@passioncode-ai/fabric-agent-adapter 0.82.0 → 0.83.1

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_package.py

@@ -390,12 +390,24 @@ def package_findings(pkg: Dict[str, Any]) -> List[Dict[str, str]]:
 
 # --- the folder check and the verifier ------------------------------------------------------------------
 
+def _json_int(text: str) -> Any:
+    """An integer literal as JSON.parse reads it: one longer than a Python with `int_max_str_digits` reads is a float,
+    as a JavaScript number is (FAA-194 (36))."""
+    return int(text) if len(text) <= 4000 else float(text)
+
+
 def _parsed(data: Optional[bytes]) -> Optional[Dict[str, Any]]:
+    """A plugin or provider manifest as the contract's checkPackageFolder reads it: decoded with replacement characters
+    (`Buffer.toString`, FAA-194 (29)); NaN or Infinity, or nesting past MAX_NESTING (the limit both kits share, FAA-194
+    (27)), is no manifest."""
     if data is None:
         return None
+    text = data.decode("utf-8", "replace")
+    if _nesting(text) > MAX_NESTING:
+        return None
     try:
-        value = json.loads(data.decode("utf-8"), parse_constant=fd._no_constant)
-    except (ValueError, RecursionError):  # invalid UTF-8, NaN or Infinity is no manifest, in both kits
+        value = json.loads(text, parse_constant=fd._no_constant, parse_int=_json_int)
+    except (ValueError, RecursionError):
         return None
     return value if isinstance(value, dict) else None
 
@@ -419,7 +431,7 @@ def check_package_folder(pkg: Dict[str, Any], files: Dict[str, bytes]) -> List[D
             problems.append({"problem": "file-unlisted", "path": path})
     if PLUGIN_MANIFEST in files:
         plugin = _parsed(files.get(PLUGIN_MANIFEST))
-        if not plugin or not _same_member(plugin, "name", pkg.get("id", _UNDEFINED)) or not _same_member(plugin, "version", pkg.get("version", _UNDEFINED)):
+        if plugin is None or not _same_member(plugin, "name", pkg.get("id", _UNDEFINED)) or not _same_member(plugin, "version", pkg.get("version", _UNDEFINED)):
             problems.append({"problem": "plugin-manifest", "path": PLUGIN_MANIFEST})
     provider = pkg.get("provider")
     if isinstance(provider, str) and provider in files:
@@ -615,7 +627,7 @@ def read_folder(folder: Any) -> Dict[str, bytes]:
         if _BY_FOLDER:
             os.close(top)  # type: ignore[arg-type]
     if refused:
-        raise PackageError("Not packed: remove these or pack a clean copy: " + "; ".join(sorted(refused)))
+        raise PackageError("Not packed: pack a clean copy (what Git would commit, references/package.md); delete only litter and credential files in place: " + "; ".join(sorted(refused)))
     return files
 
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_paths.py

@@ -38,23 +38,35 @@ def services_dir() -> Path:
     return Path(base) / "passioncode-fabric/services"
 
 
+def _durable(service_id: str, dirs: Dict[str, Path]) -> Dict[str, Path]:
+    """FABRIC_DATA_HOME (FAA-192): an absolute folder on a durable volume holds the data folder, `<home>/<id>`, on a host
+    whose own disk does not persist; logs and cache stay where the OS puts them. A relative value is refused."""
+    value = os.environ.get("FABRIC_DATA_HOME")
+    if not value:
+        return dirs
+    if not os.path.isabs(value):
+        raise ServiceError("FABRIC_DATA_HOME is an absolute folder on a durable volume.")
+    return dict(dirs, data=Path(value) / service_id)
+
+
 def service_dirs(service_id: str) -> Dict[str, Path]:
-    """State lives outside code: data+config, logs and cache in per-user OS directories."""
+    """State lives outside code: data+config, logs and cache in per-user OS directories (the data folder under
+    FABRIC_DATA_HOME when it is set)."""
     _require_id(service_id)
     home = Path.home()
     if sys.platform == "darwin":
-        return {
+        return _durable(service_id, {
             "data": home / "Library/Application Support" / service_id,
             "logs": home / "Library/Logs" / service_id,
             "cache": home / "Library/Caches" / service_id,
-        }
+        })
     if sys.platform == "win32":
         data = _local_app_data() / service_id
-        return {"data": data, "logs": data / "Logs", "cache": data / "Cache"}
+        return _durable(service_id, {"data": data, "logs": data / "Logs", "cache": data / "Cache"})
     data = Path(os.environ.get("XDG_DATA_HOME") or home / ".local/share") / service_id
     state = Path(os.environ.get("XDG_STATE_HOME") or home / ".local/state") / service_id
     cache = Path(os.environ.get("XDG_CACHE_HOME") or home / ".cache") / service_id
-    return {"data": data, "logs": state / "logs", "cache": cache}
+    return _durable(service_id, {"data": data, "logs": state / "logs", "cache": cache})
 
