@aifabrix/builder 2.44.4 → 2.44.6

package/lib/app/push.js

@@ -1,4 +1,12 @@
-const { formatSuccessLine, formatSuccessParagraph } = require('../utils/cli-test-layout-chalk');
+const {
+  formatSuccessLine,
+  formatSuccessParagraph,
+  sectionTitle,
+  headerKeyValue,
+  metadata,
+  formatWarningLine,
+  formatNextActions
+} = require('../utils/cli-test-layout-chalk');
 /**
  * Application Push Utilities
  *
@@ -9,9 +17,9 @@ const { formatSuccessLine, formatSuccessParagraph } = require('../utils/cli-test
  * @version 2.0.0
  */
 
-const chalk = require('chalk');
 const pushUtils = require('../deployment/push');
 const logger = require('../utils/logger');
+const { detectAppType } = require('../utils/paths');
 
 /**
  * Validate application name format
@@ -150,6 +158,33 @@ async function authenticateWithRegistry(registry) {
   }
 }
 
+/**
+ * Layout-aligned notice when push is skipped for external integrations.
+ * @param {string} appName
+ */
+function logExternalIntegrationPushNotice(appName) {
+  logger.log('');
+  logger.log(sectionTitle('Push'));
+  logger.log(headerKeyValue('Application:', appName));
+  logger.log(formatWarningLine('External integrations have no application image to push.'));
+  logger.log(metadata('Use upload or deploy for integration artifacts.'));
+  logger.log(formatNextActions([`aifabrix upload ${appName}`, `aifabrix deploy ${appName}`]));
+}
+
+/**
+ * Header after validation passes for a regular (non-external) push.
+ * @param {string} appName
+ * @param {string} registry
+ * @param {string} imageName
+ */
+function logPushCommandHeader(appName, registry, imageName) {
+  logger.log('');
+  logger.log(sectionTitle('Push'));
+  logger.log(headerKeyValue('Application:', appName));
+  logger.log(metadata(`Registry: ${registry}`));
+  logger.log(metadata(`Repository: ${imageName}`));
+}
+
 /**
  * Pushes image tags to registry
  * @async
@@ -171,7 +206,9 @@ async function pushImageTags(imageName, registry, tags) {
                         (errorMessage.includes('authentication') && errorMessage.includes('401'));
 
     if (isAuthError) {
-      logger.log(chalk.yellow('⚠ Authentication expired, re-authenticating...'));
+      logger.log(
+        formatWarningLine('Registry authentication expired; re-authenticating, then retrying push.')
+      );
       await authenticateWithRegistry(registry);
       // Retry push after re-authentication
       await Promise.all(tags.map(async(tag) => {
@@ -190,9 +227,9 @@ async function pushImageTags(imageName, registry, tags) {
  * @param {Array<string>} tags - Image tags
  */
 function displayPushResults(registry, imageName, tags) {
-  logger.log(formatSuccessParagraph(`Successfully pushed ${tags.length} tag(s) to ${registry}`));
-  logger.log(chalk.gray(`Image: ${registry}/${imageName}:*`));
-  logger.log(chalk.gray(`Tags: ${tags.join(', ')}`));
+  logger.log(formatSuccessParagraph(`Pushed ${tags.length} tag(s) to ${registry}`));
+  logger.log(headerKeyValue('Image:', `${registry}/${imageName}`));
+  logger.log(headerKeyValue('Tags:', tags.join(', ')));
 }
 
 /**
@@ -204,38 +241,25 @@ function displayPushResults(registry, imageName, tags) {
  * @returns {Promise<void>} Resolves when push is complete
  */
 async function pushApp(appName, options = {}) {
-  // Check if app type is external - skip push
-  const { detectAppType } = require('../utils/paths');
   try {
     const { isExternal } = await detectAppType(appName);
     if (isExternal) {
-      logger.log(chalk.yellow('⚠  External systems don\'t require Docker images. Skipping push...'));
+      logExternalIntegrationPushNotice(appName);
       return;
     }
-  } catch (error) {
+  } catch (_error) {
     // If detection fails, continue with normal push
     // (detectAppType throws if app doesn't exist, which is fine for push command)
   }
   try {
-    // Validate app name
     validateAppName(appName);
-
-    // Load configuration
     const { registry, imageName } = await loadPushConfig(appName, options);
-
-    // Validate push configuration
     await validatePushConfig(registry, imageName, appName);
-
-    // Authenticate with registry
+    logPushCommandHeader(appName, registry, imageName);
     await authenticateWithRegistry(registry);
-
-    // Push image tags
     const tags = options.tag ? options.tag.split(',').map(t => t.trim()) : ['latest'];
     await pushImageTags(imageName, registry, tags);
-
-    // Display results
     displayPushResults(registry, imageName, tags);
-
   } catch (error) {
     throw new Error(`Failed to push application: ${error.message}`);
   }
@@ -245,4 +269,3 @@ module.exports = {
   pushApp,
   validateAppName
 };
-

