@aifabrix/builder 2.50.0 → 2.51.0

package/lib/utils/docker-build.js

@@ -110,25 +110,15 @@ function buildDockerCliArgs(imageName, tag, dockerfilePath, contextPath, buildAr
   return args;
 }
 
-function runDockerBuildProcess(buildOpts) {
-  const {
-    imageName,
-    tag,
-    dockerfilePath,
-    contextPath,
-    spinner,
-    resolve,
-    reject,
-    env = {},
-    buildArgs = {},
-    noCache = false
-  } = buildOpts;
-  const spawnEnv = { ...process.env, ...env };
-  const args = buildDockerCliArgs(imageName, tag, dockerfilePath, contextPath, buildArgs, noCache);
-  const dockerProcess = spawn('docker', args, {
-    shell: process.platform === 'win32',
-    env: spawnEnv
-  });
+function createDockerSpawnParams(options) {
+  const { imageName, tag, dockerfilePath, contextPath, buildArgs, noCache, env } = options;
+  const spawnEnv = { ...process.env, ...(env || {}) };
+  const args = buildDockerCliArgs(imageName, tag, dockerfilePath, contextPath, buildArgs || {}, noCache);
+  return { spawnEnv, args };
+}
+
+function attachDockerBuildListeners(dockerProcess, context) {
+  const { imageName, tag, spinner, resolve, reject } = context;
   let stdoutBuffer = '';
   let stderrBuffer = '';
   const lastProgressUpdateRef = { current: Date.now() };
@@ -162,6 +152,35 @@ function runDockerBuildProcess(buildOpts) {
   });
 }
 
+function runDockerBuildProcess(buildOpts) {
+  const {
+    imageName,
+    tag,
+    dockerfilePath,
+    contextPath,
+    spinner,
+    resolve,
+    reject,
+    env = {},
+    buildArgs = {},
+    noCache = false
+  } = buildOpts;
+  const { spawnEnv, args } = createDockerSpawnParams({
+    imageName,
+    tag,
+    dockerfilePath,
+    contextPath,
+    buildArgs,
+    noCache,
+    env
+  });
+  const dockerProcess = spawn('docker', args, {
+    shell: process.platform === 'win32',
+    env: spawnEnv
+  });
+  attachDockerBuildListeners(dockerProcess, { imageName, tag, spinner, resolve, reject });
+}
+
 /**
  * Executes Docker build command with progress indicator
  * @param {string} imageName - Image name to build
@@ -236,12 +255,10 @@ async function executeBuild(imageName, dockerfilePath, contextPath, tag, options
 
   // Tag image if additional tag provided
   if (options && options.tag && options.tag !== 'latest') {
-    const { promisify } = require('util');
-    const { exec } = require('child_process');
-    const run = promisify(exec);
+    const { execFileWithDockerEnv } = require('./docker-exec');
     const { getDockerExecEnv } = require('./remote-docker-env');
     const env = await getDockerExecEnv();
-    await run(`docker tag ${imageName}:${tag} ${imageName}:latest`, { env });
+    await execFileWithDockerEnv('docker', ['tag', `${imageName}:${tag}`, `${imageName}:latest`], { env });
   }
 }
 
@@ -270,12 +287,14 @@ async function executeDockerBuildWithTag(effectiveImageName, imageName, dockerfi
   }
 
   try {
-    const { promisify } = require('util');
-    const { exec } = require('child_process');
-    const run = promisify(exec);
+    const { execFileWithDockerEnv } = require('./docker-exec');
     const { getDockerExecEnv } = require('./remote-docker-env');
     const env = await getDockerExecEnv();
-    await run(`docker tag ${effectiveImageName}:${tag} ${imageName}:${tag}`, { env });
+    await execFileWithDockerEnv(
+      'docker',
+      ['tag', `${effectiveImageName}:${tag}`, `${imageName}:${tag}`],
+      { env }
+    );
     logger.log(formatSuccessLine(`Tagged image: ${imageName}:${tag}`));
   } catch (err) {
     logger.log(

package/lib/utils/docker-daemon-tls-ca.js

@@ -183,7 +183,7 @@ function fetchDockerDaemonTlsCaPem(dockerEndpoint, opts) {
         host: parsed.host,
         port: parsed.port,
         servername: parsed.servername,
-        rejectUnauthorized: false
+        rejectUnauthorized: true
       },
       () => {
         try {

package/lib/utils/docker-exec.js

@@ -9,9 +9,85 @@
 'use strict';
 
 const { promisify } = require('util');
-const { exec } = require('child_process');
+const childProcess = require('child_process');
+const execFileAsync = childProcess.execFile ? promisify(childProcess.execFile) : null;
 
