
+        authority = rest[2:].partition("/")[0]
+    else:
+        return False
+    hostport = authority.rpartition("@")[2]
+    if hostport.startswith("["):
+        close = hostport.find("]")
+        if close < 0:
+            return True
+        host, after = hostport[:close + 1], hostport[close + 1:]
+        if after and not after.startswith(":"):
+            return True
+        port = after[1:]
+    else:
+        host, _, port = hostport.partition(":")
+    if port and not (port.isascii() and port.isdigit() and int(port) <= 65535):
+        return True
+    if lowered in _SPECIAL:
+        return host == "" or not _domain_ok(host)
+    if host.startswith("["):
+        return not _ipv6_ok(host[1:-1])
+    return any(c in _FORBIDDEN_HOST for c in host) or (host == "" and ("@" in authority or ":" in hostport))
+
+
 def secret_url(value: str) -> bool:
     """Whether a URL an MCP entry or a launch names carries a credential (LC-21): anything secret_argument finds, a
     password in its user information, or a query or fragment parameter whose name can only carry a credential and has
-    a value, or whose value is shaped like one. A string that is not an absolute URL is checked as an argument only."""
+    a value, or whose value is shaped like one. A string that is not an absolute URL, or one whose host or port
+    `new URL` refuses (url_refused, FAA-309), is checked as an argument only, as the Node twin's secretUrl reads it."""
+    return _url_credential(value, hosts=True)
+
+
+def _url_credential(value: str, hosts: bool) -> bool:
+    """secret_url; with `hosts` False the host is not checked, as repository_credential reads a repository's parameters
+    whatever its host (the Node twin's repositoryParts)."""
     if secret_argument(value):
         return True
     # What WHATWG URL parsing does first: trim C0 controls and space from the ends (never other Unicode spaces, which it
@@ -193,6 +423,8 @@ def secret_url(value: str) -> bool:
     value = re.sub(r"[\t\n\r]", "", value.strip(_C0_OR_SPACE))
     if not _SCHEME.match(value):
         return False  # not an absolute URL (WHATWG URL parsing refuses it)
+    if hosts and url_refused(value):
+        return False  # `new URL` refuses its host or port, so the Node twin reads it as an argument only (FAA-309)
     password, query, fragment = url_parts(value)
     if password:
         return True
@@ -260,4 +492,4 @@ def repository_credential(value: str) -> bool:
     odd = [piece for written in (path, ascii_decoded(path)) for piece in re.split(r"[/\\:]", written)
            if piece and not repository_name(piece)]
     # the scheme and authority decoded too: git sends `https://%67hp_...@h` with its user decoded (unit reading 12)
-    return secret_url(head + tail) or secret_argument(ascii_decoded(head)) or any(secret_argument(piece) for piece in odd)
+    return _url_credential(head + tail, hosts=False) or secret_argument(ascii_decoded(head)) or any(secret_argument(piece) for piece in odd)

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_service.py

