@getjack/jack 0.1.32 → 0.1.34

package/src/lib/agent-files.ts

@@ -7,7 +7,7 @@ import type { AgentConfig, AgentDefinition } from "./agents.ts";
  * Template for AGENTS.md
  */
 function generateAgentsMd(projectName: string, template: Template): string {
-	const summary = template.agentContext?.summary || "A Cloudflare Workers project";
+	const summary = template.agentContext?.summary || "A jack project";
 	const fullText = template.agentContext?.full_text || "";
 
 	return `# ${projectName}
@@ -16,16 +16,66 @@ function generateAgentsMd(projectName: string, template: Template): string {
 
 ## Deployment
 
-This project is deployed to Cloudflare Workers using jack:
+This project is deployed and managed via jack:
 
 \`\`\`bash
-jack ship    # Deploy to Cloudflare Workers
+jack ship    # Deploy to production
 jack logs    # Stream production logs
 \`\`\`
 
 All deployment is handled by jack. Never run \`wrangler\` commands directly.
 
+## Quick Commands
+
+| Command | What it does |
+|---------|--------------|
+| \`jack ship\` | Deploy to production |
+| \`jack logs\` | Stream live logs |
+| \`jack services\` | Manage databases, KV, and other bindings |
+| \`jack secrets\` | Manage environment secrets |
+
+## Services & Bindings
+
+Jack manages your project's services. To add a database:
+
+\`\`\`bash
+jack services db create
+\`\`\`
+
+To query it:
+
+\`\`\`bash
+jack services db query "SELECT * FROM users"
+\`\`\`
+
 ${fullText}
+
+## For AI Agents
+
+### MCP Tools
+
+If jack MCP is connected, **always prefer these tools over CLI commands or wrangler**:
+
+| Tool | Use for |
+|------|---------|
+| \`mcp__jack__create_project\` | Create a new project (supports forking via \`template: "username/slug"\`) |
+| \`mcp__jack__deploy_project\` | Deploy changes |
+| \`mcp__jack__get_project_status\` | Check deployment status and URL |
+| \`mcp__jack__list_projects\` | List all projects |
+| \`mcp__jack__create_database\` | Create a database |
+| \`mcp__jack__execute_sql\` | Query the database (read-only by default) |
+| \`mcp__jack__list_databases\` | List project databases |
+| \`mcp__jack__create_storage_bucket\` | Create object storage |
+| \`mcp__jack__create_vectorize_index\` | Create vector search index |
+| \`mcp__jack__tail_logs\` | Debug with live log samples |
+| \`mcp__jack__start_log_session\` | Start real-time log stream |
+| \`mcp__jack__create_cron\` | Create scheduled tasks |
+| \`mcp__jack__list_domains\` | List custom domains |
+| \`mcp__jack__connect_domain\` | Add a custom domain |
+
+### Documentation
+
+Full jack documentation: https://docs.getjack.org/llms-full.txt
 `;
 }
 
@@ -39,7 +89,7 @@ See [AGENTS.md](./AGENTS.md) for complete project context and deployment instruc
 
 ## Quick Commands
 
-- **Deploy**: \`jack ship\` - Deploy to Cloudflare Workers
+- **Deploy**: \`jack ship\` - Deploy to production
 - **Logs**: \`jack logs\` - Stream production logs
 
 ## Important

package/src/lib/agent-integration.ts

@@ -1,165 +1,18 @@
 /**
  * Agent integration module
  *
- * Ensures AI agents have proper context for jack projects.
+ * Ensures AI agents have MCP configured for jack projects.
  * Called during both project creation and first BYO deploy.
  */
 
