@aifabrix/builder 2.47.4 → 2.49.0

package/jest.isolated-projects.js

@@ -38,6 +38,10 @@ const ISOLATED_SUITE_ENTRIES = [
     'application-frontdoor-paths-contract',
     ['**/tests/lib/templates/application-frontdoor-paths.contract.test.js']
   ],
+  [
+    'dataplane-env-template-contract',
+    ['**/tests/lib/templates/dataplane-env-template.contract.test.js']
+  ],
   ['database-secret-values', ['**/tests/lib/parameters/database-secret-values.test.js']],
   ['infra-parameter-validate', ['**/tests/lib/parameters/infra-parameter-validate.test.js']],
   [
@@ -56,6 +60,8 @@ const ISOLATED_SUITE_ENTRIES = [
   ['secrets-ensure-catalog-fallback', ['**/tests/lib/core/secrets-ensure-catalog-fallback.test.js']],
   ['secrets-ensure', ['**/tests/lib/core/secrets-ensure.test.js']],
   ['url-declarative-vdir-inactive-env', ['**/tests/lib/utils/url-declarative-vdir-inactive-env.test.js']],
+  ['url-declarative-resolve-load-doc', ['**/tests/lib/utils/url-declarative-resolve-load-doc.test.js']],
+  ['compose-celery-worker', ['**/tests/lib/utils/compose-celery-worker.test.js']],
   [
     'url-declarative-user-cfg-per-app-proxy',
     ['**/tests/lib/utils/url-declarative-user-cfg-per-app-proxy.test.js']
@@ -75,6 +81,7 @@ const ISOLATED_SUITE_ENTRIES = [
   ['infra-kv-discovery', ['**/tests/lib/parameters/infra-kv-discovery.test.js']],
   ['infra-env-defaults', ['**/tests/lib/utils/infra-env-defaults.test.js']],
   ['compose-traefik-template', ['**/tests/lib/infrastructure/compose-traefik-template.test.js']],
+  ['traefik-tls-dynamic', ['**/tests/lib/infrastructure/traefik-tls-dynamic.test.js']],
   ['generator-external-rbac', ['**/tests/lib/generator/generator-external-rbac.test.js']],
   ['helpers-ensure-admin-secrets', ['**/tests/lib/infrastructure/helpers-ensure-admin-secrets.test.js']],
   ['secrets-generator', ['**/tests/lib/utils/secrets-generator.test.js']],

package/jest.projects.js

@@ -156,6 +156,14 @@ const defaultProject = {
       '\\\\tests\\\\lib\\\\utils\\\\url-declarative-vdir-inactive-env.test.js',
       'lib/utils/url-declarative-vdir-inactive-env.test.js',
       'url-declarative-vdir-inactive-env\\.test\\.js',
+      '/tests/lib/utils/url-declarative-resolve-load-doc.test.js',
+      '\\\\tests\\\\lib\\\\utils\\\\url-declarative-resolve-load-doc.test.js',
+      'lib/utils/url-declarative-resolve-load-doc.test.js',
+      'url-declarative-resolve-load-doc\\.test\\.js',
+      '/tests/lib/utils/compose-celery-worker.test.js',
+      '\\\\tests\\\\lib\\\\utils\\\\compose-celery-worker.test.js',
+      'lib/utils/compose-celery-worker.test.js',
+      'compose-celery-worker\\.test\\.js',
       '/tests/lib/utils/url-declarative-user-cfg-per-app-proxy.test.js',
       '\\\\tests\\\\lib\\\\utils\\\\url-declarative-user-cfg-per-app-proxy.test.js',
       'lib/utils/url-declarative-user-cfg-per-app-proxy.test.js',
@@ -200,6 +208,10 @@ const defaultProject = {
       '\\\\tests\\\\lib\\\\infrastructure\\\\compose-traefik-template.test.js',
       'lib/infrastructure/compose-traefik-template.test.js',
       'compose-traefik-template\\.test\\.js',
+      '/tests/lib/infrastructure/traefik-tls-dynamic.test.js',
+      '\\\\tests\\\\lib\\\\infrastructure\\\\traefik-tls-dynamic.test.js',
+      'lib/infrastructure/traefik-tls-dynamic.test.js',
+      'traefik-tls-dynamic\\.test\\.js',
       '/tests/lib/utils/paths-app-listing.test.js',
       '\\\\tests\\\\lib\\\\utils\\\\paths-app-listing.test.js',
       'lib/utils/paths-app-listing.test.js',
@@ -275,6 +287,10 @@ const defaultProject = {
       '\\\\tests\\\\lib\\\\templates\\\\application-frontdoor-paths.contract.test.js',
       'lib/templates/application-frontdoor-paths.contract.test.js',
       'application-frontdoor-paths\\.contract\\.test\\.js',
+      '/tests/lib/templates/dataplane-env-template.contract.test.js',
+      '\\\\tests\\\\lib\\\\templates\\\\dataplane-env-template.contract.test.js',
+      'lib/templates/dataplane-env-template.contract.test.js',
+      'dataplane-env-template\\.contract\\.test\\.js',
       '/tests/lib/core/admin-secrets.test.js',
       '\\\\tests\\\\lib\\\\core\\\\admin-secrets.test.js',
       'lib/core/admin-secrets.test.js',

