@aifabrix/builder 2.51.0 → 2.51.1

package/lib/channels/microsoft-copilot-package.js

@@ -0,0 +1,280 @@
+/**
+ * Microsoft Copilot package artifact generation (plan 164).
+ *
+ * @fileoverview Build source files, package ZIP, and lifecycle summary for microsoft-copilot channel
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const AdmZip = require('adm-zip');
+
+const PLACEHOLDER_ICON_BASE64 =
+  'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO2s9WQAAAAASUVORK5CYII=';
+
+/**
+ * @param {string} outputPath
+ * @param {Object} runtimeValues
+ * @returns {Object}
+ */
+function buildCopilotOutputPaths(outputPath, runtimeValues) {
+  const rootDir = path.dirname(outputPath);
+  const sourceDir = path.join(rootDir, 'source');
+  const buildDir = path.join(rootDir, 'build');
+  const installDir = path.join(rootDir, 'install');
+  const environment = String(runtimeValues.environment || 'dev').trim() || 'dev';
+  const zipFileName = `appPackage.${environment}.zip`;
+  return {
+    rootDir,
+    sourceDir,
+    buildDir,
+    installDir,
+    summaryPath: outputPath,
+    zipFileName,
+    zipPath: path.join(buildDir, zipFileName),
+    validationPath: path.join(installDir, 'validation.json'),
+    installPath: path.join(installDir, 'README.md')
+  };
+}
+
+/**
+ * @returns {{ color: Buffer, outline: Buffer }}
+ */
+function getPlaceholderIcons() {
+  const icon = Buffer.from(PLACEHOLDER_ICON_BASE64, 'base64');
+  return { color: icon, outline: icon };
+}
+
+/**
+ * @param {Object} runtimeValues
+ * @param {(templatePath: string, context: Object) => string} renderTemplateFile
+ * @param {string} templatesDir
+ * @returns {{ sourceFiles: Record<string, string>, installText: string }}
+ */
+function renderCopilotTemplates(runtimeValues, renderTemplateFile, templatesDir) {
+  const sourceFiles = {
+    'manifest.json': renderTemplateFile(path.join(templatesDir, 'manifest.template.json.hbs'), runtimeValues),
+    'declarativeAgent.json': renderTemplateFile(
+      path.join(templatesDir, 'declarative-agent.template.json.hbs'),
+      runtimeValues
+    ),
+    'ai-plugin.json': renderTemplateFile(
+      path.join(templatesDir, 'ai-plugin.template.json.hbs'),
+      runtimeValues
+    )
+  };
+  const installText = renderTemplateFile(path.join(templatesDir, 'install.template.md.hbs'), runtimeValues);
+  return { sourceFiles, installText };
+}
+
+/**
+ * @param {Record<string, string>} sourceFiles
+ * @param {(content: string) => void} assertNoSecretsInArtifact
+ */
+function assertNoSecretsInSourceFiles(sourceFiles, assertNoSecretsInArtifact) {
+  for (const content of Object.values(sourceFiles)) {
+    assertNoSecretsInArtifact(content);
+  }
+}
+
+/**
+ * @param {Record<string, string>} sourceFiles
+ * @param {{ color: Buffer, outline: Buffer }} icons
+ * @returns {Buffer}
+ */
+function buildCopilotZipBuffer(sourceFiles, icons) {
+  const zip = new AdmZip();
+  zip.addFile('manifest.json', Buffer.from(sourceFiles['manifest.json'], 'utf8'));
+  zip.addFile('declarativeAgent.json', Buffer.from(sourceFiles['declarativeAgent.json'], 'utf8'));
+  zip.addFile('ai-plugin.json', Buffer.from(sourceFiles['ai-plugin.json'], 'utf8'));
