@aifabrix/builder 2.45.5 → 2.47.0

package/lib/utils/build-resolve-image.js

@@ -11,9 +11,10 @@
 const chalk = require('chalk');
 const logger = require('./logger');
 const { execWithDockerEnv } = require('./docker-exec');
+const { buildDevImageName } = require('./image-name');
 const {
-  resolveDockerImageRef,
-  getRepositoryPathFromConfig
+  getRepositoryPathFromConfig,
+  resolveDockerImageRef
 } = require('./resolve-docker-image-ref');
 
 /**
@@ -47,20 +48,44 @@ function repositoryTail(repoPath) {
   return parts[parts.length - 1] || repoPath;
 }
 
+/**
+ * Remove registry host prefix from a Docker repository path (local build only).
+ * @param {string} repository
+ * @returns {string}
+ */
+function stripRegistryHostFromRepository(repository) {
+  if (!repository || typeof repository !== 'string') {
+    return repository;
+  }
+  const parts = repository.split('/');
+  if (parts.length <= 1) {
+    return repository;
+  }
+  const host = parts[0];
+  if (host.includes('.') || host.includes(':') || host === 'localhost') {
+    return parts.slice(1).join('/');
+  }
+  return repository;
+}
+
 /**
  * Strip dev-scoped or -extra suffix from a Docker repository path.
  * @param {string} repo
  * @returns {string}
  */
 function baseRepositoryFromDevScoped(repo) {
-  const devMatch = repo.match(/^(.*)-dev\d+$/);
+  const localRepo = stripRegistryHostFromRepository(repo);
+  const tail = repositoryTail(localRepo);
+  const devMatch = tail.match(/^(.*)-dev\d+$/);
   if (devMatch) {
-    return devMatch[1];
+    const prefix = localRepo.slice(0, localRepo.length - tail.length);
+    return `${prefix}${devMatch[1]}`;
   }
-  if (repo.endsWith('-extra')) {
-    return repo.slice(0, -'-extra'.length);
+  if (tail.endsWith('-extra')) {
+    const prefix = localRepo.slice(0, localRepo.length - tail.length);
+    return `${prefix}${tail.slice(0, -'-extra'.length)}`;
   }
-  return repo;
+  return localRepo;
 }
 
 /**
@@ -140,7 +165,33 @@ async function discoverLocalBaseImageRepository(appName, developerId) {
 }
 
 /**
- * Repository path (may include registry prefix) used for `docker build -t`.
+ * Resolve local `docker build -t` repository path(s) from the manifest or discovery.
+ * When `application.yaml` declares `image`, the manifest ref is used exactly (registry + name).
+ * Developer-scoped `-devN` suffixes apply only when the manifest omits `image` and Docker is scanned.
+ *
+ * @param {string} appName
+ * @param {Object} variables - application manifest
+ * @param {string|number} developerId
+ * @param {Object} [options] - CLI build options (`base`, `tag`, `registry`)
+ * @returns {Promise<{ buildImageName: string, compatBaseName: string|null }>}
+ */
+async function resolveBuildDockerTagNames(appName, variables, developerId, options = {}) {
+  if (!wantsLocalDockerImageDiscovery(variables)) {
+    const { imageName } = resolveDockerImageRef(appName, variables, options);
+    return { buildImageName: imageName, compatBaseName: null };
+  }
+  const baseRepo = await resolveBuildImageRepositoryName(appName, variables, developerId);
+  const buildImageName = buildDevImageName(baseRepo, developerId);
+  const wantCompat =
+    buildImageName !== baseRepo && options && options.base === true;
+  return {
+    buildImageName,
+    compatBaseName: wantCompat ? baseRepo : null
+  };
+}
+
+/**
+ * Repository path for local `docker build -t` when manifest omits `image` (discovery / app key).
  * @param {string} appName
  * @param {Object} variables - application manifest
  * @param {string|number} developerId
@@ -148,18 +199,21 @@ async function discoverLocalBaseImageRepository(appName, developerId) {
  */
 async function resolveBuildImageRepositoryName(appName, variables, developerId) {
   if (!wantsLocalDockerImageDiscovery(variables)) {
-    return resolveDockerImageRef(appName, variables, {}).imageName;
+    return getRepositoryPathFromConfig(variables, appName);
   }
   const discovered = await discoverLocalBaseImageRepository(appName, developerId);
   if (discovered) {
-    logger.log(chalk.blue(`Using image repository from local Docker: ${discovered}`));
-    return discovered;
+    const localRepo = stripRegistryHostFromRepository(discovered);
+    logger.log(chalk.blue(`Using image repository from local Docker: ${localRepo}`));
+    return localRepo;
   }
   return getRepositoryPathFromConfig(variables, appName);
 }
 
