@aifabrix/builder 2.49.2 → 2.51.0

package/lib/utils/dev-ca-install.js

@@ -1,7 +1,7 @@
 /**
  * Dev CA Install – SSL untrusted detection, fetch CA from Builder Server, install into OS trust store.
- * Used by `aifabrix dev init` when the server certificate is self-signed. Only /install-ca uses
- * rejectUnauthorized: false; all other requests use default TLS verification.
+ * Used by `aifabrix dev init` when the server certificate is self-signed.
+ * Requests keep TLS verification enabled by default.
  *
  * @fileoverview CA install utilities for development Builder Server
  * @author AI Fabrix Team
@@ -163,7 +163,7 @@ function finalizeInstallCaResponse(res, absoluteUrl, chunks, resolve, reject) {
 }
 
 /**
- * GET absolute install-ca URL with insecure TLS; follow redirects (resolve relative Location).
+ * GET absolute install-ca URL with TLS verification enabled; follow redirects.
  * @param {string} absoluteUrl - Full https URL
  * @param {number} redirectCount - Redirect depth
  * @returns {Promise<Buffer>} CA PEM
@@ -179,10 +179,9 @@ function fetchInstallCaAbsolute(absoluteUrl, redirectCount) {
       reject(new Error('install-ca requires https URL'));
       return;
     }
-    const agent = new https.Agent({ rejectUnauthorized: false });
     const req = https.get(
       absoluteUrl,
-      { agent },
+      {},
       (res) => {
         if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
           res.destroy();
@@ -208,7 +207,7 @@ function fetchInstallCaAbsolute(absoluteUrl, redirectCount) {
 
 /**
  * Fetch CA PEM from Builder Server via GET {baseUrl}/install-ca.
- * Uses rejectUnauthorized: false only for this endpoint (dev setup).
+ * Uses default TLS verification for this endpoint.
  * @param {string} baseUrl - Builder Server base URL (no trailing slash)
  * @returns {Promise<Buffer>} CA certificate PEM
  */

package/lib/utils/dev-config.js

@@ -44,8 +44,8 @@ function getDevPorts(developerId) {
     throw new Error('Developer ID must be a positive number');
   }
 
-  // Handle invalids
-  if (developerId === undefined || developerId === null || Number.isNaN(developerId)) {
+  // Handle invalid numeric values
+  if (Number.isNaN(developerId)) {
     throw new Error('Developer ID must be a positive number');
   }
   if (developerId < 0 || !Number.isInteger(developerId)) {

package/lib/utils/dev-init-ssh-merge.js

@@ -2,10 +2,17 @@
  * @fileoverview After dev init: merge SSH config Host alias from sync settings / server URL.
  */
 
+const path = require('path');
 const chalk = require('chalk');
 const config = require('../core/config');
 const logger = require('./logger');
-const { ensureDevSshConfigBlock } = require('./dev-ssh-config-helper');
+const { ensureDevSshConfigBlock, listHostAliasesForUserHost } = require('./dev-ssh-config-helper');
+const { ensureSshDir } = require('./ssh-key-helper');
+const { nodeFs } = require('../internal/node-fs');
+const {
+  collectDevSshKnownHostCandidates,
+  refreshDevSshKnownHosts
+} = require('./ssh-known-hosts');
 const { successGlyph } = require('./cli-layout-chalk');
 
