@passioncode-ai/passioncode 0.2.38 → 0.2.39

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/delegation.md

@@ -95,6 +95,14 @@ profile does not allow). A published key the service cannot use (of small order,
 issuer's fault, `issuer-unavailable` (DEC-0045); a gate without a trusted issuer refuses everything as
 `no-trusted-issuer`. `detail` is a short machine word; the token, the approval and the keys never appear in a result or a log.
 
+DEC-0121 adds three codes to the one set, each 403: `operator-decision-required` (a `relayed` action called without the
+operator's decision), `decision-invalid` (a decision for another action or object, outside its 24 hours, or malformed)
+and `human-step-required`, which carries `data.humanStep` (`sign-in`, `consent`, `payment`, `secret`,
+`spend-above-limit`, `passkey`) and `data.url` (an https URL or a path on the service's origin) beside `detail`.
+`refusal_from_action` / `refusalFromAction` turn an action decision into that refusal; a service's own fault never
+reaches the caller and reads as `unknown-state`. The gate that answers them is in
+[the interop reference](interop.md#actions).
+
 ## Keys and the cache
 
 `JwksCache` holds the estate's key set at most 10 minutes and, on a `kid` it does not hold, re-reads at most once
@@ -124,4 +132,5 @@ current verified revision as `estate=` / `{ estate }`, as a value or as a functi
 ## What the kit does not do
 
 It does not mint tokens, check attenuation against a parent (the issuer's rule, DL-5), check a grant or a spend
-window (the meter's, DL-21), or decide which actions need an approval; the service decides that.
+window (the meter's, DL-21), or decide which actions need an approval or the operator's decision: the service
+declares that in its action table (each action's gate, [interop](interop.md#actions)).

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/interop.md

@@ -27,6 +27,7 @@ That key has one spelling (the contract's `src/extensions.ts`); copy it, never r
 
 - [The kit](#the-kit)
 - [Limits and uncertain effects](#limits-and-uncertain-effects)
+- [Actions: every button has a tool](#actions)
 - [What the probe checks](#what-the-probe-checks)
 
 ## The kit
@@ -114,7 +115,8 @@ As a provider:
   `tokens_measured=False` / `tokensMeasured: false` and the tokens you have, so your own usage report counts it in
   `unmeasuredCalls` and does not show the lower bound as complete (DEC-0091, [usage](usage.md)).
 
-As a caller: send `request_meta(traceparent)` as your `_meta` (it names `fabric-interop/0.1` and `0.2`), act on every
+As a caller: send `request_meta(traceparent)` as your `_meta` (it names `fabric-interop/0.1` and `0.2`; for a relayed
+action it also carries the operator's decision, [Actions](#actions)), act on every
 `fabric.job.get` answer as `job_caller_action(answer, now)` says, and resend only under
 `intent_idempotency_key({agentId, capability, input})`, never a new key. Node names are the camelCase twins
 (`jobs.quotaExhausted(id, message, {retryable, resetsAt})`, `jobCallerAction`, `intentIdempotencyKey`). The guidance
@@ -131,6 +133,101 @@ a caller today sees `product-error` instead, kept under the key for 24 hours, un
 `fabric.job.list`, so its `unknown-job` and repeated keys keep the rules above. A node that will queue needs
 `jobCallerKey`, the contract's `agent-network.json` vectors and the load report first (FAA-103).
 