+  zip.addFile('color.png', icons.color);
+  zip.addFile('outline.png', icons.outline);
+  return zip.toBuffer();
+}
+
+/**
+ * @param {Object} runtimeValues
+ * @param {Object} paths
+ * @param {string[]} sourceFileNames
+ * @returns {Object}
+ */
+function buildCopilotValidation(runtimeValues, paths, sourceFileNames) {
+  return {
+    tier: 'builderValidated',
+    environment: runtimeValues.environment,
+    sourceFiles: sourceFileNames,
+    zipFile: paths.zipFileName,
+    runtimeSystemKey: runtimeValues.runtimeSystemKey,
+    runtimeMcpUrl: runtimeValues.mcpUrl,
+    runtimeTransport: runtimeValues.runtimeTransport,
+    expectedLayerBToolNames: runtimeValues.layerBToolNames || [],
+    boundaries: {
+      onePackagePerEnvironment: true,
+      topLevelVendorToolsExposed: false,
+      roleAssistantResolution: 'dynamic-runtime'
+    },
+    requiresMicrosoftAdmin: [
+      'upload-package',
+      'tenant-approval',
+      'assignment-and-consent',
+      'first-copilot-invoke'
+    ]
+  };
+}
+
+/**
+ * @param {Array<string|Buffer>} parts
+ * @returns {string}
+ */
+function computeCopilotArtifactHash(parts) {
+  const hash = crypto.createHash('sha256');
+  for (const part of parts) {
+    if (Buffer.isBuffer(part)) {
+      hash.update(part);
+      continue;
+    }
+    hash.update(String(part), 'utf8');
+  }
+  return hash.digest('hex');
+}
+
+/**
+ * @param {Object} runtimeValues
+ * @param {Object} paths
+ * @param {Object} validation
+ * @param {string} artifactHash
+ * @returns {Object}
+ */
+function buildCopilotSummary(runtimeValues, paths, validation, artifactHash) {
+  return {
+    channelTarget: runtimeValues.channelTarget,
+    name: runtimeValues.appName,
+    baseName: runtimeValues.baseName,
+    description: runtimeValues.appDescription,
+    environment: runtimeValues.environment,
+    runtime: {
+      runtimeSystemKey: runtimeValues.runtimeSystemKey,
+      remoteMcpUrl: runtimeValues.mcpUrl,
+      transport: runtimeValues.runtimeTransport,
+      assistantCatalogUrl: runtimeValues.assistantCatalogUrl,
+      roleAssistantResolution: 'dynamic-runtime',
+      layerBToolNames: runtimeValues.layerBToolNames || []
+    },
+    authentication: {
+      mode: runtimeValues.runtimeAuthMode,
+      credentialKey: runtimeValues.credentialKey,
+      credentialPortalUrl: runtimeValues.credentialPortalUrl,
+      scopes: runtimeValues.scopes || []
+    },
+    package: {
+      appId: runtimeValues.packageAppId,
+      version: runtimeValues.packageVersion,
+      sourceFiles: ['manifest.json', 'declarativeAgent.json', 'ai-plugin.json', 'color.png', 'outline.png'],
+      zipFileName: paths.zipFileName,
+      installGuide: path.relative(paths.rootDir, paths.installPath),
+      validationFile: path.relative(paths.rootDir, paths.validationPath)
+    },
+    probeTiers: {
+      builderValidated: true,
+      runtimeValidated: false,
+      requiresMicrosoftAdmin: true
+    },
+    artifact: {
+      format: 'microsoft-365-copilot-package',
+      hash: artifactHash,
+      generatedAt: new Date().toISOString()
+    },
+    validation
+  };
+}
+
+/**
+ * @param {Object} params
+ */
+function writeCopilotArtifacts(params) {