@@ -88,8 +88,11 @@ from fabric_lock import (  # noqa: F401
     LOCK_WAIT_SUPERVISED_SECONDS,
     LOCK_BACKOFF_FIRST_SECONDS,
     LOCK_BACKOFF_MAX_SECONDS,
+    LOCK_WATCH_SECONDS,
     AlreadyRunning,
     InstanceLock,
+    lost_lock_message,
+    stop_lost_holder,
     lock_name,
     _hold_lock_name,
     _drop_lock_name,

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/kit.json

@@ -1,6 +1,6 @@
 {
  "name": "fabric-service-kit",
- "version": "0.81.0",
+ "version": "0.82.0",
  "about": "The service kit's modules in dependency order: a module imports only modules listed before it. Written by fabric_kit.py build; edit the order and layers by hand, never the digests.",
  "python": [
   {
@@ -31,14 +31,14 @@
    "file": "fabric_secrets.py",
    "layer": "L0",
    "imports": [],
-   "sha256": "b8ee6910591f33456e9bf88415b0ea433c807e0dbb7fa8a92051350e17683f15"
+   "sha256": "2ebbd53d4b162fb41586b07ccc31534cbc3a9c6632a4ff84f56d29e90bd4294f"
   },
   {
    "module": "fabric_peer_owner",
    "file": "fabric_peer_owner.py",
    "layer": "L0",
    "imports": [],
-   "sha256": "7e71b9ac8da71da6b31852e4329dc8231075b8f391f04ede2b20900a8cbbb387"
+   "sha256": "7e007a74ab166e06046610c5961c134e523247e6d1ed010934369b7b27642bfc"
   },
   {
    "module": "fabric_tailnet",
@@ -211,7 +211,7 @@
     "fabric_base",
     "fabric_secrets"
    ],
-   "sha256": "5499d421c658f8bf00241e5e2291bd02d9ea473a229a812de3d3de9a62562ae6"
+   "sha256": "ca6a4735b21d285a3ef2c60724f3ead08f5aa707fdfaa3cb5757e02a226132a0"
   },
   {
    "module": "fabric_a2a",
@@ -257,7 +257,7 @@
     "fabric_paths",
     "fabric_platform"
    ],
-   "sha256": "10d6a2321ac8da47fc6f5bb01b32e2f8c8c966ef6d7145cf3b12bd35156bd650"
+   "sha256": "6dac051969f2c331f7cc6a90b6bb1a506a5a23a4082425d07e708ce6682aedfb"
   },
   {
    "module": "fabric_usage",
@@ -298,7 +298,7 @@
     "fabric_secrets",
     "fabric_usage"
    ],
-   "sha256": "15bc54a6f4419113bead2e482d64f6581d12be0b9eb8e97ede03a7399f6a325e"
+   "sha256": "10728dffb641c267a6dd89e47f84aed7e8cc28a00189e6545432c683bc33d85c"
   },
   {
    "module": "fabric_context",
@@ -384,7 +384,7 @@
     "fabric_time",
     "fabric_usage"
    ],
-   "sha256": "6ad0c177c2c83a3db5dede248eb10ba0947fffe0b345a9691c3e7db9ee1fba87"
+   "sha256": "fb6bccc9f330df26a53287023da2ce4947f85e6b4fb2437db01c429ec809454d"
   },
   {
    "module": "fabric_profiles",
@@ -441,7 +441,7 @@
     "fabric_paths",
     "fabric_secrets"
    ],
-   "sha256": "cf4e8a92b685878adea9af6baf7d40037faee31e5359774b8d8481b8588c8cb3"
+   "sha256": "277533ec3bf1766a5a583d852dec9a048f63d9a8d1984cfc6e32df3218849c59"
   },
   {
    "module": "fabric_hub",
@@ -452,7 +452,7 @@
     "fabric_peer_owner",
     "fabric_service"
    ],
-   "sha256": "484d0480e2ae2b82f62647104e1383576646f226045a444d4c9dc1c5e5c7eee2"
+   "sha256": "8809de7a2add22f4ce28bee5191458502e7b3bcf96efd3ad67b60de1aaaa529d"
   },
   {
    "module": "fabric_board_shapes",
@@ -529,7 +529,7 @@
     "fabric_jsvalue",
     "fabric_peer_owner"
    ],
-   "sha256": "0efd3e84bdde304f5ddfe6ce0ea7f77bb28aa5187e3fb7940a82378f26c573d5"
