@aifabrix/builder 2.55.2 → 2.57.0

package/lib/agent-kit/session-report.js

@@ -0,0 +1,76 @@
+/**
+ * Human-readable output for Agent Kit tmux session commands.
+ */
+
+'use strict';
+
+const {
+  formatBlockingError,
+  formatNextActions,
+  metadata,
+  sectionTitle
+} = require('../utils/cli-layout-chalk');
+
+/**
+ * @param {string} value
+ * @param {number} width
+ * @returns {string}
+ */
+function pad(value, width) {
+  return String(value).padEnd(width);
+}
+
+/**
+ * @param {Array<{ name: string }>} sessions
+ * @returns {{ name: number, status: number, windows: number }}
+ */
+function columnWidths(sessions) {
+  const longestName = sessions.reduce(
+    (width, session) => Math.max(width, String(session.name).length),
+    'Name'.length
+  );
+  return { name: longestName + 2, status: 10, windows: 7 };
+}
+
+/**
+ * @param {{ sessions: Array<{ name: string, attached: boolean, windows: number }> }} report
+ * @returns {string}
+ */
+function formatSessionList(report) {
+  const sessions = Array.isArray(report.sessions) ? report.sessions : [];
+  const lines = [sectionTitle(`Tmux sessions — ${sessions.length} active:`), ''];
+  if (sessions.length === 0) {
+    lines.push(metadata('  No active tmux sessions.'));
+    return lines.join('\n');
+  }
+
+  const widths = columnWidths(sessions);
+  const header = `${pad('Name', widths.name)}${pad('Status', widths.status)}Windows`;
+  lines.push(metadata(header));
+  lines.push(metadata('-'.repeat(widths.name + widths.status + widths.windows)));
+  sessions.forEach((session) => {
+    const status = session.attached ? 'attached' : 'detached';
+    lines.push(`${pad(session.name, widths.name)}${pad(status, widths.status)}${session.windows}`);
+  });
+  return lines.join('\n');
+}
+
+/**
+ * @param {boolean} asJson
+ * @returns {{ stderr: string, stdout?: string }}
+ */
+function formatMissingKillName(asJson) {
+  const error = 'Session name is required.';
+  if (asJson) {
+    return { stderr: JSON.stringify({ command: 'kill', success: false, error }, null, 2) };
+  }
+  return {
+    stderr: formatBlockingError(error),
+    stdout: formatNextActions([
+      'Run: aifabrix agent-kit list',
+      'Run: aifabrix agent-kit kill <name>'
+    ])
+  };
+}
+
+module.exports = { formatSessionList, formatMissingKillName };

package/lib/agent-kit/start.js

@@ -11,6 +11,7 @@ const { execFileSync, spawnSync } = require('child_process');
 const logger = require('../utils/logger');
 const { resolveGitRoot } = require('./repo-guard');
 const { writeApproveAllFiles } = require('./host-approve');
+const { hasOnPath, requireTmux, tmuxSessionExists } = require('./tmux-sessions');
 
 const START_APPS = {
   claude: { bin: 'claude' },
@@ -97,34 +98,6 @@ function resolveRemoteControlName(prefix, session) {
   return sanitizeSessionName(`${prefix}-${session}`);
 }
 
