@assistkick/create 1.6.0 → 1.8.0

package/templates/assistkick-product-system/packages/backend/src/services/ssh_key_service.test.ts

@@ -0,0 +1,162 @@
+import { describe, it, mock, beforeEach, afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { SshKeyService } from './ssh_key_service.ts';
+import { existsSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+
+// 32-byte key as 64-char hex string
+const TEST_ENCRYPTION_KEY = 'a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2';
+
+const createService = () => {
+  return new SshKeyService({ log: mock.fn() });
+};
+
+describe('SshKeyService', () => {
+  let originalEncryptionKey: string | undefined;
+
+  beforeEach(() => {
+    originalEncryptionKey = process.env.ENCRYPTION_KEY;
+    process.env.ENCRYPTION_KEY = TEST_ENCRYPTION_KEY;
+  });
+
+  afterEach(() => {
+    if (originalEncryptionKey !== undefined) {
+      process.env.ENCRYPTION_KEY = originalEncryptionKey;
+    } else {
+      delete process.env.ENCRYPTION_KEY;
+    }
+  });
+
+  describe('generateKeyPair', () => {
+    it('generates a valid ED25519 keypair', () => {
+      const service = createService();
+      const keyPair = service.generateKeyPair();
+
+      // Public key should be in OpenSSH format
+      assert.ok(keyPair.publicKey.startsWith('ssh-ed25519 '));
+      // Private key should be in PEM format
+      assert.ok(keyPair.privateKey.includes('-----BEGIN PRIVATE KEY-----'));
+      assert.ok(keyPair.privateKey.includes('-----END PRIVATE KEY-----'));
+    });
+
+    it('generates different keys each time', () => {
+      const service = createService();
+      const keyPair1 = service.generateKeyPair();
+      const keyPair2 = service.generateKeyPair();
+
+      assert.notEqual(keyPair1.publicKey, keyPair2.publicKey);
+      assert.notEqual(keyPair1.privateKey, keyPair2.privateKey);
+    });
+  });
+
+  describe('encrypt / decrypt', () => {
+    it('round-trips plaintext through encrypt/decrypt', () => {
+      const service = createService();
+      const plaintext = '-----BEGIN PRIVATE KEY-----\nMIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEH\n-----END PRIVATE KEY-----';
+
+      const encrypted = service.encrypt(plaintext);
+      const decrypted = service.decrypt(encrypted);
+
+      assert.equal(decrypted, plaintext);
+    });
+
+    it('encrypted output is valid JSON with expected fields', () => {
+      const service = createService();
+      const encrypted = service.encrypt('test data');
+      const parsed = JSON.parse(encrypted);
+
+      assert.ok(parsed.iv, 'should have iv');
+      assert.ok(parsed.authTag, 'should have authTag');
+      assert.ok(parsed.ciphertext, 'should have ciphertext');
+    });
+
+    it('produces different ciphertexts for same plaintext (random IV)', () => {
+      const service = createService();
+      const plaintext = 'same plaintext';
+