+   "sha256": "5a6d5ccfb76239777ef4d95fe60f96dcb156e2b8fad329a7f83a85c5c9ac4a61"
   },
   {
    "module": "fabric_openrouter",
@@ -570,14 +570,14 @@
    "file": "fabric-secrets.mjs",
    "layer": "L0",
    "imports": [],
-   "sha256": "e06af295ce278369de105a5138288b6a6b5efcc9e972de693610a018cf9bdbd6"
+   "sha256": "af4b7023c20eb40d418a431f60a5ab94a0618b01891051aacc13772e97532297"
   },
   {
    "module": "fabric-peer-owner",
    "file": "fabric-peer-owner.mjs",
    "layer": "L0",
    "imports": [],
-   "sha256": "eb2d6f0c2a601bd168f6b0987c64ad05a2dcf38c1c2009708f79eafc266ac1ff"
+   "sha256": "c58f444df44df74f8d755d95fbb3c751ccc856c5fc2fc4e178a44df26cdd12d7"
   },
   {
    "module": "fabric-tailnet",
@@ -667,7 +667,7 @@
     "fabric-paths",
     "fabric-peer-owner"
    ],
-   "sha256": "27b8f28d072c756b60f5cb90957e22700500dc8eb86ba18bd61c451e6788390b"
+   "sha256": "fbfefe8f48f9f926f6ecfe8dce1e2781eba2f4c4abef6eeec3f52837246344b6"
   },
   {
    "module": "fabric-share",
@@ -749,7 +749,7 @@
     "fabric-jsvalue",
     "fabric-secrets"
    ],
-   "sha256": "303432e547ce563e90ca9ffcd827f5612f51d3582929834e1add0fdaf6485dcc"
+   "sha256": "dd82998d7b854bfb4a11fa0fc442357e1037e379f849a91ec21f0f81d73a82fb"
   },
   {
    "module": "fabric-a2a",
@@ -793,7 +793,7 @@
     "fabric-base",
     "fabric-paths"
    ],
-   "sha256": "cf79c3aed04dfd36833929f7edd76404976699ac7a8fe38820f0fa02fc2243be"
+   "sha256": "ffd569de66d214c18f2b739e1e5fd169d84fe8f034fee8ed3d1fcb1cd87325c7"
   },
   {
    "module": "fabric-usage",
@@ -835,7 +835,7 @@
     "fabric-secrets",
     "fabric-usage"
    ],
-   "sha256": "ac172e0f906b4f530ff03ab43c750e6a8079c4f21c0178ae1b58e99e7534df8e"
+   "sha256": "d2380f116d62c076c7510a4f1b8fd6e266ac88818d4e841d7f08d4000e819c6b"
   },
   {
    "module": "fabric-context",
@@ -920,7 +920,7 @@
     "fabric-supervisors",
     "fabric-usage"
    ],
-   "sha256": "3beca77cacc4becdbc440ccc1449d1a7fc6451fb7e1f664ffbfaa5b1895938d1"
+   "sha256": "0d21b3f6f4a51b3ede576e748d481ab831fec570f629883b95f138c8823ab320"
   },
   {
    "module": "fabric-profiles",
@@ -971,7 +971,7 @@
     "fabric-paths",
     "fabric-secrets"
    ],
-   "sha256": "8ecce5c18e1c7f9a26502dc77507c163e17d2cd4d661905e3c9d8f1964dbe2e8"
+   "sha256": "bab47b2cdad663dc39a581d0d30d33c59bb847016431e18a63b326fefd612160"
   },
   {
    "module": "fabric-hub",
@@ -982,7 +982,7 @@
     "fabric-peer-owner",
     "fabric-service"
    ],
-   "sha256": "081d5b2fda552fe6ee737c22e1e87fa113568cb4e9d864c110a6a0aec758b22f"
+   "sha256": "2813beb86f72cc1932601678f81596de16f9876c9d3630874f27addf66d7b082"
   },
   {
    "module": "fabric-board-shapes",
@@ -6983,6 +6983,104 @@
    "fabric-openrouter.mjs": "4e3e73a1b8882bdde4cbb311f6f4a5e2f048fa81fa245409a16df1e6cab03e19",
    "fabric-package.schema.json": "2ba799f576fad0f608029223c4ccccd122152f1c5dbfa8ce8b31cd63ac92ad44",
    "share-registration.schema.json": "34b3997eeaf936ebc861342a23045634a7c18c19f01d7ed4198310d81989f5b0"
+  },
+  "0.82.0": {
+   "fabric_jsvalue.py": "052f1b40bab18600b3731dbdca27cbff17588c21d9458fa6241efd1340d0e09a",
