@aifabrix/builder 2.47.4 → 2.49.0

package/lib/cli/infra-guided.js

@@ -10,10 +10,7 @@ const config = require('../core/config');
 const devConfig = require('../utils/dev-config');
 const pathsUtil = require('../utils/paths');
 const { loadConfigFile } = require('../utils/config-format');
-const { computeAppBaseUrl, resolvePlatformControllerUrl } = require('../utils/platform-controller-url');
 const { withMutedLogger } = require('../utils/with-muted-logger');
-const { formatProgress, formatSuccessLine, successGlyph } = require('../utils/cli-test-layout-chalk');
-const ora = require('ora');
 const infra = require('../infrastructure');
 const { execWithDockerEnv } = require('../utils/docker-exec');
 const { getLogLevel, passesLevelFilter } = require('../commands/app-logs');
@@ -23,6 +20,26 @@ const {
   runGuidedAuthStep,
   runGuidedDataplaneWithAuthRecovery
 } = require('./infra-guided-auth');
+const {
+  startSpinner,
+  stopSpinnerSuccess,
+  createSpinnerTextUpdater
+} = require('./infra-guided-spinners');
+const {
+  SEPARATOR,
+  title,
+  logSection,
+  logFooterStart,
+  logFooterEnd,
+  resolvePlatformControllerUrlForDisplay,
+  logPlatformReadyFooter,
+  logMisoReadyFooter,
+  logDataplaneReadyFooter,
+  logPlatformSetupDurationHint,
+  logGuidedPlatformSetupHeader,
+  logUpPlatformForceCleanSummary,
+  logStoppedServices
+} = require('./infra-guided-footers');
 const healthCheck = require('../utils/health-check');
 const { prepareUrlsLocalRegistryForUpPlatform } = require('../commands/up-common');
 const { assertDevInfraUp } = require('../commands/dev-infra-gate');
@@ -30,32 +47,6 @@ const {
   emitSystemBuilderAppManifestLineIfTTY
 } = require('../utils/manifest-source-emit');
 
-const SEPARATOR = '────────────────────────────────────────';
-
-function title(text) {
-  return chalk.bold(text);
-}
-
-function shouldUseSpinner() {
-  return Boolean(process && process.stdout && process.stdout.isTTY);
-}
-
-function startSpinner(text) {
-  if (!shouldUseSpinner()) {
-    logger.log(formatProgress(text));
-    return null;
-  }
-  return ora({ text, spinner: 'dots' }).start();
-}
-
-function stopSpinnerSuccess(spinner, text) {
-  if (!spinner) {
-    logger.log(formatSuccessLine(text));
-    return;
-  }
-  spinner.succeed(text);
-}
-
 async function getRunningContainerNameForApp(appName) {
   const apps = await infra.getAppStatus();
   const hit = (apps || []).find(a => a && a.name === appName && a.container);
@@ -124,84 +115,10 @@ function resolveInfraHost(remoteServer) {
     const u = new URL(withScheme);
     return u.hostname || 'localhost';
   } catch {
-    // Fallback for non-URL strings.
     return raw.replace(/^https?:\/\//i, '').split('/')[0].split(':')[0] || 'localhost';
   }
 }
 
