@aifabrix/builder 2.51.0 → 2.52.0

package/lib/app/run-container-start.js

@@ -141,6 +141,7 @@ async function startContainer(appName, composePath, port, appConfig = null, opts
     debug = false,
     runEnvPath = null,
     runEnvAdminPath = null,
+    ensureRunEnvFiles = null,
     runOptions = {},
     devMountPath = null,
     misoEnvironment = 'dev'
@@ -166,6 +167,9 @@ async function startContainer(appName, composePath, port, appConfig = null, opts
   }
 
   if (!usedDockerRunFallback) {
+    if (typeof ensureRunEnvFiles === 'function') {
+      await ensureRunEnvFiles();
+    }
     const env = await prepareContainerEnv(debug);
     await executeComposeUp(composeCmdBase, composePath, env, debug);
   }

package/lib/app/run-deploy-job.js

@@ -0,0 +1,216 @@
+/**
+ * Optional build.deployJob — one-shot before long-running aifabrix run start.
+ *
+ * @fileoverview Run deployJob once per aifabrix run
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+const config = require('../core/config');
+const logger = require('../utils/logger');
+const {
+  infoLine,
+  formatSuccessLine,
+  formatBlockingError,
+  metadata
+} = require('../utils/cli-test-layout-chalk');
+const { runDockerRunEphemeral } = require('../utils/docker-run-ephemeral');
+const { getInfraBridgeNetworkName } = require('../infrastructure/orphan-infra-docker-teardown');
+
+/** Migrate status lines: `[system] head=… applied=3 pending=[]` */
+const DEPLOY_JOB_STATUS_RE =
+  /^\[([^\]]+)\]\s+head=\S+\s+applied=(\d+)\s+pending=(\[[^\]]*\])/i;
+
+/**
+ * Resolve trimmed deployJob from app config, or null if unset.
+ * @param {Object} appConfig - Application configuration
+ * @returns {string|null}
+ */
+function resolveDeployJobCommand(appConfig) {
+  const raw = appConfig?.build?.deployJob;
+  if (typeof raw !== 'string') {
+    return null;
+  }
+  const trimmed = raw.trim();
+  return trimmed ? trimmed : null;
+}
+
+/**
+ * Developer infra bridge so ephemeral jobs resolve compose DNS (e.g. postgres).
+ * @returns {Promise<string>}
+ */
+async function resolveDeployJobNetwork() {
+  const developerId = await config.getDeveloperId();
+  return getInfraBridgeNetworkName(developerId);
+}
+
+/**
+ * Quiet docker stdio by default (hide app bootstrap warnings). Full inherit only with --debug.
+ * @param {{ quiet?: boolean, debug?: boolean }} params
+ * @returns {boolean}
+ */
+function shouldQuietDeployJob(params = {}) {
+  if (params.debug === true) {
+    return false;
+  }
+  return true;
+}
+
+/**
+ * Parse migrate CLI status lines into totals (no per-chain head/pending dump).
+ * @param {string} output
+ * @returns {{ chains: number, applied: number, pending: number }|null}
+ */
+function summarizeDeployJobMigrateOutput(output) {
+  if (typeof output !== 'string' || !output.trim()) {
+    return null;
+  }
+  let chains = 0;
+  let applied = 0;
+  let pending = 0;
+  for (const line of output.split(/\r?\n/)) {
+    const match = DEPLOY_JOB_STATUS_RE.exec(line.trim());
+    if (!match) {
+      continue;
+    }
+    chains += 1;
+    applied += Number.parseInt(match[2], 10) || 0;
+    const inner = match[3].slice(1, -1).trim();
+    if (inner) {
+      pending += inner.split(',').filter((part) => part.trim()).length;
+    }
+  }
+  if (chains === 0) {
+    return null;
+  }
+  return { chains, applied, pending };
+}
+
+/**
+ * One-line migrate totals from quiet deployJob output (replaces per-chain dump).
+ * @param {string} output
+ * @returns {string|null} Summary text for the completed line, or null
+ */
+function formatDeployJobMigrateSummary(output) {
+  const summary = summarizeDeployJobMigrateOutput(output);
+  if (!summary) {
+    return null;
+  }
+  return `${summary.applied} applied, ${summary.pending} pending (${summary.chains} chains)`;
+}
+
+/**
+ * @deprecated Prefer formatDeployJobMigrateSummary — kept for tests.
