@aifabrix/builder 2.50.0 → 2.51.1

package/lib/utils/health-check-request.js

@@ -50,7 +50,7 @@ function handleHealthResponse(res, data, debug, resolve) {
   resolve(isHealthy);
 }
 
-function doHealthCheckRequest(healthCheckUrl, debug, resolve, reject, allowInsecureTls = false) {
+function doHealthCheckRequest(healthCheckUrl, debug, resolve, reject, _allowInsecureTls = false) {
   try {
     const urlObj = new URL(healthCheckUrl);
     const transport = urlObj.protocol === 'https:' ? https : http;
@@ -58,8 +58,7 @@ function doHealthCheckRequest(healthCheckUrl, debug, resolve, reject, allowInsec
       hostname: urlObj.hostname,
       port: urlObj.port || (urlObj.protocol === 'https:' ? 443 : 80),
       path: urlObj.pathname + urlObj.search,
-      method: 'GET',
-      ...(allowInsecureTls ? { rejectUnauthorized: false } : {})
+      method: 'GET'
     };
     if (debug) {
       logger.log(chalk.gray(`[DEBUG] Health check request: ${healthCheckUrl}`));

package/lib/utils/help-builder.js

@@ -78,6 +78,9 @@ const CATEGORIES = [
       { name: 'dimension' },
       { name: 'dimension value', term: 'dimension value <command>' },
       { name: 'resource-type' },
+      { name: 'role' },
+      { name: 'role-assistant' },
+      { name: 'evidence-kind' },
       { name: 'enterprise-knowledge' },
       { name: 'identity' },
       { name: 'protection' },
@@ -93,6 +96,7 @@ const CATEGORIES = [
       { name: 'convert', term: 'convert <appKey|systemKey>' },
       { name: 'show', term: 'show <appKey|systemKey>' },
       { name: 'validate', term: 'validate [appKey|systemKey|file]' },
+      { name: 'validate-json', term: 'validate-json [appKey|systemKey]' },
       { name: 'parameters', term: 'parameters validate' },
       { name: 'diff', term: 'diff <file1> <file2>' }
     ]

package/lib/utils/image-name.js

@@ -9,6 +9,23 @@
 
 'use strict';
 
+const DOCKER_REPOSITORY_PATH_RE = /^[a-z0-9][a-z0-9._/-]*$/i;
+
+/**
+ * @param {string} repositoryPath
+ * @returns {string}
+ */
+function assertSafeRepositoryPath(repositoryPath) {
+  const normalized = String(repositoryPath || '').trim();
+  if (!normalized) {
+    throw new Error('Repository path is required');
+  }
+  if (!DOCKER_REPOSITORY_PATH_RE.test(normalized)) {
+    throw new Error(`Repository path contains unsafe characters: ${repositoryPath}`);
+  }
+  return normalized;
+}
+
 /**
  * Builds a developer-scoped image name for local Docker builds.
  * Format: "<base>-dev<developerId>" when developerId is a positive integer.
@@ -55,18 +72,19 @@ function buildDevImageRepositoryPath(repositoryPath, developerId) {
   if (!repositoryPath || typeof repositoryPath !== 'string') {
     throw new Error('Repository path is required and must be a string');
   }
+  const safeRepositoryPath = assertSafeRepositoryPath(repositoryPath);
   const idNum =
     typeof developerId === 'number' ? developerId : parseInt(String(developerId), 10);
   if (!Number.isFinite(idNum) || idNum === 0) {
-    return repositoryPath;
+    return safeRepositoryPath;
   }
-  const idx = repositoryPath.lastIndexOf('/');
-  const tail = idx === -1 ? repositoryPath : repositoryPath.slice(idx + 1);
+  const idx = safeRepositoryPath.lastIndexOf('/');
+  const tail = idx === -1 ? safeRepositoryPath : safeRepositoryPath.slice(idx + 1);
   const scopedTail = buildDevImageName(tail, developerId);
   if (idx === -1) {
     return scopedTail;
   }
-  return `${repositoryPath.slice(0, idx)}/${scopedTail}`;
+  return `${safeRepositoryPath.slice(0, idx)}/${scopedTail}`;
 }
 