 module.exports = {
+  resolveBuildDockerTagNames,
   resolveBuildImageRepositoryName,
   wantsLocalDockerImageDiscovery,
-  pickBaseFromDockerLines
+  pickBaseFromDockerLines,
+  stripRegistryHostFromRepository
 };

package/lib/utils/celery-companion-apps.js

@@ -0,0 +1,53 @@
+/**
+ * Worker companion helpers for run/logs/down lifecycle.
+ *
+ * @fileoverview Loads application.yaml and resolves worker sidecar app keys
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const yaml = require('js-yaml');
+const paths = require('./paths');
+const {
+  getWorkerCompanionAppKeys,
+  resolveWorkerSidecars
+} = require('./worker-sidecars');
+
+/**
+ * @param {string} appName
+ * @param {object|null|undefined} appConfig
+ * @returns {boolean}
+ */
+function isCeleryWorkerStackEnabled(appName, appConfig) {
+  return resolveWorkerSidecars(appName, appConfig).enabled;
+}
+
+/**
+ * @param {string} appName
+ * @param {object|null|undefined} appConfig
+ * @returns {string[]}
+ */
+function getCeleryCompanionAppKeys(appName, appConfig) {
+  return getWorkerCompanionAppKeys(appName, appConfig);
+}
+
+/**
+ * @param {string} appName
+ * @returns {object|null}
+ */
+function loadBuilderApplicationConfig(appName) {
+  const configPath = path.join(paths.getBuilderPath(appName), 'application.yaml');
+  if (!fs.existsSync(configPath)) {
+    return null;
+  }
+  return yaml.load(fs.readFileSync(configPath, 'utf8'));
+}
+
+module.exports = {
+  isCeleryWorkerStackEnabled,
+  getCeleryCompanionAppKeys,
+  loadBuilderApplicationConfig,
+  resolveWorkerSidecars
+};

package/lib/utils/cli-secrets-error-format.js

@@ -8,6 +8,7 @@
 
 const chalk = require('chalk');
 const { metadata, sectionTitle } = require('./cli-layout-chalk');
+const { kvRefToSecretSetKey } = require('./secrets-missing-error');
 
 /**
  * @param {string[]} messages - Output lines
@@ -25,34 +26,72 @@ function pushMissingSecretsBodyLines(messages, missingSecretsMatch) {
       for (const ref of parts) {
         messages.push(`   ${chalk.cyan('-')} ${chalk.white(ref)}`);
       }
-      return;
+      return parts;
     }
     if (parts.length === 1) {
       messages.push(`   ${sectionTitle('Missing secrets:')} ${chalk.white(parts[0])}`);
-      return;
+      return parts;
     }
     messages.push(`   ${sectionTitle('Missing secrets:')}`);
-    return;
+    return [];
   }
   messages.push(`   ${chalk.white('Missing secrets in secrets file.')}`);
+  return [];
 }
 
