@aifabrix/builder 2.44.6 → 2.45.5

package/lib/core/secrets-load.js

@@ -1,7 +1,9 @@
 /**
- * Secrets loading cascade (user file, aifabrix-secrets file or remote API, builder YAML, defaults).
+ * Secrets loading: primary user file plus configured `aifabrix-secrets` (shared YAML or remote API).
  *
- * @fileoverview Split from secrets.js for module size limits
+ * @fileoverview Default `kv://` resolution uses only `~/.aifabrix/secrets.local.yaml` and `aifabrix-secrets`
+ *   from config — not cwd-ancestor `.aifabrix/secrets.local.yaml`, not `builder/secrets.local.yaml`,
+ *   and not `~/.aifabrix/secrets.yaml`.
  * @author AI Fabrix Team
  * @version 1.0.0
  */
@@ -13,27 +15,75 @@ const path = require('path');
 const config = require('./config');
 const { readYamlAtPath, applyCanonicalSecretsOverride } = require('../utils/secrets-canonical');
 const { ensureSecureFilePermissions } = require('../utils/secure-file-permissions');
+const { resolveSecretsPath } = require('../utils/secrets-path');
 const {
-  resolveSecretsPath
-} = require('../utils/secrets-path');
-const {
-  loadUserSecrets,
   loadPrimaryUserSecrets,
   loadDefaultSecrets,
   ensurePrimaryUserSecretsFileExists
 } = require('../utils/secrets-utils');
-const { decryptSecret, isEncrypted } = require('../utils/secrets-encryption');
 const pathsUtil = require('../utils/paths');
-const { collectAncestorAifabrixSecretsLocalYamlPaths } = require('../utils/secrets-ancestor-paths');
+const { decryptSecret, isEncrypted } = require('../utils/secrets-encryption');
+const logger = require('../utils/logger');
+const { isSecretKeyAllowedEmpty } = require('./secrets-ensure-infra');
+
+/** Dedupe optional decrypt warnings across repeated `loadSecrets` (and duplicate module instances). */
+function optionalDecryptWarnSeen(key) {
+  const g = globalThis;
+  if (!g.__aifabrixOptionalDecryptWarnOnce) {
+    g.__aifabrixOptionalDecryptWarnOnce = new Set();
+  }
+  const set = g.__aifabrixOptionalDecryptWarnOnce;
+  if (set.has(key)) return true;
+  set.add(key);
+  return false;
+}
+
+/**
+ * @param {string} key
+ * @param {unknown} value
+ * @param {string} encryptionKey
+ * @param {Record<string, string>} decryptedSecrets
+ * @param {string} [sourceHint] - File path or API label for decrypt errors / warnings
+ */
+function mergeDecryptedEntry(key, value, encryptionKey, decryptedSecrets, sourceHint) {
+  if (!isEncrypted(value)) {
+    decryptedSecrets[key] = value;
+    return;
+  }
+  try {
+    decryptedSecrets[key] = decryptSecret(value, encryptionKey);
+  } catch (error) {
+    const msg = error && error.message ? error.message : String(error);
+    if (!isSecretKeyAllowedEmpty(key)) {
+      const where =
+        sourceHint && String(sourceHint).trim().length > 0
+          ? ` (encrypted value loaded from: ${sourceHint})`
+          : ' (encrypted value source not recorded; check ~/.aifabrix/secrets.local.yaml and aifabrix-secrets)';
+      throw new Error(`Failed to decrypt secret '${key}'${where}: ${msg}`);
+    }
+    if (!optionalDecryptWarnSeen(key)) {
+      const where =
+        sourceHint && String(sourceHint).trim().length > 0
+          ? ` Encrypted value loaded from: ${sourceHint}.`
+          : '';
+      logger.warn(
+        `Optional secret '${key}' could not be decrypted (${msg}). Treating as empty.${where} ` +
+          'Remove the stale key from shared or local secrets, or fix secrets-encryption alignment.'
+      );
+    }
+    decryptedSecrets[key] = '';
+  }
+}
 