package/lib/app/register.js

@@ -99,7 +99,7 @@ async function saveLocalCredentials(responseData, apiUrl) {
 
     // Regenerate .env file with updated credentials
     try {
-      await generateEnvFile(registeredAppKey, null, 'local');
+      await generateEnvFile(registeredAppKey, null, 'local', true);
       logger.log(formatSuccessLine('.env file updated with new credentials'));
     } catch (error) {
       logger.warn(chalk.yellow(`⚠  Could not regenerate .env file: ${error.message}`));

package/lib/app/restart-display.js

@@ -0,0 +1,95 @@
+/**
+ * After `docker restart`, describe dev workspace mounts for developer clarity.
+ *
+ * @fileoverview Bind mount vs remote-engine hints (aligns with run --reload messaging)
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+'use strict';
+
+const logger = require('../utils/logger');
+const config = require('../core/config');
+const { execWithDockerEnv } = require('../utils/docker-exec');
+const { sectionTitle, headerKeyValue, metadata } = require('../utils/cli-test-layout-chalk');
+const { isReloadBindMountOnEngineHost } = require('../utils/docker-reload-mount');
+
+/**
+ * @param {unknown} mounts - docker inspect .Mounts
+ * @returns {{ Type: string, Source: string, Destination: string }|null}
+ */
+function findAppBindMount(mounts) {
+  if (!Array.isArray(mounts)) {
+    return null;
+  }
+  const hit = mounts.find((m) => m && m.Type === 'bind' && m.Destination === '/app');
+  return hit && typeof hit.Source === 'string' ? hit : null;
+}
+
+/**
+ * @param {string} stdout
+ * @returns {unknown|null}
+ */
+function parseInspectMountsStdout(stdout) {
+  try {
+    return JSON.parse(String(stdout || '').trim());
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * @param {string} containerName
+ * @returns {Promise<unknown|null>}
+ */
+async function fetchContainerMountsJson(containerName) {
+  try {
+    const { stdout } = await execWithDockerEnv(
+      `docker inspect --format '{{json .Mounts}}' ${containerName}`,
+      { maxBuffer: 2 * 1024 * 1024 }
+    );
+    return parseInspectMountsStdout(stdout);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Log workspace transport after a successful container restart (mounts unchanged).
+ * @param {string} containerName - Docker container name
+ * @returns {Promise<void>}
+ */
+async function logRestartDevMountSummary(containerName) {
+  if (!containerName || typeof containerName !== 'string') {
+    return;
+  }
+  const mounts = await fetchContainerMountsJson(containerName);
+  const appBind = findAppBindMount(mounts);
+  if (!appBind) {
+    return;
+  }
+  const endpoint = await config.getDockerEndpoint();
+  const localEngine = isReloadBindMountOnEngineHost(endpoint);
+
+  logger.log('');
+  logger.log(sectionTitle('Dev workspace (unchanged by restart)'));
+  if (localEngine) {
+    logger.log(headerKeyValue('Transport:', 'Direct bind mount on the Docker host (no Mutagen).'));
+    logger.log(headerKeyValue('Host path → container:', `${appBind.Source} → /app`));
+    logger.log(metadata('Edits under the host path are visible inside the container immediately.'));
+  } else {
+    logger.log(
+      headerKeyValue(
+        'Transport:',
+        'Bind mount on the Docker engine (see path below; Mutagen may sync to this path when using --reload).'
+      )
+    );
+    logger.log(headerKeyValue('Engine path → container:', `${appBind.Source} → /app`));
+  }
+  logger.log('');
+}
+
+module.exports = {
+  findAppBindMount,
+  logRestartDevMountSummary
+};

package/lib/app/rotate-secret.js

@@ -287,7 +287,7 @@ async function saveCredentialsLocally(appKey, credentials, actualControllerUrl)
 
