@aifabrix/builder 2.57.0 → 2.59.0

package/lib/utils/app-register-config.js

@@ -80,10 +80,8 @@ async function createMinimalAppIfNeeded(appKey, options) {
  * @returns {string} Image reference string
  */
 function buildImageReference(variables, appKey) {
-  const imageName = variables.image?.name || variables.app?.key || appKey;
-  const registry = variables.image?.registry;
-  const tag = variables.image?.tag || 'latest';
-  return registry ? `${registry}/${imageName}:${tag}` : `${imageName}:${tag}`;
+  const { buildManifestImageReference } = require('./resolve-docker-image-ref');
+  return buildManifestImageReference(variables, appKey);
 }
 
 /**

package/lib/utils/build-resolve-image.js

@@ -14,7 +14,8 @@ const { execWithDockerEnv } = require('./docker-exec');
 const { buildDevImageName, buildDevImageRepositoryPath } = require('./image-name');
 const {
   getRepositoryPathFromConfig,
-  resolveDockerImageRef
+  resolveDockerImageRef,
+  stripRegistryHostFromRepository
 } = require('./resolve-docker-image-ref');
 
 /**
@@ -48,26 +49,6 @@ function repositoryTail(repoPath) {
   return parts[parts.length - 1] || repoPath;
 }
 
-/**
- * Remove registry host prefix from a Docker repository path (local build only).
- * @param {string} repository
- * @returns {string}
- */
-function stripRegistryHostFromRepository(repository) {
-  if (!repository || typeof repository !== 'string') {
-    return repository;
-  }
-  const parts = repository.split('/');
-  if (parts.length <= 1) {
-    return repository;
-  }
-  const host = parts[0];
-  if (host.includes('.') || host.includes(':') || host === 'localhost') {
-    return parts.slice(1).join('/');
-  }
-  return repository;
-}
-
 /**
  * Strip dev-scoped or -extra suffix from a Docker repository path.
  * @param {string} repo

package/lib/utils/cli-utils.js

@@ -198,6 +198,9 @@ function isAzureCliToolingError(errorMsg) {
   return false;
 }
 
+/** Registry-credential and per-tag push errors that already name the host and the next step. */
+const REGISTRY_ACTIONABLE_ERROR = /dev set-registry|Push failed for |No registry credentials are available/;
+
 /**
  * Format Azure-related errors
  * @param {string} errorMsg - Error message
@@ -221,6 +224,10 @@ function formatAzureError(errorMsg) {
   if (errorMsg.includes('Docker build failed') || errorMsg.includes('Build failed: Docker')) {
     return null;
   }
+  // Registry-credential and per-tag push errors already carry host-specific next steps.
+  if (REGISTRY_ACTIONABLE_ERROR.test(errorMsg)) {
+    return null;
+  }
   const lowerMsg = String(errorMsg || '').toLowerCase();
   const hasAcrDomain = /\b[a-z0-9.-]+\.azurecr\.io\b/i.test(errorMsg);
   const hasAcrKeyword = /\bacr\b/.test(lowerMsg);
@@ -238,7 +245,7 @@ function formatAzureError(errorMsg) {
   if (errorMsg.includes('Registry URL is required')) {
     return [
       '   Registry URL is required.',
-      '   Provide via --registry flag or configure in application.yaml under image.registry'
+      '   Provide via --registry, set a default with aifabrix dev set-registry <host>, or configure image.registry in application.yaml'
     ];
   }
   return null;

package/lib/utils/config-paths.js

@@ -101,13 +101,8 @@ function createHomeAndSecretsPathFunctions(getConfigFn, saveConfigFn) {
         return;
       }
       const resolved = path.resolve(trimmed);
-      await setPathConfig(
-        getConfigFn,
-        saveConfigFn,
-        'aifabrix-work',
-        resolved,
-        'Work path must be a non-empty string'
-      );
+      await setPathConfig(getConfigFn, saveConfigFn, 'aifabrix-work', resolved,
+        'Work path must be a non-empty string');
     },
     async getAifabrixSecretsPath() {
       return getPathConfig(getConfigFn, 'aifabrix-secrets');
@@ -168,6 +163,17 @@ async function resolveEnvConfigPathToAbsolute(raw, getConfigFn) {
   return path.normalize(path.resolve(base, trimmed));
 }
 
