@aifabrix/builder 2.59.0 → 2.61.2

package/lib/commands/env-secret-push-confirm.js

@@ -0,0 +1,54 @@
+/**
+ * Confirmation gate for bulk installation-secret writes.
+ *
+ * @fileoverview Prevent accidental env secret bulk pushes
+ */
+
+'use strict';
+
+const readline = require('readline');
+const logger = require('../utils/logger');
+const { formatWarningLine } = require('../utils/cli-test-layout-chalk');
+
+/**
+ * @param {string} question - Prompt text
+ * @param {Object} [streams] - Injectable input/output streams
+ * @returns {Promise<string>} User response
+ */
+function promptLine(question, streams = {}) {
+  const input = streams.input || process.stdin;
+  const output = streams.output || process.stdout;
+  const rl = readline.createInterface({ input, output });
+  return new Promise(resolve => {
+    rl.question(question, answer => {
+      rl.close();
+      resolve(String(answer || '').trim());
+    });
+  });
+}
+
+/**
+ * Require explicit approval only when every mapped secret would be written.
+ * @param {Object} ctx - Resolved environment context
+ * @param {Object} options - CLI options
+ * @param {Object} [deps] - Injectable prompt and TTY state
+ * @returns {Promise<boolean>} True when execution may continue
+ */
+async function confirmBulkSecretPush(ctx, options = {}, deps = {}) {
+  if (options.key || options.dryRun || options.yes) return true;
+  const isTTY = deps.isTTY === undefined
+    ? Boolean(process.stdin.isTTY && process.stdout.isTTY) : deps.isTTY;
+  if (!isTTY) {
+    throw new Error('Bulk configuration push requires --yes in non-interactive or AI usage');
+  }
+  logger.log(formatWarningLine(
+    `Push all declared configuration from the .env for ${options.app} to ${ctx.envKey}?`
+  ));
+  const prompt = deps.prompt || promptLine;
+  const answer = await prompt('Type "yes" to confirm (anything else cancels): ');
+  if (String(answer).trim().toLowerCase() === 'yes') return true;
+  logger.log('Cancelled. No configuration values were pushed.');
+  return false;
+}
+
+module.exports = { promptLine, confirmBulkSecretPush };

