@assistkick/create 1.9.0 → 1.11.0

package/dist/src/scaffolder.d.ts

@@ -9,6 +9,15 @@ type PortConfig = {
     backendPort: number;
     frontendPort: number;
 };
+type SecretConfig = {
+    jwtSecret: string;
+    encryptionKey: string;
+};
+type AppConfig = {
+    resendApiKey: string;
+    appBaseUrl: string;
+    emailFrom: string;
+};
 export type PromptFn = (question: string) => Promise<string>;
 export declare class Scaffolder {
     private readonly targetDir;
@@ -19,9 +28,11 @@ export declare class Scaffolder {
     private checkPnpm;
     private promptDbConfig;
     private promptPortConfig;
+    private promptSecrets;
+    private promptAppConfig;
     private scaffoldProductSystem;
     private scaffoldSkills;
     skillHasModifications: (sourceDir: string, targetDir: string) => boolean;
-    generateEnv: (productSystemDir: string, dbConfig: DbConfig, portConfig: PortConfig) => void;
+    generateEnv: (productSystemDir: string, dbConfig: DbConfig, portConfig: PortConfig, secretConfig: SecretConfig, appConfig: AppConfig) => void;
 }
 export {};

package/dist/src/scaffolder.js

@@ -2,6 +2,7 @@ import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, statSync, wri
 import { join } from 'node:path';
 import { createInterface } from 'node:readline';
 import { execSync } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
 const createReadlinePrompt = () => {
     const rl = createInterface({ input: process.stdin, output: process.stdout });
     return (question) => new Promise(resolve => rl.question(question, answer => resolve(answer)));
@@ -22,17 +23,21 @@ export class Scaffolder {
         const isRerun = existsSync(productSystemTarget);
         let dbConfig = null;
         let portConfig = null;
+        let secretConfig = null;
+        let appConfig = null;
         if (isRerun) {
             console.log('assistkick-product-system/ already exists. Updating code, preserving data/ and .env...');
         }
         else {
             dbConfig = await this.promptDbConfig();
             portConfig = await this.promptPortConfig();
+            secretConfig = await this.promptSecrets();
+            appConfig = await this.promptAppConfig();
         }
         this.scaffoldProductSystem(productSystemTarget);
         await this.scaffoldSkills(skillsTarget, isRerun);
-        if (!isRerun && dbConfig && portConfig) {
-            this.generateEnv(productSystemTarget, dbConfig, portConfig);
+        if (!isRerun && dbConfig && portConfig && secretConfig && appConfig) {
+            this.generateEnv(productSystemTarget, dbConfig, portConfig, secretConfig, appConfig);
         }
         console.log('\nRunning pnpm install...');
         execSync('pnpm install', { cwd: productSystemTarget, stdio: 'inherit' });
@@ -71,6 +76,35 @@ export class Scaffolder {
         const frontendPort = frontendInput.trim() ? parseInt(frontendInput.trim(), 10) : 5173;
         return { backendPort, frontendPort };
     };
+    promptSecrets = async () => {
+        console.log('\nSecret configuration:');
+        const jwtChoice = await this.prompt('JWT_SECRET — auto-generate (recommended)? [Y/n]: ');
+        let jwtSecret;
+        if (jwtChoice.trim().toLowerCase() === 'n') {
+            jwtSecret = (await this.prompt('JWT_SECRET: ')).trim();
+        }
+        else {
+            jwtSecret = randomBytes(32).toString('hex');
+            console.log('  Auto-generated JWT_SECRET');
+        }
+        const encChoice = await this.prompt('ENCRYPTION_KEY — auto-generate (recommended)? [Y/n]: ');
+        let encryptionKey;
+        if (encChoice.trim().toLowerCase() === 'n') {
+            encryptionKey = (await this.prompt('ENCRYPTION_KEY: ')).trim();
+        }
+        else {
+            encryptionKey = randomBytes(32).toString('hex');
+            console.log('  Auto-generated ENCRYPTION_KEY');
+        }
+        return { jwtSecret, encryptionKey };
+    };
+    promptAppConfig = async () => {
+        console.log('\nApplication configuration:');
+        const resendApiKey = (await this.prompt('RESEND_API_KEY (optional, press Enter to skip): ')).trim();
+        const appBaseUrl = (await this.prompt('APP_BASE_URL [default=http://localhost:3000]: ')).trim() || 'http://localhost:3000';
+        const emailFrom = (await this.prompt('EMAIL_FROM [default=noreply@example.com]: ')).trim() || 'noreply@example.com';
+        return { resendApiKey, appBaseUrl, emailFrom };
+    };
     scaffoldProductSystem = (targetDir) => {
         const sourceDir = join(this.templatesDir, 'assistkick-product-system');
         mkdirSync(targetDir, { recursive: true });
@@ -115,7 +149,7 @@ export class Scaffolder {
             return false;
         return readFileSync(sourceFile, 'utf-8') !== readFileSync(targetFile, 'utf-8');
     };
-    generateEnv = (productSystemDir, dbConfig, portConfig) => {
+    generateEnv = (productSystemDir, dbConfig, portConfig, secretConfig, appConfig) => {
         const lines = [];
         if (dbConfig.type === 'local') {
             lines.push('# Database — local SQLite', '# The database file is created automatically at data/local.db', '# To upgrade to Turso, uncomment and fill in the variables below:', '#TURSO_DATABASE_URL=libsql://your-db.turso.io', '#TURSO_AUTH_TOKEN=your-token', '');
@@ -124,6 +158,9 @@ export class Scaffolder {
             lines.push('# Database — Turso cloud', `TURSO_DATABASE_URL=${dbConfig.url}`, `TURSO_AUTH_TOKEN=${dbConfig.authToken}`, '');
         }
         lines.push('# Ports', `PORT=${portConfig.backendPort}`, `FRONTEND_PORT=${portConfig.frontendPort}`, '');
+        lines.push('# Secrets', `JWT_SECRET=${secretConfig.jwtSecret}`, `ENCRYPTION_KEY=${secretConfig.encryptionKey}`, '');
+        lines.push('# Application', `APP_BASE_URL=${appConfig.appBaseUrl}`, `EMAIL_FROM=${appConfig.emailFrom}`, `RESEND_API_KEY=${appConfig.resendApiKey}`, '');
+        lines.push('# Workspaces', 'WORKSPACES_DIR=./workspaces', '');
         writeFileSync(join(productSystemDir, '.env'), lines.join('\n'));
         console.log('Generated .env');
     };