+  const { paths, sourceFiles, icons, zipBuffer, installText, validationText, summaryText } = params;
+  fs.mkdirSync(paths.sourceDir, { recursive: true });
+  fs.mkdirSync(paths.buildDir, { recursive: true });
+  fs.mkdirSync(paths.installDir, { recursive: true });
+  fs.writeFileSync(path.join(paths.sourceDir, 'manifest.json'), sourceFiles['manifest.json'], 'utf8');
+  fs.writeFileSync(
+    path.join(paths.sourceDir, 'declarativeAgent.json'),
+    sourceFiles['declarativeAgent.json'],
+    'utf8'
+  );
+  fs.writeFileSync(path.join(paths.sourceDir, 'ai-plugin.json'), sourceFiles['ai-plugin.json'], 'utf8');
+  fs.writeFileSync(path.join(paths.sourceDir, 'color.png'), icons.color);
+  fs.writeFileSync(path.join(paths.sourceDir, 'outline.png'), icons.outline);
+  fs.writeFileSync(paths.zipPath, zipBuffer);
+  fs.writeFileSync(paths.installPath, installText, 'utf8');
+  fs.writeFileSync(paths.validationPath, validationText, 'utf8');
+  fs.writeFileSync(paths.summaryPath, summaryText, 'utf8');
+}
+
+/**
+ * @param {Object} params
+ * @param {Object} params.runtimeValues
+ * @param {string} params.templatesDir
+ * @param {string} params.outputPath
+ * @param {boolean} [params.dryRun]
+ * @param {(content: string) => void} params.assertNoSecretsInArtifact
+ * @param {(templatePath: string, context: Object) => string} params.renderTemplateFile
+ * @returns {{ outputPath: string, artifactHash: string, content: string, installPath: string }}
+ */
+function generateMicrosoftCopilotPackage(params) {
+  const runtimeValues = params.runtimeValues || {};
+  const paths = buildCopilotOutputPaths(params.outputPath, runtimeValues);
+  const icons = getPlaceholderIcons();
+  const { sourceFiles, installText } = renderCopilotTemplates(
+    runtimeValues,
+    params.renderTemplateFile,
+    params.templatesDir
+  );
+  assertNoSecretsInSourceFiles(sourceFiles, params.assertNoSecretsInArtifact);
+  params.assertNoSecretsInArtifact(installText);
+  const zipBuffer = buildCopilotZipBuffer(sourceFiles, icons);
+  const validation = buildCopilotValidation(runtimeValues, paths, Object.keys(sourceFiles));
+  const validationText = JSON.stringify(validation, null, 2);
+  const artifactHash = computeCopilotArtifactHash([
+    sourceFiles['manifest.json'],
+    sourceFiles['declarativeAgent.json'],
+    sourceFiles['ai-plugin.json'],
+    installText,
+    validationText,
+    zipBuffer
+  ]);
+  const summary = buildCopilotSummary(runtimeValues, paths, validation, artifactHash);
+  const summaryText = JSON.stringify(summary, null, 2);
+  params.assertNoSecretsInArtifact(summaryText);
+  if (!params.dryRun) {
+    writeCopilotArtifacts({
+      paths,
+      sourceFiles,
+      icons,
+      zipBuffer,
+      installText,
+      validationText,
+      summaryText
+    });
+  }
+  return {
+    outputPath: paths.summaryPath,
+    artifactHash,
+    content: summaryText,
+    installPath: paths.installPath
+  };
+}
+
+module.exports = {
+  generateMicrosoftCopilotPackage,
+  buildCopilotOutputPaths,
+  renderCopilotTemplates,
+  buildCopilotZipBuffer,
+  buildCopilotValidation,
+  buildCopilotSummary,
+  computeCopilotArtifactHash
+};