-/**
- * @param {string} bin
- * @param {Function} exec
- * @returns {boolean}
- */
-function hasOnPath(bin, exec) {
-  try {
-    exec('which', [bin], {
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'pipe']
-    });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-/**
- * @param {object} options
- * @returns {void}
- */
-function validateStartOptions(options) {
-  const app = String(options.app || '').trim();
-  if (options.remoteControl && app !== 'claude') {
-    throw new Error('--remote-control is only valid with claude.');
-  }
-}
-
 /**
  * Claude argv after the binary (Remote Control names, not Claude --tmux).
  * @param {object} p
@@ -152,7 +125,7 @@ function buildTmuxSpec(p) {
   const extra = p.app === 'claude' ? claudeInnerArgs(p) : [];
   const mode = p.detach
     ? ['new-session', '-d', '-s', p.session, '-c', p.cwd]
-    : ['new-session', '-A', '-s', p.session, '-c', p.cwd];
+    : ['new-session', '-s', p.session, '-c', p.cwd];
   const remote = p.app === 'claude' && p.remoteControl;
   return {
     bin: 'tmux',
@@ -179,9 +152,7 @@ function buildLaunchSpec(p) {
  * @returns {void}
  */
 function requireBinaries(spec, exec) {
-  if (spec.needTmux && !hasOnPath('tmux', exec)) {
-    throw new Error('tmux is not on PATH. Install tmux, then retry.');
-  }
+  requireTmux(exec);
   if (hasOnPath(spec.appBin, exec)) {
     return;
   }
@@ -193,6 +164,45 @@ function requireBinaries(spec, exec) {
   throw new Error('codex is not on PATH. Install with: npm install -g @openai/codex');
 }
 
+/**
+ * @param {string} cwd
+ * @returns {{ bin: string, args: string[], cwd: string }}
+ */
+function buildCodexRemoteSpec(cwd) {
+  return {
+    bin: 'codex',
+    args: ['remote-control', 'start', '--json'],
+    cwd
+  };
+}
+
+/**
+ * @param {object} options
+ * @param {object} spec
+ * @returns {void}
+ */
+function startCodexRemote(options, spec) {
+  const exec = options.execFileSync || execFileSync;
+  try {
+    exec(spec.bin, spec.args, {
+      cwd: spec.cwd,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe']
+    });
+  } catch (error) {
+    const detail = String((error && error.stderr) || (error && error.message) || '');
+    if (/app server is running but is not managed by codex app-server daemon/i.test(detail)) {
+      return;
+    }
+    if (/unrecognized subcommand|unknown command/i.test(detail)) {
+      throw new Error(
+        'This Codex CLI does not support Remote Control. Update Codex or pass --no-remote-control.'
+      );
+    }
+    throw error;
+  }
+}
+
 /**
  * @param {object} options
  * @returns {boolean}
@@ -220,11 +230,26 @@ function spawnLaunch(options, spec) {
   const result = spawn(spec.bin, spec.args, { stdio: 'inherit', cwd: spec.cwd });
   const status = result && typeof result.status === 'number' ? result.status : 0;
   if (status !== 0) {
+    const exec = options.execFileSync || execFileSync;
+    if (tmuxSessionExists(spec.session, exec)) {
+      throw duplicateSessionError(spec.session);
+    }
     throw new Error(`${spec.bin} exited with status ${status}`);
   }
   return status;
 }
 