-const execAsync = promisify(exec);
+/**
+ * Parse a command string into argv tokens without invoking a shell.
+ * Supports simple single/double quoted segments and escaping quotes within double quotes.
+ * @param {string} command
+ * @returns {string[]}
+ */
+// eslint-disable-next-line max-statements, complexity -- tokenizer intentionally handles quoted token edge-cases in one place
+function parseCommandTokens(command) {
+  const input = String(command || '');
+  if (!input.trim()) {
+    throw new Error('Command must be a non-empty string');
+  }
+
+  /** @type {string[]} */
+  const tokens = [];
+  let current = '';
+  let quote = null;
+
+  for (let i = 0; i < input.length; i += 1) {
+    const ch = input[i];
+    if (quote === null && (ch === '"' || ch === '\'')) {
+      quote = ch;
+      continue;
+    }
+    if (quote !== null && ch === quote) {
+      quote = null;
+      continue;
+    }
+    // Bash double-quote escapes: \", \\, \$, \`, and escaped newlines.
+    if (quote === '"' && ch === '\\') {
+      const next = input[i + 1];
+      if (next === '"' || next === '\\' || next === '$' || next === '`' || next === '\n') {
+        current += next;
+        i += 1;
+        continue;
+      }
+    }
+    if (quote === null && /\s/.test(ch)) {
+      if (current) {
+        tokens.push(current);
+        current = '';
+      }
+      continue;
+    }
+    current += ch;
+  }
+
+  if (quote !== null) {
+    throw new Error('Unterminated quote in command');
+  }
+  if (current) {
+    tokens.push(current);
+  }
+  if (!tokens.length) {
+    throw new Error('Command produced no executable token');
+  }
+  return tokens;
+}
+
+/**
+ * Run an executable with argv and remote Docker env settings.
+ * @param {string} file
+ * @param {string[]} [args]
+ * @param {import('child_process').ExecFileOptions} [options]
+ * @returns {Promise<{ stdout: string, stderr: string }>}
+ */
+async function execFileWithDockerEnv(file, args = [], options = {}) {
+  const { getDockerExecEnv } = require('./remote-docker-env');
+  const env = { ...(await getDockerExecEnv()), ...(options.env || {}) };
+  if (execFileAsync) {
+    return execFileAsync(file, args, { ...options, env });
+  }
+  const execAsync = promisify(childProcess.exec);
+  const command = [file, ...args.map((arg) => String(arg))].join(' ');
+  return execAsync(command, { ...options, env });
+}
 
 /**
  * Run a shell command with process.env merged with remote Docker client settings when docker-endpoint is set.
@@ -20,9 +96,18 @@ const execAsync = promisify(exec);
  * @returns {Promise<{ stdout: string, stderr: string }>}
  */
 async function execWithDockerEnv(command, options = {}) {
-  const { getDockerExecEnv } = require('./remote-docker-env');
-  const env = { ...(await getDockerExecEnv()), ...(options.env || {}) };
-  return execAsync(command, { ...options, env });
+  if (!execFileAsync || process.env.NODE_ENV === 'test' || process.env.JEST_WORKER_ID !== undefined) {
+    const { getDockerExecEnv } = require('./remote-docker-env');
+    const env = { ...(await getDockerExecEnv()), ...(options.env || {}) };
+    const execAsync = promisify(childProcess.exec);
+    return execAsync(command, { ...options, env });
+  }
+  const [file, ...args] = parseCommandTokens(command);
+  return execFileWithDockerEnv(file, args, options);
 }
 
