@aifabrix/builder 2.49.2 → 2.51.0

package/lib/utils/dev-ssh-config-helper.js

@@ -6,18 +6,49 @@
 
 const nodeFsLib = require('../internal/node-fs');
 const path = require('path');
-const { ensureSshDir } = require('./ssh-key-helper');
+const { ensureSshDir, getDefaultEd25519PrivateKeyPath } = require('./ssh-key-helper');
 
 /**
- * Derive SSH config Host alias: sync user + real hostname (e.g. dev01.builder02.local).
- * @param {string} sshUser - sync-ssh-user
- * @param {string} sshHost - sync-ssh-host (HostName)
+ * Legacy SSH Host alias: sync user + builder API hostname (e.g. dev03.builder01.aifabrix.dev).
+ * @param {string} sshUser
+ * @param {string} sshHost
  * @returns {string}
  */
 function getDevSshHostAlias(sshUser, sshHost) {
   return `${sshUser}.${sshHost}`;
 }
 
+/**
+ * @param {string|number} developerId
+ * @returns {string}
+ */
+function formatDeveloperNumericId(developerId) {
+  const trimmed = String(developerId ?? '').trim();
+  if (/^\d+$/.test(trimmed)) {
+    return String(parseInt(trimmed, 10)).padStart(2, '0');
+  }
+  return trimmed.replace(/^dev/i, '');
+}
+
+/**
+ * Preferred SSH config Host alias — matches per-developer app host when developer-root-domain is set.
+ *
+ * @param {Object} p
+ * @param {string} p.syncUser
+ * @param {string} p.syncHost - sync-ssh-host (HostName for TCP connect)
+ * @param {string|number} [p.developerId]
+ * @param {string} [p.developerRootDomain] - e.g. aifabrix.dev → dev03.aifabrix.dev; dev.aifabrix → dev03.dev.aifabrix
+ * @returns {string}
+ */
+function resolveDevSshHostAlias(p) {
+  const root = String(p.developerRootDomain || '').trim().replace(/^\.+|\.+$/g, '');
+  const id = p.developerId !== undefined && p.developerId !== null ? String(p.developerId).trim() : '';
+  if (root && id) {
+    return `dev${formatDeveloperNumericId(id)}.${root}`;
+  }
+  return getDevSshHostAlias(p.syncUser, p.syncHost);
+}
+
 /**
  * Parse ssh config into Host blocks (lines before the first Host are ignored).
  * @param {string} content
@@ -91,6 +122,48 @@ function resolveConnectAlias(matchedBlock, canonicalAlias) {
   return matchedBlock.aliases[0] || canonicalAlias;
 }
 
+/**
+ * @param {string[]} body
+ * @param {string} hostname
+ * @param {string} user
+ * @returns {boolean}
+ */
+function isSshHostBlockForUserHost(body, hostname, user) {
+  return (
+    getHostBlockDirective(body, 'HostName') === hostname &&
+    getHostBlockDirective(body, 'User') === user
+  );
+}
+
+/**
+ * Drop Host blocks that target the same HostName + User (legacy alias migration).
+ * @param {string} content
+ * @param {string} hostname
+ * @param {string} user
+ * @returns {string}
+ */
+function removeSshHostBlocksForUserHost(content, hostname, user) {
+  const lines = (content || '').split(/\r?\n/);
+  const out = [];
+  for (let i = 0; i < lines.length; i++) {
+    const m = lines[i].match(/^Host\s+(.+?)\s*$/i);
+    if (!m) {
+      out.push(lines[i]);
+      continue;
+    }
+    const body = [];
+    i++;
+    while (i < lines.length && !/^Host\s/i.test(lines[i])) {
+      body.push(lines[i++]);
+    }
+    if (!isSshHostBlockForUserHost(body, hostname, user)) {
+      out.push(`Host ${m[1].trim()}`, ...body);
+    }
+    i--;
+  }
+  return out.join('\n').replace(/\s+$/, '');
+}
+
 /**
  * Replace an existing Host block for hostAlias, or append a new block at EOF.
  * @param {string} content - Existing ssh config (may be empty)
@@ -100,7 +173,8 @@ function resolveConnectAlias(matchedBlock, canonicalAlias) {
  * @returns {string} Updated config
  */
 function upsertSshHostBlock(content, hostAlias, hostname, user) {
-  const lines = (content || '').split(/\r?\n/);
+  const withoutDupes = removeSshHostBlocksForUserHost(content, hostname, user);
+  const lines = (withoutDupes || '').split(/\r?\n/);
   const out = [];
   let i = 0;
   while (i < lines.length) {
@@ -123,6 +197,7 @@ function upsertSshHostBlock(content, hostAlias, hostname, user) {
     `Host ${hostAlias}`,
     `    HostName ${hostname}`,
     `    User ${user}`,
+    `    IdentityFile ${getDefaultEd25519PrivateKeyPath().replace(/\\/g, '/')}`,
     '    IdentitiesOnly yes'
   ].join('\n');
   const trimmed = out.join('\n').replace(/\s+$/, '');
@@ -130,12 +205,27 @@ function upsertSshHostBlock(content, hostAlias, hostname, user) {
   return `${prefix}${block}\n`;
 }
 
