@assistkick/create 1.9.0 → 1.11.0

package/templates/assistkick-product-system/packages/backend/src/services/coherence-review.ts

@@ -232,7 +232,7 @@ export const runCoherenceReview = async (projectId?: string) => {
     await writeCoherenceData(coherenceData, projectId);
     log('COHERENCE', `=== Coherence review completed — ${sorted.length} proposals ===`);
   } catch (err: any) {
-    log('COHERENCE', `Review FAILED: ${err.message}`);
+    log('COHERENCE', `Review FAILED:`, err.stack || err.message);
     if (collectedProposals.length > 0) {
       const sorted = sortProposals(collectedProposals);
       for (const p of sorted) {
@@ -287,7 +287,7 @@ export const executeProposalAction = async (proposal: any, coherenceData: any, p
           ], dataDir);
           log('COHERENCE', `Applied suggested edge: ${fromId} --${edge.relation}--> ${toId}`);
         } catch (edgeErr: any) {
-          log('COHERENCE', `Failed to apply suggested edge: ${edgeErr.message}`);
+          log('COHERENCE', `Failed to apply suggested edge:`, edgeErr.stack || edgeErr.message);
         }
       }
       proposal.created_node_id = newNodeId;
@@ -309,7 +309,7 @@ export const executeProposalAction = async (proposal: any, coherenceData: any, p
         await removeEdgeDb(edge.from, edge.relation, edge.to);
         log('COHERENCE', `Removed edge for deprecated node: ${edge.from} --${edge.relation}--> ${edge.to}`);
       } catch (edgeErr: any) {
-        log('COHERENCE', `Failed to remove edge: ${edgeErr.message}`);
+        log('COHERENCE', `Failed to remove edge:`, edgeErr.stack || edgeErr.message);
       }
     }
     const db = getDb();

package/templates/assistkick-product-system/packages/backend/src/services/dev_command_detector.test.ts

@@ -0,0 +1,85 @@
+import { describe, it, beforeEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { DevCommandDetector } from './dev_command_detector.ts';
+import { writeFile, mkdir, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { randomBytes } from 'node:crypto';
+
+const createTmpDir = async (): Promise<string> => {
+  const dir = join(tmpdir(), `dev-detect-test-${randomBytes(4).toString('hex')}`);
+  await mkdir(dir, { recursive: true });
+  return dir;
+};
+
+describe('DevCommandDetector', () => {
+  let detector: DevCommandDetector;
+  let tmpDir: string;
+
+  beforeEach(async () => {
+    detector = new DevCommandDetector({ log: () => {} });
+    tmpDir = await createTmpDir();
+  });
+
+  it('detects "dev" script as highest priority', async () => {
+    await writeFile(join(tmpDir, 'package.json'), JSON.stringify({
+      scripts: { start: 'node server.js', dev: 'vite', serve: 'serve dist' },
+    }));
+
+    const result = await detector.detect(tmpDir);
+    assert.ok(result);
+    assert.equal(result.scriptName, 'dev');
+    assert.equal(result.command, 'vite');
+    await rm(tmpDir, { recursive: true });
+  });
+
+  it('falls back to "start" when "dev" is absent', async () => {
+    await writeFile(join(tmpDir, 'package.json'), JSON.stringify({
+      scripts: { start: 'node server.js', serve: 'serve dist' },
+    }));
+
+    const result = await detector.detect(tmpDir);
+    assert.ok(result);
+    assert.equal(result.scriptName, 'start');
+    assert.equal(result.command, 'node server.js');
+    await rm(tmpDir, { recursive: true });
+  });
+
+  it('returns null when no matching scripts exist', async () => {
+    await writeFile(join(tmpDir, 'package.json'), JSON.stringify({
+      scripts: { build: 'tsc', lint: 'eslint .' },
+    }));
+
+    const result = await detector.detect(tmpDir);
+    assert.equal(result, null);
+    await rm(tmpDir, { recursive: true });
+  });
+
+  it('returns null when no scripts field exists', async () => {
+    await writeFile(join(tmpDir, 'package.json'), JSON.stringify({
+      name: 'no-scripts',
+    }));
+
+    const result = await detector.detect(tmpDir);
+    assert.equal(result, null);
+    await rm(tmpDir, { recursive: true });
+  });
+
+  it('returns null when package.json does not exist', async () => {
+    const result = await detector.detect(join(tmpDir, 'nonexistent'));
+    assert.equal(result, null);
+    await rm(tmpDir, { recursive: true });
+  });
+
+  it('detects "serve" script', async () => {
+    await writeFile(join(tmpDir, 'package.json'), JSON.stringify({
+      scripts: { serve: 'vite preview' },
+    }));
+
+    const result = await detector.detect(tmpDir);
+    assert.ok(result);
+    assert.equal(result.scriptName, 'serve');
+    assert.equal(result.command, 'vite preview');
+    await rm(tmpDir, { recursive: true });
+  });
+});

package/templates/assistkick-product-system/packages/backend/src/services/dev_command_detector.ts