+/**
+ * @param {string} session
+ * @returns {Error}
+ */
+function duplicateSessionError(session) {
+  return new Error(
+    `tmux session "${session}" already exists. Run: aifabrix agent-kit list; ` +
+    `aifabrix agent-kit kill ${session}; or choose another --name.`
+  );
+}
+
 /**
  * @param {object} spec
  * @param {object} extra
@@ -232,12 +257,17 @@ function spawnLaunch(options, spec) {
  */
 function toStartResult(spec, extra) {
   const launch = [spec.bin, ...spec.args];
+  const remoteLaunch = extra.remoteSpec
+    ? [extra.remoteSpec.bin, ...extra.remoteSpec.args]
+    : undefined;
   return {
     command: 'start',
     app: extra.app,
     session: spec.session,
     remoteControlName: spec.remoteControlName,
     remoteControlPrefix: spec.remoteControlPrefix,
+    remoteControl: extra.remoteControl,
+    remoteLaunch,
     path: extra.cwd,
     launch,
     tmux: spec.needTmux ? launch : undefined,
@@ -252,45 +282,78 @@ function toStartResult(spec, extra) {
  * @param {object} options
  * @returns {object}
  */
-function runStart(options) {
-  validateStartOptions(options);
+function resolveStartContext(options) {
   const app = normalizeStartApp(options.app);
   const cwd = resolveGitRoot(options.cwd || process.cwd());
   const session = resolveSessionName(options.name, cwd);
   const remoteControlPrefix = hostUserPrefix(options);
   const remoteControlName = resolveRemoteControlName(remoteControlPrefix, session);
-  const exec = options.execFileSync || execFileSync;
+  const remoteControl = options.remoteControl !== false;
   const spec = buildLaunchSpec({
-    app,
-    cwd,
-    session,
-    remoteControlPrefix,
-    remoteControlName,
-    detach: Boolean(options.detach),
-    remoteControl: Boolean(options.remoteControl)
+    app, cwd, session, remoteControlPrefix, remoteControlName,
+    detach: Boolean(options.detach), remoteControl
   });
   spec.cwd = cwd;
-  const approveAll = !options.skipApproveAll && Boolean(options.approveAll || options.yes);
-  const approvals = writeApproveAllFiles({
-    repoRoot: cwd,
-    hosts: [app],
-    approveAll,
-    dryRun: Boolean(options.dryRun)
-  });
+  const remoteSpec = app === 'codex' && remoteControl
+    ? buildCodexRemoteSpec(cwd)
+    : undefined;
+  return { app, cwd, session, remoteControl, spec, remoteSpec };
+}
+
+/**
+ * @param {object} options
+ * @param {object} context
+ * @returns {boolean}
+ */
+function prepareStart(options, context) {
+  const exec = options.execFileSync || execFileSync;
   if (!options.dryRun) {
-    requireBinaries(spec, exec);
+    requireBinaries(context.spec, exec);
   }
   const execute = shouldExecute(options);
-  if (execute && !options.json) {
-    logger.log(`Starting ${app} session ${spec.session}`);
+  if (execute && tmuxSessionExists(context.session, exec)) {
+    throw duplicateSessionError(context.session);
+  }
+  return execute;
+}
+
+/**
+ * @param {object} options
+ * @param {object} context
+ * @param {boolean} execute
+ * @returns {void}
+ */
+function executeStart(options, context, execute) {
+  if (!execute) {
+    return;
   }
-  if (execute) {
-    spawnLaunch(options, spec);
+  logger.log(`Starting ${context.app} session ${context.spec.session}`);
+  if (context.remoteSpec) {
+    startCodexRemote(options, context.remoteSpec);
   }
-  return toStartResult(spec, {
-    app,
-    cwd,
+  spawnLaunch(options, context.spec);
+}
+
+/**
+ * @param {object} options
+ * @returns {object}
+ */
+function runStart(options) {
+  const context = resolveStartContext(options);
+  const execute = prepareStart(options, context);
+  const approvals = writeApproveAllFiles({
+    repoRoot: context.cwd,
+    hosts: [context.app],
+    approveAll: !options.skipApproveAll,
+    dryRun: Boolean(options.dryRun)
+  });
+  executeStart(options, context, execute);
+  return toStartResult(context.spec, {
+    app: context.app,
+    cwd: context.cwd,
     approvals,
+    remoteControl: context.remoteControl,
+    remoteSpec: context.remoteSpec,
     dryRun: Boolean(options.dryRun),
     detach: Boolean(options.detach),
     executed: execute
@@ -306,5 +369,9 @@ module.exports = {
   resolveRemoteControlName,
   claudeInnerArgs,
   buildTmuxSpec,
+  buildCodexRemoteSpec,
+  startCodexRemote,
+  duplicateSessionError,
+  resolveStartContext,
   runStart
 };