 /**
- * @param {string[]} messages - Output lines
- * @param {RegExpMatchArray|null} fileInfoMatch - File location capture
- * @param {RegExpMatchArray|null} resolveMatch - Resolve command capture
+ * @param {string} errorMsg
+ * @returns {Map<string, string>}
+ */
+function parseEnvTemplateLineHints(errorMsg) {
+  const map = new Map();
+  const re = /^Env-template-line: (kv:\/\/[^\s|]+)\|(.+)$/gm;
+  let m;
+  while ((m = re.exec(errorMsg)) !== null) {
+    map.set(m[1].trim(), m[2].trim());
+  }
+  return map;
+}
+
+/**
+ * @param {string[]} messages
+ * @param {string[]} missingRefs
+ * @param {Map<string, string>} templateLinesByRef
+ * @param {string|null} envTemplatePath
  */
-function pushSecretsResolutionHintLines(messages, fileInfoMatch, resolveMatch) {
+function pushRemediationHintLines(messages, missingRefs, templateLinesByRef, envTemplatePath) {
+  messages.push(`   ${sectionTitle('You can fix this two ways:')}`);
+  messages.push(
+    `   ${chalk.cyan('1.')} ${chalk.white('Not used by your external system?')} Comment out or delete the line in env.template.`
+  );
+  if (envTemplatePath) {
+    messages.push(`   ${metadata('env.template:')} ${chalk.white(envTemplatePath)}`);
+  }
+  for (const ref of missingRefs) {
+    const line = templateLinesByRef.get(ref);
+    if (line) {
+      messages.push(`   ${metadata('Comment or delete:')} ${chalk.gray(line)}`);
+    }
+  }
+  messages.push(
+    `   ${chalk.cyan('2.')} ${chalk.white('Store the value:')} ${metadata('aifabrix secret set')} ${chalk.yellow('<key>')} ${chalk.gray('"<your-value>"')}`
+  );
+  for (const ref of missingRefs) {
+    const key = kvRefToSecretSetKey(ref);
+    if (key) {
+      messages.push(`   ${metadata('Example:')} ${chalk.yellow(`aifabrix secret set ${key} "<your-value>"`)}`);
+    }
+  }
+}
+
+/**
+ * @param {string[]} messages
+ * @param {RegExpMatchArray|null} fileInfoMatch
+ */
+function pushSecretsFileLocationLine(messages, fileInfoMatch) {
   if (fileInfoMatch) {
     messages.push(`   ${metadata('Secrets file location:')} ${chalk.white(fileInfoMatch[1])}`);
   }
-  if (resolveMatch) {
-    messages.push(
-      `   ${metadata('Run:')} ${chalk.yellow(`aifabrix resolve ${resolveMatch[1]} to generate missing secrets.`)}`
-    );
-    return;
-  }
-  messages.push(`   ${metadata('Run:')} ${chalk.yellow('aifabrix resolve <app-name> to generate missing secrets.')}`);
 }
 
 /**
@@ -66,13 +105,36 @@ function formatSecretsError(errorMsg) {
   }
 
   const messages = [];
-  pushMissingSecretsBodyLines(messages, errorMsg.match(/Missing secrets: ([^\n]+)/));
-  pushSecretsResolutionHintLines(
-    messages,
-    errorMsg.match(/Secrets file location: ([^\n]+)/),
-    errorMsg.match(/Run "aifabrix resolve ([^"]+)"/)
-  );
+  const missingRefs = pushMissingSecretsBodyLines(messages, errorMsg.match(/Missing secrets: ([^\n]+)/));
+  pushSecretsFileLocationLine(messages, errorMsg.match(/Secrets file location: ([^\n]+)/));
+  const envTemplatePathMatch = errorMsg.match(/Env-template-path: ([^\n]+)/);
+  const envTemplatePath = envTemplatePathMatch ? envTemplatePathMatch[1].trim() : null;
+  const templateLinesByRef = parseEnvTemplateLineHints(errorMsg);
+  const refs =
+    missingRefs.length > 0
+      ? missingRefs
+      : [...templateLinesByRef.keys()];
+  if (refs.length > 0) {
+    pushRemediationHintLines(messages, refs, templateLinesByRef, envTemplatePath);
+  }
+  const staleMatch = errorMsg.match(/Stale-template-hint: oauth-leftover \| repair ([^\n]+)/);
+  if (staleMatch) {
+    messages.push(
+      `   ${chalk.yellow('⚠')} ${chalk.white('These keys are often left over after switching to apikey/bearerToken auth.')}`
+    );
+    messages.push(
+      `   ${metadata('Run:')} ${chalk.yellow(`aifabrix repair ${staleMatch[1].trim()}`)} ${chalk.gray('to comment stale OAuth lines in env.template')}`
+    );
+  }
   return messages;
 }
 
