@aifabrix/builder 2.50.0 → 2.51.0

package/lib/commands/deploy-gate-orchestrator.js

@@ -103,9 +103,16 @@ async function runRequiredDeployStep(label, runner, isOk, stepOptions = {}) {
       const outcome = await runner();
       if (!isOk(outcome)) {
         const detail = formatDeployGateFailure(label, outcome);
-        logger.log(chalk.red(`✖ ${detail}`));
+        if (stepOptions.quietDeployUi !== true) {
+          logger.log(chalk.red(`✖ ${detail}`));
+        }
         const err = new Error(`${label} failed: ${detail}`);
         err.gateFailure = true;
+        err.gateDetail = detail;
+        err.gateLabel = label;
+        if (stepOptions.gatePillar) {
+          err.gatePillar = stepOptions.gatePillar;
+        }
         throw err;
       }
       return outcome;
@@ -134,7 +141,9 @@ async function runDeployBaselineSteps(systemKey, options) {
       ...options,
       uploadStatus: 'published',
       minimal: true,
-      suppressSummary: true
+      suppressSummary: true,
+      suppressPipelineSpinner: true,
+      uploadContext: 'deploy-preflight'
     });
     stepOptions = mergeUploadAuthOptions({ ...options, uploadStatus: 'published' }, uploadCtx);
   }
@@ -191,7 +200,7 @@ async function runOperationsGate(systemKey, options) {
         syncMode: e2eSyncMode || stepOptions.syncMode
       }),
     (result) => result.success === true,
-    options
+    { ...options, gatePillar: 'operations' }
   );
 
   return { pillar: 'operations', verdict: VERDICT.VERIFIED };
@@ -208,7 +217,7 @@ async function runTrustGate(systemKey, options) {
     'Running trust gate',
     () => runVerifyTrustForExternalSystem(systemKey, { ...options, noPublish: true }),
     (outcome) => outcome.verdict === VERDICT.VERIFIED,
-    options
+    { ...options, gatePillar: 'trust' }
   );
   return {
     pillar: 'trust',
@@ -254,7 +263,7 @@ async function runGovernanceGate(systemKey, options) {
     'Running governance gate',
     runner,
     (outcome) => outcome.verdict === VERDICT.VERIFIED,
-    options
+    { ...options, gatePillar: 'governance' }
   );
   const scenarios = result.enforcementScenarios || {};
   return {
@@ -274,18 +283,37 @@ async function runGovernanceGate(systemKey, options) {
  */
 async function runDeployOptionalGates(systemKey, gates, options) {
   const outcomes = [];
-  if (gates.has('operations')) {
-    outcomes.push(await runOperationsGate(systemKey, options));
-  }
-  if (gates.has('trust')) {
-    outcomes.push(await runTrustGate(systemKey, options));
-  }
-  if (gates.has('governance')) {
-    outcomes.push(await runGovernanceGate(systemKey, options));
+  try {
+    if (gates.has('operations')) {
+      outcomes.push(await runOperationsGate(systemKey, options));
+    }
+    if (gates.has('trust')) {
+      outcomes.push(await runTrustGate(systemKey, options));
+    }
+    if (gates.has('governance')) {
+      outcomes.push(await runGovernanceGate(systemKey, options));
+    }
+  } catch (err) {
+    if (err && err.gateFailure === true) {
+      err.gatesSoFar = outcomes;
+    }
+    throw err;
   }
   return outcomes;
 }
 
