@assistkick/create 1.0.1 → 1.3.0

package/templates/assistkick-product-system/packages/backend/src/routes/terminal.ts

@@ -0,0 +1,82 @@
+/**
+ * Terminal session routes — REST API for managing named PTY sessions.
+ * GET    /api/terminal/sessions           — list all active sessions
+ * POST   /api/terminal/sessions           — create a new named session
+ * DELETE /api/terminal/sessions/:id       — kill and remove a session
+ *
+ * Admin-only: all routes require admin role.
+ */
+
+import { Router } from 'express';
+import type { Request, Response } from 'express';
+import type { PtySessionManager } from '../services/pty_session_manager.js';
+
+interface TerminalRoutesDeps {
+  ptyManager: PtySessionManager;
+  log: (tag: string, ...args: unknown[]) => void;
+}
+
+const requireAdmin = (req: Request, res: Response, next: () => void): void => {
+  const user = (req as any).user;
+  if (!user || user.role !== 'admin') {
+    res.status(403).json({ error: 'Admin privileges required' });
+    return;
+  }
+  next();
+};
+
+export const createTerminalRoutes = ({ ptyManager, log }: TerminalRoutesDeps): Router => {
+  const router: Router = Router();
+
+  router.use(requireAdmin as any);
+
+  // GET /api/terminal/sessions
+  router.get('/sessions', (_req, res) => {
+    const sessions = ptyManager.listSessions();
+    res.json({ sessions });
+  });
+
+  // POST /api/terminal/sessions
+  router.post('/sessions', (req, res) => {
+    const { projectId, projectName } = req.body;
+
+    if (!projectId || typeof projectId !== 'string') {
+      res.status(400).json({ error: 'projectId is required' });
+      return;
+    }
+    if (!projectName || typeof projectName !== 'string') {
+      res.status(400).json({ error: 'projectName is required' });
+      return;
+    }
+
+    const session = ptyManager.createSession(projectId.trim(), projectName.trim(), 80, 24);
+    log('TERMINAL', `Created session "${session.name}" for project ${projectId}`);
+    res.status(201).json({
+      session: {
+        id: session.id,
+        name: session.name,
+        projectId: session.projectId,
+        projectName: session.projectName,
+        state: session.state,
+        createdAt: session.createdAt.toISOString(),
+      },
+    });
+  });
+
+  // DELETE /api/terminal/sessions/:id
+  router.delete('/sessions/:id', (req, res) => {
+    const { id } = req.params;
+    const session = ptyManager.getSession(id);
+
+    if (!session) {
+      res.status(404).json({ error: 'Session not found' });
+      return;
+    }
+
+    ptyManager.destroySession(id);
+    log('TERMINAL', `Killed session ${id}`);
+    res.json({ ok: true });
+  });
+
+  return router;
+};

package/templates/{product-system → assistkick-product-system}/packages/backend/src/server.ts

@@ -16,7 +16,7 @@ import { fileURLToPath } from 'node:url';
 import { existsSync } from 'node:fs';
 import { WebSocketServer } from 'ws';
 import * as pty from 'node-pty';
-import { initServices, log } from './services/init.js';
+import { initServices, log, githubAppService, workspaceService } from './services/init.js';
 import { AuthService } from './services/auth_service.js';
 import { EmailService } from './services/email_service.js';
 import { PasswordResetService } from './services/password_reset_service.js';
@@ -29,14 +29,16 @@ import { AuthMiddleware } from './middleware/auth_middleware.js';
 import { createAuthRoutes } from './routes/auth.js';
 import { createUserRoutes } from './routes/users.js';
 import { createProjectRoutes } from './routes/projects.js';
-import { getDb } from '@interview-system/shared/lib/db.js';
+import { createTerminalRoutes } from './routes/terminal.js';
+import { getDb } from '@assistkick/shared/lib/db.js';
 import graphRoutes from './routes/graph.js';
 import kanbanRoutes from './routes/kanban.js';
 import pipelineRoutes from './routes/pipeline.js';
 import coherenceRoutes from './routes/coherence.js';
+import { createGitRoutes } from './routes/git.js';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
-const DEFAULT_PORT = 3000;
+const DEFAULT_PORT = parseInt(process.env.PORT || '3000', 10);
 