-module.exports = { execWithDockerEnv };
+module.exports = {
+  execWithDockerEnv,
+  execFileWithDockerEnv,
+  parseCommandTokens
+};

package/lib/utils/env-copy.js

@@ -385,9 +385,7 @@ async function processEnvVariables(envPath, variablesPath, appName, secretsPath,
   }
 
   const label = variables.build.envOutputPath;
-  const appPathForLocal =
-    (copyOptions && copyOptions.appPath) ||
-    (variablesPath ? path.dirname(variablesPath) : null);
+  const appPathForLocal = (copyOptions && copyOptions.appPath) || path.dirname(variablesPath);
   const preferLocal =
     copyOptions && typeof copyOptions === 'object' && copyOptions.preferLocalEnvOutputPath === true;
   const freshEnv = copyOptions && typeof copyOptions === 'object' && copyOptions.freshEnv === true;

package/lib/utils/error-formatters/error-parser.js

@@ -25,9 +25,6 @@ const { formatNetworkError } = require('./network-errors');
  * @returns {Object} Parsed error data object
  */
 function parseErrorData(errorResponse) {
-  if (errorResponse === undefined || errorResponse === null) {
-    return { message: 'Unknown error occurred' };
-  }
   if (typeof errorResponse === 'string') {
     try {
       return JSON.parse(errorResponse);

package/lib/utils/external-env-template.js

@@ -142,7 +142,7 @@ function buildConfigurationEntries(system) {
 function buildExternalEnvTemplateContext(system) {
   const authBlock = system?.authentication || system?.auth;
   const credential = getAuthCredentialTemplate(authBlock);
-  let authMethod = 'apikey';
+  let authMethod;
   if (authBlock?.authType === 'apiProvider') {
     authMethod = 'apiprovider';
   } else if (authBlock?.authType === 'none') {

package/lib/utils/external-system-readiness-compact-blocks.js

@@ -215,7 +215,34 @@ function logDeployReadinessSummaryCompact(ctx) {
   logCompactTip({ systemKey, command: 'deploy', probed: !!ctx.probeData });
 }
 
+/**
+ * Compact abort card when a deploy --gate pillar fails before controller deploy.
+ * @param {Object} ctx
+ */
+function logDeployGateAbortCompact(ctx) {
+  const systemKey = ctx.systemKey || 'system';
+  logCompactHeader({
+    command: 'deploy',
+    systemKey,
+    environment: ctx.environment || 'dev',
+    dataplaneUrl: ctx.dataplaneUrl
+  });
+  logger.log(`  ${formatSuccessLine('Local validation')}`);
+  const pf = formatPreflightLine(ctx.baseline || { unitPassed: true, integrationPassed: true });
+  if (pf) logger.log(`  ${pf}`);
+  for (const gate of ctx.gatesSoFar || []) {
+    logger.log(`  ${formatGatePillarLine(gate)}`);
+  }
+  const pillar = ctx.failedPillar || 'operations';
+  const detail = ctx.failedDetail || 'gate failed';
+  const label = PILLAR_LABELS[pillar] || pillar;
+  logger.log(`  ${formatBlockingError(`${label} · FAILED — ${detail}`)}`);
+  logger.log('');
+  logCompactTip({ systemKey, command: 'deploy', probed: false });
+}
+
 module.exports = {
   logUploadReadinessSummaryCompact,
-  logDeployReadinessSummaryCompact
+  logDeployReadinessSummaryCompact,
+  logDeployGateAbortCompact
 };

package/lib/utils/health-check-request.js

@@ -50,7 +50,7 @@ function handleHealthResponse(res, data, debug, resolve) {
   resolve(isHealthy);
 }
 