package/lib/channels/runtime-tool-catalog.js

@@ -0,0 +1,165 @@
+/**
+ * Resolve Runtime Layer B tool names from Dataplane.
+ *
+ * @fileoverview Runtime-orchestration MCP tool discovery for channel artifacts and probes
+ * @author AI Fabrix Team
+ * @version 1.1.0
+ */
+
+'use strict';
+
+const { createDataplaneApiClient } = require('../api/index');
+const { getChannelTarget } = require('./channel-targets');
+
+/**
+ * Prefer the first-party MCP gateway catalog, then MCP OpenAPI, then legacy paths.
+ */
+const TOOL_CATALOG_BUILDERS = Object.freeze([
+  (systemKey) =>
+    `/api/v1/mcp/servers/tools?filter=${encodeURIComponent(`systemKey:eq:${systemKey}`)}&pageSize=100`,
+  (systemKey) => `/api/v1/mcp/${systemKey}/docs/mcp-openapi.json`,
+  (systemKey) => `/api/v1/external/systems/${systemKey}/mcp/tools`,
+  (systemKey) => `/api/v1/external/systems/${systemKey}/mcp/tools/list`,
+  (systemKey) => `/api/v1/external/systems/${systemKey}/mcp/catalog`,
+  (systemKey) => `/api/v1/external/systems/${systemKey}/tools`
+]);
+
+/**
+ * @param {unknown} value
+ * @returns {string[]}
+ */
+function extractToolNames(value) {
+  if (Array.isArray(value)) {
+    return value
+      .map((item) => {
+        if (typeof item === 'string') return item.trim();
+        if (!item || typeof item !== 'object') return '';
+        return String(item.name || item.toolName || item.key || '').trim();
+      })
+      .filter(Boolean);
+  }
+  if (!value || typeof value !== 'object') {
+    return [];
+  }
+  const body = /** @type {Record<string, unknown>} */ (value);
+  if (body.paths && typeof body.paths === 'object') {
+    return extractToolNamesFromOpenApiPaths(body.paths);
+  }
+  const candidates = [body.tools, body.items, body.data, body.result];
+  for (const candidate of candidates) {
+    const names = extractToolNames(candidate);
+    if (names.length > 0) {
+      return names;
+    }
+  }
+  return [];
+}
+
+/**
+ * @param {Record<string, unknown>} paths
+ * @returns {string[]}
+ */
+function extractToolNamesFromOpenApiPaths(paths) {
+  const names = [];
+  for (const pathKey of Object.keys(paths || {})) {
+    const match = String(pathKey).match(/\/tools\/([^/]+)\/execute$/);
+    if (match && match[1] && match[1] !== 'execute') {
+      names.push(match[1]);
+    }
+  }
+  return [...new Set(names)];
+}
+
+/**
+ * @param {string} routeSystemKey
+ * @returns {string[]}
+ */
+function buildToolCatalogEndpoints(routeSystemKey) {
+  return TOOL_CATALOG_BUILDERS.map((build) => build(routeSystemKey));
+}
+
+/**
+ * @param {Object} response
+ * @returns {string[]}
+ */
+function extractToolNamesFromClientResponse(response) {
+  const direct = extractToolNames(response);
+  if (direct.length > 0) return preferLayerBToolNames(direct);
+  return preferLayerBToolNames(extractToolNames(response?.data ?? response));
+}
+
+/**
+ * Prefer MCP Layer B names (`work.start`) over REST-ish operation ids.
+ *
+ * @param {string[]} names
+ * @returns {string[]}
+ */
+function preferLayerBToolNames(names) {
+  const list = Array.isArray(names) ? names : [];
+  const dotted = list.filter((name) => /^[a-z][a-z0-9]*\.[a-z][a-z0-9.]*$/i.test(name));
+  return dotted.length > 0 ? dotted : list;
+}
+
+/**
+ * @param {string} dataplaneUrl
+ * @param {Object} authConfig
+ * @param {string} channelTarget
+ * @returns {Promise<string[]>}
+ */
+async function fetchRuntimeLayerBToolNames(dataplaneUrl, authConfig, channelTarget) {
+  const target = getChannelTarget(channelTarget);
+  const routeSystemKey = target.routeSystemKey || target.key;
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
+  const endpoints = buildToolCatalogEndpoints(routeSystemKey);
+  for (const endpoint of endpoints) {
+    try {
+      const response = await client.get(endpoint, { timeoutMs: 10000 });
+      const names = extractToolNamesFromClientResponse(response);
+      if (Array.isArray(names) && names.length > 0) {
+        return [...new Set(names)].sort();
+      }
+    } catch {
+      // Try the next endpoint candidate.
+    }
+  }
+  return [];
+}
+
+/**
+ * True when Runtime MCP gateway docs or tool catalog is reachable.
+ *
+ * @async
+ * @param {string} dataplaneUrl
+ * @param {Object} authConfig
+ * @param {string} routeSystemKey
+ * @returns {Promise<boolean>}
+ */
+async function isRuntimeMcpGatewayReachable(dataplaneUrl, authConfig, routeSystemKey) {
+  if (!dataplaneUrl || !routeSystemKey) return false;
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
+  const candidates = [
+    `/api/v1/mcp/${routeSystemKey}/docs/mcp-openapi.json`,
+    `/api/v1/mcp/servers/tools?filter=${encodeURIComponent(`systemKey:eq:${routeSystemKey}`)}&pageSize=1`
+  ];
+  for (const endpoint of candidates) {
+    try {
+      const response = await client.get(endpoint, { timeoutMs: 8000 });
+      if (response && response.success !== false) {
+        return true;
+      }
+    } catch {
+      // try next
+    }
+  }
+  return false;
+}
+
+module.exports = {
+  TOOL_CATALOG_BUILDERS,
+  extractToolNames,
+  extractToolNamesFromOpenApiPaths,
+  preferLayerBToolNames,
+  buildToolCatalogEndpoints,
+  fetchRuntimeLayerBToolNames,
+  isRuntimeMcpGatewayReachable
+};