       // Regenerate .env file with updated credentials
       try {
-        await generateEnvFile(appKey, null, 'local');
+        await generateEnvFile(appKey, null, 'local', true);
         logger.log(formatSuccessLine('.env file updated with new credentials'));
       } catch (error) {
         logger.warn(chalk.yellow(`⚠  Could not regenerate .env file: ${error.message}`));

package/lib/app/run-container-start.js

@@ -5,7 +5,11 @@
  */
 
 'use strict';
-const { formatSuccessLine } = require('../utils/cli-test-layout-chalk');
+const {
+  formatSuccessLine,
+  formatProgress,
+  formatWarningLine
+} = require('../utils/cli-test-layout-chalk');
 
 const fs = require('fs').promises;
 const chalk = require('chalk');
@@ -31,8 +35,8 @@ const execAsync = promisify(exec);
 async function emitAndRunDockerFallback(appName, appConfig, port, opts) {
   const { debug, runEnvPath, runOptions, misoEnvironment } = opts;
   logger.log(
-    chalk.yellow(
-      'Docker Compose not found; using docker run (apps without database/redis only). ' +
+    formatWarningLine(
+      'Docker Compose not found; using docker run (apps without Postgres/Redis only). ' +
         'Install docker-compose-plugin for full compose support.'
     )
   );
@@ -116,7 +120,7 @@ async function waitForHealthyAndCleanupEnvFiles(appName, port, appConfig, o) {
   const displayUrl = (healthUrl && typeof healthUrl === 'string')
     ? healthUrl
     : `http://localhost:${port}${healthCheckPath}`;
-  logger.log(chalk.blue(`Waiting for application to be healthy at ${displayUrl}...`));
+  logger.log(formatProgress(`Waiting for healthy: ${displayUrl}…`));
   await healthCheck.waitForHealthCheck(appName, 90, port, appConfig, debug, ro);
 
   for (const p of [runEnvPath, runEnvAdminPath]) {
@@ -124,7 +128,9 @@ async function waitForHealthyAndCleanupEnvFiles(appName, port, appConfig, o) {
       try {
         await fs.unlink(p);
       } catch (err) {
-        if (err.code !== 'ENOENT') logger.log(chalk.yellow(`Warning: could not remove run .env: ${err.message}`));
+        if (err.code !== 'ENOENT') {
+          logger.log(formatWarningLine(`Could not remove run .env: ${err.message}`));
+        }
       }
     }
   }
@@ -148,7 +154,7 @@ async function startContainer(appName, composePath, port, appConfig = null, opts
     devMountPath = null,
     misoEnvironment = 'dev'
   } = opts;
-  logger.log(chalk.blue(`Starting ${appName}...`));
+  logger.log(formatProgress(`Starting ${appName}…`));
 
   let composeCmdBase;
   let usedDockerRunFallback = false;

package/lib/app/run-env-compose.js

@@ -14,9 +14,36 @@ const fs = require('fs').promises;
 const fsSync = require('fs');
 const pathsUtil = require('../utils/paths');
 const adminSecrets = require('../core/admin-secrets');
+const secretsEnsure = require('../core/secrets-ensure');
 const secretsEnvWrite = require('../core/secrets-env-write');
 const { getContainerPort } = require('../utils/port-resolver');
 
