@aifabrix/builder 2.44.6 → 2.45.5

package/lib/commands/protection-cli-leaves.js

@@ -0,0 +1,286 @@
+/**
+ * @fileoverview Protection subcommand registration (keeps setupProtectionCommands under line limit).
+ */
+
+'use strict';
+
+const logger = require('../utils/logger');
+const { resolveProtectionArgument } = require('../protection/resolve');
+const {
+  runProtectionValidate,
+  runProtectionUpload,
+  runProtectionList,
+  runProtectionShow,
+  runProtectionDelete
+} = require('../protection/run-commands');
+const { runProtectionCreate } = require('../protection/run-protection-create');
+
+const SHARED_OPTS = [
+  ['-e, --env <environment>', 'Environment key'],
+  ['-v, --verbose', 'Verbose output']
+];
+
+const PROTECTION_CREATE_HELP_AFTER = `
+
+Examples:
+  $ aifabrix protection create hubspot-companies --type country-sales
+  $ aifabrix protection create hr-persons --type department-manager
+  $ aifabrix protection create erp-projects --type project-team
+  $ aifabrix protection create hubspot-companies --dimension-key country --dry-run
+  $ aifabrix protection create hubspot-companies --type country-sales --force
+
+Preset types:
+  country-sales, department-manager, customer-team, project-team, static-region, owner-direct
+`;
+
+const PROTECTION_VALIDATE_HELP_AFTER = `
+
+Examples:
+  $ aifabrix protection validate hubspot-companies
+  $ aifabrix protection validate hubspot-companies --simulate
+  $ aifabrix protection validate hubspot-companies --warnings-as-errors
+  $ aifabrix protection validate hubspot-companies --json
+`;
+
+const PROTECTION_UPLOAD_HELP_AFTER = `
+
+Examples:
+  $ aifabrix protection upload hubspot-companies
+  $ aifabrix protection upload hubspot-companies --dry-run
+  $ aifabrix protection upload hubspot-companies --no-sync
+`;
+
+const PROTECTION_LIST_HELP_AFTER = `
+
+Examples:
+  $ aifabrix protection list
+  $ aifabrix protection list --page 1 --page-size 50
+  $ aifabrix protection list --filter enabled:eq:true
+  $ aifabrix protection list --json
+`;
+
+const PROTECTION_SHOW_HELP_AFTER = `
+
+Examples:
+  $ aifabrix protection show hubspot-companies
+  $ aifabrix protection show hubspot-companies -v
+  $ aifabrix protection show hubspot-companies --json
+`;
+
+const PROTECTION_DELETE_HELP_AFTER = `
+
+Examples:
+  $ aifabrix protection delete hubspot-companies
+  $ aifabrix protection delete hubspot-companies --yes
+`;
+
+/**
+ * @param {import('commander').Command} cmd
+ * @param {string} name
+ * @param {string} description
+ * @param {Function} action
+ * @param {Array<[string, string]>} extraOpts
+ * @param {string} helpAfter
+ */
+function addProtectionLeaf(cmd, name, description, action, extraOpts = [], helpAfter = '') {
+  const leaf = cmd.command(name).description(description);
+  for (const [flags, desc] of [...SHARED_OPTS, ...extraOpts]) {
+    leaf.option(flags, desc);
+  }
+  if (helpAfter) {
+    leaf.addHelpText('after', helpAfter);
+  }
+  leaf.action(async(datasourceKey, options) => {
+    try {
+      const code = await action(datasourceKey, options);
+      if (code && code !== 0) process.exit(code);
+    } catch (err) {
+      const { formatBlockingError } = require('../utils/cli-test-layout-chalk');
+      logger.error(formatBlockingError(err.message || String(err)));
+      process.exit(1);
+    }
+  });
+}
+
+/**
+ * @param {import('commander').Command} protection
+ */
+function registerProtectionCreate(protection) {
+  const leaf = protection
+    .command('create <datasourceKey>')
+    .description(
+      'Probe dataplane datasource + Controller dimension, then scaffold under integration/.protection/'
+    );
+  for (const [flags, desc] of SHARED_OPTS) {
+    leaf.option(flags, desc);
+  }
+  leaf
+    .option('--type <type>', 'Preset type (country-sales, department-manager, customer-team, project-team, static-region, owner-direct)')
+    .option('--dimension-key <key>', 'Dimension catalog key (inferred from --type when omitted)')
+    .option('--field <name>', 'Metadata field used by preset value templates when needed')
+    .option('--fk-name <name>', 'FK binding name in expressions (default: same as dimension key)')
+    .option('--protection-key <key>', 'metadata.key (default: <datasource>-<dimension>-access)')
+    .option('--display-name <text>', 'metadata.displayName')
+    .option('--rule-key <key>', 'Rule key inside spec.rules[0]')
+    .option('--principal-expression <expr>', 'Group principal expression (default: Sales {{fk.<fk>.metadata.iso3}} Users)')
+    .option('--value-expression <expr>', 'Grant valueExpression (default: {{fk.<fk>.metadata.iso2}})')
+    .option('--dry-run', 'Print YAML to stdout; do not write file')
+    .option('--force', 'Overwrite existing integration/.protection/<datasourceKey> manifest')
+    .option('--disabled', 'Set spec.enabled to false', false)
+    .addHelpText('after', PROTECTION_CREATE_HELP_AFTER)
+    .action(async(datasourceKey, options) => {
+      try {