package/lib/api/applications.api.js

@@ -142,6 +142,28 @@ async function registerApplication(controllerUrl, envKey, authConfig, registrati
   });
 }
 
+/**
+ * Bootstrap application in an environment (install-time, ENCRYPTION_KEY header).
+ * POST /api/v1/environments/{envKey}/applications/bootstrap
+ * @async
+ * @function bootstrapApplication
+ * @param {string} controllerUrl - Controller base URL
+ * @param {string} envKey - Environment key
+ * @param {string} encryptionKey - Shared ENCRYPTION_KEY (sent as x-encryption-key; never log)
+ * @param {Object} registrationData - Same body as register
+ * @returns {Promise<Object>} Bootstrap response
+ * @throws {Error} If bootstrap fails
+ */
+async function bootstrapApplication(controllerUrl, envKey, encryptionKey, registrationData) {
+  const client = new ApiClient(controllerUrl, {
+    type: 'bootstrap',
+    encryptionKey
+  });
+  return await client.post(`/api/v1/environments/${envKey}/applications/bootstrap`, {
+    body: registrationData
+  });
+}
+
 /**
  * Rotate application secret
  * POST /api/v1/environments/{envKey}/applications/{appKey}/rotate-secret
@@ -187,6 +209,7 @@ module.exports = {
   updateApplication,
   deleteApplication,
   registerApplication,
+  bootstrapApplication,
   rotateApplicationSecret,
   getApplicationStatus
 };

package/lib/api/dev.api.js

@@ -198,7 +198,7 @@ async function listUsers(serverUrl, clientCertPem, serverCaPem) {
  * @requiresPermission {BuilderServer} Client certificate (X-Client-Cert)
  * @param {string} serverUrl - Builder Server base URL
  * @param {string} clientCertPem - PEM client certificate
- * @param {Object} body - CreateUserDto: developerId, name, email, optional groups (admin | secret-manager | developer | docker)
+ * @param {Object} body - CreateUserDto: developerId, name, email, optional groups (admin | secret-manager | secret-reader | developer | docker)
  * @param {string} [serverCaPem] - Dev root CA PEM
  * @returns {Promise<Object>} UserResponseDto
  */

package/lib/api/index.js

@@ -17,8 +17,9 @@ class ApiClient {
    * App endpoints receive token-only auth (Bearer). x-client-id/x-client-secret are used only for the controller token endpoint.
    * @param {string} baseUrl - Base URL for the API (controller URL)
    * @param {Object} [authConfig] - Authentication configuration
-   * @param {string} [authConfig.type] - Auth type ('bearer' | 'client-token' | 'client-credentials')
+   * @param {string} [authConfig.type] - Auth type ('bearer' | 'client-token' | 'client-credentials' | 'bootstrap')
    * @param {string} [authConfig.token] - Bearer token
+   * @param {string} [authConfig.encryptionKey] - Shared ENCRYPTION_KEY (bootstrap only; never log)
    * @param {string} [authConfig.clientId] - Client ID (client-credentials)
    * @param {string} [authConfig.clientSecret] - Client secret (client-credentials)
    */
@@ -79,7 +80,9 @@ class ApiClient {
     }
 
