@aifabrix/builder 2.51.1 → 2.52.0

package/lib/app/run-container-start.js

@@ -141,6 +141,7 @@ async function startContainer(appName, composePath, port, appConfig = null, opts
     debug = false,
     runEnvPath = null,
     runEnvAdminPath = null,
+    ensureRunEnvFiles = null,
     runOptions = {},
     devMountPath = null,
     misoEnvironment = 'dev'
@@ -166,6 +167,9 @@ async function startContainer(appName, composePath, port, appConfig = null, opts
   }
 
   if (!usedDockerRunFallback) {
+    if (typeof ensureRunEnvFiles === 'function') {
+      await ensureRunEnvFiles();
+    }
     const env = await prepareContainerEnv(debug);
     await executeComposeUp(composeCmdBase, composePath, env, debug);
   }

package/lib/app/run-deploy-job.js

@@ -11,11 +11,16 @@ const logger = require('../utils/logger');
 const {
   infoLine,
   formatSuccessLine,
-  formatBlockingError
+  formatBlockingError,
+  metadata
 } = require('../utils/cli-test-layout-chalk');
 const { runDockerRunEphemeral } = require('../utils/docker-run-ephemeral');
 const { getInfraBridgeNetworkName } = require('../infrastructure/orphan-infra-docker-teardown');
 
+/** Migrate status lines: `[system] head=… applied=3 pending=[]` */
+const DEPLOY_JOB_STATUS_RE =
+  /^\[([^\]]+)\]\s+head=\S+\s+applied=(\d+)\s+pending=(\[[^\]]*\])/i;
+
 /**
  * Resolve trimmed deployJob from app config, or null if unset.
  * @param {Object} appConfig - Application configuration
@@ -39,6 +44,115 @@ async function resolveDeployJobNetwork() {
   return getInfraBridgeNetworkName(developerId);
 }
 