+   "fabric_time.py": "588f383da4ac6a243ea95b6ffc3a0aa99ca94245732dc4937734f190b7af4ae9",
+   "fabric_identifiers.py": "0fd814d521ac3aa39907458265870753046a73f48af3d8581ab864b93b211607",
+   "fabric_secrets.py": "2ebbd53d4b162fb41586b07ccc31534cbc3a9c6632a4ff84f56d29e90bd4294f",
+   "fabric_peer_owner.py": "7e007a74ab166e06046610c5961c134e523247e6d1ed010934369b7b27642bfc",
+   "fabric_tailnet.py": "c60416539be0199182f7969c24a37b14d0db50c8ea5e3e04cea43babfb483407",
+   "fabric_crypto.py": "9c34aee20dbe4d6742e4fdbaab68ceb934bbe7dbd3a904c0010824ace16cdeaa",
+   "fabric_base.py": "d8c67f345e30332cce3664af77b0e6e07cd477b78c961ac009e9efee1be7e1b2",
+   "fabric_platform.py": "a9350dff55ef0fb3a23cdb4d0320a15868b15a8deb10d2eb74d72c58740c284b",
+   "fabric_paths.py": "8a1ee742f80f436e9f28c61b4f049a9545de2a9e0d66bfc61faa6ee5d1ba3734",
+   "fabric_estate_rules.py": "8b36a7f4108d9c2b1fb38c8bff344778c807bed631a99b4a563ecb0a49c10b1c",
+   "fabric_estate.py": "0737ae1d1bb12586bae49de1f15ef1348bc207b5007cced9dad4c55bb5870874",
+   "fabric_mandate.py": "fb19ce5359606bd6e3352ab02b2a12f49605ec6e5c49b55cce1f79c831325044",
+   "fabric_delegation.py": "e923be4d2d901d5e0d8bf16b05a637119464009a51cffb247bd20de5e9c1d0c9",
+   "fabric_share.py": "da36a466426fc29dd7dd40013167f3959a18375f8fedd228bf64f298cec1040c",
+   "fabric_ceremonies.py": "a59e83cf4adb2669a9b98008e3d3a0cba991a35cbff97bc604fc82fe81cfd49f",
+   "fabric_package_schema.py": "e623f0408d38e3343ed66222fb812907c6c52e1a286eb1c1176ab2e64640c9ad",
+   "fabric_package.py": "8b835fcf173b8c345ea6d229edf8ebb98b0f94e9af4894c4a6bd1301f175e2b1",
+   "fabric_protocols.py": "3cba881f6f3468e8d8a8455a5d54c5567e748c37291211a1c7f22d195ea562c4",
+   "fabric_actions.py": "ae21d1199614c4f74d1dcd1e0a87107a9d52434cd9e2d64aa24a7b1e196fb723",
+   "fabric_connections.py": "ca6a4735b21d285a3ef2c60724f3ead08f5aa707fdfaa3cb5757e02a226132a0",
+   "fabric_a2a.py": "8b01502131215bb4de1c01866187c56e99b791543923ed8577535573db33b919",
+   "fabric_page_links.py": "1b57ea573c550e2f90d1ec3edcc655917ceaa0db9dd1635fccf422ec3024d25e",
+   "fabric_load.py": "0e97b6307108c5877a728be8f0c416686130ce98b31c4dfd5d788d9dc61a8860",
+   "fabric_lock.py": "6dac051969f2c331f7cc6a90b6bb1a506a5a23a4082425d07e708ce6682aedfb",
+   "fabric_usage.py": "c1a605a84e57c5ab5d3b2bd824412c20219c237dfc4bc13f778f75340905f51e",
+   "fabric_backups.py": "1f3f0d7ecf361b29e9101e07f1c53e5dc304d598bf26fd59ec89f16b9fed2420",
+   "fabric_descriptor.py": "10728dffb641c267a6dd89e47f84aed7e8cc28a00189e6545432c683bc33d85c",
+   "fabric_context.py": "59e39fb9fd91f713f6e92ea3ec7e8252107efd148847f05934892158b326db4d",
+   "fabric_auth.py": "74ccc10239b65a3567cec5213a7b344cbd88d6eee1fd1c5f7be1d6daf985993c",
+   "fabric_events.py": "da3fe3e3e19d4c9754b90c719e9c069a3ac85e080b9fffd07adbaf63b5bfcf0d",
+   "fabric_logs.py": "86dc55bfafa2a57264722e2403510a249b95de0e4a722b2e4bc3948e3bd93da9",
+   "fabric_supervisors.py": "e5e77c7ddac742fd1882d42be33eb694906e7eb869abbee0e825d4f687936698",
+   "fabric_service.py": "fb6bccc9f330df26a53287023da2ce4947f85e6b4fb2437db01c429ec809454d",