+function findBuilderDirectory(base) {
+  if (!base) return null;
+  const candidate = path.join(base, 'builder');
+  try {
+    if (fs.existsSync(candidate) && fs.statSync(candidate).isDirectory()) return candidate;
+  } catch {
+    /* Missing or inaccessible builder directory. */
+  }
+  return null;
+}
+
 function createEnvConfigPathFunctions(getConfigFn, saveConfigFn) {
   return {
     /**
@@ -199,30 +205,16 @@ function createEnvConfigPathFunctions(getConfigFn, saveConfigFn) {
         return path.dirname(absolute);
       }
       const pathsMod = require('./paths');
-      const tryDir = (base) => {
-        if (!base) {
-          return null;
-        }
-        const b = path.join(base, 'builder');
-        try {
-          if (fs.existsSync(b) && fs.statSync(b).isDirectory()) {
-            return b;
-          }
-        } catch {
-          /* ignore */
-        }
-        return null;
-      };
-      const fromProject = tryDir(pathsMod.getProjectRoot());
+      const fromProject = findBuilderDirectory(pathsMod.getProjectRoot());
       if (fromProject) {
         return fromProject;
       }
-      const fromEffective = tryDir(pathsMod.getBuilderRoot());
+      const fromEffective = findBuilderDirectory(pathsMod.getBuilderRoot());
       if (fromEffective) {
         return fromEffective;
       }
       const work = pathsMod.getAifabrixWork();
-      return tryDir(work);
+      return findBuilderDirectory(work);
     }
   };
 }
@@ -368,11 +360,10 @@ function applySecretsUrlFromRemote(config) {
   config['aifabrix-secrets'] = `${base}/api/dev/secrets`;
 }
 
-function applySyncAndDockerFromHost(config) {
+function applySyncHost(config) {
   const host = hostnameFromUrl(config['remote-server']);
   if (!host) return;
   if (!config['sync-ssh-host']) config['sync-ssh-host'] = host;
-  if (!config['docker-endpoint']) config['docker-endpoint'] = `tcp://${host}:2376`;
 }
 
 async function mergeRemoteSettingsImpl(getConfigFn, saveConfigFn, settings) {
@@ -386,8 +377,13 @@ async function mergeRemoteSettingsImpl(getConfigFn, saveConfigFn, settings) {
     if (value === '') continue;
     config[key] = value;
   }
+  // Current settings are authoritative: never inherit Docker access from another identity.
+  if (typeof settings['docker-endpoint'] !== 'string' || !settings['docker-endpoint'].trim()) {
+    delete config['docker-endpoint'];
+    delete config['docker-tls-skip-verify'];
+  }
   applySecretsUrlFromRemote(config);
-  applySyncAndDockerFromHost(config);
+  applySyncHost(config);
   await saveConfigFn(config);
 }
 
@@ -428,7 +424,6 @@ module.exports = {
   resolveEnvConfigPathToAbsolute,
   SETTINGS_RESPONSE_KEYS,
   applySecretsUrlFromRemote,
-  applySyncAndDockerFromHost,
+  applySyncAndDockerFromHost: applySyncHost,
   hostnameFromUrl
 };
-