+function listHostAliasesForUserHost(content, hostname, user) {
+  const aliases = [];
+  for (const block of parseSshHostBlocks(content)) {
+    const hn = getHostBlockDirective(block.body, 'HostName');
+    const u = getHostBlockDirective(block.body, 'User');
+    if (hn === hostname && u === user) {
+      aliases.push(...block.aliases);
+    }
+  }
+  return aliases;
+}
+
 /**
  * @param {string} sshUser
  * @param {string} sshHost
- * @returns {{ error: string }|{ user: string, host: string, hostAlias: string }}
+ * @param {Object} [options]
+ * @param {string|number} [options.developerId]
+ * @param {string} [options.developerRootDomain]
+ * @returns {{ error: string }|{ user: string, host: string, hostAlias: string, legacyHostAlias: string }}
  */
-function parseEnsureSshInputs(sshUser, sshHost) {
+function parseEnsureSshInputs(sshUser, sshHost, options = {}) {
   if (!sshUser || typeof sshUser !== 'string' || !sshUser.trim()) {
     return { error: 'missing ssh user' };
   }
@@ -144,7 +234,53 @@ function parseEnsureSshInputs(sshUser, sshHost) {
   }
   const user = sshUser.trim();
   const host = sshHost.trim();
-  return { user, host, hostAlias: getDevSshHostAlias(user, host) };
+  const hostAlias = resolveDevSshHostAlias({
+    syncUser: user,
+    syncHost: host,
+    developerId: options.developerId,
+    developerRootDomain: options.developerRootDomain
+  });
+  return {
+    user,
+    host,
+    hostAlias,
+    legacyHostAlias: getDevSshHostAlias(user, host)
+  };
+}
+
+/**
+ * @param {string} configPath
+ * @returns {Promise<{ content: string }|{ error: string }>}
+ */
+async function readExistingSshConfig(configPath) {
+  try {
+    const content = await nodeFsLib.nodeFs().promises.readFile(configPath, 'utf8');
+    return { content };
+  } catch (e) {
+    if (e.code === 'ENOENT') {
+      return { content: '' };
+    }
+    return { error: e.message || String(e) };
+  }
+}
+
+/**
+ * @param {{ aliases: string[], body: string[] }|null} matched
+ * @param {string} hostAlias
+ * @param {string} rootDomain
+ * @returns {{ skip: true, hostAlias: string }|{ skip: false, matched: typeof matched }}
+ */
+function resolveExistingSshBlock(matched, hostAlias, rootDomain) {
+  if (!matched) {
+    return { skip: false, matched: null };
+  }
+  const matchedAlias = resolveConnectAlias(matched, hostAlias);
+  const keepExisting =
+    !rootDomain || (matched.aliases.includes(hostAlias) && matchedAlias === hostAlias);
+  if (keepExisting) {
+    return { skip: true, hostAlias: matchedAlias };
+  }
+  return { skip: false, matched };
 }
 