+ * @param {string} output
+ */
+function emitDeployJobSummaryLines(output) {
+  const text = formatDeployJobMigrateSummary(output);
+  if (text) {
+    logger.log(metadata(`DB migrate: ${text}`));
+  }
+}
+
+/**
+ * @param {string|null|undefined} devMountPath
+ * @returns {Array<{ host: string, container: string }>}
+ */
+function _deployJobVolumeMounts(devMountPath) {
+  if (typeof devMountPath !== 'string' || !devMountPath.trim()) {
+    return [];
+  }
+  return [{ host: devMountPath.trim(), container: '/app' }];
+}
+
+/**
+ * Always announce the job; debug adds command/network/mount detail.
+ * @param {{ fullImage: string, cmd: string, network: string, volumeMounts: Array, debug: boolean }} params
+ */
+function _logDeployJobStart(params) {
+  logger.log(infoLine(`Running build.deployJob once before start (${params.fullImage})…`));
+  if (!params.debug) {
+    return;
+  }
+  logger.log(infoLine(`deployJob: ${params.cmd}`));
+  logger.log(infoLine(`deployJob network: ${params.network}`));
+  if (params.volumeMounts.length) {
+    logger.log(infoLine(`deployJob mount: ${params.volumeMounts[0].host} -> /app`));
+  }
+}
+
+/**
+ * @param {{ result: any, quietJob: boolean }} params
+ * @throws {Error}
+ */
+function _assertDeployJobExit(params) {
+  const code = params.quietJob ? params.result.code : params.result;
+  if (code === 0) {
+    return;
+  }
+  if (params.quietJob && params.result.output) {
+    logger.log(params.result.output.trimEnd());
+  }
+  logger.log(formatBlockingError(`build.deployJob failed with exit code ${code}`));
+  throw new Error(`build.deployJob failed with exit code ${code}`);
+}
+
+/**
+ * If build.deployJob is set, run it once in an ephemeral container (same image + env).
+ * Fail-closed on non-zero exit. No-op when unset.
+ *
+ * When `devMountPath` is set (aifabrix run --reload), bind-mount that path at `/app`
+ * so migrate/deploy sees the same tree as the long-running reload container.
+ *
+ * @async
+ * @param {Object} params
+ * @param {Object} params.appConfig - Application configuration
+ * @param {string} params.fullImage - Image:tag used for the run
+ * @param {string|null} [params.runEnvPath] - Ephemeral .env.run path for --env-file
+ * @param {string|null} [params.devMountPath] - Host path mounted at /app for --reload
+ * @param {boolean} [params.debug]
+ * @param {boolean} [params.quiet] - Unused legacy flag; quiet is default unless debug
+ * @returns {Promise<void>}
+ * @throws {Error} If deployJob exits non-zero
+ */
+async function runDeployJobIfConfigured({
+  appConfig,
+  fullImage,
+  runEnvPath = null,
+  devMountPath = null,
+  debug = false,
+  quiet = false
+}) {
+  const cmd = resolveDeployJobCommand(appConfig);
+  if (!cmd) {
+    return;
+  }
+  if (!fullImage || typeof fullImage !== 'string') {
+    throw new Error('build.deployJob requires a resolved container image');
+  }
+  const network = await resolveDeployJobNetwork();
+  const volumeMounts = _deployJobVolumeMounts(devMountPath);
+  const quietJob = shouldQuietDeployJob({ quiet, debug });
+  _logDeployJobStart({ fullImage, cmd, network, volumeMounts, debug });
+  const result = await runDockerRunEphemeral(fullImage, cmd, runEnvPath, {
+    network,
+    volumeMounts,
+    quiet: quietJob
+  });
+  _assertDeployJobExit({ result, quietJob });
+  if (quietJob && result.output) {
+    const migrateSummary = formatDeployJobMigrateSummary(result.output);
+    if (migrateSummary) {
+      logger.log(formatSuccessLine(`build.deployJob completed — ${migrateSummary}`));
+      return;
+    }
+  }
+  logger.log(formatSuccessLine('build.deployJob completed'));
+}
+
+module.exports = {
+  resolveDeployJobCommand,
+  runDeployJobIfConfigured,
+  shouldQuietDeployJob,
+  emitDeployJobSummaryLines,
+  formatDeployJobMigrateSummary,
+  summarizeDeployJobMigrateOutput
+};

