@aifabrix/builder 2.45.5 → 2.46.0

package/lib/utils/postgres-platform-bootstrap.js

@@ -0,0 +1,199 @@
+/**
+ * Recreate platform Postgres databases and roles after setup "wipe data".
+ *
+ * Infra init scripts run only on first volume creation; dropping DBs in a
+ * running Postgres container requires explicit bootstrap before Keycloak/Miso start.
+ *
+ * @fileoverview Platform database bootstrap after postgres wipe
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const config = require('../core/config');
+const adminSecrets = require('../core/admin-secrets');
+const logger = require('./logger');
+const chalk = require('chalk');
+const { successGlyph } = require('./cli-test-layout-chalk');
+const { getPostgresContainerName } = require('./postgres-wipe');
+const dockerExec = require('./docker-exec');
+const { isSetupQuietOutput } = require('./setup-quiet-output');
+
+const SUPERUSER_ROLE = 'pgadmin';
+
+/** @type {{ dbName: string, secretKey: string }[]} */
+const PLATFORM_DATABASE_SLOTS = [
+  { dbName: 'keycloak', secretKey: 'databases-keycloak-0-passwordKeyVault' },
+  { dbName: 'miso', secretKey: 'databases-miso-controller-0-passwordKeyVault' },
+  { dbName: 'miso-logs', secretKey: 'databases-miso-controller-1-passwordKeyVault' },
+  { dbName: 'dataplane', secretKey: 'databases-dataplane-0-passwordKeyVault' },
+  { dbName: 'dataplane-vector', secretKey: 'databases-dataplane-1-passwordKeyVault' },
+  { dbName: 'dataplane-logs', secretKey: 'databases-dataplane-2-passwordKeyVault' },
+  { dbName: 'dataplane-records', secretKey: 'databases-dataplane-3-passwordKeyVault' }
+];
+
+/**
+ * @param {string} dbName
+ * @returns {string}
+ */
+function pgRoleName(dbName) {
+  return `${String(dbName).replace(/-/g, '_')}_user`;
+}
+
+/**
+ * @param {string} s
+ * @returns {string}
+ */
+function escapePgString(s) {
+  if (s === null || s === undefined || typeof s !== 'string') return '';
+  return s.replace(/'/g, '\'\'');
+}
+
+/**
+ * @param {string} urlOrPassword
+ * @returns {string|null}
+ */
+function extractPasswordFromUrlOrValue(urlOrPassword) {
+  if (typeof urlOrPassword !== 'string' || urlOrPassword.length === 0) return null;
+  if (!urlOrPassword.includes('://')) return urlOrPassword;
+  try {
+    const u = new URL(
+      urlOrPassword.replace(/\$\{DB_HOST\}/g, 'postgres').replace(/\$\{DB_PORT\}/g, '5432')
+    );
+    return u.password || null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Escape SQL for embedding in a double-quoted shell argument (-c "...").
+ * Bash expands `$` and `$$` (PID) inside double quotes; backslash-escape every `$`.
+ *
+ * @param {string} s
+ * @returns {string}
+ */
+function escapeShellDoubleQuoted(s) {
+  return s.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\$/g, '\\$');
+}
+
+/**
+ * @async
+ * @param {string} container
+ * @param {string} sql
+ * @param {string} adminPassword
+ * @returns {Promise<void>}
+ */
+async function runPsqlCommand(container, sql, adminPassword, database = 'postgres') {
+  const escapedSql = escapeShellDoubleQuoted(sql);
+  const cmd =
+    `docker exec -e PGPASSWORD -i ${container} psql -U ${SUPERUSER_ROLE} -d ${database} ` +
+    `-v ON_ERROR_STOP=1 -c "${escapedSql}"`;
+  await dockerExec.execWithDockerEnv(cmd, { env: { PGPASSWORD: adminPassword } });
+}
+
+/**
+ * @async
+ * @param {string} container
+ * @param {string} dbName
+ * @param {string} role
+ * @param {string} password
+ * @param {string} adminPassword
+ * @returns {Promise<void>}
+ */
