@aifabrix/builder 2.56.0 → 2.57.0

package/templates/README.md

@@ -22,12 +22,16 @@ Application templates are folder-based and located under `templates/applications
 | `aifabrix-builder/builder/builder-api/` | `templates/applications/builder-api/` |
 | `aifabrix-miso/builder/miso-controller/` (`env.template`, `rbac.yaml`, `application.yaml`) | `templates/applications/miso-controller/` |
 | `aifabrix-miso/builder/keycloak/` (`env.template`, `application.yaml`, `Dockerfile`, `cimd-lenient-parse/`) | `templates/applications/keycloak/` |
+| `aifabrix-miso/infrastructure/marketplace/` (`main.json`, `createUiDefinition.json`) | `templates/marketplace/` |
 | `aifabrix-dataplane/builder/dataplane/` (`env.template`, `rbac.yaml`, `application.yaml`) | `templates/applications/dataplane/` |
 
 **Schema master (dataplane):** Also copies dataplane `app/schemas/json/` core integration schemas + `type/*` and `configs/deployment-rules.yaml` into `lib/schema/` (same contract as dataplane `make sync-json`). Do not hand-edit those mirrors — edit dataplane SSOT, then sync. Builder-owned schemas in `lib/schema/` (wizard, infra, etc.) are left alone.
 
 Overrides: `AIFABRIX_MISO_SRC`, `AIFABRIX_DATAPLANE_SRC` / `AIFABRIX_DATAPLANE_ROOT` (repo roots). Install with `aifabrix up-platform` / `up-builder-api` — do not hand-edit the template copies as primary.
 
+The Marketplace copies are compiled/source artifacts for a future Azure install command. `main.parameters.json` is intentionally excluded because installation secrets and customer-specific values must come from the installer's secure parameter file.
+The two-stage CLI procedure and a blank parameter-file example are in [docs/marketplace-env-deploy.md](../docs/marketplace-env-deploy.md).
+
 **Template Validation:**
 - Template folder must exist in `templates/applications/<name>/`
 - Template folder must contain at least one file

package/templates/agent-kit/instructions/AGENTKIT.md

@@ -57,13 +57,13 @@ curl -fsSL https://claude.ai/install.sh | bash
 claude auth login
 ```
 
-**Run in tmux** from this workspace so closing the terminal does not kill Claude. `--remote-control` is the **same** session on this PC, [claude.ai/code](https://claude.ai/code), and the Claude mobile app (Code). That is not `claude --cloud` (a separate cloud VM). Claude `--tmux` is for worktrees only.
+**Run in tmux** from this workspace so closing the terminal does not kill Claude. The command enables Remote Control and this workspace's Claude auto-approval by default. Remote Control is the **same** session on this PC, [claude.ai/code](https://claude.ai/code), and the Claude mobile app (Code). That is not `claude --cloud` (a separate cloud VM). Claude `--tmux` is for worktrees only.
 
 ```bash
-aifabrix agent-kit start claude --remote-control --approve-all --yes
+aifabrix agent-kit start claude
 ```
 
-tmux session name defaults to this folder. Remote Control name is `hostname-user-folder` (for example `builder01-dev03-aifabrix-docs`). Override the folder with `--name`. Detach: `Ctrl-b` then `d`. Reattach: `tmux attach -t <folder>`. Several workspaces can run at once. Same account on phone and PC (`claude auth login`, Pro/Max/Team — not an API key). On the phone: Claude app → **Code**. Skills: `/aifabrix-plan` (and the other `/aifabrix-*` names). First `claude` must run inside this workspace, not your home directory. Full notes: `.agents/skills/shared/hosts.md`.
+tmux session name defaults to this folder. Remote Control name is `hostname-user-folder` (for example `builder01-dev03-aifabrix-docs`). Override with `--name`; opt out with `--no-remote-control` and/or `--skip-approve-all`. Detach: `Ctrl-b` then `d`. Reattach: `tmux attach -t <folder>`. Use `aifabrix agent-kit list` and `agent-kit kill <folder>` to manage sessions. Same account on phone and PC (`claude auth login`, Pro/Max/Team — not an API key). On the phone: Claude app → **Code**. Skills: `/aifabrix-plan` (and the other `/aifabrix-*` names). First `claude` must run inside this workspace, not your home directory. Full notes: `.agents/skills/shared/hosts.md`.
 {{/if}}
 {{#if codex}}
 
@@ -76,13 +76,13 @@ npm install -g @openai/codex
 codex login
 ```
 