 /**
@@ -24,6 +31,134 @@ function hostnameFromBaseUrl(baseUrl) {
   }
 }
 
+/**
+ * @param {string} sshDir
+ * @returns {Promise<string>}
+ */
+async function readSshConfigContent(sshDir) {
+  const configPath = path.join(ensureSshDir(sshDir), 'config');
+  try {
+    return await nodeFs().promises.readFile(configPath, 'utf8');
+  } catch (e) {
+    if (e.code === 'ENOENT') {
+      return '';
+    }
+    throw e;
+  }
+}
+
+/**
+ * @param {Object} p
+ * @param {string} p.baseUrl
+ * @param {string} p.syncHost
+ * @param {string} p.syncUser
+ * @param {string} p.hostAlias
+ * @param {string} p.existingSshConfig
+ * @param {string|number} [p.developerId]
+ * @param {string} [p.developerRootDomain]
+ * @returns {Promise<void>}
+ */
+async function refreshKnownHostsForDevSsh(p) {
+  const legacyHostAliases = listHostAliasesForUserHost(
+    p.existingSshConfig,
+    p.syncHost,
+    p.syncUser
+  );
+  const candidates = collectDevSshKnownHostCandidates({
+    syncHost: p.syncHost,
+    syncUser: p.syncUser,
+    hostAlias: p.hostAlias,
+    baseUrl: p.baseUrl,
+    developerId: p.developerId,
+    developerRootDomain: p.developerRootDomain,
+    legacyHostAliases
+  });
+  const { cleared, failed } = await refreshDevSshKnownHosts(candidates);
+  if (cleared.length > 0) {
+    logger.log(
+      `${chalk.green('  ')}${successGlyph()}${chalk.green(' Cleared stale SSH host keys for ')}` +
+        chalk.cyan(cleared.join(', ')) +
+        chalk.gray(' (accept the new key on first connect if prompted).')
+    );
+  }
+  if (failed.some((row) => row.error === 'ssh-keygen not found')) {
+    logger.log(
+      chalk.yellow(
+        '  ⚠ ssh-keygen not found; if SSH reports "REMOTE HOST IDENTIFICATION HAS CHANGED", ' +
+          `run: ssh-keygen -R ${p.syncHost}`
+      )
+    );
+  }
+}
+
+/**
+ * @param {string|undefined} developerRootDomain
+ * @returns {string|undefined}
+ */
+function trimDeveloperRootDomain(developerRootDomain) {
+  const trimmed = developerRootDomain && String(developerRootDomain).trim();
+  return trimmed || undefined;
+}
+
+/**
+ * @param {Object} res
+ * @param {string} syncUser
+ * @param {string} syncHost
+ * @returns {void}
+ */
+function logSshConfigMergeResult(res, syncUser, syncHost) {
+  if (res.skippedDuplicate) {
+    logger.log(
+      chalk.gray('  SSH config already has ') +
+        chalk.cyan(`${syncUser}@${syncHost}`) +
+        chalk.gray(` (Host ${res.hostAlias}); left unchanged.`)
+    );
+    return;
+  }
+  const prefix =
+    `${chalk.green('  ')}${successGlyph()}${chalk.green(' SSH config updated: ')}` +
+    chalk.cyan(`Host ${res.hostAlias}`);
+  const suffix = res.migratedFrom
+    ? chalk.gray(` (was ${res.migratedFrom}) → ${res.configPath}`)
+    : chalk.gray(` → ${res.configPath}`);
+  logger.log(prefix + suffix);
+}
+
+/**
+ * @param {Object} p
+ * @param {string} p.baseUrl
+ * @param {string} p.devId
+ * @param {string} p.syncUser
+ * @param {string} p.syncHost
+ * @param {string|undefined} p.rootTrimmed
+ * @returns {Promise<{ hostAlias: string|null, syncUser: string, syncHost: string }>}
+ */
+async function mergeDevSshConfigBlock(p) {
+  const sshDir = ensureSshDir();
+  const existingSshConfig = await readSshConfigContent(sshDir);
+  const res = await ensureDevSshConfigBlock(p.syncUser, p.syncHost, sshDir, {
+    developerId: p.devId,
+    developerRootDomain: p.rootTrimmed
+  });
+  if (!res.ok || !res.configPath || !res.hostAlias) {
+    if (!res.ok && res.error) {
+      logger.log(chalk.yellow(`  ⚠ Could not update SSH config: ${res.error}`));
+    }
+    return { hostAlias: null, syncUser: p.syncUser, syncHost: p.syncHost };
+  }
+  await refreshKnownHostsForDevSsh({
+    baseUrl: p.baseUrl,
+    syncHost: p.syncHost,
+    syncUser: p.syncUser,
+    hostAlias: res.hostAlias,
+    existingSshConfig,
+    developerId: p.devId,
+    developerRootDomain: p.rootTrimmed
+  });
+  logSshConfigMergeResult(res, p.syncUser, p.syncHost);
+  return { hostAlias: res.hostAlias, syncUser: p.syncUser, syncHost: p.syncHost };
+}
+
 /**
  * Update ~/.ssh/config with Host <user>.<host> for interactive SSH; log result.
  * @param {string} baseUrl - Builder Server base URL
@@ -37,30 +172,37 @@ async function mergeDevSshConfigAfterInit(baseUrl, devId) {
     return { hostAlias: null, syncUser, syncHost: null };
   }
   try {
-    const res = await ensureDevSshConfigBlock(syncUser, syncHost);
-    if (res.ok && res.configPath && res.hostAlias) {
-      if (res.skippedDuplicate) {
-        logger.log(
-          chalk.gray('  SSH config already has ') +
-            chalk.cyan(`${syncUser}@${syncHost}`) +
-            chalk.gray(` (Host ${res.hostAlias}); left unchanged.`)
-        );
-      } else {
-        logger.log(
-          `${chalk.green('  ')}${successGlyph()}${chalk.green(' SSH config updated: ')}` +
-            chalk.cyan(`Host ${res.hostAlias}`) +
-            chalk.gray(` → ${res.configPath}`)
-        );
-      }
-      return { hostAlias: res.hostAlias, syncUser, syncHost };
-    }
-    if (!res.ok && res.error) {
-      logger.log(chalk.yellow(`  ⚠ Could not update SSH config: ${res.error}`));
-    }
+    const rootTrimmed = trimDeveloperRootDomain(await config.getDeveloperRootDomain());
+    return await mergeDevSshConfigBlock({
+      baseUrl,
+      devId,
+      syncUser,
+      syncHost,
+      rootTrimmed
+    });
   } catch (e) {
     logger.log(chalk.yellow(`  ⚠ Could not update SSH config: ${e.message || e}`));
+    return { hostAlias: null, syncUser, syncHost };
+  }
+}
+
+/**
+ * @param {{ hostAlias: string|null }} sshInfo
+ * @returns {void}
+ */
+function logDevSshConnectHint(sshInfo) {
+  if (!sshInfo || !sshInfo.hostAlias) {
+    return;
   }
-  return { hostAlias: null, syncUser, syncHost };
+  logger.log(
+    chalk.gray('  SSH: ') +
+      chalk.cyan(`ssh ${sshInfo.hostAlias}`) +
+      chalk.gray(' (host keys refreshed if the server was reprovisioned).')
+  );
 }
 