 /**
  * Decrypts encrypted values in secrets object
  *
  * @async
  * @param {Object} secrets - Secrets object with potentially encrypted values
+ * @param {{ keySources?: Record<string, string>, defaultSourceLabel?: string }} [options] - Per-key file/API path for errors
  * @returns {Promise<Object>} Secrets object with decrypted values
  */
-async function decryptSecretsObject(secrets) {
+async function decryptSecretsObject(secrets, options) {
   if (!secrets || typeof secrets !== 'object') {
     return secrets;
   }
@@ -49,17 +99,13 @@ async function decryptSecretsObject(secrets) {
     return secrets;
   }
 
+  const keySources = options && options.keySources ? options.keySources : null;
+  const defaultLabel = options && options.defaultSourceLabel ? options.defaultSourceLabel : '';
+
   const decryptedSecrets = {};
   for (const [key, value] of Object.entries(secrets)) {
-    if (isEncrypted(value)) {
-      try {
-        decryptedSecrets[key] = decryptSecret(value, encryptionKey);
-      } catch (error) {
-        throw new Error(`Failed to decrypt secret '${key}': ${error.message}`);
-      }
-    } else {
-      decryptedSecrets[key] = value;
-    }
+    const sourceHint = (keySources && keySources[key]) || defaultLabel || '';
+    mergeDecryptedEntry(key, value, encryptionKey, decryptedSecrets, sourceHint);
   }
 
   return decryptedSecrets;
@@ -67,8 +113,9 @@ async function decryptSecretsObject(secrets) {
 
 /**
  * Merges config file secrets into user secrets (user wins). Returns null if path missing or config empty.
+ * @param {Record<string, string>} [keySources] - Mutated: path for keys filled from this file
  */
-function mergeUserWithConfigFile(userSecrets, resolvedConfigPath) {
+function mergeUserWithConfigFile(userSecrets, resolvedConfigPath, keySources) {
   if (!fs.existsSync(resolvedConfigPath)) {
     return null;
   }
@@ -86,6 +133,9 @@ function mergeUserWithConfigFile(userSecrets, resolvedConfigPath) {
   for (const key of Object.keys(configSecrets)) {
     if (!(key in merged) || merged[key] === undefined || merged[key] === null || merged[key] === '') {
       merged[key] = configSecrets[key];
+      if (keySources) {
+        keySources[key] = resolvedConfigPath;
+      }
     }
   }
   return merged;
@@ -99,122 +149,74 @@ function createMergeHelpers(userSecrets) {
   };
 }
 
-async function mergeFromConfiguredSecretsPath(configSecretsPath, userSecrets, helpers) {
+async function mergeFromConfiguredSecretsPath(configSecretsPath, userSecrets, helpers, keySources) {
   const remoteDevAuth = require('../utils/remote-dev-auth');
   const effectiveShared = await remoteDevAuth.resolveSharedSecretsEndpoint(configSecretsPath);
 
   if (remoteDevAuth.isRemoteSecretsUrl(effectiveShared)) {
     const { loadRemoteSharedSecrets, mergeUserWithRemoteSecrets } = require('../utils/remote-secrets-loader');
     const remoteSecrets = await loadRemoteSharedSecrets();
-    const merged = mergeUserWithRemoteSecrets(userSecrets, remoteSecrets);
+    const remoteLabel = `shared secrets API (${effectiveShared})`;
+    const merged = mergeUserWithRemoteSecrets(userSecrets, remoteSecrets, keySources, remoteLabel);
     return helpers.hasKeys(merged) ? merged : helpers.userOrNull();
   }
 
   const resolvedConfigPath = path.isAbsolute(configSecretsPath)
     ? configSecretsPath
     : path.resolve(process.cwd(), configSecretsPath);
-  const merged = mergeUserWithConfigFile(userSecrets, resolvedConfigPath);
+  const merged = mergeUserWithConfigFile(userSecrets, resolvedConfigPath, keySources);
   return merged !== null ? merged : helpers.userOrNull();
 }
 
 async function loadMergedConfigAndUserSecrets() {
   const userSecrets = loadPrimaryUserSecrets();
   const helpers = createMergeHelpers(userSecrets);
+  const userPath = pathsUtil.getPrimaryUserSecretsLocalPath();
+  /** @type {Record<string, string>} */
+  const keySources = {};
+  for (const k of Object.keys(userSecrets || {})) {
+    keySources[k] = userPath;
+  }
 