package/lib/utils/config-registry-preference.js

@@ -0,0 +1,113 @@
+/**
+ * Installation-level default container registry (`registry` in the Builder config.yaml).
+ *
+ * @fileoverview Registry host validation plus get/set/clear preference helpers
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const yaml = require('js-yaml');
+const fs = require('../internal/fs-real-sync');
+const { getRuntimeConfigFile } = require('../core/config-runtime-paths');
+
+const REGISTRY_CONFIG_KEY = 'registry';
+const HOST_LABEL = '[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?';
+const REGISTRY_HOST_RE = new RegExp(`^${HOST_LABEL}(?:\\.${HOST_LABEL})*$`);
+
+/**
+ * Normalizes and validates a registry host.
+ * Rejects schemes, paths, embedded credentials, query/fragment text and whitespace. A port is
+ * rejected because the deployment `image` contract (application-schema.json, shared with the
+ * Controller) accepts only one colon, which separates the tag.
+ * @param {string} value - Raw registry value
+ * @returns {string} Lower-case host
+ * @throws {Error} When the value is empty or not a plain host
+ */
+function normalizeRegistryHost(value) {
+  const raw = typeof value === 'string' ? value.trim() : '';
+  const withoutSlash = raw.replace(/\/+$/, '');
+  if (!withoutSlash) {
+    throw new Error('Registry is required (for example myregistry.azurecr.io)');
+  }
+  if (/[\s@?#/\\]|:\/\//.test(withoutSlash)) {
+    throw new Error(`Invalid registry "${raw}": use a host name such as myregistry.azurecr.io (no scheme, path or credentials)`);
+  }
+  const host = withoutSlash.toLowerCase();
+  if (host.includes(':')) {
+    throw new Error(
+      `Invalid registry "${raw}": a port is not supported because the deployed image reference keeps one colon for the tag. ` +
+      'Use a host name such as myregistry.azurecr.io.'
+    );
+  }
+  if (!REGISTRY_HOST_RE.test(host)) {
+    throw new Error(`Invalid registry "${raw}": use a host name such as myregistry.azurecr.io`);
+  }
+  return host;
+}
+
+/**
+ * Reads the installation registry synchronously (used by the shared image resolver).
+ * An unreadable or invalid value is treated as unset so image resolution keeps working.
+ * @returns {string} Normalized host or '' when unset
+ */
+function readInstallationRegistrySync() {
+  try {
+    const file = getRuntimeConfigFile();
+    if (!fs.existsSync(file)) return '';
+    const cfg = yaml.load(fs.readFileSync(file, 'utf8')) || {};
+    const value = cfg[REGISTRY_CONFIG_KEY];
+    return typeof value === 'string' && value.trim() ? normalizeRegistryHost(value) : '';
+  } catch {
+    return '';
+  }
+}
+
+/**
+ * @param {Function} getConfigFn - async () => config object
+ * @param {Function} saveConfigFn - async (config) => void
+ * @returns {{ getRegistry: Function, setRegistry: Function, clearRegistry: Function }}
+ */
+function createRegistryPreferenceFunctions(getConfigFn, saveConfigFn) {
+  return {
+    /**
+     * @returns {Promise<string|null>} Saved registry host or null
+     */
+    async getRegistry() {
+      const cfg = await getConfigFn();
+      const value = cfg[REGISTRY_CONFIG_KEY];
+      return typeof value === 'string' && value.trim() ? value.trim() : null;
+    },
+
+    /**
+     * @param {string} registry - Registry host
+     * @returns {Promise<string>} Normalized saved value
+     */
+    async setRegistry(registry) {
+      const host = normalizeRegistryHost(registry);
+      const cfg = await getConfigFn();
+      cfg[REGISTRY_CONFIG_KEY] = host;
+      await saveConfigFn(cfg);
+      return host;
+    },
+
+    /**
+     * Removes the saved registry (idempotent).
+     * @returns {Promise<void>}
+     */
+    async clearRegistry() {
+      const cfg = await getConfigFn();
+      if (!(REGISTRY_CONFIG_KEY in cfg)) return;
+      delete cfg[REGISTRY_CONFIG_KEY];
+      await saveConfigFn(cfg);
+    }
+  };
+}
+
+module.exports = {
+  REGISTRY_CONFIG_KEY,
+  normalizeRegistryHost,
+  readInstallationRegistrySync,
+  createRegistryPreferenceFunctions
+};

package/lib/utils/dev-init-ssh-merge.js

@@ -163,16 +163,17 @@ async function mergeDevSshConfigBlock(p) {
  * Update ~/.ssh/config with Host <user>.<host> for interactive SSH; log result.
  * @param {string} baseUrl - Builder Server base URL
  * @param {string} devId - Developer ID (digits)
+ * @param {Object} [freshSettings] - Current authenticated server settings; never mix with saved identity
  * @returns {Promise<{ hostAlias: string|null, syncUser: string, syncHost: string|null }>}
  */
-async function mergeDevSshConfigAfterInit(baseUrl, devId) {
-  const syncHost = (await config.getSyncSshHost()) || hostnameFromBaseUrl(baseUrl);
-  const syncUser = (await config.getSyncSshUser()) || `dev${devId}`;
+async function mergeDevSshConfigAfterInit(baseUrl, devId, freshSettings) {
+  const syncHost = (freshSettings ? freshSettings['sync-ssh-host'] : await config.getSyncSshHost()) || hostnameFromBaseUrl(baseUrl);
+  const syncUser = (freshSettings ? freshSettings['sync-ssh-user'] : await config.getSyncSshUser()) || `dev${devId}`;
   if (!syncHost) {
     return { hostAlias: null, syncUser, syncHost: null };
   }
   try {
-    const rootTrimmed = trimDeveloperRootDomain(await config.getDeveloperRootDomain());
+    const rootTrimmed = trimDeveloperRootDomain(freshSettings ? freshSettings['developer-root-domain'] : await config.getDeveloperRootDomain());
     return await mergeDevSshConfigBlock({
       baseUrl,
       devId,