-/**
- * Prefer stored platform controller URL, then compute from routing rules.
- * @async
- * @returns {Promise<string>}
- */
-async function resolvePlatformControllerUrlForDisplay() {
-  const stored = await config.getPlatformControllerUrl();
-  if (stored) {
-    return stored;
-  }
-  return resolvePlatformControllerUrl();
-}
-
-function logSection(label, value) {
-  logger.log(title(label));
-  logger.log(`  ${value}`);
-  logger.log('');
-}
-
-function logFooterStart(label) {
-  logger.log('');
-  logger.log(SEPARATOR);
-  logger.log(title(label));
-  logger.log(SEPARATOR);
-  logger.log('');
-}
-
-function logFooterEnd() {
-  logger.log(SEPARATOR);
-}
-
-async function logPlatformReadyFooter() {
-  const [controllerUrl, dataplaneUrl, keycloakUrl] = await Promise.all([
-    resolvePlatformControllerUrlForDisplay(),
-    computeAppBaseUrl('dataplane'),
-    computeAppBaseUrl('keycloak')
-  ]);
-  const cfg = await config.getConfig();
-  const env = (cfg && cfg.environment) ? cfg.environment : 'dev';
-
-  logFooterStart('Platform Ready');
-  logSection('Environment', env);
-  logSection('Miso Controller', controllerUrl);
-  logSection('Dataplane (DEV)', dataplaneUrl);
-  logSection('Keycloak', keycloakUrl);
-  logSection('API Documentation', `${dataplaneUrl}/api/docs`);
-  logSection('Knowledge Base', 'https://docs.aifabrix.ai');
-  logSection('Getting Started', 'https://docs.aifabrix.ai/get-started');
-  logFooterEnd();
-}
-
-async function logMisoReadyFooter() {
-  const [controllerUrl, keycloakUrl] = await Promise.all([
-    resolvePlatformControllerUrlForDisplay(),
-    computeAppBaseUrl('keycloak')
-  ]);
-  logFooterStart('Miso Ready');
-  logSection('Miso Controller', controllerUrl);
-  logSection('Keycloak', keycloakUrl);
-  logFooterEnd();
-}
-
-async function logDataplaneReadyFooter() {
-  const dataplaneUrl = await computeAppBaseUrl('dataplane');
-  const cfg = await config.getConfig();
-  const env = (cfg && cfg.environment) ? cfg.environment : 'dev';
-  logFooterStart('Dataplane Ready');
-  logSection('Environment', env);
-  logSection('Dataplane (DEV)', dataplaneUrl);
-  logSection('API Documentation', `${dataplaneUrl}/api/docs`);
-  logFooterEnd();
-}
-
 async function getInfraHostAndPorts() {
   const developerId = await config.getDeveloperId();
   const idNum = typeof developerId === 'string' ? parseInt(developerId, 10) : developerId;
@@ -269,17 +186,12 @@ async function runGuidedUpMiso(options, handleUpMiso) {
   await validateAppErrorLogs(['miso-controller']);
 }
 
-/**
- * Infra must be checked before auth: device login talks to the controller, which needs
- * Postgres/Redis when the controller runs locally — a down infra looks like "network error".
- */
 async function assertDevInfraForGuidedDataplane() {
   const infraSpin = startSpinner('Checking infrastructure...');
   try {
     await assertDevInfraUp({ quietSuccess: true });
     stopSpinnerSuccess(infraSpin, 'Infrastructure is up');
   } catch (infraErr) {
-    // Match up-miso: one error block from handleCommandError only (no spinner.fail / extra hints).
     if (infraSpin) infraSpin.stop();
     throw infraErr;
   }
@@ -293,17 +205,18 @@ async function runGuidedUpDataplane(options, handleUpDataplane) {
   logPlatformSetupDurationHint('dataplane');
   logger.log('');
   await assertDevInfraForGuidedDataplane();
-  // Avoid an outer long-running spinner here: up-dataplane has multiple internal
-  // phases and may print some output. An outer spinner causes "spinner over spinner"
-  // rendering artifacts. Instead, do the same single auth step as up-platform, then
-  // show one spinner for the dataplane install/run phase.
   await runGuidedAuthStep(handleLogin, {}, { startSpinner, stopSpinnerSuccess });
 
   logger.log('');
   emitSystemBuilderAppManifestLineIfTTY(logger, 'dataplane');
   const dpSpin = startSpinner('Starting Dataplane...');
-  await withMutedLogger(() =>
-    handleUpDataplane({ ...options, platformInstall: true, skipInfraCheck: true })
+  const controllerUrl = await resolveGuidedAuthControllerUrl({});
+  await runGuidedDataplaneWithAuthRecovery(
+    { ...options, platformInstall: true, skipInfraCheck: true },
+    handleUpDataplane,
+    handleLogin,
+    controllerUrl,
+    { onSpinnerText: createSpinnerTextUpdater(dpSpin) }
   );
   stopSpinnerSuccess(dpSpin, 'Dataplane ready');
   await refreshDataplaneVersionAfterPlatformInstall();
@@ -311,54 +224,6 @@ async function runGuidedUpDataplane(options, handleUpDataplane) {
   await logDataplaneReadyFooter();
 }
 