+/**
+ * @param {string|undefined} label
+ * @returns {string}
+ */
+function inferGatePillarFromLabel(label) {
+  const text = String(label || '').toLowerCase();
+  if (text.includes('operations')) return 'operations';
+  if (text.includes('trust')) return 'trust';
+  if (text.includes('governance')) return 'governance';
+  return 'operations';
+}
+
 /**
  * Baseline validate + test + test-integration, then optional --gate steps before controller deploy.
  * @async
@@ -304,11 +332,29 @@ async function runDeployGateOrchestrator(systemKey, options = {}) {
   if (gates.size === 0) {
     return { baseline, gates: [] };
   }
-  const gateOutcomes = await runDeployOptionalGates(systemKey, gates, {
-    ...options,
-    quietDeployUi: quiet
-  });
-  return { baseline, gates: gateOutcomes };
+  try {
+    const gateOutcomes = await runDeployOptionalGates(systemKey, gates, {
+      ...options,
+      quietDeployUi: quiet
+    });
+    return { baseline, gates: gateOutcomes };
+  } catch (err) {
+    if (err && err.gateFailure === true && quiet) {
+      const { logDeployGateAbortCompact } = require('../utils/external-system-readiness-compact-blocks');
+      const failedPillar = err.gatePillar || inferGatePillarFromLabel(err.gateLabel);
+      logDeployGateAbortCompact({
+        systemKey,
+        environment: options.environment || options.env || 'dev',
+        dataplaneUrl: options.dataplaneUrl || options.knownDataplaneUrl,
+        baseline,
+        gatesSoFar: err.gatesSoFar || [],
+        failedPillar,
+        failedDetail: err.gateDetail || err.message
+      });
+      err.compactGateAbortLogged = true;
+    }
+    throw err;
+  }
 }
 
 module.exports = {

package/lib/commands/dev-cli-handlers.js

@@ -18,6 +18,7 @@ const {
 } = require('../utils/dev-user-groups');
 const { handleProvisionDevUser, handleRemoveDevUser } = require('./dev-host-ops');
 const { logDevPinShareInstructions } = require('../utils/dev-pin-share-instructions');
+const { sortDevUsers } = require('../utils/dev-list-sort');
 
 const REMOTE_NOT_CONFIGURED_MSG = 'Remote server is not configured. Set remote-server and run "aifabrix dev init" first.';
 
@@ -52,10 +53,12 @@ function formatCertUntil(iso) {
 }
 
 /**
- * Handle dev list – list developer users (remote only). Table format, sorted by name.
+ * Handle dev list – list developer users (remote only). Table format; default sort by name.
+ * @param {Object} [options] - Commander options
+ * @param {string} [options.sort] - Sort field/direction (id|name|email|until; prefix - for descending)
  * @returns {Promise<void>}
  */
-async function handleDevList() {
+async function handleDevList(options = {}) {
   const auth = await getRemoteDevAuth();
   if (!auth) {
     logger.log(chalk.yellow(REMOTE_NOT_CONFIGURED_MSG));
@@ -69,7 +72,7 @@ async function handleDevList() {
   logger.log(chalk.bold('\n📋 Developers:\n'));
   logger.log(chalk.gray('ID'.padEnd(ID_WIDTH) + 'Name'.padEnd(NAME_WIDTH) + 'Email'.padEnd(EMAIL_WIDTH) + 'Cert'.padEnd(CERT_WIDTH) + 'Until'.padEnd(UNTIL_WIDTH) + 'Groups'));
   logger.log(chalk.gray('-'.repeat(TABLE_SEPARATOR_LENGTH)));
-  const sorted = [...users].sort((a, b) => (a.name || '').localeCompare(b.name || '', undefined, { sensitivity: 'base' }));
+  const sorted = sortDevUsers(users, options.sort);
   sorted.forEach(u => {
     const certLabel = u.certificateIssued ? 'yes' : 'no cert';
     const untilRaw = u.certificateIssued && u.certificateValidNotAfter ? u.certificateValidNotAfter : null;