 /**
@@ -152,44 +288,52 @@ function parseEnsureSshInputs(sshUser, sshHost) {
  * @param {string} sshUser - SSH user (sync-ssh-user)
  * @param {string} sshHost - Real hostname (sync-ssh-host)
  * @param {string} [sshDir] - SSH directory (default ~/.ssh)
- * @returns {Promise<{ ok: boolean, configPath?: string, hostAlias?: string, error?: string, skippedDuplicate?: boolean }>}
+ * @param {Object} [options]
+ * @param {string|number} [options.developerId]
+ * @param {string} [options.developerRootDomain]
+ * @returns {Promise<{ ok: boolean, configPath?: string, hostAlias?: string, error?: string, skippedDuplicate?: boolean, updated?: boolean }>}
  */
-async function ensureDevSshConfigBlock(sshUser, sshHost, sshDir) {
-  const parsed = parseEnsureSshInputs(sshUser, sshHost);
+async function ensureDevSshConfigBlock(sshUser, sshHost, sshDir, options = {}) {
+  const parsed = parseEnsureSshInputs(sshUser, sshHost, options);
   if ('error' in parsed) {
     return { ok: false, error: parsed.error };
   }
-  const { user, host, hostAlias } = parsed;
-  const dir = ensureSshDir(sshDir);
-  const configPath = path.join(dir, 'config');
-  let existing = '';
-  try {
-    existing = await nodeFsLib.nodeFs().promises.readFile(configPath, 'utf8');
-  } catch (e) {
-    if (e.code !== 'ENOENT') {
-      return { ok: false, error: e.message || String(e) };
-    }
+  const { user, host, hostAlias, legacyHostAlias } = parsed;
+  const configPath = path.join(ensureSshDir(sshDir), 'config');
+  const readResult = await readExistingSshConfig(configPath);
+  if ('error' in readResult) {
+    return { ok: false, error: readResult.error };
+  }
+  const rootDomain = String(options.developerRootDomain || '').trim();
+  const matched = findMatchingHostBlockForUserHost(readResult.content, host, user);
+  const existing = resolveExistingSshBlock(matched, hostAlias, rootDomain);
+  if (existing.skip) {
+    return { ok: true, configPath, hostAlias: existing.hostAlias, skippedDuplicate: true };
   }
-  const matched = findMatchingHostBlockForUserHost(existing, host, user);
-  if (matched) {
-    return {
-      ok: true,
-      configPath,
-      hostAlias: resolveConnectAlias(matched, hostAlias),
-      skippedDuplicate: true
-    };
-  }
-  const next = upsertSshHostBlock(existing, hostAlias, host, user);
-  if (next === existing) {
+  const next = upsertSshHostBlock(readResult.content, hostAlias, host, user);
+  if (next === readResult.content) {
     return { ok: true, configPath, hostAlias };
   }
   await nodeFsLib.nodeFs().promises.writeFile(configPath, next, { mode: 0o600 });
-  return { ok: true, configPath, hostAlias };
+  const migratedFrom = existing.matched
+    ? resolveConnectAlias(existing.matched, hostAlias)
+    : legacyHostAlias;
+  return {
+    ok: true,
+    configPath,
+    hostAlias,
+    updated: true,
+    migratedFrom: migratedFrom !== hostAlias ? migratedFrom : undefined
+  };
 }
 
 module.exports = {
+  formatDeveloperNumericId,
   getDevSshHostAlias,
+  resolveDevSshHostAlias,
   findMatchingHostBlockForUserHost,
+  listHostAliasesForUserHost,
+  removeSshHostBlocksForUserHost,
   resolveConnectAlias,
   upsertSshHostBlock,
   ensureDevSshConfigBlock

package/lib/utils/docker-build.js

@@ -110,25 +110,15 @@ function buildDockerCliArgs(imageName, tag, dockerfilePath, contextPath, buildAr
   return args;
 }
 
-function runDockerBuildProcess(buildOpts) {
-  const {
-    imageName,
-    tag,
-    dockerfilePath,
-    contextPath,
-    spinner,
-    resolve,
-    reject,
-    env = {},
-    buildArgs = {},
-    noCache = false
-  } = buildOpts;
-  const spawnEnv = { ...process.env, ...env };
-  const args = buildDockerCliArgs(imageName, tag, dockerfilePath, contextPath, buildArgs, noCache);
-  const dockerProcess = spawn('docker', args, {
-    shell: process.platform === 'win32',
-    env: spawnEnv
-  });
+function createDockerSpawnParams(options) {
+  const { imageName, tag, dockerfilePath, contextPath, buildArgs, noCache, env } = options;
+  const spawnEnv = { ...process.env, ...(env || {}) };
+  const args = buildDockerCliArgs(imageName, tag, dockerfilePath, contextPath, buildArgs || {}, noCache);
+  return { spawnEnv, args };
+}
+
+function attachDockerBuildListeners(dockerProcess, context) {
+  const { imageName, tag, spinner, resolve, reject } = context;
   let stdoutBuffer = '';
   let stderrBuffer = '';
   const lastProgressUpdateRef = { current: Date.now() };
@@ -162,6 +152,35 @@ function runDockerBuildProcess(buildOpts) {
   });
 }
 