-/**
- * Guided-mode summary after `up-platform --force` (printed under the platform header).
- * @param {{ deviceCleared: number, clientCleared: number, environment: string, defaultControllerUrl: string }} forceSummary
- * @param {string[]} cleanedApps
- */
-function logUpPlatformForceCleanSummary(forceSummary, cleanedApps) {
-  const { isSetupQuietOutput } = require('../utils/setup-quiet-output');
-  if (isSetupQuietOutput()) return;
-  const check = successGlyph();
-  logger.log(chalk.bold('Clean installation files'));
-  logger.log(
-    chalk.gray(
-      ` ${check} Cleared ${forceSummary.deviceCleared} device token(s) and ${forceSummary.clientCleared} client token(s)`
-    )
-  );
-  logger.log(chalk.gray(` ${check} Environment set to ${forceSummary.environment}`));
-  logger.log(
-    chalk.gray(
-      ` ${check} Default controller set to ${forceSummary.defaultControllerUrl} (run aifabrix login after platform is up)`
-    )
-  );
-  for (const appName of cleanedApps || []) {
-    logger.log(chalk.gray(` ${check} Cleaned builder/${appName}`));
-  }
-  logger.log('');
-}
-
-/**
- * Yellow notice before long-running platform/dataplane install steps (setup and guided up-*).
- * @param {'platform'|'dataplane'} [scope]
- */
-function logPlatformSetupDurationHint(scope = 'platform') {
-  const line =
-    scope === 'dataplane'
-      ? 'Installation may take a few minutes. Authenticating and starting Dataplane — please wait.'
-      : 'Installation may take a few minutes. Keycloak, Miso Controller, and Dataplane are starting — please wait.';
-  logger.log(chalk.yellow(`⚠ ${line}`));
-}
-
-function logGuidedPlatformSetupHeader() {
-  logger.log('');
-  logger.log(title('AI Fabrix Platform Setup'));
-  logger.log(SEPARATOR);
-  logger.log('');
-  logPlatformSetupDurationHint('platform');
-  logger.log('');
-}
-
 async function refreshDataplaneVersionAfterPlatformInstall() {
   try {
     const { tryRefreshDataplaneVersionAfterLogin } = require('../commands/auth-status-dataplane-version');
@@ -386,20 +251,27 @@ async function runGuidedDataplaneInstallPhase(options, handleUpDataplane, handle
   logger.log('');
   emitSystemBuilderAppManifestLineIfTTY(logger, 'dataplane');
   const dpSpin = startSpinner('Starting Dataplane...');
+  const onSpinnerText = createSpinnerTextUpdater(dpSpin);
   const platformMode = await config.getSetupPlatformMode();
   if (platformMode === 'full') {
-    // Full platform: three dataplane containers + per-env registrations.
     const envKeys = ['pro', 'dev', 'tst'];
     for (const envKey of envKeys) {
       await runGuidedDataplaneWithAuthRecovery(
         { ...options, envKey, runEnvKey: envKey, allowNonDev: true },
         handleUpDataplane,
         handleLoginFn,
-        controllerUrl
+        controllerUrl,
+        { onSpinnerText }
       );
     }
   } else {
-    await runGuidedDataplaneWithAuthRecovery(options, handleUpDataplane, handleLoginFn, controllerUrl);
+    await runGuidedDataplaneWithAuthRecovery(
+      options,
+      handleUpDataplane,
+      handleLoginFn,
+      controllerUrl,
+      { onSpinnerText }
+    );
   }
   stopSpinnerSuccess(dpSpin, 'Dataplane ready');
   await refreshDataplaneVersionAfterPlatformInstall();
@@ -423,6 +295,7 @@ async function runGuidedUpPlatform(options, handleUpMiso, handleUpDataplane, han
     const realmSpin = startSpinner('Waiting for Keycloak realm (aifabrix)...');
     await waitForKeycloakRealmReady({ timeoutSeconds: 180 });
     stopSpinnerSuccess(realmSpin, 'Keycloak realm ready');
+    logger.log('');
   }
   await runGuidedAuthStep(handleLogin, authOpts, { startSpinner, stopSpinnerSuccess });
   const controllerUrl = await resolveGuidedAuthControllerUrl(authOpts);
@@ -431,17 +304,7 @@ async function runGuidedUpPlatform(options, handleUpMiso, handleUpDataplane, han
   await logPlatformReadyFooter();
 }
 