+      const encrypted1 = service.encrypt(plaintext);
+      const encrypted2 = service.encrypt(plaintext);
+
+      assert.notEqual(encrypted1, encrypted2);
+    });
+
+    it('throws when ENCRYPTION_KEY is not set', () => {
+      delete process.env.ENCRYPTION_KEY;
+      const service = createService();
+
+      assert.throws(() => service.encrypt('test'), /ENCRYPTION_KEY/);
+    });
+
+    it('throws when ENCRYPTION_KEY has wrong length', () => {
+      process.env.ENCRYPTION_KEY = 'tooshort';
+      const service = createService();
+
+      assert.throws(() => service.encrypt('test'), /64-character hex/);
+    });
+
+    it('fails to decrypt with tampered ciphertext', () => {
+      const service = createService();
+      const encrypted = service.encrypt('secret data');
+      const parsed = JSON.parse(encrypted);
+
+      // Tamper with ciphertext
+      parsed.ciphertext = 'AAAA' + parsed.ciphertext.slice(4);
+      const tampered = JSON.stringify(parsed);
+
+      assert.throws(() => service.decrypt(tampered));
+    });
+  });
+
+  describe('writeTempKeyFile / removeTempKeyFile', () => {
+    it('writes a temp file with correct content and permissions', async () => {
+      const service = createService();
+      const content = '-----BEGIN PRIVATE KEY-----\ntest\n-----END PRIVATE KEY-----';
+
+      const filepath = await service.writeTempKeyFile(content);
+
+      assert.ok(existsSync(filepath));
+      const written = await readFile(filepath, 'utf8');
+      assert.equal(written, content);
+
+      // Clean up
+      await service.removeTempKeyFile(filepath);
+      assert.ok(!existsSync(filepath));
+    });
+
+    it('removeTempKeyFile does not throw for non-existent file', async () => {
+      const service = createService();
+      // Should not throw
+      await service.removeTempKeyFile('/tmp/nonexistent_ssh_key_test_12345');
+    });
+  });
+
+  describe('buildGitSshCommand', () => {
+    it('returns a valid ssh command string', () => {
+      const service = createService();
+      const cmd = service.buildGitSshCommand('/tmp/key_file');
+
+      assert.ok(cmd.includes('-i /tmp/key_file'));
+      assert.ok(cmd.includes('StrictHostKeyChecking=no'));
+      assert.ok(cmd.includes('UserKnownHostsFile=/dev/null'));
+    });
+  });
+
+  describe('isConfigured', () => {
+    it('returns true when ENCRYPTION_KEY is valid', () => {
+      const service = createService();
+      assert.equal(service.isConfigured(), true);
+    });
+
+    it('returns false when ENCRYPTION_KEY is not set', () => {
+      delete process.env.ENCRYPTION_KEY;
+      const service = createService();
+      assert.equal(service.isConfigured(), false);
+    });
+
+    it('returns false when ENCRYPTION_KEY has wrong length', () => {
+      process.env.ENCRYPTION_KEY = 'abc123';
+      const service = createService();
+      assert.equal(service.isConfigured(), false);
+    });
+  });
+});