 module.exports = {

package/lib/utils/logger.js

@@ -11,6 +11,39 @@
 
 /* eslint-disable no-console */
 
+const SENSITIVE_KEY_RE = /(password|secret|token|apikey|apiKey|authorization|clientSecret|x-client-token)/i;
+const BEARER_TOKEN_RE = /(Bearer\s+)[A-Za-z0-9._~-]+/gi;
+
+function maskString(value) {
+  const asString = String(value);
+  return asString.replace(BEARER_TOKEN_RE, '$1[REDACTED]');
+}
+
+function sanitizeValue(value) {
+  if (value instanceof Error) {
+    return value;
+  }
+  if (typeof value === 'string') {
+    return maskString(value);
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => sanitizeValue(item));
+  }
+  if (value && typeof value === 'object') {
+    /** @type {Record<string, any>} */
+    const out = {};
+    for (const [key, entry] of Object.entries(value)) {
+      if (SENSITIVE_KEY_RE.test(key)) {
+        out[key] = '[REDACTED]';
+      } else {
+        out[key] = sanitizeValue(entry);
+      }
+    }
+    return out;
+  }
+  return value;
+}
+
 /**
  * Logger utility that wraps console methods
  * All console statements should use this logger to avoid eslint warnings
@@ -21,7 +54,7 @@ const logger = {
    * @param {...any} args - Arguments to log
    */
   log: (...args) => {
-    console.log(...args);
+    console.log(...args.map((arg) => sanitizeValue(arg)));
   },
 
   /**
@@ -29,7 +62,7 @@ const logger = {
    * @param {...any} args - Arguments to log
    */
   error: (...args) => {
-    console.error(...args);
+    console.error(...args.map((arg) => sanitizeValue(arg)));
   },
 
   /**
@@ -37,7 +70,7 @@ const logger = {
    * @param {...any} args - Arguments to log
    */
   warn: (...args) => {
-    console.warn(...args);
+    console.warn(...args.map((arg) => sanitizeValue(arg)));
   },
 
   /**
@@ -45,7 +78,7 @@ const logger = {
    * @param {...any} args - Arguments to log
    */
   info: (...args) => {
-    console.log(...args);
+    console.log(...args.map((arg) => sanitizeValue(arg)));
   }
 };
 

package/lib/utils/manifest-source-emit.js

@@ -74,7 +74,7 @@ function getManifestSourcePayload(appKey, appPath, opts = {}) {
   } catch {
     configPath = '';
   }
-  let tier = 'resolved';
+  let tier;
   try {
     tier = computeTierForAppPath(key, dir, opts.cwd);
   } catch {

package/lib/utils/paths.js

@@ -382,15 +382,41 @@ function getIntegrationBuilderBaseDir() {
 }
 
 /**
- * Returns the default integration root under {@link getAppsMaterializationParent} (listing may also
- * scan {@link getCwdIntegrationRoot}; see {@link listIntegrationAppNames}).
+ * Returns the default integration root: {@link getCwdIntegrationRoot} when present, else
+ * under {@link getAppsMaterializationParent}. Listing may still scan both trees
+ * (see {@link listIntegrationAppNames}).
  *
  * @returns {string} Absolute path to integration/ directory
  */
 function getIntegrationRoot() {
+  const cwdRoot = getCwdIntegrationRoot();
+  if (cwdRoot) {
+    return cwdRoot;
+  }
   return path.join(getAppsMaterializationParent(), 'integration');
 }
 
+/**
+ * True when path exists and is a directory (best-effort; false on error).
+ * @param {string} dirPath
+ * @returns {boolean}
+ */
+function isExistingDirectoryPath(dirPath) {
+  if (!dirPath || typeof dirPath !== 'string') {
+    return false;
+  }
+  try {
+    const disk = nodeFs();
+    if (!disk.existsSync(dirPath)) {
+      return false;
+    }
+    const st = disk.statSync(dirPath);
+    return Boolean(st && typeof st.isDirectory === 'function' && st.isDirectory());
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Absolute `integration/` next to {@link process.cwd} when that directory exists.
  *
@@ -537,19 +563,47 @@ function isAppSubdirSync(root, name) {
 }
 
