@aifabrix/builder 2.53.0 → 2.54.1

package/lib/commands/role-assistant-test-output.js

@@ -81,6 +81,19 @@ function mapCaseEnvelopeRow(row) {
   };
 }
 
+function attachEnvelopeIsolation(envelope, opts) {
+  const emails = Array.isArray(opts.subjectEmail)
+    ? opts.subjectEmail.map((value) => String(value || '').trim()).filter(Boolean)
+    : [];
+  const userIds = Array.isArray(opts.subjectUserId)
+    ? opts.subjectUserId.map((value) => String(value || '').trim()).filter(Boolean)
+    : [];
+  if (emails.length === 0 && userIds.length === 0) {
+    return;
+  }
+  envelope.isolation = { subjectEmails: emails, subjectUserIds: userIds };
+}
+
 function attachEnvelopeCases(envelope, caseResult) {
   if (Array.isArray(caseResult)) {
     envelope.cases = caseResult.map(mapCaseEnvelopeRow);
@@ -118,6 +131,7 @@ function buildRoleAssistantTestEnvelope(roleKey, verdict, portalUrl, result, opt
     summary: null
   };
   attachEnvelopeCases(envelope, caseResult);
+  attachEnvelopeIsolation(envelope, opts);
   if (opts.verbose || opts.debug) {
     envelope.report = report;
   }

package/lib/commands/role-assistant.js

@@ -34,6 +34,7 @@ const {
   mergeCaseExecutionIntoLifecycleResult,
   lifecycleVerdictFromCaseExecution
 } = require('../role-assistant/test-runner');
+const { assertRoleAssistantEvidencePreflight } = require('../role-assistant/test-cases-evidence');
 const { collectString } = require('./governance');
 const {
   sectionTitle,
@@ -91,8 +92,12 @@ Notes:
   - Use \`aifabrix upload <roleKey> --env …\` (or \`--publish\`) when you intentionally refresh the package.
   - Runs lifecycle checks, then prints a portal deep link for full step-by-step status.
   - Case files with input.message/input.content execute Work Hub plan→accept (or work.start when executionPath: intent).
+  - Cases with executionPath: search|skills (input.executionPath or case-root executionPath) run work.skills / work.search instead of Work Hub.
+  - Role Assistant packages do not need application.yaml; test uses device login and the published dataplane worker.
+  - Cases with preflight.evidence.requiredKeys read live Evidence from the dataplane before start and hard-stop if those keys are missing or not active.
   - answers[] and approvals[] are matched to runtime wait payloads (questionKey/requestKey/waitReason).
   - --suite runs YAML under role-assistant/ra-<roleKey>/tests/<suite>/ (preferred), or tests/ra-<roleKey>/<roleKey>/<suite>/, or legacy tests/role-assistant/ra-<roleKey>/<suite>/ (override with --cases-root).
+  - --subject-email / --subject-user-id isolate Work Hub cases (repeatable). They do not generate Connected System governance packs and do not require application.yaml.
   - Use the portal URL for detailed human review while automation reads CLI/JSON output.
 `;
 }
@@ -254,38 +259,71 @@ async function runRoleAssistantTestAction(roleKey, options, cmd) {
   return exitCode;
 }
 