package/lib/utils/dev-user-groups.js

@@ -10,7 +10,8 @@ const ALLOWED_DEV_GROUPS = Object.freeze([
   'secret-manager',
   'secret-reader',
   'developer',
-  'docker'
+  'docker',
+  'integrator'
 ]);
 
 /**

package/lib/utils/docker-build.js

@@ -252,13 +252,44 @@ async function executeBuild(imageName, dockerfilePath, contextPath, tag, options
       (options.cache === false || options.noCache === true || options['no-cache'] === true)
   );
   await executeDockerBuild(imageName, dockerfilePath, contextPath, tag, buildArgs, noCache);
+  await applyTagAliases(imageName, tag, resolveTagAliases(tag, options));
+}
 
-  // Also apply floating `latest` when building a version tag (matches dev-promote dual tags).
+/**
+ * Aliases for the built image: explicit `options.tagAliases` from the shared tag plan, else the
+ * legacy rule (a single non-floating `options.tag` also gets `latest`).
+ * @param {string} tag - Built tag
+ * @param {Object} [options] - Build options
+ * @returns {string[]}
+ */
+function resolveTagAliases(tag, options) {
+  if (options && Array.isArray(options.tagAliases)) {
+    return options.tagAliases.filter((alias) => alias !== tag);
+  }
   if (options && options.tag && options.tag !== 'latest' && options.tag !== 'main') {
-    const { execFileWithDockerEnv } = require('./docker-exec');
-    const { getDockerExecEnv } = require('./remote-docker-env');
-    const env = await getDockerExecEnv();
-    await execFileWithDockerEnv('docker', ['tag', `${imageName}:${tag}`, `${imageName}:latest`], { env });
+    return ['latest'];
+  }
+  return [];
+}
+
+/**
+ * Tag the built image with every alias (argument arrays; no shell interpolation).
+ * @param {string} imageName - Repository
+ * @param {string} tag - Built tag
+ * @param {string[]} aliases - Additional tags
+ * @returns {Promise<void>}
+ */
+async function applyTagAliases(imageName, tag, aliases) {
+  if (!aliases.length) return;
+  const { execFileWithDockerEnv } = require('./docker-exec');
+  const { getDockerExecEnv } = require('./remote-docker-env');
+  const env = await getDockerExecEnv();
+  for (const alias of aliases) {
+    try {
+      await execFileWithDockerEnv('docker', ['tag', `${imageName}:${tag}`, `${imageName}:${alias}`], { env });
+    } catch (error) {
+      throw new Error(`Failed to tag ${imageName}:${alias}: ${error.message}`);
+    }
   }
 }
 
@@ -286,26 +317,29 @@ async function executeDockerBuildWithTag(effectiveImageName, imageName, dockerfi
     return;
   }
 
-  try {
-    const { execFileWithDockerEnv } = require('./docker-exec');
-    const { getDockerExecEnv } = require('./remote-docker-env');
-    const env = await getDockerExecEnv();
-    await execFileWithDockerEnv(
-      'docker',
-      ['tag', `${effectiveImageName}:${tag}`, `${imageName}:${tag}`],
-      { env }
-    );
-    logger.log(formatSuccessLine(`Tagged image: ${imageName}:${tag}`));
-  } catch (err) {
-    logger.log(
-      formatWarningLine(`Could not create compatibility tag ${imageName}:${tag} - ${err.message}`)
-    );
+  const { execFileWithDockerEnv } = require('./docker-exec');
+  const { getDockerExecEnv } = require('./remote-docker-env');
+  const env = await getDockerExecEnv();
+  for (const compatTag of [tag, ...resolveTagAliases(tag, options)]) {
+    try {
+      await execFileWithDockerEnv(
+        'docker',
+        ['tag', `${effectiveImageName}:${compatTag}`, `${imageName}:${compatTag}`],
+        { env }
+      );
+      logger.log(formatSuccessLine(`Tagged image: ${imageName}:${compatTag}`));
+    } catch (err) {
+      logger.log(
+        formatWarningLine(`Could not create compatibility tag ${imageName}:${compatTag} - ${err.message}`)
+      );
+    }
   }
 }
 
 module.exports = {
   executeDockerBuild,
   executeBuild,
+  resolveTagAliases,
   executeDockerBuildWithTag,
   isDockerNotAvailableError
 };

package/lib/utils/docker-daemon-tls-ca.js

@@ -146,7 +146,7 @@ function dockerEndpointFromRemoteServer(remoteServerUrl) {
 }
 