 
 def instance_dirs(service_id: str, instance: str = "default") -> Dict[str, Path]:
@@ -69,6 +81,9 @@ def instance_dirs(service_id: str, instance: str = "default") -> Dict[str, Path]
     folder, personal = "%s.%s" % (service_id, instance), service_dirs(service_id)
     if sys.platform == "win32":
         data = personal["data"].parent / folder
+        if os.environ.get("FABRIC_DATA_HOME"):  # logs and cache stay on the local disk, beside the default's
+            local = personal["logs"].parent.parent / folder
+            return {"data": data, "logs": local / "Logs", "cache": local / "Cache"}
         return {"data": data, "logs": data / "Logs", "cache": data / "Cache"}
     if sys.platform == "darwin":
         return {key: path.parent / folder for key, path in personal.items()}

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_peer_owner.py

@@ -1,25 +1,22 @@
 """peer_owner: which OS account owns each end of a loopback TCP connection.
 
-    peer_owner 1.2.0+kit.6: Observatory's peer_owner 1.2.0 (passioncode-ai/project-observatory-dashboard,
-    `observatory/engine/peer_owner.py`, first vendored at f86f0622, read against 2180235c; the same licence), the kit's
-    `fabric_peer_owner` (layer L0; DEC-0154 HA-2, FAA-226, FAA-258). Observatory's 1.3.x (this account's own sockets
-    through libproc, DEC-0155 RT-2) is not in it (FAA-292). The kit's differences: `Owner` and `Row` are NamedTuples
-    (a dataclass with postponed annotations needs its module in sys.modules, and a service may load a kit file by
-    path); `Optional[X]` for `X | None` (the kit's floor is Python 3.9); `classify` / `classify_sid` ask for this
-    process's own uid or SID first (a client running as root or SYSTEM owns root's listener); on Linux `server_end`
-    reads an accepted connection's own row and, for one not accept()ed yet (uid 0, inode 0), the listener on its local
-    address (CT-254; reasons `not-accepted`, `several-rows`, `closed`), `peer` reads a client row with inode 0 as
-    unknown, several rows of one owner are that owner, a row printed twice counts once, and a `/proc` question that
-    finds no row or several reads once more; ctypes is imported where used. On macOS (kit.2 to kit.4, FAA-267,
-    FAA-273): the sysctl calibration also requires a child process's listener, an empty or header-only netstat is
-    `TABLE_RESTRICTED`, a caller may vouch for a listener with a pid it started (`pid_listens`,
-    `CheckedHTTPConnection(vouch_pid=...)`), the child's port is read under one deadline with `selectors`, a number is
-    ASCII digits only. DEC-0155 (kit.6, FAA-312): a netstat that fails, a table with no row of another uid (sysctl) or process
-    (netstat) and a missing connection row read as `table-restricted` (RT-1); a restricted table's listener is this
-    account's only on exactly 127.0.0.1 (RT-4); the vouch takes exactly 127.0.0.1 (RT-3), never from a set-uid
-    reader. `main` is the CLI, `listener <port>` (FAA-315). /proc carries a socket's creator, so a listener root created
-    and handed to another account (systemd socket activation, User=) reads as root's. Standard library only, no other
-    kit module. Tests: `test/test_fabric_peer_owner.py`; the Node twin is `fabric-peer-owner.mjs` (no ctypes).
+    peer_owner 1.3.1+kit.7: Observatory's peer_owner (passioncode-ai/project-observatory-dashboard,
+    `observatory/engine/peer_owner.py`, vendored at f86f0622, read against 2180235c for 1.2.0 and a69c6fee for 1.3.1),
+    the kit's `fabric_peer_owner` (layer L0; DEC-0154 HA-2, FAA-226, FAA-258). 1.3.1's proof from this account's own
+    sockets (DEC-0155 RT-2) is the kit's `fabric_socket_proof`, asked when it sits beside this file (FAA-292); without
+    it this file stands alone, as before. The kit's differences: NamedTuples (a service may load a kit file by path);
+    the Python 3.9 floor; `classify` / `classify_sid` ask for this process's uid or SID first (a client running as root
+    owns root's listener); on Linux `server_end` reads an accepted connection's own row and, for one not accept()ed yet
+    (uid 0, inode 0), the listener on its local address (CT-254), several rows of one owner are that owner, a row
+    printed twice counts once, and a `/proc` question that finds no row or several reads once more. On macOS (FAA-267,
+    FAA-273): the sysctl calibration also requires a child's listener, read under one deadline with `selectors`; a
+    number is ASCII digits only; a caller may vouch for a listener with a pid it started (`pid_listens`,
+    `CheckedHTTPConnection(vouch_pid=...)`, RT-3, the fallback after RT-2). DEC-0155 (FAA-312): a netstat that fails or
+    is empty, a table with no row of another uid (sysctl) or process (netstat) and a missing connection row read as
+    `table-restricted` (RT-1); a restricted table's listener is this account's only on exactly 127.0.0.1 (RT-4); no
+    proof is taken from a set-uid reader. `main` is the CLI, `listener <port>` (FAA-315). /proc carries a socket's
+    creator, so a listener root created and handed to another account (socket activation) reads as root's. Tests:
+    `test/test_fabric_peer_owner.py`; the Node twin is `fabric-peer-owner.mjs`.
 
