@aifabrix/builder 2.47.3 → 2.48.0

package/lib/commands/up-dataplane-credentials.js

@@ -16,6 +16,10 @@ const { loadClientCredentials } = require('../utils/token-manager');
 const { rotateSecret } = require('../app/rotate-secret');
 const logger = require('../utils/logger');
 const { formatSuccessLine } = require('../utils/cli-test-layout-chalk');
+const {
+  resolveLocalhostPlatformControllerUrl,
+  resolveCliPlatformControllerUrl
+} = require('../utils/platform-controller-url');
 
 const DATAPLANE_APP_KEY = 'dataplane';
 const MISALIGN_ERROR =
@@ -30,6 +34,31 @@ function normalizeControllerUrl(controllerUrl) {
   return String(controllerUrl || '').replace(/\/+$/, '');
 }
 
+/**
+ * Controller bases to try for token probe (public Traefik, CLI-resolved, localhost).
+ * @async
+ * @param {string} controllerUrl
+ * @returns {Promise<string[]>}
+ */
+async function resolveControllerUrlsForCredentialProbe(controllerUrl) {
+  const urls = [];
+  const add = (url) => {
+    const normalized = normalizeControllerUrl(url);
+    if (normalized && !urls.includes(normalized)) {
+      urls.push(normalized);
+    }
+  };
+
+  add(controllerUrl);
+  try {
+    add(await resolveCliPlatformControllerUrl());
+    add(await resolveLocalhostPlatformControllerUrl());
+  } catch {
+    // optional fallbacks only
+  }
+  return urls;
+}
+
 /**
  * Exchange dataplane client id/secret for a controller token (probe only).
  * @async
@@ -52,17 +81,68 @@ async function probeDataplaneClientToken(controllerUrl, credentials) {
   return response.success === true;
 }
 
+/**
+ * Load dataplane pipeline credentials from secrets.local.yaml only (ignore process env).
+ * @async
+ * @returns {Promise<{ clientId: string, clientSecret: string }|null>}
+ */
+async function loadDataplanePipelineCredentialsFromSecretsFile() {
+  return loadClientCredentials(DATAPLANE_APP_KEY, { secretsFileOnly: true });
+}
+
+/**
+ * @param {number} ms
+ * @returns {Promise<void>}
+ */
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+/**
+ * Probe token endpoint with retries (controller Redis may briefly serve stale pipeline config).
+ * @async
+ * @param {string} controllerUrl
+ * @param {number} [maxAttempts]
+ * @param {number} [delayMs]
+ * @returns {Promise<boolean>}
+ */
+async function credentialsAcceptTokenWithRetry(controllerUrl, maxAttempts = 5, delayMs = 2000) {
+  for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
+    if (await credentialsAcceptToken(controllerUrl)) {
+      return true;
+    }
+    if (attempt < maxAttempts - 1 && delayMs > 0) {
+      await sleep(delayMs);
+    }
+  }
+  return false;
+}
+
+function resolveCredentialProbeRetry(options = {}) {
+  const retry = options.credentialProbeRetry || {};
+  return {
+    maxAttempts: Number.isFinite(retry.maxAttempts) ? retry.maxAttempts : 5,
+    delayMs: Number.isFinite(retry.delayMs) ? retry.delayMs : 2000
+  };
+}
+
 /**
  * @async
  * @param {string} controllerUrl
  * @returns {Promise<boolean>}
  */
 async function credentialsAcceptToken(controllerUrl) {
-  const credentials = await loadClientCredentials(DATAPLANE_APP_KEY);
+  const credentials = await loadDataplanePipelineCredentialsFromSecretsFile();
   if (!credentials) {
     return false;
   }
-  return probeDataplaneClientToken(controllerUrl, credentials);
+  const urls = await resolveControllerUrlsForCredentialProbe(controllerUrl);
+  for (const url of urls) {
+    if (await probeDataplaneClientToken(url, credentials)) {
+      return true;
+    }
+  }
+  return false;
 }
 