package/lib/commands/dev-init.js

@@ -14,10 +14,6 @@ const { getConfigDirForPaths } = require('../utils/paths');
 const {
   generateCSR,
   getCertDir,
-  readClientCertPem,
-  readClientKeyPem,
-  readServerCaPem,
-  getCertValidNotAfter,
   normalizePemNewlines,
   mergeCaPemBlocks
 } = require('../utils/dev-cert-helper');
@@ -33,9 +29,8 @@ const {
   isLinuxCaSudoRequiredError
 } = require('../utils/dev-ca-install');
 const { runOptionalHostsSetup } = require('../utils/dev-hosts-helper');
-const { mergeDevSshConfigAfterInit, logDevSshConnectHint } = require('../utils/dev-init-ssh-merge');
+const { mergeDevSshConfigAfterInit } = require('../utils/dev-init-ssh-merge');
 const { resolveInitOptions } = require('../utils/dev-init-resolve');
-const { displayDevConfig } = require('./dev-show-display');
 const {
   isHealthHttpServerError,
   formatEnsureServerTrustedFailure
@@ -383,106 +378,9 @@ async function runDevInit(options) {
   logOnboardingFinished(sshInfo);
 }
 
-/** Days before cert expiry at which we auto-refresh on dev refresh. */
-const CERT_REFRESH_DAYS = 14;
-
-/**
- * True if the cert in certDir expires within CERT_REFRESH_DAYS (or we cannot read expiry).
- * @param {string} certDir - Certificate directory
- * @returns {boolean}
- */
-function shouldRefreshDevCert(certDir) {
-  const validNotAfter = getCertValidNotAfter(certDir);
-  if (!validNotAfter) return true;
-  const now = Date.now();
-  const threshold = now + CERT_REFRESH_DAYS * 24 * 60 * 60 * 1000;
-  return validNotAfter.getTime() < threshold;
-}
-
-/**
- * Refresh developer certificate: create PIN (with current cert), issue new cert, save and apply settings.
- * @param {{ serverUrl: string, clientCertPem: string, serverCaPem?: string|null }} auth - Current auth from getRemoteDevAuth
- * @returns {Promise<void>}
- */
-async function runCertificateRefresh(auth) {
-  const devId = await config.getDeveloperId();
-  if (!devId) throw new Error('developer-id not set in config.');
-  const configDir = getConfigDirForPaths();
-  const serverCaPem = auth.serverCaPem || undefined;
-  logger.log(chalk.blue('\n🔄 Refreshing certificate (create PIN + issue-cert)...\n'));
-  const pinRes = await devApi.createPin(auth.serverUrl, auth.clientCertPem, devId, serverCaPem);
-  const pin = pinRes.pin;
-  if (!pin || typeof pin !== 'string') throw new Error('Server did not return a PIN.');
-  logger.log(chalk.gray('  Generating new certificate request...'));
-  const { csrPem, keyPem } = generateCSR(devId);
-  logger.log(chalk.gray('  Requesting new certificate (issue-cert)...'));
-  const issueResponse = await requestCertificate(auth.serverUrl, devId, pin, csrPem, serverCaPem);
-  const caPem = mergeCaPemBlocks(serverCaPem, issueResponse.caCertificate, issueResponse.ca);
-  await saveCertAndConfig(configDir, devId, issueResponse.certificate, keyPem, caPem);
-  await applySettingsFromServer(auth.serverUrl, devId, issueResponse, keyPem, serverCaPem);