 const parseArgs = (argv: string[]) => {
   const args = { port: DEFAULT_PORT, verbose: false };
@@ -68,8 +70,8 @@ app.use((req, res, next) => {
   const start = Date.now();
   res.on('finish', () => {
     const duration = Date.now() - start;
-    // Skip noisy pipeline polls
-    if (req.originalUrl.endsWith('/pipeline')) return;
+    // Skip noisy pipeline and orchestrator status polls
+    if (req.originalUrl.endsWith('/pipeline') || req.originalUrl.endsWith('/orchestrator-status')) return;
     log('HTTP', `${req.method} ${req.originalUrl} ${res.statusCode} ${duration}ms`);
   });
   next();
@@ -80,7 +82,7 @@ const jwtSecret = process.env.JWT_SECRET || 'dev-secret-change-in-production';
 const isProduction = process.env.NODE_ENV === 'production';
 const authService = new AuthService({ jwtSecret, isProduction });
 const resendApiKey = process.env.RESEND_API_KEY || '';
-const appBaseUrl = process.env.APP_BASE_URL || 'https://product-system.localhost';
+const appBaseUrl = process.env.APP_BASE_URL || 'https://assistkick.localhost';
 const emailFromAddress = process.env.EMAIL_FROM || 'noreply@example.com';
 const emailService = new EmailService({ apiKey: resendApiKey, fromAddress: emailFromAddress });
 const passwordResetService = new PasswordResetService({ getDb, emailService, authService, appBaseUrl, log });
@@ -101,15 +103,29 @@ const projectService = new ProjectService({ getDb, log });
 const projectRoutes = createProjectRoutes({ projectService, log });
 app.use('/api/projects', authMiddleware.requireAuth, projectRoutes);
 
+// Git repository routes (nested under /api/projects/:id/git)
+const gitRoutes = createGitRoutes({ projectService, githubAppService, workspaceService, log });
+app.use('/api/projects/:id/git', authMiddleware.requireAuth, gitRoutes);
+
 // Ensure default project exists and assign orphan nodes on startup
 projectService.ensureDefaultAndAssignOrphans().catch((err: any) => {
   log('STARTUP', `Failed to ensure default project: ${err.message}`);
 });
 
+// PTY session manager — initialized early so terminal REST routes can reference it
+// Resolve project root: from packages/backend/src → assistkick-product-system → repo root
+const PROJECT_ROOT = join(__dirname, '..', '..', '..', '..');
+const ptyManager = new PtySessionManager({ spawn: pty.spawn, log, projectRoot: PROJECT_ROOT });
+
+// Terminal session management REST routes (admin-only, auth required)
+const terminalRoutes = createTerminalRoutes({ ptyManager, log });
+app.use('/api/terminal', authMiddleware.requireAuth, terminalRoutes);
+
 // Protected API routes — require authentication
 app.use('/api', authMiddleware.requireAuth, graphRoutes);
 app.use('/api/kanban', authMiddleware.requireAuth, kanbanRoutes);
 app.use('/api/kanban', authMiddleware.requireAuth, pipelineRoutes);
+app.use('/api/pipeline', authMiddleware.requireAuth, pipelineRoutes);
 app.use('/api/coherence', authMiddleware.requireAuth, coherenceRoutes);
 
 // Redirect favicon.ico to SVG favicon served from static files
@@ -130,9 +146,6 @@ const server = createServer(app);
 
 // Set up WebSocket for terminal
 const wss = new WebSocketServer({ noServer: true });
-// Resolve project root: from packages/backend/src → product-system → repo root
-const PROJECT_ROOT = join(__dirname, '..', '..', '..', '..');
-const ptyManager = new PtySessionManager({ spawn: pty.spawn, log, projectRoot: PROJECT_ROOT });
 const terminalHandler = new TerminalWsHandler({ wss, authService, ptyManager, log });
 
 server.on('upgrade', (req, socket, head) => {
@@ -152,7 +165,7 @@ server.listen(args.port, () => {
   if (existsSync(FRONTEND_DIST)) {
     log('SERVER', `Serving frontend from ${FRONTEND_DIST}`);
   } else {
-    log('SERVER', `No frontend dist found — run "pnpm --filter @interview-system/frontend build" first, or use dev mode`);
+    log('SERVER', `No frontend dist found — run "pnpm --filter @assistkick/frontend build" first, or use dev mode`);
   }
 });
 

package/templates/{product-system → assistkick-product-system}/packages/backend/src/services/coherence-review.ts