package/lib/app/run-env-compose.js

@@ -315,6 +315,37 @@ async function buildMergedRunEnvAndWrite(appName, appConfig, devDir, developerId
   return { runEnvPath, runEnvAdminPath };
 }
 
+/**
+ * Rebuild run env files when another use of the shared applications directory removed them.
+ * @async
+ * @param {string} appName - Application name
+ * @param {Object} appConfig - Application configuration
+ * @param {string} runEnvPath - Expected .env.run path
+ * @param {string} runEnvAdminPath - Expected .env.run.admin path
+ * @param {number|string} developerId - Developer ID
+ * @param {Object|null} scopeOpts - Environment-scoped run options
+ * @returns {Promise<void>}
+ */
+async function ensureRunEnvFilesPresent(
+  appName,
+  appConfig,
+  runEnvPath,
+  runEnvAdminPath,
+  developerId,
+  scopeOpts = null
+) {
+  if (fsSync.existsSync(runEnvPath) && fsSync.existsSync(runEnvAdminPath)) {
+    return;
+  }
+  await buildMergedRunEnvAndWrite(
+    appName,
+    appConfig,
+    path.dirname(runEnvPath),
+    developerId,
+    scopeOpts
+  );
+}
+
 /**
  * Assert generated compose does not contain password literals in environment (ISO 27K).
  * @param {string} composeContent - Generated docker-compose content
@@ -330,6 +361,7 @@ function assertNoPasswordLiteralsInCompose(composeContent) {
 module.exports = {
   cleanApplicationsDir,
   buildMergedRunEnvAndWrite,
+  ensureRunEnvFilesPresent,
   assertNoPasswordLiteralsInCompose,
   ensureRunSecretsForApp
 };

package/lib/app/run-env-recovery.js

@@ -0,0 +1,35 @@
+/**
+ * Last-moment run env recovery for the shared applications workspace.
+ *
+ * @fileoverview Builds the callback used immediately before Docker Compose starts
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+'use strict';
+
+const runEnvCompose = require('./run-env-compose');
+
+/**
+ * Build a recovery hook for run env files in the shared workspace.
+ * @param {string} appName - Application name
+ * @param {Object} prepared - Prepared run context
+ * @returns {Function} Async recovery hook
+ */
+function buildRunEnvRecovery(appName, prepared) {
+  return () =>
+    runEnvCompose.ensureRunEnvFilesPresent(
+      appName,
+      prepared.appConfig,
+      prepared.runEnvPath,
+      prepared.runEnvAdminPath,
+      prepared.appConfig.developerId,
+      {
+        runEnvKey: prepared.mergedRunOptions.env,
+        effectiveEnvironmentScopedResources:
+          prepared.mergedRunOptions.effectiveEnvironmentScopedResources
+      }
+    );
+}
+
+module.exports = { buildRunEnvRecovery };

package/lib/app/run-helpers.js

@@ -34,7 +34,12 @@ const runEnvCompose = require('./run-env-compose');
 const { getAppInfraRequirements } = require('./run-infra-requirements');
 const { resolveRunImage } = require('./run-resolve-image');
 const { startContainer } = require('./run-container-start');
-const { resolveEnvOutputPath, writeEnvOutputForReload, writeEnvOutputForLocal } = require('../utils/env-copy');
+const {
+  resolveEnvOutputPath,
+  resolveEnvLocalOutputPath,
+  writeEnvOutputForReload,
+  writeEnvOutputForLocal
+} = require('../utils/env-copy');
 const { resolveVersionForApp } = require('../utils/image-version');
 const healthCheckUtil = require('../utils/health-check');
 const { computeTraefikPublicAppUrl } = require('../utils/health-check-url');
@@ -248,18 +253,17 @@ async function checkInfraHealthOrThrow(debug, appConfig) {
 }
 
