@aifabrix/builder 2.48.0 → 2.49.1

package/lib/cli/infra-guided-footers.js

@@ -0,0 +1,164 @@
+/**
+ * @fileoverview Footer and header layout for guided infra/platform CLI flows.
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('../utils/logger');
+const config = require('../core/config');
+const { computeAppBaseUrl, resolvePlatformControllerUrl } = require('../utils/platform-controller-url');
+const { successGlyph } = require('../utils/cli-test-layout-chalk');
+
+const SEPARATOR = '────────────────────────────────────────';
+
+function title(text) {
+  return chalk.bold(text);
+}
+
+function logSection(label, value) {
+  logger.log(title(label));
+  logger.log(`  ${value}`);
+  logger.log('');
+}
+
+function logFooterStart(label) {
+  logger.log('');
+  logger.log(SEPARATOR);
+  logger.log(title(label));
+  logger.log(SEPARATOR);
+  logger.log('');
+}
+
+function logFooterEnd() {
+  logger.log(SEPARATOR);
+}
+
+/**
+ * @async
+ * @returns {Promise<string>}
+ */
+async function resolvePlatformControllerUrlForDisplay() {
+  const stored = await config.getPlatformControllerUrl();
+  if (stored) {
+    return stored;
+  }
+  return resolvePlatformControllerUrl();
+}
+
+async function logPlatformReadyFooter() {
+  const [controllerUrl, dataplaneUrl, keycloakUrl] = await Promise.all([
+    resolvePlatformControllerUrlForDisplay(),
+    computeAppBaseUrl('dataplane'),
+    computeAppBaseUrl('keycloak')
+  ]);
+  const cfg = await config.getConfig();
+  const env = cfg && cfg.environment ? cfg.environment : 'dev';
+
+  logFooterStart('Platform Ready');
+  logSection('Environment', env);
+  logSection('Miso Controller', controllerUrl);
+  logSection('Dataplane (DEV)', dataplaneUrl);
+  logSection('Keycloak', keycloakUrl);
+  logSection('API Documentation', `${dataplaneUrl}/api/docs`);
+  logSection('Knowledge Base', 'https://docs.aifabrix.ai');
+  logSection('Getting Started', 'https://docs.aifabrix.ai/get-started');
+  logFooterEnd();
+}
+
+async function logMisoReadyFooter() {
+  const [controllerUrl, keycloakUrl] = await Promise.all([
+    resolvePlatformControllerUrlForDisplay(),
+    computeAppBaseUrl('keycloak')
+  ]);
+  logFooterStart('Miso Ready');
+  logSection('Miso Controller', controllerUrl);
+  logSection('Keycloak', keycloakUrl);
+  logFooterEnd();
+}
+
+async function logDataplaneReadyFooter() {
+  const dataplaneUrl = await computeAppBaseUrl('dataplane');
+  const cfg = await config.getConfig();
+  const env = cfg && cfg.environment ? cfg.environment : 'dev';
+  logFooterStart('Dataplane Ready');
+  logSection('Environment', env);
+  logSection('Dataplane (DEV)', dataplaneUrl);
+  logSection('API Documentation', `${dataplaneUrl}/api/docs`);
+  logFooterEnd();
+}
+
+/**
+ * @param {'platform'|'dataplane'} [scope]
+ */
+function logPlatformSetupDurationHint(scope = 'platform') {
+  const line =
+    scope === 'dataplane'
+      ? 'Installation may take a few minutes. Authenticating and starting Dataplane — please wait.'
+      : 'Installation may take a few minutes. Keycloak, Miso Controller, and Dataplane are starting — please wait.';
+  logger.log(chalk.yellow(`⚠ ${line}`));
+}
+
+function logGuidedPlatformSetupHeader() {
+  logger.log('');
+  logger.log(title('AI Fabrix Platform Setup'));
+  logger.log(SEPARATOR);
+  logger.log('');
+  logPlatformSetupDurationHint('platform');
+  logger.log('');
+}
+
+/**
+ * @param {{ deviceCleared: number, clientCleared: number, environment: string, defaultControllerUrl: string }} forceSummary
+ * @param {string[]} cleanedApps
+ */
+function logUpPlatformForceCleanSummary(forceSummary, cleanedApps) {
+  const { isSetupQuietOutput } = require('../utils/setup-quiet-output');
+  if (isSetupQuietOutput()) return;
+  const check = successGlyph();
+  logger.log(chalk.bold('Clean installation files'));
+  logger.log(
+    chalk.gray(
+      ` ${check} Cleared ${forceSummary.deviceCleared} device token(s) and ${forceSummary.clientCleared} client token(s)`
+    )
+  );
+  logger.log(chalk.gray(` ${check} Environment set to ${forceSummary.environment}`));
+  logger.log(
+    chalk.gray(
+      ` ${check} Default controller set to ${forceSummary.defaultControllerUrl} (run aifabrix login after platform is up)`
+    )
+  );
+  for (const appName of cleanedApps || []) {
+    logger.log(chalk.gray(` ${check} Cleaned builder/${appName}`));
+  }
+  logger.log('');
+}
+
+/**
+ * @param {Object} cfg
+ */
+function logStoppedServices(cfg) {
+  logger.log(title('Stopped'));
+  logger.log('  postgres');
+  logger.log('  redis');
+  if (cfg.pgadmin !== false) logger.log('  pgadmin');
+  if (cfg.redisCommander !== false) logger.log('  redis-commander');
+  if (cfg.traefik) logger.log('  traefik');
+  logger.log('');
+}
+
+module.exports = {
+  SEPARATOR,
+  title,
+  logSection,
+  logFooterStart,
+  logFooterEnd,
+  resolvePlatformControllerUrlForDisplay,
+  logPlatformReadyFooter,
+  logMisoReadyFooter,
+  logDataplaneReadyFooter,
+  logPlatformSetupDurationHint,
+  logGuidedPlatformSetupHeader,
+  logUpPlatformForceCleanSummary,
+  logStoppedServices
+};