-module.exports = { formatSecretsError };
+/**
+ * @param {string} errorMsg
+ * @returns {boolean}
+ */
+function isMissingSecretsErrorMessage(errorMsg) {
+  return typeof errorMsg === 'string' && errorMsg.includes('Missing secrets');
+}
+
+module.exports = { formatSecretsError, isMissingSecretsErrorMessage };

package/lib/utils/cli-utils.js

@@ -12,7 +12,7 @@ const path = require('path');
 const chalk = require('chalk');
 const logger = require('./logger');
 const { formatBlockingError, infoLine } = require('./cli-layout-chalk');
-const { formatSecretsError } = require('./cli-secrets-error-format');
+const { formatSecretsError, isMissingSecretsErrorMessage } = require('./cli-secrets-error-format');
 const { getDockerDaemonStartHintSentence, getDockerApiOverTcpHintLines } = require('./docker-not-running-hint');
 
 /**
@@ -215,6 +215,10 @@ function formatAzureError(errorMsg) {
       '   Use format: *.azurecr.io (e.g., myacr.azurecr.io)'
     ];
   }
+  // Docker build failures may mention azurecr.io in the local tag; show the real build error instead.
+  if (errorMsg.includes('Docker build failed') || errorMsg.includes('Build failed: Docker')) {
+    return null;
+  }
   // Only match ACR-specific authentication errors, not general authentication failures
   if (errorMsg.includes('ACR') || errorMsg.includes('azurecr.io') ||
       (errorMsg.includes('authenticate') && (errorMsg.includes('registry') || errorMsg.includes('container')))) {
@@ -337,6 +341,15 @@ function formatError(error) {
     return formatFormattedError(error.formatted);
   }
 
+  if (error.network === true) {
+    const { formatNetworkError } = require('./api-error-handler');
+    const formatted = formatNetworkError(error.message || 'Network error', {
+      endpointUrl: error.endpointUrl,
+      serviceLabel: error.serviceLabel || 'service'
+    });
+    return formatFormattedError(formatted);
+  }
+
   const errorMsg = error.message || '';
 
   // Try different error formatters in order of specificity
@@ -355,10 +368,12 @@ function formatError(error) {
  * @param {string} command - Command that failed
  * @param {string[]} errorMessages - Error message lines
  */
-function logError(command, errorMessages) {
+function logError(command, errorMessages, options = {}) {
   logger.error(`\n${formatBlockingError(`Error in ${command} command:`)}`);
   errorMessages.forEach(msg => logger.error(msg));
-  logger.log(`\n${infoLine('ℹ Run "aifabrix doctor" for environment diagnostics.')}\n`);
+  if (!options.skipDoctor) {
+    logger.log(`\n${infoLine('ℹ Run "aifabrix doctor" for environment diagnostics.')}\n`);
+  }
 }
 
 /**
@@ -396,7 +411,8 @@ function isAuthenticationError(error) {
  */
 function handleCommandError(error, command) {
   const errorMessages = formatError(error);
-  logError(command, errorMessages);
+  const skipDoctor = isMissingSecretsErrorMessage(error && error.message);
+  logError(command, errorMessages, { skipDoctor });
   if (error.wizardResumeMessage) {
     logger.log(error.wizardResumeMessage);
   }

package/lib/utils/compose-celery-worker.js

@@ -0,0 +1,23 @@
+/**
+ * Worker/beat compose fragment for local runs.
+ *
+ * @fileoverview Compose context for optional worker and beat services from application.yaml
+ */
+
+'use strict';
+
+const { buildWorkerSidecarComposeContext } = require('./worker-sidecars');
+
+/**
+ * @param {string} appKey
+ * @param {object} appConfig
+ * @param {{ devId: string|number, idNum: number }} ids
+ * @returns {ReturnType<typeof buildWorkerSidecarComposeContext>}
+ */
+function buildCeleryWorkerComposeContext(appKey, appConfig, ids) {
+  return buildWorkerSidecarComposeContext(appKey, appConfig, ids);
+}
+
+module.exports = {
+  buildCeleryWorkerComposeContext
+};