-  await augmentAndSaveCaPemForRemoteDocker(configDir, devId, caPem, {
-    settings: issueResponse.settings,
-    remoteServerUrl: auth.serverUrl,
-    warn: (msg) => logger.log(chalk.yellow(`  ⚠ ${msg}`))
-  });
-  logger.log(formatSuccessLine('Certificate refreshed and config updated from server.\n'));
-  logDevSshConnectHint(await mergeDevSshConfigAfterInit(auth.serverUrl, devId));
-}
-
-/**
- * GET /api/dev/settings and merge into local config (used by dev refresh when cert is still valid).
- * @param {{ serverUrl: string, serverCaPem?: string|null }} auth
- * @param {string} clientCertPem
- * @param {string|null|undefined} clientKeyPem
- * @param {string} devId
- * @returns {Promise<void>}
- */
-async function fetchAndMergeRemoteSettings(auth, clientCertPem, clientKeyPem, devId) {
-  logger.log(chalk.blue('\n🔄 Fetching settings from Builder Server...\n'));
-  const settings = await devApi.getSettings(
-    auth.serverUrl,
-    clientCertPem,
-    clientKeyPem || undefined,
-    auth.serverCaPem || undefined
-  );
-  await config.mergeRemoteSettings(settings);
-  const existingCa = readServerCaPem(getCertDir(getConfigDirForPaths(), devId));
-  await augmentAndSaveCaPemForRemoteDocker(getConfigDirForPaths(), devId, existingCa, {
-    settings,
-    remoteServerUrl: auth.serverUrl,
-    warn: (msg) => logger.log(chalk.yellow(`  ⚠ ${msg}`))
-  });
-  logger.log(formatSuccessLine('Config updated from server.\n'));
-  await displayDevConfig(devId);
-}
-
-/**
- * Fetch settings from Builder Server and merge into config (GET /api/dev/settings).
- * If certificate expires within CERT_REFRESH_DAYS (or --cert), refresh cert first (create PIN + issue-cert).
- * @param {Object} [options] - Commander options; options.cert = true forces cert refresh
- * @returns {Promise<void>}
- * @throws {Error} If remote server or certificate not configured, or getSettings fails
- */
-async function runDevRefresh(options = {}) {
-  const { getRemoteDevAuth } = require('../utils/remote-dev-auth');
-  const auth = await getRemoteDevAuth();
-  if (!auth) {
-    throw new Error('Remote server is not configured. Set remote-server and run "aifabrix dev init" first.');
-  }
-  const devId = await config.getDeveloperId();
-  const certDir = getCertDir(getConfigDirForPaths(), devId);
-  const clientCertPem = readClientCertPem(certDir);
-  const clientKeyPem = readClientKeyPem(certDir);
-  if (!clientCertPem) {
-    throw new Error('Client certificate not found. Run "aifabrix dev init" first.');
-  }
-  if (Boolean(options.cert) || shouldRefreshDevCert(certDir)) {
-    await runCertificateRefresh(auth);
-    await displayDevConfig(devId);
-    return;
-  }
-  await fetchAndMergeRemoteSettings(auth, clientCertPem, clientKeyPem, devId);
-  logDevSshConnectHint(await mergeDevSshConfigAfterInit(auth.serverUrl, devId));
-}
-
-module.exports = { runDevInit, runDevRefresh };
+module.exports = {
+  runDevInit,
+  requestCertificate,
+  saveCertAndConfig,
+  applySettingsFromServer
+};