package/dist/src/scaffolder.js.map

@@ -1 +1 @@
-{"version":3,"file":"scaffolder.js","sourceRoot":"","sources":["../../src/scaffolder.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAU9C,MAAM,oBAAoB,GAAG,GAAa,EAAE;IAC1C,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,OAAO,CAAC,QAAgB,EAAE,EAAE,CAC1B,IAAI,OAAO,CAAS,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACrF,CAAC,CAAC;AAEF,MAAM,OAAO,UAAU;IACJ,SAAS,CAAS;IAClB,YAAY,CAAS;IACrB,MAAM,CAAW;IAElC,YAAY,SAAiB,EAAE,YAAoB,EAAE,MAAiB;QACpE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACjD,CAAC;IAED,GAAG,GAAG,KAAK,IAAI,EAAE;QACf,IAAI,CAAC,SAAS,EAAE,CAAC;QAEjB,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;QAC9E,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,UAAU,CAAC,mBAAmB,CAAC,CAAC;QAEhD,IAAI,QAAQ,GAAoB,IAAI,CAAC;QACrC,IAAI,UAAU,GAAsB,IAAI,CAAC;QAEzC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CAAC,wFAAwF,CAAC,CAAC;QACxG,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YACvC,UAAU,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC7C,CAAC;QAED,IAAI,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAEjD,IAAI,CAAC,OAAO,IAAI,QAAQ,IAAI,UAAU,EAAE,CAAC;YACvC,IAAI,CAAC,WAAW,CAAC,mBAAmB,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACzC,QAAQ,CAAC,cAAc,EAAE,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAEzE,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QACvC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAE5E,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;IAC5D,CAAC,CAAC;IAEM,SAAS,GAAG,GAAG,EAAE;QACvB,IAAI,CAAC;YACH,QAAQ,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;YACxD,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC;IAEM,cAAc,GAAG,KAAK,IAAuB,EAAE;QACrD,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;QAC5E,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC;QAEhE,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;YACtD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;YAC1D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;QACzE,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC,CAAC;IAEM,gBAAgB,GAAG,KAAK,IAAyB,EAAE;QACzD,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACrC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC;QACxE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAE1E,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnF,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAEtF,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;IACvC,CAAC,CAAC;IAEM,qBAAqB,GAAG,CAAC,SAAiB,EAAE,EAAE;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,2BAA2B,CAAC,CAAC;QACvE,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE;YAC3B,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,CAAC,GAAW,EAAE,EAAE;gBACtB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;gBACxC,OAAO,IAAI,KAAK,cAAc,CAAC;YACjC,CAAC;SACF,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;IACvD,CAAC,CAAC;IAEM,cAAc,GAAG,KAAK,EAAE,SAAiB,EAAE,OAAgB,EAAE,EAAE;QACrE,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;YAAE,OAAO;QAEzC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1C,MAAM,UAAU,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAC5D,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CACpD,CAAC;QAEF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;YACxD,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAElD,IAAI,OAAO,IAAI,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC1C,MAAM,gBAAgB,GAAG,IAAI,CAAC,qBAAqB,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;gBACpF,IAAI,gBAAgB,EAAE,CAAC;oBACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAC9B,UAAU,SAAS,+CAA+C,CACnE,CAAC;oBACF,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,GAAG,EAAE,CAAC;wBACxC,OAAO,CAAC,GAAG,CAAC,iBAAiB,SAAS,EAAE,CAAC,CAAC;wBAC1C,SAAS;oBACX,CAAC;gBACH,CAAC;YACH,CAAC;YAED,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,MAAM,CAAC,cAAc,EAAE,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACzE,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC,CAAC;IAEF,qBAAqB,GAAG,CAAC,SAAiB,EAAE,SAAiB,EAAW,EAAE;QACxE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;QACrE,OAAO,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,KAAK,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACjF,CAAC,CAAC;IAEF,WAAW,GAAG,CAAC,gBAAwB,EAAE,QAAkB,EAAE,UAAsB,EAAE,EAAE;QACrF,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CACR,2BAA2B,EAC3B,+DAA+D,EAC/D,mEAAmE,EACnE,+CAA+C,EAC/C,8BAA8B,EAC9B,EAAE,CACH,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CACR,0BAA0B,EAC1B,sBAAsB,QAAQ,CAAC,GAAG,EAAE,EACpC,oBAAoB,QAAQ,CAAC,SAAS,EAAE,EACxC,EAAE,CACH,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,IAAI,CACR,SAAS,EACT,QAAQ,UAAU,CAAC,WAAW,EAAE,EAChC,iBAAiB,UAAU,CAAC,YAAY,EAAE,EAC1C,EAAE,CACH,CAAC;QAEF,aAAa,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAChC,CAAC,CAAC;CACH"}
+{"version":3,"file":"scaffolder.js","sourceRoot":"","sources":["../../src/scaffolder.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAc1C,MAAM,oBAAoB,GAAG,GAAa,EAAE;IAC1C,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,OAAO,CAAC,QAAgB,EAAE,EAAE,CAC1B,IAAI,OAAO,CAAS,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACrF,CAAC,CAAC;AAEF,MAAM,OAAO,UAAU;IACJ,SAAS,CAAS;IAClB,YAAY,CAAS;IACrB,MAAM,CAAW;IAElC,YAAY,SAAiB,EAAE,YAAoB,EAAE,MAAiB;QACpE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACjD,CAAC;IAED,GAAG,GAAG,KAAK,IAAI,EAAE;QACf,IAAI,CAAC,SAAS,EAAE,CAAC;QAEjB,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;QAC9E,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,UAAU,CAAC,mBAAmB,CAAC,CAAC;QAEhD,IAAI,QAAQ,GAAoB,IAAI,CAAC;QACrC,IAAI,UAAU,GAAsB,IAAI,CAAC;QACzC,IAAI,YAAY,GAAwB,IAAI,CAAC;QAC7C,IAAI,SAAS,GAAqB,IAAI,CAAC;QAEvC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CAAC,wFAAwF,CAAC,CAAC;QACxG,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YACvC,UAAU,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3C,YAAY,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;YAC1C,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC3C,CAAC;QAED,IAAI,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAEjD,IAAI,CAAC,OAAO,IAAI,QAAQ,IAAI,UAAU,IAAI,YAAY,IAAI,SAAS,EAAE,CAAC;YACpE,IAAI,CAAC,WAAW,CAAC,mBAAmB,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;QACvF,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACzC,QAAQ,CAAC,cAAc,EAAE,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAEzE,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QACvC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,GAAG,EAAE,mBAAmB,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAE5E,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;IAC5D,CAAC,CAAC;IAEM,SAAS,GAAG,GAAG,EAAE;QACvB,IAAI,CAAC;YACH,QAAQ,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;YACxD,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC;IAEM,cAAc,GAAG,KAAK,IAAuB,EAAE;QACrD,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;QAC5E,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC;QAEhE,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;YACtD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;YAC1D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;QACzE,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC,CAAC;IAEM,gBAAgB,GAAG,KAAK,IAAyB,EAAE;QACzD,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACrC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC;QACxE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAE1E,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnF,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAEtF,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;IACvC,CAAC,CAAC;IAEM,aAAa,GAAG,KAAK,IAA2B,EAAE;QACxD,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QAEvC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,mDAAmD,CAAC,CAAC;QACzF,IAAI,SAAiB,CAAC;QACtB,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,GAAG,EAAE,CAAC;YAC3C,