package/lib/utils/compose-generate-docker-compose.js

@@ -14,6 +14,7 @@ const buildCopy = require('./build-copy');
 const paths = require('./paths');
 const { getInfraDirName } = require('../infrastructure/helpers');
 const { resolveMisoEnvironment } = require('./compose-miso-env');
+const { buildCeleryWorkerComposeContext } = require('./compose-celery-worker');
 
 /**
  * When running a pulled Python image (no bind-mounted source), the image CMD may invoke the
@@ -61,6 +62,10 @@ function normalizePythonReloadForComposeMounted(raw) {
   if (/^python3?\s+-m\s+uvicorn\s+/i.test(s)) {
     return s;
   }
+  const envPrefixed = s.match(/^((?:[A-Za-z_][A-Za-z0-9_]*=\S+\s+)*)(uvicorn\s+.*)$/);
+  if (envPrefixed) {
+    return `${envPrefixed[1]}python -m uvicorn ${envPrefixed[2].slice('uvicorn '.length)}`;
+  }
   if (s.startsWith('uvicorn ')) {
     return `python -m uvicorn ${s.slice('uvicorn '.length)}`;
   }
@@ -145,7 +150,11 @@ function buildComposeTemplateContext(ctx) {
     devMountPath: ctx.devMountPath,
     reloadStartCommand: ctx.reloadStartCommand,
     infraPgpassPath: ctx.useInfraPgpass ? ctx.infraPgpassPath : null,
-    useInfraPgpass: !!ctx.useInfraPgpass
+    useInfraPgpass: !!ctx.useInfraPgpass,
+    workerSidecars: buildCeleryWorkerComposeContext(ctx.appName, ctx.appConfig, {
+      devId: ctx.devId,
+      idNum: ctx.idNum
+    })
   };
 }
 
@@ -299,6 +308,9 @@ async function generateDockerComposeImpl(deps, appName, appConfig, options) {
       ...layouts,
       ...side,
       idNum: head.idNum,
+      appName,
+      appConfig,
+      devId: head.devId,
       options
     })
   );

package/lib/utils/compose-traefik-ingress-base.js

@@ -86,6 +86,19 @@ function expandFrontDoorHostPlaceholders(template, developerIdRaw, remoteServer)
   return t;
 }
 
+function templateUsesRemoteHostPlaceholder(hostTemplate) {
+  return /\$\{REMOTE_HOST\}/.test(String(hostTemplate || ''));
+}
+
+function resolveTraefikRouterHost(hostTemplate, developerIdRaw, remoteServer) {
+  const usesRemote = templateUsesRemoteHostPlaceholder(hostTemplate);
+  const hasRemote = Boolean(remoteServer && String(remoteServer).trim());
+  if (usesRemote && !hasRemote) {
+    return 'localhost';
+  }
+  return expandFrontDoorHostPlaceholders(hostTemplate, developerIdRaw, remoteServer);
+}
+
 /**
  * Traefik PathPrefix / host / TLS from frontDoorRouting (public ingress). Does not include StripPrefix — that follows
  * the in-container health path: private URL is `http://<service>:<port>` plus the probe path; `/dev`, `/tst`, `/auth`,
@@ -105,7 +118,7 @@ function buildTraefikIngressBase(config, devId, scopeOpts, remoteServer) {
   if (!frontDoor.host || typeof frontDoor.host !== 'string') {
     throw new Error('frontDoorRouting.host is required when frontDoorRouting.enabled is true');
   }
-  const host = expandFrontDoorHostPlaceholders(frontDoor.host, devId, remoteServer);
+  const host = resolveTraefikRouterHost(frontDoor.host, devId, remoteServer);
   const basePath = derivePathFromPattern(frontDoor.pattern);
   let pathOut = basePath;
   if (
@@ -153,6 +166,8 @@ module.exports = {
   resolveTraefikTlsEnabled,
   buildDevUsernameForFrontDoorHost,
   expandFrontDoorHostPlaceholders,
+  templateUsesRemoteHostPlaceholder,
+  resolveTraefikRouterHost,
   buildTraefikIngressBase,
   computeTraefikStripPathPrefix
 };