 /**
- * Ensure dev directory exists
+ * Refresh the shared developer run directory for the current application.
+ *
+ * The applications-dev-* directory is shared by all applications. Always copy
+ * the selected app so files from a previous run cannot leak into this run.
  * @async
  * @param {string} appName - Application name
  * @param {string} developerId - Developer ID
  * @returns {Promise<string>} Dev directory path
  */
 async function ensureDevDirectory(appName, developerId) {
-  const devDir = buildCopy.getDevDirectory(appName, developerId);
-  if (!fsSync.existsSync(devDir)) {
-    await buildCopy.copyBuilderToDevDirectory(appName, developerId);
-  }
-  return devDir;
+  return buildCopy.copyBuilderToDevDirectory(appName, developerId);
 }
 
 /**
@@ -303,8 +307,8 @@ async function generateComposeFile(appName, appConfig, composeOptions, devDir, l
 
 /**
  * Writes `build.envOutputPath` after each `aifabrix run`: **local**-flavored env for the host/IDE
- * when not using `--reload`; with **`--reload`**, merges container `.env.run` into the existing file
- * (preserves resolve comments) without appending run-only keys missing from the template.
+ * when not using `--reload`; with **`--reload`**, merges container `.env.run` into `.env` and also
+ * writes a sibling **`.env.local`** with localhost / published-port URLs for host CLI and manual tests.
  *
  * @async
  * @param {string} appName - Application name
@@ -326,6 +330,8 @@ async function writeEnvOutputIfConfigured(appName, appConfig, runEnvPath, option
   }
   if (options && options.reload === true) {
     await writeEnvOutputForReload(outputPath, runEnvPath, appName);
+    const localOutputPath = resolveEnvLocalOutputPath(outputPath);
+    await writeEnvOutputForLocal(appName, localOutputPath);
   } else {
     await writeEnvOutputForLocal(appName, outputPath);
   }

package/lib/app/run.js

@@ -28,6 +28,7 @@ const helpers = require('./run-helpers');
 const { ensureReloadSync, logReloadDevSummary } = require('./run-reload-sync');
 const { logRestartDevMountSummary } = require('./restart-display');
 const { checkAndStopContainer } = require('./run-stop-containers');
+const { buildRunEnvRecovery } = require('./run-env-recovery');
 const { execWithDockerEnv } = require('../utils/docker-exec');
 const { resolveRunProxyPersistEnabled, resolveRunEffectiveNoProxy } = require('../utils/run-cli-flags');
 