-module.exports = { mergeDevSshConfigAfterInit, hostnameFromBaseUrl };
+module.exports = {
+  mergeDevSshConfigAfterInit,
+  logDevSshConnectHint,
+  hostnameFromBaseUrl
+};

package/lib/utils/dev-list-sort.js

@@ -0,0 +1,145 @@
+/**
+ * @fileoverview Client-side sort for aifabrix dev list (--sort field / -field).
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+const ALLOWED_SORT_FIELDS = Object.freeze(['id', 'name', 'email', 'until']);
+
+/**
+ * @param {unknown} id
+ * @returns {string}
+ */
+function normalizeIdKey(id) {
+  const trimmed = String(id ?? '').trim();
+  if (!/^\d+$/.test(trimmed)) {
+    return trimmed;
+  }
+  return String(parseInt(trimmed, 10)).padStart(2, '0');
+}
+
+/**
+ * @param {unknown} a
+ * @param {unknown} b
+ * @returns {number}
+ */
+function compareIds(a, b) {
+  const sa = String(a ?? '').trim();
+  const sb = String(b ?? '').trim();
+  if (/^\d+$/.test(sa) && /^\d+$/.test(sb)) {
+    return parseInt(sa, 10) - parseInt(sb, 10);
+  }
+  return normalizeIdKey(sa).localeCompare(normalizeIdKey(sb), undefined, { sensitivity: 'base' });
+}
+
+/**
+ * @param {string} a
+ * @param {string} b
+ * @returns {number}
+ */
+function compareText(a, b) {
+  return a.localeCompare(b, undefined, { sensitivity: 'base' });
+}
+
+/**
+ * @param {Object} user
+ * @returns {string}
+ */
+function untilValue(user) {
+  const raw = user && user.certificateValidNotAfter;
+  return typeof raw === 'string' ? raw.trim() : '';
+}
+
+/**
+ * Parse --sort option. Default: name ascending.
+ * @param {string|undefined|null} sortOption
+ * @returns {{ field: string, descending: boolean }}
+ * @throws {Error} When field is empty or not allowed
+ */
+function parseSortSpec(sortOption) {
+  if (sortOption === undefined || sortOption === null) {
+    return { field: 'name', descending: false };
+  }
+  const trimmed = String(sortOption).trim();
+  if (!trimmed) {
+    throw new Error(
+      'Invalid --sort value "". Allowed: id, name, email, until (prefix - for descending).'
+    );
+  }
+  let descending = false;
+  let fieldPart = trimmed;
+  if (fieldPart.startsWith('-')) {
+    descending = true;
+    fieldPart = fieldPart.slice(1).trim();
+  }
+  if (!fieldPart) {
+    throw new Error(
+      'Invalid --sort value "-". Allowed: id, name, email, until (prefix - for descending).'
+    );
+  }
+  const field = fieldPart.toLowerCase();
+  if (!ALLOWED_SORT_FIELDS.includes(field)) {
+    throw new Error(
+      `Invalid --sort value "${trimmed}". Allowed: id, name, email, until (prefix - for descending).`
+    );
+  }
+  return { field, descending };
+}
+
+/**
+ * @param {Object} a
+ * @param {Object} b
+ * @param {string} field
+ * @returns {number}
+ */
+function compareByField(a, b, field) {
+  if (field === 'id') {
+    return compareIds(a.id, b.id);
+  }
+  if (field === 'name') {
+    return compareText(String(a.name || ''), String(b.name || ''));
+  }
+  if (field === 'email') {
+    return compareText(String(a.email || ''), String(b.email || ''));
+  }
+  const ua = untilValue(a);
+  const ub = untilValue(b);
+  if (!ua && !ub) {
+    return 0;
+  }
+  if (!ua) {
+    return 1;
+  }
+  if (!ub) {
+    return -1;
+  }
+  return compareText(ua, ub);
+}
+
+/**
+ * Sort developer users without mutating the input array.
+ * @param {Object[]} users
+ * @param {string|undefined|null} sortOption
+ * @returns {Object[]}
+ */
+function sortDevUsers(users, sortOption) {
+  const { field, descending } = parseSortSpec(sortOption);
+  const list = Array.isArray(users) ? [...users] : [];
+  list.sort((a, b) => {
+    let cmp = compareByField(a, b, field);
+    if (descending) {
+      cmp = -cmp;
+    }
+    if (cmp !== 0) {
+      return cmp;
+    }
+    return compareIds(a.id, b.id);
+  });
+  return list;
+}
+
+module.exports = {
+  ALLOWED_SORT_FIELDS,
+  parseSortSpec,
+  sortDevUsers
+};