package/lib/cli/infra-guided-spinners.js

@@ -0,0 +1,57 @@
+/**
+ * @fileoverview Spinner helpers for guided infra/platform CLI flows.
+ */
+
+'use strict';
+
+const ora = require('ora');
+const logger = require('../utils/logger');
+const { formatProgress, formatSuccessLine } = require('../utils/cli-test-layout-chalk');
+
+function shouldUseSpinner() {
+  return Boolean(process && process.stdout && process.stdout.isTTY);
+}
+
+/**
+ * @param {string} text
+ * @returns {import('ora').Ora|null}
+ */
+function startSpinner(text) {
+  if (!shouldUseSpinner()) {
+    logger.log(formatProgress(text));
+    return null;
+  }
+  return ora({ text, spinner: 'dots' }).start();
+}
+
+/**
+ * @param {import('ora').Ora|null} spinner
+ * @param {string} text
+ */
+function stopSpinnerSuccess(spinner, text) {
+  if (!spinner) {
+    logger.log(formatSuccessLine(text));
+    return;
+  }
+  spinner.succeed(text);
+}
+
+/**
+ * @param {import('ora').Ora|null} spinner
+ * @returns {(text: string) => void}
+ */
+function createSpinnerTextUpdater(spinner) {
+  return (text) => {
+    if (spinner) {
+      spinner.text = text;
+      return;
+    }
+    logger.log(formatProgress(text));
+  };
+}
+
+module.exports = {
+  startSpinner,
+  stopSpinnerSuccess,
+  createSpinnerTextUpdater
+};