-function logStoppedServices(cfg) {
-  logger.log(title('Stopped'));
-  logger.log('  postgres');
-  logger.log('  redis');
-  if (cfg.pgadmin !== false) logger.log('  pgadmin');
-  if (cfg.redisCommander !== false) logger.log('  redis-commander');
-  if (cfg.traefik) logger.log('  traefik');
-  logger.log('');
-}
-
-async function runGuidedDownInfra(appName, options, infra, appLib) {
+async function runGuidedDownInfra(appName, options, infraMod, appLib) {
   logger.log('');
   logger.log(title('AI Fabrix Shutdown'));
   logger.log(SEPARATOR);
@@ -453,8 +316,8 @@ async function runGuidedDownInfra(appName, options, infra, appLib) {
       await appLib.downApp(appName, { volumes: !!options.volumes });
       return;
     }
-    if (options.volumes) await infra.stopInfraWithVolumes();
-    else await infra.stopInfra();
+    if (options.volumes) await infraMod.stopInfraWithVolumes();
+    else await infraMod.stopInfra();
   });
   stopSpinnerSuccess(spin, 'Infrastructure stopped');
 
@@ -479,4 +342,3 @@ module.exports = {
   runGuidedUpPlatform,
   runGuidedDownInfra
 };
-

package/lib/cli/setup-app.js

@@ -297,7 +297,7 @@ Examples:
     .option('--reload', 'In dev: mount workspace into container (Mutagen only if docker-endpoint is a remote host)')
     .option(
       '--proxy',
-      'Use Traefik/front-door public URL hints when infra has Traefik and application.yaml enables frontDoorRouting (default: on)',
+      'Use Traefik/front-door public URL hints when infra has Traefik (ignored when traefik: false in config)',
       true
     )
     .option(
@@ -326,6 +326,10 @@ function setupBuildRunLogsDownCommands(program) {
       '--base',
       'Build/run the manifest base image (no -devN suffix). Default local build uses a developer-scoped repository when developer-id > 0.'
     )
+    .option(
+      '--from-dev',
+      'With --base: tag the existing developer-scoped image as the base image instead of rebuilding when possible'
+    )
     .action(async(appName, options) => {
       try {
         const imageTag = await app.buildApp(appName, options);

package/lib/cli/setup-dev.js

@@ -39,6 +39,7 @@ Examples:
   $ aifabrix dev add --developer-id 02 --name "Jane Doe" --email jane@example.com
   $ aifabrix dev add --developer-id 03 --name "Build admin" --email admin@example.com --groups admin,developer
   $ aifabrix dev add --developer-id 04 --name "CI user" --email ci@example.com --groups secret-manager,developer
+  $ aifabrix dev add --developer-id 05 --name "Integrator" --email integrator@example.com --groups developer,secret-reader
 
