@aifabrix/builder 2.55.0 → 2.55.2

package/lib/utils/error-formatters/error-parser.js

@@ -177,6 +177,21 @@ function handleGenericError(errorData, statusCode) {
   return createErrorResult('generic', errorData.message || errorData.error || 'Unknown error', formatGenericError(errorData, statusCode), errorData);
 }
 
+function unwrapNestedErrorData(errorData) {
+  if (!errorData || !errorData.data || typeof errorData.data !== 'object') {
+    return errorData;
+  }
+  const nested = errorData.data;
+  return {
+    ...nested,
+    cliPermissionService: errorData.cliPermissionService || nested.cliPermissionService,
+    requiredPermissions: errorData.requiredPermissions || nested.requiredPermissions,
+    method: errorData.method || nested.method,
+    url: nested.instance || nested.url || errorData.url,
+    instance: nested.instance || errorData.instance
+  };
+}
+
 /**
  * Parses error response and determines error type
  * @param {string|Object} errorResponse - Error response (string or parsed JSON)
@@ -200,7 +215,7 @@ function parseErrorResponse(errorResponse, statusCode, isNetworkError) {
 
   // Handle nested response structure (some APIs wrap errors in data field)
   if (errorData.data && typeof errorData.data === 'object') {
-    errorData = errorData.data;
+    errorData = unwrapNestedErrorData(errorData);
   }
 
   // Handle network errors

package/lib/utils/error-formatters/permission-errors.js

@@ -42,6 +42,9 @@ function extractRequiredPermissions(errorData) {
   if (errorData.requiredPermissions && Array.isArray(errorData.requiredPermissions)) {
     return errorData.requiredPermissions;
   }
+  if (typeof errorData.requiredPermission === 'string' && errorData.requiredPermission.trim()) {
+    return [errorData.requiredPermission.trim()];
+  }
   if (errorData.required && errorData.required.permissions && Array.isArray(errorData.required.permissions)) {
     return errorData.required.permissions;
   }
@@ -97,6 +100,19 @@ function getPermissionDetailLines(errorData) {
   return lines;
 }
 
+function appendPermissionAssignHint(lines, errorData) {
+  const service = errorData.cliPermissionService;
+  if (service) {
+    lines.push(chalk.gray(`Required on: ${service}`));
+  }
+  lines.push(chalk.gray(
+    service
+      ? `Assign this permission on the ${service} for this environment (roles and groups).`
+      : 'Assign the required permission on the Controller or Dataplane for this environment (roles and groups).'
+  ));
+  lines.push('');
+}
+
 /**
  * Formats permission error with missing and required permissions
  * @param {Object} errorData - Error response data
@@ -111,11 +127,9 @@ function formatPermissionError(errorData) {
     lines.push('');
   }
 
-  const missingPerms = extractMissingPermissions(errorData);
-  addPermissionList(lines, missingPerms, 'Missing permissions');
-
-  const requiredPerms = extractRequiredPermissions(errorData);
-  addPermissionList(lines, requiredPerms, 'Required permissions');
+  addPermissionList(lines, extractMissingPermissions(errorData), 'Missing permissions');
+  addPermissionList(lines, extractRequiredPermissions(errorData), 'Required permissions');
+  appendPermissionAssignHint(lines, errorData);
 
   const requestUrl = errorData.instance || errorData.url;
   const method = errorData.method || 'POST';

package/lib/utils/keycloak-realm-ready.js

@@ -82,15 +82,18 @@ async function waitForKeycloakRealmReady(opts = {}) {
   const directUrl = directBase ? buildRealmWellKnownUrl(directBase) : null;
   const deadline = Date.now() + timeoutSeconds * 1000;
 