 /**
- * Lists app names (directories) under integration root. Excludes dot-prefixed entries.
+ * True when an integration/builder app directory has application config (yaml/json or legacy variables.yaml).
+ * Skips helper folders such as fixtures/ and wizard-configs/.
+ * @param {string} appDir - Absolute path to candidate app directory
+ * @returns {boolean}
+ */
+function hasApplicationConfigSync(appDir) {
+  if (!appDir || typeof appDir !== 'string') return false;
+  const disk = nodeFs();
+  const names = [
+    'application.yaml',
+    'application.yml',
+    'application.json',
+    'variables.yaml'
+  ];
+  return names.some((name) => {
+    try {
+      return disk.existsSync(path.join(appDir, name));
+    } catch {
+      return false;
+    }
+  });
+}
+
+/**
+ * Lists app names (directories) under integration root. Excludes dot-prefixed entries
+ * and directories without application config (e.g. fixtures/, wizard-configs/).
  * Returns [] if root does not exist.
  * @returns {string[]} Sorted list of app directory names
  */
 function listIntegrationAppNames() {
   const disk = nodeFs();
   const names = new Set();
+  const withAppConfig = (root) => (name) => hasApplicationConfigSync(path.join(root, name));
   const cwdRoot = getCwdIntegrationRoot();
   if (cwdRoot) {
-    addBuilderSubdirNamesToSet(disk, cwdRoot, names, null);
+    addBuilderSubdirNamesToSet(disk, cwdRoot, names, withAppConfig(cwdRoot));
+  }
+  const matInt = path.join(getAppsMaterializationParent(), 'integration');
+  if (!cwdRoot || path.resolve(matInt) !== path.resolve(cwdRoot)) {
+    addBuilderSubdirNamesToSet(disk, matInt, names, withAppConfig(matInt));
   }
-  const matInt = getIntegrationRoot();
-  addBuilderSubdirNamesToSet(disk, matInt, names, null);
   return [...names].sort();
 }
 
@@ -595,14 +649,19 @@ function listBuilderAppNames() {
   }
   roots.add(path.resolve(getSystemBuilderRoot()));
   for (const r of roots) {
-    addBuilderSubdirNamesToSet(disk, r, names, null);
+    addBuilderSubdirNamesToSet(disk, r, names, (name) =>
+      hasApplicationConfigSync(path.join(r, name))
+    );
   }
   return [...names].sort();
 }
 
 /**
- * Gets the integration folder path: **`cwd/integration/<appName>`** when that directory exists, else
- * **`aifabrix-work` or `aifabrix-home` + `/integration/<appName>`**.
+ * Gets the integration folder path.
+ * Resolution: existing `cwd/integration/<app>` → existing materialization copy →
+ * `cwd/integration/<app>` when `cwd/integration/` exists (new download/create) →
+ * materialization parent. Download should use {@link getAppCreatePath} when it must
+ * always land under cwd even if a materialization orphan exists.
  *
  * @param {string} appName - Application name
  * @returns {string} Absolute path to integration directory
@@ -620,18 +679,21 @@ function getIntegrationPath(appName) {
   } catch {
     // programmatic module optional for CLI-only usage
   }
-  const cwdInt = path.join(path.resolve(process.cwd()), 'integration', appName);
-  try {
-    if (nodeFs().existsSync(cwdInt)) {
-      const st = nodeFs().statSync(cwdInt);
-      if (st && typeof st.isDirectory === 'function' && st.isDirectory()) {
-        return cwdInt;
-      }
+  const cwdRoot = getCwdIntegrationRoot();
+  const matApp = path.join(getAppsMaterializationParent(), 'integration', appName);
+  if (cwdRoot) {
+    const cwdApp = path.join(cwdRoot, appName);
+    if (isExistingDirectoryPath(cwdApp)) {
+      return cwdApp;
     }
-  } catch {
-    // ignore
   }
-  return path.join(getAppsMaterializationParent(), 'integration', appName);
+  if (isExistingDirectoryPath(matApp)) {
+    return matApp;
+  }
+  if (cwdRoot) {
+    return path.join(cwdRoot, appName);
+  }
+  return matApp;
 }
 
 /**
@@ -769,13 +831,15 @@ function resolveExistingWorkspacePath(appName, options) {
   if (isExistingAppDirectory(appPath)) {
     return { appPath, baseDir };
   }
-  const altWorkspace =
-    baseDir === 'enterprise-knowledge' ? 'integration' : 'enterprise-knowledge';
-  const alt = resolveAppWorkspace(appName, { ...options, workspace: altWorkspace });
-  if (!isExistingAppDirectory(alt.appPath)) {
-    return null;
+  const alternates = ['integration', 'enterprise-knowledge', 'role-assistant']
+    .filter((workspaceName) => workspaceName !== baseDir);
+  for (const workspaceName of alternates) {
+    const alt = resolveAppWorkspace(appName, { ...options, workspace: workspaceName });
+    if (isExistingAppDirectory(alt.appPath)) {
+      return { appPath: alt.appPath, baseDir: alt.baseDir };
+    }
   }
-  return { appPath: alt.appPath, baseDir: alt.baseDir };
+  return null;
 }
 
 function externalWorkspaceFolderFromConfig(appPath, baseDir, scopedWorkspace) {
@@ -898,7 +962,7 @@ async function detectAppType(appName, options = {}) {
   const builderAfterTemplate = checkBuilderFolder(appName);
   if (builderAfterTemplate) return builderAfterTemplate;
   throw new Error(
-    `App '${appName}' not found in integration/${appName}, enterprise-knowledge/${appName}, or builder/${appName}`
+    `App '${appName}' not found in integration/${appName}, enterprise-knowledge/${appName}, role-assistant/${appName}, or builder/${appName}`
   );
 }
 