+   "fabric_profiles.py": "26e21ec29c016000f8ca8053b7b489184854a73be1b7fdc0a18d12990203db9b",
+   "fabric_interop_rules.py": "9bdb7989e57b9d0b0d15eb9982d396499823a5e2c528230b71c67866c736e0f5",
+   "fabric_interop.py": "2b4d6c144f496dbd8788f616de9956bb8b6e89290713c406aa601511c82f4a46",
+   "fabric_holds.py": "277533ec3bf1766a5a583d852dec9a048f63d9a8d1984cfc6e32df3218849c59",
+   "fabric_hub.py": "8809de7a2add22f4ce28bee5191458502e7b3bcf96efd3ad67b60de1aaaa529d",
+   "fabric_board_shapes.py": "0a0e8d3d40e33dfd8c457aedb85330b2ff25f8c49a33eb6cbd5a5cc8a5007f7e",
+   "fabric_board_link.py": "37aacd7afb0b7971c60f434d489fbfc556a70d8da87257179d891be4d2b661b0",
+   "fabric_board_slots.py": "377407183d91f5cfe264274024f0895e58fa97a84cbcead51eaa78c671d5806d",
+   "fabric_board_session.py": "21623dc42eb8be9f4586ab403c0dde597d1e3c38b366bf57621e1401ddbe5096",
+   "fabric_board_fixture.py": "69761ce205ec640762ec9b591c6903e5a87f844e8d423b041681924027e39d1e",
+   "fabric_board.py": "f86c40b8291f8c818f6924910f4022b013d5fd107abaf8825dd0aa6c5e418638",
+   "fabric_http.py": "5a6d5ccfb76239777ef4d95fe60f96dcb156e2b8fad329a7f83a85c5c9ac4a61",
+   "fabric_openrouter.py": "a415db7475c3359fa15c85979a63a3a223a0ad7f85f878bcc2d638acccb44090",
+   "fabric-jsvalue.mjs": "dfbdb8c41584972c9389750a41719374a1cfc5652ed438dd1623025190b0106e",
+   "fabric-time.mjs": "3ff932069038a720df1c68c6492976906737b2e67e5c12d9c81c418597f661de",
+   "fabric-identifiers.mjs": "a18c2a501a4aa170bfd3d99e571ad6b7662649b4d3b9d2a540c002ea42811bbf",
+   "fabric-secrets.mjs": "af4b7023c20eb40d418a431f60a5ab94a0618b01891051aacc13772e97532297",
+   "fabric-peer-owner.mjs": "c58f444df44df74f8d755d95fbb3c751ccc856c5fc2fc4e178a44df26cdd12d7",
+   "fabric-tailnet.mjs": "aff3591552448bc042af306cd8a9e5cb9102c6b62d6dc05d53db35e35c51e347",
+   "fabric-crypto.mjs": "038e03689701e3c9721a1e7f8e0a4d02a52d6a5d1661b0dc84035edc3ebbfcf6",
+   "fabric-base.mjs": "1a804bfc3ec5d2479ffc39d3c8d67b056b72af836e1b88102881f9ff632f1901",
+   "fabric-platform.mjs": "a8119d95ebba4d589a9e401f5d6fc8dda62d59d44e4c1ff811d97fac3771ac0c",
+   "fabric-paths.mjs": "aa630d611e748a899e7043480f4a4e46b444f2e15ff945f30c2fbef21c1ceea5",
+   "fabric-estate-rules.mjs": "7476be71174aa5b1026134f2b335abf647feaa55584e2f9de8618e3054aa8e1e",
+   "fabric-estate.mjs": "e8a2e62d2313121e6cb502f6e6abad94d1d546a44b4d9b3ce2be29e7808e8cf3",
+   "fabric-mandate.mjs": "b70f3de03a659e60bba7b5a0580b3582825cd7b8a8e30a28c79621919ec5b7bb",
+   "fabric-delegation.mjs": "fbfefe8f48f9f926f6ecfe8dce1e2781eba2f4c4abef6eeec3f52837246344b6",
+   "fabric-share.mjs": "bfb26581c21ad984c2a337da02429f9f3a165cc582f8ba48de4d3dfb7d163a59",
+   "fabric-ceremonies.mjs": "117d4374c9e95c930a38de7adbd4323774798f4fe6ec6f24afcd6f2c7298ca44",
+   "fabric-package-schema.mjs": "cd28092375db0fc21ffab1f0bb7794f7f8979ee08c64d3b9faf4b3845357caa6",
+   "fabric-package.mjs": "aa75c4f6ff3dade68a47c6187666332a3845b3f5da98b50e3da7824d918e941f",
+   "fabric-protocols.mjs": "26eeb8c63e9881d8fa56389455626f2bb80725bbc25b9d6ed756af88c05a848e",