-  while (Date.now() < deadline) {
+  do {
     if (await probeRealmWellKnown(url)) {
       return;
     }
     if (directUrl && (await probeRealmWellKnown(directUrl))) {
       return;
     }
+    if (Date.now() >= deadline) {
+      break;
+    }
     await new Promise((resolve) => setTimeout(resolve, intervalMs));
-  }
+  } while (Date.now() < deadline);
 
   throw new Error(
     `Keycloak realm "aifabrix" was not ready within ${timeoutSeconds}s (checked ${url}${directUrl ? ` and ${directUrl}` : ''}). ` +

package/lib/utils/logger.js

@@ -83,4 +83,5 @@ const logger = {
 };
 
 module.exports = logger;
+module.exports.sanitizeValue = sanitizeValue;
 

package/lib/utils/paths.js

@@ -957,6 +957,24 @@ async function ensureShippedBuilderAppTemplate(appName) {
   return true;
 }
 
+/**
+ * Finds an existing local app workspace without copying shipped templates.
+ *
+ * @param {string} appName - Application name
+ * @param {Object} [options] - Detection options (reserved; options.type is ignored)
+ * @returns {{isExternal: boolean, appPath: string, appType: string, baseDir?: string}|null}
+ */
+function findExistingAppType(appName, options = {}) {
+  if (!appName || typeof appName !== 'string') {
+    return null;
+  }
+  const externalResult = checkExternalWorkspaceFolder(appName, options);
+  if (externalResult) {
+    return externalResult;
+  }
+  return checkBuilderFolder(appName);
+}
+
 /**
  * Detects if an app is external type by checking application config.
  * Resolution order: integration/ first, then builder/; if neither exists, throws.
@@ -971,13 +989,15 @@ async function detectAppType(appName, options = {}) {
   if (!appName || typeof appName !== 'string') {
     throw new Error('App name is required and must be a string');
   }
-  const externalResult = checkExternalWorkspaceFolder(appName, options);
-  if (externalResult) return externalResult;
-  const builderResult = checkBuilderFolder(appName);
-  if (builderResult) return builderResult;
+  const existing = findExistingAppType(appName, options);
+  if (existing) {
+    return existing;
+  }
   await ensureShippedBuilderAppTemplate(appName);
   const builderAfterTemplate = checkBuilderFolder(appName);
-  if (builderAfterTemplate) return builderAfterTemplate;
+  if (builderAfterTemplate) {
+    return builderAfterTemplate;
+  }
   throw new Error(
     `App '${appName}' not found in integration/${appName}, enterprise-knowledge/${appName}, role-assistant/${appName}, or builder/${appName}`
   );
@@ -1121,6 +1141,7 @@ module.exports = {
   resolveApplicationConfigPath,
   resolveRbacPath,
   ensureShippedBuilderAppTemplate,
+  findExistingAppType,
   detectAppType,
   getResolveAppPath,
   resolveIntegrationAppKeyFromCwd,

package/lib/utils/secrets-helpers.js

@@ -47,7 +47,8 @@ const { resolveBashKvFromProcessEnv } = require('./secrets-bash-kv');
 const EMPTY_ALLOWED_KV_FALLBACK = new Set([
   'redis-passwordKeyVault',
   'azure-openaiapi-urlKeyVault',
-  'secrets-azureOpenaiApiKeyVault'
+  'secrets-azureOpenaiApiKeyVault',
+  'miso-controller-secrets-apiKeyVault'
 ]);
 
 /**
@@ -486,4 +487,3 @@ module.exports = {
   rewriteInfraEndpoints,
   getEnvHosts
 };
-