@@ -0,0 +1,54 @@
+/**
+ * DevCommandDetector — auto-detects the dev server command from a project's package.json.
+ * Scans the "scripts" field for common dev server script names and returns the command.
+ */
+
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+
+/** Priority-ordered list of script names that typically start a dev server. */
+const DEV_SCRIPT_NAMES = ['dev', 'start', 'serve', 'develop', 'preview'];
+
+interface DevCommandDetectorDeps {
+  log: (tag: string, ...args: unknown[]) => void;
+}
+
+export interface DetectedCommand {
+  scriptName: string;
+  command: string;
+}
+
+export class DevCommandDetector {
+  private readonly log: DevCommandDetectorDeps['log'];
+
+  constructor({ log }: DevCommandDetectorDeps) {
+    this.log = log;
+  }
+
+  /**
+   * Detect the dev server command from a project directory's package.json.
+   * Returns the first matching script from the priority list, or null if none found.
+   */
+  detect = async (projectDir: string): Promise<DetectedCommand | null> => {
+    const packageJsonPath = join(projectDir, 'package.json');
+
+    try {
+      const raw = await readFile(packageJsonPath, 'utf-8');
+      const pkg = JSON.parse(raw);
+      const scripts: Record<string, string> = pkg.scripts || {};
+
+      for (const name of DEV_SCRIPT_NAMES) {
+        if (scripts[name]) {
+          this.log('DEV_DETECT', `Found script "${name}": ${scripts[name]} in ${projectDir}`);
+          return { scriptName: name, command: scripts[name] };
+        }
+      }
+
+      this.log('DEV_DETECT', `No dev script found in ${packageJsonPath}`);
+      return null;
+    } catch (err: any) {
+      this.log('DEV_DETECT', `Failed to read ${packageJsonPath}: ${err.message}`);
+      return null;
+    }
+  };
+}

package/templates/assistkick-product-system/packages/backend/src/services/email_service.ts

@@ -9,27 +9,30 @@ import { Resend } from 'resend';
 interface EmailServiceDeps {
   apiKey: string;
   fromAddress: string;
+  log: (tag: string, ...args: any[]) => void;
 }
 
 export class EmailService {
   private readonly client: Resend | null;
   private readonly fromAddress: string;
+  private readonly log: (tag: string, ...args: any[]) => void;
 
-  constructor({ apiKey, fromAddress }: EmailServiceDeps) {
+  constructor({ apiKey, fromAddress, log }: EmailServiceDeps) {
     this.client = apiKey ? new Resend(apiKey) : null;
     this.fromAddress = fromAddress;
+    this.log = log;
     if (!apiKey) {
-      console.warn('[EMAIL] RESEND_API_KEY not set — email sending disabled');
+      log('EMAIL', 'RESEND_API_KEY not set — email sending disabled');
     }
   }
 
   sendPasswordResetEmail = async (to: string, resetUrl: string): Promise<void> => {
     if (!this.client) {
-      console.warn(`[EMAIL] Would send password reset to ${to}: ${resetUrl}`);
+      this.log('EMAIL', `Would send password reset to ${to}: ${resetUrl}`);
       return;
     }
 
-    console.log(`[EMAIL] Sending password reset to ${to} from ${this.fromAddress}`);
+    this.log('EMAIL', `Sending password reset to ${to} from ${this.fromAddress}`);
     const { data, error } = await this.client.emails.send({
       from: this.fromAddress,
       to,
@@ -42,19 +45,19 @@ export class EmailService {
     });
 
     if (error) {
-      console.error(`[EMAIL] Resend API error:`, error);
+      this.log('EMAIL', `Resend API error: ${error.message}`, error);
       throw new Error(`Resend API error: ${error.message}`);
     }
-    console.log(`[EMAIL] Password reset sent successfully, id=${data?.id}`);
+    this.log('EMAIL', `Password reset sent successfully, id=${data?.id}`);
   };
 
   sendInvitationEmail = async (to: string, invitationUrl: string): Promise<void> => {
     if (!this.client) {
-      console.warn(`[EMAIL] Would send invitation to ${to}: ${invitationUrl}`);
+      this.log('EMAIL', `Would send invitation to ${to}: ${invitationUrl}`);
       return;
     }
 