+        const code = await runProtectionCreate(datasourceKey, {
+          ...options,
+          dryRun: options.dryRun === true,
+          force: options.force === true,
+          verbose: options.verbose === true,
+          disabled: options.disabled === true
+        }, logger);
+        if (code && code !== 0) process.exit(code);
+      } catch (err) {
+        const { formatBlockingError } = require('../utils/cli-test-layout-chalk');
+        if (Array.isArray(err.probeLines)) {
+          for (const line of err.probeLines) {
+            logger.log(line);
+          }
+        }
+        logger.error(formatBlockingError(err.message || String(err)));
+        process.exit(1);
+      }
+    });
+}
+
+/**
+ * @param {import('commander').Command} protection
+ */
+function registerProtectionValidate(protection) {
+  addProtectionLeaf(
+    protection,
+    'validate <datasourceKey>',
+    'Validate protection manifest (local schema + dataplane)',
+    async(datasourceKey, options) => {
+      const resolved = resolveProtectionArgument(datasourceKey);
+      return runProtectionValidate(resolved.datasourceKey, resolved.manifest, {
+        ...options,
+        manifestPath: resolved.manifestPath,
+        warningsAsErrors: options.warningsAsErrors === true,
+        simulate: options.simulate === true,
+        json: options.json === true,
+        verbose: options.verbose === true
+      }, logger);
+    },
+    [
+      ['--json', 'Output dataplane report as JSON'],
+      ['--warnings-as-errors', 'Pass strict=true to dataplane validate'],
+      ['--simulate', 'Run simulate after validate passes']
+    ],
+    PROTECTION_VALIDATE_HELP_AFTER
+  );
+}
+
+/**
+ * @param {import('commander').Command} protection
+ */
+function registerProtectionUpload(protection) {
+  addProtectionLeaf(
+    protection,
+    'upload <datasourceKey>',
+    'Validate and upload protection manifest to dataplane',
+    async(datasourceKey, options) => {
+      const resolved = resolveProtectionArgument(datasourceKey);
+      return runProtectionUpload(resolved.datasourceKey, resolved.manifest, {
+        ...options,
+        manifestPath: resolved.manifestPath,
+        warningsAsErrors: options.warningsAsErrors === true,
+        dryRun: options.dryRun === true,
+        noSync: options.noSync === true,
+        verbose: options.verbose === true
+      }, logger);
+    },
+    [
+      ['--dry-run', 'Validate only; no upload or sync'],
+      ['--no-sync', 'Skip datasource sync after upload']
+    ],
+    PROTECTION_UPLOAD_HELP_AFTER
+  );
+}
+
+/**
+ * @param {import('commander').Command} protection
+ */
+function registerProtectionList(protection) {
+  const leaf = protection.command('list').description('List deployed protection manifests on dataplane');
+  for (const [flags, desc] of SHARED_OPTS) {
+    leaf.option(flags, desc);
+  }
+  leaf
+    .option('--json', 'Output paginated list as JSON')
+    .option('--page <n>', 'Page (1-based)', (v) => parseInt(v, 10))
+    .option('--page-size <n>', 'Page size', (v) => parseInt(v, 10))
+    .option('--filter <expr>', 'Filter (e.g. enabled:eq:true)')
+    .addHelpText('after', PROTECTION_LIST_HELP_AFTER)
+    .action(async(options) => {
+      try {
+        const code = await runProtectionList(
+          {
+            ...options,
+            json: options.json === true,
+            verbose: options.verbose === true
+          },
+          logger
+        );
+        if (code && code !== 0) process.exit(code);
+      } catch (err) {
+        const { formatBlockingError } = require('../utils/cli-test-layout-chalk');
+        logger.error(formatBlockingError(err.message || String(err)));
+        process.exit(1);
+      }
+    });
+}
+
+/**
+ * @param {import('commander').Command} protection
+ */
+function registerProtectionShow(protection) {
+  addProtectionLeaf(
+    protection,
+    'show <datasourceKey>',
+    'Show deployed protection state from dataplane',
+    async(datasourceKey, options) =>
+      runProtectionShow(datasourceKey, {
+        ...options,
+        json: options.json === true,
+        verbose: options.verbose === true
+      }, logger),
+    [['--json', 'Output merged manifest + status as JSON']],
+    PROTECTION_SHOW_HELP_AFTER
+  );
+}
+
+/**
+ * @param {import('commander').Command} protection
+ */
+function registerProtectionDelete(protection) {
+  addProtectionLeaf(
+    protection,
+    'delete <datasourceKey>',
+    'Delete deployed protection for datasource',
+    async(datasourceKey, options) =>
+      runProtectionDelete(datasourceKey, {
+        ...options,
+        yes: options.yes === true
+      }, logger),
+    [['--yes', 'Skip confirmation prompt']],
+    PROTECTION_DELETE_HELP_AFTER
+  );
+}
+
+module.exports = {
+  registerProtectionCreate,
+  registerProtectionValidate,
+  registerProtectionUpload,
+  registerProtectionList,
+  registerProtectionShow,
+  registerProtectionDelete
+};