package/lib/cli/infra-guided.js

@@ -10,10 +10,7 @@ const config = require('../core/config');
 const devConfig = require('../utils/dev-config');
 const pathsUtil = require('../utils/paths');
 const { loadConfigFile } = require('../utils/config-format');
-const { computeAppBaseUrl, resolvePlatformControllerUrl } = require('../utils/platform-controller-url');
 const { withMutedLogger } = require('../utils/with-muted-logger');
-const { formatProgress, formatSuccessLine, successGlyph } = require('../utils/cli-test-layout-chalk');
-const ora = require('ora');
 const infra = require('../infrastructure');
 const { execWithDockerEnv } = require('../utils/docker-exec');
 const { getLogLevel, passesLevelFilter } = require('../commands/app-logs');
@@ -23,6 +20,26 @@ const {
   runGuidedAuthStep,
   runGuidedDataplaneWithAuthRecovery
 } = require('./infra-guided-auth');
+const {
+  startSpinner,
+  stopSpinnerSuccess,
+  createSpinnerTextUpdater
+} = require('./infra-guided-spinners');
+const {
+  SEPARATOR,
+  title,
+  logSection,
+  logFooterStart,
+  logFooterEnd,
+  resolvePlatformControllerUrlForDisplay,
+  logPlatformReadyFooter,
+  logMisoReadyFooter,
+  logDataplaneReadyFooter,
+  logPlatformSetupDurationHint,
+  logGuidedPlatformSetupHeader,
+  logUpPlatformForceCleanSummary,
+  logStoppedServices
+} = require('./infra-guided-footers');
 const healthCheck = require('../utils/health-check');
 const { prepareUrlsLocalRegistryForUpPlatform } = require('../commands/up-common');
 const { assertDevInfraUp } = require('../commands/dev-infra-gate');
@@ -30,32 +47,6 @@ const {
   emitSystemBuilderAppManifestLineIfTTY
 } = require('../utils/manifest-source-emit');
 
-const SEPARATOR = '────────────────────────────────────────';
-
-function title(text) {
-  return chalk.bold(text);
-}
-
-function shouldUseSpinner() {
-  return Boolean(process && process.stdout && process.stdout.isTTY);
-}
-
-function startSpinner(text) {
-  if (!shouldUseSpinner()) {
-    logger.log(formatProgress(text));
-    return null;
-  }
-  return ora({ text, spinner: 'dots' }).start();
-}
-
-function stopSpinnerSuccess(spinner, text) {
-  if (!spinner) {
-    logger.log(formatSuccessLine(text));
-    return;
-  }
-  spinner.succeed(text);
-}
-
 async function getRunningContainerNameForApp(appName) {
   const apps = await infra.getAppStatus();
   const hit = (apps || []).find(a => a && a.name === appName && a.container);
@@ -113,6 +104,9 @@ async function waitForAppReady(appName, opts = {}) {
   if (userCfg && userCfg.traefik === true) {
     healthRunOpts.traefikEnabled = true;
   }
+  if (typeof opts.onPollText === 'function') {
+    healthRunOpts.onPollText = opts.onPollText;
+  }
   await healthCheck.waitForHealthCheck(appName, timeoutSeconds, hostPort, appConfig, false, healthRunOpts);
 }
 
@@ -124,84 +118,10 @@ function resolveInfraHost(remoteServer) {
     const u = new URL(withScheme);
     return u.hostname || 'localhost';
   } catch {
-    // Fallback for non-URL strings.
     return raw.replace(/^https?:\/\//i, '').split('/')[0].split(':')[0] || 'localhost';
   }
 }
 