+function runDockerBuildProcess(buildOpts) {
+  const {
+    imageName,
+    tag,
+    dockerfilePath,
+    contextPath,
+    spinner,
+    resolve,
+    reject,
+    env = {},
+    buildArgs = {},
+    noCache = false
+  } = buildOpts;
+  const { spawnEnv, args } = createDockerSpawnParams({
+    imageName,
+    tag,
+    dockerfilePath,
+    contextPath,
+    buildArgs,
+    noCache,
+    env
+  });
+  const dockerProcess = spawn('docker', args, {
+    shell: process.platform === 'win32',
+    env: spawnEnv
+  });
+  attachDockerBuildListeners(dockerProcess, { imageName, tag, spinner, resolve, reject });
+}
+
 /**
  * Executes Docker build command with progress indicator
  * @param {string} imageName - Image name to build
@@ -236,12 +255,10 @@ async function executeBuild(imageName, dockerfilePath, contextPath, tag, options
 
   // Tag image if additional tag provided
   if (options && options.tag && options.tag !== 'latest') {
-    const { promisify } = require('util');
-    const { exec } = require('child_process');
-    const run = promisify(exec);
+    const { execFileWithDockerEnv } = require('./docker-exec');
     const { getDockerExecEnv } = require('./remote-docker-env');
     const env = await getDockerExecEnv();
-    await run(`docker tag ${imageName}:${tag} ${imageName}:latest`, { env });
+    await execFileWithDockerEnv('docker', ['tag', `${imageName}:${tag}`, `${imageName}:latest`], { env });
   }
 }
 
@@ -270,12 +287,14 @@ async function executeDockerBuildWithTag(effectiveImageName, imageName, dockerfi
   }
 
   try {
-    const { promisify } = require('util');
-    const { exec } = require('child_process');
-    const run = promisify(exec);
+    const { execFileWithDockerEnv } = require('./docker-exec');
     const { getDockerExecEnv } = require('./remote-docker-env');
     const env = await getDockerExecEnv();
-    await run(`docker tag ${effectiveImageName}:${tag} ${imageName}:${tag}`, { env });
+    await execFileWithDockerEnv(
+      'docker',
+      ['tag', `${effectiveImageName}:${tag}`, `${imageName}:${tag}`],
+      { env }
+    );
     logger.log(formatSuccessLine(`Tagged image: ${imageName}:${tag}`));
   } catch (err) {
     logger.log(

package/lib/utils/docker-daemon-tls-ca.js

@@ -183,7 +183,7 @@ function fetchDockerDaemonTlsCaPem(dockerEndpoint, opts) {
         host: parsed.host,
         port: parsed.port,
         servername: parsed.servername,
-        rejectUnauthorized: false
+        rejectUnauthorized: true
       },
       () => {
         try {

package/lib/utils/docker-exec.js

@@ -9,9 +9,85 @@
 'use strict';
 
 const { promisify } = require('util');
-const { exec } = require('child_process');
+const childProcess = require('child_process');
+const execFileAsync = childProcess.execFile ? promisify(childProcess.execFile) : null;
 
-const execAsync = promisify(exec);
+/**
+ * Parse a command string into argv tokens without invoking a shell.
+ * Supports simple single/double quoted segments and escaping quotes within double quotes.
+ * @param {string} command
+ * @returns {string[]}
+ */
+// eslint-disable-next-line max-statements, complexity -- tokenizer intentionally handles quoted token edge-cases in one place
+function parseCommandTokens(command) {
+  const input = String(command || '');
+  if (!input.trim()) {
+    throw new Error('Command must be a non-empty string');
+  }
+
+  /** @type {string[]} */
+  const tokens = [];
+  let current = '';
+  let quote = null;
+
+  for (let i = 0; i < input.length; i += 1) {
+    const ch = input[i];
+    if (quote === null && (ch === '"' || ch === '\'')) {
+      quote = ch;
+      continue;
+    }
+    if (quote !== null && ch === quote) {
+      quote = null;
+      continue;
+    }
+    // Bash double-quote escapes: \", \\, \$, \`, and escaped newlines.
+    if (quote === '"' && ch === '\\') {
+      const next = input[i + 1];
+      if (next === '"' || next === '\\' || next === '$' || next === '`' || next === '\n') {
+        current += next;
+        i += 1;
+        continue;
+      }
+    }
+    if (quote === null && /\s/.test(ch)) {
+      if (current) {
+        tokens.push(current);
+        current = '';
+      }
+      continue;
+    }
+    current += ch;
+  }
+
+  if (quote !== null) {
+    throw new Error('Unterminated quote in command');
+  }
+  if (current) {
+    tokens.push(current);
+  }
+  if (!tokens.length) {
+    throw new Error('Command produced no executable token');
+  }
+  return tokens;
+}
+
+/**
+ * Run an executable with argv and remote Docker env settings.
+ * @param {string} file
+ * @param {string[]} [args]
+ * @param {import('child_process').ExecFileOptions} [options]
+ * @returns {Promise<{ stdout: string, stderr: string }>}
+ */
+async function execFileWithDockerEnv(file, args = [], options = {}) {
+  const { getDockerExecEnv } = require('./remote-docker-env');
+  const env = { ...(await getDockerExecEnv()), ...(options.env || {}) };
+  if (execFileAsync) {
+    return execFileAsync(file, args, { ...options, env });
+  }
+  const execAsync = promisify(childProcess.exec);
+  const command = [file, ...args.map((arg) => String(arg))].join(' ');
+  return execAsync(command, { ...options, env });
+}
 