package/lib/agent-kit/tmux-sessions.js

@@ -0,0 +1,163 @@
+/**
+ * Exact-name tmux session discovery and termination for Agent Kit.
+ * @fileoverview Uses argv execution only; never invokes a shell
+ */
+
+'use strict';
+
+const { execFileSync } = require('child_process');
+
+const LIST_FORMAT = [
+  '#{session_name}',
+  '#{session_windows}',
+  '#{session_attached}',
+  '#{session_created}'
+].join('\t');
+
+/**
+ * @param {string} bin
+ * @param {Function} exec
+ * @returns {boolean}
+ */
+function hasOnPath(bin, exec) {
+  try {
+    exec('which', [bin], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe']
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * @param {Function} exec
+ * @returns {void}
+ */
+function requireTmux(exec) {
+  if (!hasOnPath('tmux', exec)) {
+    throw new Error('tmux is not on PATH. Install tmux, then retry.');
+  }
+}
+
+/**
+ * @param {unknown} value
+ * @returns {string}
+ */
+function normalizeExactSessionName(value) {
+  const name = String(value || '').trim();
+  const hasControl = Array.from(name).some((char) => {
+    const code = char.charCodeAt(0);
+    return code < 32 || code === 127;
+  });
+  if (!name || hasControl || name.includes(':') || name.includes('.')) {
+    throw new Error('Invalid tmux session name. Use a non-empty name without control characters, colons, or periods.');
+  }
+  return name;
+}
+
+/**
+ * @param {unknown} error
+ * @returns {boolean}
+ */
+function isNoTmuxServer(error) {
+  const message = [error && error.message, error && error.stderr]
+    .filter(Boolean)
+    .map(String)
+    .join(' ');
+  return /no server running|failed to connect to server/i.test(message);
+}
+
+/**
+ * @param {string} name
+ * @param {Function} [exec]
+ * @returns {boolean}
+ */
+function tmuxSessionExists(name, exec = execFileSync) {
+  const exact = normalizeExactSessionName(name);
+  try {
+    exec('tmux', ['has-session', '-t', `=${exact}`], {
+      stdio: ['ignore', 'ignore', 'ignore']
+    });
+    return true;
+  } catch (error) {
+    if (error && (error.status === 1 || isNoTmuxServer(error))) {
+      return false;
+    }
+    throw error;
+  }
+}
+
+/**
+ * @param {string} line
+ * @returns {object|null}
+ */
+function parseSessionLine(line) {
+  if (!line) {
+    return null;
+  }
+  const [name, windows, attached, created] = line.split('\t');
+  return {
+    name,
+    windows: Number(windows),
+    attached: Number(attached) > 0,
+    createdAt: Number(created)
+  };
+}
+
+/**
+ * @param {object} [options]
+ * @returns {{ command: string, sessions: object[], count: number }}
+ */
+function runList(options = {}) {
+  const exec = options.execFileSync || execFileSync;
+  requireTmux(exec);
+  let output;
+  try {
+    output = exec('tmux', ['list-sessions', '-F', LIST_FORMAT], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe']
+    });
+  } catch (error) {
+    if (isNoTmuxServer(error)) {
+      return { command: 'list', sessions: [], count: 0 };
+    }
+    throw error;
+  }
+  const sessions = String(output || '')
+    .trim()
+    .split(/\r?\n/)
+    .map(parseSessionLine)
+    .filter(Boolean);
+  return { command: 'list', sessions, count: sessions.length };
+}
+
+/**
+ * @param {object} options
+ * @returns {{ command: string, session: string, killed: boolean }}
+ */
+function runKill(options) {
+  const exec = options.execFileSync || execFileSync;
+  const session = normalizeExactSessionName(options.name);
+  requireTmux(exec);
+  if (!tmuxSessionExists(session, exec)) {
+    throw new Error(`tmux session "${session}" is not running. Run: aifabrix agent-kit list`);
+  }
+  exec('tmux', ['kill-session', '-t', `=${session}`], {
+    stdio: ['ignore', 'ignore', 'pipe']
+  });
+  return { command: 'kill', session, killed: true };
+}
+
+module.exports = {
+  LIST_FORMAT,
+  hasOnPath,
+  requireTmux,
+  normalizeExactSessionName,
+  isNoTmuxServer,
+  tmuxSessionExists,
+  parseSessionLine,
+  runList,
+  runKill
+};

package/lib/api/environments.api.js

@@ -240,7 +240,45 @@ async function listEnvironmentDatasources(controllerUrl, envKey, authConfig, opt
   });
 }
 