-/**
- * Prefer stored platform controller URL, then compute from routing rules.
- * @async
- * @returns {Promise<string>}
- */
-async function resolvePlatformControllerUrlForDisplay() {
-  const stored = await config.getPlatformControllerUrl();
-  if (stored) {
-    return stored;
-  }
-  return resolvePlatformControllerUrl();
-}
-
-function logSection(label, value) {
-  logger.log(title(label));
-  logger.log(`  ${value}`);
-  logger.log('');
-}
-
-function logFooterStart(label) {
-  logger.log('');
-  logger.log(SEPARATOR);
-  logger.log(title(label));
-  logger.log(SEPARATOR);
-  logger.log('');
-}
-
-function logFooterEnd() {
-  logger.log(SEPARATOR);
-}
-
-async function logPlatformReadyFooter() {
-  const [controllerUrl, dataplaneUrl, keycloakUrl] = await Promise.all([
-    resolvePlatformControllerUrlForDisplay(),
-    computeAppBaseUrl('dataplane'),
-    computeAppBaseUrl('keycloak')
-  ]);
-  const cfg = await config.getConfig();
-  const env = (cfg && cfg.environment) ? cfg.environment : 'dev';
-
-  logFooterStart('Platform Ready');
-  logSection('Environment', env);
-  logSection('Miso Controller', controllerUrl);
-  logSection('Dataplane (DEV)', dataplaneUrl);
-  logSection('Keycloak', keycloakUrl);
-  logSection('API Documentation', `${dataplaneUrl}/api/docs`);
-  logSection('Knowledge Base', 'https://docs.aifabrix.ai');
-  logSection('Getting Started', 'https://docs.aifabrix.ai/get-started');
-  logFooterEnd();
-}
-
-async function logMisoReadyFooter() {
-  const [controllerUrl, keycloakUrl] = await Promise.all([
-    resolvePlatformControllerUrlForDisplay(),
-    computeAppBaseUrl('keycloak')
-  ]);
-  logFooterStart('Miso Ready');
-  logSection('Miso Controller', controllerUrl);
-  logSection('Keycloak', keycloakUrl);
-  logFooterEnd();
-}
-
-async function logDataplaneReadyFooter() {
-  const dataplaneUrl = await computeAppBaseUrl('dataplane');
-  const cfg = await config.getConfig();
-  const env = (cfg && cfg.environment) ? cfg.environment : 'dev';
-  logFooterStart('Dataplane Ready');
-  logSection('Environment', env);
-  logSection('Dataplane (DEV)', dataplaneUrl);
-  logSection('API Documentation', `${dataplaneUrl}/api/docs`);
-  logFooterEnd();
-}
-
 async function getInfraHostAndPorts() {
   const developerId = await config.getDeveloperId();
   const idNum = typeof developerId === 'string' ? parseInt(developerId, 10) : developerId;
@@ -263,23 +183,21 @@ async function runGuidedUpMiso(options, handleUpMiso) {
   stopSpinnerSuccess(kcSpin, 'Keycloak ready');
   logger.log('');
   const mcSpin = startSpinner('Starting Miso Controller...');
-  await waitForAppReady('miso-controller', { timeoutSeconds: 120 });
+  await waitForAppReady('miso-controller', {
+    timeoutSeconds: 120,
+    onPollText: createSpinnerTextUpdater(mcSpin)
+  });
   stopSpinnerSuccess(mcSpin, 'Miso Controller ready');
   await logMisoReadyFooter();
   await validateAppErrorLogs(['miso-controller']);
 }
 
-/**
- * Infra must be checked before auth: device login talks to the controller, which needs
- * Postgres/Redis when the controller runs locally — a down infra looks like "network error".
- */
 async function assertDevInfraForGuidedDataplane() {
   const infraSpin = startSpinner('Checking infrastructure...');
   try {
     await assertDevInfraUp({ quietSuccess: true });
     stopSpinnerSuccess(infraSpin, 'Infrastructure is up');
   } catch (infraErr) {
-    // Match up-miso: one error block from handleCommandError only (no spinner.fail / extra hints).
     if (infraSpin) infraSpin.stop();
     throw infraErr;
   }
@@ -293,17 +211,18 @@ async function runGuidedUpDataplane(options, handleUpDataplane) {
   logPlatformSetupDurationHint('dataplane');
   logger.log('');
   await assertDevInfraForGuidedDataplane();
-  // Avoid an outer long-running spinner here: up-dataplane has multiple internal
-  // phases and may print some output. An outer spinner causes "spinner over spinner"
-  // rendering artifacts. Instead, do the same single auth step as up-platform, then
-  // show one spinner for the dataplane install/run phase.
   await runGuidedAuthStep(handleLogin, {}, { startSpinner, stopSpinnerSuccess });
 
   logger.log('');
   emitSystemBuilderAppManifestLineIfTTY(logger, 'dataplane');
   const dpSpin = startSpinner('Starting Dataplane...');
-  await withMutedLogger(() =>
-    handleUpDataplane({ ...options, platformInstall: true, skipInfraCheck: true })
+  const controllerUrl = await resolveGuidedAuthControllerUrl({});
+  await runGuidedDataplaneWithAuthRecovery(
+    { ...options, platformInstall: true, skipInfraCheck: true },
+    handleUpDataplane,
+    handleLogin,
+    controllerUrl,
+    { onSpinnerText: createSpinnerTextUpdater(dpSpin) }
   );
   stopSpinnerSuccess(dpSpin, 'Dataplane ready');
   await refreshDataplaneVersionAfterPlatformInstall();
@@ -311,54 +230,6 @@ async function runGuidedUpDataplane(options, handleUpDataplane) {
   await logDataplaneReadyFooter();
 }
 