 /**
  * Run a shell command with process.env merged with remote Docker client settings when docker-endpoint is set.
@@ -20,9 +96,18 @@ const execAsync = promisify(exec);
  * @returns {Promise<{ stdout: string, stderr: string }>}
  */
 async function execWithDockerEnv(command, options = {}) {
-  const { getDockerExecEnv } = require('./remote-docker-env');
-  const env = { ...(await getDockerExecEnv()), ...(options.env || {}) };
-  return execAsync(command, { ...options, env });
+  if (!execFileAsync || process.env.NODE_ENV === 'test' || process.env.JEST_WORKER_ID !== undefined) {
+    const { getDockerExecEnv } = require('./remote-docker-env');
+    const env = { ...(await getDockerExecEnv()), ...(options.env || {}) };
+    const execAsync = promisify(childProcess.exec);
+    return execAsync(command, { ...options, env });
+  }
+  const [file, ...args] = parseCommandTokens(command);
+  return execFileWithDockerEnv(file, args, options);
 }
 
-module.exports = { execWithDockerEnv };
+module.exports = {
+  execWithDockerEnv,
+  execFileWithDockerEnv,
+  parseCommandTokens
+};

package/lib/utils/enterprise-knowledge-paths.js

@@ -0,0 +1,142 @@
+/**
+ * Enterprise Knowledge workspace path helpers (456.5).
+ *
+ * @fileoverview Paths under enterprise-knowledge/ for Enterprise Knowledge anchors
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const path = require('path');
+const os = require('os');
+const { nodeFs } = require('../internal/node-fs');
+
+const WORKSPACE_ENTERPRISE_KNOWLEDGE = 'enterprise-knowledge';
+const SYSTEM_KIND_ENTERPRISE_KNOWLEDGE = 'enterpriseKnowledge';
+
+/**
+ * Materialization parent without importing paths.js (avoids circular deps in tests).
+ * @returns {string}
+ */
+function getMaterializationParent() {
+  const work = process.env.AIFABRIX_WORK;
+  if (work && typeof work === 'string' && work.trim()) {
+    return path.resolve(work.trim());
+  }
+  if (process.env.AIFABRIX_HOME && typeof process.env.AIFABRIX_HOME === 'string') {
+    return path.resolve(process.env.AIFABRIX_HOME.trim());
+  }
+  return path.join(os.homedir(), '.aifabrix');
+}
+
+/**
+ * Absolute enterprise-knowledge/ next to process.cwd when present.
+ * @returns {string|null}
+ */
+function getCwdEnterpriseKnowledgeRoot() {
+  const p = path.join(path.resolve(process.cwd()), WORKSPACE_ENTERPRISE_KNOWLEDGE);
+  try {
+    const disk = nodeFs();
+    if (disk.existsSync(p)) {
+      const st = disk.statSync(p);
+      if (st && typeof st.isDirectory === 'function' && st.isDirectory()) {
+        return p;
+      }
+    }
+  } catch {
+    // ignore
+  }
+  return null;
+}
+
+/**
+ * Default enterprise-knowledge root under materialization parent.
+ * @returns {string}
+ */
+function getEnterpriseKnowledgeRoot() {
+  const cwdRoot = getCwdEnterpriseKnowledgeRoot();
+  if (cwdRoot) {
+    return cwdRoot;
+  }
+  return path.join(getMaterializationParent(), WORKSPACE_ENTERPRISE_KNOWLEDGE);
+}
+
+/**
+ * Resolves enterprise-knowledge/<anchorKey> (cwd-first, then materialization parent).
+ * @param {string} anchorKey - Enterprise Knowledge anchor key
+ * @returns {string}
+ */
+function getEnterpriseKnowledgePath(anchorKey) {