package/lib/utils/config-secrets-path.js

@@ -0,0 +1,46 @@
+/**
+ * Secrets path config helpers.
+ *
+ * @fileoverview Keeps lib/core/config.js under max-lines
+ */
+
+'use strict';
+
+const os = require('os');
+const path = require('path');
+
+/**
+ * Expand leading ~ to home directory so config paths like ~/.aifabrix/secrets.local.yaml resolve correctly.
+ * @param {string} filePath - Path that may start with ~ or ~/
+ * @returns {string} Path with ~ expanded, or unchanged if no leading ~
+ */
+function expandTilde(filePath) {
+  if (!filePath || typeof filePath !== 'string') return filePath;
+  if (filePath === '~') return os.homedir();
+  if (filePath.startsWith('~/') || filePath.startsWith('~' + path.sep)) {
+    return path.join(os.homedir(), filePath.slice(2));
+  }
+  return filePath;
+}
+
+function createSecretsPathFunctions(getConfig, saveConfig) {
+  async function getSecretsPath() {
+    const cfg = await getConfig();
+    const raw = cfg['aifabrix-secrets'] || cfg['secrets-path'] || null;
+    return raw ? expandTilde(raw) : null;
+  }
+
+  async function setSecretsPath(secretsPath) {
+    if (typeof secretsPath !== 'string') {
+      throw new Error('Secrets path is required and must be a string');
+    }
+    const cfg = await getConfig();
+    cfg['aifabrix-secrets'] = secretsPath.trim() || undefined;
+    await saveConfig(cfg);
+  }
+
+  return { getSecretsPath, setSecretsPath };
+}
+
+module.exports = { createSecretsPathFunctions };
+

package/lib/utils/configuration-env-resolver.js

@@ -190,6 +190,40 @@ function retemplateConfigurationFromEnvTemplate(configArray, envTemplateVariable
   }
 }
 
+/**
+ * Re-templates every system variable definition to {{NAME}} (download/export safe).
+ *
+ * @param {Array<{ name?: string, location?: string }>} configArray - Configuration array (mutated)
+ */
+function retemplateAllVariableDefinitions(configArray) {
+  if (!Array.isArray(configArray)) return;
+  for (const item of configArray) {
+    if (!item || String(item.location || 'variable').toLowerCase() !== 'variable') continue;
+    const name = item.name && String(item.name).trim();
+    if (name) {
+      item.value = `{{${name}}}`;
+    }
+  }
+}
+
+/**
+ * Re-templates datasource override literals to {{NAME}} placeholders.
+ *
+ * @param {Array<{ name?: string, value?: string }>} configArray - Datasource configuration (mutated)
+ */
+function retemplateDatasourceConfigurationOverrides(configArray) {
+  if (!Array.isArray(configArray)) return;
+  for (const item of configArray) {
+    if (!item || !item.name) continue;
+    const name = String(item.name).trim();
+    const raw = item.value;
+    if (typeof raw !== 'string') continue;
+    const value = raw.trim();
+    if (!value || value.startsWith('kv://') || value.includes('{{')) continue;
+    item.value = `{{${name}}}`;
+  }
+}
+
 /**
  * Reads env.template at integration path, re-templates the given configuration array,
  * and returns the updated array (mutates in place). If env.template is missing, does nothing.
@@ -215,6 +249,8 @@ module.exports = {
   collectResolvedVariableConfigurationNames,
   getEnvTemplateVariableNames,
   retemplateConfigurationFromEnvTemplate,
+  retemplateAllVariableDefinitions,
+  retemplateDatasourceConfigurationOverrides,
   retemplateConfigurationForDownload,
   substituteVarPlaceholders
 };