@aifabrix/builder 2.54.1 → 2.55.2

package/lib/channels/slack-mcp-runtime.js

@@ -0,0 +1,156 @@
+/**
+ * Slackbot MCP Client packaging (opt-in). Auth freeze: manual_auth.
+ *
+ * @fileoverview Slack MCP manifest fields from discovery; HMAC path stays default
+ */
+
+'use strict';
+
+const SLACK_MCP_AUTH_TYPE = 'manual_auth';
+const SLACK_MCP_AUTH_PROVIDER_KEY = 'mcp_aifabrix';
+const SLACK_MCP_SERVER_KEY = 'runtime-orchestration';
+const SLACK_MCP_CALLBACK_URI = 'https://oauth2.slack.com/external/auth/callback';
+const SLACK_MCP_OAUTH_SCOPES = ['openid', 'profile', 'email', 'offline_access'];
+const SLACK_MCP_CAPABILITY = 'customerOAuth';
+const SLACK_MCP_MISSING_URL = 'Runtime MCP URL is missing.';
+
+/**
+ * @param {string} [controllerUrl]
+ * @param {string} [mcpUrl]
+ * @param {string} [dataplaneBaseUrl]
+ * @returns {string}
+ */
+function authorizationServerBase(controllerUrl, mcpUrl, dataplaneBaseUrl) {
+  const candidate = controllerUrl || mcpUrl || dataplaneBaseUrl;
+  try {
+    return `${new URL(candidate).origin}/auth/realms/aifabrix`;
+  } catch {
+    return '';
+  }
+}
+
+/**
+ * @param {string} asBase
+ * @returns {{ authorizationUrl: string, tokenUrl: string }}
+ */
+function keycloakEndpoints(asBase) {
+  if (!asBase) {
+    return { authorizationUrl: '', tokenUrl: '' };
+  }
+  return {
+    authorizationUrl: `${asBase}/protocol/openid-connect/auth`,
+    tokenUrl: `${asBase}/protocol/openid-connect/token`
+  };
+}
+
+/**
+ * @param {Object} resolved
+ * @returns {void}
+ */
+function clearSlackMcpPackaging(resolved) {
+  resolved.slackMcpAuthType = '';
+  resolved.slackMcpAuthProviderKey = '';
+  resolved.slackMcpCallbackUri = '';
+  resolved.slackMcpCapability = '';
+  resolved.slackMcpServersJson = '';
+  resolved.slackExternalAuthJson = '';
+}
+
+/**
+ * @param {Object} resolved
+ * @returns {boolean}
+ */
+function selectsCustomerOAuth(resolved) {
+  const caps = resolved.discoveryAuthenticationCapabilities;
+  if (!Array.isArray(caps) || caps.length === 0) {
+    return true;
+  }
+  return caps.includes(SLACK_MCP_CAPABILITY);
+}
+
+/**
+ * @param {Object} resolved
+ * @param {Object} params
+ * @param {string} mcpUrl
+ * @returns {Object}
+ */
+function buildExternalAuthProviders(resolved, params, mcpUrl) {
+  const asBase = authorizationServerBase(
+    params && params.controllerUrl,
+    mcpUrl,
+    resolved.dataplaneBaseUrl
+  );
+  const endpoints = keycloakEndpoints(asBase);
+  const provider = {
+    authorization_url: endpoints.authorizationUrl,
+    token_url: endpoints.tokenUrl,
+    scope: SLACK_MCP_OAUTH_SCOPES,
+    use_pkce: true,
+    identity_config: null
+  };
+  const clientId =
+    typeof resolved.slackMcpClientId === 'string' ? resolved.slackMcpClientId.trim() : '';
+  if (clientId) {
+    provider.client_id = clientId;
+  }
+  return { oauth2: { [SLACK_MCP_AUTH_PROVIDER_KEY]: provider } };
+}
+
+/**
+ * @param {Object} resolved
+ * @param {Object} [params]
+ * @returns {void}
+ */
+function applySlackMcpRuntimeValues(resolved, params) {
+  if (!resolved.enableMcpServer) {
+    clearSlackMcpPackaging(resolved);
+    return;
+  }
+  const mcpUrl = typeof resolved.mcpUrl === 'string' ? resolved.mcpUrl.trim() : '';
+  if (!mcpUrl) {
+    throw new Error(SLACK_MCP_MISSING_URL);
+  }
+  if (!selectsCustomerOAuth(resolved)) {
+    throw new Error('Slack MCP requires customerOAuth on Runtime discovery.');
+  }
+  resolved.slackMcpAuthType = SLACK_MCP_AUTH_TYPE;
+  resolved.slackMcpAuthProviderKey = SLACK_MCP_AUTH_PROVIDER_KEY;
+  resolved.slackMcpCallbackUri = SLACK_MCP_CALLBACK_URI;
+  resolved.slackMcpCapability = SLACK_MCP_CAPABILITY;
+  resolved.slackMcpServersJson = JSON.stringify({
+    [SLACK_MCP_SERVER_KEY]: {
+      url: mcpUrl,
+      auth_type: SLACK_MCP_AUTH_TYPE,
+      auth_provider_key: SLACK_MCP_AUTH_PROVIDER_KEY
+    }
+  });
+  resolved.slackExternalAuthJson = JSON.stringify(
+    buildExternalAuthProviders(resolved, params || {}, mcpUrl)
+  );
+}
+
+/**
+ * @param {Object} [runtimeValues]
+ * @returns {string[]}
+ */
+function slackMcpRemainingSteps(runtimeValues) {
+  if (!runtimeValues || !runtimeValues.enableMcpServer) {
+    return [];
+  }
+  return [
+    'Connect the AI Fabrix MCP server in Slack',
+    'Complete sign-in at AI Fabrix when Slack asks'
+  ];
+}
+
+module.exports = {
+  SLACK_MCP_AUTH_TYPE,
+  SLACK_MCP_AUTH_PROVIDER_KEY,
+  SLACK_MCP_SERVER_KEY,
+  SLACK_MCP_CALLBACK_URI,
+  SLACK_MCP_OAUTH_SCOPES,
+  SLACK_MCP_CAPABILITY,
+  SLACK_MCP_MISSING_URL,
+  applySlackMcpRuntimeValues,
+  slackMcpRemainingSteps
+};