@@ -178,7 +179,8 @@ async function startAppContainer(appName, tempComposePath, hostPort, appConfig,
     runEnvPath = null,
     runEnvAdminPath = null,
     runOptions = {},
-    devMountPath = null
+    devMountPath = null,
+    ensureRunEnvFiles = null
   } = opts;
   const misoEnvironment = opts.misoEnvironment ?? composeGenerator.resolveMisoEnvironment(runOptions);
   try {
@@ -188,6 +190,7 @@ async function startAppContainer(appName, tempComposePath, hostPort, appConfig,
       runEnvAdminPath,
       runOptions,
       devMountPath,
+      ensureRunEnvFiles,
       misoEnvironment
     });
     await helpers.displayRunStatus(
@@ -404,13 +407,26 @@ async function runApp(appName, options = {}) {
       logger.log(chalk.gray(`[DEBUG] Compose file generated: ${prepared.tempComposePath}`));
     }
     logReloadDevSummary(Boolean(prepared.mergedRunOptions.reload), prepared.mergedRunOptions.reloadSyncSummary);
+    const { runDeployJobIfConfigured } = require('./run-deploy-job');
+    await runDeployJobIfConfigured({
+      appConfig: prepared.appConfig,
+      fullImage: prepared.mergedRunOptions.image,
+      runEnvPath: prepared.runEnvPath,
+      devMountPath: prepared.devMountPath || null,
+      debug,
+      // Guided installers already show a top-level spinner; keep migrate/deployJob logs out of TTY.
+      quiet:
+        options.silentPoll === true || typeof options.onPollText === 'function'
+    });
+    const ensureRunEnvFiles = buildRunEnvRecovery(appName, prepared);
     await startAppContainer(appName, prepared.tempComposePath, prepared.hostPort, prepared.appConfig, {
       debug,
       runEnvPath: prepared.runEnvPath,
       runEnvAdminPath: prepared.runEnvAdminPath,
       runOptions: prepared.mergedRunOptions,
       devMountPath: prepared.devMountPath,
-      runScopeOpts: prepared.runScopeOpts
+      runScopeOpts: prepared.runScopeOpts,
+      ensureRunEnvFiles
     });
   } catch (error) {
     if (debug) {

package/lib/channels/add-channel.js

@@ -12,6 +12,7 @@ const { getChannelTarget, getDefaultChannelDescription } = require('./channel-ta
 const { resolveAppDescription } = require('./channel-description');
 const { resolveChannelRuntimeValues } = require('./channel-runtime-resolver');
 const { generateChannelArtifact } = require('./channel-artifact-generator');
+const { fetchRuntimeLayerBToolNames } = require('./runtime-tool-catalog');
 const {
   getExistingChannelExtension,
   buildChannelExtensionBlock,
@@ -66,7 +67,9 @@ function toValidationDisplay(validation) {
     callbackReachable: validation.callbackReachable,
     credentialValid: validation.credentialValid,
     assistantCatalogReachable: validation.assistantCatalogReachable,
-    inboundVerification: Object.values(validation.inboundVerification).every(Boolean)
+    inboundVerification: Object.values(validation.inboundVerification).every(Boolean),
+    probeTiers: validation.probeTiers || null,
+    runtimeChecks: validation.runtimeChecks || null
   };
 }
 
@@ -156,7 +159,13 @@ async function patchConfigWithAudit(ctx, channelTarget, channelBlock, status, ar
 async function maybeRunProbe(ctx, channelBlock, channelTarget, probe) {
   if (!probe) return null;
   const validation = await runChannelProbe(
-    { dataplaneUrl: ctx.dataplaneUrl, authConfig: ctx.authConfig },
+    {
+      dataplaneUrl: ctx.dataplaneUrl,
+      authConfig: ctx.authConfig,
+      environment: ctx.environment,
+      controllerUrl: ctx.controllerUrl,
+      channelTarget
+    },
     channelBlock
   );
   if (validation.passed) {
@@ -268,6 +277,42 @@ function finishDryRunInstall(params) {
   return { dryRun: true, channelBlock: params.channelBlock, artifact: params.artifact };
 }
 
+/**
+ * @param {Object} params
+ * @returns {Promise<{ artifact: Object, channelBlock: Object, status: string }>}
+ */
+async function buildInstallArtifacts(params) {
+  const { channelTarget, options, target, existing, name, baseName, description, ctx } = params;
+  const runtimeToolNames =
+    channelTarget === 'chatgpt' || channelTarget === 'microsoft-copilot'
+      ? await fetchRuntimeLayerBToolNames(ctx.dataplaneUrl, ctx.authConfig, channelTarget)
+      : [];
+  const runtimeValues = resolveChannelRuntimeValues({
+    dataplaneBaseUrl: ctx.dataplaneUrl,
+    channelTarget,
+    appName: name,
+    baseName,
+    environment: ctx.environment,
+    appDescription: description,
+    icon: options.icon,
+    commandPrefix: options.commandPrefix,
+    layerBToolNames: runtimeToolNames
+  });
+  const projectRoot = options.projectRoot || process.cwd();
+  const artifact = generateArtifactWithAudit(channelTarget, {
+    projectRoot,
+    channelTarget,
+    runtimeValues,
+    dryRun: options.dryRun === true
+  });
+  const status = resolveInstallStatus(target, existing, options.dryRun === true);
+  const channelBlock = buildChannelExtensionBlock(
+    { name, baseName, description, artifactHash: artifact.artifactHash, status },
+    target
+  );
+  return { artifact, channelBlock, status };
+}
+
 /**
  * @param {string} channelTarget
  * @param {Object} options
@@ -289,31 +334,17 @@ async function runAddChannel(channelTarget, options = {}) {
   });
   if (skipped) return skipped;
 