     // User token (bearer) → Authorization: Bearer; application token (client-token) → x-client-token
-    if (this.authConfig.token) {
+    if (this.authConfig.type === 'bootstrap' && this.authConfig.encryptionKey) {
+      headers['x-encryption-key'] = String(this.authConfig.encryptionKey);
+    } else if (this.authConfig.token) {
       if (this.authConfig.type === 'client-token') {
         headers['x-client-token'] = this.authConfig.token;
       } else {

package/lib/api/types/dev.types.js

@@ -31,7 +31,8 @@
  * @property {string} aifabrix-env-config - Env config path
  * @property {string} remote-server - Builder-server base URL
  * @property {string} docker-endpoint - Docker API endpoint
- * @property {boolean} [docker-tls-skip-verify] - When true and ca.pem is absent, Docker uses DOCKER_TLS_VERIFY=0; if ca.pem exists, daemon is always verified
+ * @property {string} [developer-root-domain] - App hostname root (e.g. aifabrix.dev → dev01.aifabrix.dev)
+ * @property {boolean} [docker-tls-skip-verify] - When true, Docker uses DOCKER_TLS_VERIFY=0 even if ca.pem exists (client mTLS unchanged)
  * @property {string} sync-ssh-user - SSH user for Mutagen
  * @property {string} sync-ssh-host - SSH host for Mutagen
  */
@@ -45,7 +46,7 @@
  * @property {string} createdAt - ISO 8601
  * @property {boolean} certificateIssued - Whether cert was issued
  * @property {string} [certificateValidNotAfter] - Cert validity end (optional)
- * @property {string[]} groups - Access groups (admin, secret-manager, developer, docker)
+ * @property {string[]} groups - Access groups (admin, secret-manager, secret-reader, developer, docker)
  */
 
 /**
@@ -54,7 +55,7 @@
  * @property {string} developerId - Unique developer ID (numeric string)
  * @property {string} name - Display name
  * @property {string} email - Email
- * @property {string[]} [groups] - Default [developer]; tokens: admin, secret-manager, developer, docker
+ * @property {string[]} [groups] - Default [developer]; tokens: admin, secret-manager, secret-reader, developer, docker
  */
 
 /**

package/lib/app/deploy-config.js

@@ -80,7 +80,8 @@ async function extractDeploymentConfig(options, _variables) {
     repositoryUrl: options.repositoryUrl,
     // Omit default here so deployer can resolve 2s vs 5s from controller deploymentType (GET /api/v1/health)
     pollInterval: Number.isFinite(pollIntervalExplicit) ? pollIntervalExplicit : undefined,
-    pollMaxAttempts: options.pollMaxAttempts || 60
+    pollMaxAttempts: options.pollMaxAttempts || 60,
+    deploymentAuth: options.deploymentAuth
   };
 }
 
@@ -118,7 +119,7 @@ async function configureDeploymentEnvironment(_options, deploymentConfig) {
  * @returns {Promise<void>}
  * @throws {Error} If authentication fails
  */
-async function refreshDeploymentToken(appName, deploymentConfig) {
+async function refreshDeploymentToken(appName, deploymentConfig, options = {}) {
   if (!deploymentConfig.controllerUrl) {
     throw new Error('Controller URL is required. Run "aifabrix login" to set the controller URL in config.yaml');
   }
@@ -127,7 +128,8 @@ async function refreshDeploymentToken(appName, deploymentConfig) {
     const authConfig = await getDeploymentAuth(
       deploymentConfig.controllerUrl,
       deploymentConfig.envKey,
-      appName
+      appName,
+      { deploymentAuth: options.deploymentAuth || deploymentConfig.deploymentAuth }
     );
     if (!authConfig || !authConfig.controller) {
       throw new Error('Invalid authentication configuration: missing controller URL');
@@ -159,7 +161,7 @@ async function loadDeploymentConfig(appName, options) {
   const deploymentConfig = await extractDeploymentConfig(options, variables);
 
   await configureDeploymentEnvironment(options, deploymentConfig);
-  await refreshDeploymentToken(appName, deploymentConfig);
+  await refreshDeploymentToken(appName, deploymentConfig, options);
 
   validateDeploymentConfig(deploymentConfig);
 