@@ -4,10 +4,10 @@
 
 import { join } from 'node:path';
 import { randomUUID } from 'node:crypto';
-import { readGraph, removeEdge as removeEdgeDb, patchNode as patchNodeDb } from '@interview-system/shared/lib/graph.js';
-import { loadCoherence, saveCoherence, getDismissalKey, sortProposals } from '@interview-system/shared/lib/coherence.js';
-import { getDb } from '@interview-system/shared/lib/db.js';
-import { nodes } from '@interview-system/shared/db/schema.js';
+import { readGraph, removeEdge as removeEdgeDb, patchNode as patchNodeDb } from '@assistkick/shared/lib/graph.js';
+import { loadCoherence, saveCoherence, getDismissalKey, sortProposals } from '@assistkick/shared/lib/coherence.js';
+import { getDb } from '@assistkick/shared/lib/db.js';
+import { nodes } from '@assistkick/shared/db/schema.js';
 import { eq } from 'drizzle-orm';
 import { claudeService, paths, log } from './init.js';
 

package/templates/assistkick-product-system/packages/backend/src/services/github_app_service.ts

@@ -0,0 +1,146 @@
+/**
+ * GitHubAppService — generates installation access tokens for GitHub App authentication.
+ * Uses env vars GITHUB_APP_ID and GITHUB_APP_PRIVATE_KEY.
+ * Tokens are short-lived (1 hour) and scoped to a specific installation.
+ */
+
+import { SignJWT, importPKCS8 } from 'jose';
+
+interface GitHubAppServiceDeps {
+  log: (tag: string, ...args: any[]) => void;
+}
+
+interface Installation {
+  id: number;
+  account: { login: string; type: string };
+  app_id: number;
+  target_type: string;
+}
+
+interface InstallationRepo {
+  id: number;
+  full_name: string;
+  private: boolean;
+  default_branch: string;
+  clone_url: string;
+}
+
+export class GitHubAppService {
+  private readonly log: (tag: string, ...args: any[]) => void;
+
+  constructor({ log }: GitHubAppServiceDeps) {
+    this.log = log;
+  }
+
+  private getAppId = (): string => {
+    const appId = process.env.GITHUB_APP_ID;
+    if (!appId) throw new Error('GITHUB_APP_ID environment variable is not set');
+    return appId;
+  };
+
+  private getPrivateKey = (): string => {
+    const key = process.env.GITHUB_APP_PRIVATE_KEY;
+    if (!key) throw new Error('GITHUB_APP_PRIVATE_KEY environment variable is not set');
+    // Support both raw PEM and base64-encoded PEM (for env vars that can't contain newlines)
+    if (key.startsWith('-----BEGIN')) return key;
+    return Buffer.from(key, 'base64').toString('utf-8');
+  };
+
+  /** Check whether GitHub App credentials are configured. */
+  isConfigured = (): boolean => {
+    return !!(process.env.GITHUB_APP_ID && process.env.GITHUB_APP_PRIVATE_KEY);
+  };
+
+  /** Generate a JWT signed with the App's private key (valid for 10 minutes). */
+  private generateJwt = async (): Promise<string> => {
+    const appId = this.getAppId();
+    const privateKeyPem = this.getPrivateKey();
+    const privateKey = await importPKCS8(privateKeyPem, 'RS256');
+
+    const now = Math.floor(Date.now() / 1000);
+    const jwt = await new SignJWT({})
+      .setProtectedHeader({ alg: 'RS256' })
+      .setIssuer(appId)
+      .setIssuedAt(now - 60) // clock skew tolerance
+      .setExpirationTime(now + 600) // 10 minutes
+      .sign(privateKey);
+
+    return jwt;
+  };
+
+  /** Get a short-lived installation access token for git operations. */
+  getInstallationToken = async (installationId: string): Promise<string> => {
+    const jwt = await this.generateJwt();
+    this.log('GITHUB', `Requesting installation token for installation ${installationId}`);
+
+    const resp = await fetch(`https://api.github.com/app/installations/${installationId}/access_tokens`, {
+      method: 'POST',
+      headers: {
+        'Authorization': `Bearer ${jwt}`,
+        'Accept': 'application/vnd.github+json',
+        'X-GitHub-Api-Version': '2022-11-28',
+      },
+    });
+
+    if (!resp.ok) {
+      const body = await resp.text();
+      throw new Error(`GitHub API error (${resp.status}): ${body}`);
+    }
+
+    const data = await resp.json();
+    this.log('GITHUB', `Installation token obtained, expires at ${data.expires_at}`);
+    return data.token;
+  };
+
+  /** List all installations of this GitHub App. */
+  listInstallations = async (): Promise<Installation[]> => {
+    const jwt = await this.generateJwt();
+
+    const resp = await fetch('https://api.github.com/app/installations', {
+      headers: {
+        'Authorization': `Bearer ${jwt}`,
+        'Accept': 'application/vnd.github+json',
+        'X-GitHub-Api-Version': '2022-11-28',
+      },
+    });
+
+    if (!resp.ok) {
+      const body = await resp.text();
+      throw new Error(`GitHub API error (${resp.status}): ${body}`);
+    }
+
+    return resp.json();
+  };
+
+  /** List repositories accessible to a specific installation. */
+  listInstallationRepos = async (installationId: string): Promise<InstallationRepo[]> => {
+    const token = await this.getInstallationToken(installationId);
+
+    const resp = await fetch('https://api.github.com/installation/repositories?per_page=100', {
+      headers: {
+        'Authorization': `token ${token}`,
+        'Accept': 'application/vnd.github+json',
+        'X-GitHub-Api-Version': '2022-11-28',
+      },
+    });
+
+    if (!resp.ok) {
+      const body = await resp.text();
+      throw new Error(`GitHub API error (${resp.status}): ${body}`);
+    }
+
+    const data = await resp.json();
+    return data.repositories;
+  };
+
+  /** Build an authenticated clone URL using an installation token. */
+  buildAuthenticatedCloneUrl = async (installationId: string, repoFullName: string): Promise<string> => {
+    const token = await this.getInstallationToken(installationId);
+    return `https://x-access-token:${token}@github.com/${repoFullName}.git`;
+  };
+
+  /** Configure git credential helper for a workspace to use installation tokens. */
+  buildGitCredentialUrl = (token: string, repoFullName: string): string => {
+    return `https://x-access-token:${token}@github.com/${repoFullName}.git`;
+  };
+}

