@aifabrix/builder 2.44.6 → 2.45.5

package/lib/utils/agent-trust-run-display.js

@@ -0,0 +1,231 @@
+/**
+ * @fileoverview TTY display for agent metadata trust runs (plan 143).
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('./logger');
+const { sectionTitle, headerKeyValue, metadata: metaGray } = require('./cli-test-layout-chalk');
+const { statusGlyph } = require('./datasource-test-run-display');
+const { trustDecisionToRowStatus } = require('../datasource/agent-trust-map');
+
+const SEP = '────────────────────────────────';
+
+/** @type {{ datasource: number, trust: number, conf: number, status: number, cache: number }} */
+const TRUST_TABLE_COLS = {
+  datasource: 30,
+  trust: 24,
+  conf: 6,
+  status: 8,
+  cache: 8
+};
+
+function trustGlyph(trustDecision) {
+  return statusGlyph(trustDecisionToRowStatus(trustDecision));
+}
+
+function publishGateLine(trustDecision, strict) {
+  if (trustDecision === 'notTrusted') return chalk.red('blocked (trustDecision notTrusted)');
+  if (strict) {
+    return trustDecision === 'trusted'
+      ? chalk.green('allowed (strict: trusted)')
+      : chalk.yellow('blocked (strict requires trusted)');
+  }
+  return chalk.green('allowed (warning-only); use --strict to require trusted');
+}
+
+function logTrustHeader(run, env) {
+  logger.log(SEP);
+  logger.log(sectionTitle(`Semantic trust — ${run.datasourceKey}`));
+  logger.log(headerKeyValue('Environment:', env));
+  logger.log(headerKeyValue('System:', run.systemKey || '—'));
+  logger.log(SEP);
+  logger.log(metaGray('  Layer checked: business metadata (404.5 agent validation)'));
+  logger.log(metaGray('  Not checked here: vendor connectivity, sync, record counts (use test-e2e)'));
+  logger.log('');
+}
+
+function logTrustSummaryBlock(run) {
+  const confPct = Math.round((run.confidence || 0) * 100);
+  logger.log(
+    headerKeyValue(
+      'Trust:',
+      `${trustGlyph(run.trustDecision)} ${run.trustDecision} · confidence ${confPct}% · ${run.validationStatus}`
+    )
+  );
+  if (!run.validatedAt) return;
+  const hashShort = run.inputHash ? `${String(run.inputHash).slice(0, 8)}…` : '—';
+  logger.log(
+    metaGray(
+      `  Validated: ${run.validatedAt} · inputHash ${hashShort} · cache: ${run.cacheHit ? 'hit' : 'miss'}`
+    )
+  );
+}
+
+function logTrustWarningsAndFindings(run, opts) {
+  if (run.summary) {
+    logger.log('');
+    logger.log(chalk.white('  Summary'));
+    logger.log(`  ${run.summary}`);
+  }
+  const warnings = Array.isArray(run.highLevelWarnings) ? run.highLevelWarnings : [];
+  const findings = Array.isArray(run.findings) ? run.findings : [];
+  const showVerboseFindings = opts.verbose === true && findings.length > 0;
+  if (warnings.length && !showVerboseFindings) {
+    logger.log('');
+    logger.log(chalk.yellow('  Warnings (high level)'));
+    warnings.forEach(w => logger.log(`  • ${w}`));
+  }
+  if (!showVerboseFindings) return;
+  logger.log('');
+  logger.log(chalk.white('  Findings (verbose, max 10)'));
+  findings.slice(0, 10).forEach(f => {
+    logger.log(`  • [${f.severity || 'info'}] ${f.code || 'FINDING'}: ${f.message || ''}`);
+  });
+}
+
+function logTrustFooter(run, opts) {
+  logger.log('');
+  logger.log(metaGray('  ── Integration reality (informative) ──'));
+  logger.log(metaGray(`  Local manifest:  ${opts.noSync ? 'not uploaded (--no-sync)' : 'uploaded before run'}`));
+  logger.log(metaGray(`  Publish gate:    ${publishGateLine(run.trustDecision, opts.strict === true)}`));
+  logger.log(SEP);
+}
+
+function displayAgentTrustRunTTY(run, opts = {}) {
+  if (!run || opts.json === true) return;
+  const env = opts.environment ? String(opts.environment) : 'dev';
+  logTrustHeader(run, env);
+  logTrustSummaryBlock(run);
+  logTrustWarningsAndFindings(run, opts);
+  logTrustFooter(run, opts);
+}
+
+function trustCacheLabel(trustRun) {
+  if (!trustRun || typeof trustRun !== 'object') return '—';
+  if (trustRun.readLatest === true) return 'latest';