package/lib/cli/index.js

@@ -24,6 +24,7 @@ const { setupDatasourceCommands } = require('../commands/datasource');
 const { setupDimensionCommands } = require('../commands/dimension');
 const { setupResourceTypeCommands } = require('../commands/resource-type');
 const { setupRoleCommands } = require('../commands/role');
+const { setupRoleAssistantCommands } = require('../commands/role-assistant');
 const { setupEvidenceKindCommands } = require('../commands/evidence-kind');
 const { setupEnterpriseKnowledgeCommands } = require('../commands/enterprise-knowledge');
 const { setupIdentityCommands } = require('../commands/identity');
@@ -76,6 +77,7 @@ function setupExtendedCliCommands(program) {
   setupDimensionCommands(program);
   setupResourceTypeCommands(program);
   setupRoleCommands(program);
+  setupRoleAssistantCommands(program);
   setupEvidenceKindCommands(program);
   setupEnterpriseKnowledgeCommands(program);
   setupIdentityCommands(program);

package/lib/cli/setup-app.js

@@ -56,12 +56,16 @@ Examples:
   $ aifabrix validate hubspot-demo
   $ aifabrix upload hubspot-demo --probe
   $ aifabrix deploy hubspot-demo --probe -v
+  # Prove pillars in tst/CI, then promote (plain deploy seals cert on published Deploy)
   $ aifabrix deploy ek-sales --gate full --subject-email ops@example.com
+  $ aifabrix deploy ek-sales
 
 Notes:
   - Login or set MISO_CONTROLLER_URL + environment (aifabrix login / aifabrix auth).
   - CI: register once (aifabrix app register <appKey>), store DEV_MISO_CLIENTID and DEV_MISO_CLIENTSECRET in pipeline secrets.
   - upload = dataplane publish for dev iteration; deploy = controller validate + deploy (Azure or local Docker).
+  - Prove (tst/CI): use --gate full (optional --subject-email) before promote; plain deploy promotes without live E2E gates.
+  - After a successful published Deploy, the platform seals the integration certificate (no separate certificates issue step).
   - Default output is a compact status card; use -v for expanded preflight and readiness detail.
   - Controller deploy always polls to a terminal status (no --poll / --no-poll on this command).
   - --repository-url overrides repo URL for pipeline validate (default: application.yaml repository.repositoryUrl).

package/lib/cli/setup-external-system-help.js

@@ -10,6 +10,7 @@ Examples:
   $ aifabrix upload hubspot-demo
   $ aifabrix upload hubspot-demo -v
   $ aifabrix upload hubspot-demo --probe
+  $ aifabrix upload hubspot-demo --timeout 600000
 