package/lib/commands/env-secret-push-run.js

@@ -0,0 +1,227 @@
+/**
+ * Orchestration and reporting for `aifabrix env secret push`.
+ *
+ * Reporting is the security-sensitive half: every line names a variable, a catalog key and
+ * an outcome, and there is no branch that can print a value. Kept separate from the row
+ * mechanics so the redaction rule is easy to read in one place.
+ *
+ * @fileoverview env secret push: run, report, exit code
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const chalk = require('chalk');
+const logger = require('../utils/logger');
+const {
+  OUTCOME, readEnvFile, pushRow
+} = require('./env-secret-push');
+const { parseEnvAssignments } = require('../utils/system-secret-mapping');
+const {
+  listEnvironmentConfiguration,
+  putEnvironmentConfiguration
+} = require('../api/configuration.api');
+const { putSystemSecret } = require('../api/system-secrets.api');
+
+const GLYPH = Object.freeze({ ok: '✔', fail: '✖', skip: '·' });
+
+/**
+ * @param {Object} row - Reported row
+ * @returns {string} One aligned line naming the variable, key and outcome
+ */
+function formatRow(row, widths = { name: 34, key: 44 }) {
+  const glyph = row.outcome === OUTCOME.updated ? chalk.green(GLYPH.ok)
+    : row.outcome === OUTCOME.skipped ? chalk.gray(GLYPH.skip)
+      : chalk.red(GLYPH.fail);
+  const name = String(row.name).padEnd(widths.name);
+  const key = String(row.catalogKey || '—').padEnd(widths.key);
+  const detail = row.reason ? `${row.outcome} (${row.reason})` : row.outcome;
+  return `  ${name}-> ${key}${glyph} ${detail}`;
+}
+
+/**
+ * Keep variable and declaration names complete and aligned.
+ * @param {Array<Object>} rows - Report rows
+ * @returns {{ name: number, key: number }} Result-specific widths
+ */
+function reportWidths(rows) {
+  return {
+    name: Math.max(34, ...rows.map(row => String(row.name).length)),
+    key: Math.max(44, ...rows.map(row => String(row.catalogKey || '—').length))
+  };
+}
+
+/**
+ * Print the installation before the first write. Pushing into the wrong installation is
+ * silent and unrecoverable, because no value can be read back to show what was overwritten.
+ * @param {Object} ctx - controllerUrl, envKey
+ * @returns {void}
+ */
+function reportTarget(ctx) {
+  logger.log(`Controller: ${ctx.controllerUrl}   environment: ${ctx.envKey}`);
+  logger.log('');
+}
+
+/**
+ * @param {Array<Object>} results - Reported rows
+ * @param {boolean} dryRun - Whether anything was written
+ * @returns {number} Exit code: non-zero when any row failed
+ */
+function reportSummary(results, dryRun) {
+  const failed = results.filter(row => row.outcome !== OUTCOME.updated && row.outcome !== OUTCOME.skipped);
+  const updated = results.filter(row => row.outcome === OUTCOME.updated);
+  const skipped = results.filter(row => row.outcome === OUTCOME.skipped);
+  // Count only the rows that would actually be written. Counting skipped rows as "would be
+  // pushed" overstates what the command does, which is the one thing a dry run must not do.
+  const considered = results.length - skipped.length;
+  logger.log('');
+  if (dryRun) {
+    const tail = skipped.length > 0 ? ` ${skipped.length} skipped.` : '';
+    logger.log(`Dry run: ${updated.length} of ${considered} configuration value(s) would be pushed.${tail} Nothing was written.`);
+    return 0;
+  }
+  if (failed.length === 0) {
+    logger.log(`${updated.length} of ${considered} pushed.`);
+    return 0;
+  }
+  logger.log(`${updated.length} of ${considered} pushed; ${failed.length} failed.`);
+  reportRemediation(failed);
+  return 1;
+}
+
+/**
+ * One hint per failure class, because each has a different owner.
+ * @param {Array<Object>} failed - Failing rows
+ * @returns {void}
+ */
+function reportRemediation(failed) {
+  if (failed.some(row => row.outcome === OUTCOME.notInCatalog)) {
+    logger.log('The controller no longer recognizes those configuration declarations.');
+    logger.log('Refresh with aifabrix env secret list, then retry using the current declaration.');
+  }
+  if (failed.some(row => row.outcome === OUTCOME.forbidden)) {
+    logger.log('Setting a system secret requires the controller:admin scope. Run: aifabrix login');
+  }
+  if (failed.some(row => row.outcome === OUTCOME.unreachable)) {
+    logger.log('Nothing was written for those keys. Check the controller URL above and retry.');
+  }
+  if (failed.some(row => row.outcome === OUTCOME.conflict)) {