 /**
@@ -86,9 +166,10 @@ async function alignDataplaneCredentialsAfterDeploy(options, controllerUrl) {
   if (!quiet) {
     logger.log(chalk.blue('Aligning dataplane pipeline credentials with controller...'));
   }
-  await rotateSecret(DATAPLANE_APP_KEY, { ...options, quiet });
+  await rotateSecret(DATAPLANE_APP_KEY, { ...options, quiet, exitOnFailure: false });
 
-  const stillMisaligned = !(await credentialsAcceptToken(controllerUrl));
+  const { maxAttempts, delayMs } = resolveCredentialProbeRetry(options);
+  const stillMisaligned = !(await credentialsAcceptTokenWithRetry(controllerUrl, maxAttempts, delayMs));
   if (stillMisaligned) {
     throw new Error(MISALIGN_ERROR);
   }
@@ -100,5 +181,7 @@ async function alignDataplaneCredentialsAfterDeploy(options, controllerUrl) {
 module.exports = {
   alignDataplaneCredentialsAfterDeploy,
   probeDataplaneClientToken,
-  credentialsAcceptToken
+  credentialsAcceptToken,
+  loadDataplanePipelineCredentialsFromSecretsFile,
+  resolveControllerUrlsForCredentialProbe
 };

package/lib/core/setup-platform-mode.js

@@ -48,7 +48,7 @@ function normalizeSetupPlatformMode(value) {
  * - full: Traefik ingress + env-scoped resources (multi-env; CLI only until menu returns)
  *
  * @param {'single'|'single-traefik'|'full'} mode
- * @returns {{ traefik: boolean, useEnvironmentScopedResources: boolean }}
+ * @returns {{ traefik: boolean, tlsEnabled: boolean, useEnvironmentScopedResources: boolean }}
  */
 function flagsForSetupPlatformMode(mode) {
   const m = normalizeSetupPlatformMode(mode);
@@ -56,28 +56,35 @@ function flagsForSetupPlatformMode(mode) {
     m === SETUP_PLATFORM_MODE.SINGLE_TRAEFIK || m === SETUP_PLATFORM_MODE.FULL;
   return {
     traefik,
+    tlsEnabled: traefik,
     useEnvironmentScopedResources: m === SETUP_PLATFORM_MODE.FULL
   };
 }
 
 /**
  * Interactive setup menu choices (full platform hidden until multi-env path ships).
+ * Traefik front door requires `remote-server` (from `aifabrix dev init`); without it only direct ports is offered.
  *
+ * @param {Object} [opts]
+ * @param {boolean} [opts.remoteServerConfigured=false]
  * @returns {{ name: string, value: string }[]}
  */
-function getSetupPlatformModePromptChoices() {
-  return [
+function getSetupPlatformModePromptChoices(opts = {}) {
+  const choices = [
     {
       name: 'Single environment — direct ports (no Traefik front door)',
       value: SETUP_PLATFORM_MODE.SINGLE
-    },
-    {
-      name: 'Single environment — Traefik front door (domain + TLS)',
-      value: SETUP_PLATFORM_MODE.SINGLE_TRAEFIK
     }
-    // Full platform — Traefik front door + miso/dev/tst/pro (shared infra) — menu returns soon.
-    // { name: 'Full platform — Traefik front door + miso/dev/tst/pro (shared infra)', value: SETUP_PLATFORM_MODE.FULL },
   ];
+  if (opts.remoteServerConfigured === true) {
+    choices.push({
+      name: 'Single environment — Traefik front door (domain + TLS)',
+      value: SETUP_PLATFORM_MODE.SINGLE_TRAEFIK
+    });
+  }
+  // Full platform — Traefik front door + miso/dev/tst/pro (shared infra) — menu returns soon.
+  // { name: 'Full platform — Traefik front door + miso/dev/tst/pro (shared infra)', value: SETUP_PLATFORM_MODE.FULL },
+  return choices;
 }
 
 module.exports = {

package/lib/parameters/infra-kv-discovery.js

@@ -6,6 +6,7 @@
 
 const fsRealSync = require('../internal/fs-real-sync');
 const path = require('path');
+const { activeEnvLineForKvScan } = require('../utils/secrets-kv-refs');
 const { loadRequiresDatabasesArray, loadShippedRequiresDatabases } = require('./database-secret-values');
 