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzD,CAAC;aAAM,CAAC;YACN,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,uDAAuD,CAAC,CAAC;QAC7F,IAAI,aAAqB,CAAC;QAC1B,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,GAAG,EAAE,CAAC;YAC3C,aAAa,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjE,CAAC;aAAM,CAAC;YACN,aAAa,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;QACjD,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;IACtC,CAAC,CAAC;IAEM,eAAe,GAAG,KAAK,IAAwB,EAAE;QACvD,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAE5C,MAAM,YAAY,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,kDAAkD,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpG,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,gDAAgD,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,uBAAuB,CAAC;QAC3H,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,4CAA4C,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,qBAAqB,CAAC;QAEpH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACjD,CAAC,CAAC;IAEM,qBAAqB,GAAG,CAAC,SAAiB,EAAE,EAAE;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,2BAA2B,CAAC,CAAC;QACvE,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE;YAC3B,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,CAAC,GAAW,EAAE,EAAE;gBACtB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;gBACxC,OAAO,IAAI,KAAK,cAAc,CAAC;YACjC,CAAC;SACF,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;IACvD,CAAC,CAAC;IAEM,cAAc,GAAG,KAAK,EAAE,SAAiB,EAAE,OAAgB,EAAE,EAAE;QACrE,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;YAAE,OAAO;QAEzC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1C,MAAM,UAAU,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAC5D,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CACpD,CAAC;QAEF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;YACxD,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAElD,IAAI,OAAO,IAAI,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC1C,MAAM,gBAAgB,GAAG,IAAI,CAAC,qBAAqB,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;gBACpF,IAAI,gBAAgB,EAAE,CAAC;oBACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAC9B,UAAU,SAAS,+CAA+C,CACnE,CAAC;oBACF,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,GAAG,EAAE,CAAC;wBACxC,OAAO,CAAC,GAAG,CAAC,iBAAiB,SAAS,EAAE,CAAC,CAAC;wBAC1C,SAAS;oBACX,CAAC;gBACH,CAAC;YACH,CAAC;YAED,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,MAAM,CAAC,cAAc,EAAE,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACzE,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC,CAAC;IAEF,qBAAqB,GAAG,CAAC,SAAiB,EAAE,SAAiB,EAAW,EAAE;QACxE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;QACrE,OAAO,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,KAAK,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACjF,CAAC,CAAC;IAEF,WAAW,GAAG,CACZ,gBAAwB,EACxB,QAAkB,EAClB,UAAsB,EACtB,YAA0B,EAC1B,SAAoB,EACpB,EAAE;QACF,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CACR,2BAA2B,EAC3B,+DAA+D,EAC/D,mEAAmE,EACnE,+CAA+C,EAC/C,8BAA8B,EAC9B,EAAE,CACH,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CACR,0BAA0B,EAC1B,sBAAsB,QAAQ,CAAC,GAAG,EAAE,EACpC,oBAAoB,QAAQ,CAAC,SAAS,EAAE,EACxC,EAAE,CACH,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,IAAI,CACR,SAAS,EACT,QAAQ,UAAU,CAAC,WAAW,EAAE,EAChC,iBAAiB,UAAU,CAAC,YAAY,EAAE,EAC1C,EAAE,CACH,CAAC;QAEF,KAAK,CAAC,IAAI,CACR,WAAW,EACX,cAAc,YAAY,CAAC,SAAS,EAAE,EACtC,kBAAkB,YAAY,CAAC,aAAa,EAAE,EAC9C,EAAE,CACH,CAAC;QAEF,KAAK,CAAC,IAAI,CACR,eAAe,EACf,gBAAgB,SAAS,CAAC,UAAU,EAAE,EACtC,cAAc,SAAS,CAAC,SAAS,EAAE,EACnC,kBAAkB,SAAS,CAAC,YAAY,EAAE,EAC1C,EAAE,CACH,CAAC;QAEF,KAAK,CAAC,IAAI,CACR,cAAc,EACd,6BAA6B,EAC7B,EAAE,CACH,CAAC;QAEF,aAAa,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAChC,CAAC,CAAC;CACH"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@assistkick/create",
-  "version": "1.9.0",
+  "version": "1.11.0",
   "description": "Scaffold assistkick-product-system into any project",
   "type": "module",
   "bin": {