 WHY. Loopback is one per machine, not one per OS account. On a host with several accounts, every account's processes
 reach every service any account listens with on 127.0.0.1, and a loopback socket proves nothing about who is on the
@@ -29,17 +26,14 @@ other end. This module answers that question from the host's socket table, read
     server_end(sock) -> Owner     for a client's connected socket: who accepted it
     peer(sock) -> Owner           for a server's accepted socket: who connected
     peer_at(server, client)       the same as `peer`, from two (host, port) addresses
-    own_connection(port, ...)     a CheckedHTTPConnection, connected: every connect, the first and
-                                  any reconnect http.client makes after `Connection: close`, checks
-                                  that the server end is this account's, or raises ListenerRefused
-                                  before a byte of the request is sent
+    own_connection(port, ...)     a CheckedHTTPConnection, connected: every connect (the first, and any reconnect
+                                  http.client makes) checks the server end is this account's before a byte is sent
 
 `Owner.kind` is one of:
 
     this-account      the socket belongs to the account running this process
     another-account   another OS account's
-    system            uid 0, pid 1 (launchd holds the sockets of socket-activated jobs) or, on
-                      Windows, the system's own accounts and processes
+    system            uid 0, pid 1 (launchd's socket-activated jobs) or, on Windows, the system's accounts and processes
     unknown           the owner could not be told; `reason` says why
     none              `listener` only: nothing listens on that port
 
@@ -52,36 +46,28 @@ answer; two live rows with the same addresses are `unknown` (`several-rows`), ne
 
 - macOS, primary (`sysctl`): `sysctl net.inet.tcp.pcblist_n` through ctypes, the record list `netstat` itself reads.
   Each connection is an `xinpcb_n` (addresses and ports) followed by an `xsocket_n` that carries `so_uid` and
-  `so_last_pid` (XNU `bsd/netinet/in_pcb.h` and `bsd/sys/socketvar.h`, both under `#pragma pack(4)`); the two are
-  paired by the pcb handle (`xi_inpp` equals `so_pcb`). Measured on macOS 26: about 4 ms for 770 sockets, every pid
-  equal to the one `netstat` printed. The `xtcpcb_n` record that follows gives the TCP state (`t_state`), so listeners
-  and TIME_WAIT rows are told apart. The layout is not an API, so the first read in a process calibrates it: it opens
-  a connected pair of its own (listen, connect, accept) and the listener and both ends of the pair must read back with
-  their exact addresses, this process's uid and its pid. A layout that fails calibration is not used again in that
-  process.
-- macOS 27.2 shows an ad-hoc-signed interpreter (a Homebrew Python) only its own sockets: the calibration also
-  requires a child's listener, and a restricted table (DEC-0155 RT-1) is `unknown` with a reason beginning
-  `table-restricted`, never another account's. A caller that started the server (an installer, its launchd job) may
-  vouch with that pid: `lsof -p PID` asks the process, which the restriction leaves readable (RT-3).
+  `so_last_pid` (XNU `bsd/netinet/in_pcb.h` and `bsd/sys/socketvar.h`, both under `#pragma pack(4)`), paired by the pcb
+  handle (`xi_inpp` equals `so_pcb`); the `xtcpcb_n` that follows gives the TCP state. Measured on macOS 26: about 4 ms
+  for 770 sockets. The layout is not an API, so the first read in a process calibrates it on a connected pair of its
+  own (the listener and both ends must read back with their exact addresses, this uid and this pid); a layout that
+  fails is not used again in that process.
+- macOS 27.2 shows an ad-hoc-signed interpreter (a Homebrew Python) only its own sockets: the calibration also requires
+  a child's listener, and a restricted table (DEC-0155 RT-1) is `unknown` with a reason beginning `table-restricted`,
+  never another account's, unless `fabric_socket_proof` finds the socket in this account's own processes (RT-2) or a
+  caller that started the server vouches with its pid, which `lsof -p PID` asks the process itself about (RT-3).
 - macOS, fallback (`netstat`): `/usr/sbin/netstat -anv -p tcp`, its `process:pid` column, then `ps -o uid= -p PID` for
-  the owner of the one row a question needs. Measured: about 20 ms over 846 sockets, and it names the pids of root's
-  listeners, which `lsof` run by an ordinary account cannot see. Another local service implemented the same check this
-  way; it is kept as the documented fallback for a macOS whose record layout the calibration refuses.
+  the one row a question needs; about 20 ms over 846 sockets, and it names the pids of root's listeners, which `lsof`
+  run by an ordinary account cannot see. Kept for a macOS whose record layout the calibration refuses.
 - Linux (`proc`): `/proc/net/tcp` and `/proc/net/tcp6`, whose `uid` column every account may read (also under
-  `hidepid=2`, which hides `/proc/<pid>` and not this file). No pid: that is only readable for this account's own
-  processes, and the decision needs the uid alone.
-- Windows (`iphlpapi`): `GetExtendedTcpTable(TCP_TABLE_OWNER_PID_ALL)` gives each row's owning pid;
-  `OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION)`, `OpenProcessToken(TOKEN_QUERY)` and
-  `GetTokenInformation(TokenUser)` give its account SID, compared with this process's. A process that cannot be opened
-  (another account's, usually) is `unknown`, never `another-account`: the caller refuses either way, and the reason
-  says which it was. `Owner.uid` is None there.
+  `hidepid=2`). No pid: that is only readable for this account's own processes, and the decision needs the uid alone.
+- Windows (`iphlpapi`): `GetExtendedTcpTable(TCP_TABLE_OWNER_PID_ALL)` gives each row's owning pid; `OpenProcess`,
+  `OpenProcessToken` and `GetTokenInformation(TokenUser)` its account SID, compared with this process's. A process that
+  cannot be opened (another account's, usually) is `unknown`, never `another-account`. `Owner.uid` is None there.
 - Anything else: `unknown`, reason `unsupported-platform`.
 