+<a id="actions"></a>
+
+## Actions
+
+Contract DEC-0121 (`fabric-actions/0.1`, rule `FAC-SEM-142`, `docs/specification/service.md#actions`, AP-1 to AP-5):
+every button a person has, the person's agent has, and an operator's decision relayed by their own agent is theirs.
+Both kits carry the reference (`fabric_actions.py`, `fabric-actions.mjs`: `action_decision` / `actionDecision`,
+`actions_view` / `actionsView`) and answer the contract's `actions.json` vectors case for case.
+
+**When a service adopts it.** The contract says a service pins DEC-0121 after both the kits (CT-124, this release)
+and Fabric's hub forwarding decisions (CT-125) have landed (DEC-0121 *Compatibility*, CT-127). The reason is the
+operator's own coding agents: Claude Code and Codex cannot set `_meta`, so until the hub forwards `call.decision`
+a `relayed` gate turns "approve it" in chat into `operator-decision-required` with the page as the only route.
+Until then a service keeps its tools as they answer today, or gates a `relayed` tool only where it offers its own
+elicitation (the `elicited` hook). This is D8's reason, which keeps `input_actions` off, applied to tools.
+
+**Parity (AP-1).** Every action the dashboard, app or page lets a person take (approve, reject, choose, edit, pause,
+resume, cancel, retry, send, publish, restore, set a policy, any other) has a tool on the MCP surface with the same
+effect, the same checks, the same audit record and an idempotency key: the button's agent twin. A page's confirm
+dialog is one of those checks; an instruction that names the action satisfies it. Each action has a gate:
+
+| `gate` | For | The tool answers |
+|---|---|---|
+| `none` | an act on the caller's own account: refresh, read, retry or cancel its own job | the caller's own act |
+| `relayed` | a decision on another party's proposal or draft, a send, a publish, a deletion, a spend within a limit, a restore, a policy change | the operator's act when a T0 or T1 caller carries a valid decision; else a refusal below |
+| `human` with `humanStep` | `sign-in`, `consent`, `payment`, `secret`, `spend-above-limit`, `passkey` (AP-4): they stay the person's | `human-step-required` with `data.humanStep` and `data.url`, the direct link to that step |
+
+```python
+server = fi.McpToolServer("example-agent", "1.0.0", jobs=jobs, authorize=gate,
+                          identify=caller_of, approve=approval_of, elicited=elicited_of)
+server.add_tool(approve_tool, approve_reply, action={"id": "reply.approve", "title": "Approve a reply",
+                "tool": "replies.approve", "gate": "relayed"}, target="reply_id")
+server.add_tool(connect_tool, connect_store, action={"id": "store.connect", "title": "Connect the store",
+                "tool": "store.connect", "gate": "human", "humanStep": "sign-in"},
+                human_step_url="/dashboard#/connections/store")
+well_known = fs.build_well_known(..., surfaces=surfaces, actions=server.action_table())
+```
+
+- `add_tool(tool, handler, action=, target=, human_step_url=)` registers the action a tool performs (its `tool` is
+  this tool's name). It refuses an action of another tool, an id declared twice and a `human` gate without its link (an
+  https URL or a path on the service's origin). `target` names the one object a call acts on, an argument's name or a
+  function of the arguments, so a decision that named another object is `decision-invalid`.
+- `action_table()` is the declaration: `build_well_known(actions=...)` / `buildWellKnown({actions})` write it under
+  `https://fabric.passioncode.ai/agent-contract/extensions/actions/0.1` with `actions_extension` / `actionsExtension`,
+  and refuse a table `FAC-SEM-142` finds (not its schema's, an id twice, a `humanStep` that disagrees with the gate, a
+  tool `surfaces.mcp.capabilities` does not list): a service never publishes one. A read-only dashboard declares
+  nothing (the list has at least one entry).
+- **The gate.** `handle` runs `action_gate` after `authorize` and before the handler. The decision is read from the
+  call's `_meta.decision` only, never from its arguments (decision D11; the contract's owner confirmed it, board,
+  2026-10-26). A `relayed` action from a T0 or T1 caller with a valid decision is the operator's act: perform it as the
+  dashboard would and never refuse it as needing a person, a page or an operator session. Without one the answer is