   try {
     const configSecretsPath = await config.getSecretsPath();
     if (!configSecretsPath) {
-      return helpers.userOrNull();
+      return { merged: helpers.userOrNull(), keySources };
     }
-    return await mergeFromConfiguredSecretsPath(configSecretsPath, userSecrets, helpers);
+    const merged = await mergeFromConfiguredSecretsPath(configSecretsPath, userSecrets, helpers, keySources);
+    return { merged, keySources };
   } catch (error) {
     if (error.message && error.message.startsWith('Failed to load secrets file')) {
       throw error;
     }
-    return null;
-  }
-}
-
-function collectBuilderSecretsYamlPaths() {
-  const projectRoot = pathsUtil.getProjectRoot();
-  const candidates = [];
-  if (projectRoot) {
-    candidates.push(path.join(projectRoot, 'builder', 'secrets.local.yaml'));
-  }
-  try {
-    const alt = path.join(pathsUtil.getBuilderRoot(), 'secrets.local.yaml');
-    if (!candidates.length || path.resolve(candidates[0]) !== path.resolve(alt)) {
-      candidates.push(alt);
-    }
-  } catch {
-    /* ignore */
-  }
-  return candidates;
-}
-
-function mergeBuilderSecretsLocalFiles(merged) {
-  try {
-    const seen = new Set();
-    let out = merged;
-    for (const builderPath of collectBuilderSecretsYamlPaths()) {
-      if (!builderPath || seen.has(path.resolve(builderPath))) {
-        continue;
-      }
-      seen.add(path.resolve(builderPath));
-      if (fs.existsSync(builderPath)) {
-        ensureSecureFilePermissions(builderPath);
-        const builderSecrets = mergeUserWithConfigFile(out || {}, builderPath);
-        if (builderSecrets) out = builderSecrets;
-      }
-    }
-    return out;
-  } catch {
-    return merged;
-  }
-}
-
-/**
- * Merge each `cwd/.aifabrix/secrets.local.yaml` found walking up to filesystem root.
- * Later files only fill keys missing or empty on the merged object (same as shared merge).
- * Skips the primary user file path when it appears on the walk (already loaded in merge chain).
- *
- * @param {Object|null|undefined} merged - Current secrets map
- * @returns {Object}
- */
-function mergeAncestorAifabrixSecretsLocalFiles(merged) {
-  try {
-    const primaryUser = path.resolve(pathsUtil.getPrimaryUserSecretsLocalPath());
-    let out = merged && typeof merged === 'object' ? merged : {};
-    const ancestorPaths = collectAncestorAifabrixSecretsLocalYamlPaths(process.cwd(), fs.existsSync);
-    for (const secretsPath of ancestorPaths) {
-      if (path.resolve(secretsPath) === primaryUser) {
-        continue;
-      }
-      ensureSecureFilePermissions(secretsPath);
-      const next = mergeUserWithConfigFile(out, secretsPath);
-      if (next) out = next;
-    }
-    return out;
-  } catch {
-    return merged && typeof merged === 'object' ? merged : {};
+    return { merged: null, keySources };
   }
 }
 
 async function loadSecretsWithFallbacks() {
-  let merged = await loadMergedConfigAndUserSecrets();
+  const mergedResult = await loadMergedConfigAndUserSecrets();
+  let merged = mergedResult.merged;
+  const keySources = mergedResult.keySources;
   if (!merged || Object.keys(merged).length === 0) {
     merged = loadPrimaryUserSecrets();
-    if (Object.keys(merged).length === 0) {
-      merged = loadUserSecrets();
+    const userPath = pathsUtil.getPrimaryUserSecretsLocalPath();
+    for (const k of Object.keys(merged || {})) {
+      keySources[k] = userPath;
     }
-    merged = await applyCanonicalSecretsOverride(merged);
+    merged = await applyCanonicalSecretsOverride(merged || {}, keySources);
   }
-  merged = mergeAncestorAifabrixSecretsLocalFiles(merged);
-  merged = mergeBuilderSecretsLocalFiles(merged);
-  if (Object.keys(merged).length === 0) {
+  const configuredShared = await config.getSecretsPath();
+  if ((!merged || Object.keys(merged).length === 0) && !configuredShared) {
     merged = loadDefaultSecrets();
+    const defaultPath = path.join(pathsUtil.getAifabrixHome(), 'secrets.yaml');
+    for (const k of Object.keys(merged || {})) {
+      keySources[k] = defaultPath;
+    }
   }
-  return merged;
+  if (!merged || Object.keys(merged).length === 0) {
+    return { merged: {}, keySources };
+  }
+  return { merged, keySources };
 }
 