-/**
- * Guided-mode summary after `up-platform --force` (printed under the platform header).
- * @param {{ deviceCleared: number, clientCleared: number, environment: string, defaultControllerUrl: string }} forceSummary
- * @param {string[]} cleanedApps
- */
-function logUpPlatformForceCleanSummary(forceSummary, cleanedApps) {
-  const { isSetupQuietOutput } = require('../utils/setup-quiet-output');
-  if (isSetupQuietOutput()) return;
-  const check = successGlyph();
-  logger.log(chalk.bold('Clean installation files'));
-  logger.log(
-    chalk.gray(
-      ` ${check} Cleared ${forceSummary.deviceCleared} device token(s) and ${forceSummary.clientCleared} client token(s)`
-    )
-  );
-  logger.log(chalk.gray(` ${check} Environment set to ${forceSummary.environment}`));
-  logger.log(
-    chalk.gray(
-      ` ${check} Default controller set to ${forceSummary.defaultControllerUrl} (run aifabrix login after platform is up)`
-    )
-  );
-  for (const appName of cleanedApps || []) {
-    logger.log(chalk.gray(` ${check} Cleaned builder/${appName}`));
-  }
-  logger.log('');
-}
-
-/**
- * Yellow notice before long-running platform/dataplane install steps (setup and guided up-*).
- * @param {'platform'|'dataplane'} [scope]
- */
-function logPlatformSetupDurationHint(scope = 'platform') {
-  const line =
-    scope === 'dataplane'
-      ? 'Installation may take a few minutes. Authenticating and starting Dataplane — please wait.'
-      : 'Installation may take a few minutes. Keycloak, Miso Controller, and Dataplane are starting — please wait.';
-  logger.log(chalk.yellow(`⚠ ${line}`));
-}
-
-function logGuidedPlatformSetupHeader() {
-  logger.log('');
-  logger.log(title('AI Fabrix Platform Setup'));
-  logger.log(SEPARATOR);
-  logger.log('');
-  logPlatformSetupDurationHint('platform');
-  logger.log('');
-}
-
 async function refreshDataplaneVersionAfterPlatformInstall() {
   try {
     const { tryRefreshDataplaneVersionAfterLogin } = require('../commands/auth-status-dataplane-version');
@@ -377,7 +248,10 @@ async function runGuidedKeycloakAndMisoControllerPhase(options, handleUpMiso) {
   logger.log('');
   emitSystemBuilderAppManifestLineIfTTY(logger, 'miso-controller');
   const mcSpin = startSpinner('Starting Miso Controller...');
-  await waitForAppReady('miso-controller', { timeoutSeconds: 120 });
+  await waitForAppReady('miso-controller', {
+    timeoutSeconds: 120,
+    onPollText: createSpinnerTextUpdater(mcSpin)
+  });
   stopSpinnerSuccess(mcSpin, 'Miso Controller ready');
   logger.log('');
 }
@@ -386,20 +260,27 @@ async function runGuidedDataplaneInstallPhase(options, handleUpDataplane, handle
   logger.log('');
   emitSystemBuilderAppManifestLineIfTTY(logger, 'dataplane');
   const dpSpin = startSpinner('Starting Dataplane...');
+  const onSpinnerText = createSpinnerTextUpdater(dpSpin);
   const platformMode = await config.getSetupPlatformMode();
   if (platformMode === 'full') {
-    // Full platform: three dataplane containers + per-env registrations.
     const envKeys = ['pro', 'dev', 'tst'];
     for (const envKey of envKeys) {
       await runGuidedDataplaneWithAuthRecovery(
         { ...options, envKey, runEnvKey: envKey, allowNonDev: true },
         handleUpDataplane,
         handleLoginFn,
-        controllerUrl
+        controllerUrl,
+        { onSpinnerText }
       );
     }
   } else {
-    await runGuidedDataplaneWithAuthRecovery(options, handleUpDataplane, handleLoginFn, controllerUrl);
+    await runGuidedDataplaneWithAuthRecovery(
+      options,
+      handleUpDataplane,
+      handleLoginFn,
+      controllerUrl,
+      { onSpinnerText }
+    );
   }
   stopSpinnerSuccess(dpSpin, 'Dataplane ready');
   await refreshDataplaneVersionAfterPlatformInstall();
@@ -423,6 +304,7 @@ async function runGuidedUpPlatform(options, handleUpMiso, handleUpDataplane, han
     const realmSpin = startSpinner('Waiting for Keycloak realm (aifabrix)...');
     await waitForKeycloakRealmReady({ timeoutSeconds: 180 });
     stopSpinnerSuccess(realmSpin, 'Keycloak realm ready');
+    logger.log('');
   }
   await runGuidedAuthStep(handleLogin, authOpts, { startSpinner, stopSpinnerSuccess });
   const controllerUrl = await resolveGuidedAuthControllerUrl(authOpts);
@@ -431,17 +313,7 @@ async function runGuidedUpPlatform(options, handleUpMiso, handleUpDataplane, han
   await logPlatformReadyFooter();
 }
 