package/lib/utils/write-stream-and-wait.js

@@ -0,0 +1,63 @@
+/**
+ * Flush a writable stream chunk without hanging on Jest write mocks.
+ *
+ * @fileoverview Shared stdout/stderr write + wait for CLI exits.
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+/**
+ * @param {unknown} writeFn - Stream write implementation
+ * @returns {boolean}
+ */
+function isJestMockWrite(writeFn) {
+  return typeof jest !== 'undefined'
+    && typeof jest.isMockFunction === 'function'
+    && jest.isMockFunction(writeFn);
+}
+
+/**
+ * Write `chunk` and resolve after the stream flushes.
+ *
+ * Piped stdout/stderr on Linux is asynchronous; exiting before the write
+ * callback can truncate output. Jest spies that ignore the callback, and
+ * native writes inside a Jest worker, must not hang the test.
+ *
+ * @param {NodeJS.WritableStream} stream - stdout or stderr
+ * @param {string} chunk - Bytes to write
+ * @returns {Promise<void>}
+ */
+function writeStreamAndWait(stream, chunk) {
+  return new Promise(resolve => {
+    let settled = false;
+    const finish = () => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      resolve();
+    };
+    if (!stream || typeof stream.write !== 'function') {
+      finish();
+      return;
+    }
+    const writeFn = stream.write;
+    try {
+      writeFn.call(stream, chunk, finish);
+    } catch {
+      finish();
+      return;
+    }
+    if (isJestMockWrite(writeFn) && writeFn.length < 2) {
+      finish();
+      return;
+    }
+    if (!isJestMockWrite(writeFn) && process.env.JEST_WORKER_ID) {
+      setImmediate(finish);
+    }
+  });
+}
+
+module.exports = { writeStreamAndWait };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aifabrix/builder",
-  "version": "2.55.0",
+  "version": "2.55.2",
   "description": "AI Fabrix Builder — CLI and developer scripts (pnpm + af)",
   "main": "lib/index.js",
   "bin": {
@@ -86,28 +86,42 @@
   "overrides": {
     "@babel/core": "^7.29.7",
     "@babel/plugin-transform-modules-systemjs": "^7.29.7",
-    "fast-uri": "^4.1.0",
+    "baseline-browser-mapping": "^2.11.21",
+    "brace-expansion@5": "5.0.9",
+    "browserslist": "^4.28.9",
+    "fast-uri": "^4.1.4",
     "flatted": "^3.4.2",
     "follow-redirects": "^1.16.0",
     "form-data": "^4.0.6",
+    "js-yaml@3": "3.15.2",
+    "js-yaml@5": "5.4.1",
     "lodash": "^4.18.1",
     "minimatch": "^10.2.5",
+    "multer": "^2.3.0",
     "picomatch": "^4.0.5",
-    "qs": "^6.15.3"
+    "qs": "^6.16.0",
+    "smol-toml": "^1.8.0"
   },
   "pnpm": {
     "overrides": {
       "@bcoe/v8-coverage": "^1.0.2",
       "@babel/core": "^7.29.7",
       "@babel/plugin-transform-modules-systemjs": "^7.29.7",
-      "fast-uri": "^4.1.0",
+      "baseline-browser-mapping": "^2.11.21",
+      "brace-expansion@5": "5.0.9",
+      "browserslist": "^4.28.9",
+      "fast-uri": "^4.1.4",
       "flatted": "^3.4.2",
       "follow-redirects": "^1.16.0",
       "form-data": "^4.0.6",
+      "js-yaml@3": "3.15.2",
+      "js-yaml@5": "5.4.1",
       "lodash": "^4.18.1",
       "minimatch": "^10.2.5",
+      "multer": "^2.3.0",
       "picomatch": "^4.0.5",
-      "qs": "^6.15.3"
+      "qs": "^6.16.0",
+      "smol-toml": "^1.8.0"
     }
   },
   "dependencies": {
@@ -121,7 +135,7 @@
     "handlebars": "^4.7.9",
     "inquirer": "^8.2.5",
     "inquirer-autocomplete-prompt": "^2.0.0",
-    "js-yaml": "^4.3.0",
+    "js-yaml": "^4.3.2",
     "ora": "^5.4.1",
     "yaml": "^2.9.0"
   },

package/templates/agent-kit/agent-kit.yaml

@@ -1,5 +1,5 @@
 schemaVersion: "1"
-kitVersion: "1.1.1"
+kitVersion: "1.1.2"
 minimumBuilderVersion: "2.54.2"
 skills:
   - aifabrix-plan

package/templates/agent-kit/instructions/AGENTKIT.md

@@ -34,7 +34,7 @@ New workspace instead of an existing repo: `aifabrix agent-kit init <workspaceNa
 Install the coding app, then sign in. How to **run** it locally or over SSH is in `.agents/skills/shared/hosts.md` (linked from every Agent Kit skill).
 {{#if autoApprove}}
 
