@aifabrix/builder 2.47.4 → 2.49.0

package/lib/utils/promote-dev-docker-image.js

@@ -0,0 +1,170 @@
+/**
+ * Promote a developer-scoped local Docker image to the manifest base repository (tag only).
+ *
+ * @fileoverview Used by `aifabrix build --base --from-dev` and dev-promote workflows
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const config = require('../core/config');
+const { loadAndValidateConfig } = require('./build-helpers');
+const { resolveBuildDockerTagNames } = require('./build-resolve-image');
+const { execWithDockerEnv } = require('./docker-exec');
+const logger = require('./logger');
+const { formatSuccessLine } = require('./cli-test-layout-chalk');
+
+/**
+ * @param {string} value
+ * @returns {string}
+ */
+function shellQuote(value) {
+  return `'${String(value).replace(/'/g, '\'\\\'\'')}'`;
+}
+
+/**
+ * @param {string} imageRef - repository:tag
+ * @returns {Promise<boolean>}
+ */
+async function dockerImageRefExists(imageRef) {
+  try {
+    await execWithDockerEnv(`docker image inspect ${shellQuote(imageRef)}`);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * @param {string} imageRef
+ * @returns {Promise<string|null>}
+ */
+async function readDockerImageId(imageRef) {
+  try {
+    const { stdout } = await execWithDockerEnv(
+      `docker image inspect --format '{{.Id}}' ${shellQuote(imageRef)}`
+    );
+    const id = stdout.trim();
+    return id || null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * @param {string} sourceRef
+ * @param {string} targetRef
+ * @returns {Promise<void>}
+ */
+async function dockerTagImageRef(sourceRef, targetRef) {
+  await execWithDockerEnv(`docker tag ${shellQuote(sourceRef)} ${shellQuote(targetRef)}`);
+}
+
+/**
+ * @param {string} appName
+ * @param {Object} variables
+ * @param {string|number} developerId
+ * @param {Object} options - `tag` (base target), `fromDevTag` (dev source; default `latest`)
+ * @returns {Promise<{ devRef: string, baseRef: string, devTag: string, baseTag: string }>}
+ */
+async function resolveDevAndBaseImageRefs(appName, variables, developerId, options) {
+  const baseTag = options.tag || 'latest';
+  const devTag = options.fromDevTag || 'latest';
+  const { buildImageName: baseName } = await resolveBuildDockerTagNames(appName, variables, developerId, {
+    ...options,
+    base: true
+  });
+  const { buildImageName: devName } = await resolveBuildDockerTagNames(appName, variables, developerId, {
+    ...options,
+    base: false
+  });
+  return {
+    devRef: `${devName}:${devTag}`,
+    baseRef: `${baseName}:${baseTag}`,
+    devTag,
+    baseTag
+  };
+}
+
+/**
+ * Find a local developer-scoped image to promote (dev-build usually tags `latest`).
+ * @param {string} appName
+ * @param {Object} appConfig
+ * @param {string|number} developerId
+ * @param {Object} options
+ * @returns {Promise<{ devRef: string, baseRef: string }|null>}
+ */
+async function resolvePromoteSourceAndTargetRefs(appName, appConfig, developerId, options) {
+  const baseTag = options.tag || 'latest';
+  const devTagCandidates = ['latest'];
+  if (baseTag !== 'latest' && !devTagCandidates.includes(baseTag)) {
+    devTagCandidates.push(baseTag);
+  }
+  for (const fromDevTag of devTagCandidates) {
+    const refs = await resolveDevAndBaseImageRefs(appName, appConfig, developerId, {
+      ...options,
+      fromDevTag
+    });
+    if (await dockerImageRefExists(refs.devRef)) {
+      return { devRef: refs.devRef, baseRef: refs.baseRef };
+    }
+  }
+  return null;
+}
+
+/**
+ * Tag developer-scoped image as manifest base when present locally.
+ * @param {string} appName
+ * @param {Object} options - build options (`base`, `tag`, `registry`, `fromDev`)
+ * @returns {Promise<string|null>} base image ref when promoted/skipped; null when dev image missing
+ */
+async function tryPromoteDevImageToBase(appName, options = {}) {
+  if (options.base !== true) {
+    throw new Error('Promote-from-dev requires --base.');
+  }
+
+  const developerId = await config.getDeveloperId();
+  const idNum = typeof developerId === 'string' ? parseInt(developerId, 10) : Number(developerId);
+  if (!Number.isFinite(idNum) || idNum <= 0) {
+    return null;
+  }
+
+  const { config: appConfig } = await loadAndValidateConfig(appName);
+  const resolved = await resolvePromoteSourceAndTargetRefs(appName, appConfig, developerId, options);
+  if (!resolved) {
+    return null;
+  }
+  const { devRef, baseRef } = resolved;
+
+  const devId = await readDockerImageId(devRef);
+  if (await dockerImageRefExists(baseRef)) {
+    const baseId = await readDockerImageId(baseRef);
+    if (devId && baseId && devId === baseId) {
+      logger.log(formatSuccessLine(`Base image already matches dev build: ${baseRef}`));
+      return baseRef;
+    }
+  }
+
+  await dockerTagImageRef(devRef, baseRef);
+  logger.log(formatSuccessLine(`Promoted dev image to base (tag only): ${baseRef}`));
+  return baseRef;
+}
+
+/**
+ * @param {Object} options
+ * @returns {boolean}
+ */
+function shouldAttemptDevPromote(options) {
+  return options.fromDev === true && options.base === true;
+}
+
+module.exports = {
+  tryPromoteDevImageToBase,
+  shouldAttemptDevPromote,
+  resolveDevAndBaseImageRefs,
+  resolvePromoteSourceAndTargetRefs,
+  dockerImageRefExists,
+  readDockerImageId,
+  dockerTagImageRef
+};