 /** Platform apps from shipped templates (setup/up-infra before builder/ is copied). */
@@ -22,11 +23,11 @@ function extractKvKeysFromEnvContent(content) {
   const kvPattern = /kv:\/\/([a-zA-Z0-9-_]+)/g;
   const lines = content.split('\n');
   for (const line of lines) {
-    const t = line.trim();
-    if (t === '' || t.startsWith('#')) continue;
+    const scanLine = activeEnvLineForKvScan(line);
+    if (!scanLine) continue;
     let m;
     kvPattern.lastIndex = 0;
-    while ((m = kvPattern.exec(line)) !== null) {
+    while ((m = kvPattern.exec(scanLine)) !== null) {
       keys.add(m[1]);
     }
   }

package/lib/utils/aifabrix-runtime-config-dir.js

@@ -88,7 +88,8 @@ function resolveAifabrixHomeLikePath(raw) {
     return path.normalize(expanded);
   }
   if (isExplicitRelativeToCwd(expanded)) {
-    return path.resolve(expanded);
+    // Use process.cwd() explicitly — Jest wraps cwd separately from path.resolve('.') (native getcwd).
+    return path.resolve(process.cwd(), expanded);
   }
   return path.resolve(safeHomedir(), expanded);
 }

package/lib/utils/compose-generate-docker-compose.js

@@ -153,7 +153,8 @@ function buildComposeTemplateContext(ctx) {
     useInfraPgpass: !!ctx.useInfraPgpass,
     workerSidecars: buildCeleryWorkerComposeContext(ctx.appName, ctx.appConfig, {
       devId: ctx.devId,
-      idNum: ctx.idNum
+      idNum: ctx.idNum,
+      envFilePath: ctx.envFileAbsolutePath
     })
   };
 }

package/lib/utils/config-paths.js

@@ -264,8 +264,8 @@ function createRemoteConfigGetters(getConfigFn) {
       return getPathConfig(getConfigFn, 'docker-endpoint');
     },
     /**
-     * When true, Docker CLI may use DOCKER_TLS_VERIFY=0 only when ca.pem is absent (no trust anchor).
-     * If ca.pem exists (e.g. after issue-cert), the daemon is always verified regardless of this flag.
+     * When true, Docker CLI uses DOCKER_TLS_VERIFY=0 (client certs still sent when present).
+     * Applies even when ca.pem exists (internal issue-cert CA vs public Docker daemon cert).
      */
     async getDockerTlsSkipVerify() {
       const envRaw = process.env.AIFABRIX_DOCKER_TLS_SKIP_VERIFY;