-On TTY, install **asks** to auto-approve tool permissions **in this workspace**. Claude Code also allows `Bash(aifabrix *)` (delivery CLI) and `Read(~/**)` (home Read). Silent (`--yes` / non-TTY) writes them; `--skip-approve-all` skips.
+On TTY, install **asks** which hosts to support (omit `--host`) and which tools to auto-approve. `--approve-all claude` or `--approve-all codex` writes only that host's config. Claude Code also allows `Bash(aifabrix *)` (delivery CLI) and `Read(~/**)` (home Read). Silent (`--yes` / non-TTY) writes them; `--skip-approve-all` skips.
 {{#if claude}}
 - Claude Code writes `.claude/settings.local.json` (gitignored).
 {{/if}}
@@ -57,22 +57,43 @@ curl -fsSL https://claude.ai/install.sh | bash
 claude auth login
 ```
 
-Skills: same `/aifabrix-*` names. First `claude` must run inside this workspace, not your home directory.
+**Run in tmux** from this workspace so closing the terminal does not kill Claude. `--remote-control` is the **same** session on this PC, [claude.ai/code](https://claude.ai/code), and the Claude mobile app (Code). That is not `claude --cloud` (a separate cloud VM). Claude `--tmux` is for worktrees only.
+
+```bash
+aifabrix agent-kit start claude --remote-control --approve-all --yes
+```
+
+tmux session name defaults to this folder. Remote Control name is `hostname-user-folder` (for example `builder01-dev03-aifabrix-docs`). Override the folder with `--name`. Detach: `Ctrl-b` then `d`. Reattach: `tmux attach -t <folder>`. Several workspaces can run at once. Same account on phone and PC (`claude auth login`, Pro/Max/Team — not an API key). On the phone: Claude app → **Code**. Skills: `/aifabrix-plan` (and the other `/aifabrix-*` names). First `claude` must run inside this workspace, not your home directory. Full notes: `.agents/skills/shared/hosts.md`.
 {{/if}}
 {{#if codex}}
 
 ### Codex
 
-Install the Codex CLI, then sign in with your Codex account. Skills: `$aifabrix-plan` (and the other `$aifabrix-*` names). Codex reads `AGENTS.md`.
+Install the Codex CLI (`@openai/codex`, not the unrelated `codex` package), then sign in with ChatGPT (Plus, Pro, Business, Edu, or Enterprise):
+
+```bash
+npm install -g @openai/codex
+codex login
+```
+
+**Run in tmux** from this workspace so the session stays if you close the terminal:
+
+```bash
+aifabrix agent-kit start codex --approve-all --yes
+```
+
+Detach: `Ctrl-b` then `d`. Reattach: `tmux attach -t <folder>`, or `aifabrix agent-kit start codex` from this workspace. Default session name is this folder. Skills: `$aifabrix-plan` (and the other `$aifabrix-*` names). Codex reads `AGENTS.md`. Full notes: `.agents/skills/shared/hosts.md`.
 {{/if}}
 
 ## Auth for delivery CLI
 
+Do not tell the user to open a terminal for Builder login. Follow `.agents/skills/shared/login.md`.
+
 ```bash
 aifabrix auth status
 ```
 
-If still unauthenticated, run `aifabrix login` (the agent cannot log in for you).
+If that is not authenticated, ask for the Miso Controller URL, run device login, and paste the printed authenticate URL into chat.
 
 ## How to start
 

package/templates/agent-kit/instructions/root.AGENTS.md

@@ -28,7 +28,7 @@ Do not collapse these into a generic success boolean. Do not start the next life
 ## Coding hosts
 
 Cursor, Claude Code, and Codex — local machine or SSH (tmux, Claude Remote Control): `.agents/skills/shared/hosts.md`.
-Install and sign-in: `AGENTKIT.md`.
+Install and sign-in: `AGENTKIT.md`. Builder CLI login from chat: `.agents/skills/shared/login.md`.
 
 ## Docs
 

package/templates/agent-kit/skills/aifabrix-connected-system/SKILL.md

@@ -24,6 +24,7 @@ Stop at the phase gate. Do not run the next phase without `next-yes`
 
 Read current CLI help before composing commands. You own orchestration, not CLI implementation.
 Host runtimes (local vs SSH): [hosts.md](../shared/hosts.md).
+CLI login from chat: [login.md](../shared/login.md).
 
 ## Always
 
@@ -31,7 +32,7 @@ Host runtimes (local vs SSH): [hosts.md](../shared/hosts.md).
 aifabrix auth status
 ```
 
-Refresh first. User runs `aifabrix login` only if still unauthenticated. Re-run on 401, then retry once.
+Refresh first. If still unauthenticated, follow [login.md](../shared/login.md). Re-run on 401, then retry once.
 
