@assistkick/create 1.9.0 → 1.10.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@assistkick/create",
-  "version": "1.9.0",
+  "version": "1.10.0",
   "description": "Scaffold assistkick-product-system into any project",
   "type": "module",
   "bin": {

package/templates/assistkick-product-system/packages/backend/src/routes/git.ts

@@ -241,7 +241,7 @@ export const createGitRoutes = ({ projectService, githubAppService, workspaceSer
 
     try {
       if (!sshKeyService.isConfigured()) {
-        res.status(400).json({ error: 'ENCRYPTION_KEY environment variable is not configured' });
+        res.status(400).json({ error: `ENCRYPTION_KEY environment variable is not configured. ${SshKeyService.KEY_HELP}` });
         return;
       }
 

package/templates/assistkick-product-system/packages/backend/src/services/ssh_key_service.ts

@@ -30,15 +30,29 @@ export class SshKeyService {
     this.log = log;
   }
 
+  static readonly KEY_HELP = 'Set ENCRYPTION_KEY in your .env file (any string with at least 32 characters). Generate one with: openssl rand -hex 32';
+
+  /** Parse ENCRYPTION_KEY: try hex first, then base64, then use raw UTF-8 bytes via SHA-256. */
   private getEncryptionKey = (): Buffer => {
     const key = process.env.ENCRYPTION_KEY;
-    if (!key) throw new Error('ENCRYPTION_KEY environment variable is not set');
-    // Expect a 64-char hex string (32 bytes)
-    const buf = Buffer.from(key, 'hex');
-    if (buf.length !== 32) {
-      throw new Error('ENCRYPTION_KEY must be a 64-character hex string (32 bytes for AES-256)');
+    if (!key) {
+      throw new Error(`ENCRYPTION_KEY environment variable is not set. ${SshKeyService.KEY_HELP}`);
+    }
+    if (key.length < 32) {
+      throw new Error(`ENCRYPTION_KEY must be at least 32 characters. ${SshKeyService.KEY_HELP}`);
+    }
+    // Try hex (64-char hex = 32 bytes)
+    if (/^[0-9a-fA-F]{64}$/.test(key)) {
+      return Buffer.from(key, 'hex');
+    }
+    // Try base64 (44 chars with padding = 32 bytes)
+    if (/^[A-Za-z0-9+/]{43}=?$/.test(key)) {
+      const buf = Buffer.from(key, 'base64');
+      if (buf.length === 32) return buf;
     }
-    return buf;
+    // Fallback: SHA-256 hash of the raw string to get exactly 32 bytes
+    const { createHash } = require('node:crypto');
+    return createHash('sha256').update(key).digest();
   };
 
   /** Generate an ED25519 SSH keypair. */