package/lib/utils/refresh-remote-settings.js

@@ -0,0 +1,67 @@
+/**
+ * Refresh ~/.aifabrix/config.yaml from GET /api/dev/settings when remote dev auth is available.
+ *
+ * @fileoverview Merge builder-server settings (developer-root-domain, sync paths, etc.)
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const config = require('../core/config');
+const devApi = require('../api/dev.api');
+const { getRemoteDevAuth } = require('./remote-dev-auth');
+const { getCertDir, readClientKeyPem } = require('./dev-cert-helper');
+const { getConfigDirForPaths } = require('./paths');
+const logger = require('./logger');
+
+/**
+ * @typedef {Object} RefreshRemoteSettingsResult
+ * @property {boolean} refreshed
+ * @property {string} [reason]
+ * @property {Object} [settings]
+ * @property {Error} [error]
+ */
+
+/**
+ * Fetch GET /api/dev/settings and merge into config when remote-server + client cert exist.
+ *
+ * @async
+ * @param {{ quiet?: boolean }} [opts]
+ * @returns {Promise<RefreshRemoteSettingsResult>}
+ */
+async function refreshRemoteSettingsFromBuilderIfPossible(opts = {}) {
+  const quiet = opts.quiet !== false;
+  const auth = await getRemoteDevAuth();
+  if (!auth) {
+    return { refreshed: false, reason: 'no-remote-auth' };
+  }
+
+  const devId = await config.getDeveloperId();
+  const certDir = getCertDir(getConfigDirForPaths(), devId);
+  const clientKeyPem = readClientKeyPem(certDir);
+
+  try {
+    const settings = await devApi.getSettings(
+      auth.serverUrl,
+      auth.clientCertPem,
+      clientKeyPem || undefined,
+      auth.serverCaPem || undefined
+    );
+    await config.mergeRemoteSettings(settings);
+    if (!quiet) {
+      logger.log(chalk.gray('Synced developer settings from Builder Server'));
+    }
+    return { refreshed: true, settings };
+  } catch (error) {
+    if (!quiet) {
+      logger.warn(
+        chalk.yellow(`Could not refresh settings from Builder Server: ${error.message}`)
+      );
+    }
+    return { refreshed: false, reason: 'fetch-failed', error };
+  }
+}
+
+module.exports = { refreshRemoteSettingsFromBuilderIfPossible };