-`LOCAL_PEERCRED`, `getpeereid` and Linux `SO_PEERCRED` answer this question for Unix-domain sockets only, not for TCP,
-which is why a socket table is read here at all.
-
-WHAT IT NEVER DOES. It never reads a byte from the socket it is asked about, never resolves a name, never sends
-anything, and never needs a privilege. It reports the process names `netstat` prints only as far as the pid behind them.
+`LOCAL_PEERCRED`, `getpeereid` and `SO_PEERCRED` answer this for Unix-domain sockets only, hence a socket table. It
+never reads a byte from the socket it is asked about, never resolves a name, never sends anything, never needs a
+privilege, and reports the process names `netstat` prints only as far as the pid behind them.
 """
 from __future__ import annotations
 
@@ -98,7 +84,7 @@ import time
 from typing import NamedTuple, Optional, Tuple
 
 # This file's own version, for projects that copy it; not the engine's (that is configuration.VERSION).
-PEER_OWNER_VERSION = "1.2.0+kit.6"  # Observatory's 1.2.0 with the kit's differences above
+PEER_OWNER_VERSION = "1.3.1+kit.7"  # Observatory's 1.3.1 line with the kit's differences above
 
 THIS_ACCOUNT = "this-account"
 ANOTHER_ACCOUNT = "another-account"
@@ -201,11 +187,6 @@ def _posix_uid() -> Optional[int]:
     return os.getuid() if hasattr(os, "getuid") else None
 
 
-def _own_pid() -> int:
-    """This process's pid: a netstat that shows no other process's row is a restricted table (DEC-0155 RT-1)."""
-    return os.getpid()
-
-
 def _set_uid() -> bool:
     """Real and effective uid differ: such a reader uses none of DEC-0155's proofs (RT-2 to RT-5), the vouch included."""
     return hasattr(os, "geteuid") and os.geteuid() != _posix_uid()
@@ -529,10 +510,9 @@ def _child_line(child: "subprocess.Popen[bytes]", deadline: float) -> Optional[b
 
 
 def _child_listener_seen(rows_of) -> Optional[bool]:
-    """Whether the table shows a listener of a child process of this one: False when it does not (the table shows
-    this process alone, FAA-267), None when no child could be started (a frozen or embedded host has no interpreter to
-    start), or it gave no port line within TIMEOUT_SECONDS (silence, a partial or non-numeric line, an early exit, a
-    pipe that cannot be read). The calibration trusts only True."""
+    """Whether the table shows a listener of a child process of this one: False when not (it shows this process alone,
+    FAA-267), None when no child could be started (a frozen or embedded host) or it gave no port line within
+    TIMEOUT_SECONDS (silence, a partial line, an early exit, an unreadable pipe). The calibration trusts only True."""
     if not sys.executable or getattr(sys, "frozen", False):
         return None
     try:
@@ -780,7 +760,7 @@ def restricted(rows: list[Row], how: str, *, own_uid: Optional[int] = None, own_
         own = _posix_uid() if own_uid is None else own_uid
         return not any(row.uid is not None and row.uid != own for row in rows)
     if how == "netstat":
-        own = _own_pid() if own_pid is None else own_pid
+        own = os.getpid() if own_pid is None else own_pid
         return not any(row.pid is not None and row.pid != own for row in rows)
     return False
 