+    logger.log('The configuration changed before the write. Run the push again to use a fresh revision.');
+  }
+}
+
+/**
+ * Map .env variable names to authoritative Controller declarations.
+ * @param {string} envContent - Application .env content
+ * @param {Array<Object>} declarations - Controller configuration rows
+ * @param {string} [only] - Optional exact .env variable name
+ * @param {string} [application] - Expected exact application owner
+ * @returns {{ pushable: Array<Object>, skipped: Array<Object> }} Revision-bound rows
+ */
+function mapEnvConfiguration(envContent, declarations, only, application) {
+  const pushable = [];
+  const skipped = [];
+  const values = parseEnvAssignments(envContent);
+  for (const [name, value] of values) {
+    if (only && name !== only) continue;
+    const matches = declarations.filter(item => item && item.name === name &&
+      (!application || item.application === application));
+    if (matches.length !== 1) {
+      skipped.push({ name, reason: matches.length ? 'ambiguous declaration' : 'not declared' });
+      continue;
+    }
+    const match = matches[0];
+    if (typeof match.sensitive !== 'boolean' || !match.key || !match.application || !match.revision) {
+      skipped.push({ name, catalogKey: match.key, reason: 'incomplete declaration metadata' });
+      continue;
+    }
+    if (match.sensitive && !value) {
+      skipped.push({ name, catalogKey: match.key, reason: 'no secret value in the env file' });
+      continue;
+    }
+    pushable.push({
+      name, value, catalogKey: match.key, application: match.application,
+      revision: match.revision, sensitive: match.sensitive
+    });
+  }
+  if (only && !values.has(only)) skipped.push({ name: only, reason: 'not present in the env file' });
+  return { pushable, skipped };
+}
+
+/**
+ * @param {Object} deps - Injected api
+ * @param {Object} ctx - controllerUrl, authConfig, envKey
+ * @param {Array<Object>} ready - Rows to push
+ * @returns {Promise<Array<Object>>} Reported rows
+ */
+async function pushAll(deps, ctx, ready) {
+  const results = [];
+  for (const row of ready) {
+    const result = await pushRow(deps, ctx, row);
+    results.push(result);
+    if (result.fatal) {
+      // 403 fails identically for every remaining key; report them rather than retry.
+      for (const remaining of ready.slice(results.length)) {
+        results.push({ name: remaining.name, catalogKey: remaining.catalogKey, outcome: result.outcome });
+      }
+      break;
+    }
+  }
+  return results;
+}
+
+/**
+ * Run the push.
+ * @param {Object} ctx - controllerUrl, authConfig, envKey, envFilePath
+ * @param {Object} [options] - `key`, `dryRun`, `api`
+ * @returns {Promise<{ exitCode: number, results: Array<Object> }>} Outcome per row
+ */
+async function runEnvSecretPush(ctx, options = {}) {
+  const envContent = readEnvFile(ctx.envFilePath, options);
+  const api = options.api || {
+    listEnvironmentConfiguration, putSystemSecret, putEnvironmentConfiguration
+  };
+  const declarations = await api.listEnvironmentConfiguration(
+    ctx.controllerUrl, ctx.authConfig, ctx.envKey, options.application
+  );
+  const { pushable, skipped } = mapEnvConfiguration(
+    envContent, declarations, options.key, options.application
+  );
+  reportTarget(ctx);
+  // Every mapped row is attempted. Whether an unlisted key can be written differs by
+  // installation, so only the server can answer it.
+  const results = options.dryRun
+    ? dryRunRows(pushable)
+    : await pushAll(options, ctx, pushable);
+  const reported = results.concat(skipped.map(row => ({ ...row, outcome: OUTCOME.skipped })));
+  const widths = reportWidths(reported);
+  for (const row of reported) {
+    logger.log(formatRow(row, widths));
+  }
+  return { exitCode: reportSummary(reported, options.dryRun === true), results: reported };
+}
+
+/**
+ * Dry-run rows: what would be attempted. Catalog validity is decided by PUT on a real run.
+ * @param {Array<Object>} pushable - Mapped rows
+ * @returns {Array<Object>} Reportable rows that write nothing
+ */
+function dryRunRows(pushable) {
+  return pushable.map(row => ({
+    name: row.name,
+    catalogKey: row.catalogKey,
+    outcome: OUTCOME.updated
+  }));
+}
+
+module.exports = {
+  formatRow,
+  reportWidths,
+  reportTarget,
+  reportSummary,
+  dryRunRows,
+  pushAll,
+  mapEnvConfiguration,
+  runEnvSecretPush
+};