 /**
@@ -232,14 +234,16 @@ async function loadSecrets(secretsPath, _appName) {
     if (!explicitSecrets || typeof explicitSecrets !== 'object') {
       throw new Error(`Invalid secrets file format: ${resolvedPath}`);
     }
-    return await decryptSecretsObject(explicitSecrets);
+    return await decryptSecretsObject(explicitSecrets, { defaultSourceLabel: resolvedPath });
   }
-  let mergedSecrets = await loadSecretsWithFallbacks();
+  let { merged: mergedSecrets, keySources } = await loadSecretsWithFallbacks();
   if (!mergedSecrets || Object.keys(mergedSecrets).length === 0) {
     ensurePrimaryUserSecretsFileExists();
-    mergedSecrets = await loadSecretsWithFallbacks();
+    const again = await loadSecretsWithFallbacks();
+    mergedSecrets = again.merged;
+    keySources = again.keySources;
   }
-  return await decryptSecretsObject(mergedSecrets || {});
+  return await decryptSecretsObject(mergedSecrets || {}, { keySources });
 }
 
 module.exports = {

package/lib/datasource/agent-trust-debug-log.js

@@ -0,0 +1,45 @@
+/**
+ * @fileoverview Debug log writer for agent trust CLI runs (plan 143).
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const path = require('path');
+const logger = require('../utils/logger');
+const { getIntegrationPath } = require('../utils/paths');
+const { writeTestLog } = require('../utils/test-log-writer');
+
+/**
+ * @async
+ * @param {string} appKey - Integration folder key
+ * @param {string} datasourceKey
+ * @param {Object} payload
+ * @returns {Promise<string|null>} Log path or null when skipped
+ */
+async function writeTrustDebugLog(appKey, datasourceKey, payload) {
+  const logPath = await writeTestLog(
+    appKey,
+    payload,
+    `test-trust-${datasourceKey}`,
+    path.dirname(getIntegrationPath(appKey))
+  );
+  return logPath;
+}
+
+/**
+ * @async
+ * @param {string} appKey
+ * @param {string} datasourceKey
+ * @param {Object} payload
+ */
+async function writeTrustDebugLogAndPrint(appKey, datasourceKey, payload) {
+  const logPath = await writeTrustDebugLog(appKey, datasourceKey, payload);
+  logger.log(chalk.gray(`  Debug log: ${logPath}`));
+  return logPath;
+}
+
+module.exports = {
+  writeTrustDebugLog,
+  writeTrustDebugLogAndPrint
+};