+async function ensureRoleAndDatabase(container, dbName, role, password, adminPassword) {
+  if (!/^[A-Za-z_][A-Za-z0-9_-]*$/.test(dbName) || !/^[A-Za-z_][A-Za-z0-9_-]*$/.test(role)) {
+    throw new Error(`Unsafe database or role name: ${dbName} / ${role}`);
+  }
+  const pwd = escapePgString(password);
+  await runPsqlCommand(
+    container,
+    `DO $$ BEGIN IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = '${role}') THEN CREATE USER "${role}" WITH PASSWORD '${pwd}'; ELSE ALTER USER "${role}" WITH PASSWORD '${pwd}'; END IF; END $$;`,
+    adminPassword
+  );
+  const exists = await dockerExec.execWithDockerEnv(
+    `docker exec -e PGPASSWORD -i ${container} psql -U ${SUPERUSER_ROLE} -d postgres -tAc "SELECT 1 FROM pg_database WHERE datname = '${dbName}'"`,
+    { env: { PGPASSWORD: adminPassword } }
+  );
+  const hasDb = String((exists && exists.stdout) || '').trim() === '1';
+  if (!hasDb) {
+    await runPsqlCommand(
+      container,
+      `CREATE DATABASE "${dbName}" OWNER "${role}";`,
+      adminPassword
+    );
+  }
+  await runPsqlCommand(
+    container,
+    `GRANT ALL ON SCHEMA public TO "${role}"; ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO "${role}";`,
+    adminPassword,
+    dbName
+  );
+}
+
+/**
+ * @async
+ * @param {string} container
+ * @param {{ dbName: string, secretKey: string }} slot
+ * @param {Object} secrets
+ * @param {string} adminPassword
+ * @returns {Promise<string>}
+ */
+async function ensurePlatformDatabaseSlot(container, slot, secrets, adminPassword) {
+  const raw = secrets[slot.secretKey];
+  const password = extractPasswordFromUrlOrValue(raw);
+  if (!password || !password.trim()) {
+    throw new Error(
+      `Secret ${slot.secretKey} is missing or empty. Run "aifabrix up-infra" to ensure infra secrets.`
+    );
+  }
+  const role = pgRoleName(slot.dbName);
+  await ensureRoleAndDatabase(container, slot.dbName, role, password.trim(), adminPassword);
+  if (!isSetupQuietOutput()) {
+    logger.log(chalk.gray(` ${successGlyph()} Ensured database ${slot.dbName} (${role})`));
+  }
+  return slot.dbName;
+}
+
+/**
+ * @async
+ * @returns {Promise<{ container: string, adminPassword: string, secrets: Object }>}
+ */
+async function resolveBootstrapContext() {
+  const devId = await config.getDeveloperId();
+  const container = getPostgresContainerName(devId);
+  const admin = await adminSecrets.readAndDecryptAdminSecrets();
+  const adminPassword = admin && admin.POSTGRES_PASSWORD;
+  if (!adminPassword) {
+    throw new Error('POSTGRES_PASSWORD not found in admin-secrets.env. Run "aifabrix up-infra" first.');
+  }
+  const secretsEnsure = require('../core/secrets-ensure');
+  await secretsEnsure.ensureInfraSecrets();
+  const { loadSecrets } = require('../core/secrets');
+  const secrets = await loadSecrets(undefined);
+  return { container, adminPassword, secrets };
+}
+
+/**
+ * Recreate platform DB users and databases from resolved kv secrets.
+ *
+ * @async
+ * @returns {Promise<string[]>} database names ensured
+ */
+async function bootstrapPlatformPostgresDatabases() {
+  const { container, adminPassword, secrets } = await resolveBootstrapContext();
+  const ensured = [];
+  for (const slot of PLATFORM_DATABASE_SLOTS) {
+    ensured.push(await ensurePlatformDatabaseSlot(container, slot, secrets, adminPassword));
+  }
+  return ensured;
+}
+
+module.exports = {
+  PLATFORM_DATABASE_SLOTS,
+  bootstrapPlatformPostgresDatabases,
+  pgRoleName,
+  extractPasswordFromUrlOrValue,
+  escapeShellDoubleQuoted
+};