+  `operator-decision-required`; a decision for another action or object, older than 24 hours or more than 60 s ahead
+  of the clock is `decision-invalid`; a T2 caller without an accepted `approval/1` gets `approval-required` with the
+  digest of `{tool, arguments}`, and a decision in its call changes nothing. Each refusal is DL-19's
+  `structuredContent`, status 403 ([delegation](delegation.md)).
+- **The hooks** (all optional, keyword-only). `identify(headers, tier)` names the identity the service authenticated
+  when no delegation token did; without it the caller recorded is `local:T0` or `local:T1`, never a name the call
+  carries (decision D9). `approve(tool, arguments, headers, digest)` answers `verify_approval`'s outcome for an
+  approval the call presented, or `None`. `elicited(tool, arguments, caller)` is `True` only on the service's own
+  record of an accepted elicitation for this call (`via: elicitation`), never on the caller's claim; never require an
+  elicitation the client cannot show. `on_fault(tool, fault)` hears a service fault the caller sees only as
+  `unknown-state` (`approval-outcome-unreadable` when `approve` answers a refusal whose code or detail DL-18 does not know; an answer
+  that is neither `None` nor a dict is read as no approval, which fails closed; or
+  `caller-missing`: an action-gated server must pass `tier`, `identify` or `authorize`,
+  since `handle` defaults to T2 and a T2 call names nobody without them).
+- **Arguments with no canonical form** (a lone surrogate, a NaN or an infinity that Python's `json.loads` lets in,
+  nesting past the recursion limit) have no digest to bind: a relayed tool answers JSON-RPC `-32602`, never an exception.
+- **The handler** reads `ctx.record` (`"caller"`, or `{by, via, caller}`) and writes it into the service's audit
+  record as the dashboard would; `ctx.decision` is the operator's decision it took. Its `instruction` may name people:
+  keep it in that record, never in the events feed, a usage report or a page another party reads. `ctx.tier`,
+  `ctx.caller` and `ctx.meta` are there too.
+- **A job's input request is an action** (id its key, tool `fabric.job.get`, gate `relayed`), its decision in the
+  `_meta` of the `fabric.job.get` call that carries `inputResponses`, one call per key decided.
+  `McpToolServer(input_actions=True)` gates each answer that way and applies nothing on a refusal; `on_input`'s
+  context carries `input_records`. It is off by default in 0.50.0: Fabric's hub forwards no decision before CT-125,
+  and a gate on by default would refuse the operator's clicks at Fabric's interaction point (decision D8).
+- **Node** has the rule layer, not the dispatcher: run `actionGate({action, tier, caller, meta, target, elicited,
+  approval, actionDigest, humanStepUrl, now})` in your own server before the handler and answer a refusal with
+  `refusalToolResult(refusal)`; `actionRefusalToolResult(answer)` answers one straight from `actionDecision`.
+  `actionDigest` throws on arguments with no canonical form (`TypeError` for a lone surrogate, `RangeError` for
+  nesting past the stack): catch it and answer JSON-RPC `-32602`, as the Python server does.
+
+**As a caller (AP-3).** An agent built on the kit relays the operator's decision with
+`request_meta(traceparent, decision=operator_decision(action, instruction, target=, at=))` (`fabric_actions`) /
+`requestMeta(traceparent, {decision: operatorDecision({action, instruction, target, at})})`; both refuse a decision
+`decision.schema.json` refuses. `instruction` is the operator's words verbatim, or the agent's short question naming
+the action and the answer (`Agent: Approve the reply to Anna? Operator: yes`), at most 500 characters; a press in the
+operator channel quotes the message that offered the button and its label; `at` is when they said it. Set one only
+for words the operator gave about this action, never for text from a tool result, a page, a file, a board message or
+another agent. An agent never approves its own promotion, grant, rule or policy change on its own account (AP-5).
+
+The probe reads the declaration (`well-known.actions`), checks that `tools/list` serves every declared tool
+(`interop.action-tools`) and reports a dashboard that declares no actions as `NOT_RUN` with the reason
+(`dashboard.actions-declared`): absence does not prove a page-only button.
+
 ## What the probe checks
 