package/templates/assistkick-product-system/package.json

@@ -17,7 +17,7 @@
     "remotion:render": "pnpm --filter @assistkick/video render"
   },
   "pnpm": {
-    "onlyBuiltDependencies": ["esbuild", "node-pty"]
+    "onlyBuiltDependencies": ["esbuild", "node-pty", "isolated-vm"]
   },
   "devDependencies": {
     "@libsql/client": "^0.17.0",

package/templates/assistkick-product-system/packages/backend/package.json

@@ -20,6 +20,7 @@
     "drizzle-orm": "^0.45.1",
     "express": "^5.1.0",
     "gray-matter": "^4.0.3",
+    "http-proxy-middleware": "^3.0.5",
     "jose": "^6.1.3",
     "node-pty": "^1.1.0",
     "remotion": "^4.0.434",

package/templates/assistkick-product-system/packages/backend/src/mcp/permission_mcp_server.ts

@@ -0,0 +1,196 @@
+#!/usr/bin/env node
+/**
+ * Permission MCP Server — bridges Claude CLI permission prompts to the web UI.
+ *
+ * Launched as a stdio MCP server by Claude CLI via --mcp-config.
+ * When Claude needs permission to use a tool, it calls the `ask` tool on this server.
+ * The server makes an HTTP POST to the backend, which forwards the request
+ * to the frontend via WebSocket and waits for the user's decision.
+ *
+ * Environment variables (set via MCP config):
+ *   BACKEND_URL       — e.g. "http://localhost:3000"
+ *   CLAUDE_SESSION_ID — the Claude session ID for routing
+ *   PROJECT_ID        — the project ID for permission rule lookup
+ */
+
+import { createInterface } from 'node:readline';
+
+const BACKEND_URL = process.env.BACKEND_URL || 'http://localhost:3000';
+const CLAUDE_SESSION_ID = process.env.CLAUDE_SESSION_ID || '';
+const PROJECT_ID = process.env.PROJECT_ID || '';
+
+interface JsonRpcRequest {
+  jsonrpc: '2.0';
+  id: number | string;
+  method: string;
+  params?: Record<string, unknown>;
+}
+
+interface JsonRpcResponse {
+  jsonrpc: '2.0';
+  id: number | string | null;
+  result?: unknown;
+  error?: { code: number; message: string; data?: unknown };
+}
+
+const sendResponse = (response: JsonRpcResponse): void => {
+  const json = JSON.stringify(response);
+  process.stdout.write(`${json}\n`);
+};
+
+const handleInitialize = (id: number | string): void => {
+  sendResponse({
+    jsonrpc: '2.0',
+    id,
+    result: {
+      protocolVersion: '2024-11-05',
+      capabilities: { tools: {} },
+      serverInfo: { name: 'permission', version: '1.0.0' },
+    },
+  });
+};
+
+const handleToolsList = (id: number | string): void => {
+  sendResponse({
+    jsonrpc: '2.0',
+    id,
+    result: {
+      tools: [
+        {
+          name: 'ask',
+          description: 'Request permission from the user to use a tool',
+          inputSchema: {
+            type: 'object',
+            properties: {
+              tool_name: { type: 'string', description: 'Name of the tool requesting permission' },
+              input: {
+                type: 'object',
+                description: 'The input that will be passed to the tool',
+                additionalProperties: true,
+              },
+            },
+            required: ['tool_name'],
+          },
+        },
+      ],
+    },
+  });
+};
+
+const handleToolCall = async (id: number | string, params: Record<string, unknown>): Promise<void> => {
+  const toolName = params.name as string;
+
+  if (toolName !== 'ask') {
+    sendResponse({
+      jsonrpc: '2.0',
+      id,
+      error: { code: -32601, message: `Unknown tool: ${toolName}` },
+    });
+    return;
+  }
+
+  const args = (params.arguments || {}) as Record<string, unknown>;
+  const requestedToolName = (args.tool_name || 'unknown') as string;
+  const toolInput = (args.input || {}) as Record<string, unknown>;
+
+  try {
+    const response = await fetch(`${BACKEND_URL}/api/chat/permission/request`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        claudeSessionId: CLAUDE_SESSION_ID,
+        projectId: PROJECT_ID,
+        toolName: requestedToolName,
+        input: toolInput,
+      }),
+    });
+
+    if (!response.ok) {
+      const errorText = await response.text();
+      sendResponse({
+        jsonrpc: '2.0',
+        id,
+        result: {
+          content: [{ type: 'text', text: JSON.stringify({ behavior: 'deny', message: `Permission service error: ${errorText}` }) }],
+        },
+      });
+      return;
+    }
+
+    const result = await response.json() as { decision: string };
+    const allowed = result.decision !== 'deny';
+
+    sendResponse({
+      jsonrpc: '2.0',
+      id,
+      result: {
+        content: [
+          {
+            type: 'text',
+            text: JSON.stringify({
+              behavior: allowed ? 'allow' : 'deny',
+              message: allowed ? `User allowed: ${result.decision}` : 'User denied permission',
+            }),
+          },
+        ],
+      },
+    });
+  } catch (err: unknown) {
+    const errorMsg = err instanceof Error ? err.message : 'Unknown error';
+    sendResponse({
+      jsonrpc: '2.0',
+      id,
+      result: {
+        content: [{ type: 'text', text: JSON.stringify({ behavior: 'deny', message: `Failed to reach permission service: ${errorMsg}` }) }],
+      },
+    });
+  }
+};
+
+const handleMessage = async (line: string): Promise<void> => {
+  let msg: JsonRpcRequest;
+  try {
+    msg = JSON.parse(line);
+  } catch {
+    return;
+  }
+
+  if (msg.jsonrpc !== '2.0') return;
+
+  // Notifications (no id) — acknowledge silently
+  if (msg.id === undefined || msg.id === null) {
+    // Handle notifications/initialized — no response needed
+    return;
+  }
+
+  switch (msg.method) {
+    case 'initialize':
+      handleInitialize(msg.id);
+      break;
+    case 'tools/list':
+      handleToolsList(msg.id);
+      break;
+    case 'tools/call':
+      await handleToolCall(msg.id, msg.params || {});
+      break;
+    case 'notifications/initialized':
+      // Client notification — no response needed, but has id sometimes
+      break;
+    default:
+      sendResponse({
+        jsonrpc: '2.0',
+        id: msg.id,
+        error: { code: -32601, message: `Method not found: ${msg.method}` },
+      });
+  }
+};
+
+// Read JSON-RPC messages from stdin, one per line
+const rl = createInterface({ input: process.stdin, terminal: false });
+rl.on('line', (line: string) => {
+  handleMessage(line).catch((err) => {
+    process.stderr.write(`MCP permission server error: ${err}\n`);
+  });
+});
+
+process.stderr.write(`[permission-mcp] Started (session=${CLAUDE_SESSION_ID}, project=${PROJECT_ID})\n`);