 Requires a configured remote Builder Server and an admin client certificate (same machine setup as dev list / dev pin). After add, run dev pin <id> once to create a PIN for aifabrix dev init.
 `;
@@ -274,7 +275,7 @@ function setupDevListAddCommands(dev) {
     .requiredOption('--developer-id <id>', 'Unique id, digits only (e.g. 02); used with dev init --developer-id')
     .requiredOption('--name <name>', 'Display name')
     .requiredOption('--email <email>', 'Email address')
-    .option('--groups <items>', 'Comma-separated roles: admin, secret-manager, developer, docker', 'developer')
+    .option('--groups <items>', 'Comma-separated roles: admin, secret-manager, secret-reader, developer, docker', 'developer')
     .addHelpText('after', DEV_ADD_HELP_AFTER)
     .action(async(options) => {
       try {
@@ -297,7 +298,7 @@ function setupDevUpdatePinDeleteCommands(dev) {
     .option('--developer-id <id>', 'Developer ID (same as dev add)')
     .option('--name <name>', 'Display name')
     .option('--email <email>', 'Email address')
-    .option('--groups <items>', 'Comma-separated groups (admin, secret-manager, developer, docker)')
+    .option('--groups <items>', 'Comma-separated groups (admin, secret-manager, secret-reader, developer, docker)')
     .addHelpText('after', DEV_UPDATE_HELP_AFTER)
     .action(async(developerId, options) => {
       try {

package/lib/cli/setup-infra.js

@@ -34,7 +34,8 @@ const {
 
 const {
   computeEffectiveInfraOptionalFlags,
-  persistMissingInfraOptionalServiceFlags
+  persistMissingInfraOptionalServiceFlags,
+  resolveEffectiveTlsEnabled
 } = require('../utils/infra-optional-service-flags');
 
 const UP_INFRA_HELP_AFTER = `
@@ -137,7 +138,7 @@ async function runUpInfraCommand(options) {
   const { passwordBundleFromCliOptions } = require('../core/admin-secrets-bundle');
   const bundle = passwordBundleFromCliOptions(options);
   const adminPass = options.adminPassword || options.adminPwd;
-  const tlsEnabledEffective = cfg.tlsEnabled === true;
+  const tlsEnabledEffective = resolveEffectiveTlsEnabled(cfg, options);
   const effective = computeEffectiveInfraOptionalFlags(cfg, options);
   await infra.startInfra(developerId, {
     traefik: effective.traefik,

package/lib/cli/setup-platform.js

@@ -29,6 +29,8 @@ What this command does:
       2) Wipe data — drop every database and DB user, then up-infra + up-platform --force.
       3) Clean installation files — remove user-local secrets, then up-infra + up-platform --force.
       4) Update images — pull the latest infra and platform images, then up-infra + up-platform.
+  - With --mode fresh: first-time install when no infra is running (non-interactive; use with --admin-email and --admin-password).
+  - With --mode update-images: refresh images when infra is already running (non-interactive).
 
 AI tool keys are read from the user-local file (~/.aifabrix/secrets.local.yaml) merged with the shared aifabrix-secrets file. If either source already provides keys, the AI tool prompt is skipped.
 
@@ -59,6 +61,7 @@ function registerSetup(program) {
     .option('--pro-password-mode <mode>', 'Pro profile only: autogen or manual')
     .option('--admin-email <email>', 'Admin email (non-interactive fresh install)')
     .option('--admin-password <password>', 'Admin password for dev or pro manual-single (non-interactive)')
+    .option('--mode <mode>', 'Non-interactive mode: fresh (no infra) or update-images (infra running)')
     .option('-y, --yes', 'Skip destructive confirmation prompts (re-install, wipe data, teardown)')
     .addHelpText('after', SETUP_HELP_AFTER)
     .action(async(options) => {

package/lib/commands/dev-init.js

@@ -16,6 +16,7 @@ const {
   getCertDir,
   readClientCertPem,
   readClientKeyPem,
+  readServerCaPem,
   getCertValidNotAfter,
   normalizePemNewlines,
   mergeCaPemBlocks
@@ -40,6 +41,7 @@ const {
   formatEnsureServerTrustedFailure
 } = require('../utils/dev-init-health-messages');
 const { getBadRequestHint, logCertTroubleshootingHint } = require('../utils/dev-init-cert-hints');
+const { augmentAndSaveCaPemForRemoteDocker } = require('../utils/dev-ca-docker-augment');
 