package/lib/channels/slack-provisioning/install-cli.js

@@ -179,6 +179,19 @@ function fetchHttpsText(url, redirects = 0) {
   });
 }
 
+/**
+ * Drop Node's version footer; prefer an Error: line when present.
+ * @param {string} text
+ * @returns {string}
+ */
+function lastUsefulInstallLine(text) {
+  const lines = text.split('\n').map((line) => line.trim()).filter(Boolean);
+  const withoutNode = lines.filter((line) => !/^Node\.js v\d/i.test(line));
+  const pool = withoutNode.length ? withoutNode : lines;
+  const errorLine = [...pool].reverse().find((line) => /^Error:/i.test(line));
+  return errorLine || pool[pool.length - 1] || '';
+}
+
 /**
  * Prefer child stderr over Node's "Command failed: bash /tmp/…" wrapper.
  * @param {unknown} error
@@ -190,8 +203,7 @@ function slackCliInstallFailureMessage(error) {
   const raw = error && error.message ? String(error.message) : '';
   const fromChild = stderr || stdout;
   if (fromChild) {
-    const lines = fromChild.split('\n').map((line) => line.trim()).filter(Boolean);
-    return lines[lines.length - 1] || fromChild;
+    return lastUsefulInstallLine(fromChild) || fromChild;
   }
   const stripped = raw.replace(/^Command failed: bash \S+\s*/i, '').trim();
   return stripped || 'Slack CLI install failed.';