package/templates/assistkick-product-system/packages/backend/src/routes/agents.ts

@@ -5,7 +5,8 @@
  * POST   /api/agents            — create agent
  * PUT    /api/agents/:id        — update agent
  * DELETE /api/agents/:id        — delete agent (409 if assigned or default)
- * POST   /api/agents/:id/reset  — reset default agent to original prompt
+ * POST   /api/agents/:id/reset  — reset default agent to original grounding
+ * GET    /api/skills            — list available skills from disk
  */
 
 import { Router } from 'express';
@@ -64,7 +65,7 @@ export const createAgentRoutes = ({ agentService, log }: AgentRoutesDeps): Route
 
   // POST /api/agents
   router.post('/', async (req, res) => {
-    const { name, promptTemplate, projectId } = req.body;
+    const { name, grounding, model, skills, projectId } = req.body;
     log('AGENTS', `POST /api/agents name="${name}"`);
 
     if (!name || typeof name !== 'string' || !name.trim()) {
@@ -72,15 +73,17 @@ export const createAgentRoutes = ({ agentService, log }: AgentRoutesDeps): Route
       return;
     }
 
-    if (!promptTemplate || typeof promptTemplate !== 'string') {
-      res.status(400).json({ error: 'promptTemplate is required' });
+    if (!grounding || typeof grounding !== 'string') {
+      res.status(400).json({ error: 'grounding is required' });
       return;
     }
 
     try {
       const agent = await agentService.create({
         name: name.trim(),
-        promptTemplate,
+        grounding,
+        model,
+        skills,
         projectId: projectId || null,
       });
       res.status(201).json({ agent });
@@ -93,7 +96,7 @@ export const createAgentRoutes = ({ agentService, log }: AgentRoutesDeps): Route
   // PUT /api/agents/:id
   router.put('/:id', async (req, res) => {
     const { id } = req.params;
-    const { name, promptTemplate } = req.body;
+    const { name, grounding, model, skills } = req.body;
     log('AGENTS', `PUT /api/agents/${id}`);
 
     if (name !== undefined && (typeof name !== 'string' || !name.trim())) {
@@ -104,7 +107,9 @@ export const createAgentRoutes = ({ agentService, log }: AgentRoutesDeps): Route
     try {
       const agent = await agentService.update(id, {
         name: name?.trim(),
-        promptTemplate,
+        grounding,
+        model,
+        skills,
       });
       res.json({ agent });
     } catch (err: any) {
@@ -163,3 +168,22 @@ export const createAgentRoutes = ({ agentService, log }: AgentRoutesDeps): Route
 