package/lib/commands/protection.js

@@ -0,0 +1,50 @@
+/**
+ * @fileoverview Protection manifest CLI commands.
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const {
+  registerProtectionCreate,
+  registerProtectionValidate,
+  registerProtectionUpload,
+  registerProtectionList,
+  registerProtectionShow,
+  registerProtectionDelete
+} = require('./protection-cli-leaves');
+
+const PROTECTION_HELP_AFTER = `
+
+Examples:
+  $ aifabrix protection create hubspot-companies --type country-sales
+  $ aifabrix protection validate hubspot-companies --simulate
+  $ aifabrix protection upload hubspot-companies --dry-run
+  $ aifabrix protection list
+  $ aifabrix protection show hubspot-companies
+  $ aifabrix protection delete hubspot-companies --yes
+
+Per-command help:  aifabrix protection <command> --help
+`;
+
+/**
+ * @param {import('commander').Command} program
+ */
+function setupProtectionCommands(program) {
+  const protection = program
+    .command('protection')
+    .description('Manage protection manifests in integration/.protection/ (repo root)')
+    .addHelpText('after', PROTECTION_HELP_AFTER);
+
+  registerProtectionCreate(protection);
+  registerProtectionValidate(protection);
+  registerProtectionUpload(protection);
+  registerProtectionList(protection);
+  registerProtectionShow(protection);
+  registerProtectionDelete(protection);
+}
+
+module.exports = {
+  setupProtectionCommands
+};

package/lib/commands/repair.js

@@ -125,11 +125,21 @@ function applyAuthMethod(ctx) {
   const existingAuth = ctx.systemParsed.authentication || ctx.systemParsed.auth || {};
   const { buildAuthenticationFromMethod } = require('../external-system/generator');
   const newAuth = buildAuthenticationFromMethod(ctx.systemKey, method);
-  const existingVars = existingAuth.variables && typeof existingAuth.variables === 'object' ? existingAuth.variables : {};
-  const mergedVariables = { ...newAuth.variables, ...existingVars };
+  const existingVars =
+    existingAuth.variables && typeof existingAuth.variables === 'object'
+      ? existingAuth.variables
+      : {};
+  // When switching auth method, keep only connectivity fields from the wizard draft.
+  // Do not let OAuth-era variables (tokenUrl, scope, headerName, …) override the new method.
+  const mergedVariables = { ...newAuth.variables };
+  for (const key of ['baseUrl', 'testEndpoint']) {
+    if (existingVars[key] !== undefined && existingVars[key] !== null) {
+      mergedVariables[key] = existingVars[key];
+    }
+  }
   ctx.systemParsed.authentication = {
     ...newAuth,
-    variables: Object.keys(mergedVariables).length ? mergedVariables : newAuth.variables
+    variables: mergedVariables
   };
   if (existingAuth.displayName !== undefined) {
     ctx.systemParsed.authentication.displayName = existingAuth.displayName;