@@ -936,6 +1000,11 @@ async function getResolveAppPath(appName, options = {}) {
   if (workspaceHit) {
     return workspaceHit;
   }
+  const { getRoleAssistantPath } = require('./role-assistant-paths');
+  const roleAssistantHit = tryResolveEnvOnlyPath(getRoleAssistantPath(appName));
+  if (roleAssistantHit) {
+    return roleAssistantHit;
+  }
   const integrationHit = tryResolveEnvOnlyPath(getIntegrationPath(appName));
   if (integrationHit) {
     return integrationHit;
@@ -1045,6 +1114,9 @@ module.exports = {
   getEnterpriseKnowledgePath: require('./enterprise-knowledge-paths').getEnterpriseKnowledgePath,
   getEnterpriseKnowledgeRoot: require('./enterprise-knowledge-paths').getEnterpriseKnowledgeRoot,
   listEnterpriseKnowledgeAnchors: require('./enterprise-knowledge-paths').listEnterpriseKnowledgeAnchors,
+  getRoleAssistantPath: require('./role-assistant-paths').getRoleAssistantPath,
+  getRoleAssistantRoot: require('./role-assistant-paths').getRoleAssistantRoot,
+  getCwdRoleAssistantRoot: require('./role-assistant-paths').getCwdRoleAssistantRoot,
   resolveAppWorkspace: require('./app-path-resolve').resolveAppWorkspace,
   resolveExternalSystemPath: require('./app-path-resolve').resolveExternalSystemPath
 };

package/lib/utils/pipeline-upload-auth-retry.js

@@ -57,13 +57,29 @@ async function resolveClientTokenAuthForPipelineRetry(systemKey) {
  * @param {Object} authConfig
  * @param {Object} payload
  * @param {string} systemKey - External system key for credential lookup on retry
+ * @param {Object} [options] - Forwarded to uploadApplicationViaPipeline (e.g. timeoutMs)
  * @returns {Promise<Object>}
  */
-async function uploadApplicationViaPipelineWithAuthRetry(dataplaneUrl, authConfig, payload, systemKey) {
-  const first = await uploadApplicationViaPipeline(dataplaneUrl, authConfig, payload);
+async function uploadApplicationViaPipelineWithAuthRetry(
+  dataplaneUrl,
+  authConfig,
+  payload,
+  systemKey,
+  options = {}
+) {
+  const first = await uploadApplicationViaPipeline(
+    dataplaneUrl,
+    authConfig,
+    payload,
+    options
+  );
   if (!isPipelineAuthFailure(first) || authConfig.type !== 'bearer') {
     return first;
   }
+  // Token-forward: do not swap the caller JWT for application client-token.
+  if (authConfig.preserveBearer) {
+    return first;
+  }
   const clientAuth = await resolveClientTokenAuthForPipelineRetry(systemKey);
   if (!clientAuth || clientAuth.type === 'bearer') {
     return first;
@@ -73,7 +89,7 @@ async function uploadApplicationViaPipelineWithAuthRetry(dataplaneUrl, authConfi
       'Device login token was rejected for pipeline publish; retrying with application client token…'
     )
   );
-  return uploadApplicationViaPipeline(dataplaneUrl, clientAuth, payload);
+  return uploadApplicationViaPipeline(dataplaneUrl, clientAuth, payload, options);
 }
 