package/lib/commands/dev-refresh.js

@@ -0,0 +1,197 @@
+/**
+ * @fileoverview aifabrix dev refresh – sync remote settings and renew client cert when due
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const config = require('../core/config');
+const { getConfigDirForPaths } = require('../utils/paths');
+const {
+  generateCSR,
+  getCertDir,
+  readClientCertPem,
+  readClientKeyPem,
+  readServerCaPem,
+  getCertValidNotAfter,
+  mergeCaPemBlocks
+} = require('../utils/dev-cert-helper');
+const devApi = require('../api/dev.api');
+const logger = require('../utils/logger');
+const { mergeDevSshConfigAfterInit, logDevSshConnectHint } = require('../utils/dev-init-ssh-merge');
+const { displayDevConfig } = require('./dev-show-display');
+const { augmentAndSaveCaPemForRemoteDocker } = require('../utils/dev-ca-docker-augment');
+const { formatSuccessLine } = require('../utils/cli-test-layout-chalk');
+const {
+  requestCertificate,
+  saveCertAndConfig,
+  applySettingsFromServer
+} = require('./dev-init');
+
+/** Days before cert expiry at which we auto-refresh on dev refresh / auto-renew. */
+const CERT_REFRESH_DAYS = 14;
+
+/**
+ * True if the cert expires within CERT_REFRESH_DAYS (or expiry cannot be read).
+ * Used by explicit `dev refresh` (also attempts when expiry is unknown).
+ * @param {string} certDir
+ * @returns {boolean}
+ */
+function shouldRefreshDevCert(certDir) {
+  const validNotAfter = getCertValidNotAfter(certDir);
+  if (!validNotAfter) return true;
+  const now = Date.now();
+  const threshold = now + CERT_REFRESH_DAYS * 24 * 60 * 60 * 1000;
+  return validNotAfter.getTime() < threshold;
+}
+
+/**
+ * True when cert is still valid but expires within CERT_REFRESH_DAYS.
+ * Used for automatic renew (never tries when already expired).
+ * @param {string} certDir
+ * @returns {boolean}
+ */
+function isDevCertAutoRenewalDue(certDir) {
+  const validNotAfter = getCertValidNotAfter(certDir);
+  if (!validNotAfter) return false;
+  const now = Date.now();
+  if (validNotAfter.getTime() <= now) return false;
+  const threshold = now + CERT_REFRESH_DAYS * 24 * 60 * 60 * 1000;
+  return validNotAfter.getTime() < threshold;
+}
+
+/**
+ * Refresh developer certificate: create PIN (with current cert), issue new cert, save and apply settings.
+ * @param {{ serverUrl: string, clientCertPem: string, serverCaPem?: string|null }} auth
+ * @returns {Promise<void>}
+ */
+async function runCertificateRefresh(auth) {
+  const devId = await config.getDeveloperId();
+  if (!devId) throw new Error('developer-id not set in config.');
+  const configDir = getConfigDirForPaths();
+  const serverCaPem = auth.serverCaPem || undefined;
+  logger.log(chalk.blue('\n🔄 Refreshing certificate (create PIN + issue-cert)...\n'));
+  const pinRes = await devApi.createPin(auth.serverUrl, auth.clientCertPem, devId, serverCaPem);
+  const pin = pinRes.pin;
+  if (!pin || typeof pin !== 'string') throw new Error('Server did not return a PIN.');
+  logger.log(chalk.gray('  Generating new certificate request...'));
+  const { csrPem, keyPem } = generateCSR(devId);
+  logger.log(chalk.gray('  Requesting new certificate (issue-cert)...'));
+  const issueResponse = await requestCertificate(auth.serverUrl, devId, pin, csrPem, serverCaPem);
+  const caPem = mergeCaPemBlocks(serverCaPem, issueResponse.caCertificate, issueResponse.ca);
+  await saveCertAndConfig(configDir, devId, issueResponse.certificate, keyPem, caPem);
+  await applySettingsFromServer(auth.serverUrl, devId, issueResponse, keyPem, serverCaPem);
+  await augmentAndSaveCaPemForRemoteDocker(configDir, devId, caPem, {
+    settings: issueResponse.settings,
+    remoteServerUrl: auth.serverUrl,
+    warn: (msg) => logger.log(chalk.yellow(`  ⚠ ${msg}`))
+  });
+  logger.log(formatSuccessLine('Certificate refreshed and config updated from server.\n'));
+  logDevSshConnectHint(await mergeDevSshConfigAfterInit(auth.serverUrl, devId));
+}
+
+/**