+/**
+ * Quiet docker stdio by default (hide app bootstrap warnings). Full inherit only with --debug.
+ * @param {{ quiet?: boolean, debug?: boolean }} params
+ * @returns {boolean}
+ */
+function shouldQuietDeployJob(params = {}) {
+  if (params.debug === true) {
+    return false;
+  }
+  return true;
+}
+
+/**
+ * Parse migrate CLI status lines into totals (no per-chain head/pending dump).
+ * @param {string} output
+ * @returns {{ chains: number, applied: number, pending: number }|null}
+ */
+function summarizeDeployJobMigrateOutput(output) {
+  if (typeof output !== 'string' || !output.trim()) {
+    return null;
+  }
+  let chains = 0;
+  let applied = 0;
+  let pending = 0;
+  for (const line of output.split(/\r?\n/)) {
+    const match = DEPLOY_JOB_STATUS_RE.exec(line.trim());
+    if (!match) {
+      continue;
+    }
+    chains += 1;
+    applied += Number.parseInt(match[2], 10) || 0;
+    const inner = match[3].slice(1, -1).trim();
+    if (inner) {
+      pending += inner.split(',').filter((part) => part.trim()).length;
+    }
+  }
+  if (chains === 0) {
+    return null;
+  }
+  return { chains, applied, pending };
+}
+
+/**
+ * One-line migrate totals from quiet deployJob output (replaces per-chain dump).
+ * @param {string} output
+ * @returns {string|null} Summary text for the completed line, or null
+ */
+function formatDeployJobMigrateSummary(output) {
+  const summary = summarizeDeployJobMigrateOutput(output);
+  if (!summary) {
+    return null;
+  }
+  return `${summary.applied} applied, ${summary.pending} pending (${summary.chains} chains)`;
+}
+
+/**
+ * @deprecated Prefer formatDeployJobMigrateSummary — kept for tests.
+ * @param {string} output
+ */
+function emitDeployJobSummaryLines(output) {
+  const text = formatDeployJobMigrateSummary(output);
+  if (text) {
+    logger.log(metadata(`DB migrate: ${text}`));
+  }
+}
+
+/**
+ * @param {string|null|undefined} devMountPath
+ * @returns {Array<{ host: string, container: string }>}
+ */
+function _deployJobVolumeMounts(devMountPath) {
+  if (typeof devMountPath !== 'string' || !devMountPath.trim()) {
+    return [];
+  }
+  return [{ host: devMountPath.trim(), container: '/app' }];
+}
+
+/**
+ * Always announce the job; debug adds command/network/mount detail.
+ * @param {{ fullImage: string, cmd: string, network: string, volumeMounts: Array, debug: boolean }} params
+ */
+function _logDeployJobStart(params) {
+  logger.log(infoLine(`Running build.deployJob once before start (${params.fullImage})…`));
+  if (!params.debug) {
+    return;
+  }
+  logger.log(infoLine(`deployJob: ${params.cmd}`));
+  logger.log(infoLine(`deployJob network: ${params.network}`));
+  if (params.volumeMounts.length) {
+    logger.log(infoLine(`deployJob mount: ${params.volumeMounts[0].host} -> /app`));
+  }
+}
+
+/**
+ * @param {{ result: any, quietJob: boolean }} params
+ * @throws {Error}
+ */
+function _assertDeployJobExit(params) {
+  const code = params.quietJob ? params.result.code : params.result;
+  if (code === 0) {
+    return;
+  }
+  if (params.quietJob && params.result.output) {
+    logger.log(params.result.output.trimEnd());
+  }
+  logger.log(formatBlockingError(`build.deployJob failed with exit code ${code}`));
+  throw new Error(`build.deployJob failed with exit code ${code}`);
+}
+
 /**
  * If build.deployJob is set, run it once in an ephemeral container (same image + env).
  * Fail-closed on non-zero exit. No-op when unset.
@@ -53,6 +167,7 @@ async function resolveDeployJobNetwork() {
  * @param {string|null} [params.runEnvPath] - Ephemeral .env.run path for --env-file
  * @param {string|null} [params.devMountPath] - Host path mounted at /app for --reload
  * @param {boolean} [params.debug]
+ * @param {boolean} [params.quiet] - Unused legacy flag; quiet is default unless debug
  * @returns {Promise<void>}
  * @throws {Error} If deployJob exits non-zero
  */
@@ -61,7 +176,8 @@ async function runDeployJobIfConfigured({
   fullImage,
   runEnvPath = null,
   devMountPath = null,
-  debug = false
+  debug = false,
+  quiet = false
 }) {
   const cmd = resolveDeployJobCommand(appConfig);
   if (!cmd) {
@@ -72,37 +188,29 @@ async function runDeployJobIfConfigured({
   }
   const network = await resolveDeployJobNetwork();
   const volumeMounts = _deployJobVolumeMounts(devMountPath);
-  logger.log(infoLine(`Running build.deployJob once before start (${fullImage})…`));
-  if (debug) {
-    logger.log(infoLine(`deployJob: ${cmd}`));
-    logger.log(infoLine(`deployJob network: ${network}`));
-    if (volumeMounts.length) {
-      logger.log(infoLine(`deployJob mount: ${volumeMounts[0].host} -> /app`));
-    }
-  }
-  const code = await runDockerRunEphemeral(fullImage, cmd, runEnvPath, {
+  const quietJob = shouldQuietDeployJob({ quiet, debug });
+  _logDeployJobStart({ fullImage, cmd, network, volumeMounts, debug });
+  const result = await runDockerRunEphemeral(fullImage, cmd, runEnvPath, {
     network,
-    volumeMounts
+    volumeMounts,
+    quiet: quietJob
   });
-  if (code !== 0) {
-    logger.log(formatBlockingError(`build.deployJob failed with exit code ${code}`));
-    throw new Error(`build.deployJob failed with exit code ${code}`);
+  _assertDeployJobExit({ result, quietJob });
+  if (quietJob && result.output) {
+    const migrateSummary = formatDeployJobMigrateSummary(result.output);
+    if (migrateSummary) {
+      logger.log(formatSuccessLine(`build.deployJob completed — ${migrateSummary}`));
+      return;
+    }
   }
   logger.log(formatSuccessLine('build.deployJob completed'));
 }
 
-/**
- * @param {string|null|undefined} devMountPath
- * @returns {Array<{ host: string, container: string }>}
- */
-function _deployJobVolumeMounts(devMountPath) {
-  if (typeof devMountPath !== 'string' || !devMountPath.trim()) {
-    return [];
-  }
-  return [{ host: devMountPath.trim(), container: '/app' }];
-}
-
 module.exports = {
   resolveDeployJobCommand,
-  runDeployJobIfConfigured
+  runDeployJobIfConfigured,
+  shouldQuietDeployJob,
+  emitDeployJobSummaryLines,
+  formatDeployJobMigrateSummary,
+  summarizeDeployJobMigrateOutput
 };

package/lib/app/run-env-compose.js

@@ -315,6 +315,37 @@ async function buildMergedRunEnvAndWrite(appName, appConfig, devDir, developerId
   return { runEnvPath, runEnvAdminPath };
 }
 