+/**
+ * Backfill only secrets needed for `aifabrix run <app>`: kv:// keys from that app's env.template
+ * (catalog defaults via placeholderContext). Does not run full `ensureInfraSecrets`.
+ *
+ * Docker Postgres admin password for compose/db-init comes from **admin-secrets.env** (see
+ * `ensureAdminSecrets` / `readAndDecryptAdminSecrets`), not from `postgres-passwordKeyVault` on every run.
+ * The kv key is used when **generating** admin-secrets (e.g. first `up-infra`) via `generateAdminSecretsEnv`;
+ * we do not duplicate it here when an admin file already exists.
+ *
+ * @async
+ * @param {string} appName - Builder application key
+ * @returns {Promise<void>}
+ */
+async function ensureRunSecretsForApp(appName) {
+  const placeholderContext = secretsEnsure.buildInfraPlaceholderContext({});
+  const userSecretsPath = pathsUtil.getPrimaryUserSecretsLocalPath();
+  const templatePath = path.join(pathsUtil.getBuilderPath(appName), 'env.template');
+  if (fsSync.existsSync(templatePath)) {
+    await secretsEnsure.ensureSecretsFromEnvTemplate(templatePath, {
+      placeholderContext,
+      preferredFilePath: userSecretsPath,
+      useMergedSecretsForMissingKeys: true
+    });
+  }
+}
+
 /**
  * Clean applications directory: remove generated docker-compose.yaml and .env.* files.
  * @param {string|number} developerId - Developer ID
@@ -204,6 +231,7 @@ async function buildMergedRunEnvAndWrite(appName, appConfig, devDir, developerId
   const ensureAdminSecretsFn = typeof infra.ensureAdminSecrets === 'function'
     ? infra.ensureAdminSecrets
     : require('../infrastructure/helpers').ensureAdminSecrets;
+  await ensureRunSecretsForApp(appName);
   await ensureAdminSecretsFn();
   const adminObj = await adminSecrets.readAndDecryptAdminSecrets();
   const runEnvKey = scopeOpts && scopeOpts.runEnvKey ? String(scopeOpts.runEnvKey).toLowerCase() : 'dev';
@@ -248,5 +276,6 @@ function assertNoPasswordLiteralsInCompose(composeContent) {
 module.exports = {
   cleanApplicationsDir,
   buildMergedRunEnvAndWrite,
-  assertNoPasswordLiteralsInCompose
+  assertNoPasswordLiteralsInCompose,
+  ensureRunSecretsForApp
 };

package/lib/app/run-helpers.js

@@ -1,4 +1,12 @@
-const { formatSuccessLine, formatSuccessParagraph } = require('../utils/cli-test-layout-chalk');
+const {
+  formatSuccessLine,
+  formatSuccessParagraph,
+  formatProgress,
+  formatNextActions,
+  headerKeyValue,
+  metadata,
+  infoLine
+} = require('../utils/cli-test-layout-chalk');
 /**
  * AI Fabrix Builder - App Run Helpers
  *
@@ -28,6 +36,8 @@ const { resolveRunImage } = require('./run-resolve-image');
 const { startContainer } = require('./run-container-start');
 const { resolveEnvOutputPath, writeEnvOutputForReload, writeEnvOutputForLocal } = require('../utils/env-copy');
 const { resolveVersionForApp } = require('../utils/image-version');
+const healthCheckUtil = require('../utils/health-check');
+const { computeTraefikPublicAppUrl } = require('../utils/health-check-url');
 
 /** Template apps (keycloak, miso-controller, dataplane) - never update application config when running */
 const TEMPLATE_APP_KEYS = ['keycloak', 'miso-controller', 'dataplane'];
@@ -179,7 +189,7 @@ async function checkPrerequisites(appName, appConfig, debug = false, skipInfraCh
     logger.log(chalk.gray(`[DEBUG] Image name: ${imageName}, tag: ${imageTag}`));
   }
 
-  logger.log(chalk.blue(`Checking if image ${fullImageName} exists...`));
+  logger.log(formatProgress(`Checking image ${fullImageName}…`));
   const imageExists = await checkImageExists(imageName, imageTag, debug);
   if (!imageExists) {
     const isTemplateApp = TEMPLATE_APP_KEYS.includes(appName);
@@ -208,12 +218,12 @@ async function checkInfraHealthOrThrow(debug, appConfig) {
   const requirements = getAppInfraRequirements(appConfig);
   if (requirements && !requirements.needsPostgres && !requirements.needsRedis) {
     logger.log(
-      chalk.blue('Skipping infrastructure check (application does not require database or redis)...')
+      infoLine('Skipping Postgres/Redis health check (not required by this application).')
     );
     return;
   }
 