package/lib/commands/env-secret-push.js

@@ -0,0 +1,168 @@
+/**
+ * Push declared configuration values from an operator's env file into an installation.
+ *
+ * Every value in this module comes from a file and goes to one API call. It is never an
+ * argument (so it cannot reach shell history or a process list), never logged, and never
+ * placed in a message, a progress line or a JSON envelope — on success or on failure.
+ * Rows are reported by variable name, declaration key and outcome only.
+ *
+ * The command updates Controller declarations and cannot create a new declaration.
+ *
+ * @fileoverview aifabrix env secret push
+ * @author AI Fabrix Team
+ * @version 1.0.0
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { execFileSync } = require('child_process');
+const { putSystemSecret } = require('../api/system-secrets.api');
+const {
+  listEnvironmentConfiguration,
+  putEnvironmentConfiguration
+} = require('../api/configuration.api');
+
+/** Outcome codes reported per row; none of them can carry a value. */
+const OUTCOME = Object.freeze({
+  updated: 'updated',
+  notInCatalog: 'not declared',
+  forbidden: 'not permitted',
+  conflict: 'configuration changed; retry',
+  unreachable: 'controller unreachable',
+  skipped: 'skipped'
+});
+
+/**
+ * HTTP status from an API client error, when it carries one.
+ * @param {Error} error - Thrown error
+ * @returns {number} Status code, or 0 when the failure was not an HTTP response
+ */
+function statusOf(error) {
+  const status = error && (error.status || error.statusCode ||
+    (error.response && error.response.status));
+  return Number.isInteger(status) ? status : 0;
+}
+
+/**
+ * The API client resolves non-2xx responses as `{ success: false, status }` rather than
+ * throwing, so a failure that is only caught in a try/catch is reported as success. Verified
+ * against the live controller: a PUT to an undefined catalog key resolves with status 404.
+ * @param {Object} response - Resolved API response
+ * @returns {boolean} True when the call did not succeed
+ */
+function isFailedResponse(response) {
+  if (!response || typeof response !== 'object') {
+    return false;
+  }
+  if (response.success === false) {
+    return true;
+  }
+  const status = statusOf(response);
+  return status >= 400;
+}
+
+/**
+ * Classify a failure by owner. 403, 404 and transport failures need different messages
+ * because different people fix them; collapsing them to "failed to push" helps nobody.
+ * @param {Error} error - Thrown error
+ * @returns {{ outcome: string, fatal: boolean }} Outcome and whether remaining keys are pointless
+ */
+function classifyFailure(error) {
+  const status = statusOf(error);
+  if (status === 403 || status === 401) {
+    // Every remaining key fails the same way, so stop rather than repeat it.
+    return { outcome: OUTCOME.forbidden, fatal: true };
+  }
+  if (status === 404) {
+    return { outcome: OUTCOME.notInCatalog, fatal: false };
+  }
+  if (status === 409) {
+    return { outcome: OUTCOME.conflict, fatal: true };
+  }
+  return { outcome: OUTCOME.unreachable, fatal: false };
+}
+
+/**
+ * A secrets file that git does not ignore is one `git add .` away from being committed, and
+ * a committed secret is disclosed no matter what happens afterwards. Refuse rather than
+ * read it. An untracked path outside any repository is fine — there is nothing to commit to.
+ *
+ * @param {string} filePath - Env file path
+ * @param {Object} [deps] - `execFileSync` for tests
+ * @returns {boolean} True when git ignores the file, or the path is not in a repository
+ */
+function isIgnoredByGit(filePath, deps = {}) {
+  const exec = deps.execFileSync || execFileSync;
+  const cwd = path.dirname(filePath);
+  try {
+    exec('git', ['check-ignore', '-q', '--', filePath], { cwd, stdio: 'ignore' });
+    return true;
+  } catch (error) {
+    // check-ignore exits 1 when the path is NOT ignored, and 128 outside a repository.
+    return statusOf(error) === 128 || (error && error.status === 128);
+  }
+}
+
+/**
+ * @param {string} filePath - Env file path
+ * @param {Object} [deps] - `execFileSync` for tests
+ * @returns {string} File content
+ * @throws {Error} When the file is missing or git does not ignore it
+ */
+function readEnvFile(filePath, deps = {}) {
+  if (!filePath || !fs.existsSync(filePath)) {
+    throw new Error(`Env file not found: ${filePath || '(no path resolved)'}`);
+  }
+  if (!isIgnoredByGit(filePath, deps)) {
+    throw new Error(
+      `Refusing to read ${filePath}: git does not ignore it. ` +
+      'A secrets file inside a tracked path can be committed by accident. ' +
+      'Add it to .gitignore, or pass --file with a path outside the repository.'
+    );
+  }
+  return fs.readFileSync(filePath, 'utf8');
+}
+
+/**
+ * Push one row. Returns an outcome; never returns or throws the value.
+ * @param {Object} deps - Injected api
+ * @param {Object} ctx - controllerUrl, authConfig, envKey
+ * @param {Object} row - name, catalogKey, value
+ * @returns {Promise<{ name: string, catalogKey: string, outcome: string, fatal?: boolean }>} Result
+ */
+async function pushRow(deps, ctx, row) {
+  const api = deps.api || {
+    putSystemSecret, listEnvironmentConfiguration, putEnvironmentConfiguration
+  };
+  try {
+    const common = [ctx.controllerUrl, ctx.authConfig, ctx.envKey];
+    const response = row.sensitive
+      ? await api.putSystemSecret(
+        ...common, row.catalogKey, row.value, row.revision
+      )
+      : await api.putEnvironmentConfiguration(
+        ...common, row.application, row.catalogKey,
+        { value: row.value, revision: row.revision }
+      );
+    if (isFailedResponse(response)) {
+      const { outcome, fatal } = classifyFailure(response);
+      return { name: row.name, catalogKey: row.catalogKey, outcome, fatal };
+    }
+    return { name: row.name, catalogKey: row.catalogKey, outcome: OUTCOME.updated };
+  } catch (error) {
+    const { outcome, fatal } = classifyFailure(error);
+    return { name: row.name, catalogKey: row.catalogKey, outcome, fatal };
+  }
+}
+
+module.exports = {
+  OUTCOME,
+  classifyFailure,
+  statusOf,
+  isIgnoredByGit,
+  isFailedResponse,
+  readEnvFile,
+  pushRow
+};