package/lib/datasource/agent-trust-fetch.js

@@ -0,0 +1,115 @@
+/**
+ * @fileoverview Dataplane fetch paths for agent trust runs (POST validate / GET latest).
+ */
+
+'use strict';
+
+const {
+  runAgentMetadataValidation,
+  getLatestAgentMetadataValidation
+} = require('../api/agent-metadata-validation.api');
+const { parseTrustTimeoutMs } = require('./agent-trust-timeout');
+const { isAgentTrustMockEnabled, buildMockTrustRun } = require('./agent-trust-mock');
+const { mapRunResponseToTrustRun, mapLatestResultToTrustRun } = require('./agent-trust-map');
+const {
+  runWithAgentTrustWaitSpinner,
+  logAgentTrustWaitHintOnce
+} = require('../utils/agent-trust-wait-ui');
+
+function unwrapApiData(response) {
+  if (response && response.data !== undefined) return response.data;
+  return response;
+}
+
+/**
+ * @param {Object} options
+ * @returns {boolean}
+ */
+function shouldPreferLatestRead(options = {}) {
+  if (options.revalidate === true) return false;
+  return options.summary === true;
+}
+
+/**
+ * @param {Error} err
+ * @returns {boolean}
+ */
+function isLatestNotFoundError(err) {
+  const code = err && (err.statusCode || err.status);
+  if (code === 404) return true;
+  const msg = err && err.message ? String(err.message) : '';
+  return /no agent metadata validation/i.test(msg);
+}
+
+/**
+ * @async
+ * @param {Object} params
+ * @returns {Promise<Object>}
+ */
+async function postValidateTrustRun(params) {
+  const { dataplaneUrl, datasourceKey, systemKey, authConfig, body, options } = params;
+  const timeoutMs = parseTrustTimeoutMs(options);
+  logAgentTrustWaitHintOnce(datasourceKey, timeoutMs);
+  const raw = await runWithAgentTrustWaitSpinner(
+    () =>
+      runAgentMetadataValidation(dataplaneUrl, datasourceKey, authConfig, body, { timeoutMs }),
+    { datasourceKey, timeoutMs }
+  );
+  return mapRunResponseToTrustRun({
+    datasourceKey,
+    systemKey,
+    runResponse: unwrapApiData(raw)
+  });
+}
+
+/**
+ * @async
+ * @param {Object} params
+ * @returns {Promise<Object>}
+ */
+async function getLatestTrustRun(params) {
+  const { dataplaneUrl, datasourceKey, systemKey, authConfig, options } = params;
+  const timeoutMs = parseTrustTimeoutMs(options);
+  const raw = await getLatestAgentMetadataValidation(dataplaneUrl, datasourceKey, authConfig, {
+    timeoutMs
+  });
+  return mapLatestResultToTrustRun({
+    datasourceKey,
+    systemKey,
+    latestResult: unwrapApiData(raw)
+  });
+}
+
+/**
+ * @async
+ * @param {Object} params
+ * @returns {Promise<Object>}
+ */
+async function fetchTrustRunFromDataplane(params) {
+  const { datasourceKey, systemKey, dataplaneUrl, authConfig, options } = params;
+  if (isAgentTrustMockEnabled()) {
+    return buildMockTrustRun(datasourceKey, systemKey);
+  }
+
+  const body = { forceRevalidate: options.revalidate === true };
+  if (options.peerDatasourceConfigs && typeof options.peerDatasourceConfigs === 'object') {
+    body.peerDatasourceConfigs = options.peerDatasourceConfigs;
+  }
+
+  if (!shouldPreferLatestRead(options)) {
+    return postValidateTrustRun({ dataplaneUrl, datasourceKey, systemKey, authConfig, body, options });
+  }
+
+  try {
+    return await getLatestTrustRun({ dataplaneUrl, datasourceKey, systemKey, authConfig, options });
+  } catch (err) {
+    if (!isLatestNotFoundError(err)) throw err;
+    return postValidateTrustRun({ dataplaneUrl, datasourceKey, systemKey, authConfig, body, options });
+  }
+}
+
+module.exports = {
+  shouldPreferLatestRead,
+  fetchTrustRunFromDataplane,
+  isLatestNotFoundError
+};