package/lib/app/register.js

@@ -78,38 +78,40 @@ function buildRegistrationData(appConfig, options) {
 }
 
 /**
- * Save credentials to local secrets if localhost
+ * Save pipeline client credentials to ~/.aifabrix/secrets.local.yaml (always).
+ * env.template / in-memory resolve validation runs only for localhost controllers.
  * @async
  * @param {Object} responseData - Registration response data
  * @param {string} apiUrl - API URL
  */
 async function saveLocalCredentials(responseData, apiUrl) {
-  if (!isLocalhost(apiUrl)) {
-    return;
-  }
-
   const registeredAppKey = responseData.application.key;
   const clientIdKey = `${registeredAppKey}-client-idKeyVault`;
   const clientSecretKey = `${registeredAppKey}-client-secretKeyVault`;
+  const localhostController = isLocalhost(apiUrl);
 
   try {
     await saveLocalSecret(clientIdKey, responseData.credentials.clientId);
     await saveLocalSecret(clientSecretKey, responseData.credentials.clientSecret);
 
-    // Update env.template (kv:// refs only; no resolved values touch disk)
-    await updateEnvTemplate(registeredAppKey, clientIdKey, clientSecretKey, apiUrl);
-
-    // Resolve in-memory so any missing-secret / kv:// error surfaces here, but never
-    // materialize <appPath>/.env or envOutputPath — that is only done by `aifabrix resolve`.
-    try {
-      await generateEnvFile(registeredAppKey, null, 'local', true, { noWrite: true });
-    } catch (error) {
-      logger.warn(chalk.yellow(`⚠  Could not validate env resolution: ${error.message}`));
+    if (localhostController) {
+      // Update env.template (kv:// refs only; no resolved values touch disk)
+      await updateEnvTemplate(registeredAppKey, clientIdKey, clientSecretKey, apiUrl);
+
+      // Resolve in-memory so any missing-secret / kv:// error surfaces here, but never
+      // materialize <appPath>/.env or envOutputPath — that is only done by `aifabrix resolve`.
+      try {
+        await generateEnvFile(registeredAppKey, null, 'local', true, { noWrite: true });
+      } catch (error) {
+        logger.warn(chalk.yellow(`⚠  Could not validate env resolution: ${error.message}`));
+      }
+
+      logger.log(formatSuccessParagraph('Credentials saved to ~/.aifabrix/secrets.local.yaml'));
+      logger.log(formatSuccessLine('env.template updated with MISO_CLIENTID, MISO_CLIENTSECRET, and MISO_CONTROLLER_URL'));
+      logger.log(formatSuccessLine('Run "aifabrix resolve ' + registeredAppKey + '" to materialize an on-disk .env\n'));
+    } else {
+      logger.log(formatSuccessParagraph('Credentials saved to ~/.aifabrix/secrets.local.yaml\n'));
     }
-
-    logger.log(formatSuccessParagraph('Credentials saved to ~/.aifabrix/secrets.local.yaml'));
-    logger.log(formatSuccessLine('env.template updated with MISO_CLIENTID, MISO_CLIENTSECRET, and MISO_CONTROLLER_URL'));
-    logger.log(formatSuccessLine('Run "aifabrix resolve ' + registeredAppKey + '" to materialize an on-disk .env\n'));
   } catch (error) {
     logger.warn(chalk.yellow(`⚠  Could not save credentials locally: ${error.message}`));
   }
@@ -197,5 +199,5 @@ async function registerApplication(appKey, options = {}) {
   displayRegistrationResults(responseData, authConfig.apiUrl, environment, registrationData.displayName);
 }
 
-module.exports = { registerApplication, getEnvironmentPrefix };
+module.exports = { registerApplication, getEnvironmentPrefix, buildRegistrationData, saveLocalCredentials, applyLocalhostPortAdjustment };
 