 /**
  * Install dev CA into the OS trust store. On Linux without sudo, log and return false so the caller can use in-process PEM.
@@ -371,6 +373,11 @@ async function runDevInit(options) {
   await saveCertAndConfig(configDir, devId, issueResponse.certificate, keyPem, caPem);
 
   await applySettingsFromServer(baseUrl, devId, issueResponse, keyPem, serverCaPemForTls || undefined);
+  await augmentAndSaveCaPemForRemoteDocker(configDir, devId, caPem, {
+    settings: issueResponse.settings,
+    remoteServerUrl: baseUrl,
+    warn: (msg) => logger.log(chalk.yellow(`  ⚠ ${msg}`))
+  });
   await _runSshKeyRegistrationStep(baseUrl, issueResponse, keyPem, configDir, devId, serverCaPemForTls || undefined);
   const sshInfo = await mergeDevSshConfigAfterInit(baseUrl, devId);
   logOnboardingFinished(sshInfo);
@@ -413,6 +420,11 @@ async function runCertificateRefresh(auth) {
   const caPem = mergeCaPemBlocks(serverCaPem, issueResponse.caCertificate, issueResponse.ca);
   await saveCertAndConfig(configDir, devId, issueResponse.certificate, keyPem, caPem);
   await applySettingsFromServer(auth.serverUrl, devId, issueResponse, keyPem, serverCaPem);
+  await augmentAndSaveCaPemForRemoteDocker(configDir, devId, caPem, {
+    settings: issueResponse.settings,
+    remoteServerUrl: auth.serverUrl,
+    warn: (msg) => logger.log(chalk.yellow(`  ⚠ ${msg}`))
+  });
   logger.log(formatSuccessLine('Certificate refreshed and config updated from server.\n'));
 }
 
@@ -433,6 +445,12 @@ async function fetchAndMergeRemoteSettings(auth, clientCertPem, clientKeyPem, de
     auth.serverCaPem || undefined
   );
   await config.mergeRemoteSettings(settings);
+  const existingCa = readServerCaPem(getCertDir(getConfigDirForPaths(), devId));
+  await augmentAndSaveCaPemForRemoteDocker(getConfigDirForPaths(), devId, existingCa, {
+    settings,
+    remoteServerUrl: auth.serverUrl,
+    warn: (msg) => logger.log(chalk.yellow(`  ⚠ ${msg}`))
+  });
   logger.log(formatSuccessLine('Config updated from server.\n'));
   await displayDevConfig(devId);
 }

package/lib/commands/login-device.js

@@ -96,7 +96,7 @@ async function saveTokenAndDisplaySuccess(controllerUrl, token, refreshToken, ex
       logger.log(chalk.gray(`Environment: ${envKey}`));
     }
     logger.log(chalk.gray('Token stored securely in ~/.aifabrix/config.yaml\n'));
-  } else {
+  } else if (!opts.suppressSuccessLine && !opts.guidedInstall) {
     logger.log(formatSuccessLine('Authentication successful'));
   }
 }
@@ -116,8 +116,10 @@ async function pollAndSaveDeviceCodeToken(controllerUrl, deviceCode, interval, e
   const spinner = useSpinner
     ? ora({ text: 'Waiting for approval', spinner: 'dots' }).start()
     : null;
-  if (!useSpinner) {
+  if (!useSpinner && !opts.onProgressText) {
     logger.log('Waiting for approval...');
+  } else if (opts.onProgressText) {
+    opts.onProgressText('Waiting for approval...');
   }
 