-  const runtimeValues = resolveChannelRuntimeValues({
-    dataplaneBaseUrl: ctx.dataplaneUrl,
+  const { artifact, channelBlock, status } = await buildInstallArtifacts({
     channelTarget,
-    appName: name,
+    options,
+    target,
+    existing,
+    name,
     baseName,
-    environment: ctx.environment,
-    appDescription: description,
-    icon: options.icon,
-    commandPrefix: options.commandPrefix
-  });
-
-  const projectRoot = options.projectRoot || process.cwd();
-  const artifact = generateArtifactWithAudit(channelTarget, {
-    projectRoot,
-    channelTarget,
-    runtimeValues,
-    dryRun: options.dryRun === true
+    description,
+    ctx
   });
 
-  const status = resolveInstallStatus(target, existing, options.dryRun === true);
-  const channelBlock = buildChannelExtensionBlock(
-    { name, baseName, description, artifactHash: artifact.artifactHash, status },
-    target
-  );
-
   if (options.dryRun) {
     return finishDryRunInstall({ channelTarget, name, baseName, target, artifact, channelBlock });
   }

package/lib/channels/approval-guides/chatgpt.js

@@ -16,16 +16,20 @@ const { formatCredentialPortalStep } = require('./credential-portal');
  */
 function buildChatGptApprovalGuide(ctx) {
   return {
-    portalUrl: 'https://platform.openai.com/',
+    portalUrl: 'https://chatgpt.com/',
     steps: [
-      'Sign in to OpenAI Platform (https://platform.openai.com/) or your ChatGPT Enterprise workspace admin console.',
-      'Create a custom GPT, workspace connector, or MCP integration using the generated manifest (path shown below).',
-      'Configure the OpenAPI specification URL and MCP endpoint from INSTALL.md (dataplane ChatGPT routes).',
-      'Complete OAuth or API key setup as required by your ChatGPT deployment model.',
-      formatCredentialPortalStep(ctx, 'the API key or OAuth client credentials'),
-      'Publish the connector to your workspace and complete admin approval if your org requires it.',
-      `After ChatGPT lists the connector as active, re-run: ${ctx.resumeCommand}`,
-      'Optional: add --probe when dataplane ChatGPT runtime routes are live on your environment.'
+      'Sign in to the ChatGPT web app as a workspace admin or owner.',
+      'Enable Developer mode for custom MCP apps (Business: Workspace settings → Apps, or Settings → Apps → Advanced settings; Enterprise/Edu: grant Developer mode under Permissions & roles → Connected data first).',
+      'Create a custom MCP app with the Remote MCP URL from INSTALL.md (channel-chatgpt.json is a deployment reference, not a plugin archive).',
+      'Select OAuth (authorization-code + PKCE S256). Do not configure a custom API key for a remote custom MCP app.',
+      'Scan tools, complete OAuth if prompted, review discovered Runtime Layer B tools, then save the app as a draft.',
+      formatCredentialPortalStep(
+        ctx,
+        `${ctx.credentialKey || 'channel'} credential references (not secrets to paste into ChatGPT)`
+      ),
+      'Test representative workflows, then publish the app and configure workspace access and action controls.',
+      `After ChatGPT lists the app as active, re-run: ${ctx.resumeCommand}`,
+      'Optional: use --probe for AI Fabrix-side Runtime checks; ChatGPT Scan tools / OAuth / publication remain workspace-admin responsibilities.'
     ]
   };
 }