-function logStoppedServices(cfg) {
-  logger.log(title('Stopped'));
-  logger.log('  postgres');
-  logger.log('  redis');
-  if (cfg.pgadmin !== false) logger.log('  pgadmin');
-  if (cfg.redisCommander !== false) logger.log('  redis-commander');
-  if (cfg.traefik) logger.log('  traefik');
-  logger.log('');
-}
-
-async function runGuidedDownInfra(appName, options, infra, appLib) {
+async function runGuidedDownInfra(appName, options, infraMod, appLib) {
   logger.log('');
   logger.log(title('AI Fabrix Shutdown'));
   logger.log(SEPARATOR);
@@ -453,8 +325,8 @@ async function runGuidedDownInfra(appName, options, infra, appLib) {
       await appLib.downApp(appName, { volumes: !!options.volumes });
       return;
     }
-    if (options.volumes) await infra.stopInfraWithVolumes();
-    else await infra.stopInfra();
+    if (options.volumes) await infraMod.stopInfraWithVolumes();
+    else await infraMod.stopInfra();
   });
   stopSpinnerSuccess(spin, 'Infrastructure stopped');
 
@@ -479,4 +351,3 @@ module.exports = {
   runGuidedUpPlatform,
   runGuidedDownInfra
 };
-

package/lib/cli/setup-app.js

@@ -297,7 +297,7 @@ Examples:
     .option('--reload', 'In dev: mount workspace into container (Mutagen only if docker-endpoint is a remote host)')
     .option(
       '--proxy',
-      'Use Traefik/front-door public URL hints when infra has Traefik and application.yaml enables frontDoorRouting (default: on)',
+      'Use Traefik/front-door public URL hints when infra has Traefik (ignored when traefik: false in config)',
       true
     )
     .option(

package/lib/cli/setup-dev.js

@@ -39,6 +39,7 @@ Examples:
   $ aifabrix dev add --developer-id 02 --name "Jane Doe" --email jane@example.com
   $ aifabrix dev add --developer-id 03 --name "Build admin" --email admin@example.com --groups admin,developer
   $ aifabrix dev add --developer-id 04 --name "CI user" --email ci@example.com --groups secret-manager,developer
+  $ aifabrix dev add --developer-id 05 --name "Integrator" --email integrator@example.com --groups developer,secret-reader
 
 Requires a configured remote Builder Server and an admin client certificate (same machine setup as dev list / dev pin). After add, run dev pin <id> once to create a PIN for aifabrix dev init.
 `;
@@ -274,7 +275,7 @@ function setupDevListAddCommands(dev) {
     .requiredOption('--developer-id <id>', 'Unique id, digits only (e.g. 02); used with dev init --developer-id')
     .requiredOption('--name <name>', 'Display name')
     .requiredOption('--email <email>', 'Email address')
-    .option('--groups <items>', 'Comma-separated roles: admin, secret-manager, developer, docker', 'developer')
+    .option('--groups <items>', 'Comma-separated roles: admin, secret-manager, secret-reader, developer, docker', 'developer')
     .addHelpText('after', DEV_ADD_HELP_AFTER)
     .action(async(options) => {
       try {
@@ -297,7 +298,7 @@ function setupDevUpdatePinDeleteCommands(dev) {
     .option('--developer-id <id>', 'Developer ID (same as dev add)')
     .option('--name <name>', 'Display name')
     .option('--email <email>', 'Email address')
-    .option('--groups <items>', 'Comma-separated groups (admin, secret-manager, developer, docker)')
+    .option('--groups <items>', 'Comma-separated groups (admin, secret-manager, secret-reader, developer, docker)')
     .addHelpText('after', DEV_UPDATE_HELP_AFTER)
     .action(async(developerId, options) => {
       try {