 System key: argument → active plan → sole `integration/` folder → ask once. Never invent. Reject `ra-` / `ek-` ([scripts/reserved-system-key.js](scripts/reserved-system-key.js)).
 

package/templates/agent-kit/skills/aifabrix-connected-system/references/delivery-gates.md

@@ -41,7 +41,7 @@ Never mark live E2E pass when it did not run.
 
 ## Identity and protection order
 
-1. `aifabrix auth status`
+1. `aifabrix auth status` — if unauthenticated, [login.md](../../shared/login.md)
 2. Catalog roles + fixtures + `identity apply` / `identity sync` / `role set-groups`
 3. Load partitioned fixtures
 4. `aifabrix protection upload <sourceStorageDs> --sync` (storage DS, not the view)

package/templates/agent-kit/skills/aifabrix-plan/SKILL.md

@@ -15,6 +15,7 @@ Output: one delivery plan from [plan-template.md](references/plan-template.md).
 Score completeness with [challenge-checklist.md](references/challenge-checklist.md).
 Next-step interaction: [interaction.md](references/interaction.md).
 Host runtimes (local vs SSH): [hosts.md](../shared/hosts.md).
+CLI login from chat: [login.md](../shared/login.md).
 
 ## Sequence
 
@@ -44,7 +45,7 @@ aifabrix auth status
 aifabrix role list --page-size 1000
 ```
 
-If still unauthenticated after refresh, draft the plan; catalog-role rows stay MISSING until the user runs `aifabrix login`.
+If unauthenticated after refresh, follow [login.md](../shared/login.md) before listing catalog roles.
 
 ## Trigger examples
 

package/templates/agent-kit/skills/aifabrix-prove/SKILL.md

@@ -19,6 +19,7 @@ Evidence rules: [evidence-lifecycle.md](references/evidence-lifecycle.md).
 Demo shape: [demo-template.md](references/demo-template.md).
 Next-step: [interaction.md](../aifabrix-plan/references/interaction.md).
 Host runtimes (local vs SSH): [hosts.md](../shared/hosts.md).
+CLI login from chat: [login.md](../shared/login.md).
 
 ## Keys
 

package/templates/agent-kit/skills/aifabrix-role-assistant/SKILL.md

@@ -10,6 +10,7 @@ description: >
 
 See [package-boundary.md](references/package-boundary.md) and nested `role-assistant/AGENTS.md`.
 Host runtimes (local vs SSH): [hosts.md](../shared/hosts.md).
+CLI login from chat: [login.md](../shared/login.md).
 
 ## Preconditions
 

package/templates/agent-kit/skills/shared/hosts.md

@@ -2,7 +2,7 @@
 
 Use this workspace from **Cursor**, **Claude Code**, and **Codex**. Skills live in `.agents/skills/`. Invoke `/aifabrix-*` in Cursor and Claude Code, and `$aifabrix-*` in Codex.
 
-Install and sign-in steps are in `AGENTKIT.md`. This file is how to **run** each host on a local machine or over SSH.
+Install and sign-in steps are in `AGENTKIT.md`. This file is how to **run** each host on a local machine or over SSH. Builder CLI login from chat: [login.md](login.md).
 
 Do not start Claude or Codex in your home directory. `cd` into this git workspace first.
 
@@ -13,7 +13,7 @@ Do not start Claude or Codex in your home directory. `cd` into this git workspac
 - Claude Code: `.claude/settings.local.json` (`permissions.defaultMode` = `bypassPermissions`, `allow` = `Bash(aifabrix *)` and `Read(~/**)`)
 - Codex: `.codex/config.toml` (`approval_policy = "never"`, `sandbox_mode = "workspace-write"`)
 
-Those files stay in **this workspace**. Claude may **read** files under the developer home (`Read(~/**)`) and run the delivery CLI (`Bash(aifabrix *)`). They do not add sibling folders as extra workspaces, do not grant Write outside this repo, and do not allow every shell command. TTY asks (default yes). `--yes` or a non-TTY / `--json` run writes them. `--skip-approve-all` skips. `--force` overwrites existing local files. Builder never writes `~/.claude` or `~/.codex`.
+Those files stay in **this workspace**. Claude may **read** files under the developer home (`Read(~/**)`) and run the delivery CLI (`Bash(aifabrix *)`). They do not add sibling folders as extra workspaces, do not grant Write outside this repo, and do not allow every shell command. TTY asks which host to auto-approve when both are selected. `--approve-all claude` or `--approve-all codex` writes only that host. `--yes` or a non-TTY / `--json` run writes them. `--skip-approve-all` skips. `--force` overwrites existing local files. Builder never writes `~/.claude` or `~/.codex`.
 
 ## Cursor
 
@@ -23,48 +23,35 @@ Those files stay in **this workspace**. Claude may **read** files under the deve
 
 ## Claude Code
 
-**Local.**
+**Local or SSH — tmux.** Closing the terminal must not kill Claude. Agent Kit starts Claude **inside tmux**. `--remote-control` is the **same** session on this PC, [claude.ai/code](https://claude.ai/code), and the Claude mobile app (**Code**). Do not use `claude --cloud` for this — that starts a different machine that clones GitHub. Claude `--tmux` is only for `--worktree` sessions, not this wrapper.
 