-async function resolveRoleAssistantCaseResult(roleKey, opts, result, verdict, portalUrl) {
-  if (!opts.case) {
-    return null;
-  }
-  const roleCase = loadRoleAssistantTestCase(roleKey, opts.case, {
-    testsDir: opts.testsDir || null
-  });
-  if (!isExecutableRoleAssistantCase(roleCase)) {
-    return evaluateRoleAssistantTestCase(roleCase, result, verdict, portalUrl);
-  }
+function attachCaseExecution(evaluation, executionResult, error) {
+  const errMsg = error && (error.message || String(error));
+  evaluation.execution = {
+    processExecutionId: executionResult?.processExecutionId || error?.planId || null,
+    finalStatus: executionResult?.finalStatus?.status || (error ? 'failed' : null),
+    waitReason: executionResult?.finalStatus?.wait?.waitReason || null,
+    interactions: executionResult?.interactions || [],
+    workResultError: executionResult?.workResultError || errMsg || null
+  };
+  return evaluation;
+}
+
+async function resolveExecutableCaseResult(roleKey, roleCase, opts, result, verdict, portalUrl) {
   const authContext = await resolveLifecycleAuth(roleKey, {
     ...opts,
     run: false,
     noPublish: true
   });
+  const evidencePreflight = await assertRoleAssistantEvidencePreflight(roleCase, authContext);
   const executionResult = await runRoleAssistantCaseLifecycle(roleKey, roleCase, authContext, opts);
   const executionVerdict = lifecycleVerdictFromCaseExecution(executionResult, verdict);
   const evaluationInput = mergeCaseExecutionIntoLifecycleResult(result, executionResult);
+  evaluationInput.evidencePreflight = evidencePreflight;
   const evaluation = evaluateRoleAssistantTestCase(
     roleCase,
     evaluationInput,
     executionVerdict,
     portalUrl
   );
-  evaluation.execution = {
-    processExecutionId: executionResult.processExecutionId || null,
-    finalStatus: executionResult.finalStatus?.status || null,
-    waitReason: executionResult.finalStatus?.wait?.waitReason || null,
-    interactions: executionResult.interactions || [],
-    workResultError: executionResult.workResultError || null
-  };
-  return evaluation;
+  return attachCaseExecution(evaluation, executionResult);
+}
+
+async function resolveRoleAssistantCaseResult(roleKey, opts, result, verdict, portalUrl) {
+  if (!opts.case) {
+    return null;
+  }
+  const roleCase = loadRoleAssistantTestCase(roleKey, opts.case, {
+    testsDir: opts.testsDir || null
+  });
+  if (!isExecutableRoleAssistantCase(roleCase)) {
+    return evaluateRoleAssistantTestCase(roleCase, result, verdict, portalUrl);
+  }
+  try {
+    return await resolveExecutableCaseResult(
+      roleKey,
+      roleCase,
+      opts,
+      result,
+      verdict,
+      portalUrl
+    );
+  } catch (error) {
+    const failedInput = mergeCaseExecutionIntoLifecycleResult(result, {
+      finalStatus: { status: 'failed' },
+      workResult: null,
+      workResultError: error.message || String(error),
+      interactions: []
+    });
+    failedInput.workResultError = error.message || String(error);
+    return attachCaseExecution(
+      evaluateRoleAssistantTestCase(roleCase, failedInput, verdict, portalUrl),
+      null,
+      error
+    );
+  }
 }
 
 async function roleAssistantTestHandler(roleKey, options, cmd) {
@@ -332,19 +370,19 @@ function setupRoleAssistantCommands(program) {
     .option('--force', 'Force upload when --publish is set')
     .option(
       '--subject-user-id <id>',
-      'Subject user id for governance generate (repeatable)',
+      'Work Hub isolation user id (repeatable; not Connected System governance)',
       collectString,
       []
     )
     .option(
       '--subject-email <email>',
-      'Subject email for governance generate (repeatable)',
+      'Work Hub isolation email (repeatable; not Connected System governance)',
       collectString,
       []
     )
     .option(
       '--certification-profile <profile>',
-      'Certification profile for governance generate (bronze, silver, gold, ...)',
+      'Ignored for Role Assistant packages (Connected System governance generate does not run)',
       'bronze'
     )
     .option('--json', 'Machine-readable output envelope')

package/lib/commands/test-e2e-external.js

@@ -39,6 +39,99 @@ function deriveDatasourceKeyFromFileName(fileName, systemKey) {
 }
 