+   "fabric-actions.mjs": "06e42f5e24c96311d5417d0d1effa93479ef7128a7ab139903b2bcf59253f6be",
+   "fabric-connections.mjs": "dd82998d7b854bfb4a11fa0fc442357e1037e379f849a91ec21f0f81d73a82fb",
+   "fabric-a2a.mjs": "51b72fe1d80649d659fcad3a8f96370db3476c4a7b30cbabd8522c138be69346",
+   "fabric-page-links.mjs": "a8834926e9d4bbf7c4857f551451d2ebf6ac8873bbccaaf89c5e30cf45b17ee6",
+   "fabric-load.mjs": "88d9fc5576ac605a038b7ca8a8498aa0dc5848dee94f66c4c7900bd9de48e935",
+   "fabric-lock.mjs": "ffd569de66d214c18f2b739e1e5fd169d84fe8f034fee8ed3d1fcb1cd87325c7",
+   "fabric-usage.mjs": "d42ae671a1182a542f94a83cc297b1ef2161376f4f56267a8915e7123c025087",
+   "fabric-backups.mjs": "cfd8c9085e3d597a783099c2bd2ffe2f3faa0daaadab46dedd30523894cfeb06",
+   "fabric-descriptor.mjs": "d2380f116d62c076c7510a4f1b8fd6e266ac88818d4e841d7f08d4000e819c6b",
+   "fabric-context.mjs": "ac88273a7ff0010a122c9bd309012a484c439ffd6e9e16923f103a3f8de7a539",
+   "fabric-auth.mjs": "10ff37a39f9e3adb4d0f05db66c45f49b10eef582e9220c213907964109d7e52",
+   "fabric-events.mjs": "c95c07e2745e52fddbb7237b89824123f240d4f8d6b14f5cb269a09e1845c3ba",
+   "fabric-logs.mjs": "58467e5719c16e099d05bbedec47a95712506ab03c33f3cd4be1252e8498a946",
+   "fabric-supervisors.mjs": "6d9fecb0f19e82548c991be2e7e76e1bde5405fa34c6606f90025cc14128395e",
+   "fabric-service.mjs": "0d21b3f6f4a51b3ede576e748d481ab831fec570f629883b95f138c8823ab320",
+   "fabric-profiles.mjs": "314376cf2deb87f235fb18b11d3b532e211f585b9af0a9302b5f4cc39971b532",
+   "fabric-interop-rules.mjs": "b4e386c359a48e49ffff8a842215760c18a7c98a0af4754a808a35fb2820d458",
+   "fabric-interop.mjs": "989040aed33b2712a258244192bdf70e811a51076aa1b62f2adc2a6db051dbed",
+   "fabric-holds.mjs": "bab47b2cdad663dc39a581d0d30d33c59bb847016431e18a63b326fefd612160",
+   "fabric-hub.mjs": "2813beb86f72cc1932601678f81596de16f9876c9d3630874f27addf66d7b082",
+   "fabric-board-shapes.mjs": "c1db7b7bd0d58d82bb6d8dfbc3cd1547a256a333052d367e82ff1b3edf2804d7",
+   "fabric-board-link.mjs": "a21fcfe6f4e701b1f5142a008ceeb7eea42c251a01688f9022539235b6f80b62",
+   "fabric-board-slots.mjs": "721c5f3ddb0bd76d6b5d9e08807e50392302e71efa4385e351d9bee2ad06c103",
+   "fabric-board-session.mjs": "ccce0f335e85ce676edbaf15dc6c048e7fb50a9e34310724759b84cafd4139a0",
+   "fabric-board-fixture.mjs": "83c4b7e33ee47b68385faf2569d38d5c8a0c5cb0f8656090f41e1b0eed2f436e",
+   "fabric-board.mjs": "15fbb4441fcf7d2f285375b75de64ad6cffea129c515084c110245376b07775f",
+   "fabric-http.mjs": "7bb5e41d2fbd3ba2717946777be7fd91e41ec4514a92aae2351ae8c4f2439476",
+   "fabric-openrouter.mjs": "4e3e73a1b8882bdde4cbb311f6f4a5e2f048fa81fa245409a16df1e6cab03e19",
+   "fabric-package.schema.json": "2ba799f576fad0f608029223c4ccccd122152f1c5dbfa8ce8b31cd63ac92ad44",
+   "share-registration.schema.json": "34b3997eeaf936ebc861342a23045634a7c18c19f01d7ed4198310d81989f5b0"
   }
  },
  "data": {

package/plugins/fabric-agent-adapter/skills/creating-fabric-agents/SKILL.md

@@ -9,7 +9,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode. Ships in one plugin with adapting-projects-to-fabric, whose scripts it reuses.