-    console.log(`[EMAIL] Sending invitation to ${to} from ${this.fromAddress}`);
+    this.log('EMAIL', `Sending invitation to ${to} from ${this.fromAddress}`);
     const { data, error } = await this.client.emails.send({
       from: this.fromAddress,
       to,
@@ -67,9 +70,9 @@ export class EmailService {
     });
 
     if (error) {
-      console.error(`[EMAIL] Resend API error:`, error);
+      this.log('EMAIL', `Resend API error: ${error.message}`, error);
       throw new Error(`Resend API error: ${error.message}`);
     }
-    console.log(`[EMAIL] Invitation sent successfully, id=${data?.id}`);
+    this.log('EMAIL', `Invitation sent successfully, id=${data?.id}`);
   };
 }

package/templates/assistkick-product-system/packages/backend/src/services/init.ts

@@ -34,7 +34,7 @@ const DATA_DIR = SHARED_DIR;
 const PROJECT_ROOT = join(SKILL_ROOT, '..');
 const SKILLS_DIR = join(PROJECT_ROOT, '.claude', 'skills');
 const WORKSPACES_DIR = process.env.WORKSPACES_DIR || join(PROJECT_ROOT, 'workspaces');
-const WORKTREES_DIR = join(PROJECT_ROOT, '.worktrees');
+// WORKTREES_DIR is no longer used — worktrees are per-project inside workspacesDir
 const DEVELOPER_SKILL_PATH = join(SKILLS_DIR, 'product-developer', 'SKILL.md');
 const REVIEWER_SKILL_PATH = join(SKILLS_DIR, 'product-code-reviewer', 'SKILL.md');
 const DEBUGGER_SKILL_PATH = join(SKILLS_DIR, 'product-debugger', 'SKILL.md');
@@ -46,6 +46,13 @@ export const log = (tag: string, ...args: any[]) => {
   console.log(`[${ts}] [${tag}]`, ...args);
 };
 
+/** Log an error with its stack trace for debugging. */
+export const logError = (tag: string, msg: string, err: unknown) => {
+  const ts = new Date().toISOString().slice(11, 23);
+  const stack = err instanceof Error ? err.stack : String(err);
+  console.error(`[${ts}] [${tag}] ERROR ${msg}`, stack);
+};
+
 export let claudeService: any;
 export let workflowEngine: WorkflowEngine;
 export let orchestrator: WorkflowOrchestrator;
@@ -61,7 +68,7 @@ export let videoRenderService: VideoRenderService;
 export const paths = {
   projectRoot: PROJECT_ROOT,
   workspacesDir: WORKSPACES_DIR,
-  worktreesDir: WORKTREES_DIR,
+  worktreesDir: '', // deprecated — worktrees are per-project inside workspacesDir
   skillsDir: SKILLS_DIR,
   toolsDir: TOOLS_DIR,
   dataDir: DATA_DIR,
@@ -74,7 +81,7 @@ export const paths = {
 
 export const initServices = (verbose: boolean) => {
   claudeService = createClaudeService({ verbose, log });
-  const gitWorkflow = new GitWorkflow({ claudeService, projectRoot: PROJECT_ROOT, worktreesDir: WORKTREES_DIR, log });
+  const gitWorkflow = new GitWorkflow({ claudeService, workspacesDir: WORKSPACES_DIR, log });
 
   // New services for project git repo integration
   githubAppService = new GitHubAppService({ log });
@@ -96,6 +103,7 @@ export const initServices = (verbose: boolean) => {
     kanban: { getKanbanEntry, saveKanbanEntry },
     claudeService,
     gitWorkflow,
+    skillsDir: SKILLS_DIR,
     bundleService,
     ttsService,
     videoRenderService,

package/templates/assistkick-product-system/packages/backend/src/services/invitation_service.ts

@@ -89,7 +89,7 @@ export class InvitationService {
       await this.emailService.sendInvitationEmail(normalizedEmail, invitationUrl);
       this.log('INVITE', `Invitation sent to ${normalizedEmail}`);
     } catch (err: any) {
-      this.log('INVITE', `Failed to send invitation email: ${err.message}`);
+      this.log('INVITE', `Failed to send invitation email:`, err.stack || err.message);
       throw new Error('Failed to send invitation email');
     }
   };

package/templates/assistkick-product-system/packages/backend/src/services/password_reset_service.ts