package/templates/assistkick-product-system/packages/backend/src/services/init.ts

@@ -0,0 +1,147 @@
+/**
+ * Service initialization — creates pipeline, claude service, and related instances.
+ * Deferred until VERBOSE flag is set at startup.
+ */
+
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { existsSync } from 'node:fs';
+import { createClaudeService } from '@assistkick/shared/lib/claude-service.js';
+import { Pipeline } from '@assistkick/shared/lib/pipeline.js';
+import { PipelineStateStore } from '@assistkick/shared/lib/pipeline-state-store.js';
+import { PromptBuilder } from '@assistkick/shared/lib/prompt_builder.js';
+import { GitWorkflow } from '@assistkick/shared/lib/git_workflow.js';
+import { getDb } from '@assistkick/shared/lib/db.js';
+import { loadKanban, getKanbanEntry, saveKanbanEntry } from '@assistkick/shared/lib/kanban.js';
+import { readGraph, getNode } from '@assistkick/shared/lib/graph.js';
+import { WorkSummaryParser } from '@assistkick/shared/lib/work_summary_parser.js';
+import { PipelineOrchestrator } from '@assistkick/shared/lib/pipeline_orchestrator.js';
+import { GitHubAppService } from './github_app_service.js';
+import { ProjectWorkspaceService } from './project_workspace_service.js';
+import { ProjectService } from './project_service.js';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+// Navigate from packages/backend/src/services/ up to assistkick-product-system/
+const SKILL_ROOT = join(__dirname, '..', '..', '..', '..');
+const SHARED_DIR = join(SKILL_ROOT, 'packages', 'shared');
+
+const IS_DEV = import.meta.url.endsWith('.ts');
+const TOOL_EXT = IS_DEV ? '.ts' : '.js';
+const TOOL_RUNNER = IS_DEV ? 'tsx' : 'node';
+const TOOLS_DIR = IS_DEV ? join(SHARED_DIR, 'tools') : join(__dirname, '..', '..', '..', 'shared', 'build', 'tools');
+const DATA_DIR = SHARED_DIR;
+const PROJECT_ROOT = join(SKILL_ROOT, '..');
+const SKILLS_DIR = join(PROJECT_ROOT, '.claude', 'skills');
+const WORKTREES_DIR = join(PROJECT_ROOT, '.worktrees');
+const DEVELOPER_SKILL_PATH = join(SKILLS_DIR, 'product-developer', 'SKILL.md');
+const REVIEWER_SKILL_PATH = join(SKILLS_DIR, 'product-code-reviewer', 'SKILL.md');
+const DEBUGGER_SKILL_PATH = join(SKILLS_DIR, 'product-debugger', 'SKILL.md');
+
+export const log = (tag: string, ...args: any[]) => {
+  const ts = new Date().toISOString().slice(11, 23);
+  console.log(`[${ts}] [${tag}]`, ...args);
+};
+
+export let claudeService: any;
+export let pipeline: any;
+export let pipelineStateStore: any;
+export let orchestrator: PipelineOrchestrator;
+export let githubAppService: GitHubAppService;
+export let workspaceService: ProjectWorkspaceService;
+
+export const paths = {
+  projectRoot: PROJECT_ROOT,
+  worktreesDir: WORKTREES_DIR,
+  skillsDir: SKILLS_DIR,
+  toolsDir: TOOLS_DIR,
+  dataDir: DATA_DIR,
+  developerSkillPath: DEVELOPER_SKILL_PATH,
+  reviewerSkillPath: REVIEWER_SKILL_PATH,
+  debuggerSkillPath: DEBUGGER_SKILL_PATH,
+  toolExt: TOOL_EXT,
+  toolRunner: TOOL_RUNNER,
+};
+
+export const initServices = (verbose: boolean) => {
+  claudeService = createClaudeService({ verbose, log });