+/**
+ * Rebuild run env files when another use of the shared applications directory removed them.
+ * @async
+ * @param {string} appName - Application name
+ * @param {Object} appConfig - Application configuration
+ * @param {string} runEnvPath - Expected .env.run path
+ * @param {string} runEnvAdminPath - Expected .env.run.admin path
+ * @param {number|string} developerId - Developer ID
+ * @param {Object|null} scopeOpts - Environment-scoped run options
+ * @returns {Promise<void>}
+ */
+async function ensureRunEnvFilesPresent(
+  appName,
+  appConfig,
+  runEnvPath,
+  runEnvAdminPath,
+  developerId,
+  scopeOpts = null
+) {
+  if (fsSync.existsSync(runEnvPath) && fsSync.existsSync(runEnvAdminPath)) {
+    return;
+  }
+  await buildMergedRunEnvAndWrite(
+    appName,
+    appConfig,
+    path.dirname(runEnvPath),
+    developerId,
+    scopeOpts
+  );
+}
+
 /**
  * Assert generated compose does not contain password literals in environment (ISO 27K).
  * @param {string} composeContent - Generated docker-compose content
@@ -330,6 +361,7 @@ function assertNoPasswordLiteralsInCompose(composeContent) {
 module.exports = {
   cleanApplicationsDir,
   buildMergedRunEnvAndWrite,
+  ensureRunEnvFilesPresent,
   assertNoPasswordLiteralsInCompose,
   ensureRunSecretsForApp
 };

package/lib/app/run-env-recovery.js

@@ -0,0 +1,35 @@
+/**
+ * Last-moment run env recovery for the shared applications workspace.
+ *
+ * @fileoverview Builds the callback used immediately before Docker Compose starts
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+'use strict';
+
+const runEnvCompose = require('./run-env-compose');
+
+/**
+ * Build a recovery hook for run env files in the shared workspace.
+ * @param {string} appName - Application name
+ * @param {Object} prepared - Prepared run context
+ * @returns {Function} Async recovery hook
+ */
+function buildRunEnvRecovery(appName, prepared) {
+  return () =>
+    runEnvCompose.ensureRunEnvFilesPresent(
+      appName,
+      prepared.appConfig,
+      prepared.runEnvPath,
+      prepared.runEnvAdminPath,
+      prepared.appConfig.developerId,
+      {
+        runEnvKey: prepared.mergedRunOptions.env,
+        effectiveEnvironmentScopedResources:
+          prepared.mergedRunOptions.effectiveEnvironmentScopedResources
+      }
+    );
+}
+
+module.exports = { buildRunEnvRecovery };

package/lib/app/run-helpers.js

@@ -253,18 +253,17 @@ async function checkInfraHealthOrThrow(debug, appConfig) {
 }
 
 /**
- * Ensure dev directory exists
+ * Refresh the shared developer run directory for the current application.
+ *
+ * The applications-dev-* directory is shared by all applications. Always copy
+ * the selected app so files from a previous run cannot leak into this run.
  * @async
  * @param {string} appName - Application name
  * @param {string} developerId - Developer ID
  * @returns {Promise<string>} Dev directory path
  */
 async function ensureDevDirectory(appName, developerId) {
-  const devDir = buildCopy.getDevDirectory(appName, developerId);
-  if (!fsSync.existsSync(devDir)) {
-    await buildCopy.copyBuilderToDevDirectory(appName, developerId);
-  }
-  return devDir;
+  return buildCopy.copyBuilderToDevDirectory(appName, developerId);
 }
 
 /**

package/lib/app/run.js

@@ -28,6 +28,7 @@ const helpers = require('./run-helpers');
 const { ensureReloadSync, logReloadDevSummary } = require('./run-reload-sync');
 const { logRestartDevMountSummary } = require('./restart-display');
 const { checkAndStopContainer } = require('./run-stop-containers');
+const { buildRunEnvRecovery } = require('./run-env-recovery');
 const { execWithDockerEnv } = require('../utils/docker-exec');
 const { resolveRunProxyPersistEnabled, resolveRunEffectiveNoProxy } = require('../utils/run-cli-flags');
 