package/lib/utils/remote-docker-env.js

@@ -6,10 +6,12 @@
  * @version 2.0.0
  */
 
+const fs = require('fs');
 const path = require('path');
 const config = require('../core/config');
-const { getCertDir } = require('./dev-cert-helper');
+const { getCertDir, readServerCaPem } = require('./dev-cert-helper');
 const { getConfigDirForPaths } = require('./paths');
+const { resolveRemoteDockerDaemonVerify } = require('./docker-daemon-tls-ca');
 
 function devTlsCertPaths(certDir) {
   return {
@@ -43,10 +45,13 @@ function missingCaError(trimmed, certDir) {
  * When docker-endpoint is set, we do not fall back to the local daemon without that endpoint
  * (avoids accidentally using Docker Desktop while the dev profile targets a remote engine).
  *
- * When **TLS skip-verify** is enabled (config or env) and **ca.pem is missing**, client cert/key are
- * optional: Docker can use DOCKER_TLS_VERIFY=0 with no client certs if the daemon allows it.
- * If **ca.pem is present** (e.g. from Builder Server issue-cert), the daemon certificate is always
- * verified (DOCKER_TLS_VERIFY=1) even when skip-verify is set — better security once a trust anchor exists.
+ * When **TLS skip-verify** is enabled (config or `AIFABRIX_DOCKER_TLS_SKIP_VERIFY`), Docker uses
+ * DOCKER_TLS_VERIFY=0 (client cert/key still sent when present). Skip-verify applies even when ca.pem
+ * exists — ca.pem may hold the internal issue-cert CA while the Docker daemon uses a public/wildcard cert.
+ *
+ * When skip-verify is off and ca.pem exists, the CLI verifies the daemon only if ca.pem includes the
+ * Docker daemon trust chain (merged at dev init/refresh or lazily on first Docker use). Otherwise it
+ * falls back to DOCKER_TLS_VERIFY=0 with client mTLS (public CA daemon on a trusted builder host).
  *
  * Without skip-verify, cert.pem, key.pem, and ca.pem are required in the dev cert directory.
  *
@@ -61,7 +66,6 @@ async function getRemoteDockerEnv() {
   const trimmed = endpoint.trim();
   const certDir = getCertDir(getConfigDirForPaths(), await config.getDeveloperId());
   const { certPath, keyPath, caPath } = devTlsCertPaths(certDir);
-  const fs = require('fs');
   const skipVerify = await config.getDockerTlsSkipVerify();
   const hasClient = fs.existsSync(certPath) && fs.existsSync(keyPath);
   const hasCa = fs.existsSync(caPath);
@@ -71,7 +75,18 @@ async function getRemoteDockerEnv() {
     return { DOCKER_HOST: trimmed, DOCKER_TLS_VERIFY: '0' };
   }
   if (!hasCa && !skipVerify) throw missingCaError(trimmed, certDir);
-  const verifyDaemon = hasCa;
+
+  let verifyDaemon = false;
+  if (!skipVerify && hasCa) {
+    verifyDaemon = await resolveRemoteDockerDaemonVerify({
+      certDir,
+      existingCaPem: readServerCaPem(certDir),
+      dockerEndpoint: trimmed,
+      remoteServerUrl: await config.getRemoteServer(),
+      skipVerify: false
+    });
+  }
+
   return {
     DOCKER_HOST: trimmed,
     DOCKER_TLS_VERIFY: verifyDaemon ? '1' : '0',