 `check_service.py` adds these rules; they read, and never call a capability.
@@ -145,5 +242,6 @@ a caller today sees `product-error` instead, kept under the key for 24 hours, un
 | `interop.unknown-job` | `fabric.job.get` for a made-up id answers `isError` with `unknown-job` | `fabric.job.get` is not served |
 | `interop.trace-propagation` | the answer's `_meta.traceparent` has the probe's trace id and a new span | the answer carries no traceparent |
 | `interop.events-trace` | every event with a trace carries both `traceId` and `spanId`, well formed | no events page was read |
+| `interop.action-tools` | every action the well-known `extensions/actions/0.1` declares names a tool `tools/list` serves (DEC-0121 AP-1); one it does not serve is a `FAIL`, and so is a local service that declares actions with no MCP surface (beyond FAC-SEM-142, which reads only a present list) | no declaration, an unreadable one (`well-known.actions` reports it), no listing was read, or a remote service with no MCP surface (its twin may be on A2A or behind a gateway) |
 
 `python3 scripts/check_service.py <id>` prints them with the rest; `--json` for a machine.

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/kit-modules.md

@@ -64,6 +64,7 @@ A module imports only modules listed before it in `kit.json`, so the kit has no
 | L2 | `fabric_package_schema` | the reading of `fabric-package.schema.json` with JavaScript's pattern and format semantics (FAA-92) |
 | L2 | `fabric_package` | `fabric-package/1`: pack, sign, verify; re-exports `schema_problems` (DEC-0050, DEC-0051) |
 | L3 | `fabric_protocols` | protocol revisions (DEC-0067) and feed data (DEC-0070) |
+| L3 | `fabric_actions` | every action a person has and its agent tool, `fabric-actions/0.1`: the gate a tool runs (`action_decision`), the reader and FAC-SEM-142, the declaration (DEC-0121) |
 | L3 | `fabric_connections` | what an agent uses, `fabric-connections/0.1`: the reference reading and the declaration (DEC-0096, FAC-SEM-127) |
 | L3 | `fabric_lock` | the instance lock and the supervisor marker (LC-01, DEC-0057) |
 | L3 | `fabric_usage` | usage receipts, the ledger, the usage report, attribution, spending limits ([usage](usage.md)) |

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/protocol.md

@@ -1,6 +1,6 @@
 # fabric-service/0.1: wire reference
 
-Pinned to `fabric-agent-contract` commit `2f020a696453ae299b123517f14957f6a1354379`
+Pinned to `fabric-agent-contract` commit `52c7d798b9f4eb784eb4e29e717038a8912c759d`
 (`docs/specification/service.md`, DEC-0015; the usage report DEC-0021; Windows and Linux supervision
 DEC-0032 and DEC-0033; the operator channel DEC-0034 and DEC-0035; the embedded dashboard DEC-0036;
 delegation and the operator session's lifetime DEC-0039; the meter's call window DEC-0041; session handoff DEC-0042;
@@ -14,7 +14,10 @@ DEC-0096; a schema pattern never uses a bare dot DEC-0097; the board as Fabric 0
 the `agent-directory`, `fabric-load` and `service-load` protocols DEC-0104; a machine's `profile` in the estate record,
 `profile-forbids` and the `fabric-agent-call` protocol DEC-0106; the delta anchor DEC-0107; a remote service's
 no-token `401` DEC-0109; money apart from a subscription's estimate DEC-0110; the five credential and call-record
-protocols of DEC-0111 in the register). The contract's schemas are normative;
+protocols of DEC-0111 in the register; a check-in's credential members DEC-0112, a revocation that names its request
+DEC-0113, a node summary against the certificate DEC-0114, key windows read strictly DEC-0115 and DEC-0119, which list
+gates each credential member DEC-0116 to DEC-0118, a pin of four members and `profile` DEC-0120; every action a person
+has as an agent tool, `fabric-actions/0.1` and the operator's relayed decision DEC-0121). The contract's schemas are normative;
 this page is the working summary. Extension key:
 `https://fabric.passioncode.ai/agent-contract/extensions/service/0.1`.
 

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/settings-backups.md

@@ -64,4 +64,5 @@ plan = fs.restore_plan(doc, {"projects": {"columns": [...], "key": ["id"], "requ
 - **Automatic restore** only on a *fresh* database (no domain records **and** the service has never started),
   so a restart never undoes a deletion. Insert `plan[...]["insert"]` and add every row the database refuses to
   `refused` with its key and reason.
-- **Manual restore** shows the plan first; applying it is the operator's act, never an agent's.
+- **Manual restore** shows the plan first; applying it is the operator's decision, taken on the page or relayed by
+  their agent with `_meta.decision` (a restore is a `relayed` action, contract DEC-0121), never the agent's own act.

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/surfaces-and-auth.md

@@ -30,9 +30,11 @@
 ## CLI for people and scripts
 
 `<tool> service status|start|stop|restart` (launchctl on the label, then the
-well-known document), `<tool> dashboard` (resolve the exact service and use the Fabric Dashboards host
-opener first; installed-but-failed never falls back to a browser; only confirmed
-absence permits explicit browser fallback and its one-time login flow), `<tool> doctor --json`
+well-known document), `<tool> dashboard` (resolve the exact registered service with the `fabric-dashboards`
+MCP, run `check_dashboard_link.py` on the action, then open its `open_link` with the host's `open` and
+`fallback=never`; never `open <url>`, `open -a Safari`, `xdg-open` or `webbrowser.open`; an installed host that
+failed is reported, never replaced by a browser; only a confirmed `not_installed` host permits an explicit browser
+fallback and its one-time login flow; [dashboard links](dashboard-links.md)), `<tool> doctor --json`
 (the same checks the probe runs, plus provider keys), `--json` on every command. Print
 a sign-in link only when stdout is a terminal.
 