package/lib/commands/repair-datasource-apply.js

@@ -8,6 +8,7 @@
 
 'use strict';
 
+const { repairKeyedDocument } = require('./repair-datasource-keyed-document');
 const { repairOpenapiSection } = require('./repair-datasource-openapi');
 const { repairSyncOperationsFromCapabilities } = require('./repair-datasource-sync-operations');
 const { normalizeAutoRbacOperationKeys } = require('./repair-datasource-auto-rbac');
@@ -132,6 +133,7 @@ function runRepairDatasourceFile(parsed, options, changes, helpers) {
 
   const none = helpers.isNoneEntityType(parsed?.entityType);
 
+  updated = repairKeyedDocument(parsed, options, out) || updated;
   updated = applyBaseDatasourceRepairs(parsed, none, out, options, helpers) || updated;
   updated = applyOpenapiDatasourceRepairs(parsed, out) || updated;
   updated = applyOptionalDatasourceRepairs(parsed, options, none, out, helpers) || updated;

package/lib/commands/repair-datasource-keyed-document.js

@@ -0,0 +1,122 @@
+/**
+ * @fileoverview Generate keyed document retrieval from vendor OpenAPI response media types.
+ * @author AI Fabrix Team
+ */
+'use strict';
+
+const fs = require('fs');
+const { toCamelCaseKey } = require('./repair-datasource-auto-rbac');
+const { loadConfigFile } = require('../utils/config-format');
+const { documentKeyToLocalOpenApiPath } = require('./repair-openapi-export');
+const { findVendorOperation } = require('../validation/openapi-contract-vendor-validation');
+
+/** @param {Object} ds @param {Object} options @returns {Object|null} */
+function loadVendorSpec(ds, options) {
+  if (options.openapiSpec) return options.openapiSpec;
+  if (!options.appPath || !ds.openapi?.documentKey) return null;
+  const file = documentKeyToLocalOpenApiPath(options.appPath, ds.systemKey || '', ds.openapi.documentKey);
+  return fs.existsSync(file) ? loadConfigFile(file) : null;
+}
+
+/** @param {Object} operation @returns {Object[]} */
+function binaryResponses(operation) {
+  return Object.entries(operation?.responses || {})
+    .filter(([status]) => /^2(?:\d\d|XX)$/i.test(status))
+    .map(([, response]) => response)
+    .filter(response => Object.keys(response?.content || {}).some(type =>
+      /^(application\/(octet-stream|pdf)|image\/[^;]+)(;|$)/i.test(type)));
+}
+
+/** @param {Object} ds @param {Object} operation @param {Object[]} responses */
+function addMetadataMappings(ds, operation, responses) {
+  ds.fieldMappings = ds.fieldMappings || {};
+  ds.fieldMappings.attributes = ds.fieldMappings.attributes || {};
+  const attributes = ds.fieldMappings.attributes;
+  for (const response of responses) {
+    for (const name of Object.keys(response.headers || {})) {
+      addMappingStub(attributes, name, 'headers');
+    }
+  }
+  for (const param of operation.parameters || []) {
+    if (param.required && ['query', 'path'].includes(param.in) && param.name) {
+      addMappingStub(attributes, param.name, 'params');
+    }
+  }
+}
+
+/** @param {Object} attributes @param {string} name @param {string} source */
+function addMappingStub(attributes, name, source) {
+  const key = toCamelCaseKey(name);
+  if (!/^[a-z][a-zA-Z0-9]*$/.test(key) || Object.hasOwn(attributes, key)) return;
+  attributes[key] = { expression: `{{raw.${source}.${name}}}` };
+}
+