 /* eslint-disable max-statements -- Key resolution from system or files */
+function datasourceKeyFromParsedOrFile(parsed, fileName, systemKey) {
+  if (parsed && typeof parsed.key === 'string' && parsed.key.trim()) {
+    return parsed.key.trim();
+  }
+  return deriveDatasourceKeyFromFileName(fileName, systemKey);
+}
+
+function cipFetchSources(parsed) {
+  const ops = parsed && parsed.execution && parsed.execution.cip && parsed.execution.cip.operations;
+  if (!ops || typeof ops !== 'object') {
+    return [];
+  }
+  const sources = [];
+  for (const op of Object.values(ops)) {
+    if (!op || typeof op !== 'object') continue;
+    for (const step of op.steps || []) {
+      const src = step && step.fetch && step.fetch.source;
+      if (typeof src === 'string' && src.trim()) sources.push(src.trim());
+    }
+  }
+  return sources;
+}
+
+function isExclusiveRecordFetchSource(parsed) {
+  const sources = cipFetchSources(parsed);
+  return sources.length > 0 && sources.every((src) => src === 'record');
+}
+
+/**
+ * Maps datasource keys to E2E skip reasons (`view` / `record`) or storageType.
+ * @param {string} appPath
+ * @param {string[]} datasourceFiles
+ * @param {string} systemKey
+ * @returns {Object<string, string|undefined>}
+ */
+function loadDatasourceStorageByKey(appPath, datasourceFiles, systemKey) {
+  const byKey = {};
+  for (const fileName of datasourceFiles) {
+    const filePath = path.join(appPath, fileName);
+    if (!fs.existsSync(filePath)) continue;
+    try {
+      const parsed = loadConfigFile(filePath);
+      const key = datasourceKeyFromParsedOrFile(parsed, fileName, systemKey);
+      if (!key) continue;
+      if (parsed && parsed.storageType === 'view') byKey[key] = 'view';
+      else if (isExclusiveRecordFetchSource(parsed)) byKey[key] = 'record';
+      else byKey[key] = parsed && parsed.storageType;
+    } catch {
+      // Unreadable files stay unknown and remain eligible for E2E.
+    }
+  }
+  return byKey;
+}
+
+/**
+ * Table E2E (sync/CRUD) does not apply to viewpoint datasources.
+ * @param {string[]} keys
+ * @param {Object<string, string|undefined>} storageByKey
+ * @returns {{ runnable: string[], skipped: string[] }}
+ */
+function selectE2eRunnableKeys(keys, storageByKey) {
+  const runnable = [];
+  const skipped = [];
+  for (const key of keys) {
+    if (storageByKey[key] === 'view' || storageByKey[key] === 'record') skipped.push(key);
+    else runnable.push(key);
+  }
+  return { runnable, skipped };
+}
+
+/**
+ * Drops storageType view keys and logs skips. Empty runnable is success (nothing to run).
+ * @param {string} externalSystem
+ * @param {string} appPath
+ * @param {string[]} datasourceFiles
+ * @param {string} systemKey
+ * @param {string[]} keys
+ * @returns {string[]}
+ */
+function prepareE2eDatasourceKeys(externalSystem, appPath, datasourceFiles, systemKey, keys) {
+  const storageByKey = loadDatasourceStorageByKey(appPath, datasourceFiles, systemKey);
+  const { runnable, skipped } = selectE2eRunnableKeys(keys, storageByKey);
+  skipped.forEach((key) => {
+    const reason =
+      storageByKey[key] === 'record' ? 'fetch.source record' : 'storageType view';
+    logger.log(chalk.gray(`⏭ Skipping ${key} (${reason})`));
+  });
+  if (runnable.length === 0 && keys.length === 0) {
+    logger.log(chalk.yellow(`No datasources found for ${externalSystem}. Add datasource files and run aifabrix repair.`));
+  }
+  return runnable;
+}
+
 /**
  * Resolves the list of datasource keys for an external system (from system file or discovered files).
  * @param {string} appPath - Integration app path
@@ -117,22 +210,29 @@ async function syncLocalIfRequested(systemKey, options) {
   return uploadCtx && uploadCtx.dataplaneUrl && uploadCtx.authConfig ? uploadCtx : null;
 }
 