 ```bash
-cd /path/to/this-workspace
-claude
-```
-
-Then `/aifabrix-plan` (or another `/aifabrix-*` skill). First run in a project asks you to trust the folder; accept only this workspace.
-
-**SSH (keep the session after you disconnect).** tmux holds the process on the remote machine:
-
-```bash
-tmux new -s claude -c /path/to/this-workspace
-claude --remote-control
+aifabrix agent-kit start claude --remote-control --approve-all --yes
 ```
 
-Detach without killing Claude: `Ctrl-b` then `d`. Reattach: `tmux attach -t claude`.
+tmux session name is this folder (for example `aifabrix-docs`). Remote Control name is `hostname-user-folder` (for example `builder01-dev03-aifabrix-docs`). `--name` overrides the folder. Several workspaces can run at once. Detach without killing Claude: `Ctrl-b` then `d`. Reattach: `tmux attach -t aifabrix-docs`, or run `start` again from the same folder. Then `/aifabrix-plan` (or another `/aifabrix-*` skill). First run in a project asks you to trust the folder; accept only this workspace.
 
-**Phone and web.** `--remote-control` (or `claude remote-control` in server mode) publishes the same session to [claude.ai/code](https://claude.ai/code) and the Claude mobile app (**Code**). Press space in server mode for a QR code. In an interactive session, `/remote-control` or `/mobile`. Requires a Claude Pro/Max/Team login (`claude auth login`), not an API key.
+**Phone and PC.** Sign in with the same Claude Pro/Max/Team account (`claude auth login` — not an API key). After Remote Control starts, open **Code** in the Claude mobile app and/or [claude.ai/code](https://claude.ai/code) on the PC. In an already-running session, `/remote-control` or `/mobile`.
 
-Closing SSH does not stop a tmux session. Stopping tmux or the machine does.
+Closing the terminal (or SSH) does not stop a tmux session. Stopping tmux or the machine does. Remote Control also stops if this host goes down.
 
 ## Codex
 
-**Local.**
+**Local or SSH — tmux (recommended).** Same recipe on your PC and on a remote host. tmux keeps Codex running if you close the terminal or disconnect SSH. Codex has no Claude-style phone/web Remote Control.
 