+  if (trustRun.cacheHit === true) return 'hit';
+  if (trustRun.cacheHit === false) return 'miss';
+  return '—';
+}
+
+/**
+ * @param {boolean} showCache
+ * @returns {number}
+ */
+function trustTableLineWidth(showCache) {
+  const { datasource, trust, conf, status, cache } = TRUST_TABLE_COLS;
+  let w = 2 + datasource + 1 + trust + 1 + conf + 1 + status;
+  if (showCache) w += 1 + cache;
+  return w;
+}
+
+/**
+ * @param {string} key
+ * @returns {string}
+ */
+function formatTrustTableDatasourceCol(key) {
+  return String(key || '').padEnd(TRUST_TABLE_COLS.datasource).slice(0, TRUST_TABLE_COLS.datasource);
+}
+
+/**
+ * @param {Object|null|undefined} tr
+ * @returns {string}
+ */
+function formatTrustTableTrustCol(tr) {
+  const w = TRUST_TABLE_COLS.trust;
+  if (!tr || !tr.trustDecision) return '—'.padEnd(w);
+  const decision = String(tr.trustDecision);
+  const cell = `${trustGlyph(decision)} ${decision}`;
+  return cell.length > w ? cell.slice(0, w) : cell.padEnd(w);
+}
+
+/**
+ * @param {Object|null|undefined} tr
+ * @returns {string}
+ */
+function formatTrustTableConfCol(tr) {
+  const w = TRUST_TABLE_COLS.conf;
+  if (!tr || typeof tr.confidence !== 'number') return '—'.padStart(w);
+  return `${Math.round(tr.confidence * 100)}%`.padStart(w);
+}
+
+/**
+ * @param {Object|null|undefined} tr
+ * @param {Object} row
+ * @returns {string}
+ */
+function formatTrustTableStatusCol(tr, row) {
+  const w = TRUST_TABLE_COLS.status;
+  const raw = tr ? String(tr.validationStatus || '—') : row.error || 'fail';
+  return raw.padEnd(w).slice(0, w);
+}
+
+/**
+ * @param {boolean} showCache
+ */
+function logSystemTrustTableHeader(showCache) {
+  const { datasource, trust, conf, status, cache } = TRUST_TABLE_COLS;
+  let header = `  ${'Datasource'.padEnd(datasource)} ${'Trust'.padEnd(trust)} ${'Conf.'.padStart(conf)} ${'Status'.padEnd(status)}`;
+  if (showCache) header += ` ${'Cache'.padEnd(cache)}`;
+  logger.log(chalk.white(header));
+  logger.log(chalk.gray(`  ${'─'.repeat(trustTableLineWidth(showCache))}`));
+}
+
+/**
+ * @param {Object} row
+ * @param {boolean} showCache
+ * @returns {string}
+ */
+function formatTrustTableRow(row, showCache) {
+  const tr = row.trustRun;
+  let line = `  ${formatTrustTableDatasourceCol(row.key)} ${formatTrustTableTrustCol(tr)} ${formatTrustTableConfCol(tr)} ${formatTrustTableStatusCol(tr, row)}`;
+  if (showCache) {
+    line += ` ${trustCacheLabel(tr).padEnd(TRUST_TABLE_COLS.cache).slice(0, TRUST_TABLE_COLS.cache)}`;
+  }
+  return line;
+}
+
+function logSystemTrustTable(list, opts = {}) {
+  const showCache = opts.showCache === true;
+  logSystemTrustTableHeader(showCache);
+  for (const row of list) {
+    logger.log(formatTrustTableRow(row, showCache));
+  }
+}
+
+function displaySystemTrustRollupTTY(systemKey, rows, opts = {}) {
+  if (opts.json === true) return;
+  const list = Array.isArray(rows) ? rows : [];
+  logger.log(SEP);
+  logger.log(sectionTitle(`Semantic trust — system ${systemKey} (${list.length} datasources)`));
+  const { deriveSystemStatus } = require('./external-system-system-test-tty');
+  const worst = deriveSystemStatus(
+    list.map(r => ({
+      success: r.success !== false,
+      datasourceTestRun: {
+        status: r.trustRun ? trustDecisionToRowStatus(r.trustRun.trustDecision) : 'fail'
+      }
+    }))
+  );
+  logger.log(
+    headerKeyValue('System trust:', `${statusGlyph(worst)} ${worst} (worst-of rollup)`)
+  );
+  logger.log('');
+  logSystemTrustTable(list, opts);
+  logger.log('');
+  logger.log(metaGray('  ── What this run proved ──'));
+  logger.log(metaGray(`  ✔ Semantic metadata reviewed for ${list.length} datasource(s) on dataplane`));
+  logger.log(metaGray('  ✖ Did not call external APIs or run CIP (not E2E)'));
+  logger.log(SEP);
+}
+
+module.exports = {
+  displayAgentTrustRunTTY,
+  displaySystemTrustRollupTTY,
+  formatTrustTableRow,
+  TRUST_TABLE_COLS
+};