@@ -73,7 +73,7 @@ export class PasswordResetService {
       await this.emailService.sendPasswordResetEmail(user.email, resetUrl);
       this.log('RESET', `Reset email sent to ${user.email}`);
     } catch (err: any) {
-      this.log('RESET', `Failed to send reset email: ${err.message}`);
+      this.log('RESET', `Failed to send reset email:`, err.stack || err.message);
       throw new Error('Failed to send reset email');
     }
   };

package/templates/assistkick-product-system/packages/backend/src/services/permission_service.test.ts

@@ -0,0 +1,243 @@
+import { describe, it, mock, beforeEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { PermissionService, type PermissionRequest } from './permission_service.ts';
+
+/** Wait for microtasks (async operations) to complete */
+const tick = () => new Promise(resolve => setTimeout(resolve, 5));
+
+/**
+ * Create a mock database that simulates Drizzle ORM's chainable API.
+ */
+const createMockDb = (alwaysRules: Array<{ toolName: string }> = []) => {
+  const insertedRows: unknown[] = [];
+
+  return {
+    select: mock.fn((..._args: unknown[]) => ({
+      from: mock.fn(() => ({
+        where: mock.fn(() => ({
+          limit: mock.fn(() => alwaysRules),
+        })),
+      })),
+    })),
+    insert: mock.fn(() => ({
+      values: mock.fn(async (val: unknown) => {
+        insertedRows.push(val);
+      }),
+    })),
+    delete: mock.fn(() => ({
+      where: mock.fn(async () => {}),
+    })),
+    _insertedRows: insertedRows,
+  };
+};
+
+describe('PermissionService', () => {
+  let service: PermissionService;
+  let mockDb: ReturnType<typeof createMockDb>;
+  let logMock: ReturnType<typeof mock.fn>;
+
+  beforeEach(() => {
+    logMock = mock.fn();
+    mockDb = createMockDb();
+
+    service = new PermissionService({
+      getDb: () => mockDb,
+      log: logMock,
+    });
+  });
+
+  describe('isToolAllowed', () => {
+    it('returns false for unknown tool with empty DB', async () => {
+      const result = await service.isToolAllowed('proj_1', 'session_1', 'Read');
+      assert.equal(result, false);
+    });
+
+    it('returns true when tool has an "always" rule in DB', async () => {
+      const dbWithRules = createMockDb([{ toolName: 'Read' }]);
+      const svc = new PermissionService({ getDb: () => dbWithRules, log: logMock });
+      const result = await svc.isToolAllowed('proj_1', 'session_1', 'Read');
+      assert.equal(result, true);
+    });
+  });
+
+  describe('requestPermission', () => {
+    it('creates a pending request and notifies handler', async () => {
+      let receivedRequest: PermissionRequest | null = null;
+      service.setPermissionRequestHandler((req) => {
+        receivedRequest = req;
+      });
+
+      // Start the request — don't await (it blocks until resolved)
+      const promise = service.requestPermission('proj_1', 'session_1', 'Read', { file_path: '/test.ts' });
+
+      // Wait for isToolAllowed async check to complete
+      await tick();
+
+      // Handler should have been notified
+      assert.ok(receivedRequest !== null);
+      assert.equal(receivedRequest!.toolName, 'Read');
+      assert.equal(receivedRequest!.claudeSessionId, 'session_1');
+      assert.ok(receivedRequest!.requestId.startsWith('perm_'));
+
+      // Resolve the permission
+      const resolved = await service.resolvePermission(receivedRequest!.requestId, 'proj_1', 'allow_once');
+      assert.equal(resolved, true);
+
+      const response = await promise;
+      assert.equal(response.decision, 'allow_once');
+    });
+
+    it('rejects when no handler is registered', async () => {
+      await assert.rejects(
+        () => service.requestPermission('proj_1', 'session_1', 'Read', {}),
+        { message: 'No permission request handler registered' },
+      );
+    });
+
+    it('resolves immediately when tool is already allowed in DB', async () => {
+      const dbWithRules = createMockDb([{ toolName: 'Read' }]);
+      const svc = new PermissionService({ getDb: () => dbWithRules, log: logMock });
+
+      const response = await svc.requestPermission('proj_1', 'session_1', 'Read', {});
+      assert.equal(response.decision, 'allow_always');
+    });
+  });
+
+  describe('resolvePermission', () => {
+    it('returns false for unknown requestId', async () => {
+      const result = await service.resolvePermission('unknown', 'proj_1', 'allow_once');
+      assert.equal(result, false);
+    });
+
+    it('persists "allow_always" to database', async () => {