package/lib/utils/remote-host-for-front-door.js

@@ -0,0 +1,43 @@
+/**
+ * Resolve hostname for `${REMOTE_HOST}` in frontDoorRouting.host templates.
+ * Prefers `developer-root-domain` from builder-server settings over `remote-server` hostname.
+ *
+ * @fileoverview App public hostname root (separate from builder API host)
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const { hostnameFromUrl } = require('./config-paths');
+
+/**
+ * Hostname for `${REMOTE_HOST}` expansion (Traefik labels, url:// public, setup health).
+ *
+ * @param {Object} [input]
+ * @param {string|null|undefined} input.remoteServer - Builder API base URL
+ * @param {string|null|undefined} input.developerRootDomain - App hostname root from GET /api/dev/settings
+ * @returns {string}
+ */
+function resolveRemoteHostForFrontDoor(input = {}) {
+  const root = String(input.developerRootDomain || '').trim();
+  if (root) {
+    return root.replace(/^\.+|\.+$/g, '');
+  }
+  return hostnameFromUrl(input.remoteServer) || '';
+}
+
+/**
+ * Whether front-door host expansion can resolve `${REMOTE_HOST}` (root domain or remote-server).
+ *
+ * @param {Object} [input]
+ * @returns {boolean}
+ */
+function hasFrontDoorRemoteHostContext(input = {}) {
+  return Boolean(resolveRemoteHostForFrontDoor(input));
+}
+
+module.exports = {
+  resolveRemoteHostForFrontDoor,
+  hasFrontDoorRemoteHostContext
+};

package/lib/utils/run-cli-flags.js

@@ -24,6 +24,42 @@ function isRunCliNoProxy(options) {
   return options.noProxy === true;
 }
 
+/**
+ * Whether `aifabrix run` should persist `applications.<app>.proxy: true`.
+ * Proxy / front-door URL hints require infra Traefik (`traefik: true` in config).
+ * Direct-port (`setupPlatformMode: single`) always persists false even though Commander defaults `--proxy` on.
+ *
+ * @param {Object} [options] - Commander action options
+ * @param {Object|null|undefined} [userCfg] - Parsed `~/.aifabrix/config.yaml`
+ * @returns {boolean}
+ */
+function resolveRunProxyPersistEnabled(options, userCfg) {
+  if (isRunCliNoProxy(options)) {
+    return false;
+  }
+  return Boolean(userCfg && userCfg.traefik === true);
+}
+
+/**
+ * Effective no-proxy for env/url expansion during run.
+ *
+ * @param {Object} [options]
+ * @param {Object|null|undefined} [userCfg]
+ * @param {boolean} savedProxyHint - `applications.<app>.proxy` from config
+ * @returns {boolean}
+ */
+function resolveRunEffectiveNoProxy(options, userCfg, savedProxyHint) {
+  if (isRunCliNoProxy(options)) {
+    return true;
+  }
+  if (!userCfg || userCfg.traefik !== true) {
+    return true;
+  }
+  return !savedProxyHint;
+}
+
 module.exports = {
-  isRunCliNoProxy
+  isRunCliNoProxy,
+  resolveRunProxyPersistEnabled,
+  resolveRunEffectiveNoProxy
 };

package/lib/utils/secrets-helpers.js

@@ -19,7 +19,7 @@ const { updateContainerPortInEnvFile } = require('./env-ports');
 const { buildEnvVarMap } = require('./env-map');
 const { getLocalPortFromPath } = require('./port-resolver');
 const { readYamlAtPath, applyCanonicalSecretsOverride } = require('./secrets-canonical');
-const { collectUniqueKvPathStrings } = require('./secrets-kv-refs');
+const { collectUniqueKvPathStrings, isCommentOrEmptyLine, activeEnvLineForKvScan, envLineWithoutInlineComment } = require('./secrets-kv-refs');
 
 /**
  * Interpolate ${VAR} occurrences with values from envVars map
@@ -34,16 +34,6 @@ function interpolateEnvVars(content, envVars) {
   });
 }
 
-/**
- * Returns true if the line is a comment or empty (should be skipped for kv:// resolution)
- * @param {string} line - Single line
- * @returns {boolean}
- */
-function isCommentOrEmptyLine(line) {
-  const t = line.trim();
-  return t === '' || t.startsWith('#');
-}
-
 /** Regex for kv:// path (allows slashes, e.g. kv://hubspot/clientId) */
 const KV_REF_PATTERN = /kv:\/\/([a-zA-Z0-9_\-/]+)/g;
 