   let pollCount = 0;
@@ -125,6 +127,8 @@ async function pollAndSaveDeviceCodeToken(controllerUrl, deviceCode, interval, e
     pollCount++;
     if (spinner) {
       spinner.text = `Waiting for approval (attempt ${pollCount})...`;
+    } else if (opts.onProgressText) {
+      opts.onProgressText(`Waiting for approval (attempt ${pollCount})...`);
     }
   };
 

package/lib/commands/login.js

@@ -163,7 +163,10 @@ async function handleDeviceCodeLoginFlow(controllerUrl, environment, options) {
   return await handleDeviceCodeLogin(controllerUrl, environment, options.online, options.scope, {
     compact: Boolean(options.compact),
     exitOnFailure: options.exitOnFailure !== false,
-    tokenControllerUrl: options.tokenControllerUrl
+    tokenControllerUrl: options.tokenControllerUrl,
+    guidedInstall: options.guidedInstall === true,
+    onProgressText: options.onProgressText,
+    suppressSuccessLine: options.suppressSuccessLine === true
   });
 }
 

package/lib/commands/setup-modes.js

@@ -42,11 +42,19 @@ const postgresBootstrap = require('../utils/postgres-platform-bootstrap');
 const appLib = require('../app');
 const setupPrompts = require('./setup-prompts');
 const { ensureSetupPlatformAuth, syncPlatformControllerUrlsInConfig } = require('./setup-platform-auth');
+const {
+  refreshRemoteSettingsFromBuilderIfPossible
+} = require('../utils/refresh-remote-settings');
 const { handleLogin } = require('./login');
 const infraGuided = require('../cli/infra-guided');
+const {
+  applyPlatformTopologyFlagsToConfig,
+  platformTopologyNeedsReconcile
+} = require('../core/setup-platform-mode');
 const {
   computeEffectiveInfraOptionalFlags,
-  persistMissingInfraOptionalServiceFlags
+  persistMissingInfraOptionalServiceFlags,
+  topologyFlagsForConfig
 } = require('../utils/infra-optional-service-flags');
 
 /** Builder app keys touched by `up-platform --force`. */
@@ -197,11 +205,19 @@ async function maybePromptForExistingBuilderDir({ force, skipBuilderConflictProm
  */
 async function startInfraFromConfig(overrides = {}) {
   await config.ensureSecretsEncryptionKey();
-  const cfg = await config.getConfig();
+  await refreshRemoteSettingsFromBuilderIfPossible({ quiet: true });
+  let cfg = await config.getConfig();
+  if (platformTopologyNeedsReconcile(cfg)) {
+    applyPlatformTopologyFlagsToConfig(cfg, cfg.setupPlatformMode);
+    await config.saveConfig(cfg);
+    cfg = await config.getConfig();
+  }
   const emailOverride = String(overrides.adminEmail || '').trim();
   const emailFromConfig = typeof cfg.adminEmail === 'string' ? cfg.adminEmail.trim() : '';
   const adminEmailMerged = emailOverride || emailFromConfig || undefined;
   const effective = computeEffectiveInfraOptionalFlags(cfg, {});
+  const topology = topologyFlagsForConfig(cfg);
+  const tlsEnabled = topology ? topology.tlsEnabled : cfg.tlsEnabled === true;
   const legacyPwd =
     overrides.passwordBundle && overrides.passwordBundle.mode === 'single'
       ? overrides.passwordBundle.password
@@ -215,7 +231,7 @@ async function startInfraFromConfig(overrides = {}) {
       adminPwd: legacyPwd,
       adminEmail: adminEmailMerged,
       passwordBundle: overrides.passwordBundle,
-      tlsEnabled: cfg.tlsEnabled === true
+      tlsEnabled
     });
   });
   await persistMissingInfraOptionalServiceFlags(cfg, effective);

package/lib/commands/setup-platform-auth.js

@@ -14,6 +14,14 @@ const { resolvePlatformControllerUrl } = require('../utils/platform-controller-u
 const { isPlatformAuthValidForController } = require('../utils/controller-url');
 const { infoLine } = require('../utils/cli-test-layout-chalk');
 const logger = require('../utils/logger');
+const chalk = require('chalk');
+const {
+  refreshRemoteSettingsFromBuilderIfPossible
+} = require('../utils/refresh-remote-settings');
+const {
+  applyPlatformTopologyFlagsToConfig,
+  platformTopologyNeedsReconcile
+} = require('../core/setup-platform-mode');
 