package/lib/app/rotate-secret.js

@@ -63,16 +63,34 @@ function validateEnvironment(environment) {
   }
 }
 
+/**
+ * @param {number} code
+ * @param {string} message
+ * @param {{ exitOnFailure?: boolean }} [options]
+ * @throws {Error}
+ */
+function failRotation(code, message, options = {}) {
+  if (options.exitOnFailure === false) {
+    throw new Error(message);
+  }
+  logger.error(formatBlockingError(message));
+  process.exit(code);
+}
+
 /**
  * Resolve controller URL and environment from config; exit if controller is missing.
  * @async
+ * @param {{ exitOnFailure?: boolean }} [options]
  * @returns {Promise<{controllerUrl: string, environment: string}>}
  */
-async function resolveControllerAndEnvironment() {
+async function resolveControllerAndEnvironment(options = {}) {
   const controllerUrl = await resolveControllerUrl();
   if (!controllerUrl) {
-    logger.error(formatBlockingError('Controller URL is required. Run "aifabrix login" to set the controller URL in config.yaml'));
-    process.exit(1);
+    failRotation(
+      1,
+      'Controller URL is required. Run "aifabrix login" to set the controller URL in config.yaml',
+      options
+    );
   }
   const environment = await resolveEnvironment();
   validateEnvironment(environment);
@@ -197,9 +215,10 @@ function displayRotationResults(appKey, environment, credentials, apiUrl, messag
  * Get device token from provided controller URL
  * @async
  * @param {string} controllerUrl - Controller URL
+ * @param {{ exitOnFailure?: boolean }} [options]
  * @returns {Promise<Object|null>} Object with token and controllerUrl, or null if failed
  */
-async function getTokenFromUrl(controllerUrl) {
+async function getTokenFromUrl(controllerUrl, options = {}) {
   try {
     const normalizedUrl = normalizeControllerUrl(controllerUrl);
     const deviceToken = await getOrRefreshDeviceToken(normalizedUrl);
@@ -210,9 +229,7 @@ async function getTokenFromUrl(controllerUrl) {
       };
     }
   } catch (error) {
-    logger.error(formatBlockingError(`Failed to authenticate with controller: ${controllerUrl}`));
-    logger.error(chalk.gray(`Error: ${error.message}`));
-    process.exit(1);
+    failRotation(1, `Failed to authenticate with controller: ${controllerUrl} (${error.message})`, options);
   }
   return null;
 }
@@ -222,9 +239,13 @@ async function getTokenFromUrl(controllerUrl) {
  * @param {string|null} token - Authentication token
  * @param {string|null} controllerUrl - Controller URL
  * @param {string} [providedUrl] - Original provided URL for error context
+ * @param {{ exitOnFailure?: boolean }} [options]
  */
-function validateAuthToken(token, controllerUrl, providedUrl) {
+function validateAuthToken(token, controllerUrl, providedUrl, options = {}) {
   if (!token || !controllerUrl) {
+    if (options.exitOnFailure === false) {
+      throw new Error('No valid authentication found');
+    }
     const formattedError = formatAuthenticationError({
       controllerUrl: providedUrl || undefined,
       message: 'No valid authentication found'
@@ -239,16 +260,17 @@ function validateAuthToken(token, controllerUrl, providedUrl) {
  * @async
  * @param {string} [controllerUrl] - Optional controller URL
  * @param {Object} config - Configuration object
+ * @param {{ exitOnFailure?: boolean }} [options]
  * @returns {Promise<Object>} Object with token and actualControllerUrl
  * @throws {Error} If authentication fails
  */
-async function getRotationAuthToken(controllerUrl, config) {
+async function getRotationAuthToken(controllerUrl, config, options = {}) {
   let token = null;
   let actualControllerUrl = null;
 
   // If controller URL provided, try to get device token
   if (controllerUrl) {
-    const tokenResult = await getTokenFromUrl(controllerUrl);
+    const tokenResult = await getTokenFromUrl(controllerUrl, options);
     if (tokenResult) {
       token = tokenResult.token;
       actualControllerUrl = tokenResult.controllerUrl;
@@ -264,7 +286,7 @@ async function getRotationAuthToken(controllerUrl, config) {
     }
   }
 
-  validateAuthToken(token, actualControllerUrl, controllerUrl);
+  validateAuthToken(token, actualControllerUrl, controllerUrl, options);
   return { token, actualControllerUrl };
 }
 
@@ -323,6 +345,9 @@ async function executeRotation(appKey, actualControllerUrl, environment, token,
 
   if (!response.success) {
     const formattedError = response.formattedError || formatApiError(response, actualControllerUrl);
+    if (options.exitOnFailure === false) {
+      throw new Error(formattedError || `Rotate secret failed for ${appKey}`);
+    }
     logger.error(formattedError);
     logger.error(chalk.gray(`\nController URL: ${actualControllerUrl}`));
     process.exit(1);
@@ -351,16 +376,14 @@ async function rotateSecret(appKey, options = {}) {
   const { ensureSecretsEncryptionKey } = require('../core/config');
   await ensureSecretsEncryptionKey();
 