 ```bash
-cd /path/to/this-workspace
-codex
+aifabrix agent-kit start codex --approve-all --yes
 ```
 
-Then `$aifabrix-plan` (and the other `$aifabrix-*` skills). Codex reads `AGENTS.md`.
+Equivalent: `tmux new -s aifabrix-docs -c /path/to/this-workspace` then `codex`. Default `--name` is the last folder. If that session already exists, `start` attaches. Detach: `Ctrl-b` then `d`. Then `$aifabrix-plan` (and the other `$aifabrix-*` skills). Codex reads `AGENTS.md`.
 
-**SSH (keep the session after you disconnect).**
+**Foreground only (no tmux).**
 
 ```bash
-tmux new -s codex -c /path/to/this-workspace
+cd /path/to/this-workspace
 codex
 ```
 
-Detach: `Ctrl-b` then `d`. Reattach: `tmux attach -t codex`. Codex has no Claude-style phone/web Remote Control; stay in tmux (or reattach later) to see the session.
-
 ## tmux cheat sheet
 
 | Action | Keys / command |
@@ -75,4 +62,4 @@ Detach: `Ctrl-b` then `d`. Reattach: `tmux attach -t codex`. Codex has no Claude
 | Attach | `tmux attach -t <name>` |
 | Kill session | `tmux kill-session -t <name>` |
 
-Use separate session names (`claude` vs `codex`) if both run on the same host.
+Use a different `--name` per workspace so several Claude or Codex sessions can run on the same host. Claude and Codex in the **same** folder also need two names.

package/templates/agent-kit/skills/shared/login.md

@@ -0,0 +1,16 @@
+# Delivery CLI login (no terminal)
+
+Before any online Builder command (`deploy`, `upload`, `role list`, `show --online`):
+
+1. Run `aifabrix auth status`. If authenticated, continue.
+2. If not, ask the user in chat for the Miso Controller URL. Do not invent it. Paste whatever they give you; extra path segments are ignored.
+3. Run (environment **dev** unless they named another):
+
+```bash
+aifabrix login --method device -c <url> -e dev
+```
+
+4. As soon as the command prints **Open this URL to authenticate:**, copy that full URL into chat and ask the user to open it and approve. Do not ask them to use a terminal.
+5. Leave the login command running until it reports success (or fails). Then run `aifabrix auth status` again.
+
+On 401 later, repeat this flow once, then retry the original command.

package/templates/agent-kit/workspace/README.md

@@ -9,7 +9,7 @@ Vendor limits, credentials, designated test subjects, and PII live only in each
 ## How to start
 
 1. Open **this folder** in Cursor, Claude Code, or Codex. Host install and sign-in: **[AGENTKIT.md](./AGENTKIT.md)**.
-2. In a terminal here, run `aifabrix auth status`. If you are not authenticated, run `aifabrix login` (the agent cannot log in for you).
+2. The agent checks `aifabrix auth status`. If you are not signed in, it asks for the Miso Controller URL and gives you a browser link. You do not need a terminal. Details: **[AGENTKIT.md](./AGENTKIT.md)**.
 3. In chat, either **invoke a skill** or **paste a prompt** from the tables below. Work in order. Wait for the gate (`PLAN_READY`, `READY`, `BUILT`, then `PASS` or `PASS_WITH_SKIPS`) before the next step.
 
 ### How to use prompts

package/templates/applications/dataplane/application.yaml

@@ -5,7 +5,7 @@ app:
   description: "AI Fabrix Dataplane is a secure, in-tenant integration and automation layer that supplies governed, normalized, and explainable enterprise data to AI agents. Using CIP as a declarative standard, it enforces RBAC and ABAC, executes integrations, and exposes trusted data via MCP and OpenAPI."
   type: webapp
   language: python # Explicitly specify Python language
-  version: 2.0.56
+  version: 2.0.65
 # Image Configuration
 # Set tag to match your build (example: aifabrix build dataplane -t 1.0.0).
 # Registry is required so the controller can pull the image (avoids docker-not-found on the controller host).
@@ -240,4 +240,3 @@ configuration:
       field: text
       label: "Default LLM provider (system key when two or more providers)"
       placeholder: "openai"