+/** @param {Object} ds @param {string} ref @returns {Object[]} */
+function ensureGetSteps(ds, ref) {
+  ds.execution = ds.execution || {};
+  ds.execution.engine = 'cip';
+  ds.execution.cip = ds.execution.cip || { version: '1.0', operations: {} };
+  ds.execution.cip.operations = ds.execution.cip.operations || {};
+  const operations = ds.execution.cip.operations;
+  if (!operations.get) {
+    operations.get = { steps: [
+      { fetch: { source: 'openapi', openapiRef: ref, responseType: 'binary' } },
+      { map: { useFieldMappings: true } },
+      { filter: { abac: { mode: 'mandatory' } } },
+      { output: { mode: 'documents' } }
+    ] };
+  }
+  return Array.isArray(operations.get.steps) ? operations.get.steps : [];
+}
+
+/**
+ * Leave list-based document sync and author-owned unrelated operations unchanged.
+ * @param {Object} ds - Datasource, mutated
+ * @param {Object} options - Vendor spec or local appPath
+ * @param {string[]} changes - Repair log
+ * @returns {boolean}
+ */
+function repairKeyedDocument(ds, options = {}, changes = []) {
+  const candidate = keyedDocumentCandidate(ds, options);
+  if (!candidate) return false;
+  const { ref, vendor, responses } = candidate;
+  const before = JSON.stringify(ds);
+  const getSteps = ensureGetSteps(ds, ref);
+  if (!getSteps.some(step => step?.fetch) || !getSteps.some(step => step?.output)) return false;
+  for (const step of getSteps) {
+    if (step?.fetch && (step.fetch.openapiRef || 'get') === ref) step.fetch.responseType = 'binary';
+    if (step?.output) step.output.mode = 'documents';
+  }
+  ds.documentStorage = { enabled: true, ingestAfterSync: true,
+    ...ds.documentStorage, responseType: 'binary', binaryOperationRef: 'get' };
+  addMetadataMappings(ds, vendor, responses);
+  if (JSON.stringify(ds) === before) return false;
+  changes.push('Configured keyed binary get with documents output and header/parameter mappings');
+  return true;
+}
+
+/** @param {Object} ds @param {Object} options @returns {Object|null} */
+function keyedDocumentCandidate(ds, options) {
+  if (!['documentStorage', 'document-storage'].includes(ds?.entityType)) return null;
+  if (!canGenerateKeyedDocument(ds)) return null;
+  const operations = ds.execution?.cip?.operations || {};
+  const steps = operations.get?.steps || [];
+  const fetch = steps.find(step => step?.fetch)?.fetch;
+  if (fetch && !['openapi', undefined].includes(fetch.source)) return null;
+  const ref = fetch?.openapiRef || 'get';
+  const binding = ds.openapi?.operations?.[ref];
+  const vendor = findVendorOperation(loadVendorSpec(ds, options), binding);
+  const responses = binaryResponses(vendor);
+  return responses.length ? { ref, vendor, responses } : null;
+}
+
+/** @param {Object} ds @returns {boolean} */
+function canGenerateKeyedDocument(ds) {
+  if (ds.execution?.cip?.operations?.list || ds.openapi?.operations?.list) return false;
+  if (ds.capabilities?.some(cap => (cap.key || cap) === 'list')) return false;
+  if (ds.documentStorage?.enabled === false) return false;
+  if (ds.execution?.engine && ds.execution.engine !== 'cip') return false;
+  return !ds.documentStorage?.binaryOperationRef || ds.documentStorage.binaryOperationRef === 'get';
+}
+
+module.exports = { repairKeyedDocument };

