@passioncode-ai/passioncode 0.1.20 → 0.1.21

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.1.21 - 2026-10-03
+
+### Changed
+
+- **Fabric Agent Adapter is pinned at `v0.6.1`:** `check_service.py` no longer fails an online
+  service hosted behind a platform router. Heroku, Fly, Render and CDNs answer a foreign `Host`
+  themselves (`404`/`421`), and that now counts as the refusal it is, unless the body is the
+  well-known document.
+
 ## 0.1.20 - 2026-10-02
 
 ### Changed

package/family.json

@@ -8,7 +8,7 @@
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "repo": "passioncode-ai/fabric-agent-adapter",
-      "ref": "v0.6.0",
+      "ref": "v0.6.1",
       "kind": "plugin",
       "path": "plugins/fabric-agent-adapter",
       "legacyPluginIds": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@passioncode-ai/passioncode",
-  "version": "0.1.20",
+  "version": "0.1.21",
   "description": "The PassionCode.ai agent skill set \u2014 Fabric Agent Adapter, Observatory Log and the organisation's working rules \u2014 for Claude Code and every other agent on the machine, updated as one set.",
   "bin": {
     "passioncode": "bin/passioncode.js"

package/payload/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "source": "./plugins/fabric-agent-adapter",
-      "version": "0.6.0",
+      "version": "0.6.1",
       "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles.",
       "author": {
         "name": "PassionCode.ai",
@@ -35,7 +35,7 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "source": "./plugins/passioncode",
-      "version": "0.1.20",
+      "version": "0.1.21",
       "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/manifest.json

@@ -1,15 +1,15 @@
 {
   "family": "passioncode",
-  "version": "0.1.20",
+  "version": "0.1.21",
   "release": true,
   "members": [
     {
       "name": "fabric-agent-adapter",
       "displayName": "Fabric Agent Adapter",
       "repo": "passioncode-ai/fabric-agent-adapter",
-      "ref": "v0.6.0",
-      "commit": "447b55819b83d25f168afa7abd99cafa0ab29812",
-      "version": "0.6.0",
+      "ref": "v0.6.1",
+      "commit": "d3a4c67262e242b0a4422ecdcf99a7d892db6caa",
+      "version": "0.6.1",
       "via": "clone of https://***@github.com/passioncode-ai/fabric-agent-adapter.git",
       "skills": [
         "adapting-projects-to-fabric",
@@ -22,7 +22,7 @@
       "legacyMarketplaces": [
         "fabric-agent-adapter"
       ],
-      "contentHash": "sha256:f714e1620093378f3c790287270608ad8b6084109e813eead03dea9c159e964e",
+      "contentHash": "sha256:654511f4332892aa9a709e1946566d017179edc294e136fbe5c6466c5c32b5c8",
       "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles.",
       "author": {
         "name": "PassionCode.ai",
@@ -61,16 +61,16 @@
       "name": "passioncode",
       "displayName": "PassionCode.ai",
       "repo": "passioncode-ai/passioncode",
-      "ref": "v0.1.20",
+      "ref": "v0.1.21",
       "commit": null,
-      "version": "0.1.20",
+      "version": "0.1.21",
       "via": "this repository",
       "skills": [
         "working-in-passioncode"
       ],
       "legacyPluginIds": [],
       "legacyMarketplaces": [],
-      "contentHash": "sha256:b230828150120df33b6c48eccf6a6d4e20e35f0dff8089df4d9554c29957016a",
+      "contentHash": "sha256:63c4bc3c353c3e7b3762c4ab20a50e4684504c142a378c988c73d86049892a50",
       "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check that keeps the PassionCode.ai set current.",
       "author": {
         "name": "PassionCode.ai",

package/payload/plugins/fabric-agent-adapter/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "fabric-agent-adapter",
   "displayName": "Fabric Agent Adapter",
   "description": "Create new Fabric-compatible agents, build them as always-alive local services with dashboards (fabric-service/0.1), and adapt existing projects to the Fabric Agent Contract through evidence-backed MCP, A2A, or local-runner provider bundles.",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "author": {
     "name": "PassionCode.ai",
     "url": "https://passioncode.ai/"

package/payload/plugins/fabric-agent-adapter/skills/adapting-projects-to-fabric/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode.
 metadata:
   author: PassionCode.ai
-  version: "0.6.0"
+  version: "0.6.1"
   contract-version: "0.1.0"
   contract-commit: "2ce392291c6668598d12cd38327e24696b5ca15c"
 ---