package/lib/utils/dev-ca-docker-augment.js

@@ -0,0 +1,54 @@
+/**
+ * Persist ca.pem after merging Docker daemon TLS trust (wildcard/public CA).
+ *
+ * @fileoverview Write augmented ca.pem for remote Docker
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fs = require('fs').promises;
+const path = require('path');
+const { normalizePemNewlines, getCertDir } = require('./dev-cert-helper');
+const {
+  resolveDockerEndpointForCaAugment,
+  augmentCaPemWithDockerDaemonChain,
+  writeDockerDaemonCaMarker
+} = require('./docker-daemon-tls-ca');
+
+/**
+ * @param {string} configDir
+ * @param {string} devId
+ * @param {string|null|undefined} existingCaPem
+ * @param {{ settings?: Object|null, remoteServerUrl?: string|null, warn?: (msg: string) => void }} ctx
+ * @returns {Promise<string|null>}
+ */
+async function augmentAndSaveCaPemForRemoteDocker(configDir, devId, existingCaPem, ctx) {
+  const dockerEndpoint = resolveDockerEndpointForCaAugment({
+    settings: ctx && ctx.settings,
+    remoteServerUrl: ctx && ctx.remoteServerUrl
+  });
+  if (!dockerEndpoint) {
+    return existingCaPem || null;
+  }
+
+  const augmented = await augmentCaPemWithDockerDaemonChain(existingCaPem, dockerEndpoint, {
+    warn: ctx && ctx.warn
+  });
+  if (!augmented || augmented === existingCaPem) {
+    return existingCaPem || null;
+  }
+
+  const certDir = getCertDir(configDir, devId);
+  await fs.mkdir(certDir, { recursive: true });
+  await fs.writeFile(
+    path.join(certDir, 'ca.pem'),
+    normalizePemNewlines(augmented),
+    { mode: 0o600 }
+  );
+  await writeDockerDaemonCaMarker(certDir);
+  return augmented;
+}
+
+module.exports = { augmentAndSaveCaPemForRemoteDocker };