package/lib/utils/agent-trust-run-exit.js

@@ -0,0 +1,59 @@
+/**
+ * @fileoverview Exit codes for agent metadata trust CLI runs (plan 143).
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { trustDecisionToRowStatus } = require('../datasource/agent-trust-map');
+const { deriveSystemStatus } = require('./external-system-system-test-tty');
+const { computeExitCodeFromDatasourceTestRun } = require('./datasource-test-run-exit');
+
+/**
+ * @param {Object|null|undefined} run
+ * @param {Object} [opts]
+ * @param {boolean} [opts.warningsAsErrors]
+ * @param {boolean} [opts.strict]
+ * @returns {number}
+ */
+function computeExitCodeFromTrustRun(run, opts = {}) {
+  if (!run || typeof run !== 'object') return 3;
+  const td = run.trustDecision;
+  if (run.validationStatus === 'failed' || td === 'notTrusted') return 1;
+  if (opts.strict === true && td !== 'trusted') return 1;
+  if (opts.warningsAsErrors === true && td === 'usableWithWarnings') return 1;
+  if (td === 'trusted' || td === 'usableWithWarnings' || td === 'pending') return 0;
+  return 3;
+}
+
+/**
+ * @param {Array<{ success?: boolean, trustRun?: Object|null }>} rows
+ * @param {Object} [opts]
+ * @returns {number}
+ */
+function computeSystemExitCodeFromTrustRows(rows, opts = {}) {
+  const list = Array.isArray(rows) ? rows : [];
+  let worst = 0;
+  for (const row of list) {
+    const code = computeExitCodeFromTrustRun(row && row.trustRun, opts);
+    if (code === 3) return 3;
+    if (code > worst) worst = code;
+  }
+  if (worst > 0) return worst;
+  const synthetic = list.map(r => {
+    const tr = r && r.trustRun;
+    const st = tr ? trustDecisionToRowStatus(tr.trustDecision) : 'fail';
+    return { success: st !== 'fail', datasourceTestRun: { status: st } };
+  });
+  const rollup = deriveSystemStatus(synthetic);
+  return computeExitCodeFromDatasourceTestRun(
+    { status: rollup },
+    { warningsAsErrors: opts.warningsAsErrors === true }
+  );
+}
+
+module.exports = {
+  computeExitCodeFromTrustRun,
+  computeSystemExitCodeFromTrustRows
+};