+      let receivedRequest: PermissionRequest | null = null;
+      service.setPermissionRequestHandler((req) => {
+        receivedRequest = req;
+      });
+
+      const promise = service.requestPermission('proj_1', 'session_1', 'Read', {});
+      await tick();
+
+      // Resolve with "allow_always"
+      await service.resolvePermission(receivedRequest!.requestId, 'proj_1', 'allow_always');
+      await promise;
+
+      // Should have called insert for the "always" rule
+      assert.ok(mockDb.insert.mock.calls.length > 0);
+    });
+
+    it('stores session rule in memory for "allow_session"', async () => {
+      let receivedRequest: PermissionRequest | null = null;
+      service.setPermissionRequestHandler((req) => {
+        receivedRequest = req;
+      });
+
+      const promise = service.requestPermission('proj_1', 'session_1', 'Read', {});
+      await tick();
+
+      await service.resolvePermission(receivedRequest!.requestId, 'proj_1', 'allow_session');
+      await promise;
+
+      // Now the same tool should be allowed for this session (in-memory)
+      // isToolAllowed checks session permissions first
+      const allowed = await service.isToolAllowed('proj_1', 'session_1', 'Read');
+      assert.equal(allowed, true);
+    });
+  });
+
+  describe('cancelPendingRequests', () => {
+    it('cancels all pending requests for a session', async () => {
+      service.setPermissionRequestHandler(() => {});
+
+      const promise = service.requestPermission('proj_1', 'session_1', 'Read', {});
+      await tick();
+
+      // Cancel the request
+      service.cancelPendingRequests('session_1');
+
+      // The promise should reject
+      await assert.rejects(() => promise, { message: 'Permission request cancelled — session ended' });
+    });
+
+    it('does not cancel requests for other sessions', async () => {
+      service.setPermissionRequestHandler(() => {});
+
+      const promise = service.requestPermission('proj_1', 'session_1', 'Read', {});
+      await tick();
+
+      // Cancel requests for session_2 — should not affect session_1
+      service.cancelPendingRequests('session_2');
+
+      assert.equal(service.getPendingCount(), 1);
+
+      // Clean up — cancel session_1 too
+      service.cancelPendingRequests('session_1');
+      await promise.catch(() => {}); // Ignore rejection
+    });
+  });
+
+  describe('clearSessionPermissions', () => {
+    it('clears session-scoped permissions', async () => {
+      // Add a session rule first
+      let receivedRequest: PermissionRequest | null = null;
+      service.setPermissionRequestHandler((req) => {
+        receivedRequest = req;
+      });
+
+      const promise = service.requestPermission('proj_1', 'session_1', 'Read', {});
+      await tick();
+
+      await service.resolvePermission(receivedRequest!.requestId, 'proj_1', 'allow_session');
+      await promise;
+
+      // Tool should be allowed
+      let allowed = await service.isToolAllowed('proj_1', 'session_1', 'Read');
+      assert.equal(allowed, true);
+
+      // Clear session permissions
+      service.clearSessionPermissions('session_1');
+
+      // Tool should no longer be allowed (DB has no rules)
+      allowed = await service.isToolAllowed('proj_1', 'session_1', 'Read');
+      assert.equal(allowed, false);
+    });
+  });
+
+  describe('getAlwaysRules', () => {
+    it('returns tool names from the database', async () => {
+      const dbWithRules = createMockDb();
+      // Override select to return rules without the limit chain
+      dbWithRules.select = mock.fn(() => ({
+        from: mock.fn(() => ({
+          where: mock.fn(() => [
+            { toolName: 'Read' },
+            { toolName: 'Glob' },
+          ]),
+        })),
+      }));
+
+      const svc = new PermissionService({ getDb: () => dbWithRules, log: logMock });
+      const rules = await svc.getAlwaysRules('proj_1');
+      assert.deepEqual(rules, ['Read', 'Glob']);
+    });
+  });
+
+  describe('getPendingCount', () => {
+    it('returns 0 when no pending requests', () => {
+      assert.equal(service.getPendingCount(), 0);
+    });
+
+    it('returns correct count with pending requests', async () => {
+      service.setPermissionRequestHandler(() => {});
+
+      const promise = service.requestPermission('proj_1', 'session_1', 'Read', {});
+      await tick();
+
+      assert.equal(service.getPendingCount(), 1);
+
+      // Clean up — cancel and await the rejection
+      service.cancelPendingRequests('session_1');
+      await promise.catch(() => {});
+    });
+  });
+});