 metadata:
   author: PassionCode.ai
-  version: "0.81.0"
+  version: "0.82.0"
   contract-version: "0.1.0"
   contract-commit: "93e7db164c7829e2783b4b7705c4113bb5201131"
 ---

package/plugins/fabric-agent-adapter/skills/creating-fabric-agents/references/dashboard-links.md

@@ -123,7 +123,15 @@ if_absent policy, the same device and `"listener_owner": "this-account"`: the ki
 the host read for the listener on http_url's port (`fabric_peer_owner`'s
 `this-account`, `another-account`, `system`, `unknown`, `none`, or
 `check_service.py`'s `foreign-user`); any other, or none given, refuses the
-browser (DEC-0154 PL-3, FAA-251). The native link does not take it: Fabric
+browser (DEC-0154 PL-3, FAA-251). The host reads that kind right before it opens
+the page with the adapter's
+`python3 building-fabric-services/scripts/fabric_peer_owner.py listener <port>`
+(or `node building-fabric-services/scripts/fabric-peer-owner.mjs listener <port>`),
+which prints it on one line (`--json` prints the whole owner) and sends nothing
+to the port (FAA-315). Where the socket table is restricted (macOS 27.2 for an
+ad-hoc-signed Python or Node, DEC-0155 RT-4) only this account's listener on
+exactly `127.0.0.1` reads `this-account`; a wildcard or `::1` bind reads
+`unknown` (`table-restricted`), and the browser is refused. The native link does not take it: Fabric
 Dashboards checks its own listener. Contract DEC-0123 PL-3 also allows a browser
 on `unsupported` (a system the host does not ship for); the gate treats
 `unsupported` as no fallback, by the operator's rule that a browser opens only on a

package/plugins/fabric-agent-adapter/skills/creating-fabric-agents/scripts/check_dashboard_link.py

@@ -28,6 +28,24 @@ CREDENTIAL_PAIRS = {
     'session': {'token', 'id'},
     'code': {'login', 'auth', 'access', 'session'}}
 JWT_SHAPE = re.compile(r'eyJ[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]*')
+URL_BASE64_RUN = re.compile(r'[A-Za-z0-9_-]*')
+
+
+def has_jwt(text):
+    # Whether JWT_SHAPE matches anywhere, read in one pass (the contract's hasJwt, FAA-313): the expression backtracks
+    # from every `eyJ` of a long run, quadratic in it, while every `eyJ` of one run shares that run's end, so only its
+    # first is tried. The kit's fabric_secrets.has_jwt reads the same way; this file stands alone, so it has its own.
+    at = text.find('eyJ')
+    while at >= 0:
+        one = URL_BASE64_RUN.match(text, at + 3).end()
+        if one - at - 3 >= 2 and text[one:one + 1] == '.':
+            two = URL_BASE64_RUN.match(text, one + 1).end()
+            if two - one - 1 >= 2 and text[two:two + 1] == '.':
+                return True
+        at = text.find('eyJ', one)
+    return False
+
+
 # The contract's SECRET_VALUE at the pin (DEC-0151): `Bearer ` at a value's start in any case, or a provider key with its
 # prefix in its canonical case after a boundary (the start, a character that is no ASCII letter or digit, or an escape);
 # an `sk-` key holds a digit and an upper-case letter with 16 or more characters, or a digit with 32 or more.
@@ -58,7 +76,7 @@ def credential_name(name):
 def secret_value(value):
     long_secret = any(re.search(r'[a-z]', run) and re.search(r'[A-Z]', run) and re.search(r'[0-9]', run)
                       for run in LONG_RUN.findall(value))
-    return bool(JWT_SHAPE.search(value) or SECRET_VALUE.search(value) or long_secret)
+    return bool(has_jwt(value) or SECRET_VALUE.search(value) or long_secret)
 
 
 def carries_credential(text):