package/lib/utils/agent-trust-wait-ui.js

@@ -0,0 +1,94 @@
+/**
+ * TTY ora spinner for slow agent metadata validation POST (non-cached path).
+ *
+ * @fileoverview Agent trust wait presentation (aligned with validation-poll-ui)
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('./logger');
+
+function shouldUseAgentTrustWaitSpinner() {
+  return Boolean(process && process.stdout && process.stdout.isTTY);
+}
+
+/**
+ * @param {string} [datasourceKey]
+ * @param {number} deadlineMs
+ * @returns {string}
+ */
+function buildAgentTrustWaitSpinnerText(datasourceKey, deadlineMs) {
+  const remainingSec = Math.max(0, Math.ceil((deadlineMs - Date.now()) / 1000));
+  const key =
+    datasourceKey && String(datasourceKey).trim() ? String(datasourceKey).trim() : 'datasource';
+  return `Waiting for semantic trust validation… ${key} (~${remainingSec}s left)`;
+}
+
+/**
+ * Run a blocking validate POST behind a TTY spinner (skipped when not a TTY).
+ *
+ * @async
+ * @param {Function} work - Zero-arg async function performing the HTTP call
+ * @param {Object} opts
+ * @param {string} [opts.datasourceKey]
+ * @param {number} opts.timeoutMs
+ * @returns {Promise<*>}
+ */
+async function runWithAgentTrustWaitSpinner(work, opts = {}) {
+  const timeoutMs =
+    Number.isFinite(opts.timeoutMs) && opts.timeoutMs > 0 ? opts.timeoutMs : 120000;
+  const deadlineMs = Date.now() + timeoutMs;
+  const datasourceKey = opts.datasourceKey;
+
+  if (!shouldUseAgentTrustWaitSpinner()) {
+    return work();
+  }
+
+  const ora = require('ora');
+  const spinner = ora({
+    text: buildAgentTrustWaitSpinnerText(datasourceKey, deadlineMs),
+    spinner: 'dots'
+  }).start();
+
+  const tick = setInterval(() => {
+    spinner.text = buildAgentTrustWaitSpinnerText(datasourceKey, deadlineMs);
+  }, 1000);
+
+  try {
+    return await work();
+  } finally {
+    clearInterval(tick);
+    spinner.stop();
+  }
+}
+
+const NON_TTY_LOG_MS = 5000;
+
+/**
+ * Optional one-line hint on non-TTY before a slow validate (throttled by caller usage).
+ *
+ * @param {string} [datasourceKey]
+ * @param {number} timeoutMs
+ */
+function logAgentTrustWaitHintOnce(datasourceKey, timeoutMs) {
+  if (shouldUseAgentTrustWaitSpinner()) return;
+  const budgetSec = Math.max(1, Math.ceil(timeoutMs / 1000));
+  const key =
+    datasourceKey && String(datasourceKey).trim() ? String(datasourceKey).trim() : 'datasource';
+  logger.log(
+    chalk.gray(
+      `Waiting for semantic trust validation… ${key} (may take up to ~${budgetSec}s; not cached)`
+    )
+  );
+}
+
+module.exports = {
+  shouldUseAgentTrustWaitSpinner,
+  buildAgentTrustWaitSpinnerText,
+  runWithAgentTrustWaitSpinner,
+  logAgentTrustWaitHintOnce,
+  NON_TTY_LOG_MS
+};