-import { existsSync } from "node:fs";
-import { join } from "node:path";
-import type { Template } from "../templates/types.ts";
 import { installMcpConfigsToAllApps, isAppInstalled } from "./mcp-config.ts";
 
 export interface EnsureAgentResult {
 	mcpInstalled: string[];
-	jackMdCreated: boolean;
-	referencesAdded: string[];
 }
 
 export interface EnsureAgentOptions {
-	template?: Template;
 	silent?: boolean;
-	projectName?: string;
-}
-
-/**
- * Generate JACK.md content
- * Uses template agentContext if available, otherwise generic jack instructions
- */
-export function generateJackMd(projectName?: string, template?: Template): string {
-	const header = projectName ? `# ${projectName}\n\n` : "# Jack\n\n";
-
-	const templateSummary = template?.agentContext?.summary;
-	const templateFullText = template?.agentContext?.full_text;
-
-	const summarySection = templateSummary ? `> ${templateSummary}\n\n` : "";
-
-	const templateSection = templateFullText ? `${templateFullText}\n\n` : "";
-
-	return `${header}${summarySection}This project is deployed and managed via jack.
-
-## Quick Commands
-
-| Command | What it does |
-|---------|--------------|
-| \`jack ship\` | Deploy to production |
-| \`jack logs\` | Stream live logs |
-| \`jack services\` | Manage databases, KV, and other bindings |
-| \`jack secrets\` | Manage environment secrets |
-
-## Important
-
-- **Never run \`wrangler\` commands directly** - jack handles all infrastructure
-- Use \`jack services db\` to create and query databases
-- Secrets sync automatically across deploys
-
-## Services & Bindings
-
-Jack manages your project's services. To add a database:
-
-\`\`\`bash
-jack services db create
-\`\`\`
-
-To query it:
-
-\`\`\`bash
-jack services db query "SELECT * FROM users"
-\`\`\`
-
-More bindings (KV, R2, queues) coming soon.
-
-${templateSection}## For AI Agents
-
-### MCP Tools
-
-If jack MCP is connected, prefer these tools over CLI commands:
-
-| Tool | Use for |
-|------|---------|
-| \`mcp__jack__deploy_project\` | Deploy changes |
-| \`mcp__jack__create_database\` | Create a new database |
-| \`mcp__jack__execute_sql\` | Query the database |
-| \`mcp__jack__list_projects\` | List all projects |
-| \`mcp__jack__get_project_status\` | Check deployment status |
-
-### Documentation
-
-Full jack documentation: https://docs.getjack.org/llms-full.txt
-`;
-}
-
-/**
- * Create JACK.md if it doesn't exist
- */
-async function ensureJackMd(
-	projectPath: string,
-	projectName?: string,
-	template?: Template,
-): Promise<boolean> {
-	const jackMdPath = join(projectPath, "JACK.md");
-
-	if (existsSync(jackMdPath)) {
-		return false;
-	}
-
-	const content = generateJackMd(projectName, template);
-	await Bun.write(jackMdPath, content);
-	return true;
-}
-
-/**
- * Append JACK.md reference to existing agent files (CLAUDE.md, AGENTS.md)
- */
-async function appendJackMdReferences(projectPath: string): Promise<string[]> {
-	const filesToCheck = ["CLAUDE.md", "AGENTS.md"];
-	const referencesAdded: string[] = [];
-	const jackMdPath = join(projectPath, "JACK.md");
-
-	// Only add references if JACK.md exists
-	if (!existsSync(jackMdPath)) {
-		return referencesAdded;
-	}
-
-	const referenceBlock = `<!-- Added by jack -->
-> **Jack project** - See [JACK.md](./JACK.md) for deployment, services, and bindings.
-
-`;
-
-	for (const filename of filesToCheck) {
-		const filePath = join(projectPath, filename);
-
-		if (!existsSync(filePath)) {
-			continue;
-		}
-
-		try {
-			const content = await Bun.file(filePath).text();
-
-			// Skip if reference already exists
-			if (content.includes("JACK.md") || content.includes("<!-- Added by jack -->")) {
-				continue;
-			}
-
-			// Find position after first heading, or prepend if no heading
-			const headingMatch = content.match(/^#[^\n]*\n/m);
-			let newContent: string;
-
-			if (headingMatch && headingMatch.index !== undefined) {
-				const insertPos = headingMatch.index + headingMatch[0].length;
-				newContent = content.slice(0, insertPos) + "\n" + referenceBlock + content.slice(insertPos);
-			} else {
-				newContent = referenceBlock + content;
-			}
-
-			await Bun.write(filePath, newContent);
-			referencesAdded.push(filename);
-		} catch {
-			// Ignore errors reading/writing individual files
-		}
-	}
-
-	return referencesAdded;
 }
 