package/lib/channels/slack-provisioning/with-curl-on-path.js

@@ -22,7 +22,12 @@ async function curlExists(env) {
 }
 
 function writeCurlShim(dir) {
-  const runtime = path.join(__dirname, 'curl-shim.js');
+  const source = path.join(__dirname, 'curl-shim.js');
+  if (!fs.existsSync(source)) {
+    throw new Error(`Slack CLI curl shim missing: ${source}`);
+  }
+  const runtime = path.join(dir, 'curl-shim.js');
+  fs.copyFileSync(source, runtime);
   const wrapper = `#!/bin/sh\nexec "${process.execPath}" "${runtime}" "$@"\n`;
   fs.writeFileSync(path.join(dir, 'curl'), wrapper, { mode: 0o755 });
 }

package/lib/cli/index.js

@@ -25,9 +25,11 @@ const { setupDimensionCommands } = require('../commands/dimension');
 const { setupResourceTypeCommands } = require('../commands/resource-type');
 const { setupRoleCommands } = require('../commands/role');
 const { setupRoleAssistantCommands } = require('../commands/role-assistant');
+const { setupSearchCommands } = require('../commands/search');
 const { setupEvidenceKindCommands } = require('../commands/evidence-kind');
 const { setupEnterpriseKnowledgeCommands } = require('../commands/enterprise-knowledge');
 const { setupIdentityCommands } = require('../commands/identity');
+const { setupAgentKitCommands } = require('../commands/agent-kit');
 const { setupProtectionCommands } = require('../commands/protection');
 const { setupEvidenceCommands } = require('../commands/evidence');
 const { setupCredentialDeploymentCommands } = require('./setup-credential-deployment');
@@ -80,9 +82,11 @@ function setupExtendedCliCommands(program) {
   setupResourceTypeCommands(program);
   setupRoleCommands(program);
   setupRoleAssistantCommands(program);
+  setupSearchCommands(program);
   setupEvidenceKindCommands(program);
   setupEnterpriseKnowledgeCommands(program);
   setupIdentityCommands(program);
+  setupAgentKitCommands(program);
   setupProtectionCommands(program);
   setupEvidenceCommands(program);
   setupUtilityCommands(program);

package/lib/cli/setup-app.js

@@ -39,6 +39,10 @@ Examples:
   $ aifabrix deploy myapp
   $ aifabrix deploy myapp --local
 
+  # Missing local app that matches a shipped template (TTY asks to create)
+  $ aifabrix deploy dataplane
+  $ aifabrix deploy dataplane --yes
+
   # Local — external system (integration/<systemKey>/); manifest regenerated on deploy
   $ aifabrix deploy hubspot-demo
   $ aifabrix deploy hubspot-demo --local
@@ -69,6 +73,7 @@ Notes:
   - Default output is a compact status card; use -v for expanded preflight and readiness detail.
   - Controller deploy always polls to a terminal status (no --poll / --no-poll on this command).
   - --repository-url overrides repo URL for pipeline validate (default: application.yaml repository.repositoryUrl).
+  - If the app is missing locally and the name matches a shipped template, TTY asks to create it (use --yes in scripts).
 `;
 
 const PUSH_HELP_AFTER = `
@@ -367,6 +372,7 @@ function setupDeployCommand(program) {
       '--subject-email <emails>',
       'Subject email(s) for governance gate (comma-separated; used with --gate governance|full)'
     )
+    .option('-y, --yes', 'Create a missing app from a matching shipped template without prompting')
     .action(async(appName, options) => {
       try {
         const probeTimeout =
@@ -381,8 +387,9 @@ function setupDeployCommand(program) {
         };
         const outcome = await app.deployApp(appName, opts);
         if (opts.local && outcome) {
+          const targetApp = outcome.appKey || appName;
           if (outcome.usedExternalDeploy) await app.restartApp('dataplane');
-          else await app.runApp(appName, opts);
+          else await app.runApp(targetApp, opts);
         }
       } catch (error) {
         handleCommandError(error, 'deploy');