package/lib/utils/app-config-resolver.js

@@ -12,7 +12,28 @@
 'use strict';
 
 const path = require('path');
-const fs = require('fs');
+const defaultFs = require('fs');
+const { nodeFs } = require('../internal/node-fs');
+
+const realFs = nodeFs();
+
+/**
+ * Prefer real disk when `fs` is not mocked (avoids `jest.mock('fs')` bleed in other suites).
+ * Use `require('fs')` when Jest replaced it so tests with virtual file stores still work.
+ *
+ * @returns {Pick<import('fs'), 'existsSync'|'renameSync'>}
+ */
+function getResolverFs() {
+  if (
+    typeof jest !== 'undefined' &&
+    defaultFs.existsSync &&
+    typeof jest.isMockFunction === 'function' &&
+    jest.isMockFunction(defaultFs.existsSync)
+  ) {
+    return defaultFs;
+  }
+  return realFs;
+}
 
 /**
  * Resolves path to application config file (application.yaml, application.json, or legacy variables.yaml).
@@ -23,6 +44,7 @@ const fs = require('fs');
  * @throws {Error} If no config file found
  */
 function resolveApplicationConfigPath(appPath) {
+  const fs = getResolverFs();
   if (!appPath || typeof appPath !== 'string') {
     throw new Error('App path is required and must be a string');
   }
@@ -59,6 +81,7 @@ const RBAC_NAMES = ['rbac.yaml', 'rbac.yml', 'rbac.json'];
  * @returns {string|null} Absolute path to RBAC file, or null if none exist
  */
 function resolveRbacPath(appPath) {
+  const fs = getResolverFs();
   if (!appPath || typeof appPath !== 'string') {
     throw new Error('App path is required and must be a string');
   }