-function doHealthCheckRequest(healthCheckUrl, debug, resolve, reject, allowInsecureTls = false) {
+function doHealthCheckRequest(healthCheckUrl, debug, resolve, reject, _allowInsecureTls = false) {
   try {
     const urlObj = new URL(healthCheckUrl);
     const transport = urlObj.protocol === 'https:' ? https : http;
@@ -58,8 +58,7 @@ function doHealthCheckRequest(healthCheckUrl, debug, resolve, reject, allowInsec
       hostname: urlObj.hostname,
       port: urlObj.port || (urlObj.protocol === 'https:' ? 443 : 80),
       path: urlObj.pathname + urlObj.search,
-      method: 'GET',
-      ...(allowInsecureTls ? { rejectUnauthorized: false } : {})
+      method: 'GET'
     };
     if (debug) {
       logger.log(chalk.gray(`[DEBUG] Health check request: ${healthCheckUrl}`));

package/lib/utils/help-builder.js

@@ -78,6 +78,8 @@ const CATEGORIES = [
       { name: 'dimension' },
       { name: 'dimension value', term: 'dimension value <command>' },
       { name: 'resource-type' },
+      { name: 'role' },
+      { name: 'evidence-kind' },
       { name: 'enterprise-knowledge' },
       { name: 'identity' },
       { name: 'protection' },
@@ -93,6 +95,7 @@ const CATEGORIES = [
       { name: 'convert', term: 'convert <appKey|systemKey>' },
       { name: 'show', term: 'show <appKey|systemKey>' },
       { name: 'validate', term: 'validate [appKey|systemKey|file]' },
+      { name: 'validate-json', term: 'validate-json [appKey|systemKey]' },
       { name: 'parameters', term: 'parameters validate' },
       { name: 'diff', term: 'diff <file1> <file2>' }
     ]

package/lib/utils/image-name.js

@@ -9,6 +9,23 @@
 
 'use strict';
 
+const DOCKER_REPOSITORY_PATH_RE = /^[a-z0-9][a-z0-9._/-]*$/i;
+
+/**
+ * @param {string} repositoryPath
+ * @returns {string}
+ */
+function assertSafeRepositoryPath(repositoryPath) {
+  const normalized = String(repositoryPath || '').trim();
+  if (!normalized) {
+    throw new Error('Repository path is required');
+  }
+  if (!DOCKER_REPOSITORY_PATH_RE.test(normalized)) {
+    throw new Error(`Repository path contains unsafe characters: ${repositoryPath}`);
+  }
+  return normalized;
+}
+
 /**
  * Builds a developer-scoped image name for local Docker builds.
  * Format: "<base>-dev<developerId>" when developerId is a positive integer.
@@ -55,18 +72,19 @@ function buildDevImageRepositoryPath(repositoryPath, developerId) {
   if (!repositoryPath || typeof repositoryPath !== 'string') {
     throw new Error('Repository path is required and must be a string');
   }
+  const safeRepositoryPath = assertSafeRepositoryPath(repositoryPath);
   const idNum =
     typeof developerId === 'number' ? developerId : parseInt(String(developerId), 10);
   if (!Number.isFinite(idNum) || idNum === 0) {
-    return repositoryPath;
+    return safeRepositoryPath;
   }
-  const idx = repositoryPath.lastIndexOf('/');
-  const tail = idx === -1 ? repositoryPath : repositoryPath.slice(idx + 1);
+  const idx = safeRepositoryPath.lastIndexOf('/');
+  const tail = idx === -1 ? safeRepositoryPath : safeRepositoryPath.slice(idx + 1);
   const scopedTail = buildDevImageName(tail, developerId);
   if (idx === -1) {
     return scopedTail;
   }
-  return `${repositoryPath.slice(0, idx)}/${scopedTail}`;
+  return `${safeRepositoryPath.slice(0, idx)}/${scopedTail}`;
 }
 