-/* eslint-disable max-lines-per-function, max-statements -- Load context, then loop over keys */
-/**
- * Runs E2E for all datasources of an external system. Uses each datasource's payloadTemplate (no extra params required).
- *
- * @async
- * @param {string} externalSystem - System key (e.g. hubspot-demo)
- * @param {Object} options - Options passed to each runDatasourceTestE2E
- * @param {string} [options.env] - Environment (dev, tst, pro)
- * @param {boolean} [options.debug] - Include debug, write log
- * @param {boolean} [options.verbose] - Verbose output
- * @param {boolean} [options.async] - If false, sync mode (default true)
- * @param {boolean} [options.noPublish] - When true, skip upload (E2E uses dataplane config already deployed)
- * @returns {Promise<{ success: boolean, results: Array<{ key: string, success: boolean, error?: string }> }>}
- */
+function isPlatformShellAppPath(appPath) {
+  const parent = path.basename(path.dirname(path.resolve(String(appPath || ''))));
+  return parent === 'role-assistant' || parent === 'enterprise-knowledge';
+}
+
+function platformShellIntegrationContext(systemKey, appPath) {
+  return { systemKey, keys: [], appPath, datasourceFiles: [] };
+}
+
+function tryApplicationConfigPath(appPath) {
+  try {
+    return resolveApplicationConfigPath(appPath);
+  } catch (error) {
+    if (isPlatformShellAppPath(appPath)) {
+      return null;
+    }
+    throw error;
+  }
+}
+
 /**
  * Resolve integration folder, system key, and datasource keys for system-level tests.
+ * Role Assistant / Enterprise Knowledge packages have no application.yaml.
  * @param {string} externalSystem
  * @returns {{ systemKey: string, keys: string[] }}
  */
@@ -144,13 +244,19 @@ function resolveExternalIntegrationContext(externalSystem, pathOptions = {}) {
   if (!fs.existsSync(appPath)) {
     throw new Error(`Integration path not found: ${appPath}`);
   }
-  const configPath = resolveApplicationConfigPath(appPath);
+  const configPath = tryApplicationConfigPath(appPath);
+  if (!configPath) {
+    return platformShellIntegrationContext(externalSystem, appPath);
+  }
   let variables = {};
   if (fs.existsSync(configPath)) {
     variables = loadConfigFile(configPath);
   }
   const { systemFiles, datasourceFiles: discovered } = discoverIntegrationFiles(appPath);
   if (systemFiles.length === 0) {
+    if (isPlatformShellAppPath(appPath)) {
+      return platformShellIntegrationContext(externalSystem, appPath);
+    }
     throw new Error(`No system file found in ${appPath}. Expected *-system.yaml or *-system.json`);
   }
   const datasourceFiles = buildEffectiveDatasourceFiles(
@@ -171,13 +277,33 @@ function resolveExternalIntegrationContext(externalSystem, pathOptions = {}) {
     systemParsed,
     datasourceFiles
   );
-  return { systemKey, keys };
+  return { systemKey, keys, appPath, datasourceFiles };
 }
 
+/* eslint-disable max-lines-per-function, max-statements -- Load context, then loop over keys */
+/**
+ * Runs E2E for all datasources of an external system. Uses each datasource's payloadTemplate (no extra params required).
+ *
+ * @async
+ * @param {string} externalSystem - System key (e.g. hubspot-demo)
+ * @param {Object} options - Options passed to each runDatasourceTestE2E
+ * @param {string} [options.env] - Environment (dev, tst, pro)
+ * @param {boolean} [options.debug] - Include debug, write log
+ * @param {boolean} [options.verbose] - Verbose output
+ * @param {boolean} [options.async] - If false, sync mode (default true)
+ * @param {boolean} [options.noPublish] - When true, skip upload (E2E uses dataplane config already deployed)
+ * @returns {Promise<{ success: boolean, results: Array<{ key: string, success: boolean, error?: string }> }>}
+ */
 async function runTestE2EForExternalSystem(externalSystem, options = {}) {
-  const { systemKey, keys } = resolveExternalIntegrationContext(externalSystem);
-  if (keys.length === 0) {
-    logger.log(chalk.yellow(`No datasources found for ${externalSystem}. Add datasource files and run aifabrix repair.`));
+  const { systemKey, keys, appPath, datasourceFiles } = resolveExternalIntegrationContext(externalSystem);
+  const e2eKeys = prepareE2eDatasourceKeys(
+    externalSystem,
+    appPath,
+    datasourceFiles,
+    systemKey,
+    keys
+  );
+  if (e2eKeys.length === 0) {
     return { success: true, results: [] };
   }
 