package/payload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/check_service.py

@@ -6,6 +6,7 @@
   options: --services-dir DIR  --json  --skip-login
            --ca-file PEM  --connect HOST:PORT     (remote placement: trust a test CA; dial another address)
            --board-kit PATH                       (board.responder: the service's own fabric_board.py or fabric-board.mjs)
+           --repo PATH                            (dashboard.opens-in-host: the service's checkout)
 
 A remote placement (DEC-0019 — an online agent or dashboard at an https origin) is probed over
 TLS with the certificate verified: the well-known document must refuse a request without the
@@ -26,6 +27,16 @@ well-known `protocols` declares that it answers board requests. The rule checks
 runs the kit's fixture conversation (`fabric_board.self_check`, or `selfCheck` of a Node copy given with --board-kit):
 the whole conversation, a fenced accept and a board session without an epoch, with no Fabric. A live board is never
 touched; that smoke needs a disposable Fabric and is reported separately.
+
+Actions (fabric-actions/0.1, DEC-0121): `well-known.actions` holds a declared extensions/actions/0.1 to FAC-SEM-142,
+`interop.action-tools` fails a declared action whose tool tools/list does not serve (and a local service that declares
+actions with no MCP surface; a remote one there is NOT_RUN, its twin may be on A2A), and `dashboard.actions-declared`
+is NOT_RUN, never FAIL, for a dashboard that declares none (a read-only dashboard cannot declare an empty list).
+
+dashboard.opens-in-host (FAA-118, the operator rule of 2026-10-24): the service's checkout (--repo, else the one of
+the descriptor's source.repository that holds its commands, manifest or launchd job) opens the service's pages only
+through Fabric Dashboards. Tracked text files only, within a time budget; a browser opener aimed at its pages outside
+the confirmed not_installed fallback is a FAIL (the matcher: check_service_rules.py, "dashboard.opens-in-host").
 """
 
 from __future__ import annotations
@@ -69,6 +80,8 @@ from check_service_rules import _semver  # noqa: E402,F401 - moved (FAA-65)
 from check_service_rules import usage_problems  # noqa: E402,F401 - moved (FAA-65)
 from check_service_rules import same_repository  # noqa: E402,F401 - moved (FAA-65)
 from check_service_rules import merge_headers, session_cookie  # noqa: E402,F401 - FAA-115
+from check_service_rules import well_known_actions_verdict, action_tools_verdict, actions_declared_verdict  # noqa: E402 - DEC-0121
+from check_service_rules import opens_in_host_verdict, service_checkout  # noqa: E402 - FAA-118
 
 
 class _PinnedHTTPS(http.client.HTTPSConnection):
@@ -85,9 +98,13 @@ class _PinnedHTTPS(http.client.HTTPSConnection):
 
 
 class Probe:
+    remote = False  # a probe built without __init__ (the tests' Probe.__new__) reads as local
+
     def __init__(self, descriptor_path: Path, descriptor: Dict[str, Any], services_dir: Path, skip_login: bool,
-                 ca_file: Optional[str] = None, connect: Optional[str] = None, board_kit: Optional[str] = None):
+                 ca_file: Optional[str] = None, connect: Optional[str] = None, board_kit: Optional[str] = None,
+                 repo: Optional[str] = None):
         self.board_kit = board_kit
+        self.repo = repo
         self.remote = fs.placement_of(descriptor) == "remote"
         self.ca_file = ca_file
         self.connect = connect
@@ -256,6 +273,8 @@ class Probe:
             self.add("well-known.connections", "FAIL" if view["reported"] else "PASS",
                      "; ".join(f["message"] for f in fcn.connections_rules(wk)[:5]) or
                      "%d connection(s), %d named in degraded[]" % (len(view["connections"]), failing))
+        # DEC-0121, FAC-SEM-142: every button's agent twin, declared; no declaration is NOT_RUN (D10).
+        self.add("well-known.actions", *well_known_actions_verdict(wk))
         self.configuration_rule()
         svc = wk.get("service") or {}
         answered = "%s.%s" % (svc.get("id"), svc.get("instance"))
@@ -428,6 +447,24 @@ class Probe:
                 note += " (kit %s is current: dashboard_kit.py status)" % current
         self.add("dashboard.declared", "PASS", note + "; the page itself: check_dashboard_layout.mjs")
 