-**Run in tmux** from this workspace so the session stays if you close the terminal:
+**Run in tmux** from this workspace so the session stays if you close the terminal. The command starts native Codex Remote Control and writes this workspace's Codex auto-approval by default:
 
 ```bash
-aifabrix agent-kit start codex --approve-all --yes
+aifabrix agent-kit start codex
 ```
 
-Detach: `Ctrl-b` then `d`. Reattach: `tmux attach -t <folder>`, or `aifabrix agent-kit start codex` from this workspace. Default session name is this folder. Skills: `$aifabrix-plan` (and the other `$aifabrix-*` names). Codex reads `AGENTS.md`. Full notes: `.agents/skills/shared/hosts.md`.
+Detach: `Ctrl-b` then `d`. Reattach: `tmux attach -t <folder>`. A duplicate `start` fails instead of attaching. Default session name is this folder. Use `--no-remote-control` and/or `--skip-approve-all` to opt out. Skills: `$aifabrix-plan` (and the other `$aifabrix-*` names). Codex reads `AGENTS.md`. Full notes: `.agents/skills/shared/hosts.md`.
 {{/if}}
 
 ## Auth for delivery CLI

package/templates/agent-kit/skills/shared/hosts.md

@@ -6,14 +6,14 @@ Install and sign-in steps are in `AGENTKIT.md`. This file is how to **run** each
 
 Do not start Claude or Codex in your home directory. `cd` into this git workspace first.
 
-## Auto-approve (optional)
+## Auto-approve
 
 `aifabrix agent-kit install` can write gitignored host configs so Claude Code and Codex do not prompt for every tool:
 
 - Claude Code: `.claude/settings.local.json` (`permissions.defaultMode` = `bypassPermissions`, `allow` = `Bash(aifabrix *)` and `Read(~/**)`)
 - Codex: `.codex/config.toml` (`approval_policy = "never"`, `sandbox_mode = "workspace-write"`)
 
-Those files stay in **this workspace**. Claude may **read** files under the developer home (`Read(~/**)`) and run the delivery CLI (`Bash(aifabrix *)`). They do not add sibling folders as extra workspaces, do not grant Write outside this repo, and do not allow every shell command. TTY asks which host to auto-approve when both are selected. `--approve-all claude` or `--approve-all codex` writes only that host. `--yes` or a non-TTY / `--json` run writes them. `--skip-approve-all` skips. `--force` overwrites existing local files. Builder never writes `~/.claude` or `~/.codex`.
+Those files stay in **this workspace**. Claude may **read** files under the developer home (`Read(~/**)`) and run the delivery CLI (`Bash(aifabrix *)`). They do not add sibling folders as extra workspaces, do not grant Write outside this repo, and do not allow every shell command. `agent-kit start claude|codex` writes only the selected host's file by default; `--skip-approve-all` opts out. Install/update retain their explicit approval prompts and flags. `--force` overwrites existing local files. Builder never writes `~/.claude` or `~/.codex`.
 
 ## Cursor
 
@@ -23,13 +23,13 @@ Those files stay in **this workspace**. Claude may **read** files under the deve
 
 ## Claude Code
 
-**Local or SSH — tmux.** Closing the terminal must not kill Claude. Agent Kit starts Claude **inside tmux**. `--remote-control` is the **same** session on this PC, [claude.ai/code](https://claude.ai/code), and the Claude mobile app (**Code**). Do not use `claude --cloud` for this — that starts a different machine that clones GitHub. Claude `--tmux` is only for `--worktree` sessions, not this wrapper.
+**Local or SSH — tmux.** Closing the terminal must not kill Claude. Agent Kit starts Claude **inside tmux**, with Remote Control and workspace auto-approval enabled by default. Remote Control is the **same** session on this PC, [claude.ai/code](https://claude.ai/code), and the Claude mobile app (**Code**). Do not use `claude --cloud` for this — that starts a different machine that clones GitHub. Claude `--tmux` is only for `--worktree` sessions, not this wrapper.
 
 ```bash
-aifabrix agent-kit start claude --remote-control --approve-all --yes
+aifabrix agent-kit start claude
 ```
 