 module.exports = {

package/lib/utils/postgres-platform-bootstrap.js

@@ -68,29 +68,37 @@ function extractPasswordFromUrlOrValue(urlOrPassword) {
 }
 
 /**
- * Escape SQL for embedding in a double-quoted shell argument (-c "...").
- * Bash expands `$` and `$$` (PID) inside double quotes; backslash-escape every `$`.
+ * Run psql -c inside the Postgres container without a shell.
+ * Passes SQL as an argv element so dollar-quoting (DO $$ … $$) is not mangled.
  *
- * @param {string} s
- * @returns {string}
- */
-function escapeShellDoubleQuoted(s) {
-  return s.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\$/g, '\\$');
-}
-
-/**
  * @async
  * @param {string} container
  * @param {string} sql
  * @param {string} adminPassword
+ * @param {string} [database='postgres']
  * @returns {Promise<void>}
  */
 async function runPsqlCommand(container, sql, adminPassword, database = 'postgres') {
-  const escapedSql = escapeShellDoubleQuoted(sql);
-  const cmd =
-    `docker exec -e PGPASSWORD -i ${container} psql -U ${SUPERUSER_ROLE} -d ${database} ` +
-    `-v ON_ERROR_STOP=1 -c "${escapedSql}"`;
-  await dockerExec.execWithDockerEnv(cmd, { env: { PGPASSWORD: adminPassword } });
+  await dockerExec.execFileWithDockerEnv(
+    'docker',
+    [
+      'exec',
+      '-e',
+      'PGPASSWORD',
+      '-i',
+      container,
+      'psql',
+      '-U',
+      SUPERUSER_ROLE,
+      '-d',
+      database,
+      '-v',
+      'ON_ERROR_STOP=1',
+      '-c',
+      sql
+    ],
+    { env: { PGPASSWORD: adminPassword } }
+  );
 }
 
 /**
@@ -194,6 +202,5 @@ module.exports = {
   PLATFORM_DATABASE_SLOTS,
   bootstrapPlatformPostgresDatabases,
   pgRoleName,
-  extractPasswordFromUrlOrValue,
-  escapeShellDoubleQuoted
+  extractPasswordFromUrlOrValue
 };

package/lib/utils/postgres-wipe.js

@@ -86,9 +86,12 @@ async function runPsql(container, sql, adminPassword) {
   if (!adminPassword || typeof adminPassword !== 'string') {
     throw new Error('Admin password is required');
   }
-  const escapedSql = sql.replace(/"/g, '\\"');
-  const cmd = `docker exec -e PGPASSWORD -i ${container} psql -U ${SUPERUSER_ROLE} -d postgres -tAc "${escapedSql}"`;
+  if (!/^[a-z0-9][a-z0-9._-]*$/i.test(container)) {
+    throw new Error(`Unsafe Postgres container name: ${container}`);
+  }
   const env = { PGPASSWORD: adminPassword };
+  const safeSqlToken = JSON.stringify(String(sql));
+  const cmd = `docker exec -e PGPASSWORD -i ${container} psql -U ${SUPERUSER_ROLE} -d postgres -tAc ${safeSqlToken}`;
   const result = (await dockerExec.execWithDockerEnv(cmd, { env })) || {};
   return String(result.stdout || '').trim();
 }

package/lib/utils/remote-dev-auth.js

@@ -24,6 +24,17 @@ function expandConfiguredSecretsTilde(filePath) {
   return filePath;
 }
 
+/** One auto-renew attempt per CLI process (shared by concurrent getRemoteDevAuth callers). */
+let autoRenewPromise = null;
+
+/**
+ * Reset process-level auto-renew gate (tests only).
+ * @returns {void}
+ */
+function resetDevCertAutoRenewGateForTests() {
+  autoRenewPromise = null;
+}
+
 /**
  * Single API object so resolveSharedSecretsEndpoint and callers share one getRemoteDevAuth
  * (Jest spies and partial mocks work reliably).
@@ -39,12 +50,11 @@ const remoteDevAuth = {
   },
 
   /**
-   * Get Builder Server URL, client cert PEM, and optional dev root CA when remote is configured; otherwise null.
-   * serverCaPem comes from ca.pem (saved at dev init); required for Node TLS to private-CA servers.
-   * Use for cert-authenticated dev API calls (settings, users, ssh-keys, secrets).
+   * Read remote server URL + client cert from disk without auto-renew.
+   * Use when renewing (avoids recursion) or when only a local presence check is needed.
    * @returns {Promise<{ serverUrl: string, clientCertPem: string, serverCaPem: string|null }|null>}
    */
-  async getRemoteDevAuth() {
+  async readRemoteDevAuth() {
     const serverUrl = await config.getRemoteServer();
     if (!serverUrl) return null;
     const devId = await config.getDeveloperId();
@@ -55,6 +65,30 @@ const remoteDevAuth = {
     return { serverUrl, clientCertPem, serverCaPem };
   },
 