-

package/templates/applications/dataplane/env.template

@@ -30,8 +30,8 @@ LOCAL_MODE=false
 # CELERY_WORKER_RUNTIME is set automatically by python -m app.core.celery_worker_main (NullPool per task).
 # CELERY_LOG_LEVEL=info
 
-# When API_KEY is set, a matching Bearer token bypasses OAuth2 validation
-# Same kv:// as miso-controller API_KEY so pipeline Bearer bypass uses one secrets.local entry
+# When API_KEY is set, a matching Bearer token bypasses OAuth2 validation.
+# Same kv:// as miso-controller API_KEY; Azure may leave this optional key empty.
 API_KEY=kv://miso-controller-secrets-apiKeyVault
 # Comma-separated realm roles attached to API_KEY bypass (JWT realm_access.roles). Default: operator.
 # Dev manual tests (437 governance, enterprise-llm llm.call): use full-access locally; restrict in tst/pro.
@@ -44,7 +44,7 @@ API_KEY_BYPASS_ROLES=full-access
 
 # API Configuration
 API_V1_STR=/api/v1
-VERSION=2.0.56
+VERSION=2.0.65
 # Minimum supported aifabrix-builder CLI semver (advertised on /health and /api/v1/health; empty = no gate)
 # MIN_BUILDER_CLI_VERSION=2.45.0
 MIN_BUILDER_CLI_VERSION=2.45.5
@@ -258,7 +258,7 @@ DATAPLANE_PUBLIC_KEY_ID=
 CERTIFICATE_PRIVATE_KEY=kv://secrets-certificatePrivateKeyVault
 CERTIFICATE_PUBLIC_KEY=kv://secrets-certificatePublicKeyVault
 # Optional public key identifier for issued certificates; default if unset: dataplane-signing-key
-CERTIFICATE_PUBLIC_KEY_ID=dev01-dataplane-signing
+CERTIFICATE_PUBLIC_KEY_ID=dataplane-signing-key
 
 # =============================================================================
 # VALIDATION ENGINE — YAML CONTRACTS
@@ -333,4 +333,4 @@ TRUST_AI_EXPOSURE_GATE_ENABLED=false
 # app/schemas/json/external-datasource.schema.json metadata.version. Set CERTIFICATION_RULES_VERSION
 # when 346.rules / §17 revisions must invalidate existing certificates without matching rulesVersion.
 CERTIFICATION_DATASOURCE_SCHEMA_VERSION=
-CERTIFICATION_RULES_VERSION=
+CERTIFICATION_RULES_VERSION=

package/templates/applications/miso-controller/application.yaml

@@ -4,7 +4,7 @@ app:
   displayName: 'Miso Controller'
   description: 'Miso is the AI Fabrix in-tenant controller and portal layer for securely operating enterprise AI apps inside a customer’s Azure tenant. It provides Entra ID SSO, RBAC, audit logs, environment/app configuration via schemas, and safe secret handling via Key Vault references—ensuring governance, traceability, and predictable UX across portal, SDK, and CLI.'
   type: webapp
-  version: '2.0.51'
+  version: '2.0.66'
 # Image Configuration
 # Set tag to match your build (e.g. aifabrix build miso-controller -t 1.0.0 then tag: 1.0.0)
 # Registry is required so the controller can pull the image (avoids "docker: not found" on the controller host).
@@ -72,10 +72,29 @@ repository:
 #
 # NOT included (auto-configured):
 # - DATABASE_URL, REDIS_URL, KEYCLOAK_* → auto-generated during Azure install
-# - MISO_*, AZURE_*, kv:// → credentials and system parameters
+# - Other MISO_*, AZURE_*, kv:// → credentials and system parameters
 # - PORT, NODE_ENV, MISO_ENVIRONMENT → set by deployment target
 
 configuration:
+  # -------------------------------------------------------------------------
+  # Security & browser session
+  # -------------------------------------------------------------------------
+  - name: MISO_APPLICATION_SECRETS_UI_ENABLED
+    category: Security
+    portalInput:
+      field: select
+      label: 'Enable Settings System Secrets tab'
+      options:
+        - 'false'
+        - 'true'
+
+  - name: AUTH_BROWSER_SESSION_TTL_SECONDS
+    category: Security
+    portalInput:
+      field: text
+      label: 'Browser Session Idle Timeout (seconds)'
+      placeholder: '1800'
+
   # -------------------------------------------------------------------------
   # Operations & Debugging
   # -------------------------------------------------------------------------