-  const { controllerUrl, environment } = await resolveControllerAndEnvironment();
+  const { controllerUrl, environment } = await resolveControllerAndEnvironment(options);
   const config = await getConfig();
-  const { token, actualControllerUrl } = await getRotationAuthToken(controllerUrl, config);
+  const { token, actualControllerUrl } = await getRotationAuthToken(controllerUrl, config, options);
 
   try {
     await executeRotation(appKey, actualControllerUrl, environment, token, options);
   } catch (error) {
-    logger.error(formatBlockingError(`Failed to rotate secret via controller: ${actualControllerUrl}`));
-    logger.error(chalk.gray(`Error: ${error.message}`));
-    process.exit(1);
+    failRotation(1, `Failed to rotate secret via controller: ${actualControllerUrl} (${error.message})`, options);
   }
 }
 

package/lib/app/run-container-start.js

@@ -112,15 +112,6 @@ async function waitForHealthyAndCleanupEnvFiles(appName, port, appConfig, o) {
   logger.log(formatSuccessLine(`Container ${containerName} started`));
   await containerHelpers.logContainerStatus(containerName, debug);
 
-  const healthCheckPath = appConfig?.healthCheck?.path || '/health';
-  const healthUrl = (typeof healthCheck.computeHealthCheckUrl === 'function')
-    ? await healthCheck.computeHealthCheckUrl(appName, port, appConfig, { runOptions: ro })
-    : null;
-  // Keep a stable fallback in the message if URL computation fails for any reason.
-  const displayUrl = (healthUrl && typeof healthUrl === 'string')
-    ? healthUrl
-    : `http://localhost:${port}${healthCheckPath}`;
-  logger.log(formatProgress(`Waiting for healthy: ${displayUrl}…`));
   await healthCheck.waitForHealthCheck(appName, 90, port, appConfig, debug, ro);
 
   for (const p of [runEnvPath, runEnvAdminPath]) {

package/lib/app/run-helpers.js

@@ -290,8 +290,10 @@ function calculateComposePort(options, appConfig, developerId) {
  * @param {string} devDir - Dev directory path
  * @returns {Promise<string>} Path to compose file
  */
-async function generateComposeFile(appName, appConfig, composeOptions, devDir) {
-  logger.log(formatProgress('Generating Docker Compose configuration…'));
+async function generateComposeFile(appName, appConfig, composeOptions, devDir, logOpts = {}) {
+  if (!logOpts.suppressProgressLog) {
+    logger.log(formatProgress('Generating Docker Compose configuration…'));
+  }
   const composeContent = await composeGenerator.generateDockerCompose(appName, appConfig, composeOptions);
   runEnvCompose.assertNoPasswordLiteralsInCompose(composeContent);
   const tempComposePath = path.join(devDir, 'docker-compose.yaml');
@@ -352,7 +354,7 @@ async function prepareEnvironment(appName, appConfig, options) {
   );
 
   runEnvCompose.cleanApplicationsDir(developerId);
-  logger.log(formatProgress('Building merged .env (admin + app secrets)…'));
+  logger.log(formatProgress('Preparing run environment (env + compose)…'));
   const { runEnvPath, runEnvAdminPath } = await runEnvCompose.buildMergedRunEnvAndWrite(
     appName,
     appConfig,
@@ -370,7 +372,9 @@ async function prepareEnvironment(appName, appConfig, options) {
     omitAppTraefikLabels: userCfg.traefik === false
   };
   composeOptions.port = calculateComposePort(composeOptions, appConfig, developerId);
-  const composePath = await generateComposeFile(appName, appConfig, composeOptions, devDir);
+  const composePath = await generateComposeFile(appName, appConfig, composeOptions, devDir, {
+    suppressProgressLog: true
+  });
 
   await writeEnvOutputIfConfigured(appName, appConfig, runEnvPath, options);
 

package/lib/app/run-reload-sync.js

@@ -9,16 +9,15 @@
 'use strict';
 
 const chalk = require('chalk');
-const { formatProgress } = require('../utils/cli-test-layout-chalk');
+const { formatProgress, metadata } = require('../utils/cli-test-layout-chalk');
 const config = require('../core/config');
 const logger = require('../utils/logger');
 const mutagen = require('../utils/mutagen');
 const pathsUtil = require('../utils/paths');
 const {
   isReloadBindMountOnEngineHost,
-  isLocalhostSyncSshHost
+  isHostOnThisMachine
 } = require('../utils/docker-reload-mount');
-const { sectionTitle, headerKeyValue, metadata } = require('../utils/cli-test-layout-chalk');
 