 /**
- * Resolve docker-endpoint for CA augmentation (settings override, else derive from remote-server).
+ * Resolve only an explicitly advertised docker-endpoint; a server hostname is not Docker access.
  * @param {{ settings?: Object|null, remoteServerUrl?: string|null }} ctx
  * @returns {string|null}
  */
@@ -156,7 +156,7 @@ function resolveDockerEndpointForCaAugment(ctx) {
   if (typeof fromSettings === 'string' && fromSettings.trim()) {
     return fromSettings.trim();
   }
-  return dockerEndpointFromRemoteServer(ctx && ctx.remoteServerUrl);
+  return null;
 }
 
 /**

package/lib/utils/env-map.js

@@ -12,6 +12,8 @@ const fs = require('fs');
 const yaml = require('js-yaml');
 const { loadEnvConfig, loadSchemaEnvConfig } = require('./env-config-loader');
 const config = require('../core/config');
+const { buildDevUsernameForFrontDoorHost } = require('./compose-traefik-ingress-base');
+const { resolveRemoteHostForFrontDoor } = require('./remote-host-for-front-door');
 
 /**
  * Load base environment variables from env-config.yaml
@@ -309,19 +311,34 @@ function applyPublicPortAdjustmentsForContext(result, context, devIdNum) {
 }
 
 /**
- * Set TLS_ENABLED / HTTP_ENABLED from ~/.aifabrix/config.yaml (tlsEnabled).
+ * Add config-derived interpolation values used by env.template.
  * @param {Object} result - Env map (mutated)
+ * @param {number} devIdNum - Normalized developer ID
  */
-async function applyTlsHttpManifestFlags(result) {
+async function applyRuntimeConfigVars(result, devIdNum) {
+  let userCfg = {};
   let tlsOn = false;
   try {
-    const userCfg = await config.getConfig();
+    userCfg = await config.getConfig();
     tlsOn = Boolean(userCfg && userCfg.tlsEnabled === true);
   } catch {
-    tlsOn = false;
+    userCfg = {};
   }
   result.TLS_ENABLED = tlsOn ? 'true' : 'false';
   result.HTTP_ENABLED = tlsOn ? 'false' : 'true';
+  const devUsername = buildDevUsernameForFrontDoorHost(devIdNum);
+  const remoteServerHost = resolveRemoteHostForFrontDoor({
+    remoteServer: userCfg && userCfg['remote-server']
+  });
+  const remoteHost = remoteServerHost ? remoteServerHost.split('.')[0] : '';
+  const devRootDomain = resolveRemoteHostForFrontDoor({
+    developerRootDomain: userCfg && userCfg['developer-root-domain']
+  });
+  if (devUsername || remoteHost) {
+    result.DEV_USERNAME = devUsername;
+    result.REMOTE_HOST = remoteHost;
+  }
+  if (devRootDomain) result.DEV_ROOT_DOMAIN = devRootDomain;
 }
 
 /**
@@ -333,6 +350,7 @@ async function applyTlsHttpManifestFlags(result) {
  * - Applies developer-id adjustment to port variables for local context
  * - Calculates *_PUBLIC_PORT for both local and docker context (basePort + developer-id * 100)
  * - Adds TLS_ENABLED and HTTP_ENABLED ("true" / "false"); HTTP_ENABLED = !TLS_ENABLED for manifest ${...} substitution
+ * - Adds DEV_USERNAME, REMOTE_HOST, and DEV_ROOT_DOMAIN from Builder configuration
  * @async
  * @function buildEnvVarMap
  * @param {'docker'|'local'} context - Environment context
@@ -358,7 +376,7 @@ async function buildEnvVarMap(context, osModule = null, developerId = null, opti
     applyLocalPortAdjustment(result, devIdNum);
   }
   applyPublicPortAdjustmentsForContext(result, context, devIdNum);
-  await applyTlsHttpManifestFlags(result);
+  await applyRuntimeConfigVars(result, devIdNum);
   return result;
 }
 