package/lib/commands/setup-modes.js

@@ -9,7 +9,9 @@
  *   - {@link runUpdateImages}     — Mode 4: docker pull infra + platform images, up-infra, up-platform.
  *
  * Every handler ends with `up-infra` (idempotent, reads flags from
- * `config.yaml`) followed by `up-platform`. Modes 1/2/3 also remove
+ * `config.yaml`) followed by `up-platform`. Optional service keys
+ * (`traefik`, `pgadmin`, `redisCommander`) are written when missing so the
+ * file matches effective compose defaults. Modes 1/2/3 also remove
  * `secrets.local.yaml` so the next platform bootstrap re-resolves
  * service secrets from the catalog and re-prompts the AI tool wizard.
  *
@@ -49,6 +51,10 @@ const postgresWipe = require('../utils/postgres-wipe');
 const setupPrompts = require('./setup-prompts');
 const { handleLogin } = require('./login');
 const infraGuided = require('../cli/infra-guided');
+const {
+  computeEffectiveInfraOptionalFlags,
+  persistMissingInfraOptionalServiceFlags
+} = require('../utils/infra-optional-service-flags');
 
 /** Builder app keys touched by `up-platform --force`. */
 const PLATFORM_APPS = ['keycloak', 'miso-controller', 'dataplane'];
@@ -203,7 +209,9 @@ function stopSpinnerSuccess(spinner, text) {
 /**
  * Start infrastructure using the developer's `config.yaml` flags.
  * Mirrors the relevant slice of `runUpInfraCommand` from `lib/cli/setup-infra.js`
- * without re-applying CLI flag persistence (we never receive flags here).
+ * without re-applying CLI flag persistence (setup passes no Commander flags).
+ * After a successful start, missing `traefik` / `pgadmin` / `redisCommander`
+ * keys are written to match effective {@link infra.startInfra} options.
  *
  * @async
  * @param {Object} [overrides] - Optional admin overrides (fresh install only)
@@ -214,17 +222,22 @@ function stopSpinnerSuccess(spinner, text) {
 async function startInfraFromConfig(overrides = {}) {
   await config.ensureSecretsEncryptionKey();
   const cfg = await config.getConfig();
+  const emailOverride = String(overrides.adminEmail || '').trim();
+  const emailFromConfig = typeof cfg.adminEmail === 'string' ? cfg.adminEmail.trim() : '';
+  const adminEmailMerged = emailOverride || emailFromConfig || undefined;
+  const effective = computeEffectiveInfraOptionalFlags(cfg, {});
   await withMutedLogger(async() => {
     await infra.startInfra(null, {
-      traefik: cfg.traefik === true,
-      pgadmin: cfg.pgadmin !== false,
-      redisCommander: cfg.redisCommander !== false,
+      traefik: effective.traefik,
+      pgadmin: effective.pgadmin,
+      redisCommander: effective.redisCommander,
       adminPassword: overrides.adminPassword,
       adminPwd: overrides.adminPassword,
-      adminEmail: overrides.adminEmail,
+      adminEmail: adminEmailMerged,
       tlsEnabled: cfg.tlsEnabled === true
     });
   });
+  await persistMissingInfraOptionalServiceFlags(cfg, effective);
 }
 
 /**

package/lib/commands/setup-prompts.js

@@ -3,7 +3,8 @@
  *
  * Three small prompt helpers:
  *   1. {@link promptModeSelection} - Mode menu shown when infra is already up.
- *   2. {@link promptAdminCredentials} - Admin email + password (fresh install only).
+ *   2. {@link promptAdminCredentials} - Admin email + password (fresh install only); email default
+ *      from {@link module:lib/core/config.getAdminEmail} when `adminEmail` exists in config.yaml.
  *   3. {@link promptAiTool} - AI tool provider + keys, only when the merged
  *      secret cascade (user-local + shared) does not already provide the keys.
  *
@@ -23,9 +24,11 @@
 
 'use strict';
 