package/templates/assistkick-product-system/packages/backend/src/services/ssh_key_service.ts

@@ -0,0 +1,148 @@
+/**
+ * SshKeyService — generates ED25519 SSH keypairs, encrypts/decrypts private keys
+ * with AES-256-GCM, and manages temporary key files for git operations.
+ */
+
+import { generateKeyPairSync, createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
+import { writeFile, unlink, chmod } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+interface SshKeyServiceDeps {
+  log: (tag: string, ...args: any[]) => void;
+}
+
+export interface SshKeyPair {
+  publicKey: string;
+  privateKey: string;
+}
+
+export interface EncryptedKey {
+  iv: string;
+  authTag: string;
+  ciphertext: string;
+}
+
+export class SshKeyService {
+  private readonly log: SshKeyServiceDeps['log'];
+
+  constructor({ log }: SshKeyServiceDeps) {
+    this.log = log;
+  }
+
+  private getEncryptionKey = (): Buffer => {
+    const key = process.env.ENCRYPTION_KEY;
+    if (!key) throw new Error('ENCRYPTION_KEY environment variable is not set');
+    // Expect a 64-char hex string (32 bytes)
+    const buf = Buffer.from(key, 'hex');
+    if (buf.length !== 32) {
+      throw new Error('ENCRYPTION_KEY must be a 64-character hex string (32 bytes for AES-256)');
+    }
+    return buf;
+  };
+
+  /** Generate an ED25519 SSH keypair. */
+  generateKeyPair = (): SshKeyPair => {
+    this.log('SSH', 'Generating ED25519 keypair');
+    const { publicKey, privateKey } = generateKeyPairSync('ed25519', {
+      publicKeyEncoding: { type: 'spki', format: 'pem' },
+      privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+    });
+
+    // Convert the PEM public key to OpenSSH format for use as a deploy key
+    const sshPublicKey = this.pemToSshPublicKey(publicKey);
+
+    return {
+      publicKey: sshPublicKey,
+      privateKey,
+    };
+  };
+
+  /** Convert PEM public key to OpenSSH format (ssh-ed25519 ...). */
+  private pemToSshPublicKey = (pemPublicKey: string): string => {
+    // Extract the base64 body from PEM
+    const lines = pemPublicKey.split('\n').filter(l => !l.startsWith('-----') && l.trim());
+    const derB64 = lines.join('');
+    const der = Buffer.from(derB64, 'base64');
+
+    // ED25519 SPKI DER: 30 2a 30 05 06 03 2b 65 70 03 21 00 <32 bytes key>
+    // The raw public key bytes start at offset 12
+    const rawKey = der.subarray(12);
+
+    // Build SSH wire format: string "ssh-ed25519" + string <raw key>
+    const keyType = Buffer.from('ssh-ed25519');
+    const typeLen = Buffer.alloc(4);
+    typeLen.writeUInt32BE(keyType.length);
+    const keyLen = Buffer.alloc(4);
+    keyLen.writeUInt32BE(rawKey.length);
+
+    const sshBlob = Buffer.concat([typeLen, keyType, keyLen, rawKey]);
+    return `ssh-ed25519 ${sshBlob.toString('base64')}`;
+  };
+
+  /** Encrypt a private key using AES-256-GCM. Returns a JSON string. */
+  encrypt = (plaintext: string): string => {
+    const key = this.getEncryptionKey();
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', key, iv);
+
+    let ciphertext = cipher.update(plaintext, 'utf8', 'base64');
+    ciphertext += cipher.final('base64');
+    const authTag = cipher.getAuthTag();
+
+    const encrypted: EncryptedKey = {
+      iv: iv.toString('base64'),
+      authTag: authTag.toString('base64'),
+      ciphertext,
+    };
+
+    return JSON.stringify(encrypted);
+  };
+
+  /** Decrypt a private key from its encrypted JSON string. */
+  decrypt = (encryptedJson: string): string => {
+    const key = this.getEncryptionKey();
+    const { iv, authTag, ciphertext }: EncryptedKey = JSON.parse(encryptedJson);
+
+    const decipher = createDecipheriv('aes-256-gcm', key, Buffer.from(iv, 'base64'));
+    decipher.setAuthTag(Buffer.from(authTag, 'base64'));
+
+    let plaintext = decipher.update(ciphertext, 'base64', 'utf8');
+    plaintext += decipher.final('utf8');
+
+    return plaintext;
+  };
+
+  /** Write an SSH private key to a temporary file with restricted permissions. Returns the file path. */
+  writeTempKeyFile = async (privateKeyPem: string): Promise<string> => {
+    const filename = `assistkick_ssh_${randomBytes(8).toString('hex')}`;
+    const filepath = join(tmpdir(), filename);
+
+    await writeFile(filepath, privateKeyPem, { mode: 0o600 });
+    await chmod(filepath, 0o600);
+    this.log('SSH', `Temporary key file created: ${filepath}`);
+    return filepath;
+  };
+
+  /** Remove a temporary key file. */
+  removeTempKeyFile = async (filepath: string): Promise<void> => {
+    try {
+      await unlink(filepath);
+      this.log('SSH', `Temporary key file removed: ${filepath}`);
+    } catch {
+      this.log('SSH', `Failed to remove temp key file (non-fatal): ${filepath}`);
+    }
+  };
+
+  /** Build the GIT_SSH_COMMAND value for using a specific key file. */
+  buildGitSshCommand = (keyFilePath: string): string => {
+    return `ssh -i ${keyFilePath} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null`;
+  };
+
+  /** Check whether ENCRYPTION_KEY is configured. */
+  isConfigured = (): boolean => {
+    const key = process.env.ENCRYPTION_KEY;
+    if (!key) return false;
+    return Buffer.from(key, 'hex').length === 32;
+  };
+}

package/templates/assistkick-product-system/packages/backend/src/services/terminal_ws_handler.ts