@@ -810,10 +790,9 @@ def _owner_of(local: tuple[str, int], remote: tuple[str, int], server: bool = Fa
     if len(found) > 1:
         return Owner(UNKNOWN, None, None, how, "several-rows")
     if how == "proc" and server and found[0].uid is None:
-        # Linux: a connection not accept()ed yet (uid 0, inode 0) belongs to the listener on its local address (exact,
-        # else the wildcard) and dies with it (inet_csk_listen_stop); an accepted one's own row carries the accepting
-        # process's uid (sock_graft), so a listener swapped after another account accepted cannot pass (Observatory's
-        # 1.2.0, board thread ced00f6e; CT-254). An orphaned server row reads so too: nothing sent to it reaches anyone.
+        # Linux: a connection not accept()ed yet (uid 0, inode 0) belongs to the listener on its local address (exact, else
+        # the wildcard) and dies with it; an accepted one's own row carries the accepting process's uid (sock_graft), so a
+        # listener swapped after another account accepted cannot pass (CT-254). An orphaned server row reads so too.
         return _one_owner(_listeners_of(rows, found[0].local), how, "not-accepted")
     if how == "proc" and found[0].uid is None:
         # A client's socket with inode 0 has already closed (0.74.0 unit reading 4): never another socket's owner.
@@ -842,10 +821,32 @@ def _one_owner(found: list[Row], how: str, none_reason: Optional[str] = None) ->
     return Owner(UNKNOWN, None, None, how, "several-rows")
 
 
+_PROOF: list = [None]  # fabric_socket_proof once looked for: None not yet, False not beside this file (FAA-292)
+
+
+def _proved(ask: str, *args, fallback: Owner, **kwargs) -> Owner:
+    """`fallback`, unless it is a restricted macOS table's `unknown` and `fabric_socket_proof` beside this file finds the
+    socket (`accepted`) or the 127.0.0.1 listener (`own_listener`, FAA-272) in this account's processes: else it stands."""
+    if fallback.kind != UNKNOWN or not (fallback.reason or "").startswith(TABLE_RESTRICTED) or sys.platform != "darwin":
+        return fallback
+    try:
+        if _PROOF[0] is None:
+            sys.path.append(os.path.dirname(os.path.abspath(__file__)))  # beside this file, as the kit's modules load
+            import fabric_socket_proof
+            _PROOF[0] = fabric_socket_proof
+        proof = getattr(_PROOF[0], ask)(*args, **kwargs) if _PROOF[0] else None
+    except ImportError:
+        _PROOF[0], proof = False, None
+    except Exception:  # noqa: BLE001 - a proof that fails proves nothing; the table's answer stands (fail closed)
+        proof = None
+    return Owner(THIS_ACCOUNT, _posix_uid(), proof.pid, proof.method, proof.reason) if proof and proof.proved else fallback
+
+
 def peer_at(server: tuple, client: tuple) -> Owner:
     """The owner of the CLIENT socket of the connection between `server` and `client`, as a server sees them (its own
     address, the peer's): the row whose local address is the client's and whose remote address is the server's."""
-    return _owner_of(_address(client), _address(server))
+    client, server = _address(client), _address(server)
+    return _proved("accepted", client, server, wait=False, fallback=_owner_of(client, server))
 
 
 def peer(sock: socket.socket) -> Owner:
@@ -859,14 +860,14 @@ def peer(sock: socket.socket) -> Owner:
 
 def server_end(sock: socket.socket) -> Owner:
     """For a client's connected socket: who accepted it. The row whose local address is the server's and whose remote
-    address is this socket's own, which is the server process's accepted socket, so a listener swapped after `listen`
-    cannot pass for the one that answers. On Linux a connection not yet accept()ed has no owner of its own (inode 0):
-    its listener answers (the contract's CT-254, HA-2's Linux source)."""
+    address is this socket's own, the server process's accepted socket, so a listener swapped after `listen` cannot
+    pass; on Linux a connection not accept()ed yet answers through its listener (CT-254); RT-2 under a restricted table."""
     try:
         own, server = sock.getsockname(), sock.getpeername()
     except OSError as exc:
         return Owner(UNKNOWN, None, None, "none", f"socket: {type(exc).__name__}")
-    return _owner_of(_address(server), _address(own), server=True)
+    server, own = _address(server), _address(own)
+    return _proved("accepted", server, own, wait=True, fallback=_owner_of(server, own, server=True))
 