+  pipelineStateStore = new PipelineStateStore({ getDb });
+  const promptBuilder = new PromptBuilder({ paths, log });
+  const gitWorkflow = new GitWorkflow({ claudeService, projectRoot: PROJECT_ROOT, worktreesDir: WORKTREES_DIR, log });
+  const workSummaryParser = new WorkSummaryParser();
+
+  // New services for project git repo integration
+  githubAppService = new GitHubAppService({ log });
+  workspaceService = new ProjectWorkspaceService({ claudeService, projectRoot: PROJECT_ROOT, log });
+  const projectService = new ProjectService({ getDb, log });
+
+  /**
+   * Resolve a project-scoped workspace for the pipeline.
+   * Returns a GitWorkflow pointing to the project workspace + an afterMerge hook
+   * that pushes to the remote. Returns null if no workspace is configured.
+   */
+  const resolveProjectWorkspace = async (projectId: string) => {
+    const project = await projectService.getById(projectId);
+    if (!project) return null;
+
+    // Check if project has a workspace
+    if (!workspaceService.hasWorkspace(projectId)) {
+      // No workspace — use default behavior
+      return null;
+    }
+
+    const wsPath = workspaceService.getWorkspacePath(projectId);
+    const wsWorktreesDir = workspaceService.getWorktreesDir(projectId);
+
+    const projectGitWorkflow = new GitWorkflow({
+      claudeService,
+      projectRoot: wsPath,
+      worktreesDir: wsWorktreesDir,
+      log,
+    });
+
+    // Build afterMerge hook for pushing to remote
+    let afterMerge = null;
+    if (project.repoUrl && project.githubInstallationId && project.githubRepoFullName) {
+      afterMerge = async () => {
+        // Get a fresh token for push
+        const token = await githubAppService.getInstallationToken(project.githubInstallationId!);
+        const authUrl = `https://x-access-token:${token}@github.com/${project.githubRepoFullName}.git`;
+        await projectGitWorkflow.setRemoteUrl(authUrl);
+        try {
+          const branch = project.baseBranch || 'main';
+          await projectGitWorkflow.pushToRemote(branch);
+        } finally {
+          // Reset to non-authenticated URL
+          await projectGitWorkflow.setRemoteUrl(`https://github.com/${project.githubRepoFullName}.git`).catch(() => {});
+        }
+      };
+    }
+
+    return { gitWorkflow: projectGitWorkflow, afterMerge };
+  };
+
+  pipeline = new Pipeline({
+    promptBuilder,
+    gitWorkflow,
+    claudeService,
+    kanban: { getKanbanEntry, saveKanbanEntry },
+    paths,
+    log,
+    stateStore: pipelineStateStore,
+    workSummaryParser,
+    getNode,
+    resolveProjectWorkspace,
+  });
+
+  orchestrator = new PipelineOrchestrator({
+    pipeline,
+    loadKanban,
+    readGraph,
+    log,
+  });
+
+  // Mark any active pipeline states as interrupted (server restart recovery)
+  pipelineStateStore.markInterrupted().catch((err: any) => {
+    log('STARTUP', `Failed to mark interrupted pipelines: ${err.message}`);
+  });
+};

package/templates/{product-system → assistkick-product-system}/packages/backend/src/services/invitation_service.ts