-tmux session name is this folder (for example `aifabrix-docs`). Remote Control name is `hostname-user-folder` (for example `builder01-dev03-aifabrix-docs`). `--name` overrides the folder. Several workspaces can run at once. Detach without killing Claude: `Ctrl-b` then `d`. Reattach: `tmux attach -t aifabrix-docs`, or run `start` again from the same folder. Then `/aifabrix-plan` (or another `/aifabrix-*` skill). First run in a project asks you to trust the folder; accept only this workspace.
+tmux session name is this folder (for example `aifabrix-docs`). Remote Control name is `hostname-user-folder` (for example `builder01-dev03-aifabrix-docs`). `--name` overrides the folder; `--no-remote-control` and `--skip-approve-all` opt out. Several workspaces can run at once. Detach without killing Claude: `Ctrl-b` then `d`. Reattach: `tmux attach -t aifabrix-docs`. A duplicate `start` fails instead of attaching. Then `/aifabrix-plan` (or another `/aifabrix-*` skill). First run in a project asks you to trust the folder; accept only this workspace.
 
 **Phone and PC.** Sign in with the same Claude Pro/Max/Team account (`claude auth login` — not an API key). After Remote Control starts, open **Code** in the Claude mobile app and/or [claude.ai/code](https://claude.ai/code) on the PC. In an already-running session, `/remote-control` or `/mobile`.
 
@@ -37,13 +37,13 @@ Closing the terminal (or SSH) does not stop a tmux session. Stopping tmux or the
 
 ## Codex
 
-**Local or SSH — tmux (recommended).** Same recipe on your PC and on a remote host. tmux keeps Codex running if you close the terminal or disconnect SSH. Codex has no Claude-style phone/web Remote Control.
+**Local or SSH — tmux and Remote Control.** tmux keeps Codex running if you close the terminal or disconnect SSH. Agent Kit also starts Codex's native remote-control daemon and workspace auto-approval by default.
 
 ```bash
-aifabrix agent-kit start codex --approve-all --yes
+aifabrix agent-kit start codex
 ```
 
-Equivalent: `tmux new -s aifabrix-docs -c /path/to/this-workspace` then `codex`. Default `--name` is the last folder. If that session already exists, `start` attaches. Detach: `Ctrl-b` then `d`. Then `$aifabrix-plan` (and the other `$aifabrix-*` skills). Codex reads `AGENTS.md`.
+Default `--name` is the last folder. `--no-remote-control` keeps the launch local; `--skip-approve-all` leaves Codex permissions unchanged. If that session already exists, `start` fails with list/kill guidance. Detach: `Ctrl-b` then `d`. Reattach with `tmux attach -t aifabrix-docs`. Then `$aifabrix-plan` (and the other `$aifabrix-*` skills). Codex reads `AGENTS.md`. Killing tmux does not stop the shared daemon; use `codex remote-control stop` when required.
 
 **Foreground only (no tmux).**
 
@@ -58,8 +58,8 @@ codex
 | --- | --- |
 | New named session | `tmux new -s <name> -c /path/to/this-workspace` |
 | Detach (leave it running) | `Ctrl-b`, then `d` |
-| List sessions | `tmux ls` |
+| List sessions | `aifabrix agent-kit list` |
 | Attach | `tmux attach -t <name>` |
-| Kill session | `tmux kill-session -t <name>` |
+| Kill session | `aifabrix agent-kit kill <name>` |
 
 Use a different `--name` per workspace so several Claude or Codex sessions can run on the same host. Claude and Codex in the **same** folder also need two names.

package/templates/applications/dataplane/application.yaml

@@ -5,7 +5,7 @@ app:
   description: "AI Fabrix Dataplane is a secure, in-tenant integration and automation layer that supplies governed, normalized, and explainable enterprise data to AI agents. Using CIP as a declarative standard, it enforces RBAC and ABAC, executes integrations, and exposes trusted data via MCP and OpenAPI."
   type: webapp
   language: python # Explicitly specify Python language
-  version: 2.0.68
+  version: 2.0.70
 # Image Configuration
 # Set tag to match your build (example: aifabrix build dataplane -t 1.0.0).
 # Registry is required so the controller can pull the image (avoids docker-not-found on the controller host).