@@ -2,6 +2,9 @@
  * WebSocket handler for terminal connections.
  * Authenticates via cookie, enforces admin-only access,
  * and bridges WebSocket ↔ PTY session by sessionId.
+ *
+ * If the session is suspended (no PTY running), it auto-resumes
+ * the claude session via --resume before bridging.
  */
 
 import type { IncomingMessage } from 'node:http';
@@ -88,6 +91,8 @@ export class TerminalWsHandler {
     // Parse sessionId from query params
     const url = new URL(req.url || '', 'http://localhost');
     const sessionId = url.searchParams.get('sessionId');
+    const cols = parseInt(url.searchParams.get('cols') || '80', 10);
+    const rows = parseInt(url.searchParams.get('rows') || '24', 10);
 
     if (!sessionId) {
       this.log('TERMINAL', 'Connection rejected — no sessionId provided');
@@ -95,14 +100,15 @@ export class TerminalWsHandler {
       return;
     }
 
-    const session = this.ptyManager.getSession(sessionId);
-    if (!session) {
+    // Ensure the PTY is running (auto-resumes suspended sessions)
+    const running = await this.ptyManager.ensureRunning(sessionId, cols, rows);
+    if (!running) {
       this.log('TERMINAL', `Connection rejected — session ${sessionId} not found`);
       ws.close(4004, 'Session not found');
       return;
     }
 
-    this.log('TERMINAL', `Admin ${payload.email} connected to session ${session.name}`);
+    this.log('TERMINAL', `Admin ${payload.email} connected to session ${sessionId}`);
 
     // Send buffered output from previous connection
     const buffered = this.ptyManager.getBufferedOutput(sessionId);
@@ -134,9 +140,9 @@ export class TerminalWsHandler {
     });
 
     ws.on('close', () => {
-      this.log('TERMINAL', `Admin ${payload.email} disconnected from session ${session.name}`);
+      this.log('TERMINAL', `Admin ${payload.email} disconnected from session ${sessionId}`);
       this.ptyManager.removeListener(sessionId, outputListener);
-      // PTY session persists (dec_030) — not destroyed on disconnect
+      // PTY session persists — not destroyed on disconnect
     });
 
     ws.on('error', (err) => {

package/templates/assistkick-product-system/packages/backend/src/services/tts_service.test.ts

@@ -0,0 +1,64 @@
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { join } from 'node:path';
+import { TtsService } from './tts_service.js';
+
+describe('TtsService', () => {
+  const makeTtsService = () => {
+    const logs: string[] = [];
+    return new TtsService({
+      workspacesDir: '/data/workspaces',
+      videoPackageDir: '/app/packages/video',
+      log: (tag: string, ...args: any[]) => { logs.push(`[${tag}] ${args.join(' ')}`); },
+    });
+  };
+
+  it('resolves media base path for a project', () => {
+    const svc = makeTtsService();
+    assert.equal(
+      svc.getMediaBasePath('proj_abc'),
+      join('/data/workspaces', 'proj_abc', 'media'),
+    );
+  });
+
+  it('resolves audio path for a project and feature', () => {
+    const svc = makeTtsService();
+    assert.equal(
+      svc.getAudioPath('proj_abc', 'feat_123'),
+      join('/data/workspaces', 'proj_abc', 'media', 'feat_123', 'audio'),
+    );
+  });
+
+  it('rejects when script file does not exist', async () => {
+    const svc = makeTtsService();
+    await assert.rejects(
+      () => svc.generate({
+        scriptPath: '/nonexistent/script.md',
+        projectId: 'proj_test',
+        featureId: 'feat_test',
+      }),
+      { message: /Script file not found/ },
+    );
+  });
+
+  it('rejects when ELEVENLABS_API_KEY is not set', async () => {
+    const originalKey = process.env.ELEVENLABS_API_KEY;
+    delete process.env.ELEVENLABS_API_KEY;
+
+    const svc = makeTtsService();
+    try {
+      await assert.rejects(
+        () => svc.generate({
+          scriptPath: import.meta.dirname + '/tts_service.ts', // any existing file
+          projectId: 'proj_test',
+          featureId: 'feat_test',
+        }),
+        { message: /ELEVENLABS_API_KEY/ },
+      );
+    } finally {
+      if (originalKey !== undefined) {
+        process.env.ELEVENLABS_API_KEY = originalKey;
+      }
+    }
+  });
+});

package/templates/assistkick-product-system/packages/backend/src/services/tts_service.ts