+/**
+ * Validate an environment deployment request without deploying
+ * POST /api/v1/environments/{envKey}/validate
+ * @requiresPermission {Controller} controller:deploy
+ * @async
+ * @function validateEnvironmentDeployment
+ * @param {string} controllerUrl - Controller base URL
+ * @param {string} envKey - Environment key
+ * @param {Object} authConfig - Authentication configuration
+ * @param {Object} request - Body with environmentConfig
+ * @returns {Promise<Object>} Validation response (`data.valid`, errors, warnings)
+ * @throws {Error} If request fails
+ */
+async function validateEnvironmentDeployment(controllerUrl, envKey, authConfig, request) {
+  const client = new ApiClient(controllerUrl, authConfig);
+  return await client.post(`/api/v1/environments/${envKey}/validate`, {
+    body: request
+  });
+}
+
+/**
+ * Get server-reported tenant activation status
+ * GET /api/v1/tenant/status
+ * @requiresPermission {Controller} Authenticated (bearer)
+ * @async
+ * @function getTenantStatus
+ * @param {string} controllerUrl - Controller base URL
+ * @param {Object} authConfig - Authentication configuration
+ * @returns {Promise<Object>} Tenant status response (`status`: PENDING, ACTIVE, INACTIVE)
+ * @throws {Error} If request fails
+ */
+async function getTenantStatus(controllerUrl, authConfig) {
+  const client = new ApiClient(controllerUrl, authConfig);
+  return await client.get('/api/v1/tenant/status');
+}
+
 module.exports = {
+  validateEnvironmentDeployment,
+  getTenantStatus,
   listEnvironments,
   createEnvironment,
   getEnvironment,

package/lib/api/marketplace-bootstrap.api.js

@@ -0,0 +1,31 @@
+/**
+ * @fileoverview Mori Marketplace installation bootstrap API (public, unauthenticated).
+ * Used only for DOCKER installation registration; AZURE bootstrap runs inside the Marketplace
+ * template deployment script.
+ * @author AI Fabrix Team
+ * @version 2.0.0
+ */
+
+const { ApiClient } = require('./index');
+
+/**
+ * Register an installation and receive its Service API Key exactly once.
+ * POST /api/v1/marketplace/bootstrap
+ * @requiresPermission Public (Mori; no authentication)
+ * @async
+ * @function bootstrapMarketplaceInstallation
+ * @param {string} moriBaseUrl - Mori base URL (no trailing slash)
+ * @param {Object} body - Request body
+ * @param {string} body.subscriptionId - Stable installation UUID
+ * @param {string} body.tenantId - Stable owner UUID
+ * @param {string} body.resourceGroupName - Installation label
+ * @param {string} body.cloudVendor - AZURE or DOCKER
+ * @param {string} [body.marketplaceSubscriptionId] - Marketplace SaaS subscription; empty selects Community
+ * @returns {Promise<Object>} API response; `data.apiKey` is secret and must never be logged
+ */
+async function bootstrapMarketplaceInstallation(moriBaseUrl, body) {
+  const client = new ApiClient(moriBaseUrl, {});
+  return await client.post('/api/v1/marketplace/bootstrap', { body });
+}
+
+module.exports = { bootstrapMarketplaceInstallation };