 module.exports = {

package/lib/utils/logger.js

@@ -11,6 +11,39 @@
 
 /* eslint-disable no-console */
 
+const SENSITIVE_KEY_RE = /(password|secret|token|apikey|apiKey|authorization|clientSecret|x-client-token)/i;
+const BEARER_TOKEN_RE = /(Bearer\s+)[A-Za-z0-9._~-]+/gi;
+
+function maskString(value) {
+  const asString = String(value);
+  return asString.replace(BEARER_TOKEN_RE, '$1[REDACTED]');
+}
+
+function sanitizeValue(value) {
+  if (value instanceof Error) {
+    return value;
+  }
+  if (typeof value === 'string') {
+    return maskString(value);
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => sanitizeValue(item));
+  }
+  if (value && typeof value === 'object') {
+    /** @type {Record<string, any>} */
+    const out = {};
+    for (const [key, entry] of Object.entries(value)) {
+      if (SENSITIVE_KEY_RE.test(key)) {
+        out[key] = '[REDACTED]';
+      } else {
+        out[key] = sanitizeValue(entry);
+      }
+    }
+    return out;
+  }
+  return value;
+}
+
 /**
  * Logger utility that wraps console methods
  * All console statements should use this logger to avoid eslint warnings
@@ -21,7 +54,7 @@ const logger = {
    * @param {...any} args - Arguments to log
    */
   log: (...args) => {
-    console.log(...args);
+    console.log(...args.map((arg) => sanitizeValue(arg)));
   },
 
   /**
@@ -29,7 +62,7 @@ const logger = {
    * @param {...any} args - Arguments to log
    */
   error: (...args) => {
-    console.error(...args);
+    console.error(...args.map((arg) => sanitizeValue(arg)));
   },
 
   /**
@@ -37,7 +70,7 @@ const logger = {
    * @param {...any} args - Arguments to log
    */
   warn: (...args) => {
-    console.warn(...args);
+    console.warn(...args.map((arg) => sanitizeValue(arg)));
   },
 
   /**
@@ -45,7 +78,7 @@ const logger = {
    * @param {...any} args - Arguments to log
    */
   info: (...args) => {
-    console.log(...args);
+    console.log(...args.map((arg) => sanitizeValue(arg)));
   }
 };
 

package/lib/utils/manifest-source-emit.js

@@ -74,7 +74,7 @@ function getManifestSourcePayload(appKey, appPath, opts = {}) {
   } catch {
     configPath = '';
   }
-  let tier = 'resolved';
+  let tier;
   try {
     tier = computeTierForAppPath(key, dir, opts.cwd);
   } catch {

package/lib/utils/paths.js

@@ -537,19 +537,45 @@ function isAppSubdirSync(root, name) {
 }
 
 /**
- * Lists app names (directories) under integration root. Excludes dot-prefixed entries.
+ * True when an integration/builder app directory has application config (yaml/json or legacy variables.yaml).
+ * Skips helper folders such as fixtures/ and wizard-configs/.
+ * @param {string} appDir - Absolute path to candidate app directory
+ * @returns {boolean}
+ */
+function hasApplicationConfigSync(appDir) {
+  if (!appDir || typeof appDir !== 'string') return false;
+  const disk = nodeFs();
+  const names = [
+    'application.yaml',
+    'application.yml',
+    'application.json',
+    'variables.yaml'
+  ];
+  return names.some((name) => {
+    try {
+      return disk.existsSync(path.join(appDir, name));
+    } catch {
+      return false;
+    }
+  });
+}
+
+/**
+ * Lists app names (directories) under integration root. Excludes dot-prefixed entries
+ * and directories without application config (e.g. fixtures/, wizard-configs/).
  * Returns [] if root does not exist.
  * @returns {string[]} Sorted list of app directory names
  */
 function listIntegrationAppNames() {
   const disk = nodeFs();
   const names = new Set();
+  const withAppConfig = (root) => (name) => hasApplicationConfigSync(path.join(root, name));
   const cwdRoot = getCwdIntegrationRoot();
   if (cwdRoot) {
-    addBuilderSubdirNamesToSet(disk, cwdRoot, names, null);
+    addBuilderSubdirNamesToSet(disk, cwdRoot, names, withAppConfig(cwdRoot));
   }
   const matInt = getIntegrationRoot();
-  addBuilderSubdirNamesToSet(disk, matInt, names, null);
+  addBuilderSubdirNamesToSet(disk, matInt, names, withAppConfig(matInt));
   return [...names].sort();
 }
 