@@ -178,7 +179,8 @@ async function startAppContainer(appName, tempComposePath, hostPort, appConfig,
     runEnvPath = null,
     runEnvAdminPath = null,
     runOptions = {},
-    devMountPath = null
+    devMountPath = null,
+    ensureRunEnvFiles = null
   } = opts;
   const misoEnvironment = opts.misoEnvironment ?? composeGenerator.resolveMisoEnvironment(runOptions);
   try {
@@ -188,6 +190,7 @@ async function startAppContainer(appName, tempComposePath, hostPort, appConfig,
       runEnvAdminPath,
       runOptions,
       devMountPath,
+      ensureRunEnvFiles,
       misoEnvironment
     });
     await helpers.displayRunStatus(
@@ -410,15 +413,20 @@ async function runApp(appName, options = {}) {
       fullImage: prepared.mergedRunOptions.image,
       runEnvPath: prepared.runEnvPath,
       devMountPath: prepared.devMountPath || null,
-      debug
+      debug,
+      // Guided installers already show a top-level spinner; keep migrate/deployJob logs out of TTY.
+      quiet:
+        options.silentPoll === true || typeof options.onPollText === 'function'
     });
+    const ensureRunEnvFiles = buildRunEnvRecovery(appName, prepared);
     await startAppContainer(appName, prepared.tempComposePath, prepared.hostPort, prepared.appConfig, {
       debug,
       runEnvPath: prepared.runEnvPath,
       runEnvAdminPath: prepared.runEnvAdminPath,
       runOptions: prepared.mergedRunOptions,
       devMountPath: prepared.devMountPath,
-      runScopeOpts: prepared.runScopeOpts
+      runScopeOpts: prepared.runScopeOpts,
+      ensureRunEnvFiles
     });
   } catch (error) {
     if (debug) {

package/lib/channels/approval-guides/chatgpt.js

@@ -16,17 +16,20 @@ const { formatCredentialPortalStep } = require('./credential-portal');
  */
 function buildChatGptApprovalGuide(ctx) {
   return {
-    portalUrl: 'https://platform.openai.com/',
+    portalUrl: 'https://chatgpt.com/',
     steps: [
-      'Sign in to OpenAI Platform (https://platform.openai.com/) or your ChatGPT Enterprise workspace admin console.',
-      'Enable Developer mode / custom MCP app creation for the workspace (if policy requires admin allow-listing).',
-      'Create a custom MCP app using the generated channel-chatgpt.json reference artifact (path shown below).',
-      'Configure the Runtime MCP endpoint from INSTALL.md and verify Runtime Layer B tool discovery.',
-      'Complete workspace authentication setup for the custom MCP app.',
-      formatCredentialPortalStep(ctx, 'workspace credential references used by the ChatGPT channel'),
-      'Publish the app to your workspace and configure end-user access controls.',
+      'Sign in to the ChatGPT web app as a workspace admin or owner.',
+      'Enable Developer mode for custom MCP apps (Business: Workspace settings → Apps, or Settings → Apps → Advanced settings; Enterprise/Edu: grant Developer mode under Permissions & roles → Connected data first).',
+      'Create a custom MCP app with the Remote MCP URL from INSTALL.md (channel-chatgpt.json is a deployment reference, not a plugin archive).',
+      'Select OAuth (authorization-code + PKCE S256). Do not configure a custom API key for a remote custom MCP app.',
+      'Scan tools, complete OAuth if prompted, review discovered Runtime Layer B tools, then save the app as a draft.',
+      formatCredentialPortalStep(
+        ctx,
+        `${ctx.credentialKey || 'channel'} credential references (not secrets to paste into ChatGPT)`
+      ),
+      'Test representative workflows, then publish the app and configure workspace access and action controls.',
       `After ChatGPT lists the app as active, re-run: ${ctx.resumeCommand}`,
-      'Optional: use --probe for AI Fabrix-side runtime checks; OpenAI-side publication remains a manual admin responsibility.'
+      'Optional: use --probe for AI Fabrix-side Runtime checks; ChatGPT Scan tools / OAuth / publication remain workspace-admin responsibilities.'
     ]
   };
 }