package/lib/api/pipeline.api.js

@@ -278,7 +278,10 @@ function resolvePipelineUploadTimeoutMs(raw) {
  * @param {Object} authConfig
  * @param {Object} payload
  * @param {Object} [options]
- * @param {number|string} [options.timeoutMs] - HTTP + dataplane publish budget (default 300000)
+ * @param {number|string} [options.timeoutMs] - HTTP + dataplane publish budget (default 300000); ignored when options.async is true.
+ * @param {boolean} [options.async=false] - When true, durably accept the upload for qualification (202 jobId/candidateFingerprint) instead of blocking for the ladder (plan 191.0 task 1).
+ * @param {string} [options.gate] - Optional comma-separated checks: operations, trust, governance, full.
+ * @param {string} [options.subjectEmail] - Optional comma-separated governance subject emails.
  */
 async function uploadApplicationViaPipeline(
   dataplaneUrl,
@@ -287,8 +290,17 @@ async function uploadApplicationViaPipeline(
   options = {}
 ) {
   const body = { ...payload, status: payload.status ?? 'draft' };
-  const timeoutMs = resolvePipelineUploadTimeoutMs(options.timeoutMs);
   const client = createDataplaneApiClient(dataplaneUrl, authConfig);
+  if (options.async === true) {
+    const params = { async: 'true' };
+    if (options.gate) params.gate = options.gate;
+    if (options.subjectEmail) params.subjectEmail = options.subjectEmail;
+    return await client.post('/api/v1/pipeline/upload', {
+      body,
+      params
+    });
+  }
+  const timeoutMs = resolvePipelineUploadTimeoutMs(options.timeoutMs);
   return await client.post('/api/v1/pipeline/upload', {
     body,
     timeoutMs,
@@ -297,6 +309,23 @@ async function uploadApplicationViaPipeline(
   });
 }
 
+/**
+ * Get durable publish/qualification job status.
+ * GET /api/v1/publish-jobs/{jobId}
+ * @requiresPermission {Dataplane} external-system:publish or external-system:read
+ * @async
+ * @function getPublishJobStatus
+ * @param {string} dataplaneUrl - Dataplane base URL
+ * @param {Object} authConfig - Authentication configuration
+ * @param {string} jobId - Publish/qualification job id returned by uploadApplicationViaPipeline({ async: true })
+ * @returns {Promise<Object>} API envelope `{ success, data }` where `data` is `{ jobId, state, targetType, targetKey, steps, error, result }`
+ * @throws {Error} If request fails
+ */
+async function getPublishJobStatus(dataplaneUrl, authConfig, jobId) {
+  const client = createDataplaneApiClient(dataplaneUrl, authConfig);
+  return await client.get(`/api/v1/publish-jobs/${encodeURIComponent(jobId)}`);
+}
+
 module.exports = {
   validatePipeline,
   deployPipeline,
@@ -307,7 +336,7 @@ module.exports = {
   testSystemViaPipeline,
   testDatasourceViaPipeline,
   uploadApplicationViaPipeline,
+  getPublishJobStatus,
   resolvePipelineUploadTimeoutMs,
   PIPELINE_UPLOAD_TIMEOUT_MS
 };
-

package/lib/app/deploy.js

@@ -308,10 +308,12 @@ function validateImageIsPullable(imageRef, appName) {
  */
 function throwIfDeploymentFailed(status, statusObj) {
   if (status !== 'failed' && status !== 'cancelled') return;
-  const msg =
-    statusObj.message ||
-    statusObj.error ||
-    (status === 'cancelled' ? 'Deployment cancelled' : 'Deployment failed');
+  const reportedErrors = Array.isArray(statusObj.errors) ? statusObj.errors.filter(Boolean).join('; ') : '';
+  // A failed deployment can retain its last progress message (for example
+  // "Database-only mode"). Prefer the terminal error so the CLI reports the cause.
+  const msg = status === 'failed'
+    ? statusObj.error || reportedErrors || statusObj.message || 'Deployment failed'
+    : statusObj.message || statusObj.error || reportedErrors || 'Deployment cancelled';
   const err = new Error(`Deployment ${status}: ${msg}`);
   err.formatted = `Deployment ${status}.\n\n${msg}`;
   err.deploymentStatus = statusObj;
@@ -495,4 +497,3 @@ module.exports = {
   validateAppName,
   validateImageIsPullable
 };
-