-  logger.log(chalk.blue('Checking infrastructure health...'));
+  logger.log(formatProgress('Checking infrastructure health…'));
   const infra = require('../infrastructure');
   const healthOptions =
     requirements === null
@@ -280,7 +290,7 @@ function calculateComposePort(options, appConfig, developerId) {
  * @returns {Promise<string>} Path to compose file
  */
 async function generateComposeFile(appName, appConfig, composeOptions, devDir) {
-  logger.log(chalk.blue('Generating Docker Compose configuration...'));
+  logger.log(formatProgress('Generating Docker Compose configuration…'));
   const composeContent = await composeGenerator.generateDockerCompose(appName, appConfig, composeOptions);
   runEnvCompose.assertNoPasswordLiteralsInCompose(composeContent);
   const tempComposePath = path.join(devDir, 'docker-compose.yaml');
@@ -338,7 +348,7 @@ async function prepareEnvironment(appName, appConfig, options) {
   );
 
   runEnvCompose.cleanApplicationsDir(developerId);
-  logger.log(chalk.blue('Building merged .env (admin + app secrets)...'));
+  logger.log(formatProgress('Building merged .env (admin + app secrets)…'));
   const { runEnvPath, runEnvAdminPath } = await runEnvCompose.buildMergedRunEnvAndWrite(
     appName,
     appConfig,
@@ -367,15 +377,37 @@ async function prepareEnvironment(appName, appConfig, options) {
  * @param {string} appName - Application name
  * @param {number} port - Application port
  * @param {Object} appConfig - Application configuration (with developerId property)
+ * @param {Object|null} [runScopeOpts] - Optional env-scoped container naming
+ * @param {Object} [runOptions] - Run options (traefikEnabled / probeViaTraefik for public URL)
  */
-async function displayRunStatus(appName, port, appConfig, runScopeOpts = null) {
+async function displayRunStatus(appName, port, appConfig, runScopeOpts = null, runOptions = {}) {
   const containerName = containerHelpers.getContainerName(appName, appConfig.developerId, runScopeOpts);
-  const healthCheckPath = appConfig?.healthCheck?.path || '/health';
-  const healthCheckUrl = `http://localhost:${port}${healthCheckPath}`;
+  const ro = runOptions && typeof runOptions === 'object' ? runOptions : {};
+  const wantsPublic = Boolean(ro.probeViaTraefik === true || ro.traefikEnabled === true);
 
-  logger.log(formatSuccessParagraph(`App running at http://localhost:${port}`));
-  logger.log(chalk.blue(`Health check: ${healthCheckUrl}`));
-  logger.log(chalk.gray(`Container: ${containerName}`));
+  let primaryAppUrl = `http://localhost:${port}`;
+  if (wantsPublic) {
+    const pub = await computeTraefikPublicAppUrl(appName, port, appConfig);
+    if (pub) primaryAppUrl = pub;
+  }
+
+  const healthTipUrl = await healthCheckUtil.computeHealthCheckUrl(appName, port, appConfig, {
+    runOptions: ro
+  });
+
+  logger.log(formatSuccessParagraph(`App running at ${primaryAppUrl}`));
+  if (wantsPublic && primaryAppUrl.indexOf('localhost') === -1) {
+    logger.log(metadata(`Local direct: http://localhost:${port}`));
+  }
+  logger.log(headerKeyValue('Health check:', healthTipUrl));
+  logger.log(headerKeyValue('Container:', containerName));
+  logger.log('');
+  logger.log(
+    formatNextActions([
+      `Validate errors: aifabrix logs ${appName} -l error`,
+      `Follow output: aifabrix logs ${appName} -f -t 100`
+    ])
+  );
 }
 
 module.exports = {

package/lib/app/run-reload-sync.js

@@ -0,0 +1,148 @@
+/**
+ * Mutagen sync for `aifabrix run --reload` when Docker runs on another host.
+ *
+ * @fileoverview ensureReloadSync extracted from run.js (size limits)
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const { formatProgress } = require('../utils/cli-test-layout-chalk');
+const config = require('../core/config');
+const logger = require('../utils/logger');
+const mutagen = require('../utils/mutagen');
+const pathsUtil = require('../utils/paths');
+const {
+  isReloadBindMountOnEngineHost,
+  isLocalhostSyncSshHost
+} = require('../utils/docker-reload-mount');
+const { sectionTitle, headerKeyValue, metadata } = require('../utils/cli-test-layout-chalk');
+
+/**
+ * @typedef {Object} ReloadSyncSummaryBind
+ * @property {'bind-mount'} transport
+ * @property {string} hostPath - Host directory bind-mounted to /app in the container
+ */
+
+/**
+ * @typedef {Object} ReloadSyncSummaryMutagen
+ * @property {'mutagen'} transport
+ * @property {string} remotePath - Path on sync host used for Docker -v
+ * @property {string} sessionName - Mutagen session name
+ * @property {string} localPath - Local folder synced (same as build context)
+ * @property {string} syncSshHost - sync-ssh-host from config
+ * @property {string} sshUrl - Mutagen endpoint (user@host:path)
+ */
+
+/**
+ * @typedef {ReloadSyncSummaryBind|ReloadSyncSummaryMutagen} ReloadSyncSummary
+ */
+
+/**
+ * Install Mutagen if needed, create sync session, return summary for compose and UX.
+ * @param {string} appName
+ * @param {string} developerId
+ * @param {boolean} debug
+ * @param {string} codePath
+ * @param {string} [remoteSyncPath]
+ * @param {string} syncSshHost
+ * @returns {Promise<ReloadSyncSummaryMutagen>}
+ */
+async function startMutagenReloadSync(
+  appName,
+  developerId,
+  debug,
+  codePath,
+  remoteSyncPath,
+  syncSshHost
+) {
+  const [userMutagenFolder, syncSshUser] = await Promise.all([
+    config.getUserMutagenFolder(),
+    config.getSyncSshUser()
+  ]);
+  if (!userMutagenFolder || !syncSshUser || !syncSshHost) {
+    throw new Error(
+      'run --reload requires remote server sync settings. Run "aifabrix dev init" or set user-mutagen-folder, sync-ssh-user, sync-ssh-host in config.'
+    );
+  }
+  const mutagenPath = await mutagen.ensureMutagenPath(logger.log);
+  const remotePath = mutagen.getRemotePath(userMutagenFolder, appName, remoteSyncPath);
+  const sshUrl = mutagen.getSyncSshUrl(syncSshUser, syncSshHost, remotePath);
+  const sessionName = mutagen.getSessionName(developerId, appName);
+  const localPath = (codePath && typeof codePath === 'string') ? codePath : pathsUtil.getBuilderPath(appName);
+  if (debug) logger.log(chalk.gray(`[DEBUG] Mutagen sync: ${sessionName} ${localPath} <-> ${sshUrl}`));
+  logger.log(formatProgress('Reload: ensuring Mutagen sync (remote Docker engine)…'));
+  await mutagen.ensureSyncSession(mutagenPath, sessionName, localPath, sshUrl);
+  return {
+    transport: 'mutagen',
+    remotePath,
+    sessionName,
+    localPath,
+    syncSshHost,
+    sshUrl
+  };
+}
+
+/**
+ * When run --reload in dev with remote: ensure Mutagen sync session; return summary for mounts and CLI copy.
+ * Uses codePath (resolved build.context) as Mutagen local path so one config field drives both local and remote.
+ * Skips Mutagen when docker-endpoint targets this host (bind mount) or sync-ssh-host is localhost.
+ *
+ * @param {string} appName - Application name
+ * @param {string} developerId - Developer ID
+ * @param {boolean} debug - Debug flag
+ * @param {string} codePath - Resolved build.context (absolute path to app code)
+ * @param {string} [remoteSyncPath] - Optional relative path under user-mutagen-folder (from build.remoteSyncPath); when unset, defaults to dev/<appKey>
+ * @returns {Promise<ReloadSyncSummary>}
+ * @throws {Error} If --reload but remote not configured, or Mutagen install fails
+ */
+async function ensureReloadSync(appName, developerId, debug, codePath, remoteSyncPath) {
+  const endpoint = await config.getDockerEndpoint();
+  if (isReloadBindMountOnEngineHost(endpoint)) {
+    if (debug) {
+      logger.log(
+        chalk.gray('[DEBUG] Docker engine shares this host filesystem; skipping Mutagen for --reload')
+      );
+    }
+    return { transport: 'bind-mount', hostPath: codePath };
+  }
+  const syncSshHost = await config.getSyncSshHost();
+  if (isLocalhostSyncSshHost(syncSshHost || '')) {
+    if (debug) {
+      logger.log(chalk.gray('[DEBUG] sync-ssh-host is localhost; skipping Mutagen, using local path'));
+    }
+    return { transport: 'bind-mount', hostPath: codePath };
+  }
+  return startMutagenReloadSync(appName, developerId, debug, codePath, remoteSyncPath, syncSshHost);
+}
+
+/**
+ * Log how --reload is wired (bind vs Mutagen) after compose/env prep, before container start.
+ * @param {boolean} reload
+ * @param {ReloadSyncSummary|undefined} summary
+ */
+function logReloadDevSummary(reload, summary) {
+  if (!reload || !summary) {
+    return;
+  }
+  logger.log('');
+  logger.log(sectionTitle('Reload (dev)'));
+  if (summary.transport === 'bind-mount') {
+    logger.log(headerKeyValue('Transport:', 'Direct bind mount on the Docker host (no Mutagen).'));
+    logger.log(headerKeyValue('Host path → container:', `${summary.hostPath} → /app`));
+    logger.log(metadata('Edits under the host path are visible inside the container immediately.'));
+    logger.log('');
+    return;
+  }
+  logger.log(headerKeyValue('Transport:', 'Mutagen two-way sync (Docker engine on another host).'));
+  logger.log(headerKeyValue('Session:', summary.sessionName));
+  logger.log(headerKeyValue('Sync host:', summary.syncSshHost));
+  logger.log(headerKeyValue('Local folder:', summary.localPath));
+  logger.log(headerKeyValue('Remote mount (-v):', summary.remotePath));
+  logger.log(metadata(`Mutagen endpoint: ${summary.sshUrl}`));
+  logger.log('');
+}
+
+module.exports = { ensureReloadSync, logReloadDevSummary };

package/lib/app/run-resolve-image.js

@@ -6,7 +6,10 @@
 
 'use strict';
 
+const config = require('../core/config');
 const { resolveDockerImageRef } = require('../utils/resolve-docker-image-ref');
+const { checkImageExists } = require('../utils/app-run-containers');
+const { buildDevImageRepositoryPath } = require('../utils/image-name');
 
 /**
  * @param {string} appName
@@ -18,4 +21,51 @@ function resolveRunImage(appName, appConfig, runOptions) {
   return resolveDockerImageRef(appName, appConfig, runOptions);
 }
 
-module.exports = { resolveRunImage };
+/**
+ * Resolves which local image to run: developer-scoped ref first when present, else manifest base.
+ * With {@link runOptions.base} true, uses manifest base only (no dev-first probe).
+ *
+ * @async
+ * @param {string} appName
+ * @param {Object} appConfig
+ * @param {Object} [runOptions]
+ * @param {string} [runOptions.image] - Full override (skips fallback logic)
+ * @param {boolean} [runOptions.base] - When true, manifest base ref only
+ * @returns {Promise<{ imageName: string, imageTag: string }>}
+ */
+async function resolveRunImageWithLocalFallback(appName, appConfig, runOptions = {}) {
+  const opts = runOptions || {};
+  if (opts.image) {
+    return resolveDockerImageRef(appName, appConfig, opts);
+  }
+
+  const baseRef = resolveDockerImageRef(appName, appConfig, opts);
+
+  if (opts.base === true) {
+    return baseRef;
+  }
+
+  const developerId = await config.getDeveloperId();
+  const idNum = typeof developerId === 'string' ? parseInt(developerId, 10) : developerId;
+  if (!Number.isFinite(idNum) || idNum === 0) {
+    return baseRef;
+  }
+
+  const tag = baseRef.imageTag;
+  const devRepo = buildDevImageRepositoryPath(baseRef.imageName, developerId);
+  const devExists = await checkImageExists(devRepo, tag, false);
+  if (devExists) {
+    return { imageName: devRepo, imageTag: tag };
+  }
+  const baseExists = await checkImageExists(baseRef.imageName, tag, false);
+  if (baseExists) {
+    return baseRef;
+  }
+
+  throw new Error(
+    `Docker image not found (tried ${devRepo}:${tag} then ${baseRef.imageName}:${tag})\n` +
+      `Run 'aifabrix build ${appName}' or pull the manifest image, or use --base after pulling the base image.`
+  );
+}
+
+module.exports = { resolveRunImage, resolveRunImageWithLocalFallback };