 /**
  * @typedef {Object} ReloadSyncSummaryBind
@@ -109,9 +108,11 @@ async function ensureReloadSync(appName, developerId, debug, codePath, remoteSyn
     return { transport: 'bind-mount', hostPath: codePath };
   }
   const syncSshHost = await config.getSyncSshHost();
-  if (isLocalhostSyncSshHost(syncSshHost || '')) {
+  if (isHostOnThisMachine(syncSshHost || '')) {
     if (debug) {
-      logger.log(chalk.gray('[DEBUG] sync-ssh-host is localhost; skipping Mutagen, using local path'));
+      logger.log(
+        chalk.gray('[DEBUG] sync-ssh-host is this machine; skipping Mutagen, using local path')
+      );
     }
     return { transport: 'bind-mount', hostPath: codePath };
   }
@@ -127,22 +128,19 @@ function logReloadDevSummary(reload, summary) {
   if (!reload || !summary) {
     return;
   }
-  logger.log('');
-  logger.log(sectionTitle('Reload (dev)'));
   if (summary.transport === 'bind-mount') {
-    logger.log(headerKeyValue('Transport:', 'Direct bind mount on the Docker host (no Mutagen).'));
-    logger.log(headerKeyValue('Host path → container:', `${summary.hostPath} → /app`));
-    logger.log(metadata('Edits under the host path are visible inside the container immediately.'));
-    logger.log('');
+    logger.log(
+      metadata(
+        'Reload (dev) — Edits under the host path are visible inside the container immediately.'
+      )
+    );
     return;
   }
-  logger.log(headerKeyValue('Transport:', 'Mutagen two-way sync (Docker engine on another host).'));
-  logger.log(headerKeyValue('Session:', summary.sessionName));
-  logger.log(headerKeyValue('Sync host:', summary.syncSshHost));
-  logger.log(headerKeyValue('Local folder:', summary.localPath));
-  logger.log(headerKeyValue('Remote mount (-v):', summary.remotePath));
-  logger.log(metadata(`Mutagen endpoint: ${summary.sshUrl}`));
-  logger.log('');
+  logger.log(
+    metadata(
+      `Reload (dev) — Mutagen sync (${summary.sessionName}); edits sync to ${summary.remotePath} before the container sees them.`
+    )
+  );
 }
 
 module.exports = { ensureReloadSync, logReloadDevSummary };

package/lib/app/run-stop-containers.js

@@ -8,7 +8,10 @@
 
 'use strict';
 
-const { formatWarningLine } = require('../utils/cli-test-layout-chalk');
+const {
+  formatProgress,
+  formatSuccessLine
+} = require('../utils/cli-test-layout-chalk');
 const config = require('../core/config');
 const logger = require('../utils/logger');
 const containerHelpers = require('../utils/app-run-containers');
@@ -16,6 +19,34 @@ const helpers = require('./run-helpers');
 const { computeEffectiveEnvironmentScopedResources } = require('../utils/environment-scoped-resources');
 const { getCeleryCompanionAppKeys } = require('../utils/celery-companion-apps');
 