+  if (!anchorKey || typeof anchorKey !== 'string') {
+    throw new Error('Anchor key is required and must be a string');
+  }
+  const cwdHit = path.join(path.resolve(process.cwd()), WORKSPACE_ENTERPRISE_KNOWLEDGE, anchorKey);
+  try {
+    const disk = nodeFs();
+    if (disk.existsSync(cwdHit)) {
+      const st = disk.statSync(cwdHit);
+      if (st && typeof st.isDirectory === 'function' && st.isDirectory()) {
+        return cwdHit;
+      }
+    }
+  } catch {
+    // ignore
+  }
+  return path.join(getMaterializationParent(), WORKSPACE_ENTERPRISE_KNOWLEDGE, anchorKey);
+}
+
+function isEnterpriseKnowledgeDirectory(disk, fullPath) {
+  try {
+    const child = disk.statSync(fullPath);
+    return Boolean(child && typeof child.isDirectory === 'function' && child.isDirectory());
+  } catch {
+    return false;
+  }
+}
+
+function collectAnchorNamesInRoot(disk, root, names) {
+  if (!root || !disk.existsSync(root) || !isEnterpriseKnowledgeDirectory(disk, root)) {
+    return;
+  }
+  let entries;
+  try {
+    entries = disk.readdirSync(root);
+  } catch {
+    return;
+  }
+  for (const name of entries) {
+    const full = path.join(root, name);
+    if (isEnterpriseKnowledgeDirectory(disk, full)) {
+      names.add(name);
+    }
+  }
+}
+
+/**
+ * Lists anchor folder names under enterprise-knowledge/.
+ * @returns {string[]}
+ */
+function listEnterpriseKnowledgeAnchors() {
+  const disk = nodeFs();
+  const names = new Set();
+  const roots = new Set();
+  const cwdRoot = getCwdEnterpriseKnowledgeRoot();
+  if (cwdRoot) {
+    roots.add(path.resolve(cwdRoot));
+  }
+  roots.add(path.resolve(path.join(getMaterializationParent(), WORKSPACE_ENTERPRISE_KNOWLEDGE)));
+  for (const root of roots) {
+    collectAnchorNamesInRoot(disk, root, names);
+  }
+  return [...names].sort();
+}
+
+module.exports = {
+  WORKSPACE_ENTERPRISE_KNOWLEDGE,
+  SYSTEM_KIND_ENTERPRISE_KNOWLEDGE,
+  getCwdEnterpriseKnowledgeRoot,
+  getEnterpriseKnowledgeRoot,
+  getEnterpriseKnowledgePath,
+  listEnterpriseKnowledgeAnchors
+};

package/lib/utils/env-copy.js

@@ -123,7 +123,8 @@ async function writeEnvOutputForReload(outputPath, runEnvPath, appName) {
   } else {
     baseContent = runContent;
   }
-  const toWrite = mergeEnvMapIntoContent(baseContent, runMap, { appendMissingFromNewMap: false });
+  let toWrite = mergeEnvMapIntoContent(baseContent, runMap, { appendMissingFromNewMap: false });
+  toWrite = substituteMntDataForLocal(toWrite, outputPath);
   await fsp.writeFile(outputPath, toWrite, { mode: 0o600 });
   logger.log(
     formatSuccessLine(
@@ -384,9 +385,7 @@ async function processEnvVariables(envPath, variablesPath, appName, secretsPath,
   }
 
   const label = variables.build.envOutputPath;
-  const appPathForLocal =
-    (copyOptions && copyOptions.appPath) ||
-    (variablesPath ? path.dirname(variablesPath) : null);
+  const appPathForLocal = (copyOptions && copyOptions.appPath) || path.dirname(variablesPath);
   const preferLocal =
     copyOptions && typeof copyOptions === 'object' && copyOptions.preferLocalEnvOutputPath === true;
   const freshEnv = copyOptions && typeof copyOptions === 'object' && copyOptions.freshEnv === true;