@@ -217,12 +343,12 @@ async function runTestE2EForExternalSystem(externalSystem, options = {}) {
     quietPollUi: options.quietPollUi === true,
     onPollProgress: options.onPollProgress
   };
-  for (const key of keys) {
+  for (const key of e2eKeys) {
     if (typeof options.onDatasourceProgress === 'function') {
       options.onDatasourceProgress({
         key,
         index: results.length,
-        total: keys.length
+        total: e2eKeys.length
       });
     }
     try {
@@ -246,6 +372,7 @@ async function runTestE2EForExternalSystem(externalSystem, options = {}) {
 module.exports = {
   runTestE2EForExternalSystem,
   getDatasourceKeys,
+  selectE2eRunnableKeys,
   resolveExternalIntegrationContext,
   syncLocalIfRequested
 };

package/lib/commands/upload-credential-push-log.js

@@ -91,7 +91,8 @@ async function pushAndLogCredentialSecrets(dataplaneUrl, authConfig, systemKey,
       pushCredentialSecrets(dataplaneUrl, authConfig, {
         envFilePath,
         appName: systemKey,
-        payload
+        payload,
+        excludeKeys: uiOpts.excludeSecretKeys
       }),
     { systemKey, json: uiOpts.json === true }
   );

package/lib/commands/upload-publish-context.js

@@ -57,7 +57,7 @@ async function resolveUploadPublishContext(
     environment: options.environment
   });
   requireBearerForDataplanePipeline(resolved.authConfig);
-  if (options.force === true) {
+  if (options.force === true && options.suppressSummary !== true) {
     logForcePublishWarning();
   }
   const controllerUrl = await resolveControllerUrl();