+function shouldUseReplaceContainerSpinner() {
+  return Boolean(process && process.stdout && process.stdout.isTTY);
+}
+
+/**
+ * @param {string} progressText
+ * @param {string} successText
+ * @param {() => Promise<void>} work
+ * @returns {Promise<void>}
+ */
+async function runContainerReplaceLine(progressText, successText, work) {
+  if (shouldUseReplaceContainerSpinner()) {
+    const ora = require('ora');
+    const spinner = ora({ text: progressText, spinner: 'dots' }).start();
+    try {
+      await work();
+      spinner.succeed(successText);
+    } catch (error) {
+      spinner.fail(progressText.replace(/…$/, '').trim());
+      throw error;
+    }
+    return;
+  }
+  logger.log(formatProgress(progressText));
+  await work();
+  logger.log(formatSuccessLine(successText));
+}
+
 /**
  * @param {Object} appConfig
  * @param {Object} options
@@ -62,8 +93,14 @@ async function findRunningCompanionKeys(companionKeys, developerId, debug, scope
 async function stopCompanionContainers(companionKeys, developerId, debug, scopeOpts) {
   for (const companionKey of companionKeys) {
     const companionName = containerHelpers.getContainerName(companionKey, developerId, scopeOpts);
-    logger.log(formatWarningLine(`Stopping companion container ${companionName}`));
-    await helpers.stopAndRemoveContainer(companionKey, developerId, debug, scopeOpts);
+    await runContainerReplaceLine(
+      `Stopping companion container ${companionName}…`,
+      `Companion container ${companionName} stopped and removed`,
+      () =>
+        helpers.stopAndRemoveContainer(companionKey, developerId, debug, scopeOpts, {
+          suppressLog: true
+        })
+    );
   }
 }
 
@@ -101,8 +138,14 @@ async function checkAndStopContainer(appName, appConfig, options, debug) {
     return;
   }
   const containerName = containerHelpers.getContainerName(appName, developerId, scopeOpts);
-  logger.log(formatWarningLine(`Container ${containerName} is already running`));
-  await helpers.stopAndRemoveContainer(appName, developerId, debug, scopeOpts);
+  await runContainerReplaceLine(
+    `Replacing running container ${containerName}…`,
+    `Container ${containerName} stopped and removed`,
+    () =>
+      helpers.stopAndRemoveContainer(appName, developerId, debug, scopeOpts, {
+        suppressLog: true
+      })
+  );
 }
 
 module.exports = {

package/lib/app/run.js

@@ -29,7 +29,7 @@ const { ensureReloadSync, logReloadDevSummary } = require('./run-reload-sync');
 const { logRestartDevMountSummary } = require('./restart-display');
 const { checkAndStopContainer } = require('./run-stop-containers');
 const { execWithDockerEnv } = require('../utils/docker-exec');
-const { isRunCliNoProxy } = require('../utils/run-cli-flags');
+const { resolveRunProxyPersistEnabled, resolveRunEffectiveNoProxy } = require('../utils/run-cli-flags');
 
 /**
  * True if host is localhost or 127.0.0.1 (case-insensitive).
@@ -347,7 +347,10 @@ async function prepareAppRun(appName, options, debug) {
   }
   let userCfg = await config.getConfig();
   const appsDefaults = require('../utils/applications-config-defaults');
-  await appsDefaults.persistApplicationRunProxyFlag(appName, !isRunCliNoProxy(options));
+  await appsDefaults.persistApplicationRunProxyFlag(
+    appName,
+    resolveRunProxyPersistEnabled(options, userCfg)
+  );
   if (envKey === 'dev') {
     await appsDefaults.persistApplicationReloadFlag(appName, options.reload === true);
   }
@@ -356,7 +359,7 @@ async function prepareAppRun(appName, options, debug) {
   const mergedOpts = {
     ...options,
     reload: options.reload === true,
-    noProxy: isRunCliNoProxy(options) || !savedProxyHint
+    noProxy: resolveRunEffectiveNoProxy(options, userCfg, savedProxyHint)
   };
   logger.log('');
   logger.log(sectionTitle('Run'));

package/lib/app/show.js

@@ -45,11 +45,11 @@ const {
  * @param {Object} userCfg
  */
 function attachRunDefaultsFromUserConfig(summary, appKey, userCfg) {
-  const { isApplicationsReloadDefaultOn, getApplicationsRunProxyHint } = require('../utils/applications-config-defaults');
+  const { isApplicationsReloadDefaultOn, getEffectiveApplicationsRunProxyHint } = require('../utils/applications-config-defaults');
   if (isApplicationsReloadDefaultOn(userCfg, appKey)) {
     summary.runReloadDefault = true;
   }
-  summary.runProxyDefault = getApplicationsRunProxyHint(userCfg, appKey);
+  summary.runProxyDefault = getEffectiveApplicationsRunProxyHint(userCfg, appKey);
 }
 
 /**