package/lib/datasource/agent-trust-map.js

@@ -0,0 +1,101 @@
+/**
+ * @fileoverview Map dataplane agent metadata validation API payloads to CLI trust runs.
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+/**
+ * @param {string} trustDecision
+ * @returns {'ok'|'warn'|'fail'}
+ */
+function trustDecisionToRowStatus(trustDecision) {
+  const td = String(trustDecision || '').trim();
+  if (td === 'trusted') return 'ok';
+  if (td === 'usableWithWarnings') return 'warn';
+  return 'fail';
+}
+
+/**
+ * @param {Object} result - AgentMetadataValidationResult from dataplane
+ * @returns {string[]}
+ */
+function highLevelWarningsFromResult(result) {
+  if (!result || !Array.isArray(result.findings)) return [];
+  return result.findings
+    .filter(f => f && (f.severity === 'warning' || f.severity === 'error'))
+    .slice(0, 8)
+    .map(f => {
+      const code = f.code ? String(f.code) : 'FINDING';
+      const msg = f.message ? String(f.message) : '';
+      return msg ? `${code} — ${msg}` : code;
+    });
+}
+
+/**
+ * @param {Object} params
+ * @param {string} params.datasourceKey
+ * @param {string} params.systemKey
+ * @param {Object} params.runResponse - POST run response body
+ * @returns {Object} AgentTrustRun-shaped object for CLI display/exit
+ */
+function mapRunResponseToTrustRun({ datasourceKey, systemKey, runResponse }) {
+  const body = runResponse && typeof runResponse === 'object' ? runResponse : {};
+  const result = body.result && typeof body.result === 'object' ? body.result : {};
+  const trustDecision = result.trustDecision || 'pending';
+  return {
+    datasourceKey,
+    systemKey,
+    status: trustDecisionToRowStatus(trustDecision),
+    trustDecision,
+    validationStatus: result.status || 'pending',
+    confidence: typeof result.confidence === 'number' ? result.confidence : 0,
+    summary: result.summary || '',
+    validatedAt: result.validatedAt || '',
+    inputHash: result.inputHash || '',
+    contractVersion: result.contractVersion || '',
+    cacheHit: body.reused === true,
+    highLevelWarnings: highLevelWarningsFromResult(result),
+    findings: Array.isArray(result.findings) ? result.findings : [],
+    observedBusinessModel: result.observedBusinessModel || null,
+    runId: body.id || null
+  };
+}
+
+/**
+ * @param {Object} params
+ * @param {string} params.datasourceKey
+ * @param {string} params.systemKey
+ * @param {Object} params.latestResult - GET /agent-validation body
+ * @returns {Object}
+ */
+function mapLatestResultToTrustRun({ datasourceKey, systemKey, latestResult }) {
+  const result = latestResult && typeof latestResult === 'object' ? latestResult : {};
+  const trustDecision = result.trustDecision || 'pending';
+  return {
+    datasourceKey,
+    systemKey,
+    status: trustDecisionToRowStatus(trustDecision),
+    trustDecision,
+    validationStatus: result.status || 'pending',
+    confidence: typeof result.confidence === 'number' ? result.confidence : 0,
+    summary: result.summary || '',
+    validatedAt: result.validatedAt || '',
+    inputHash: result.inputHash || '',
+    contractVersion: result.contractVersion || '',
+    cacheHit: true,
+    highLevelWarnings: highLevelWarningsFromResult(result),
+    findings: Array.isArray(result.findings) ? result.findings : [],
+    observedBusinessModel: result.observedBusinessModel || null,
+    runId: null,
+    readLatest: true
+  };
+}
+
+module.exports = {
+  trustDecisionToRowStatus,
+  highLevelWarningsFromResult,
+  mapRunResponseToTrustRun,
+  mapLatestResultToTrustRun
+};

package/lib/datasource/agent-trust-mock.js

@@ -0,0 +1,44 @@
+/**
+ * @fileoverview Dev-only mock trust runs when AIFABRIX_AGENT_TRUST_MOCK=1 (plan 143).
+ * Not documented in user-facing CLI docs; for local CLI development without dataplane 404.5.
+ */
+
+'use strict';
+
+/**
+ * @returns {boolean}
+ */
+function isAgentTrustMockEnabled() {
+  return String(process.env.AIFABRIX_AGENT_TRUST_MOCK || '').trim() === '1';
+}
+
+/**
+ * @param {string} datasourceKey
+ * @param {string} systemKey
+ * @returns {Object}
+ */
+function buildMockTrustRun(datasourceKey, systemKey) {
+  return {
+    datasourceKey,
+    systemKey,
+    status: 'warn',
+    trustDecision: 'usableWithWarnings',
+    validationStatus: 'warning',
+    confidence: 0.72,
+    summary: 'Mock trust run (AIFABRIX_AGENT_TRUST_MOCK=1)',
+    validatedAt: new Date().toISOString(),
+    inputHash: 'mock-input-hash',
+    contractVersion: '1.0.0',
+    cacheHit: false,
+    highLevelWarnings: ['MOCK_TRUST — set AIFABRIX_AGENT_TRUST_MOCK=0 for live dataplane validation'],
+    findings: [],
+    observedBusinessModel: null,
+    runId: 'mock-run-id',
+    mock: true
+  };
+}
+
+module.exports = {
+  isAgentTrustMockEnabled,
+  buildMockTrustRun
+};