package/lib/utils/applications-config-defaults.js

@@ -0,0 +1,206 @@
+/**
+ * User `applications` entries in config.yaml (read by `aifabrix resolve`, written by `aifabrix run` dev).
+ *
+ * @fileoverview Per-app reload and `proxy` (Traefik/public URL hints) in ~/.aifabrix/config.yaml
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const config = require('../core/config');
+
+/**
+ * Persist `applications.<appKey>.reload` from the last `aifabrix run` (dev only; CLI is source of truth).
+ *
+ * @async
+ * @param {string} appKey - Application key
+ * @param {boolean} reload - Same as passing `--reload` on run
+ * @returns {Promise<void>}
+ */
+async function persistApplicationReloadFlag(appKey, reload) {
+  if (!appKey || typeof appKey !== 'string') {
+    return;
+  }
+  const cfg = await config.getConfig();
+  if (!cfg.applications || typeof cfg.applications !== 'object') {
+    cfg.applications = {};
+  }
+  const prev = cfg.applications[appKey];
+  const nextEntry =
+    prev && typeof prev === 'object' && !Array.isArray(prev) ? { ...prev, reload: Boolean(reload) } : { reload: Boolean(reload) };
+  cfg.applications[appKey] = nextEntry;
+  await config.saveConfig(cfg);
+}
+
+/**
+ * True when `applications.<appKey>.reload` is explicitly **true** (bind-mount + hot reload for `aifabrix run`).
+ * Does **not** control other compose overrides (e.g. Python image `command` when the image lacks `uvicorn` on PATH).
+ *
+ * @param {Object|null|undefined} userConfig - Parsed config.yaml root
+ * @param {string} appKey - Application key (folder / app.key)
+ * @returns {boolean} True when `applications.<appKey>.reload` is explicitly true
+ */
+function isApplicationsReloadDefaultOn(userConfig, appKey) {
+  if (!userConfig || !appKey || typeof appKey !== 'string') {
+    return false;
+  }
+  const apps = userConfig.applications;
+  if (!apps || typeof apps !== 'object') {
+    return false;
+  }
+  const entry = apps[appKey];
+  if (!entry || typeof entry !== 'object') {
+    return false;
+  }
+  return entry.reload === true;
+}
+
+/**
+ * True when `remote-server` is a non-empty string (after trim).
+ *
+ * @param {string|null|undefined} remoteServer
+ * @returns {boolean}
+ */
+function isRemoteServerConfigured(remoteServer) {
+  return Boolean(remoteServer && String(remoteServer).trim());
+}
+
+/**
+ * Whether `build.envOutputPath` should be regenerated with the **local** profile (`generateEnvContent(..., 'local')`).
+ * **False** only when **both** `remote-server` is set and `applications.<appKey>.reload` is true — then the host file
+ * uses the same **docker**-flavor expansion as `builder/<app>/.env` (copy path). All other cases use **local**.
+ *
+ * @param {Object|null|undefined} userConfig - Parsed config.yaml root
+ * @param {string} appKey - Application key
+ * @param {string|null|undefined} remoteServer - `remote-server` value (or null)
+ * @returns {boolean}
+ */
+function isPreferLocalEnvOutputPath(userConfig, appKey, remoteServer) {
+  if (!isRemoteServerConfigured(remoteServer)) {
+    return true;
+  }
+  return !isApplicationsReloadDefaultOn(userConfig, appKey);
+}
+
+/**
+ * For `aifabrix resolve`: reads `remote-server` and returns {@link isPreferLocalEnvOutputPath}.
+ *
+ * @async
+ * @param {Object|null|undefined} userConfig
+ * @param {string} appKey
+ * @returns {Promise<boolean>}
+ */
+async function resolvePreferLocalEnvOutputPathFlag(userConfig, appKey) {
+  let remoteServer = null;
+  try {
+    const rs = await config.getRemoteServer();
+    if (rs && String(rs).trim()) {
+      remoteServer = String(rs).trim();
+    }
+  } catch {
+    remoteServer = null;
+  }
+  return isPreferLocalEnvOutputPath(userConfig, appKey, remoteServer);
+}
+
+/**
+ * Normalize YAML boolean-ish values.
+ * @param {unknown} v
+ * @returns {boolean|undefined} undefined if absent / not coercible
+ */
+function coerceTriStateBool(v) {
+  if (v === true || v === 'true' || v === 'yes' || v === 'on' || v === 1 || v === '1') {
+    return true;
+  }
+  if (v === false || v === 'false' || v === 'no' || v === 'off' || v === 0 || v === '0') {
+    return false;
+  }
+  return undefined;
+}
+
+/**
+ * Whether `aifabrix run` / resolve should use Traefik-style public URL hints for this app when infra allows.
+ * Default **false** when unset. Legacy `noProxy: true` ⇒ false; legacy `noProxy: false` with no `proxy` ⇒ true.
+ *
+ * @param {Object|null|undefined} userConfig - Parsed config.yaml root
+ * @param {string} appKey - Application key
+ * @returns {boolean}
+ */
+function getApplicationsRunProxyHint(userConfig, appKey) {
+  if (!userConfig || !appKey || typeof appKey !== 'string') {
+    return false;
+  }
+  const apps = userConfig.applications;
+  if (!apps || typeof apps !== 'object') {
+    return false;
+  }
+  const entry = apps[appKey];
+  if (!entry || typeof entry !== 'object') {
+    return false;
+  }
+  const proxyCoerced = coerceTriStateBool(entry.proxy);
+  if (proxyCoerced !== undefined) {
+    return proxyCoerced;
+  }
+  const legacyNo = coerceTriStateBool(entry.noProxy);
+  if (legacyNo === true) {
+    return false;
+  }
+  if (legacyNo === false) {
+    return true;
+  }
+  return false;
+}
+
+/**
+ * Persist `applications.<appKey>.proxy` from each `aifabrix run` (same pattern as `reload` for dev-only reload flag).
+ * `proxy: true` means use Traefik/front-door URL hints when infra + that app's `application.yaml` allow; `false` means docker `url://` **public** bases for **that app** use localhost + published port. During `resolve`/`run`, each `url://` token uses the **target** app's `applications.<targetKey>.proxy`, not only the app whose `env.template` is being expanded.
+ * Removes legacy `noProxy` on the same entry when present.
+ *
+ * @async
+ * @param {string} appKey - Application key
+ * @param {boolean} proxyEnabled - Same as a normal `aifabrix run` with proxy hints on (`!isRunCliNoProxy(options)`)
+ * @returns {Promise<void>}
+ */
+async function persistApplicationRunProxyFlag(appKey, proxyEnabled) {
+  if (!appKey || typeof appKey !== 'string') {
+    return;
+  }
+  const cfg = await config.getConfig();
+  if (!cfg.applications || typeof cfg.applications !== 'object') {
+    cfg.applications = {};
+  }
+  const prev = cfg.applications[appKey];
+  const nextEntry =
+    prev && typeof prev === 'object' && !Array.isArray(prev)
+      ? { ...prev, proxy: Boolean(proxyEnabled) }
+      : { proxy: Boolean(proxyEnabled) };
+  if (Object.prototype.hasOwnProperty.call(nextEntry, 'noProxy')) {
+    delete nextEntry.noProxy;
+  }
+  cfg.applications[appKey] = nextEntry;
+  await config.saveConfig(cfg);
+}
+
+/**
+ * Whether declarative `url://*` expansion should treat Traefik as on (infra Traefik + per-app `proxy: true`).
+ *
+ * @param {Object|null|undefined} userConfig
+ * @param {string} appKey
+ * @returns {boolean}
+ */
+function isDeclarativeTraefikUrlsEnabled(userConfig, appKey) {
+  return Boolean(userConfig && userConfig.traefik === true) && getApplicationsRunProxyHint(userConfig, appKey);
+}
+
+module.exports = {
+  getApplicationsRunProxyHint,
+  isApplicationsReloadDefaultOn,
+  isDeclarativeTraefikUrlsEnabled,
+  isPreferLocalEnvOutputPath,
+  isRemoteServerConfigured,
+  persistApplicationRunProxyFlag,
+  persistApplicationReloadFlag,
+  resolvePreferLocalEnvOutputPathFlag
+};