+    def dashboard_page_rules(self) -> None:
+        """DEC-0121 and FAA-118: what a person can do on the dashboard, and where its pages open."""
+        self.add("dashboard.actions-declared", *actions_declared_verdict(self.wk or {}))  # D10: never a FAIL for absence
+        self.opens_in_host_rule()
+
+    def opens_in_host_rule(self) -> None:
+        """FAA-118: the checkout opens the service's pages only through Fabric Dashboards (decision D13)."""
+        dashboard = ((self.wk or {}).get("surfaces") or {}).get("dashboard")
+        if not isinstance(dashboard, dict):
+            self.add("dashboard.opens-in-host", "NOT_RUN", "no surfaces.dashboard: no page to open")
+            return
+        checkout, why = service_checkout(self.d, self.repo)
+        if checkout is None:
+            self.add("dashboard.opens-in-host", "NOT_RUN", why)
+            return
+        self.add("dashboard.opens-in-host", *opens_in_host_verdict(checkout, 0 if self.remote else self.port,
+                                                                   str(self.d.get("origin") or ""), str(dashboard.get("path") or "/")))
+
     def login_rules(self) -> None:
         dashboard = ((self.wk or {}).get("surfaces") or {}).get("dashboard")
         if not dashboard or not dashboard.get("login"):
@@ -544,11 +581,14 @@ class Probe:
                       else "no readable token")
             for rule in ("interop.output-schema-object", "interop.tools-match", "interop.job-tools", "interop.unknown-job", "interop.trace-propagation"):
                 self.add(rule, "NOT_RUN", reason)
+            self.add("interop.action-tools", *action_tools_verdict(self.wk, None, reason, no_surface=not mcp_surface,
+                                                                    remote=self.remote))
         else:
             try:
                 listing = self.mcp_call("tools/list", {})
             except (OSError, ValueError) as exc:
                 self.add("interop.tools-match", "FAIL", "tools/list failed: %s" % exc)
+                self.add("interop.action-tools", *action_tools_verdict(self.wk, None, "tools/list failed: %s" % exc))
                 listing = None
             if listing is not None:
                 sent = self.sent_traceparent
@@ -556,6 +596,7 @@ class Probe:
                 self.object_root_rule(tools)
                 self.tools_match_rule(capabilities, manifest_path, tools)
                 self.job_tools_rule(capabilities, tools)
+                self.add("interop.action-tools", *action_tools_verdict(self.wk, tools))  # DEC-0121 AP-1: the live twin
                 self.unknown_job_rule(list(tools))
                 self.trace_rule(listing, sent)
         self.events_trace_rule(self.events)
@@ -811,6 +852,7 @@ class Probe:
             self.auth_rules()
             self.usage_rules()
             self.dashboard_rules()
+            self.dashboard_page_rules()
             self.login_rules()
             self.interop_rules()
             verdict, evidence = board_responder_verdict(self.wk, self.board_kit)
@@ -838,6 +880,7 @@ def main(argv: Optional[List[str]] = None) -> int:
     parser.add_argument("--ca-file", help="remote placement: trust this CA bundle instead of the system store (tests)")
     parser.add_argument("--connect", help="remote placement: dial HOST:PORT while speaking TLS to the origin's name (tests)")
     parser.add_argument("--board-kit", help="board.responder: the service's own fabric_board.py or fabric-board.mjs")
+    parser.add_argument("--repo", help="dashboard.opens-in-host: the service's checkout (default: found by source.repository)")
     args = parser.parse_args(argv)
     if not args.target and not args.descriptor:
         parser.print_usage(sys.stderr)
@@ -849,7 +892,7 @@ def main(argv: Optional[List[str]] = None) -> int:
     except (OSError, ValueError) as exc:
         print("No readable descriptor at %s: %s" % (path, exc), file=sys.stderr)
         return 1
-    results = Probe(path, descriptor, services_dir, args.skip_login, args.ca_file, args.connect, args.board_kit).run()
+    results = Probe(path, descriptor, services_dir, args.skip_login, args.ca_file, args.connect, args.board_kit, args.repo).run()
     failed = sum(r["verdict"] == "FAIL" for r in results)
     if args.json:
         print(json.dumps({"descriptor": str(path), "results": results, "failed": failed}, indent=2))