package/lib/utils/postgres-wipe.js

@@ -22,6 +22,7 @@ const dockerExec = require('./docker-exec');
 const logger = require('./logger');
 const chalk = require('chalk');
 const { successGlyph } = require('./cli-test-layout-chalk');
+const { isSetupQuietOutput } = require('./setup-quiet-output');
 
 /** Roles that must never be dropped (Postgres-managed predefined roles). */
 const PROTECTED_ROLES = new Set([
@@ -190,15 +191,21 @@ async function wipePostgresData() {
   }
 
   const databases = await listUserDatabases(container, password);
+  const quiet = isSetupQuietOutput();
+
   for (const dbName of databases) {
     await dropDatabase(container, dbName, password);
-    logger.log(chalk.gray(` ${successGlyph()} Dropped database ${dbName}`));
+    if (!quiet) {
+      logger.log(chalk.gray(` ${successGlyph()} Dropped database ${dbName}`));
+    }
   }
 
   const roles = await listDropableRoles(container, password);
   for (const role of roles) {
     await dropRole(container, role, password);
-    logger.log(chalk.gray(` ${successGlyph()} Dropped role ${role}`));
+    if (!quiet) {
+      logger.log(chalk.gray(` ${successGlyph()} Dropped role ${role}`));
+    }
   }
 
   return { databases, roles };

package/lib/utils/resolve-env-mode.js

@@ -0,0 +1,47 @@
+/**
+ * Chooses `local` vs `docker` for `generateEnvFile` / `resolve` (integration → local, no Docker rewrite).
+ *
+ * @fileoverview Resolve environment mode for env generation
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const path = require('path');
+
+/** Platform builder apps that run in Docker and need docker host/port transforms on resolve. */
+const PLATFORM_DOCKER_APP_KEYS = new Set(['keycloak', 'miso-controller', 'dataplane']);
+
+/**
+ * @param {string} appPath - Resolved app directory from getResolveAppPath
+ * @returns {boolean}
+ */
+function isIntegrationAppPath(appPath) {
+  if (!appPath || typeof appPath !== 'string') return false;
+  const normalized = path.resolve(appPath);
+  const marker = `${path.sep}integration${path.sep}`;
+  return normalized.includes(marker);
+}
+
+/**
+ * @param {string} appPath - Resolved application directory
+ * @param {string} [appName] - App or system key
+ * @returns {'local'|'docker'}
+ */
+function resolveGenerateEnvEnvironment(appPath, appName) {
+  if (isIntegrationAppPath(appPath)) {
+    return 'local';
+  }
+  const key = String(appName || '').trim().toLowerCase();
+  if (PLATFORM_DOCKER_APP_KEYS.has(key)) {
+    return 'docker';
+  }
+  return 'docker';
+}
+
+module.exports = {
+  PLATFORM_DOCKER_APP_KEYS,
+  isIntegrationAppPath,
+  resolveGenerateEnvEnvironment
+};

package/lib/utils/secrets-generator.js

@@ -77,42 +77,44 @@ function loadYamlTolerantOfDuplicateKeys(content) {
 }
 
 /**
- * Skips commented or empty lines when scanning env.template
- * @param {string} line - Single line
+ * True when secrets map already has a non-empty value for a kv path (flat or nested).
+ * @param {Object} secrets
+ * @param {string} pathStr - Path after kv:// (e.g. hubspot-demo/token)
  * @returns {boolean}
  */
-function isCommentOrEmptyLine(line) {
-  const t = line.trim();
-  return t === '' || t.startsWith('#');
+function secretPathExistsInStore(secrets, pathStr) {
+  if (!secrets || typeof secrets !== 'object' || !pathStr) {
+    return false;
+  }
+  const direct = secrets[pathStr];
+  if (direct !== undefined && direct !== null && String(direct).trim() !== '') {
+    return true;
+  }
+  if (!pathStr.includes('/')) {
+    return false;
+  }
+  let current = secrets;
+  for (const segment of pathStr.split('/')) {
+    if (current === null || current === undefined || typeof current !== 'object' || !(segment in current)) {
+      return false;
+    }
+    current = current[segment];
+  }
+  return current !== undefined && current !== null && String(current).trim() !== '';
 }
 