@@ -6,7 +6,7 @@
 import { randomBytes, randomUUID } from 'node:crypto';
 import { hash, compare } from 'bcryptjs';
 import { eq } from 'drizzle-orm';
-import { users, invitations } from '@interview-system/shared/db/schema.js';
+import { users, invitations } from '@assistkick/shared/db/schema.js';
 import type { EmailService } from './email_service.js';
 import type { AuthService } from './auth_service.js';
 

package/templates/{product-system → assistkick-product-system}/packages/backend/src/services/password_reset_service.ts

@@ -6,7 +6,7 @@
 import { randomBytes, randomUUID } from 'node:crypto';
 import { hash, compare } from 'bcryptjs';
 import { eq, and } from 'drizzle-orm';
-import { users, passwordResetTokens } from '@interview-system/shared/db/schema.js';
+import { users, passwordResetTokens } from '@assistkick/shared/db/schema.js';
 import type { EmailService } from './email_service.js';
 import type { AuthService } from './auth_service.js';
 

package/templates/{product-system → assistkick-product-system}/packages/backend/src/services/project_service.ts

@@ -4,7 +4,7 @@
  */
 
 import { eq, isNull } from 'drizzle-orm';
-import { projects, nodes, edges, kanban, sessions } from '@interview-system/shared/db/schema.js';
+import { projects, nodes, edges, kanban, sessions } from '@assistkick/shared/db/schema.js';
 import { randomBytes } from 'node:crypto';
 
 interface ProjectServiceDeps {
@@ -17,6 +17,10 @@ export interface ProjectRecord {
   name: string;
   isDefault: number;
   archivedAt: string | null;
+  repoUrl: string | null;
+  githubInstallationId: string | null;
+  githubRepoFullName: string | null;
+  baseBranch: string | null;
   createdAt: string;
   updatedAt: string;
 }
@@ -64,6 +68,10 @@ export class ProjectService {
       name,
       isDefault: 0,
       archivedAt: null,
+      repoUrl: null,
+      githubInstallationId: null,
+      githubRepoFullName: null,
+      baseBranch: null,
       createdAt: now,
       updatedAt: now,
     };
@@ -139,6 +147,69 @@ export class ProjectService {
     return { ...existing, archivedAt: null, updatedAt: now };
   };
 
+  /** Connect a git repository to a project (stores repo metadata). */
+  connectRepo = async (id: string, opts: {
+    repoUrl: string;
+    githubInstallationId?: string;
+    githubRepoFullName?: string;
+    baseBranch?: string;
+  }): Promise<ProjectRecord> => {
+    const db = this.getDb();
+    const existing = await this.getById(id);
+    if (!existing) throw new Error('Project not found');
+
+    const now = new Date().toISOString();
+    await db
+      .update(projects)
+      .set({
+        repoUrl: opts.repoUrl,
+        githubInstallationId: opts.githubInstallationId || null,
+        githubRepoFullName: opts.githubRepoFullName || null,
+        baseBranch: opts.baseBranch || null,
+        updatedAt: now,
+      })
+      .where(eq(projects.id, id));
+
+    this.log('PROJECTS', `Connected repo to project ${id}: ${opts.repoUrl}`);
+    return {
+      ...existing,
+      repoUrl: opts.repoUrl,
+      githubInstallationId: opts.githubInstallationId || null,
+      githubRepoFullName: opts.githubRepoFullName || null,
+      baseBranch: opts.baseBranch || null,
+      updatedAt: now,
+    };
+  };
+
+  /** Disconnect a git repository from a project. */
+  disconnectRepo = async (id: string): Promise<ProjectRecord> => {
+    const db = this.getDb();
+    const existing = await this.getById(id);
+    if (!existing) throw new Error('Project not found');
+
+    const now = new Date().toISOString();
+    await db
+      .update(projects)
+      .set({
+        repoUrl: null,
+        githubInstallationId: null,
+        githubRepoFullName: null,
+        baseBranch: null,
+        updatedAt: now,
+      })
+      .where(eq(projects.id, id));
+
+    this.log('PROJECTS', `Disconnected repo from project ${id}`);
+    return {
+      ...existing,
+      repoUrl: null,
+      githubInstallationId: null,
+      githubRepoFullName: null,
+      baseBranch: null,
+      updatedAt: now,
+    };
+  };
+
   ensureDefaultAndAssignOrphans = async (): Promise<void> => {
     const db = this.getDb();