+const path = require('path');
 const inquirer = require('inquirer');
 const chalk = require('chalk');
 const logger = require('../utils/logger');
+const config = require('../core/config');
 const secretsCore = require('../core/secrets');
 const secretsEnsure = require('../core/secrets-ensure');
 const { formatSuccessLine, infoLine } = require('../utils/cli-test-layout-chalk');
@@ -133,6 +136,8 @@ function validatePassword(input) {
 
 /**
  * Prompt for admin email + password (fresh install only).
+ * Reads {@link module:lib/core/config.getAdminEmail} so a previous `aifabrix setup` can prefill the
+ * email field (user may change it before continuing).
  * Asks once for the password and once for confirmation; returns trimmed email
  * and the verbatim password (never logged).
  *
@@ -140,13 +145,24 @@ function validatePassword(input) {
  * @returns {Promise<{ adminEmail: string, adminPassword: string }>}
  */
 async function promptAdminCredentials() {
+  let defaultEmail;
+  try {
+    const saved = await config.getAdminEmail();
+    defaultEmail = saved && saved.trim() ? saved.trim() : undefined;
+  } catch {
+    defaultEmail = undefined;
+  }
+  const emailQuestion = {
+    type: 'input',
+    name: 'adminEmail',
+    message: 'Admin email (Keycloak / pgAdmin login):',
+    validate: validateEmail
+  };
+  if (defaultEmail !== undefined) {
+    emailQuestion.default = defaultEmail;
+  }
   const answers = await inquirer.prompt([
-    {
-      type: 'input',
-      name: 'adminEmail',
-      message: 'Admin email (Keycloak / pgAdmin login):',
-      validate: validateEmail
-    },
+    emailQuestion,
     {
       type: 'password',
       name: 'adminPassword',
@@ -323,6 +339,22 @@ async function promptAiTool(options = {}) {
   );
 }
 
+/**
+ * Absolute directory paths (with trailing sep) shown when setup will replace platform apps.
+ *
+ * @param {string} builderRoot - Absolute or relative builder root
+ * @param {string[]} platformApps - App folder names (e.g. `keycloak`)
+ * @returns {string[]}
+ */
+function formatBuilderPlatformReplaceLines(builderRoot, platformApps) {
+  const root = builderRoot && typeof builderRoot === 'string' ? builderRoot : 'builder/';
+  const apps = Array.isArray(platformApps) ? platformApps : [];
+  return apps.map((a) => {
+    const full = path.resolve(path.join(root, a));
+    return full.endsWith(path.sep) ? full : `${full}${path.sep}`;
+  });
+}
+
 /**
  * When `aifabrix setup` is about to run `up-platform --force`, it will wipe
  * platform app directories under `builder/`. If the builder root already
@@ -356,7 +388,7 @@ async function promptBuilderDirConflict(info) {
     systemNote +
     '\n\n' +
     'This setup path will REPLACE the platform app folders under:\n' +
-    `  ${platformApps.map(a => `builder/${a}/`).join('\n  ')}`;
+    `  ${formatBuilderPlatformReplaceLines(builderRoot, platformApps).join('\n  ')}`;
 
   const { action } = await inquirer.prompt([
     {
@@ -379,6 +411,7 @@ module.exports = {
   MODE,
   AI_KEYS,
   BUILDER_DIR_ACTION,
+  formatBuilderPlatformReplaceLines,
   promptModeSelection,
   confirmDestructiveMode,
   promptAdminCredentials,

package/lib/commands/setup.js

@@ -29,6 +29,7 @@ const {
 
 const setupPrompts = require('./setup-prompts');
 const setupModes = require('./setup-modes');
+const installationLog = require('../utils/installation-log');
 
 const MODE = setupPrompts.MODE;
 
@@ -57,19 +58,25 @@ async function runFreshInstallFlow(options) {
   await maybePinDeveloperIdForFreshInstall(options.developer);
   logger.log(infoLine('No infrastructure detected; starting fresh install.'));
   const adminCreds = await setupPrompts.promptAdminCredentials();
+  await config.setAdminEmail(adminCreds.adminEmail);
   await setupModes.runFreshInstall(adminCreds);
   logger.log(formatSuccessParagraph('aifabrix setup complete (fresh install).'));
 }
 