package/templates/applications/dataplane/env.template

@@ -44,7 +44,7 @@ API_KEY_BYPASS_ROLES=full-access
 
 # API Configuration
 API_V1_STR=/api/v1
-VERSION=2.0.68
+VERSION=2.0.70
 # Minimum supported aifabrix-builder CLI semver (advertised on /health and /api/v1/health; empty = no gate)
 # MIN_BUILDER_CLI_VERSION=2.45.0
 MIN_BUILDER_CLI_VERSION=2.45.5

package/templates/applications/miso-controller/application.yaml

@@ -4,7 +4,7 @@ app:
   displayName: 'Miso Controller'
   description: 'Miso is the AI Fabrix in-tenant controller and portal layer for securely operating enterprise AI apps inside a customer’s Azure tenant. It provides Entra ID SSO, RBAC, audit logs, environment/app configuration via schemas, and safe secret handling via Key Vault references—ensuring governance, traceability, and predictable UX across portal, SDK, and CLI.'
   type: webapp
-  version: '2.0.78'
+  version: '2.0.81'
 # Image Configuration
 # Set tag to match your build (e.g. aifabrix build miso-controller -t 1.0.0 then tag: 1.0.0)
 # Registry is required so the controller can pull the image (avoids "docker: not found" on the controller host).
@@ -58,7 +58,8 @@ build:
   dockerfile: builder/miso-controller/Dockerfile # Dockerfile name (relative to project root)
   envOutputPath: ../../packages/miso-controller/.env # Copy .env to repo root for local dev (relative to builder/) (if null, no .env file is copied) (if empty, .env file is copied to repo root)
   language: typescript # Runtime language for template selection (typescript or python)
-  reloadStart: pnpm --filter @aifabrix/miso-controller run dev:watch:public # Docker --reload: nodemon backend + pre-built UI (no Vite in container)
+  # Runtime image has npm/npx, not pnpm. Keep the existing dev:watch:public script.
+  reloadStart: npm --prefix packages/miso-controller run dev:watch:public
 
 # Repository Configuration (pipeline validate: REPOSITORY_URL_MISMATCH)
 repository:

package/templates/applications/miso-controller/env.template

@@ -213,12 +213,6 @@ MISO_ENVIRONMENT=miso
 MISO_CLIENTID=kv://miso-controller-client-idKeyVault
 MISO_CLIENTSECRET=kv://miso-controller-client-secretKeyVault
 
-# Evaluation mode (optional .env override of DB controller.configuration.evaluation):
-# When true (default if DB omits flag), infra deploy may coerce :envKey to `miso` — e2e poll on `dev` can 404.
-# Set false locally to force path envKey to match deploy + GET .../deployments/:id.
-# Unset = use DB only.
-CONTROLLER_EVALUATION=
-
 # =============================================================================
 # ENTRA ID ONBOARDING (vendor multi-tenant app — admin consent) — [always]
 # =============================================================================
@@ -361,6 +355,21 @@ API_KEY=kv://miso-controller-secrets-apiKeyVault
 #   LICENSE_VALIDATION_DISABLED=true switch; do not use it in deployed installations.
 LICENSE_JWT=kv://miso-controller-jwt-licenseKeyVault
 
+# Signed licenses require a Mori issuer key trusted independently of the JWT.
+# Provision the SPKI PEM public key and exact issuer during installation, before
+# pasting LICENSE_JWT or using Update license. An embedded JWT publicKey/jwk or Mori URL
+# is not a trust source. For disconnected installs, deliver the key through the
+# authenticated installation package or another operator-verified channel.
+# Azure resolves this from Key Vault using the app's managed identity.
+# Builder Docker resolves the same kv:// catalog key from the installer's local
+# secrets store before starting the container. Provision a trusted Mori public key
+# there first; the empty catalog default is only for unlicensed Community mode.
+MORI_LICENSE_PUBLIC_KEY=kv://mori-license-public-keyKeyVault
+# Plain docker run can instead leave MORI_LICENSE_PUBLIC_KEY unset and use a
+# trusted, read-only PEM mount at this path.
+# MORI_LICENSE_PUBLIC_KEY_FILE=/run/secrets/mori-license-public-key.pem
+MORI_LICENSE_ISSUER=mori-controller
+
 # =============================================================================
 # ENTRA ID ONBOARDING (delegated Graph via Mori)
 # =============================================================================