package/lib/cli/setup-infra.js

@@ -34,7 +34,8 @@ const {
 
 const {
   computeEffectiveInfraOptionalFlags,
-  persistMissingInfraOptionalServiceFlags
+  persistMissingInfraOptionalServiceFlags,
+  resolveEffectiveTlsEnabled
 } = require('../utils/infra-optional-service-flags');
 
 const UP_INFRA_HELP_AFTER = `
@@ -137,7 +138,7 @@ async function runUpInfraCommand(options) {
   const { passwordBundleFromCliOptions } = require('../core/admin-secrets-bundle');
   const bundle = passwordBundleFromCliOptions(options);
   const adminPass = options.adminPassword || options.adminPwd;
-  const tlsEnabledEffective = cfg.tlsEnabled === true;
+  const tlsEnabledEffective = resolveEffectiveTlsEnabled(cfg, options);
   const effective = computeEffectiveInfraOptionalFlags(cfg, options);
   await infra.startInfra(developerId, {
     traefik: effective.traefik,

package/lib/cli/setup-platform.js

@@ -29,6 +29,8 @@ What this command does:
       2) Wipe data — drop every database and DB user, then up-infra + up-platform --force.
       3) Clean installation files — remove user-local secrets, then up-infra + up-platform --force.
       4) Update images — pull the latest infra and platform images, then up-infra + up-platform.
+  - With --mode fresh: first-time install when no infra is running (non-interactive; use with --admin-email and --admin-password).
+  - With --mode update-images: refresh images when infra is already running (non-interactive).
 
 AI tool keys are read from the user-local file (~/.aifabrix/secrets.local.yaml) merged with the shared aifabrix-secrets file. If either source already provides keys, the AI tool prompt is skipped.
 
@@ -59,6 +61,7 @@ function registerSetup(program) {
     .option('--pro-password-mode <mode>', 'Pro profile only: autogen or manual')
     .option('--admin-email <email>', 'Admin email (non-interactive fresh install)')
     .option('--admin-password <password>', 'Admin password for dev or pro manual-single (non-interactive)')
+    .option('--mode <mode>', 'Non-interactive mode: fresh (no infra) or update-images (infra running)')
     .option('-y, --yes', 'Skip destructive confirmation prompts (re-install, wipe data, teardown)')
     .addHelpText('after', SETUP_HELP_AFTER)
     .action(async(options) => {

package/lib/commands/login-device.js

@@ -96,7 +96,7 @@ async function saveTokenAndDisplaySuccess(controllerUrl, token, refreshToken, ex
       logger.log(chalk.gray(`Environment: ${envKey}`));
     }
     logger.log(chalk.gray('Token stored securely in ~/.aifabrix/config.yaml\n'));
-  } else {
+  } else if (!opts.suppressSuccessLine && !opts.guidedInstall) {
     logger.log(formatSuccessLine('Authentication successful'));
   }
 }
@@ -116,8 +116,10 @@ async function pollAndSaveDeviceCodeToken(controllerUrl, deviceCode, interval, e
   const spinner = useSpinner
     ? ora({ text: 'Waiting for approval', spinner: 'dots' }).start()
     : null;
-  if (!useSpinner) {
+  if (!useSpinner && !opts.onProgressText) {
     logger.log('Waiting for approval...');
+  } else if (opts.onProgressText) {
+    opts.onProgressText('Waiting for approval...');
   }
 
   let pollCount = 0;
@@ -125,6 +127,8 @@ async function pollAndSaveDeviceCodeToken(controllerUrl, deviceCode, interval, e
     pollCount++;
     if (spinner) {
       spinner.text = `Waiting for approval (attempt ${pollCount})...`;
+    } else if (opts.onProgressText) {
+      opts.onProgressText(`Waiting for approval (attempt ${pollCount})...`);
     }
   };