+/**
+ * @param {boolean} assumeYes
+ * @returns {Promise<{ aborted: boolean, mode: string|null }>}
+ */
 async function runExistingInfraFlow(assumeYes) {
   const mode = await setupPrompts.promptModeSelection();
   const proceed = await setupPrompts.confirmDestructiveMode(mode, assumeYes);
   if (!proceed) {
     logger.log(chalk.yellow('Aborted by user.'));
-    return;
+    return { aborted: true, mode };
   }
   await dispatchMode(mode);
   logger.log(formatSuccessParagraph(`aifabrix setup complete (mode: ${mode}).`));
+  return { aborted: false, mode };
 }
 
 /**
@@ -116,6 +123,89 @@ async function dispatchMode(mode) {
   }
 }
 
+/**
+ * @param {Object} options
+ * @param {boolean} assumeYes
+ * @returns {Promise<{ outcome: string, setupMode: string|null }>}
+ */
+async function runSetupMainPath(options, assumeYes) {
+  logSetupHeader();
+  logger.log(formatProgress('Detecting current installation state...'));
+  const running = await isInfraRunning();
+  if (!running) {
+    await runFreshInstallFlow(options);
+    return { outcome: 'success', setupMode: 'fresh' };
+  }
+  const r = await runExistingInfraFlow(assumeYes);
+  const outcome = r.aborted ? 'aborted' : 'success';
+  return { outcome, setupMode: r.mode };
+}
+
+async function readConfigSnapshotForSetupLog() {
+  try {
+    return await config.getConfig();
+  } catch {
+    return {};
+  }
+}
+
+function tryCollectPlatformImagesForLog(outcome) {
+  if (outcome !== 'success') return undefined;
+  try {
+    return installationLog.collectPlatformAppImages(['keycloak', 'miso-controller', 'dataplane'], {});
+  } catch {
+    return undefined;
+  }
+}
+
+async function readSetupLogUrlFields() {
+  let controllerUrl;
+  try {
+    controllerUrl = await installationLog.resolveControllerUrlForLog();
+  } catch {
+    controllerUrl = undefined;
+  }
+  let adminEmail;
+  try {
+    adminEmail = await installationLog.resolveAdminEmailPresence();
+  } catch {
+    adminEmail = 'unset';
+  }
+  return { controllerUrl, adminEmail };
+}
+
+/**
+ * @param {Object} payload
+ * @param {string} payload.outcome
+ * @param {Date} payload.startedAt
+ * @param {Date} payload.completedAt
+ * @param {Object} payload.options
+ * @param {string|null} payload.setupMode
+ * @param {Error|null} payload.err
+ */
+async function appendSetupInstallationRecord(payload) {
+  const cfg = await readConfigSnapshotForSetupLog();
+  const platformApps = tryCollectPlatformImagesForLog(payload.outcome);
+  const { controllerUrl, adminEmail } = await readSetupLogUrlFields();
+  try {
+    await installationLog.appendInstallationRecord({
+      command: 'setup',
+      outcome: payload.outcome,
+      startedAt: payload.startedAt,
+      completedAt: payload.completedAt,
+      options: payload.options,
+      setupMode: payload.setupMode || undefined,
+      infra: cfg && typeof cfg === 'object' ? { cfg, options: {} } : undefined,
+      platformApps,
+      configExtra: { controllerUrl, adminEmail },
+      error: payload.err || undefined,
+      errorCode: payload.err && payload.err.code ? String(payload.err.code) : undefined
+    });
+  } catch {
+    // never block setup on log failure
+  }
+}
+
 /**
  * Run the setup wizard / dispatcher.
  *
@@ -129,17 +219,32 @@ async function dispatchMode(mode) {
  */
 async function handleSetup(options = {}) {
   const assumeYes = options.yes === true || options.assumeYes === true;
+  const startedAt = new Date();
+  let outcome = 'success';
+  let setupMode = null;
+  let err = null;
 
-  logSetupHeader();
-
-  logger.log(formatProgress('Detecting current installation state...'));
-  const running = await isInfraRunning();
+  try {
+    const main = await runSetupMainPath(options, assumeYes);
+    outcome = main.outcome;
+    setupMode = main.setupMode;
+  } catch (e) {
+    outcome = 'failure';
+    err = e;
+  } finally {
+    await appendSetupInstallationRecord({
+      outcome,
+      startedAt,
+      completedAt: new Date(),
+      options,
+      setupMode,
+      err
+    });
+  }
 
-  if (!running) {
-    await runFreshInstallFlow(options);
-    return;
+  if (err) {
+    throw err;
   }
-  await runExistingInfraFlow(assumeYes);
 }
 
 module.exports = {