package/templates/marketplace/createUiDefinition.json

@@ -0,0 +1,77 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/0.1.2-preview/CreateUIDefinition.MultiVm.json#",
+  "handler": "Microsoft.Azure.CreateUIDef",
+  "version": "0.1.2-preview",
+  "parameters": {
+    "config": {
+      "basics": {
+        "description": "Choose subscription, resource group, and region above. Under **Application resources Resource group name**, enter your install id (for example `aifabrixpoc02`). That managed resource group name is the naming prefix: resources become `{rg}-miso-asp`, `{rg}-miso-miso`, and so on. Set the Azure **Application name** to the same id when the portal asks. Enter the initial platform administrator password and choose the license below. Container images are pulled with the web apps' managed identities; no registry credential is needed."
+      }
+    },
+    "basics": [
+      {
+        "name": "adminPassword",
+        "type": "Microsoft.Common.PasswordBox",
+        "label": "Administrator password",
+        "toolTip": "Password for the initial AI Fabrix platform administrator (user admin). PostgreSQL, Keycloak, and encryption secrets are generated automatically and stored in Key Vault — do not reuse this password for infrastructure.",
+        "constraints": {
+          "required": true,
+          "regex": "^.{8,128}$",
+          "validationMessage": "Password must be 8–128 characters."
+        },
+        "options": {
+          "hideConfirmation": false
+        }
+      },
+      {
+        "name": "licenseChoice",
+        "type": "Microsoft.Common.DropDown",
+        "label": "License",
+        "toolTip": "License AI Fabrix requests during tenant activation. Community is permanent. Standard or Enterprise requested by name is a 30-day evaluation. For a purchased plan, choose 'Purchased Marketplace subscription' and enter its subscription ID; the edition is then resolved from the purchased plan.",
+        "defaultValue": "Community",
+        "constraints": {
+          "required": true,
+          "allowedValues": [
+            {
+              "label": "Community",
+              "value": "COMMUNITY"
+            },
+            {
+              "label": "Standard (30-day evaluation)",
+              "value": "STANDARD"
+            },
+            {
+              "label": "Enterprise (30-day evaluation)",
+              "value": "ENTERPRISE"
+            },
+            {
+              "label": "Purchased Marketplace subscription",
+              "value": "SUBSCRIPTION_ID"
+            }
+          ]
+        }
+      },
+      {
+        "name": "licenseSubscriptionKey",
+        "type": "Microsoft.Common.TextBox",
+        "label": "Marketplace subscription ID",
+        "toolTip": "The ID (GUID) of the purchased AI Fabrix Azure Marketplace subscription.",
+        "defaultValue": "",
+        "visible": "[equals(basics('licenseChoice'), 'SUBSCRIPTION_ID')]",
+        "constraints": {
+          "required": "[equals(basics('licenseChoice'), 'SUBSCRIPTION_ID')]",
+          "regex": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$",
+          "validationMessage": "Enter the Marketplace subscription ID as a GUID (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx)."
+        }
+      }
+    ],
+    "steps": [],
+    "outputs": {
+      "location": "[location()]",
+      "deploymentEnvironment": "evaluation",
+      "adminPassword": "[basics('adminPassword')]",
+      "licenseEdition": "[if(equals(basics('licenseChoice'), 'SUBSCRIPTION_ID'), basics('licenseSubscriptionKey'), basics('licenseChoice'))]",
+      "acrResourceId": "__MARKETPLACE_ACR_RESOURCE_ID__"
+    }
+  }
+}

package/templates/marketplace/install.parameters.example.json

@@ -0,0 +1,9 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    "adminPassword": { "value": "" },
+    "marketplaceSubscriptionId": { "value": "" },
+    "location": { "value": "swedencentral" }
+  }
+}