   # Build and validate payload only (no API calls)
   $ aifabrix upload hubspot-demo --dry-run
@@ -18,11 +19,16 @@ Examples:
   $ aifabrix upload .protection
   $ aifabrix upload .protection --warnings-as-errors
 
+  # Role Assistant package (settings section + Evidence sidecars)
+  $ aifabrix upload sales-representative --env dev
+
 Notes:
   - Requires login (aifabrix auth status).
-  - Reads files under integration/<systemKey>/ (system JSON, datasources, credentials).
+  - Reads files under integration/<systemKey>/ or role-assistant/<roleKey>/ for digital workers.
   - Default output is a compact readiness summary; use -v for expanded detail and server-side validate warnings.
-  - --probe runs dataplane runtime checks after publish (slower; common in Session 1).
+  - --probe runs dataplane runtime checks after publish (slower).
+  - --timeout sets publish budget in ms (HTTP client and dataplane); default 300000.
+  - --env selects role-assistant.yaml section (dev|tst|pro) for digital workers; default dev.
   - test-e2e and test-integration publish local files first by default; use --no-publish on those commands to skip.
   - After dimension/FK edits on active datasources, use --force (or test-e2e / test-integration / datasource test-* with --sync --force).
   - For one datasource only: aifabrix datasource upload <datasourceKey>

package/lib/cli/setup-external-system.js

@@ -45,13 +45,16 @@ async function handleUploadCommandAction(systemKey, options) {
     return;
   }
   const upload = require('../commands/upload');
+  const { resolvePipelineUploadTimeoutMs } = require('../api/pipeline.api');
   const probeTimeout =
     options.probeTimeout === undefined || options.probeTimeout === null
       ? 120000
       : Number(options.probeTimeout);
+  const timeoutMs = resolvePipelineUploadTimeoutMs(options.timeout);
   await upload.uploadExternalSystem(systemKey, {
     ...options,
     probeTimeout: Number.isFinite(probeTimeout) ? probeTimeout : 120000,
+    timeoutMs,
     pathOptions: {}
   });
 }
@@ -98,10 +101,19 @@ function setupUploadCommand(program) {
     .option('-v, --verbose', 'Expanded upload summary and server-side pipeline validate warnings before publish')
     .option('--probe', 'After publish, run dataplane runtime checks (validation/run); slower')
     .option('--probe-timeout <ms>', 'Timeout for --probe (default: 120000)', '120000')
+    .option(
+      '--timeout <ms>',
+      'Publish timeout in ms for HTTP and dataplane budget (default: 300000; min 5000, max 2700000)'
+    )
     .option(
       '--force',
       'Bypass schema guards on active datasources during publish (dangerous; shows a warning)'
     )
+    .option(
+      '-e, --env <env>',
+      'Role Assistant settings environment section: dev, tst, or pro (default: dev)',
+      'dev'
+    )
     .action(async(systemKey, options) => {
       try {
         await handleUploadCommandAction(systemKey, options);

package/lib/commands/app-test.js

@@ -166,20 +166,8 @@ async function runDockerExec(containerName, testCmd, envFilePath = null) {
  * @returns {Promise<number>} Exit code
  */
 async function runDockerRunEphemeral(fullImage, testCmd, envFilePath = null) {
-  const { getDockerExecEnv } = require('../utils/remote-docker-env');
-  const dockerEnv = await getDockerExecEnv();
-  return new Promise((resolve) => {
-    const args = ['run', '--rm'];
-    if (envFilePath) args.push('--env-file', envFilePath);
-    args.push(fullImage, 'sh', '-c', testCmd);
-    const proc = spawn('docker', args, {
-      stdio: 'inherit',
-      shell: false,
-      env: dockerEnv
-    });
-    proc.on('close', code => resolve(code !== null ? code : 1));
-    proc.on('error', () => resolve(1));
-  });
+  const { runDockerRunEphemeral: runEphemeral } = require('../utils/docker-run-ephemeral');
+  return runEphemeral(fullImage, testCmd, envFilePath);
 }
 