 /**
- * Finds missing secret keys from template (skips commented and empty lines)
+ * Finds missing secret keys from template (skips commented and empty lines).
+ * Uses full kv:// paths (e.g. hubspot-demo/token), aligned with collectMissingSecrets.
  * @function findMissingSecretKeys
  * @param {string} envTemplate - Environment template content
  * @param {Object} existingSecrets - Existing secrets object
  * @returns {string[]} Array of missing secret keys
  */
 function findMissingSecretKeys(envTemplate, existingSecrets) {
-  const kvPattern = /kv:\/\/([a-zA-Z0-9-_]+)/g;
-  const missingKeys = [];
-  const seenKeys = new Set();
-  const lines = envTemplate.split('\n');
-
-  for (const line of lines) {
-    if (isCommentOrEmptyLine(line)) continue;
-    let match;
-    kvPattern.lastIndex = 0;
-    while ((match = kvPattern.exec(line)) !== null) {
-      const secretKey = match[1];
-      if (!seenKeys.has(secretKey) && !(secretKey in existingSecrets)) {
-        missingKeys.push(secretKey);
-        seenKeys.add(secretKey);
-      }
-    }
-  }
-
-  return missingKeys;
+  const { collectUniqueKvPathStrings } = require('./secrets-kv-refs');
+  const paths = collectUniqueKvPathStrings(envTemplate);
+  return paths.filter(pathStr => !secretPathExistsInStore(existingSecrets, pathStr));
 }
 
 /**
@@ -275,6 +277,8 @@ function loadExistingSecrets(resolvedPath) {
  * @throws {Error} If save fails
  */
 function saveSecretsFile(resolvedPath, secrets) {
+  const { assertWritableSecretsPathForTests } = require('./aifabrix-test-runtime-guard');
+  assertWritableSecretsPathForTests(resolvedPath);
   const dir = path.dirname(resolvedPath);
   if (!fs.existsSync(dir)) {
     fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
@@ -356,6 +360,8 @@ function appendSecretsToFile(resolvedPath, secrets) {
   if (!secrets || typeof secrets !== 'object' || Object.keys(secrets).length === 0) {
     return;
   }
+  const { assertWritableSecretsPathForTests } = require('./aifabrix-test-runtime-guard');
+  assertWritableSecretsPathForTests(resolvedPath);
   const dir = path.dirname(resolvedPath);
   if (!fs.existsSync(dir)) {
     fs.mkdirSync(dir, { recursive: true, mode: 0o700 });