 
 #: port -> (time.monotonic() of the read, the Owner)
@@ -899,6 +900,7 @@ def listener(port: int) -> Owner:
         owner = Owner(UNKNOWN, None, None, method(), str(exc))
     else:
         owner = _restricted_listener(rows, port, how) if restricted(rows, how) else _one_owner(pick_listener(rows, port), how)
+    owner = _proved("own_listener", port, fallback=owner)
     _LISTENERS[port] = (now, owner)
     return owner
 
@@ -922,17 +924,21 @@ def refusal(owner: Owner, port: int, expect_pid: Optional[int] = None) -> Option
     return None
 
 
-def pid_listens(pid: int, port: int) -> bool:
-    """macOS, when the socket table is restricted (FAA-267, DEC-0155 RT-3): whether process `pid`, this account's,
-    listens on exactly 127.0.0.1:<port> (never the IPv4 wildcard, which `lsof` prints as it prints an IPv6-only one, nor
-    ::1; FAA-312). `lsof -p` asks the process itself (libproc), which the restriction does not hide. Only a caller that
-    started `pid` itself (a launchd job it installed) may vouch with it, and never a set-uid one."""
-    if sys.platform != "darwin" or not isinstance(pid, int) or isinstance(pid, bool) or pid <= 1 or _set_uid():
+def pid_listens(pid: int, port: int, owner: object = THIS_ACCOUNT) -> bool:
+    """macOS, a restricted table (FAA-267, DEC-0155 RT-3): whether process `pid` listens on exactly 127.0.0.1:<port>
+    (never the IPv4 wildcard, which `lsof` prints as an IPv6-only one, nor ::1), asked of the process (`lsof -p`). Only
+    a caller that started `pid` (a launchd job it installed) vouches with it, never a set-uid one for this account. `owner`:
+    the uid `pid` runs as, this account's by default, or None when the caller checks it (a LaunchDaemon's UserName)."""
+    if owner is not None and owner != THIS_ACCOUNT and (not isinstance(owner, int) or isinstance(owner, bool) or owner < 0):
+        raise ValueError("owner is this-account, a uid or None")
+    if sys.platform != "darwin" or not isinstance(pid, int) or isinstance(pid, bool) or pid <= 1 or (
+            owner == THIS_ACCOUNT and _set_uid()):
         return False
     try:
-        uid = parse_ps_uid(_run([PS, "-o", "uid=", "-p", str(pid)]))
-        if uid is None or uid != _posix_uid():
-            return False
+        if owner is not None:
+            uid = parse_ps_uid(_run([PS, "-o", "uid=", "-p", str(pid)]))
+            if uid is None or uid != (_posix_uid() if owner == THIS_ACCOUNT else owner):
+                return False
         out = _run([LSOF, "-nP", "-a", "-p", str(pid), "-i4TCP", "-sTCP:LISTEN", "-Fn"])
     except TableUnreadable:
         return False
@@ -940,9 +946,8 @@ def pid_listens(pid: int, port: int) -> bool:
 
 
 class CheckedHTTPConnection(http.client.HTTPConnection):
-    """An `http.client.HTTPConnection` whose every `connect()` checks the server end before returning: `http.client`
-    connects again by itself (`auto_open`) after `Connection: close` or a close, and that connection may reach another
-    listener. A refused connect closes the socket and raises ListenerRefused before any byte of a request is sent."""
+    """An `http.client.HTTPConnection` whose every `connect()` (the reconnect `auto_open` makes too, which may reach
+    another listener) checks the server end: refused, it closes the socket and raises ListenerRefused before a byte."""
 
     def __init__(self, host: str, port: int, *, expect_pid: Optional[int] = None, timeout: float = 10.0,
                  vouch_pid: Optional[int] = None) -> None:
@@ -957,7 +962,7 @@ class CheckedHTTPConnection(http.client.HTTPConnection):
         super().connect()
         owner = server_end(self.sock)
         if (owner.kind == UNKNOWN and (owner.reason or "").startswith(TABLE_RESTRICTED) and getattr(self, "vouch_pid", None)
-                and pid_listens(self.vouch_pid, self.port)):
+                and _address(self.sock.getpeername())[0] == "127.0.0.1" and pid_listens(self.vouch_pid, self.port)):
             # The table hides other processes (FAA-267); the process this caller started holds the listener.
             owner = Owner(THIS_ACCOUNT, _posix_uid(), self.vouch_pid, "lsof-pid")
         refused = refusal(owner, self.port, self.expect_pid)
@@ -969,14 +974,9 @@ class CheckedHTTPConnection(http.client.HTTPConnection):
 def own_connection(port: int, *, expect_pid: Optional[int] = None, timeout: float = 10.0,
                    host: str = "127.0.0.1", vouch_pid: Optional[int] = None) -> CheckedHTTPConnection:
     """A `CheckedHTTPConnection` to `host:port`, connected, whose server end is this account's (and, with `expect_pid`,
-    that process's). The check runs on the very connection the caller then sends on, so no listener can change between
-    the check and the request, and again on every reconnect `http.client` makes. No proxy is consulted. Raises
-    ListenerRefused after closing the connection:
-
-        server-not-own             another account's or the system's process accepted it
-        server-unverified          its owner could not be told (nothing is sent: fail closed)
-        server-not-this-workspace  this account's process, but not the pid expected
-
+    that process's), checked on the very connection the caller sends on and on every reconnect; no proxy is consulted.
+    ListenerRefused, the connection closed: `server-not-own` (another account's or the system's process accepted it),
+    `server-unverified` (its owner could not be told: fail closed), `server-not-this-workspace` (not the pid expected).
     `vouch_pid`, as on `CheckedHTTPConnection` and the Node twin's `checkedSocket`: a pid the caller started (FAA-267)."""
     conn = CheckedHTTPConnection(host, port, expect_pid=expect_pid, timeout=timeout, vouch_pid=vouch_pid)
     conn.connect()