@@ -0,0 +1,134 @@
+/**
+ * TtsService — runs the process_script.ts CLI to generate TTS audio
+ * from video script narration directives.
+ *
+ * Spawns the script as a subprocess with --json output and parses the result.
+ * Audio files are written to /data/workspaces/<projectId>/media/<featureId>/audio/.
+ */
+
+import { execFile } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+
+interface TtsServiceDeps {
+  workspacesDir: string;
+  videoPackageDir: string;
+  log: (tag: string, ...args: any[]) => void;
+}
+
+export interface TtsGenerateOptions {
+  scriptPath: string;
+  projectId: string;
+  featureId: string;
+  force?: boolean;
+  voiceId?: string;
+}
+
+export interface TtsResult {
+  processed: number;
+  generated: number;
+  skipped: number;
+  errors: string[];
+  durations: Record<string, number>;
+  audioBasePath: string;
+}
+
+export class TtsService {
+  private readonly workspacesDir: string;
+  private readonly videoPackageDir: string;
+  private readonly log: TtsServiceDeps['log'];
+
+  constructor({ workspacesDir, videoPackageDir, log }: TtsServiceDeps) {
+    this.workspacesDir = workspacesDir;
+    this.videoPackageDir = videoPackageDir;
+    this.log = log;
+  }
+
+  /** Resolve the media base directory for a project. */
+  getMediaBasePath = (projectId: string): string => {
+    return join(this.workspacesDir, projectId, 'media');
+  };
+
+  /** Resolve the audio directory for a specific feature within a project. */
+  getAudioPath = (projectId: string, featureId: string): string => {
+    return join(this.getMediaBasePath(projectId), featureId, 'audio');
+  };
+
+  /**
+   * Generate TTS audio by running process_script.ts against a script file.
+   * Returns a structured summary of what was processed.
+   */
+  generate = async (opts: TtsGenerateOptions): Promise<TtsResult> => {
+    const { scriptPath, projectId, featureId, force, voiceId } = opts;
+
+    if (!existsSync(scriptPath)) {
+      throw new Error(`Script file not found: ${scriptPath}`);
+    }
+
+    const apiKey = process.env.ELEVENLABS_API_KEY;
+    if (!apiKey) {
+      throw new Error('ELEVENLABS_API_KEY environment variable is not configured.');
+    }
+
+    const scriptFile = join(this.videoPackageDir, 'scripts', 'process_script.ts');
+    const mediaBase = join(this.workspacesDir, projectId, 'media');
+
+    const args = [
+      scriptFile,
+      scriptPath,
+      '--project-id', projectId,
+      '--feature-id', featureId,
+      '--media-base', mediaBase,
+      '--json',
+    ];
+
+    if (force) args.push('--force');
+    if (voiceId) args.push('--voice-id', voiceId);
+
+    this.log('TTS', `Generating TTS for project=${projectId} feature=${featureId}`);
+
+    const result = await this.spawnTsx(args);
+    return result;
+  };
+
+  private spawnTsx = (args: string[]): Promise<TtsResult> => {
+    return new Promise((resolve, reject) => {
+      execFile('npx', ['tsx', ...args], {
+        env: { ...process.env },
+        cwd: this.videoPackageDir,
+        timeout: 300_000, // 5 minutes max
+        maxBuffer: 10 * 1024 * 1024,
+      }, (error, stdout, stderr) => {
+        if (stderr) {
+          this.log('TTS', `stderr: ${stderr}`);
+        }
+
+        if (error) {
+          // Try to parse JSON error from stdout
+          try {
+            const parsed = JSON.parse(stdout);
+            if (parsed.error) {
+              reject(new Error(parsed.error));
+              return;
+            }
+          } catch {
+            // Not JSON, use the error message
+          }
+          reject(new Error(`TTS process failed: ${error.message}`));
+          return;
+        }
+
+        try {
+          const parsed = JSON.parse(stdout.trim());
+          if (parsed.error) {
+            reject(new Error(parsed.error));
+            return;
+          }
+          resolve(parsed as TtsResult);
+        } catch {
+          reject(new Error(`Failed to parse TTS output: ${stdout}`));
+        }
+      });
+    });
+  };
+}