package/lib/commands/upload-role-assistant-shell.js

@@ -0,0 +1,124 @@
+/**
+ * Role Assistant upload without Connected System files.
+ *
+ * @fileoverview Settings + Evidence path for role-assistant/ packages
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('../utils/logger');
+const { detectAppType } = require('../utils/paths');
+const { isRoleAssistantWorkspace } = require('../utils/platform-shell-package');
+const {
+  SYSTEM_KIND_DIGITAL_WORKER,
+  readRoleAssistantSettings,
+  resolveRoleAssistantSettingsVersion,
+  resolveRoleAssistantEnvironmentSettings
+} = require('../role-assistant/settings');
+const { validateExternalSystemComplete } = require('../validation/validate');
+const { displayValidationResults } = require('../validation/validate-display');
+const { formatSuccessLine } = require('../utils/cli-test-layout-chalk');
+const { runUploadSidecarFollowups } = require('./upload-sidecar-followups');
+const { finalizeUploadPublishResult } = require('./upload-data-sync-finalize');
+
+async function isRoleAssistantShellPackage(systemKey, options = {}) {
+  const pathOptions = options.pathOptions || {};
+  const detected = await detectAppType(systemKey, pathOptions);
+  return isRoleAssistantWorkspace(detected.baseDir);
+}
+
+function buildRoleAssistantShellPayload(systemKey, options = {}) {
+  const pathOptions = options.pathOptions || {};
+  const settings = readRoleAssistantSettings(systemKey, { required: true, pathOptions });
+  resolveRoleAssistantEnvironmentSettings(settings, options.env || 'dev', { required: true });
+  const version = resolveRoleAssistantSettingsVersion(settings) || '1.0.0';
+  return {
+    version,
+    application: {
+      key: systemKey,
+      systemKind: SYSTEM_KIND_DIGITAL_WORKER
+    },
+    dataSources: [],
+    status: options.uploadStatus === 'published' ? 'published' : 'draft'
+  };
+}
+
+function assertRoleAssistantShellValid(validationResult) {
+  if (validationResult && validationResult.valid) {
+    return;
+  }
+  displayValidationResults(validationResult);
+  const errors = (validationResult && validationResult.errors) || [];
+  const summary = errors.slice(0, 3).map((item) => (typeof item === 'string' ? item : String(item))).join('; ');
+  throw new Error(
+    summary
+      ? `Validation failed: ${summary}. Fix errors above and run the command again.`
+      : 'Validation failed. Fix errors before uploading.'
+  );
+}
+
+async function validateRoleAssistantShellPackage(systemKey, options = {}) {
+  const pathOptions = options.pathOptions || {};
+  const validationResult = await validateExternalSystemComplete(systemKey, {
+    type: 'external',
+    ...pathOptions
+  });
+  assertRoleAssistantShellValid(validationResult);
+  if (options.minimal !== true) {
+    logger.log(formatSuccessLine('Local validation passed'));
+  }
+}
+
+function logRoleAssistantShellDryRun(systemKey, payload) {
+  logger.log(
+    chalk.yellow(
+      'Dry run: would apply Role Assistant settings and Evidence (no Connected System publish).'
+    )
+  );
+  logger.log(chalk.gray(`  System: ${systemKey}, version: ${payload.version}`));
+}
+
+async function applyRoleAssistantShellSidecars(systemKey, options, payload, deps) {
+  const { dataplaneUrl, authConfig, environment } = await deps.resolveDataplaneAndAuth(
+    systemKey,
+    options
+  );
+  const sidecar = await runUploadSidecarFollowups({
+    systemKey,
+    options: { ...options, skipDataSync: true },
+    payload,
+    dataplaneUrl,
+    authConfig,
+    environment
+  });
+  if (options.suppressSummary !== true && options.minimal !== true) {
+    logger.log(
+      formatSuccessLine('Role Assistant settings and Evidence applied (no Connected System publish).')
+    );
+  }
+  return finalizeUploadPublishResult(
+    { dataplaneUrl, authConfig, environment, uploadSkipped: true, sidecar },
+    payload,
+    options
+  );
+}
+
+async function uploadRoleAssistantShellPackage(systemKey, options = {}, deps = {}) {
+  if (!deps.resolveDataplaneAndAuth) {
+    throw new Error('Role Assistant upload requires dataplane auth resolution');
+  }
+  await validateRoleAssistantShellPackage(systemKey, options);
+  const payload = buildRoleAssistantShellPayload(systemKey, options);
+  if (options.dryRun === true) {
+    logRoleAssistantShellDryRun(systemKey, payload);
+    return undefined;
+  }
+  return applyRoleAssistantShellSidecars(systemKey, options, payload, deps);
+}
+
+module.exports = {
+  isRoleAssistantShellPackage,
+  buildRoleAssistantShellPayload,
+  uploadRoleAssistantShellPackage
+};

package/lib/commands/upload-sidecar-followups.js

@@ -38,11 +38,14 @@ function buildRoleAssistantSyncContext(ctx, model) {
 
 async function runGovernanceSidecar(ctx, sidecar, quietSidecar) {
   try {
-    const { uploadGovernanceScenarioPacks } = require('../lifecycle/scenario-upload');
-    const uploaded = await uploadGovernanceScenarioPacks(ctx.systemKey, ctx.dataplaneUrl, ctx.authConfig, {
+    const {
+      uploadGovernanceScenarioPacks,
+      normalizeGovernanceUploadResult
+    } = require('../lifecycle/scenario-upload');
+    const result = await uploadGovernanceScenarioPacks(ctx.systemKey, ctx.dataplaneUrl, ctx.authConfig, {
       silent: quietSidecar
     });
-    sidecar.governance = { uploaded: Number(uploaded || 0) };
+    sidecar.governance = normalizeGovernanceUploadResult(result);
   } catch (err) {
     sidecar.governance = { skipped: true, reason: err.message || String(err) };
     if (!quietSidecar) {