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_secrets.py

@@ -31,7 +31,7 @@ CREDENTIAL_PAIRS: Dict[str, tuple] = {
 }
 #: ECMAScript's \s, as a character class body.
 JS_SPACE = "\t\n\x0b\x0c\r \xa0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff"
-_NOT_LINE_END = "[^\n\r\u2028\u2029]"  # ECMAScript's `.` without the s flag
+NOT_LINE_END = "[^\n\r\u2028\u2029]"  # ECMAScript's `.` without the s flag
 JWT_SHAPE = re.compile(r"eyJ[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]{2,}\.[A-Za-z0-9_-]*")
 _URL_BASE64_RUN = re.compile(r"[A-Za-z0-9_-]*")
 
@@ -74,14 +74,17 @@ _PROVIDER_KEYS = (r"(?:sk-(?=[A-Za-z0-9_-]{0,255}?[0-9])(?:(?=[A-Za-z0-9_-]{0,25
 #: The contract's SECRET_VALUE at the pin (DEC-0151): `Bearer ` at a value's start in any case, or a provider key after a
 #: boundary. No case-insensitive flag; digits are ASCII. A match includes its boundary character: callers test, never
 #: read the matched text or its index.
-SECRET_VALUE = re.compile("(^[Bb][Ee][Aa][Rr][Ee][Rr][" + JS_SPACE + "]" + _NOT_LINE_END + "+|" + _KEY_BOUNDARY + _PROVIDER_KEYS + ")")
+SECRET_VALUE = re.compile("(^[Bb][Ee][Aa][Rr][Ee][Rr][" + JS_SPACE + "]" + NOT_LINE_END + "+|" + _KEY_BOUNDARY + _PROVIDER_KEYS + ")")
 _LONG_RUN = re.compile(r"[A-Za-z0-9+/=_-]{40,}")
-_BEARER_INSIDE = re.compile(r"(?<![A-Za-z0-9_])bearer[%s]+(?=[A-Za-z0-9._~+/-]*[0-9])[A-Za-z0-9._~+/-]{12,}=*" % JS_SPACE,
+BEARER_INSIDE = re.compile(r"(?<![A-Za-z0-9_])bearer[%s]+(?=[A-Za-z0-9._~+/-]*[0-9])[A-Za-z0-9._~+/-]{12,}=*" % JS_SPACE,
                             re.IGNORECASE | re.ASCII)
 _PATH_LIKE = re.compile(r"^(?:[/~.]|[A-Za-z]:[\\/]|[a-z][a-z0-9+.-]*://)", re.IGNORECASE | re.ASCII)
 _WORD_SPLIT = re.compile("[%s._-]+" % JS_SPACE)
 _ARGUMENT_SPLIT = re.compile("[%s=]" % JS_SPACE)
-_SCHEME = re.compile(r"^[A-Za-z][A-Za-z0-9+.-]*:")
+SCHEME = re.compile(r"^[A-Za-z][A-Za-z0-9+.-]*:")
+#: The names the check and older readers wrote before these became public (FAA-190 (2), (12)): kept so a module from
+#: an earlier version beside this one still loads.
+_BEARER_INSIDE, _SCHEME, _NOT_LINE_END = BEARER_INSIDE, SCHEME, NOT_LINE_END
 #: WHATWG's special schemes that carry an authority with user information (file has none).
 _SPECIAL = ("ftp", "http", "https", "ws", "wss")
 
@@ -108,13 +111,17 @@ def credential_name(name: str) -> bool:
     return any(word in words and any(p in words for p in partners) for word, partners in CREDENTIAL_PAIRS.items())
 