package/lib/utils/secrets-missing-error.js

@@ -0,0 +1,164 @@
+/**
+ * Build missing-secrets errors with remediation hints (no secret values).
+ *
+ * @fileoverview Missing kv:// error message for resolve and env generation
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { formatMissingSecretsFileInfo } = require('./secrets-helpers');
+
+/**
+ * @param {string} line
+ * @returns {boolean}
+ */
+function isCommentOrEmptyLine(line) {
+  const t = String(line).trim();
+  return t === '' || t.startsWith('#');
+}
+
+/**
+ * @param {string} kvRef - e.g. kv://hubspot-demo/clientSecret
+ * @returns {string}
+ */
+function kvRefToSecretSetKey(kvRef) {
+  const s = String(kvRef || '').trim();
+  return s.replace(/^kv:\/\//i, '');
+}
+
+/**
+ * @param {string} envTemplate
+ * @param {string} kvRef
+ * @returns {string|null}
+ */
+function findActiveEnvLineForKvRef(envTemplate, kvRef) {
+  if (!envTemplate || !kvRef) return null;
+  const needle = String(kvRef).trim();
+  for (const line of envTemplate.split('\n')) {
+    if (isCommentOrEmptyLine(line)) continue;
+    if (line.includes(needle)) return line.trim();
+  }
+  return null;
+}
+
+const OAUTH_STALE_KV_PATH_RE = /\/(clientId|clientSecret|tokenUrl|authorizationUrl)$/i;
+
+/**
+ * @param {string[]} missing
+ * @returns {boolean}
+ */
+function hasStaleOAuthTemplatePaths(missing) {
+  return missing.some((ref) => OAUTH_STALE_KV_PATH_RE.test(String(ref)));
+}
+
+/**
+ * @param {string} key
+ * @param {Object} secrets
+ * @returns {boolean}
+ */
+function isPopulatedSecretKey(key, secrets) {
+  const value = secrets[key];
+  return value !== undefined && value !== null && String(value).trim() !== '';
+}
+
+/**
+ * Other populated secret paths that share the same path segment after the namespace.
+ *
+ * @param {string} pathStr - Secret path without kv:// (e.g. my-app-e2e/clientId)
+ * @param {Object} secrets
+ * @returns {string[]}
+ */
+function findPopulatedAlternateKvPaths(pathStr, secrets) {
+  if (!secrets || typeof secrets !== 'object' || !pathStr) {
+    return [];
+  }
+  const slash = pathStr.indexOf('/');
+  if (slash <= 0) {
+    return [];
+  }
+  const missingNamespace = pathStr.slice(0, slash);
+  const segment = pathStr.slice(slash + 1);
+  return Object.keys(secrets).filter((key) => {
+    if (typeof key !== 'string' || !key.includes('/')) {
+      return false;
+    }
+    const keySlash = key.indexOf('/');
+    const namespace = key.slice(0, keySlash);
+    const keySegment = key.slice(keySlash + 1);
+    return (
+      keySegment === segment &&
+      namespace !== missingNamespace &&
+      isPopulatedSecretKey(key, secrets)
+    );
+  });
+}
+
+/**
+ * @param {string[]} missing - kv:// refs
+ * @param {Object} [secrets]
+ * @param {string} [appName]
+ * @returns {string[]}
+ */
+function buildKvNamespaceAlternateHints(missing, secrets, appName) {
+  const lines = [];
+  const seen = new Set();
+  for (const ref of missing) {
+    const pathStr = kvRefToSecretSetKey(ref);
+    for (const alt of findPopulatedAlternateKvPaths(pathStr, secrets)) {
+      const line = `Found kv://${alt} in secrets; env.template references kv://${pathStr}.`;
+      if (seen.has(line)) {
+        continue;
+      }
+      seen.add(line);
+      lines.push(line);
+    }
+  }
+  if (lines.length === 0) {
+    return [];
+  }
+  const repairTail = appName
+    ? `Use aifabrix secret set <key> for each missing path, or aifabrix repair ${appName} to align env.template.`
+    : 'Use aifabrix secret set <key> for each missing path, or repair to align env.template.';
+  lines.push(repairTail);
+  return lines;
+}
+
+/**
+ * @param {Object} opts
+ * @param {string[]} opts.missing
+ * @param {Object|string|null} [opts.secretsFilePaths]
+ * @param {string} [opts.appName]
+ * @param {string} [opts.envTemplatePath]
+ * @param {string} [opts.envTemplate]
+ * @param {Object} [opts.secrets]
+ * @returns {string}
+ */
+function buildMissingSecretsErrorMessage(opts) {
+  const { missing, secretsFilePaths, appName, envTemplatePath, envTemplate, secrets } = opts;
+  const fileInfo = formatMissingSecretsFileInfo(secretsFilePaths);
+  const lines = [`Missing secrets: ${missing.join(', ')}`];
+  if (fileInfo) lines.push(fileInfo.trim());
+  if (envTemplatePath) lines.push(`Env-template-path: ${envTemplatePath}`);
+  for (const ref of missing) {
+    const templateLine = findActiveEnvLineForKvRef(envTemplate, ref);
+    if (templateLine) lines.push(`Env-template-line: ${ref}|${templateLine}`);
+  }
+  if (appName) lines.push(`App-name: ${appName}`);
+  if (hasStaleOAuthTemplatePaths(missing) && appName) {
+    lines.push(`Stale-template-hint: oauth-leftover | repair ${appName}`);
+  }
+  for (const hint of buildKvNamespaceAlternateHints(missing, secrets, appName)) {
+    lines.push(`Alternate-kv-hint: ${hint}`);
+  }
+  lines.push('Remediation-hint: comment-or-delete-template-line | secret-set');
+  return `${lines.join('\n')}\n`;
+}
+
+module.exports = {
+  kvRefToSecretSetKey,
+  findActiveEnvLineForKvRef,
+  findPopulatedAlternateKvPaths,
+  buildMissingSecretsErrorMessage
+};