package/lib/channels/approval-guides/microsoft-copilot.js

@@ -19,14 +19,13 @@ function buildMicrosoftCopilotApprovalGuide(ctx) {
     portalUrl: 'https://admin.cloud.microsoft.com/',
     steps: [
       'Sign in to Microsoft 365 admin (https://admin.cloud.microsoft.com/) or Copilot Studio as a tenant admin.',
-      'Create or open a Copilot extensibility project (declarative agent or API plugin).',
-      'Import or configure using the generated manifest artifact (path shown below).',
-      'Point the OpenAPI / action endpoints to the URLs in INSTALL.md (dataplane Copilot routes).',
-      'Register OAuth client credentials for the API provider connection if the platform prompts for them.',
-      formatCredentialPortalStep(ctx, 'the OAuth client ID and client secret'),
-      'Submit for M365 admin approval and publish to your organization when review completes.',
-      `After Copilot shows the extension as available, re-run: ${ctx.resumeCommand}`,
-      'Optional: add --probe when dataplane Copilot runtime routes are live on your environment.'
+      'Upload or sideload the generated appPackage.<env>.zip package artifact.',
+      'Review declarative agent + Remote MCP plugin details and approve tenant distribution.',
+      'Configure Entra/OAuth consent and user assignment for target groups.',
+      formatCredentialPortalStep(ctx, 'Copilot channel credential references (no secrets in package files)'),
+      'Verify Runtime MCP endpoint and Layer B tool visibility using INSTALL.md guidance.',
+      `After Copilot shows the package as available, re-run: ${ctx.resumeCommand}`,
+      'Optional: use --probe for AI Fabrix-side checks; tenant upload/approval remains Microsoft-admin responsibility.'
     ]
   };
 }

package/lib/channels/channel-artifact-generator.js

@@ -14,6 +14,7 @@ const path = require('path');
 const Handlebars = require('handlebars');
 const { getChannelTarget } = require('./channel-targets');
 const { BUILDER_ROOT } = require('./channel-integration-template');
+const { generateMicrosoftCopilotPackage } = require('./microsoft-copilot-package');
 
 const SECRET_PATTERNS = [/xoxb-/i, /xoxp-/i, /client_secret/i, /signing_secret/i, /Bearer\s+/i];
 const PLACEHOLDER_DOMAIN_RE = /\byour-domain\.com\b/i;
@@ -115,11 +116,22 @@ function renderInstallGuideIfPresent(templatesDir, runtimeValues, outputDir, dry
  */
 function generateChannelArtifact(params) {
   const templatesDir = getChannelTemplatesDir(params.channelTarget);
+  const outputPath = getArtifactOutputPath(params.projectRoot, params.channelTarget);
+
+  if (params.channelTarget === 'microsoft-copilot') {
+    return generateMicrosoftCopilotPackage({
+      runtimeValues: params.runtimeValues,
+      templatesDir,
+      outputPath,
+      dryRun: params.dryRun === true,
+      assertNoSecretsInArtifact,
+      renderTemplateFile
+    });
+  }
+
   const manifestTemplate = path.join(templatesDir, 'manifest.template.json.hbs');
   const content = renderTemplateFile(manifestTemplate, params.runtimeValues);
   assertNoSecretsInArtifact(content);
-
-  const outputPath = getArtifactOutputPath(params.projectRoot, params.channelTarget);
   const artifactHash = crypto.createHash('sha256').update(content, 'utf8').digest('hex');
   const outputDir = path.dirname(outputPath);
 

package/lib/channels/channel-credential.js

@@ -48,8 +48,10 @@ const CREDENTIAL_SPECS = {
     method: 'oauth2',
     credentialConfig: {
       type: 'oauth2',
-      grantType: 'client_credentials',
+      grantType: 'authorization_code',
+      authorizationUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize',
       tokenUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/token',
+      scope: 'openid profile offline_access',
       clientId: 'pending-channel-install',
       clientSecret: 'pending-channel-install'
     }