 
-def _long_secret(value: str) -> bool:
+def long_secret(value: str) -> bool:
+    """A run of 40 or more base64 characters mixing upper case, lower case and digits (the Node twin's longSecret)."""
     return any(re.search(r"[a-z]", run) and re.search(r"[A-Z]", run) and re.search(r"[0-9]", run) for run in _LONG_RUN.findall(value))
 
 
+_long_secret = long_secret  # its name before FAA-190 (2)
+
+
 def secret_value(value: str) -> bool:
     """A JWT anywhere, a provider key or `Bearer …`, or a long base64 run mixing upper case, lower case and digits."""
-    return bool(has_jwt(value) or SECRET_VALUE.search(value) or _long_secret(value))
+    return bool(has_jwt(value) or SECRET_VALUE.search(value) or long_secret(value))
 
 
 def _path_like(piece: str) -> bool:
@@ -126,13 +133,13 @@ def _path_like(piece: str) -> bool:
 def secret_argument(value: str) -> bool:
     """The same for a launch argument or a server's command and URL: a long run is looked for between path separators,
     so a folder path holding a session id is not taken for a key."""
-    if has_jwt(value) or SECRET_VALUE.search(value) or _BEARER_INSIDE.search(value):
+    if has_jwt(value) or SECRET_VALUE.search(value) or BEARER_INSIDE.search(value):
         return True
     for piece in _ARGUMENT_SPLIT.split(value):
         if _path_like(piece):
-            if any(_long_secret(part) for part in re.split(r"[\\/]", piece)):
+            if any(long_secret(part) for part in re.split(r"[\\/]", piece)):
                 return True
-        elif _long_secret(piece):
+        elif long_secret(piece):
             return True
     return False
 
@@ -421,7 +428,7 @@ def _url_credential(value: str, hosts: bool) -> bool:
     # What WHATWG URL parsing does first: trim C0 controls and space from the ends (never other Unicode spaces, which it
     # refuses), then remove every tab, CR and LF.
     value = re.sub(r"[\t\n\r]", "", value.strip(_C0_OR_SPACE))
-    if not _SCHEME.match(value):
+    if not SCHEME.match(value):
         return False  # not an absolute URL (WHATWG URL parsing refuses it)
     if hosts and url_refused(value):
         return False  # `new URL` refuses its host or port, so the Node twin reads it as an argument only (FAA-309)
@@ -442,7 +449,25 @@ _REPOSITORY_AUTHORITY = re.compile(r"[A-Za-z][A-Za-z0-9+.-]*://")
 #: boundary, so composed after a separator look-behind it would miss a key after `-`, `.` or `_`.
 _REPOSITORY_KEYS = r"sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|xox[abposr]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|glpat-[A-Za-z0-9_-]{20,}"
 _KEY_AT_A_WORD = re.compile(r"(?:\A|(?<=[._-]))(?:%s)" % _REPOSITORY_KEYS)
-_JWT_AT_A_WORD = re.compile(r"(?:\A|(?<=[._-]))%s" % JWT_SHAPE.pattern)
+
+
+def jwt_at_a_word(text: str) -> bool:
+    """Whether JWT_SHAPE matches at a word's start: the text's start, or after a `.`, `_` or `-` (FAA-321). Read in one
+    pass, as jwt_spans: the look-behind expression backtracked from every such `eyJ` of a long run, quadratic in it.
+    Every `eyJ` of one run shares that run's end and a shorter first segment, so only a run's first `eyJ` at a word's
+    start is tried; an `eyJ` that is not at one is passed over, since a later one of its run may be."""
+    at = text.find("eyJ")
+    while at >= 0:
+        if at and text[at - 1] not in "._-":
+            at = text.find("eyJ", at + 1)
+            continue
+        one = _URL_BASE64_RUN.match(text, at + 3).end()
+        if one - at - 3 >= 2 and text[one:one + 1] == ".":
+            two = _URL_BASE64_RUN.match(text, one + 1).end()
+            if two - one - 1 >= 2 and text[two:two + 1] == ".":
+                return True
+        at = text.find("eyJ", one)
+    return False
 
 
 def repository_name(piece: str) -> bool:
@@ -450,7 +475,7 @@ def repository_name(piece: str) -> bool:
     key's or JWT's shape (`sk-`, `ghp_`, `xoxb-`, `AKIA`, `eyJ`) at its start or after a `.`, `_` or `-` (0.62.0
     readings 9 and 10), so a letters-only key is still a key while `task-pipeline-dashboard`, which holds an `sk-` shape
     inside a word, is a name."""
-    return bool(_REPOSITORY_NAME.match(piece)) and not _KEY_AT_A_WORD.search(piece) and not _JWT_AT_A_WORD.search(piece)
+    return bool(_REPOSITORY_NAME.match(piece)) and not _KEY_AT_A_WORD.search(piece) and not jwt_at_a_word(piece)
 
 
 def ascii_decoded(text: str) -> str: