@aifabrix/builder 2.44.5 → 2.45.0

package/lib/utils/app-run-containers.js

@@ -1,4 +1,4 @@
-const { formatSuccessLine } = require('./cli-test-layout-chalk');
+const { formatSuccessLine, formatProgress } = require('./cli-test-layout-chalk');
 /**
  * AI Fabrix Builder - App Run Container Helpers
  *
@@ -118,7 +118,7 @@ async function checkContainerRunning(appName, developerId, debug = false, scopeO
 async function stopAndRemoveContainer(appName, developerId, debug = false, scopeOpts = null) {
   try {
     const containerName = getContainerName(appName, developerId, scopeOpts);
-    logger.log(chalk.yellow(`Stopping existing container ${containerName}...`));
+    logger.log(formatProgress(`Stopping container ${containerName}…`));
     const stopCmd = `docker stop ${containerName}`;
     if (debug) {
       logger.log(chalk.gray(`[DEBUG] Executing: ${stopCmd}`));

package/lib/utils/applications-config-defaults.js

@@ -0,0 +1,206 @@
+/**
+ * User `applications` entries in config.yaml (read by `aifabrix resolve`, written by `aifabrix run` dev).
+ *
+ * @fileoverview Per-app reload and `proxy` (Traefik/public URL hints) in ~/.aifabrix/config.yaml
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const config = require('../core/config');
+
+/**
+ * Persist `applications.<appKey>.reload` from the last `aifabrix run` (dev only; CLI is source of truth).
+ *
+ * @async
+ * @param {string} appKey - Application key
+ * @param {boolean} reload - Same as passing `--reload` on run
+ * @returns {Promise<void>}
+ */
+async function persistApplicationReloadFlag(appKey, reload) {
+  if (!appKey || typeof appKey !== 'string') {
+    return;
+  }
+  const cfg = await config.getConfig();
+  if (!cfg.applications || typeof cfg.applications !== 'object') {
+    cfg.applications = {};
+  }
+  const prev = cfg.applications[appKey];
+  const nextEntry =
+    prev && typeof prev === 'object' && !Array.isArray(prev) ? { ...prev, reload: Boolean(reload) } : { reload: Boolean(reload) };
+  cfg.applications[appKey] = nextEntry;
+  await config.saveConfig(cfg);
+}
+
+/**
+ * True when `applications.<appKey>.reload` is explicitly **true** (bind-mount + hot reload for `aifabrix run`).
+ * Does **not** control other compose overrides (e.g. Python image `command` when the image lacks `uvicorn` on PATH).
+ *
+ * @param {Object|null|undefined} userConfig - Parsed config.yaml root
+ * @param {string} appKey - Application key (folder / app.key)
+ * @returns {boolean} True when `applications.<appKey>.reload` is explicitly true
+ */
+function isApplicationsReloadDefaultOn(userConfig, appKey) {
+  if (!userConfig || !appKey || typeof appKey !== 'string') {
+    return false;
+  }
+  const apps = userConfig.applications;
+  if (!apps || typeof apps !== 'object') {
+    return false;
+  }
+  const entry = apps[appKey];
+  if (!entry || typeof entry !== 'object') {
+    return false;
+  }
+  return entry.reload === true;
+}
+
+/**
+ * True when `remote-server` is a non-empty string (after trim).
+ *
+ * @param {string|null|undefined} remoteServer
+ * @returns {boolean}
+ */
+function isRemoteServerConfigured(remoteServer) {
+  return Boolean(remoteServer && String(remoteServer).trim());
+}
+
+/**
+ * Whether `build.envOutputPath` should be regenerated with the **local** profile (`generateEnvContent(..., 'local')`).
+ * **False** only when **both** `remote-server` is set and `applications.<appKey>.reload` is true — then the host file
+ * uses the same **docker**-flavor expansion as `builder/<app>/.env` (copy path). All other cases use **local**.
+ *
+ * @param {Object|null|undefined} userConfig - Parsed config.yaml root
+ * @param {string} appKey - Application key
+ * @param {string|null|undefined} remoteServer - `remote-server` value (or null)
+ * @returns {boolean}
+ */
+function isPreferLocalEnvOutputPath(userConfig, appKey, remoteServer) {
+  if (!isRemoteServerConfigured(remoteServer)) {
+    return true;
+  }
+  return !isApplicationsReloadDefaultOn(userConfig, appKey);
+}
+
+/**
+ * For `aifabrix resolve`: reads `remote-server` and returns {@link isPreferLocalEnvOutputPath}.
+ *
+ * @async
+ * @param {Object|null|undefined} userConfig
+ * @param {string} appKey
+ * @returns {Promise<boolean>}
+ */
+async function resolvePreferLocalEnvOutputPathFlag(userConfig, appKey) {
+  let remoteServer = null;
+  try {
+    const rs = await config.getRemoteServer();
+    if (rs && String(rs).trim()) {
+      remoteServer = String(rs).trim();
+    }
+  } catch {
+    remoteServer = null;
+  }
+  return isPreferLocalEnvOutputPath(userConfig, appKey, remoteServer);
+}
+
+/**
+ * Normalize YAML boolean-ish values.
+ * @param {unknown} v
+ * @returns {boolean|undefined} undefined if absent / not coercible
+ */
+function coerceTriStateBool(v) {
+  if (v === true || v === 'true' || v === 'yes' || v === 'on' || v === 1 || v === '1') {
+    return true;
+  }
+  if (v === false || v === 'false' || v === 'no' || v === 'off' || v === 0 || v === '0') {
+    return false;
+  }
+  return undefined;
+}
+
+/**
+ * Whether `aifabrix run` / resolve should use Traefik-style public URL hints for this app when infra allows.
+ * Default **false** when unset. Legacy `noProxy: true` ⇒ false; legacy `noProxy: false` with no `proxy` ⇒ true.
+ *
+ * @param {Object|null|undefined} userConfig - Parsed config.yaml root
+ * @param {string} appKey - Application key
+ * @returns {boolean}
+ */
+function getApplicationsRunProxyHint(userConfig, appKey) {
+  if (!userConfig || !appKey || typeof appKey !== 'string') {
+    return false;
+  }
+  const apps = userConfig.applications;
+  if (!apps || typeof apps !== 'object') {
+    return false;
+  }
+  const entry = apps[appKey];
+  if (!entry || typeof entry !== 'object') {
+    return false;
+  }
+  const proxyCoerced = coerceTriStateBool(entry.proxy);
+  if (proxyCoerced !== undefined) {
+    return proxyCoerced;
+  }
+  const legacyNo = coerceTriStateBool(entry.noProxy);
+  if (legacyNo === true) {
+    return false;
+  }
+  if (legacyNo === false) {
+    return true;
+  }
+  return false;
+}
+
+/**
+ * Persist `applications.<appKey>.proxy` from each `aifabrix run` (same pattern as `reload` for dev-only reload flag).
+ * `proxy: true` means use Traefik/front-door URL hints when infra + that app's `application.yaml` allow; `false` means docker `url://` **public** bases for **that app** use localhost + published port. During `resolve`/`run`, each `url://` token uses the **target** app's `applications.<targetKey>.proxy`, not only the app whose `env.template` is being expanded.
+ * Removes legacy `noProxy` on the same entry when present.
+ *
+ * @async
+ * @param {string} appKey - Application key
+ * @param {boolean} proxyEnabled - Same as a normal `aifabrix run` with proxy hints on (`!isRunCliNoProxy(options)`)
+ * @returns {Promise<void>}
+ */
+async function persistApplicationRunProxyFlag(appKey, proxyEnabled) {
+  if (!appKey || typeof appKey !== 'string') {
+    return;
+  }
+  const cfg = await config.getConfig();
+  if (!cfg.applications || typeof cfg.applications !== 'object') {
+    cfg.applications = {};
+  }
+  const prev = cfg.applications[appKey];
+  const nextEntry =
+    prev && typeof prev === 'object' && !Array.isArray(prev)
+      ? { ...prev, proxy: Boolean(proxyEnabled) }
+      : { proxy: Boolean(proxyEnabled) };
+  if (Object.prototype.hasOwnProperty.call(nextEntry, 'noProxy')) {
+    delete nextEntry.noProxy;
+  }
+  cfg.applications[appKey] = nextEntry;
+  await config.saveConfig(cfg);
+}
+
+/**
+ * Whether declarative `url://*` expansion should treat Traefik as on (infra Traefik + per-app `proxy: true`).
+ *
+ * @param {Object|null|undefined} userConfig
+ * @param {string} appKey
+ * @returns {boolean}
+ */
+function isDeclarativeTraefikUrlsEnabled(userConfig, appKey) {
+  return Boolean(userConfig && userConfig.traefik === true) && getApplicationsRunProxyHint(userConfig, appKey);
+}
+
+module.exports = {
+  getApplicationsRunProxyHint,
+  isApplicationsReloadDefaultOn,
+  isDeclarativeTraefikUrlsEnabled,
+  isPreferLocalEnvOutputPath,
+  isRemoteServerConfigured,
+  persistApplicationRunProxyFlag,
+  persistApplicationReloadFlag,
+  resolvePreferLocalEnvOutputPathFlag
+};

package/lib/utils/auth-config-validator.js

@@ -8,7 +8,7 @@
  * @version 2.0.0
  */
 
-const { getControllerUrlFromLoggedInUser } = require('./controller-url');
+const { hasStoredDeviceTokenForController } = require('./controller-url');
 
 /**
  * Validate controller URL format
@@ -72,17 +72,7 @@ async function checkUserLoggedIn(controllerUrl) {
   if (!controllerUrl) {
     return false;
   }
-
-  const normalizedUrl = controllerUrl.trim().replace(/\/+$/, '');
-  const loggedInControllerUrl = await getControllerUrlFromLoggedInUser();
-
-  if (!loggedInControllerUrl) {
-    return false;
-  }
-
-  // Normalize both URLs for comparison
-  const normalizedLoggedIn = loggedInControllerUrl.trim().replace(/\/+$/, '');
-  return normalizedLoggedIn === normalizedUrl;
+  return hasStoredDeviceTokenForController(controllerUrl);
 }
 
 module.exports = {

package/lib/utils/bash-secret-env.js

@@ -0,0 +1,59 @@
+/**
+ * Map secrets keys `BASH_<NAME>` to process-style env `{ [NAME]: value }` for child_process env.
+ * Same naming rule as kv://BASH_* resolution (see secrets-bash-kv.js).
+ *
+ * @fileoverview BASH-prefixed secret → exported-style env for Docker/subprocess
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const secretsLoad = require('../core/secrets-load');
+
+/**
+ * @param {string} suffix - Part after BASH_
+ * @returns {boolean}
+ */
+function isValidExportedName(suffix) {
+  return Boolean(suffix && /^[A-Za-z_][A-Za-z0-9_]*$/.test(suffix));
+}
+
+/**
+ * Collect `BASH_*` entries from a flat or shallow secrets object.
+ *
+ * @param {Record<string, unknown>|null|undefined} secrets - Merged secrets map (decrypted)
+ * @returns {Record<string, string>} e.g. { NPM_TOKEN: '...' } from BASH_NPM_TOKEN
+ */
+function collectBashPrefixedEnv(secrets) {
+  const out = {};
+  if (!secrets || typeof secrets !== 'object') return out;
+  for (const [k, v] of Object.entries(secrets)) {
+    if (typeof k !== 'string' || !k.startsWith('BASH_')) continue;
+    if (v === undefined || v === null) continue;
+    const str = typeof v === 'string' ? v.trim() : String(v).trim();
+    if (!str) continue;
+    const suffix = k.slice(5);
+    if (!isValidExportedName(suffix)) continue;
+    out[suffix] = str;
+  }
+  return out;
+}
+
+/**
+ * Overlay for `child_process` `env`: values from primary user `secrets.local.yaml` plus `aifabrix-secrets`
+ * for every `BASH_*` key (merged via {@link secretsLoad.loadSecrets}).
+ *
+ * @param {string|null} [secretsPath] - Optional explicit secrets file (same as resolve)
+ * @param {string|null} [appName] - Optional app name for loadSecrets second arg
+ * @returns {Promise<Record<string, string>>}
+ */
+async function getBashPrefixedProcessEnvOverlay(secretsPath = null, appName = null) {
+  const secrets = await secretsLoad.loadSecrets(secretsPath, appName);
+  return collectBashPrefixedEnv(secrets);
+}
+
+module.exports = {
+  collectBashPrefixedEnv,
+  getBashPrefixedProcessEnvOverlay
+};

package/lib/utils/cli-secrets-error-format.js

@@ -0,0 +1,78 @@
+/**
+ * @fileoverview Missing-secrets CLI error lines (layout colors via cli-layout-chalk).
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const { metadata, sectionTitle } = require('./cli-layout-chalk');
+
+/**
+ * @param {string[]} messages - Output lines
+ * @param {RegExpMatchArray|null} missingSecretsMatch - Missing secrets capture
+ */
+function pushMissingSecretsBodyLines(messages, missingSecretsMatch) {
+  if (missingSecretsMatch) {
+    const parts = missingSecretsMatch[1]
+      .trim()
+      .split(',')
+      .map((s) => s.trim())
+      .filter(Boolean);
+    if (parts.length > 1) {
+      messages.push(`   ${sectionTitle('Missing secrets:')}`);
+      for (const ref of parts) {
+        messages.push(`   ${chalk.cyan('-')} ${chalk.white(ref)}`);
+      }
+      return;
+    }
+    if (parts.length === 1) {
+      messages.push(`   ${sectionTitle('Missing secrets:')} ${chalk.white(parts[0])}`);
+      return;
+    }
+    messages.push(`   ${sectionTitle('Missing secrets:')}`);
+    return;
+  }
+  messages.push(`   ${chalk.white('Missing secrets in secrets file.')}`);
+}
+
+/**
+ * @param {string[]} messages - Output lines
+ * @param {RegExpMatchArray|null} fileInfoMatch - File location capture
+ * @param {RegExpMatchArray|null} resolveMatch - Resolve command capture
+ */
+function pushSecretsResolutionHintLines(messages, fileInfoMatch, resolveMatch) {
+  if (fileInfoMatch) {
+    messages.push(`   ${metadata('Secrets file location:')} ${chalk.white(fileInfoMatch[1])}`);
+  }
+  if (resolveMatch) {
+    messages.push(
+      `   ${metadata('Run:')} ${chalk.yellow(`aifabrix resolve ${resolveMatch[1]} to generate missing secrets.`)}`
+    );
+    return;
+  }
+  messages.push(`   ${metadata('Run:')} ${chalk.yellow('aifabrix resolve <app-name> to generate missing secrets.')}`);
+}
+
+/**
+ * Format secrets-related errors
+ * @param {string} errorMsg - Error message
+ * @returns {string[]|null} Array of error message lines or null if not a secrets error
+ */
+function formatSecretsError(errorMsg) {
+  if (!errorMsg.includes('Missing secrets')) {
+    return null;
+  }
+
+  const messages = [];
+  pushMissingSecretsBodyLines(messages, errorMsg.match(/Missing secrets: ([^\n]+)/));
+  pushSecretsResolutionHintLines(
+    messages,
+    errorMsg.match(/Secrets file location: ([^\n]+)/),
+    errorMsg.match(/Run "aifabrix resolve ([^"]+)"/)
+  );
+  return messages;
+}
+
+module.exports = { formatSecretsError };

package/lib/utils/cli-test-layout-chalk.js

@@ -7,6 +7,18 @@
 
 const chalk = require('chalk');
 
+/**
+ * Invoke chalk[method](text) when the mock/real chalk exposes that method; otherwise return text.
+ * Keeps layout helpers working in Jest suites that only stub a subset of chalk.
+ * @param {string} method - chalk method name (e.g. 'white', 'bold', 'gray')
+ * @param {string} text
+ * @returns {string}
+ */
+function chalkStyle(method, text) {
+  const fn = chalk[method];
+  return typeof fn === 'function' ? fn(text) : text;
+}
+
 /** Canonical success glyph (green), layout §CORE / §3. */
 function successGlyph() {
   return chalk.green('✔');
@@ -35,6 +47,15 @@ function formatSuccessParagraph(message) {
   return chalk.green(`\n✔ ${message}`);
 }
 
+/**
+ * Non-blocking warning (layout §CORE): yellow ⚠ + white detail.
+ * @param {string} message - text after the glyph (do not prefix with ⚠)
+ * @returns {string}
+ */
+function formatWarningLine(message) {
+  return `${chalkStyle('yellow', '⚠')} ${chalkStyle('white', message)}`;
+}
+
 /**
  * Blocking error line: red ✖ + red message (layout §18).
  * @param {string} message
@@ -65,7 +86,7 @@ function formatIssue(title, hint) {
  */
 function formatNextActions(lines) {
   const body = (lines || [])
-    .map(line => `${chalk.cyan('-')} ${chalk.white(line)}`)
+    .map(line => `${chalkStyle('cyan', '-')} ${chalkStyle('white', line)}`)
     .join('\n');
   return `${sectionTitle('Next actions:')}\n${body}`;
 }
@@ -87,7 +108,7 @@ function formatDocsLine(label, url) {
  * @returns {string}
  */
 function formatProgress(message) {
-  return `${chalk.yellow('⏳')} ${chalk.white(message)}`;
+  return `${chalkStyle('yellow', '⏳')} ${chalkStyle('white', message)}`;
 }
 
 /**
@@ -99,7 +120,7 @@ function formatProgress(message) {
  */
 function formatBulletSection(title, items, opts) {
   const bulletColor = opts && opts.bullet === 'red' ? chalk.red : chalk.cyan;
-  const body = (items || []).map(line => `${bulletColor('-')} ${chalk.white(line)}`).join('\n');
+  const body = (items || []).map(line => `${bulletColor('-')} ${chalkStyle('white', line)}`).join('\n');
   return `${sectionTitle(title)}\n${body}`;
 }
 
@@ -109,7 +130,7 @@ function formatBulletSection(title, items, opts) {
  * @returns {string}
  */
 function sectionTitle(text) {
-  return chalk.white.bold(text);
+  return chalkStyle('bold', chalkStyle('white', text));
 }
 
 /**
@@ -119,7 +140,7 @@ function sectionTitle(text) {
  * @returns {string}
  */
 function headerKeyValue(label, value) {
-  return `${chalk.gray(label)} ${chalk.white.bold(value)}`;
+  return `${chalkStyle('gray', label)} ${chalkStyle('bold', chalkStyle('white', value))}`;
 }
 
 /**
@@ -201,7 +222,7 @@ function formatDatasourceListRow(rowStatus, name, statusHint) {
           ? chalk.red('✖')
           : chalk.gray('⏭');
   const hint = statusHint ? ` ${chalk.gray(`(${statusHint})`)}` : '';
-  return `  ${sym} ${chalk.white(name)}${hint}`;
+  return `  ${sym} ${chalkStyle('white', name)}${hint}`;
 }
 
 /**
@@ -232,13 +253,13 @@ function colorRollupPrefixedLine(line) {
   const trimmed = line.trimStart();
   const first = trimmed[0];
   if (first === '✔') {
-    return chalk.green('✔') + chalk.white(trimmed.slice(1));
+    return chalk.green('✔') + chalkStyle('white', trimmed.slice(1));
   }
   if (first === '⚠') {
-    return chalk.yellow('⚠') + chalk.white(trimmed.slice(1));
+    return chalk.yellow('⚠') + chalkStyle('white', trimmed.slice(1));
   }
   if (first === '✖') {
-    return chalk.red('✖') + chalk.white(trimmed.slice(1));
+    return chalk.red('✖') + chalkStyle('white', trimmed.slice(1));
   }
   return line;
 }
@@ -258,6 +279,7 @@ module.exports = {
   failureGlyph,
   formatSuccessLine,
   formatSuccessParagraph,
+  formatWarningLine,
   formatBlockingError,
   formatIssue,
   formatNextActions,

package/lib/utils/cli-utils.js

@@ -11,6 +11,8 @@
 const path = require('path');
 const chalk = require('chalk');
 const logger = require('./logger');
+const { formatBlockingError, infoLine } = require('./cli-layout-chalk');
+const { formatSecretsError } = require('./cli-secrets-error-format');
 const { getDockerDaemonStartHintSentence, getDockerApiOverTcpHintLines } = require('./docker-not-running-hint');
 
 /**
@@ -231,40 +233,6 @@ function formatAzureError(errorMsg) {
   return null;
 }
 
-/**
- * Format secrets-related errors
- * @param {string} errorMsg - Error message
- * @returns {string[]|null} Array of error message lines or null if not a secrets error
- */
-function formatSecretsError(errorMsg) {
-  if (!errorMsg.includes('Missing secrets')) {
-    return null;
-  }
-
-  const messages = [];
-  const missingSecretsMatch = errorMsg.match(/Missing secrets: ([^\n]+)/);
-  const fileInfoMatch = errorMsg.match(/Secrets file location: ([^\n]+)/);
-  const resolveMatch = errorMsg.match(/Run "aifabrix resolve ([^"]+)"/);
-
-  if (missingSecretsMatch) {
-    messages.push(`   Missing secrets: ${missingSecretsMatch[1]}`);
-  } else {
-    messages.push('   Missing secrets in secrets file.');
-  }
-
-  if (fileInfoMatch) {
-    messages.push(`   Secrets file location: ${fileInfoMatch[1]}`);
-  }
-
-  if (resolveMatch) {
-    messages.push(`   Run: aifabrix resolve ${resolveMatch[1]} to generate missing secrets.`);
-  } else {
-    messages.push('   Run: aifabrix resolve <app-name> to generate missing secrets.');
-  }
-
-  return messages;
-}
-
 /**
  * Format deployment-related errors
  * @param {string} errorMsg - Error message
@@ -388,9 +356,9 @@ function formatError(error) {
  * @param {string[]} errorMessages - Error message lines
  */
 function logError(command, errorMessages) {
-  logger.error(`\n✖ Error in ${command} command:`);
+  logger.error(`\n${formatBlockingError(`Error in ${command} command:`)}`);
   errorMessages.forEach(msg => logger.error(msg));
-  logger.error('\n💡 Run "aifabrix doctor" for environment diagnostics.\n');
+  logger.log(`\n${infoLine('ℹ Run "aifabrix doctor" for environment diagnostics.')}\n`);
 }
 
 /**