@@ -162,10 +152,11 @@ function collectMissingSecrets(content, secrets, scopedKv = null) {
   const seen = new Set();
   const missing = [];
   for (const line of content.split('\n')) {
-    if (isCommentOrEmptyLine(line)) continue;
+    const scanLine = activeEnvLineForKvScan(line);
+    if (!scanLine) continue;
     let match;
     KV_REF_PATTERN.lastIndex = 0;
-    while ((match = KV_REF_PATTERN.exec(line)) !== null) {
+    while ((match = KV_REF_PATTERN.exec(scanLine)) !== null) {
       const pathStr = match[1];
       if (seen.has(pathStr)) continue;
       seen.add(pathStr);
@@ -222,7 +213,10 @@ function replaceKvInContent(content, secrets, envVars, scopedKv = null) {
   const lines = content.split('\n');
   const result = lines.map(line => {
     if (isCommentOrEmptyLine(line)) return line;
-    return line.replace(KV_REF_PATTERN, (match, pathStr) => {
+    const scanLine = envLineWithoutInlineComment(line);
+    if (!scanLine.trim()) return line;
+    const suffix = line.slice(scanLine.length);
+    const replaced = scanLine.replace(KV_REF_PATTERN, (match, pathStr) => {
       let value = resolveKvRefValue(secretsMap, pathStr, scopedKv?.envKey, effective);
       if ((value === undefined || value === null) && isKvKeyAllowedEmptyWhenAbsent(pathStr)) {
         value = '';
@@ -234,6 +228,7 @@ function replaceKvInContent(content, secrets, envVars, scopedKv = null) {
       }
       return value !== null && value !== undefined ? String(value) : match;
     });
+    return replaced + suffix;
   });
   return result.join('\n');
 }

package/lib/utils/secrets-kv-refs.js

@@ -7,11 +7,51 @@
 
 const KV_REF_PATTERN = /kv:\/\/([a-zA-Z0-9_\-/]+)/g;
 
+/**
+ * True when the line is empty or a full-line comment (# after trim).
+ *
+ * @param {string} line
+ * @returns {boolean}
+ */
 function isCommentOrEmptyLine(line) {
-  const t = line.trim();
+  const t = String(line).trim();
   return t === '' || t.startsWith('#');
 }
 
+/**
+ * Active env line for kv:// scanning: drop inline `#` comments (not inside quotes).
+ *
+ * @param {string} line
+ * @returns {string}
+ */
+function envLineWithoutInlineComment(line) {
+  if (isCommentOrEmptyLine(line)) {
+    return '';
+  }
+  let inSingle = false;
+  let inDouble = false;
+  const raw = String(line);
+  for (let i = 0; i < raw.length; i++) {
+    const c = raw[i];
+    if (c === '\'' && !inDouble) {
+      inSingle = !inSingle;
+    } else if (c === '"' && !inSingle) {
+      inDouble = !inDouble;
+    } else if (c === '#' && !inSingle && !inDouble) {
+      return raw.slice(0, i);
+    }
+  }
+  return raw;
+}
+
+/**
+ * @param {string} line
+ * @returns {string}
+ */
+function activeEnvLineForKvScan(line) {
+  return envLineWithoutInlineComment(line).trim();
+}
+
 /**
  * @param {string} content
  * @returns {string[]}
@@ -23,10 +63,11 @@ function collectUniqueKvPathStrings(content) {
     return out;
   }
   for (const line of content.split('\n')) {
-    if (isCommentOrEmptyLine(line)) continue;
+    const scanLine = activeEnvLineForKvScan(line);
+    if (!scanLine) continue;
     let match;
     KV_REF_PATTERN.lastIndex = 0;
-    while ((match = KV_REF_PATTERN.exec(line)) !== null) {
+    while ((match = KV_REF_PATTERN.exec(scanLine)) !== null) {
       const pathStr = match[1];
       if (!seen.has(pathStr)) {
         seen.add(pathStr);
@@ -38,5 +79,8 @@ function collectUniqueKvPathStrings(content) {
 }
 
 module.exports = {
+  isCommentOrEmptyLine,
+  envLineWithoutInlineComment,
+  activeEnvLineForKvScan,
   collectUniqueKvPathStrings
 };

package/lib/utils/secrets-missing-error.js

@@ -9,15 +9,7 @@
 'use strict';
 
 const { formatMissingSecretsFileInfo } = require('./secrets-helpers');
-
-/**
- * @param {string} line
- * @returns {boolean}
- */
-function isCommentOrEmptyLine(line) {
-  const t = String(line).trim();
-  return t === '' || t.startsWith('#');
-}
+const { isCommentOrEmptyLine } = require('./secrets-kv-refs');
 