@@ -367,4 +385,3 @@ module.exports = {
   getDeveloperIdNumber,
   resolvePortInEnvValues
 };
-

package/lib/utils/error-formatters/validation-errors.js

@@ -11,6 +11,26 @@ const { formatBlockingError } = require('../cli-test-layout-chalk');
 
 const chalk = require('chalk');
 
+/**
+ * Resolves legacy application lookup codes without replacing API explanations.
+ * @param {Object|string} error - Validation error entry
+ * @returns {{message: string, applicationNotFound: boolean}} Display information
+ */
+function getValidationMessage(error) {
+  const message = typeof error === 'string' ? error : error.msg || error.message;
+  const code = typeof error === 'object' ? error.code : undefined;
+  const applicationNotFound = message === 'APPLICATION_NOT_FOUND' || code === 'APPLICATION_NOT_FOUND';
+  if (applicationNotFound && (!message || message === 'APPLICATION_NOT_FOUND')) {
+    return {
+      message: 'The controller could not find the application. ' +
+        'Check that it is registered on the selected controller and that its application key matches. ' +
+        '(Error code: APPLICATION_NOT_FOUND)',
+      applicationNotFound
+    };
+  }
+  return { message: message || 'Invalid value', applicationNotFound };
+}
+
 /**
  * Adds main error message to lines array
  * @param {Array<string>} lines - Lines array to append to
@@ -52,7 +72,7 @@ function addValidationErrorsList(lines, errors) {
   lines.push(chalk.yellow('Validation errors:'));
   errors.forEach(err => {
     const field = err.field || err.path || err.loc?.join('.') || 'validation';
-    const message = err.msg || err.message || 'Invalid value';
+    const { message } = getValidationMessage(err);
     const value = err.value !== undefined ? ` (value: ${JSON.stringify(err.value)})` : '';
     if (field === 'validation' || field === 'unknown') {
       lines.push(chalk.gray(`  • ${message}${value}`));
@@ -91,10 +111,10 @@ function addConfigurationErrors(lines, configuration) {
 /**
  * Adds actionable guidance tips to lines
  * @param {Array<string>} lines - Lines array to append to
- * @param {boolean} hasErrors - Whether there are validation errors
+ * @param {Array<Object|string>} errors - Validation errors
  */
-function addValidationGuidance(lines, hasErrors) {
-  if (!hasErrors) {
+function addValidationGuidance(lines, errors) {
+  if (!Array.isArray(errors) || !errors.some(err => !getValidationMessage(err).applicationNotFound)) {
     return;
   }
   lines.push(chalk.gray('Tips:'));
@@ -117,7 +137,7 @@ function formatValidationError(errorData) {
   addValidationErrorMessage(lines, errorData);
   addValidationErrorsList(lines, errorData.errors);
   addConfigurationErrors(lines, errorData.configuration);
-  addValidationGuidance(lines, errorData.errors && errorData.errors.length > 0);
+  addValidationGuidance(lines, errorData.errors);
 
   if (errorData.instance) {
     lines.push(chalk.gray(`Endpoint: ${errorData.instance}`));

package/lib/utils/help-builder.js

@@ -17,6 +17,7 @@ const { Help } = require('commander');
  * @type {Array<{ name: string, commands: Array<{ name: string, term?: string }> }>}
  */
 const CATEGORIES = [
+  { name: 'Getting Started', commands: [{ name: 'help', term: 'help [command]' }, { name: 'onboarding' }] },
   {
     name: 'Infrastructure (Local Development)',
     commands: [
@@ -209,9 +210,9 @@ function formatCommandCategories(helper, program) {
     for (const { term, desc: d } of lines) out.push(`  ${term.padEnd(pad)}${d}`);
     out.push('');
   }
-  out.push('Help:');
-  out.push(`  ${'help [command]'.padEnd(pad)}display help for command`);
-  out.push('');
+  if (!program.commands.some(command => command.name() === 'help')) {
+    out.push('Help:', `  ${'help [command]'.padEnd(pad)}display help for command`, '');
+  }
   out.push(`  ${''.padEnd(pad)}Tip: aifabrix <command> --help for flags and examples`);
   out.push('');
   return out;