package/lib/cli/setup-auth.js

@@ -17,7 +17,12 @@ const { handleAuthConfig } = require('../commands/auth-config');
 const LOGIN_HELP_AFTER = `
 Examples:
   $ aifabrix login
+  $ aifabrix login -c https://controller.example.com
   $ aifabrix login -m credentials -a myapp -e dev
+
+Notes:
+  - Public controller URLs are stored as origin + /miso (extra path segments are ignored).
+  - Localhost URLs keep the origin unless the path is already /miso.
 `;
 
 const AUTH_HELP_AFTER = `
@@ -34,12 +39,15 @@ Subcommand: auth status [--validate] for CI/scripts (exit codes 0/1/3).
 const LOGOUT_HELP_AFTER = `
 Examples:
   $ aifabrix logout
+  $ aifabrix logout --type client
+  $ aifabrix logout --type device
   $ aifabrix logout -c http://localhost:3600
   $ aifabrix logout -e dev
   $ aifabrix logout -e dev -a hubspot-e2e
 
 Notes:
   - With no flags: clears all device tokens and all client tokens in config.yaml.
+  - Use --type client or --type device to clear only that token type.
   - Device tokens are keyed by controller URL (-c).
   - Client tokens are per environment and app (-e and optional -a).
   - Run aifabrix auth status to list stored app tokens and copy-paste logout commands.
@@ -164,7 +172,7 @@ function setupLoginCommand(program) {
   program.command('login')
     .description('Sign in to Miso Controller (device or credentials flow)')
     .addHelpText('after', LOGIN_HELP_AFTER)
-    .option('-c, --controller <url>', 'Controller URL (default: from config or developer ID, e.g. http://localhost:3000)')
+    .option('-c, --controller <url>', 'Controller URL (public hosts use origin + /miso; default: config or localhost by developer ID)')
     .option('-m, --method <method>', 'Authentication method (device|credentials)', 'device')
     .option('-a, --app <app>', 'Application name (required for credentials method, reads from secrets.local.yaml)')
     .option('--client-id <id>', 'Client ID (for credentials method, overrides secrets.local.yaml)')
@@ -188,7 +196,8 @@ function setupLoginCommand(program) {
 
 function setupLogoutCommand(program) {
   program.command('logout')
-    .description('Clear stored tokens (optional filter by controller/env/app)')
+    .description('Clear stored tokens (optional filter by type/controller/env/app)')
+    .option('-t, --type <type>', 'Clear only one token type (device|client)')
     .option('-c, --controller <url>', 'Clear device tokens for specific controller')
     .option('-e, --environment <env>', 'Clear client tokens for specific environment')
     .option('-a, --app <app>', 'Clear client tokens for specific app (requires --environment)')

package/lib/cli/setup-certification-commands.js

@@ -20,7 +20,7 @@ function setupVerifyOperationsCommand(program) {
     .option('-e, --env <env>', 'Environment: dev, tst, or pro', 'dev')
     .option('-v, --verbose', 'Readiness breakdown and verification step checklist')
     .option('-d, --debug', 'Write debug logs under integration/<systemKey>/logs/')
-    .option('--no-publish', 'Skip publishing local integration files before dataplane steps')
+    .option('--no-publish', 'Skip uploading local files (verify-operations does not upload by default)')
     .option(
       '--force',
       'With default sync, pass force to upload (same as aifabrix upload --force)'
@@ -39,7 +39,7 @@ function setupVerifyTrustCommand(program) {
     .option('-e, --env <env>', 'Environment: dev, tst, or pro', 'dev')
     .option('-v, --verbose', 'Per-datasource breakdown')
     .option('-d, --debug', 'Write debug log under integration/<systemKey>/logs/')
-    .option('--no-publish', 'Skip publishing local integration files before validate')
+    .option('--no-publish', 'Skip uploading local files (verify-trust does not upload by default)')
     .option(
       '--force',
       'With default sync, pass force to upload (same as aifabrix upload --force)'

package/lib/cli/setup-certification.help.js

@@ -12,6 +12,8 @@ Examples:
 