 /**

package/lib/commands/datasource-load-export-cli.js

@@ -76,7 +76,8 @@ async function datasourceLoadAction(datasourceKey, options) {
       dryRun: options.dryRun,
       batchSize: options.batchSize,
       syncType: options.syncType,
-      format: options.format
+      format: options.format,
+      timeoutMs: options.timeout
     });
 
     if (options.json) {
@@ -141,6 +142,10 @@ function setupDatasourceLoadExportCommands(datasource) {
       'Dataplane syncType',
       'incremental'
     )
+    .option(
+      '--timeout <ms>',
+      'Per-batch HTTP timeout for records/bulk (default 120000)'
+    )
     .option('--dry-run', 'Parse and validate only; no upload')
     .option('-v, --verbose', 'Per-batch progress')
     .option('--json', 'Machine-readable result JSON')

package/lib/commands/deploy-gate-failure-details.js

@@ -113,6 +113,24 @@ function formatOperationsGateFailure(result) {
   return 'E2E validation did not succeed for one or more datasources';
 }
 
+/**
+ * @param {Object} row
+ * @returns {string|null}
+ */
+function formatFailedDatasourceRowHint(row) {
+  if (!row || row.success !== false) {
+    return null;
+  }
+  const key = row.key || row.datasourceKey || 'datasource';
+  const issues = row.datasourceTestRun?.validation?.issues;
+  if (Array.isArray(issues) && issues.length > 0) {
+    const first = issues[0];
+    const code = first.code ? `${first.code}: ` : '';
+    return `${key}: ${code}${first.message || 'validation failed'}`;
+  }
+  return row.error ? `${key}: ${row.error}` : null;
+}
+
 /**
  * @param {Object} result
  * @returns {string}
@@ -125,23 +143,7 @@ function formatIntegrationGateFailure(result) {
     return String(result.message);
   }
   const rows = Array.isArray(result?.datasourceResults) ? result.datasourceResults : [];
-  const hints = [];
-  for (const row of rows) {
-    if (!row || row.success !== false) {
-      continue;
-    }
-    const key = row.key || row.datasourceKey || 'datasource';
-    const issues = row.datasourceTestRun?.validation?.issues;
-    if (Array.isArray(issues) && issues.length > 0) {
-      const first = issues[0];
-      const code = first.code ? `${first.code}: ` : '';
-      hints.push(`${key}: ${code}${first.message || 'validation failed'}`);
-      continue;
-    }
-    if (row.error) {
-      hints.push(`${key}: ${row.error}`);
-    }
-  }
+  const hints = rows.map(formatFailedDatasourceRowHint).filter(Boolean);
   if (hints.length > 0) {
     return hints.slice(0, 3).join('; ');
   }

package/lib/commands/dev-down.js

@@ -23,18 +23,14 @@ const execAsync = promisify(exec);
  * @returns {Promise<void>}
  */
 async function stopMutagenSessions(developerId) {
-  const { getMutagenPath } = require('../utils/mutagen');
+  const { getMutagenPath, listSyncSessionNames } = require('../utils/mutagen');
   const mutagenPath = await getMutagenPath();
   if (!mutagenPath) {
     logger.log(chalk.gray('Mutagen not installed; no sync sessions to stop.'));
     return;
   }
   try {
-    const { stdout } = await execAsync(`"${mutagenPath}" sync list --template '{{.Name}}'`, {
-      encoding: 'utf8',
-      timeout: 5000
-    });
-    const sessions = (stdout || '').trim().split('\n').filter(Boolean);
+    const sessions = await listSyncSessionNames(mutagenPath);
     const prefix = `aifabrix-${developerId}-`;
     const toTerminate = sessions.filter(name => name.startsWith(prefix));
     for (const name of toTerminate) {