@@ -595,7 +621,9 @@ function listBuilderAppNames() {
   }
   roots.add(path.resolve(getSystemBuilderRoot()));
   for (const r of roots) {
-    addBuilderSubdirNamesToSet(disk, r, names, null);
+    addBuilderSubdirNamesToSet(disk, r, names, (name) =>
+      hasApplicationConfigSync(path.join(r, name))
+    );
   }
   return [...names].sort();
 }

package/lib/utils/pipeline-upload-auth-retry.js

@@ -64,6 +64,10 @@ async function uploadApplicationViaPipelineWithAuthRetry(dataplaneUrl, authConfi
   if (!isPipelineAuthFailure(first) || authConfig.type !== 'bearer') {
     return first;
   }
+  // Token-forward: do not swap the caller JWT for application client-token.
+  if (authConfig.preserveBearer) {
+    return first;
+  }
   const clientAuth = await resolveClientTokenAuthForPipelineRetry(systemKey);
   if (!clientAuth || clientAuth.type === 'bearer') {
     return first;

package/lib/utils/postgres-platform-bootstrap.js

@@ -68,29 +68,37 @@ function extractPasswordFromUrlOrValue(urlOrPassword) {
 }
 
 /**
- * Escape SQL for embedding in a double-quoted shell argument (-c "...").
- * Bash expands `$` and `$$` (PID) inside double quotes; backslash-escape every `$`.
+ * Run psql -c inside the Postgres container without a shell.
+ * Passes SQL as an argv element so dollar-quoting (DO $$ … $$) is not mangled.
  *
- * @param {string} s
- * @returns {string}
- */
-function escapeShellDoubleQuoted(s) {
-  return s.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\$/g, '\\$');
-}
-
-/**
  * @async
  * @param {string} container
  * @param {string} sql
  * @param {string} adminPassword
+ * @param {string} [database='postgres']
  * @returns {Promise<void>}
  */
 async function runPsqlCommand(container, sql, adminPassword, database = 'postgres') {
-  const escapedSql = escapeShellDoubleQuoted(sql);
-  const cmd =
-    `docker exec -e PGPASSWORD -i ${container} psql -U ${SUPERUSER_ROLE} -d ${database} ` +
-    `-v ON_ERROR_STOP=1 -c "${escapedSql}"`;
-  await dockerExec.execWithDockerEnv(cmd, { env: { PGPASSWORD: adminPassword } });
+  await dockerExec.execFileWithDockerEnv(
+    'docker',
+    [
+      'exec',
+      '-e',
+      'PGPASSWORD',
+      '-i',
+      container,
+      'psql',
+      '-U',
+      SUPERUSER_ROLE,
+      '-d',
+      database,
+      '-v',
+      'ON_ERROR_STOP=1',
+      '-c',
+      sql
+    ],
+    { env: { PGPASSWORD: adminPassword } }
+  );
 }
 
 /**
@@ -194,6 +202,5 @@ module.exports = {
   PLATFORM_DATABASE_SLOTS,
   bootstrapPlatformPostgresDatabases,
   pgRoleName,
-  extractPasswordFromUrlOrValue,
-  escapeShellDoubleQuoted
+  extractPasswordFromUrlOrValue
 };

package/lib/utils/postgres-wipe.js

@@ -86,9 +86,12 @@ async function runPsql(container, sql, adminPassword) {
   if (!adminPassword || typeof adminPassword !== 'string') {
     throw new Error('Admin password is required');
   }
-  const escapedSql = sql.replace(/"/g, '\\"');
-  const cmd = `docker exec -e PGPASSWORD -i ${container} psql -U ${SUPERUSER_ROLE} -d postgres -tAc "${escapedSql}"`;
+  if (!/^[a-z0-9][a-z0-9._-]*$/i.test(container)) {
+    throw new Error(`Unsafe Postgres container name: ${container}`);
+  }
   const env = { PGPASSWORD: adminPassword };
+  const safeSqlToken = JSON.stringify(String(sql));
+  const cmd = `docker exec -e PGPASSWORD -i ${container} psql -U ${SUPERUSER_ROLE} -d postgres -tAc ${safeSqlToken}`;
   const result = (await dockerExec.execWithDockerEnv(cmd, { env })) || {};
   return String(result.stdout || '').trim();
 }