package/lib/utils/docker-daemon-tls-ca.js

@@ -0,0 +1,326 @@
+/**
+ * Fetch Docker Engine TLS trust anchors when the daemon uses a public/wildcard server
+ * certificate (e.g. Sectigo *.aifabrix.dev) while issue-cert ca.pem holds the internal CA.
+ * Docker CLI verifies the daemon with ca.pem only (not the OS trust store).
+ *
+ * @fileoverview Docker daemon TLS CA chain for remote docker-endpoint
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const tls = require('tls');
+const { mergeCaPemBlocks } = require('./dev-cert-helper');
+
+const DEFAULT_DOCKER_TLS_PORT = 2376;
+const DEFAULT_FETCH_TIMEOUT_MS = 10000;
+/** Written under ~/.aifabrix/certs/<developer-id>/ when ca.pem includes Docker daemon trust. */
+const DOCKER_DAEMON_CA_MARKER = '.docker-daemon-ca-augmented';
+
+/**
+ * @param {Buffer|string} der
+ * @returns {string}
+ */
+function derCertToPem(der) {
+  const buf = Buffer.isBuffer(der) ? der : Buffer.from(der);
+  const lines = buf.toString('base64').match(/.{1,64}/g) || [];
+  return `-----BEGIN CERTIFICATE-----\n${lines.join('\n')}\n-----END CERTIFICATE-----`;
+}
+
+/**
+ * @param {import('tls').PeerCertificate} peerCert
+ * @returns {string[]}
+ */
+function collectIssuerChainPems(peerCert) {
+  const pems = [];
+  const seen = new Set();
+  let cert = peerCert && peerCert.issuerCertificate;
+  while (cert && cert.raw) {
+    const fp = cert.fingerprint256 || cert.fingerprint;
+    if (fp) {
+      if (seen.has(fp)) break;
+      seen.add(fp);
+    }
+    if (peerCert.fingerprint && cert.fingerprint === peerCert.fingerprint) break;
+    pems.push(derCertToPem(cert.raw));
+    const next = cert.issuerCertificate;
+    if (!next || next === cert) break;
+    cert = next;
+  }
+  return pems;
+}
+
+/**
+ * Parse docker-endpoint (tcp://host:port) into TLS connect parameters.
+ * @param {string} endpoint
+ * @returns {{ host: string, port: number, servername: string }|null}
+ */
+function parseDockerTlsEndpoint(endpoint) {
+  const trimmed = String(endpoint || '').trim();
+  if (!trimmed) return null;
+  const lower = trimmed.toLowerCase();
+  if (lower.startsWith('unix:')) return null;
+
+  let host = '';
+  let port = DEFAULT_DOCKER_TLS_PORT;
+
+  if (lower.startsWith('tcp://')) {
+    const rest = trimmed.slice(6).split('/')[0];
+    if (rest.startsWith('[')) {
+      const end = rest.indexOf(']');
+      if (end === -1) return null;
+      host = rest.slice(1, end);
+      const after = rest.slice(end + 1);
+      if (after.startsWith(':')) {
+        const p = parseInt(after.slice(1), 10);
+        if (!Number.isNaN(p)) port = p;
+      }
+    } else {
+      const colonIdx = rest.lastIndexOf(':');
+      if (colonIdx > 0 && /^\d+$/.test(rest.slice(colonIdx + 1))) {
+        port = parseInt(rest.slice(colonIdx + 1), 10);
+        host = rest.slice(0, colonIdx);
+      } else {
+        host = rest;
+      }
+    }
+  } else {
+    try {
+      const u = new URL(trimmed.includes('://') ? trimmed : `tcp://${trimmed}`);
+      host = u.hostname;
+      if (u.port) {
+        const p = parseInt(u.port, 10);
+        if (!Number.isNaN(p)) port = p;
+      }
+    } catch {
+      return null;
+    }
+  }
+
+  host = String(host || '').trim();
+  if (!host) return null;
+  return { host, port, servername: host };
+}
+
+/**
+ * @param {string} remoteServerUrl
+ * @returns {string|null}
+ */
+function dockerEndpointFromRemoteServer(remoteServerUrl) {
+  try {
+    const u = new URL(String(remoteServerUrl || '').trim().replace(/\/+$/, ''));
+    if (!u.hostname) return null;
+    return `tcp://${u.hostname}:${DEFAULT_DOCKER_TLS_PORT}`;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Resolve docker-endpoint for CA augmentation (settings override, else derive from remote-server).
+ * @param {{ settings?: Object|null, remoteServerUrl?: string|null }} ctx
+ * @returns {string|null}
+ */
+function resolveDockerEndpointForCaAugment(ctx) {
+  const settings = ctx && ctx.settings;
+  const fromSettings = settings && settings['docker-endpoint'];
+  if (typeof fromSettings === 'string' && fromSettings.trim()) {
+    return fromSettings.trim();
+  }
+  return dockerEndpointFromRemoteServer(ctx && ctx.remoteServerUrl);
+}
+
+/**
+ * Connect to Docker Engine TLS port and return issuer-chain PEM for daemon server verification.
+ * @param {string} dockerEndpoint - e.g. tcp://builder01.aifabrix.dev:2376
+ * @param {{ timeoutMs?: number }} [opts]
+ * @returns {Promise<string|null>}
+ */
+function fetchDockerDaemonTlsCaPem(dockerEndpoint, opts) {
+  const parsed = parseDockerTlsEndpoint(dockerEndpoint);
+  if (!parsed) {
+    return Promise.resolve(null);
+  }
+  const timeoutMs =
+    opts && typeof opts.timeoutMs === 'number' && opts.timeoutMs > 0
+      ? opts.timeoutMs
+      : DEFAULT_FETCH_TIMEOUT_MS;
+
+  return new Promise((resolve, reject) => {
+    let settled = false;
+
+    const socket = tls.connect(
+      {
+        host: parsed.host,
+        port: parsed.port,
+        servername: parsed.servername,
+        rejectUnauthorized: false
+      },
+      () => {
+        try {
+          const peer = socket.getPeerCertificate(true);
+          const chain = collectIssuerChainPems(peer);
+          socket.end();
+          finish(resolve, chain.length ? chain.join('\n\n') : null);
+        } catch (err) {
+          socket.destroy();
+          finish(reject, err);