package/lib/utils/dev-pin-share-instructions.js

@@ -0,0 +1,110 @@
+/**
+ * Copy-paste onboarding block for `aifabrix dev pin` (admin → developer).
+ *
+ * @fileoverview Dev PIN share instructions with platform prerequisites
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('./logger');
+const { formatSuccessLine } = require('./cli-test-layout-chalk');
+
+const NODE_INSTALL_URL = 'https://nodejs.org/';
+const BUILDER_INSTALL_CMD = 'npm install -g @aifabrix/builder';
+
+/**
+ * @returns {void}
+ */
+function logDevPinPrerequisites() {
+  logger.log(chalk.bold('Prerequisites (once per machine):'));
+  logger.log('');
+  logger.log(chalk.cyan('Windows'));
+  logger.log(chalk.gray(`  1. Install Node.js 18+ from ${NODE_INSTALL_URL}`));
+  logger.log(`  2. ${BUILDER_INSTALL_CMD}`);
+  logger.log('');
+  logger.log(chalk.cyan('Linux & macOS'));
+  logger.log(
+    chalk.gray(`  1. Install Node.js 18+ (${NODE_INSTALL_URL} or your package manager)`)
+  );
+  logger.log(`  2. ${BUILDER_INSTALL_CMD}`);
+  logger.log('');
+  logger.log(chalk.gray('  After install, `af` is a shortcut for `aifabrix`.'));
+}
+
+/**
+ * @param {string} baseInit
+ * @param {string} id
+ * @param {string} [hostsIp]
+ * @returns {void}
+ */
+function logPinHostsVariantLines(baseInit, id, hostsIp) {
+  logger.log(
+    chalk.cyan('2) Hosts file / administrator')
+    + chalk.gray(
+      ' — use when the hostname does not resolve and your organisation does not publish DNS for it. '
+      + 'Run in an elevated terminal so the hosts file can be updated, or add the entry manually:'
+    )
+  );
+  if (hostsIp) {
+    logger.log(`   ${baseInit} --add-hosts --hosts-ip ${hostsIp}`);
+  } else {
+    logger.log(`   ${baseInit} --add-hosts --hosts-ip <server-LAN-IPv4>`);
+    logger.log(
+      chalk.gray(
+        `   Replace <server-LAN-IPv4> with the Builder Server IPv4, or re-run: aifabrix dev pin ${id} --hosts-ip <ip>`
+      )
+    );
+  }
+}
+
+/**
+ * Log copy-paste dev init commands for the developer (standard vs hosts-file).
+ * @param {Object} p
+ * @param {string} p.id - Developer ID
+ * @param {string} p.serverUrl - Builder Server base URL
+ * @param {string} p.pin - One-time PIN
+ * @param {string} p.expiresAt - PIN expiry (API string)
+ * @param {string} [p.hostsIp] - Optional IPv4 for the hosts variant
+ * @returns {void}
+ */
+function logDevPinShareInstructions(p) {
+  const { id, serverUrl, pin, expiresAt, hostsIp } = p;
+  const baseInit = `aifabrix dev init --developer-id ${id} --server ${serverUrl} --pin ${pin}`;
+  const pinOnly = `aifabrix dev init --pin ${pin}`;
+  logger.log(formatSuccessLine(`PIN created for ${id}, expires ${expiresAt}.`));
+  logger.log('');
+  logger.log(
+    chalk.bold('Share with the developer — prerequisites and onboarding (PIN is one-time):')
+  );
+  logger.log('');
+  logDevPinPrerequisites();
+  logger.log('');
+  logger.log(chalk.bold('Then run one command to connect (choose the variant that fits):'));
+  logger.log('');
+  logger.log(
+    chalk.cyan('1) Standard')
+    + chalk.gray(' — use when this machine can resolve the server hostname (DNS or hosts already set):')
+  );
+  logger.log(`   ${baseInit}`);
+  logger.log('');
+  logPinHostsVariantLines(baseInit, id, hostsIp);
+  logger.log('');
+  logger.log(
+    chalk.cyan('3) Config already has remote-server + developer-id')
+    + chalk.gray(
+      ' — e.g. second machine / SSH session after settings were merged; same onboarding, PIN only:'
+    )
+  );
+  logger.log(`   ${pinOnly}`);
+  logger.log('');
+}
+
+module.exports = {
+  BUILDER_INSTALL_CMD,
+  NODE_INSTALL_URL,
+  logDevPinPrerequisites,
+  logDevPinShareInstructions
+};