 Notes:
   - Orchestrates validate → test → test-integration → test-e2e for the system.
+  - Does not upload. Upload is not publish; run aifabrix deploy to publish.
+  - Static custom packages (syncBridge disabled) skip live E2E (not FAILED).
   - Default output shows Operational Readiness % and OPERATIONS VERIFIED/FAILED only.
   - -v / --verbose adds readiness breakdown and verification step checklist at the end.
   - -v does not enable upload sidecar logs or inner E2E poll spinners (use aifabrix upload -v for upload detail).
@@ -28,7 +30,7 @@ Examples:
 Notes:
   - For one datasource: aifabrix datasource verify-trust <datasourceKey>
   - Does not call external vendor APIs (use verify-operations / test-e2e for connectivity).
-  - Local integration files are published before run unless --no-publish.
+  - Does not upload. Upload is not publish; run aifabrix deploy to publish.
 `;
 
 const VERIFY_GOVERNANCE_HELP_AFTER = `

package/lib/commands/agent-kit-help.js

@@ -0,0 +1,149 @@
+/**
+ * Help text for `aifabrix agent-kit` leaves.
+ * @fileoverview Per-command examples so update -h is not install-centric
+ */
+
+'use strict';
+
+const HOST_OPTION_HELP =
+  'Coding hosts to activate: all, cursor, claude, or codex (one name = that host only)';
+
+const APPROVE_ALL_OPTION_HELP =
+  'Auto-approve tools for all, claude, or codex (omit value = every selected host)';
+
+const GROUP_HELP = `
+Coding hosts (--host) are Cursor, Claude Code, and/or Codex in this workspace.
+GitHub remotes are a separate command (agent-kit remote create).
+
+Examples:
+  $ aifabrix agent-kit init cust-demo --host all --approve-all --yes
+  $ aifabrix agent-kit install --host claude --approve-all --yes
+  $ aifabrix agent-kit install --host all --approve-all claude --yes
+  $ aifabrix agent-kit update --host all --approve-all --yes
+  $ aifabrix agent-kit remote create --org my-org --yes
+  $ aifabrix agent-kit start claude --remote-control --approve-all --yes
+  $ aifabrix agent-kit start claude --name aifabrix-docs --remote-control --approve-all --yes
+  $ aifabrix agent-kit start codex --approve-all --yes
+  $ aifabrix agent-kit status
+  $ aifabrix agent-kit validate
+`;
+
+const INSTALL_HELP = `
+--host chooses which coding apps this repo supports (default all).
+Use one name to activate only that host. --approve-all [claude|codex] writes
+auto-approve configs for that host's tools only.
+
+Examples:
+  $ aifabrix agent-kit install
+  $ aifabrix agent-kit install --host all --approve-all --yes
+  $ aifabrix agent-kit install --host claude --approve-all --yes
+  $ aifabrix agent-kit install --host codex --approve-all --yes
+  $ aifabrix agent-kit install --host all --approve-all claude --yes
+  $ aifabrix agent-kit install --skip-approve-all
+  $ aifabrix agent-kit install --dry-run
+
+TTY asks which hosts to support (omit --host) and which tools to auto-approve.
+Silent: --host <name> --approve-all [claude|codex] --yes. Skip: --skip-approve-all.
+Start without installing skills: aifabrix agent-kit start claude
+`;
+
+const STATUS_HELP = `
+Examples:
+  $ aifabrix agent-kit status
+  $ aifabrix agent-kit status --json
+`;
+
+const UPDATE_HELP = `
+Examples:
+  $ aifabrix agent-kit update
+  $ aifabrix agent-kit update --host all --approve-all --yes
+  $ aifabrix agent-kit update --host claude --force
+  $ aifabrix agent-kit update --host all --approve-all claude --yes