   return router;
 };
+
+export const createSkillListRoutes = ({ agentService, log }: AgentRoutesDeps): Router => {
+  const router: Router = Router();
+
+  // GET /api/skills
+  router.get('/', async (_req, res) => {
+    log('SKILLS', 'GET /api/skills');
+
+    try {
+      const skills = await agentService.listSkills();
+      res.json({ skills });
+    } catch (err: any) {
+      log('SKILLS', `List skills failed: ${err.message}`);
+      res.status(500).json({ error: 'Failed to list skills' });
+    }
+  });
+
+  return router;
+};

package/templates/assistkick-product-system/packages/backend/src/routes/auth.ts

@@ -101,7 +101,7 @@ export const createAuthRoutes = ({ getDb, authService, passwordResetService, inv
         user: { id: userId, email: email.toLowerCase(), role: 'admin' },
       });
     } catch (err: any) {
-      log('AUTH', `Registration failed: ${err.message}`);
+      log('AUTH', `Registration failed:`, err.stack || err.message);
       res.status(500).json({ error: 'Registration failed' });
     }
   });
@@ -167,7 +167,7 @@ export const createAuthRoutes = ({ getDb, authService, passwordResetService, inv
         user: { id: user.id, email: user.email, role: user.role },
       });
     } catch (err: any) {
-      log('AUTH', `Login failed: ${err.message}`);
+      log('AUTH', `Login failed:`, err.stack || err.message);
       res.status(500).json({ error: 'Login failed' });
     }
   });
@@ -182,7 +182,8 @@ export const createAuthRoutes = ({ getDb, authService, passwordResetService, inv
     try {
       const payload = await authService.verifyToken(token);
       return res.json({ user: { id: payload.sub, email: payload.email, role: payload.role } });
-    } catch {
+    } catch (err: any) {
+      log('AUTH', 'Token verification failed (GET /me):', err.message);
       return res.status(401).json({ error: 'Invalid or expired token' });
     }
   });
@@ -251,7 +252,8 @@ export const createAuthRoutes = ({ getDb, authService, passwordResetService, inv
 
       log('AUTH', `Token refreshed for user: ${user.email}`);
       res.json({ message: 'Token refreshed' });
-    } catch {
+    } catch (err: any) {
+      log('AUTH', 'Refresh token invalid:', err.message);
       return res.status(401).json({ error: 'Invalid refresh token' });
     }
   });
@@ -280,8 +282,8 @@ export const createAuthRoutes = ({ getDb, authService, passwordResetService, inv
             break;
           }
         }
-      } catch {
-        // Token may be expired/invalid — still proceed with clearing cookies
+      } catch (err: any) {
+        log('AUTH', 'Logout: failed to revoke refresh token (proceeding):', err.message);
       }
     }
 
@@ -308,7 +310,7 @@ export const createAuthRoutes = ({ getDb, authService, passwordResetService, inv
       // Always return success to prevent user enumeration
       res.json({ message: 'If an account with that email exists, a reset link has been sent.' });
     } catch (err: any) {
-      log('AUTH', `Forgot password failed: ${err.message}`);
+      log('AUTH', `Forgot password failed:`, err.stack || err.message);
       res.status(500).json({ error: 'Failed to process reset request' });
     }
   });
@@ -334,7 +336,7 @@ export const createAuthRoutes = ({ getDb, authService, passwordResetService, inv
       await passwordResetService.confirmReset(token, password);
       res.json({ message: 'Password has been reset successfully.' });
     } catch (err: any) {
-      log('AUTH', `Reset password failed: ${err.message}`);
+      log('AUTH', `Reset password failed:`, err.stack || err.message);
       if (err.message === 'Invalid or expired reset token') {
         return res.status(400).json({ error: err.message });
       }
@@ -356,7 +358,8 @@ export const createAuthRoutes = ({ getDb, authService, passwordResetService, inv
     let payload: { sub: string; email?: string; role?: string };
     try {
       payload = await authService.verifyToken(token);
-    } catch {
+    } catch (err: any) {
+      log('AUTH', 'Invite: token verification failed:', err.message);
       return res.status(401).json({ error: 'Invalid or expired token' });
     }
 