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md

@@ -15,7 +15,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Python 3.9+ or Node.js 20+ for the kits; the probe needs Python 3.9+. launchd steps are macOS-only (Linux services use lifecycle manager none until a systemd adapter exists). Dashboard handoff optionally uses Fabric Dashboards MCP link/host_status/open; without it, report unresolved host capability. The contract checkout is optional.
 metadata:
   author: PassionCode.ai
-  version: "0.6.0"
+  version: "0.6.1"
   contract-version: "0.1.0"
   extension: "fabric-service/0.1"
   extension-commit: "2ce392291c6668598d12cd38327e24696b5ca15c"

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/remote-placement.md

@@ -44,6 +44,14 @@ same objects — well-known document, events feed, login code — at the same pa
 - **Behind a router**: check the platform-set forwarded scheme; `Host` is preserved by common
   platforms and must equal the origin's host.
 
+## Checking it
+
+`check_service.py <id>` probes a remote placement over verified TLS. Behind a platform router
+(Heroku, Fly, Render, a CDN) a request that names a foreign `Host` never reaches the process: the
+router answers it, usually `404` or `421`. The probe counts that as the refusal it is, as long as
+the body is not the well-known document. The Origin and cross-site checks name the right `Host`,
+reach the service, and still need its own `403`.
+
 ## What a host does and will not do
 
 | Situation | Host |

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_service.py

@@ -79,6 +79,23 @@ def priority_problems(plist: dict) -> list:
     return out
 
 
+# A platform router (Heroku, Fly, Render, a CDN) routes by Host, so a request naming a foreign
+# Host never reaches an online service: the router itself answers, typically 404 or 421. That is
+# still a refusal — the service disclosed nothing — so for a remote placement the host check
+# accepts it, as long as the body is not the well-known document. Every other guard request names
+# the right Host, reaches the service, and must be the service's own 403.
+PLATFORM_HOST_REFUSALS = (400, 404, 421)
+
+
+def guard_verdict(rule: str, remote: bool, status: int, body: bytes) -> Tuple[str, str]:
+    if status == 403:
+        return "PASS", "HTTP 403"
+    disclosed = b"fabric-service/" in (body or b"")
+    if rule == "network.host-check" and remote and status in PLATFORM_HOST_REFUSALS and not disclosed:
+        return "PASS", "HTTP %d from the platform router: a foreign Host never reaches the service" % status
+    return "FAIL", "HTTP %d%s" % (status, ", and the body is the well-known document" if disclosed else "")
+
+
 class _PinnedHTTPS(http.client.HTTPSConnection):
     """HTTPS to the origin's name (SNI, certificate, Host) over a socket dialled elsewhere."""
 
@@ -243,8 +260,9 @@ class Probe:
                     sent.update(self.auth_headers())
                     if "Origin" in sent:
                         sent["Origin"] = "https://evil.example"
-                status, _, _ = self.request("GET", "/.well-known/fabric-service", sent)
-                self.add(rule, "PASS" if status == 403 else "FAIL", "HTTP %d" % status)
+                status, _, body = self.request("GET", "/.well-known/fabric-service", sent)
+                verdict, evidence = guard_verdict(rule, self.remote, status, body)
+                self.add(rule, verdict, evidence)
             except (OSError, ssl.SSLError) as exc:
                 self.add(rule, "NOT_RUN", str(exc))
         if self.remote:

package/payload/plugins/fabric-agent-adapter/skills/creating-fabric-agents/SKILL.md

@@ -5,7 +5,7 @@ license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
 compatibility: Requires filesystem access and Python 3.9+. Exact schema checks additionally need git, Node.js, pnpm, and the pinned fabric-agent-contract checkout (a public repository). Works without those tools in an explicitly degraded structural-check mode. Ships in one plugin with adapting-projects-to-fabric, whose scripts it reuses.
 metadata:
   author: PassionCode.ai
-  version: "0.6.0"
+  version: "0.6.1"
   contract-version: "0.1.0"
   contract-commit: "2ce392291c6668598d12cd38327e24696b5ca15c"
 ---

package/payload/plugins/passioncode/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "passioncode",
   "displayName": "PassionCode.ai",
-  "version": "0.1.20",
+  "version": "0.1.21",
   "description": "The organisation's working rules for every contributor's agent (working-in-passioncode), and a once-a-day check at session start that keeps the PassionCode.ai skill set current.",
   "author": {
     "name": "PassionCode.ai",