package/lib/utils/dev-platform-tls.js

@@ -8,7 +8,6 @@
 
 'use strict';
 
-const https = require('https');
 const config = require('../core/config');
 const { isLocalhostPublicSchemeHostname } = require('./localhost-public-host');
 
@@ -68,65 +67,6 @@ async function shouldAllowInsecureDevPlatformTls(url) {
   }
 }
 
-/**
- * Minimal fetch for self-signed dev platform HTTPS (Node global fetch cannot set rejectUnauthorized).
- *
- * @param {string} url
- * @param {Object} options
- * @returns {Promise<{ status: number, statusText: string, headers: { get: Function }, text: Function, json: Function }>}
- */
-function nodeHttpsFetchInsecure(url, options = {}) {
-  return new Promise((resolve, reject) => {
-    const u = new URL(url);
-    const method = String(options.method || 'GET').toUpperCase();
-    const headers = { ...(options.headers || {}) };
-    const body = options.body;
-    const reqOpts = {
-      hostname: u.hostname,
-      port: u.port || 443,
-      path: `${u.pathname}${u.search}`,
-      method,
-      headers,
-      rejectUnauthorized: false
-    };
-
-    const req = https.request(reqOpts, (res) => {
-      const chunks = [];
-      res.on('data', (chunk) => chunks.push(chunk));
-      res.on('end', () => {
-        const raw = Buffer.concat(chunks).toString('utf8');
-        const status = res.statusCode || 0;
-        resolve({
-          ok: status >= 200 && status < 300,
-          status,
-          statusText: res.statusMessage || '',
-          headers: {
-            get: (name) => res.headers[String(name || '').toLowerCase()] || null
-          },
-          text: async() => raw,
-          json: async() => JSON.parse(raw)
-        });
-      });
-    });
-
-    req.on('error', reject);
-    if (options.signal) {
-      const onAbort = () => {
-        req.destroy(new Error('The operation was aborted'));
-      };
-      if (options.signal.aborted) {
-        onAbort();
-        return;
-      }
-      options.signal.addEventListener('abort', onAbort, { once: true });
-    }
-    if (body !== undefined && body !== null) {
-      req.write(typeof body === 'string' ? body : String(body));
-    }
-    req.end();
-  });
-}
-
 /**
  * @async
  * @param {string} url
@@ -134,9 +74,6 @@ function nodeHttpsFetchInsecure(url, options = {}) {
  * @returns {Promise<Response>}
  */
 async function fetchWithOptionalDevPlatformTls(url, options = {}) {
-  if (await shouldAllowInsecureDevPlatformTls(url)) {
-    return nodeHttpsFetchInsecure(url, options);
-  }
   return fetch(url, options);
 }