 /**
  * @param {string} kvRef - e.g. kv://hubspot-demo/clientSecret

package/lib/utils/token-manager-client-credentials.js

@@ -183,12 +183,22 @@ async function resolveCredentialAppForDeployment(appName) {
 
 /**
  * @param {string} appName
+ * @param {{ secretsFileOnly?: boolean }} [options]
  * @returns {Promise<{ clientId: string, clientSecret: string }|null>}
  */
-async function loadClientCredentials(appName) {
+async function loadClientCredentials(appName, options = {}) {
   if (!appName || typeof appName !== 'string') {
     throw new Error('App name is required and must be a string');
   }
+  if (options.secretsFileOnly === true) {
+    for (const key of credentialAppKeysToTry(appName)) {
+      const fromFile = await readClientCredentialsFromSecretsFileDecrypted(key);
+      if (fromFile) {
+        return fromFile;
+      }
+    }
+    return null;
+  }
   const resolved = await resolveCredentialAppForDeployment(appName);
   return resolved.credentials;
 }

package/lib/utils/url-declarative-public-base.js

@@ -9,6 +9,7 @@
 'use strict';
 
 const { expandFrontDoorHostPlaceholders } = require('./compose-generator');
+const { hasFrontDoorRemoteHostContext } = require('./remote-host-for-front-door');
 const { publishedHostPort, localHostPort } = require('./declarative-url-ports');
 const {
   normalizeSetupPlatformMode,
@@ -23,11 +24,12 @@ const { isLocalhostPublicSchemeHostname } = require('./localhost-public-host');
  * @param {Object} opts
  * @param {string|number|null|undefined} opts.developerIdRaw
  * @param {string|null|undefined} opts.remoteServer
+ * @param {string|null|undefined} [opts.developerRootDomain]
  * @returns {string}
  */
 function expandFrontDoorHostTemplateForUrls(template, opts) {
-  const { developerIdRaw, remoteServer } = opts || {};
-  return expandFrontDoorHostPlaceholders(template, developerIdRaw, remoteServer);
+  const { developerIdRaw, remoteServer, developerRootDomain } = opts || {};
+  return expandFrontDoorHostPlaceholders(template, developerIdRaw, remoteServer, developerRootDomain);
 }
 
 function hostPortForProfile(profile, listenPort, developerIdNum) {
@@ -174,6 +176,7 @@ function buildTraefikPublicBaseIfApplicable(opts) {
     hostTemplate,
     developerIdRaw,
     remoteServer,
+    developerRootDomain,
     profile,
     developerIdNum
   } = opts;
@@ -181,7 +184,10 @@ function buildTraefikPublicBaseIfApplicable(opts) {
   if (!traefik || !pathActive || !hostTemplate || !String(hostTemplate).trim()) {
     return null;
   }
-  if (templateUsesRemoteHostPlaceholder(hostTemplate) && !String(remoteServer || '').trim()) {
+  if (
+    templateUsesRemoteHostPlaceholder(hostTemplate) &&
+    !hasFrontDoorRemoteHostContext({ remoteServer, developerRootDomain })
+  ) {
     // Local full-platform (no remote domain): use the single localhost front door port (3000 + devId×100).
     return localhostFrontDoorBaseForMissingRemote({
       profile,
@@ -190,7 +196,8 @@ function buildTraefikPublicBaseIfApplicable(opts) {
   }
   const expanded = expandFrontDoorHostTemplateForUrls(hostTemplate, {
     developerIdRaw,
-    remoteServer
+    remoteServer,
+    developerRootDomain
   });
   if (!expanded) {
     return null;