package/lib/channels/channel-targets.js

@@ -113,10 +113,27 @@ function getDefaultChannelDescription() {
   );
 }
 
+/**
+ * Human-readable supported channel list for CLI help and error hints.
+ * @returns {string}
+ */
+function formatSupportedChannelTargetsHelp() {
+  const stable = CHANNEL_TARGET_KEYS.filter((key) => !CHANNEL_TARGETS[key].experimental);
+  const experimental = CHANNEL_TARGET_KEYS.filter((key) => CHANNEL_TARGETS[key].experimental);
+  const lines = ['Supported channels:', `  ${stable.join(', ')}`];
+  if (experimental.length > 0) {
+    lines.push(
+      `  ${experimental.join(', ')} (experimental — scaffold with --allow-experimental)`
+    );
+  }
+  return lines.join('\n');
+}
+
 module.exports = {
   CHANNEL_TARGETS,
   CHANNEL_TARGET_KEYS,
   isChannelTargetKey,
   getChannelTarget,
-  getDefaultChannelDescription
+  getDefaultChannelDescription,
+  formatSupportedChannelTargetsHelp
 };

package/lib/channels/chatgpt-runtime-contract.js

@@ -12,7 +12,7 @@ const RUNTIME_ORCHESTRATION_SYSTEM_KEY = 'runtime-orchestration';
 
 const CHATGPT_RUNTIME_SYSTEM_KEY = RUNTIME_ORCHESTRATION_SYSTEM_KEY;
 const CHATGPT_RUNTIME_TRANSPORT = 'streamable-http';
-const CHATGPT_RUNTIME_AUTH_MODE = 'workspace-managed-oauth-or-api-key';
+const CHATGPT_RUNTIME_AUTH_MODE = 'oauth21-authorization-code-pkce-s256';
 
 const COPILOT_RUNTIME_SYSTEM_KEY = RUNTIME_ORCHESTRATION_SYSTEM_KEY;
 const COPILOT_RUNTIME_TRANSPORT = 'streamable-http';

package/lib/cli/infra-guided-footers.js

@@ -95,7 +95,7 @@ function logPlatformSetupDurationHint(scope = 'platform') {
   const line =
     scope === 'dataplane'
       ? 'Installation may take a few minutes. Authenticating and starting Dataplane — please wait.'
-      : 'Installation may take a few minutes. Keycloak, Miso Controller, and Dataplane are starting — please wait.';
+      : 'Installation may take a few minutes. Keycloak, Miso Controller, Dataplane, and Builder API are starting — please wait.';
   logger.log(chalk.yellow(`⚠ ${line}`));
 }
 

package/lib/cli/infra-guided-public-url-warn.js

@@ -0,0 +1,55 @@
+/**
+ * @fileoverview Consolidate deferred public-URL health warnings for guided install UX.
+ */
+
+'use strict';
+
+const logger = require('../utils/logger');
+const { formatWarningLine } = require('../utils/cli-test-layout-chalk');
+
+/**
+ * @param {string} message
+ * @returns {{ kind: 'dns'|'localhost', url: string }|null}
+ */
+function extractPublicUrlFromWarning(message) {
+  const text = String(message || '');
+  const dnsMatch = text.match(/Public URL was not verified \(DNS\):\s*(\S+)/);
+  if (dnsMatch) {
+    return { kind: 'dns', url: dnsMatch[1].replace(/\.$/, '') };
+  }
+  const match = text.match(/Public URL was not verified:\s*(\S+)/);
+  if (match) {
+    return { kind: 'localhost', url: match[1].replace(/\.$/, '') };
+  }
+  return null;
+}
+
+/**
+ * Print one consolidated public-URL warning (avoid N near-duplicate lines).
+ * @param {string[]} messages
+ */
+function flushDeferredPublicUrlWarnings(messages) {
+  const list = (messages || []).filter(Boolean);
+  if (list.length === 0) {
+    return;
+  }
+  const parsed = list.map(extractPublicUrlFromWarning).filter(Boolean);
+  if (parsed.length === 0) {
+    for (const message of list) {
+      logger.log(formatWarningLine(message));
+    }
+    return;
+  }
+  const urls = [...new Set(parsed.map((row) => row.url))];
+  const hasDns = parsed.some((row) => row.kind === 'dns');
+  const urlPart = urls.length === 1 ? urls[0] : urls.join(', ');
+  const detail = hasDns
+    ? 'Hostname DNS and/or Traefik routing/TLS could not be verified; health succeeded via localhost only.'
+    : 'Health checks succeeded via localhost only. Validate Traefik routing, TLS, and DNS.';
+  logger.log(formatWarningLine(`Public URL was not verified: ${urlPart}. ${detail}`));
+}
+
+module.exports = {
+  extractPublicUrlFromWarning,
+  flushDeferredPublicUrlWarnings
+};