+ * GET /api/dev/settings and merge into local config (when cert is still valid).
+ * @param {{ serverUrl: string, serverCaPem?: string|null }} auth
+ * @param {string} clientCertPem
+ * @param {string|null|undefined} clientKeyPem
+ * @param {string} devId
+ * @returns {Promise<void>}
+ */
+async function fetchAndMergeRemoteSettings(auth, clientCertPem, clientKeyPem, devId) {
+  logger.log(chalk.blue('\n🔄 Fetching settings from Builder Server...\n'));
+  const settings = await devApi.getSettings(
+    auth.serverUrl,
+    clientCertPem,
+    clientKeyPem || undefined,
+    auth.serverCaPem || undefined
+  );
+  await config.mergeRemoteSettings(settings);
+  const existingCa = readServerCaPem(getCertDir(getConfigDirForPaths(), devId));
+  await augmentAndSaveCaPemForRemoteDocker(getConfigDirForPaths(), devId, existingCa, {
+    settings,
+    remoteServerUrl: auth.serverUrl,
+    warn: (msg) => logger.log(chalk.yellow(`  ⚠ ${msg}`))
+  });
+  logger.log(formatSuccessLine('Config updated from server.\n'));
+  await displayDevConfig(devId);
+}
+
+/**
+ * Fetch settings from Builder Server and merge into config.
+ * If certificate expires within CERT_REFRESH_DAYS (or --cert), refresh cert first.
+ * @param {Object} [options] - Commander options; options.cert = true forces cert refresh
+ * @returns {Promise<void>}
+ */
+async function runDevRefresh(options = {}) {
+  const { readRemoteDevAuth } = require('../utils/remote-dev-auth');
+  const auth = await readRemoteDevAuth();
+  if (!auth) {
+    throw new Error('Remote server is not configured. Set remote-server and run "aifabrix dev init" first.');
+  }
+  const devId = await config.getDeveloperId();
+  const certDir = getCertDir(getConfigDirForPaths(), devId);
+  const clientCertPem = readClientCertPem(certDir);
+  const clientKeyPem = readClientKeyPem(certDir);
+  if (!clientCertPem) {
+    throw new Error('Client certificate not found. Run "aifabrix dev init" first.');
+  }
+  if (Boolean(options.cert) || shouldRefreshDevCert(certDir)) {
+    await runCertificateRefresh(auth);
+    await displayDevConfig(devId);
+    return;
+  }
+  await fetchAndMergeRemoteSettings(auth, clientCertPem, clientKeyPem, devId);
+  logDevSshConnectHint(await mergeDevSshConfigAfterInit(auth.serverUrl, devId));
+}
+
+/**
+ * Automatically renew the developer client certificate when still valid but due within
+ * CERT_REFRESH_DAYS. Safe for any cert-using command: no-op when not due / offline.
+ * Uses readRemoteDevAuth (not getRemoteDevAuth) to avoid recursion with auto-renew.
+ * Does not display config (caller shows status afterward).
+ *
+ * @param {{ quiet?: boolean }} [opts] - quiet=true suppresses failure warnings
+ * @returns {Promise<{ refreshed: boolean, reason?: string, error?: Error }>}
+ */
+async function ensureDevCertFreshIfDue(opts = {}) {
+  const quiet = opts.quiet === true;
+  const { readRemoteDevAuth } = require('../utils/remote-dev-auth');
+  const auth = await readRemoteDevAuth();
+  if (!auth) {
+    return { refreshed: false, reason: 'no-remote-auth' };
+  }
+  const devId = await config.getDeveloperId();
+  if (!devId) {
+    return { refreshed: false, reason: 'no-developer-id' };
+  }
+  const certDir = getCertDir(getConfigDirForPaths(), devId);
+  if (!readClientCertPem(certDir)) {
+    return { refreshed: false, reason: 'no-cert' };
+  }
+  if (!isDevCertAutoRenewalDue(certDir)) {
+    return { refreshed: false, reason: 'not-due' };
+  }
+  try {
+    await runCertificateRefresh(auth);
+    return { refreshed: true };
+  } catch (error) {
+    if (!quiet) {
+      logger.warn(
+        chalk.yellow(`Could not auto-refresh developer certificate: ${error.message}`)
+      );
+      logger.warn(chalk.gray('  Run: aifabrix dev refresh --cert'));
+    }
+    return { refreshed: false, reason: 'refresh-failed', error };
+  }
+}
+
+module.exports = {
+  runDevRefresh,
+  ensureDevCertFreshIfDue,
+  isDevCertAutoRenewalDue,
+  shouldRefreshDevCert,
+  CERT_REFRESH_DAYS
+};