 /**
  * Recompute `controller` and `platform-controller` from traefik / setupPlatformMode / front-door config.
@@ -24,6 +32,23 @@ const logger = require('../utils/logger');
  * @returns {Promise<string>} Normalized platform controller URL
  */
 async function syncPlatformControllerUrlsInConfig() {
+  const refresh = await refreshRemoteSettingsFromBuilderIfPossible({ quiet: true });
+  const cfg = await config.getConfig();
+  if (platformTopologyNeedsReconcile(cfg)) {
+    applyPlatformTopologyFlagsToConfig(cfg, cfg.setupPlatformMode);
+    await config.saveConfig(cfg);
+  }
+  const remoteServer = await config.getRemoteServer();
+  const rootDomain = await config.getDeveloperRootDomain();
+  if (remoteServer && !rootDomain && !refresh.refreshed) {
+    logger.warn(
+      chalk.yellow(
+        'Platform URLs may be wrong: developer-root-domain is missing. ' +
+          'Run "aifabrix dev refresh" (or "aifabrix dev init") to sync from the Builder Server.'
+      )
+    );
+  }
+
   const platformControllerUrl = await resolvePlatformControllerUrl();
   await config.setPlatformControllerUrl(platformControllerUrl);
   await config.setControllerUrl(platformControllerUrl);

package/lib/commands/setup-prompts-admin.js

@@ -225,6 +225,15 @@ async function promptAdminCredentialsWithProfile(options = {}) {
   await config.setSetupInstallationProfile(profile);
 
   const adminEmail = await promptAdminEmail(options);
+  const cliPassword = String(options.adminPassword || '').trim();
+  if (cliPassword) {
+    validatePassword(cliPassword);
+    const passwordBundle = isProInstallationProfile(profile)
+      ? singlePasswordBundle(cliPassword)
+      : singlePasswordBundle(cliPassword);
+    return { adminEmail, passwordBundle, profile };
+  }
+
   const passwordBundle = isProInstallationProfile(profile)
     ? await promptProPasswordBundle(options)
     : await promptDevPasswordBundle();

package/lib/commands/setup-prompts-platform-mode.js

@@ -9,12 +9,14 @@
 'use strict';
 
 const inquirer = require('inquirer');
+const config = require('../core/config');
 const {
   normalizeSetupPlatformMode,
   SETUP_PLATFORM_MODE,
   SETUP_PLATFORM_MODE_CLI_VALUES,
   getSetupPlatformModePromptChoices
 } = require('../core/setup-platform-mode');
+const { isRemoteServerConfigured } = require('../utils/applications-config-defaults');
 
 /**
  * Resolve platform mode from CLI options, if provided.
@@ -51,12 +53,20 @@ async function promptSetupPlatformMode(options = {}) {
   const fromCli = resolvePlatformModeFromOptions(options);
   if (fromCli) return fromCli;
 
+  const remoteServer = await config.getRemoteServer();
+  const choices = getSetupPlatformModePromptChoices({
+    remoteServerConfigured: isRemoteServerConfigured(remoteServer)
+  });
+  if (choices.length === 1) {
+    return SETUP_PLATFORM_MODE.SINGLE;
+  }
+
   const { mode } = await inquirer.prompt([
     {
       type: 'list',
       name: 'mode',
       message: 'Platform mode:',
-      choices: getSetupPlatformModePromptChoices(),
+      choices,
       default: SETUP_PLATFORM_MODE.SINGLE
     }
   ]);