+  $ aifabrix agent-kit update --dry-run
+
+Omit --host to keep the coding hosts already recorded. Pass --host claude or
+--host codex to activate only that host. --approve-all claude writes Claude
+Code tool auto-approve only.
+`;
+
+const VALIDATE_HELP = `
+Examples:
+  $ aifabrix agent-kit validate
+  $ aifabrix agent-kit validate --json
+`;
+
+const INIT_HELP = `
+--host chooses Cursor, Claude Code, and/or Codex for the new workspace.
+GitHub (origin + push) is --remote / agent-kit remote create — not --host.
+
+Examples:
+  $ aifabrix agent-kit init cust-demo
+  $ aifabrix agent-kit init cust-demo --host all --approve-all --yes
+  $ aifabrix agent-kit init cust-demo --host claude --approve-all --yes
+  $ aifabrix agent-kit init cust-demo --host all --approve-all claude --yes
+  $ aifabrix agent-kit init cust-demo --host all --remote --org my-org --yes
+  $ aifabrix agent-kit init ./path/to/cust-demo --dry-run --json
+
+Interactive (TTY): omit --host / --yes to be prompted.
+Silent local: --host all --approve-all --yes
+Silent one host: --host claude --approve-all --yes
+Silent remote: --host all --remote --org <owner> --yes
+`;
+
+const REMOTE_GROUP_HELP = `
+This is GitHub only: create origin and push this workspace.
+It does not choose Cursor, Claude Code, or Codex.
+
+Examples:
+  $ aifabrix agent-kit remote create
+  $ aifabrix agent-kit remote create --org my-org --yes
+  $ aifabrix agent-kit install --host claude --approve-all --yes
+  $ aifabrix agent-kit install --host codex --approve-all --yes
+  $ aifabrix agent-kit install --host all --approve-all claude --yes
+`;
+
+const REMOTE_HELP = `
+Creates a GitHub repository (origin) and pushes this workspace.
+Not coding-host selection — use --host on install/update for Claude or Codex.
+
+Examples:
+  $ cd cust-demo && aifabrix agent-kit remote create
+  $ aifabrix agent-kit remote create --org my-org --yes
+  $ aifabrix agent-kit remote create --org my-org --dry-run --json
+
+Interactive (TTY): omit flags to be prompted. Silent: --org <owner> --yes
+`;
+
+const START_HELP = `
+Does not install Agent Kit skills. Starts claude or codex in tmux in this git
+workspace so closing the terminal does not kill the session. Detach: Ctrl-b then
+d. --approve-all writes that app's local permission config only. --name is the
+tmux session (default: last folder, e.g. aifabrix-docs). Claude also gets
+--name and --remote-control hostname-user-folder, e.g.
+builder01-dev03-aifabrix-docs. Claude --tmux is for worktrees, not this wrapper.
+That is not Claude --cloud (a separate cloud VM). Codex has no phone/web attach.
+
+Examples:
+  $ aifabrix agent-kit start claude --remote-control --approve-all --yes
+  $ aifabrix agent-kit start claude --name aifabrix-docs --remote-control --approve-all --yes
+  $ aifabrix agent-kit start claude --name aifabrix-miso --remote-control --approve-all --yes
+  $ aifabrix agent-kit start claude --remote-control --detach
+  $ aifabrix agent-kit start claude
+  $ aifabrix agent-kit start claude --approve-all --yes
+  $ aifabrix agent-kit start codex --approve-all --yes
+  $ aifabrix agent-kit start claude --dry-run --json
+`;
+
+module.exports = {
+  HOST_OPTION_HELP,
+  APPROVE_ALL_OPTION_HELP,
+  GROUP_HELP,
+  INSTALL_HELP,
+  STATUS_HELP,
+  UPDATE_HELP,
+  VALIDATE_HELP,
+  INIT_HELP,
+  REMOTE_GROUP_HELP,
+  REMOTE_HELP,
+  START_HELP
+};