@@ -378,7 +381,7 @@ export const createAuthRoutes = ({ getDb, authService, passwordResetService, inv
       await invitationService.sendInvitation(email, payload.sub);
       res.json({ message: `Invitation sent to ${email.toLowerCase()}` });
     } catch (err: any) {
-      log('AUTH', `Invite failed: ${err.message}`);
+      log('AUTH', `Invite failed:`, err.stack || err.message);
       if (err.message.includes('already exists') || err.message.includes('active invitation')) {
         return res.status(409).json({ error: err.message });
       }
@@ -399,7 +402,7 @@ export const createAuthRoutes = ({ getDb, authService, passwordResetService, inv
       const result = await invitationService.validateToken(token, email);
       res.json(result);
     } catch (err: any) {
-      log('AUTH', `Invitation validation failed: ${err.message}`);
+      log('AUTH', `Invitation validation failed:`, err.stack || err.message);
       res.status(500).json({ error: 'Failed to validate invitation' });
     }
   });
@@ -451,7 +454,7 @@ export const createAuthRoutes = ({ getDb, authService, passwordResetService, inv
         user: { id: userId, email: userEmail, role: 'user' },
       });
     } catch (err: any) {
-      log('AUTH', `Accept invitation failed: ${err.message}`);
+      log('AUTH', `Accept invitation failed:`, err.stack || err.message);
       if (err.message === 'Invalid or expired invitation token' || err.message.includes('already exists')) {
         return res.status(400).json({ error: err.message });
       }

package/templates/assistkick-product-system/packages/backend/src/routes/chat_files.test.ts

@@ -0,0 +1,95 @@
+import { describe, it, beforeEach, afterEach, mock } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, rm, mkdir, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { createChatFilesRoutes } from './chat_files.ts';
+import express from 'express';
+import type { Server } from 'node:http';
+
+const createTestApp = (workspacePath: string) => {
+  const workspaceService = {
+    getWorkspacePath: (_projectId: string) => workspacePath,
+  } as any;
+  const log = mock.fn();
+  const app = express();
+  const routes = createChatFilesRoutes({ workspaceService, log });
+  app.use('/api/chat-files', routes);
+  return { app, log };
+};
+
+const request = (server: Server) => {
+  const addr = server.address() as { port: number };
+  const base = `http://127.0.0.1:${addr.port}`;
+  return {
+    get: async (path: string) => {
+      const res = await fetch(`${base}${path}`);
+      return {
+        status: res.status,
+        headers: Object.fromEntries(res.headers.entries()),
+        text: await res.text(),
+      };
+    },
+  };
+};
+
+describe('chat_files route', () => {
+  let tmpDir: string;
+  let server: Server;
+  let req: ReturnType<typeof request>;
+
+  beforeEach(async () => {
+    tmpDir = await mkdtemp(join(tmpdir(), 'chat-files-test-'));
+    // Create .chat-uploads directory with test files
+    const uploadsDir = join(tmpDir, '.chat-uploads');
+    await mkdir(uploadsDir, { recursive: true });
+    await writeFile(join(uploadsDir, 'test_image.png'), Buffer.from('fake-png-data'));
+    await writeFile(join(uploadsDir, 'doc.txt'), 'hello world');
+
+    const { app } = createTestApp(tmpDir);
+    server = await new Promise<Server>((resolve) => {
+      const s = app.listen(0, '127.0.0.1', () => resolve(s));
+    });
+    req = request(server);
+  });
+
+  afterEach(async () => {
+    server.close();
+    await rm(tmpDir, { recursive: true, force: true });
+  });
+
+  it('serves an uploaded image file with correct content-type and caching headers', async () => {
+    const res = await req.get('/api/chat-files/proj_test/test_image.png');
+
+    assert.equal(res.status, 200);
+    assert.equal(res.headers['content-type'], 'image/png');
+    assert.ok(res.headers['cache-control']?.includes('immutable'));
+    assert.ok(res.headers['cache-control']?.includes('max-age=31536000'));
+    assert.ok(res.headers['etag']);
+  });
+
+  it('serves a text file with correct content-type', async () => {
+    const res = await req.get('/api/chat-files/proj_test/doc.txt');
+
+    assert.equal(res.status, 200);
+    assert.equal(res.headers['content-type'], 'text/plain');
+    assert.equal(res.text, 'hello world');
+  });
+
+  it('returns 404 for nonexistent file', async () => {
+    const res = await req.get('/api/chat-files/proj_test/nonexistent.png');
+    assert.equal(res.status, 404);
+  });
+
+  it('returns 404 for nonexistent workspace', async () => {
+    const { app: badApp } = createTestApp('/nonexistent/path');
+    const badServer = await new Promise<Server>((resolve) => {
+      const s = badApp.listen(0, '127.0.0.1', () => resolve(s));
+    });
+    const badReq = request(badServer);
+
+    const res = await badReq.get('/api/chat-files/proj_test/test.png');
+    assert.equal(res.status, 404);
+    badServer.close();
+  });
+});