package/lib/commands/repair-datasource-run.js

@@ -37,6 +37,7 @@ function runDatasourceRepairs(appPath, datasourceFiles, options, dryRun, changes
     try {
       const parsed = loadConfigFile(filePath);
       const { updated: fileUpdated, changes: fileChanges } = repairDatasourceFile(parsed, {
+        appPath,
         expose: options.expose,
         sync: options.sync,
         test: options.test,

package/lib/commands/role-assistant.js

@@ -41,6 +41,10 @@ const {
   patchCaseStatusAfterRun
 } = require('../role-assistant/test-pack-sync');
 const { collectString } = require('./governance');
+const {
+  hasRoleAssistantTestSubject,
+  runPublishedCaseAsSubject
+} = require('../role-assistant/test-job-runner');
 const {
   sectionTitle,
   headerKeyValue,
@@ -338,6 +342,9 @@ async function resolveExecutableCaseResult(roleKey, roleCase, opts, result, verd
     run: false,
     noPublish: true
   });
+  if (hasRoleAssistantTestSubject(opts)) {
+    return runPublishedCaseAsSubject(roleKey, roleCase, opts, authContext);
+  }
   const evidencePreflight = await assertRoleAssistantEvidencePreflight(roleCase, authContext);
   const executionResult = await runRoleAssistantCaseLifecycle(roleKey, roleCase, authContext, opts);
   const executionVerdict = lifecycleVerdictFromCaseExecution(executionResult, verdict);

package/lib/commands/setup-modes.js

@@ -322,8 +322,7 @@ function removeUserLocalSecrets() {
 }
 
 /**
- * Fresh install: wizard collects admin email + password, then AI tool keys,
- * then up-infra + up-platform.
+ * Fresh install: wizard collects admin credentials, then runs up-infra + up-platform.
  *
  * @async
  * @param {{ adminEmail: string, adminPassword?: string, passwordBundle?: object }} adminCreds
@@ -345,9 +344,6 @@ async function runFreshInstall(adminCreds) {
   });
   stopSpinnerSuccess(infraSpin, 'Infrastructure ready');
   await runSetupImageRefresh({ quiet: true });
-  // Bring up infra first, then collect optional platform-level secrets (AI tool)
-  // so the flow feels like a product installer: infra → platform configuration → platform services.
-  await setupPrompts.promptAiTool({ silentIfConfigured: true });
   // Fresh-install should reset dev defaults (env + controller URL) the same way
   // as other setup recovery paths, otherwise the platform can come up pointed at
   // stale configuration.
@@ -382,7 +378,6 @@ async function runReinstall() {
   await runSetupImageRefresh({ quiet: true });
   const adminCreds = await setupPrompts.promptAdminCredentials();
   await config.setAdminEmail(adminCreds.adminEmail);
-  await setupPrompts.promptAiTool({ silentIfConfigured: true });
   const infraSpin = startSpinner('Starting infrastructure...');
   await startInfraFromConfig({
     adminEmail: adminCreds.adminEmail,
@@ -436,7 +431,6 @@ async function runWipeData() {
   });
   stopSpinnerSuccess(wipeSpin, 'Databases reset');
   await runSetupImageRefresh({ quiet: true });
-  await setupPrompts.promptAiTool({ silentIfConfigured: true });
   const infraSpin = startSpinner('Starting infrastructure...');
   await startInfraFromConfig({});
   stopSpinnerSuccess(infraSpin, 'Infrastructure ready');
@@ -460,7 +454,6 @@ async function runWipeData() {
  */
 async function runUpdateImages() {
   await runSetupImageRefresh({ quiet: true });
-  await setupPrompts.promptAiTool({ silentIfConfigured: true });
   const infraSpin = startSpinner('Starting infrastructure...');
   await startInfraFromConfig({});
   stopSpinnerSuccess(infraSpin, 'Infrastructure ready');