+        }
+      }
+    );
+
+    const timer = setTimeout(() => {
+      socket.destroy(new Error(`Timed out fetching Docker daemon TLS chain (${timeoutMs}ms)`));
+    }, timeoutMs);
+
+    function finish(fn, value) {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      fn(value);
+    }
+
+    socket.on('error', (err) => {
+      finish(reject, err);
+    });
+  });
+}
+
+/**
+ * Merge Docker daemon public/wildcard trust anchors into ca.pem blocks.
+ * @param {string|null|undefined} existingCaPem
+ * @param {string|null|undefined} dockerEndpoint
+ * @param {{ timeoutMs?: number, warn?: (msg: string) => void }} [opts]
+ * @returns {Promise<string|null>}
+ */
+async function augmentCaPemWithDockerDaemonChain(existingCaPem, dockerEndpoint, opts) {
+  if (!dockerEndpoint || typeof dockerEndpoint !== 'string' || !dockerEndpoint.trim()) {
+    return existingCaPem || null;
+  }
+  try {
+    const dockerCaPem = await fetchDockerDaemonTlsCaPem(dockerEndpoint.trim(), opts);
+    if (!dockerCaPem) {
+      return existingCaPem || null;
+    }
+    return mergeCaPemBlocks(existingCaPem, dockerCaPem);
+  } catch (err) {
+    const warn = opts && typeof opts.warn === 'function' ? opts.warn : null;
+    const msg = err && err.message ? err.message : String(err);
+    if (warn) {
+      warn(
+        `Could not fetch Docker daemon TLS chain from ${dockerEndpoint.trim()} (${msg}). ` +
+          'Remote docker may fail until ca.pem includes the daemon trust anchor (re-run dev init or dev refresh).'
+      );
+    }
+    return existingCaPem || null;
+  }
+}
+
+/**
+ * Split PEM file into individual certificate blocks.
+ * @param {string} pem
+ * @returns {string[]}
+ */
+function splitPemCertificateBlocks(pem) {
+  if (!pem || typeof pem !== 'string') return [];
+  return pem
+    .replace(/\r\n/g, '\n')
+    .split(/(?=-----BEGIN CERTIFICATE-----)/)
+    .map((block) => block.trim())
+    .filter(Boolean);
+}
+
+/**
+ * True when existing ca.pem already contains every issuer from the live Docker daemon chain.
+ * @param {string|null|undefined} existingCaPem
+ * @param {string|null|undefined} dockerEndpoint
+ * @param {{ timeoutMs?: number }} [opts]
+ * @returns {Promise<boolean>}
+ */
+async function caPemTrustsDockerDaemon(existingCaPem, dockerEndpoint, opts) {
+  if (!existingCaPem || !dockerEndpoint) return false;
+  try {
+    const dockerChain = await fetchDockerDaemonTlsCaPem(dockerEndpoint.trim(), opts);
+    if (!dockerChain) return false;
+    const normalizedExisting = String(existingCaPem).replace(/\r\n/g, '\n');
+    const blocks = splitPemCertificateBlocks(dockerChain);
+    if (!blocks.length) return false;
+    return blocks.every((block) => normalizedExisting.includes(block));
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * @param {string} certDir
+ * @returns {Promise<void>}
+ */
+async function writeDockerDaemonCaMarker(certDir) {
+  const fs = require('fs').promises;
+  const markerPath = require('path').join(certDir, DOCKER_DAEMON_CA_MARKER);
+  await fs.writeFile(markerPath, `augmentedAt=${new Date().toISOString()}\n`, { mode: 0o600 });
+}
+
+/**
+ * Decide whether Docker CLI should verify the daemon certificate (DOCKER_TLS_VERIFY=1).
+ * When ca.pem holds only the internal issue-cert CA but the daemon uses a public/wildcard cert,
+ * returns false so client mTLS still works with DOCKER_TLS_VERIFY=0.
+ *
+ * @param {{ certDir: string, existingCaPem: string, dockerEndpoint: string|null, remoteServerUrl?: string|null, settings?: Object|null, skipVerify?: boolean }} ctx
+ * @returns {Promise<boolean>}
+ */
+async function resolveRemoteDockerDaemonVerify(ctx) {
+  if (ctx && ctx.skipVerify) return false;
+  const certDir = ctx && ctx.certDir;
+  const existingCaPem = ctx && ctx.existingCaPem;
+  if (!certDir || !existingCaPem) return false;
+
+  const fs = require('fs');
+  const path = require('path');
+  const markerPath = path.join(certDir, DOCKER_DAEMON_CA_MARKER);
+  if (fs.existsSync(markerPath)) return true;
+
+  const dockerEndpoint = resolveDockerEndpointForCaAugment({
+    settings: ctx.settings,
+    remoteServerUrl: ctx.remoteServerUrl
+  }) || (ctx.dockerEndpoint && String(ctx.dockerEndpoint).trim()) || null;
+  if (!dockerEndpoint) return true;
+
+  const fetchOpts = { timeoutMs: DEFAULT_FETCH_TIMEOUT_MS };
+  if (await caPemTrustsDockerDaemon(existingCaPem, dockerEndpoint, fetchOpts)) {
+    await writeDockerDaemonCaMarker(certDir);
+    return true;
+  }
+
+  const augmented = await augmentCaPemWithDockerDaemonChain(existingCaPem, dockerEndpoint, fetchOpts);
+  if (augmented && augmented !== existingCaPem) {
+    const { normalizePemNewlines } = require('./dev-cert-helper');
+    await fs.promises.writeFile(
+      path.join(certDir, 'ca.pem'),
+      normalizePemNewlines(augmented),
+      { mode: 0o600 }
+    );
+    await writeDockerDaemonCaMarker(certDir);
+    return true;
+  }
+
+  return false;
+}
+
+module.exports = {
+  DEFAULT_DOCKER_TLS_PORT,
+  DEFAULT_FETCH_TIMEOUT_MS,
+  DOCKER_DAEMON_CA_MARKER,
+  parseDockerTlsEndpoint,
+  dockerEndpointFromRemoteServer,
+  resolveDockerEndpointForCaAugment,
+  fetchDockerDaemonTlsCaPem,
+  augmentCaPemWithDockerDaemonChain,
+  caPemTrustsDockerDaemon,
+  writeDockerDaemonCaMarker,
+  resolveRemoteDockerDaemonVerify,
+  splitPemCertificateBlocks,
+  derCertToPem,
+  collectIssuerChainPems
+};