package/lib/utils/service-url-label.js

@@ -0,0 +1,81 @@
+/**
+ * Infer which platform service a request URL targets (CLI error copy).
+ *
+ * @fileoverview Service label heuristics for network error messages
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+/** @type {readonly string[]} */
+const DATAPLANE_PATH_PREFIXES = Object.freeze([
+  '/api/v1/external',
+  '/api/v1/validation',
+  '/api/v1/records',
+  '/api/v1/wizard',
+  '/api/v1/admin',
+  '/api/v1/health',
+  '/api/v1/dataplane',
+  '/api/v1/policy',
+  '/api/v1/mcp',
+  '/api/v1/ide',
+  '/api/v1/knowledgebase'
+]);
+
+/** @type {readonly string[]} */
+const CONTROLLER_PATH_PREFIXES = Object.freeze([
+  '/api/v1/auth',
+  '/api/v1/applications',
+  '/api/v1/pipeline',
+  '/api/v1/environments',
+  '/api/v1/deployments',
+  '/api/v1/datasources',
+  '/api/v1/external-systems',
+  '/api/controller'
+]);
+
+/**
+ * @param {string} url - Full request URL
+ * @returns {'dataplane'|'controller'|'service'}
+ */
+function inferServiceLabelFromUrl(url) {
+  if (!url || typeof url !== 'string') {
+    return 'service';
+  }
+  try {
+    const path = new URL(url.trim()).pathname || '';
+    for (const prefix of DATAPLANE_PATH_PREFIXES) {
+      if (path.startsWith(prefix)) {
+        return 'dataplane';
+      }
+    }
+    for (const prefix of CONTROLLER_PATH_PREFIXES) {
+      if (path.startsWith(prefix)) {
+        return 'controller';
+      }
+    }
+  } catch {
+    return 'service';
+  }
+  return 'service';
+}
+
+/**
+ * @param {'dataplane'|'controller'|'service'} label
+ * @returns {string}
+ */
+function serviceLabelDisplayName(label) {
+  if (label === 'dataplane') {
+    return 'dataplane';
+  }
+  if (label === 'controller') {
+    return 'controller';
+  }
+  return 'service';
+}
+
+module.exports = {
+  inferServiceLabelFromUrl,
+  serviceLabelDisplayName
+};

package/lib/utils/setup-quiet-output.js

@@ -0,0 +1,25 @@
+/**
+ * Suppress verbose CLI detail during `aifabrix setup` (guided milestones only).
+ *
+ * @fileoverview Setup quiet output flag
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+/**
+ * @returns {boolean} True while `aifabrix setup` is running
+ */
+function isSetupQuietOutput() {
+  try {
+    const { isSetupCommandFlow } = require('../commands/setup-run-context');
+    return isSetupCommandFlow();
+  } catch {
+    return false;
+  }
+}
+
+module.exports = {
+  isSetupQuietOutput
+};

package/lib/utils/template-helpers.js

@@ -110,6 +110,20 @@ function updateDatabaseConfig(variables, options, appName) {
  * @param {Object} options - CLI options
  * @param {Object} config - Final configuration
  */
+async function patchEnvTemplateRelativePathKey(appPath, appName) {
+  const fsSync = require('fs');
+  const envTemplatePath = path.join(appPath, 'env.template');
+  if (!fsSync.existsSync(envTemplatePath)) {
+    return;
+  }
+  const { renameAppRelativePathEnvKeyInTemplate } = require('./app-relative-path-env');
+  const raw = await fs.readFile(envTemplatePath, 'utf8');
+  const patched = renameAppRelativePathEnvKeyInTemplate(raw, appName);
+  if (patched !== raw) {
+    await fs.writeFile(envTemplatePath, patched, 'utf8');
+  }
+}
+
 async function updateTemplateVariables(appPath, appName, options, config) {
   const { resolveApplicationConfigPath } = require('./app-config-resolver');
   const { loadConfigFile, writeConfigFile } = require('./config-format');
@@ -123,6 +137,7 @@ async function updateTemplateVariables(appPath, appName, options, config) {
     updateDatabaseConfig(variables, options, appName);
 
     writeConfigFile(variablesPath, variables);
+    await patchEnvTemplateRelativePathKey(appPath, appName);
   } catch (error) {
     if (error.message && !error.message.includes('not found')) {
       logger.warn(chalk.yellow(`⚠  Warning: Could not update application config: ${error.message}`));