package/lib/commands/upload.js

@@ -44,6 +44,7 @@ const { maybeSyncOpenApiFilesForMcp } = require('./repair-openapi-sync');
 const { exportProgrammaticOpenApiForRepair } = require('./repair-openapi-export');
 const { resolveUploadPublishContext } = require('./upload-publish-context');
 const { syncDeployJsonFromSources } = require('../external-system/sync-deploy-manifest');
+const { assertUploadPackageIdentity } = require('../external-system/upload-identity');
 const { handlePublicationAndFollowups } = require('./upload-sidecar-followups');
 const { finalizeUploadPublishResult, finishUnchangedUploadPublication } = require('./upload-data-sync-finalize');
 const { pushAndLogCredentialSecrets } = require('./upload-credential-push-log');
@@ -53,6 +54,10 @@ const {
   resolveRoleAssistantSettingsVersion,
   resolveRoleAssistantEnvironmentSettings
 } = require('../role-assistant/settings');
+const {
+  isRoleAssistantShellPackage,
+  uploadRoleAssistantShellPackage
+} = require('./upload-role-assistant-shell');
 
 /**
  * Validates system-key format (same as download).
@@ -149,7 +154,10 @@ async function runUploadValidatePublish(
     { timeoutMs: options.timeoutMs }
   );
   if (res?.success === false) {
-    throw new Error(formatApiError(res, dataplaneUrl));
+    const err = new Error(formatApiError(res, dataplaneUrl));
+    const status = Number(res.status || res.statusCode);
+    err.statusCode = status >= 400 && status < 600 ? status : 400;
+    throw err;
   }
   return res;
 }
@@ -256,6 +264,7 @@ async function buildValidatedUploadManifestPayload(systemKey, opts = {}) {
     }
   }
   await resolvePayloadConfiguration(systemKey, payload, pathOptions);
+  assertUploadPackageIdentity(payload, systemKey);
   return { manifest, payload };
 }
 
@@ -312,7 +321,8 @@ async function completeUploadAfterPublish(systemKey, options, manifest, payload,
   const pushMeta = await pushAndLogCredentialSecrets(ctx.dataplaneUrl, ctx.authConfig, systemKey, payload, {
     json: options.json === true,
     pathOptions: options.pathOptions,
-    suppressCredentialLog: quietCompact
+    suppressCredentialLog: quietCompact,
+    excludeSecretKeys: options.excludeSecretKeys
   });
   await logAndSyncLocalOpenApiForUpload(systemKey, manifest, {
     dataplaneUrl: ctx.dataplaneUrl,
@@ -417,7 +427,12 @@ async function uploadExternalSystem(systemKey, options = {}) {
       : options.minimal === false
         ? false
         : options.verbose !== true;
-  const uploadOptions = { ...options, minimal };
+  const uploadOptions = { ...options, minimal, pathOptions };
+  if (await isRoleAssistantShellPackage(systemKey, uploadOptions)) {
+    return uploadRoleAssistantShellPackage(systemKey, uploadOptions, {
+      resolveDataplaneAndAuth
+    });
+  }
   if (!minimal) {
     logger.log('');
     logger.log(sectionTitle('Upload external system'));

package/lib/core/secrets-docker-env.js

@@ -10,7 +10,7 @@ const fs = require('fs');
 const yaml = require('js-yaml');
 const config = require('./config');
 const { getEnvHosts } = require('../utils/env-endpoints');
-const { getContainerPortFromPath } = require('../utils/port-resolver');
+const { getContainerPortFromPath, isExternalAppPath } = require('../utils/port-resolver');
 
 /**
  * Gets base docker environment config
@@ -69,6 +69,9 @@ function getContainerPortFromDockerEnv(dockerEnv) {
  * @returns {Promise<string>} Updated content with PORT set
  */
 async function updatePortForDocker(resolved, variablesPath) {
+  if (isExternalAppPath(variablesPath)) {
+    return resolved;
+  }
   let dockerEnv = await getBaseDockerEnv();
   dockerEnv = applyDockerEnvOverride(dockerEnv);