+  /**
+   * Get Builder Server URL, client cert PEM, and optional dev root CA when remote is configured; otherwise null.
+   * When the client cert is still valid but expires within 14 days, renews it once per process before returning.
+   * serverCaPem comes from ca.pem (saved at dev init); required for Node TLS to private-CA servers.
+   * Use for cert-authenticated dev API calls (settings, users, ssh-keys, secrets).
+   * @returns {Promise<{ serverUrl: string, clientCertPem: string, serverCaPem: string|null }|null>}
+   */
+  async getRemoteDevAuth() {
+    const existing = await remoteDevAuth.readRemoteDevAuth();
+    if (!existing) return null;
+    if (!autoRenewPromise) {
+      autoRenewPromise = (async() => {
+        const { ensureDevCertFreshIfDue } = require('../commands/dev-refresh');
+        return ensureDevCertFreshIfDue({ quiet: false });
+      })();
+    }
+    try {
+      await autoRenewPromise;
+    } catch {
+      // ensureDevCertFreshIfDue already handles failures; keep using current cert
+    }
+    return remoteDevAuth.readRemoteDevAuth();
+  },
+
   /**
    * Resolve where shared secrets read/write should go. After dev init, config may still hold a
    * server-side filesystem path from GET /api/dev/settings (not an http URL) if merge did not rewrite it.
@@ -148,3 +182,4 @@ function normalizeSharedSecretsFilePath(configured) {
 }
 
 module.exports = remoteDevAuth;
+module.exports.resetDevCertAutoRenewGateForTests = resetDevCertAutoRenewGateForTests;

package/lib/utils/resolve-docker-image-ref.js

@@ -12,6 +12,32 @@
 'use strict';
 
 const { parseImageOverride } = require('./parse-image-ref');
+const DOCKER_REPOSITORY_RE = /^[a-z0-9][a-z0-9._/-]*$/i;
+const DOCKER_TAG_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+
+/**
+ * @param {string} repository
+ * @returns {string}
+ */
+function assertSafeRepository(repository) {
+  const trimmed = String(repository || '').trim();
+  if (!trimmed || !DOCKER_REPOSITORY_RE.test(trimmed)) {
+    throw new Error(`Invalid Docker repository path: ${repository}`);
+  }
+  return trimmed;
+}
+
+/**
+ * @param {string} tag
+ * @returns {string}
+ */
+function assertSafeTag(tag) {
+  const trimmed = String(tag || '').trim();
+  if (!trimmed || !DOCKER_TAG_RE.test(trimmed)) {
+    throw new Error(`Invalid Docker image tag: ${tag}`);
+  }
+  return trimmed;
+}
 
 /**
  * Repository path without host (same rules as compose-generator getImageName).
@@ -59,7 +85,11 @@ function normalizeDockerRegistryPrefix(registry) {
   if (!t) {
     return '';
   }
-  return t.replace(/\/+$/, '');
+  let end = t.length;
+  while (end > 0 && t[end - 1] === '/') {
+    end -= 1;
+  }
+  return t.slice(0, end);
 }
 
 /**
@@ -81,18 +111,18 @@ function resolveDockerImageRef(appName, appConfig, runOptions = {}) {
   if (opts.image) {
     const parsed = parseImageOverride(opts.image);
     return {
-      imageName: parsed ? parsed.name : getRepositoryPathFromConfig(appConfig, appName),
-      imageTag: parsed ? parsed.tag : tagFromOpts || imageTagFromConfig(appConfig)
+      imageName: assertSafeRepository(parsed ? parsed.name : getRepositoryPathFromConfig(appConfig, appName)),
+      imageTag: assertSafeTag(parsed ? parsed.tag : tagFromOpts || imageTagFromConfig(appConfig))
     };
   }
 
-  const baseRepo = getRepositoryPathFromConfig(appConfig, appName);
-  const imageTag = tagFromOpts || imageTagFromConfig(appConfig);
+  const baseRepo = assertSafeRepository(getRepositoryPathFromConfig(appConfig, appName));
+  const imageTag = assertSafeTag(tagFromOpts || imageTagFromConfig(appConfig));
   const prefix =
     normalizeDockerRegistryPrefix(opts.registry) ||
     normalizeDockerRegistryPrefix(appConfig?.image?.registry ?? '');
   if (prefix) {
-    return { imageName: `${prefix}/${baseRepo}`, imageTag };
+    return { imageName: assertSafeRepository(`${prefix}/${baseRepo}`), imageTag };
   }
   return { imageName: baseRepo, imageTag };
 }