package/lib/utils/ensure-dev-certs-for-remote-docker.js

@@ -27,6 +27,7 @@ const {
   normalizePemNewlines
 } = require('./dev-cert-helper');
 const { isSslUntrustedError, fetchInstallCa } = require('./dev-ca-install');
+const { augmentAndSaveCaPemForRemoteDocker } = require('./dev-ca-docker-augment');
 
 /**
  * Read one-time issue-cert PIN from env or first non-empty line of AIFABRIX_DEV_ISSUE_PIN_FILE.
@@ -184,6 +185,10 @@ async function ensureDevCertsIfNeededForRemoteDocker() {
   const issueResponse = await requestIssueCert(ctx.baseUrl, ctx.devId, pin, csrPem, serverCaPem);
   const caPem = mergeCaPemBlocks(serverCaPem, issueResponse.caCertificate, issueResponse.ca);
   await saveDevCertMaterial(ctx.configDir, ctx.devId, issueResponse.certificate, keyPem, caPem);
+  await augmentAndSaveCaPemForRemoteDocker(ctx.configDir, ctx.devId, caPem, {
+    remoteServerUrl: ctx.baseUrl,
+    warn: (msg) => logger.log(chalk.yellow(`  ⚠ ${msg}`))
+  });
   logger.log(
     formatSuccessLine('Saved TLS material to ') + chalk.cyan(ctx.certDir) + chalk.green(' for remote Docker.\n')
   );