package/lib/utils/auth-config-validator.js

@@ -8,7 +8,7 @@
  * @version 2.0.0
  */
 
-const { getControllerUrlFromLoggedInUser } = require('./controller-url');
+const { hasStoredDeviceTokenForController } = require('./controller-url');
 
 /**
  * Validate controller URL format
@@ -72,17 +72,7 @@ async function checkUserLoggedIn(controllerUrl) {
   if (!controllerUrl) {
     return false;
   }
-
-  const normalizedUrl = controllerUrl.trim().replace(/\/+$/, '');
-  const loggedInControllerUrl = await getControllerUrlFromLoggedInUser();
-
-  if (!loggedInControllerUrl) {
-    return false;
-  }
-
-  // Normalize both URLs for comparison
-  const normalizedLoggedIn = loggedInControllerUrl.trim().replace(/\/+$/, '');
-  return normalizedLoggedIn === normalizedUrl;
+  return hasStoredDeviceTokenForController(controllerUrl);
 }
 
 module.exports = {

package/lib/utils/bash-secret-env.js

@@ -41,7 +41,7 @@ function collectBashPrefixedEnv(secrets) {
 }
 
 /**
- * Overlay for `child_process` `env`: values from user + shared + ancestor `secrets.local.yaml`
+ * Overlay for `child_process` `env`: values from primary user `secrets.local.yaml` plus `aifabrix-secrets`
  * for every `BASH_*` key (merged via {@link secretsLoad.loadSecrets}).
  *
  * @param {string|null} [secretsPath] - Optional explicit secrets file (same as resolve)