 /**
@@ -186,31 +39,16 @@ async function ensureMcpConfigured(): Promise<string[]> {
 /**
  * Ensure agent integration is set up for a project
  *
- * This function:
- * 1. Creates JACK.md if not exists (with template context if available)
- * 2. Appends JACK.md reference to existing CLAUDE.md/AGENTS.md
- * 3. Installs MCP config to detected AI apps
- *
+ * Installs MCP config to detected AI apps.
  * Safe to call multiple times - all operations are idempotent.
  */
 export async function ensureAgentIntegration(
-	projectPath: string,
-	options: EnsureAgentOptions = {},
+	_projectPath: string,
+	_options: EnsureAgentOptions = {},
 ): Promise<EnsureAgentResult> {
-	const { template, projectName } = options;
-
-	// 1. Create JACK.md if not exists
-	const jackMdCreated = await ensureJackMd(projectPath, projectName, template);
-
-	// 2. Append references to existing agent files
-	const referencesAdded = await appendJackMdReferences(projectPath);
-
-	// 3. Ensure MCP is configured
 	const mcpInstalled = await ensureMcpConfigured();
 
 	return {
 		mcpInstalled,
-		jackMdCreated,
-		referencesAdded,
 	};
 }

package/src/lib/claude-hooks-installer.ts

@@ -0,0 +1,55 @@
+import { existsSync } from "node:fs";
+import { mkdir } from "node:fs/promises";
+import { join } from "node:path";
+
+const HOOK_COMMAND = "jack mcp context 2>/dev/null || true";
+
+/**
+ * Install a Claude Code SessionStart hook to the project's .claude/settings.json.
+ * Only fires when Claude Code is opened in this project directory.
+ * Non-destructive: preserves existing hooks and deduplicates.
+ */
+export async function installClaudeCodeHooks(projectPath: string): Promise<boolean> {
+	try {
+		const claudeDir = join(projectPath, ".claude");
+		const settingsPath = join(claudeDir, "settings.json");
+
+		// Ensure .claude directory exists
+		if (!existsSync(claudeDir)) {
+			await mkdir(claudeDir, { recursive: true });
+		}
+
+		let settings: Record<string, unknown> = {};
+		if (existsSync(settingsPath)) {
+			try {
+				settings = await Bun.file(settingsPath).json();
+			} catch {
+				settings = {};
+			}
+		}
+
+		const hooks = (settings.hooks as Record<string, unknown[]>) ?? {};
+		const sessionStart = (hooks.SessionStart as Array<Record<string, unknown>>) ?? [];
+
+		// Check if jack hook is already installed
+		for (const entry of sessionStart) {
+			const entryHooks = entry.hooks as Array<Record<string, string>> | undefined;
+			if (entryHooks?.some((h) => h.command?.includes("jack mcp context"))) {
+				return true;
+			}
+		}
+
+		sessionStart.push({
+			matcher: "",
+			hooks: [{ type: "command", command: HOOK_COMMAND }],
+		});
+
+		hooks.SessionStart = sessionStart;
+		settings.hooks = hooks;
+
+		await Bun.write(settingsPath, JSON.stringify(settings, null, 2));
+		return true;
+	} catch {
+		return false;
+	}
+}

package/src/lib/control-plane.ts

@@ -3,7 +3,6 @@
  */
 
 import { debug } from "./debug.ts";
-import { formatSize } from "./format.ts";
 
 const DEFAULT_CONTROL_API_URL = "https://control.getjack.org";
 
@@ -16,12 +15,14 @@ export interface CreateProjectRequest {
 	slug?: string;
 	template?: string;
 	use_prebuilt?: boolean;
+	forked_from?: string;
 }
 
 export interface CreateManagedProjectOptions {
 	slug?: string;
 	template?: string;
 	usePrebuilt?: boolean;
+	forkedFrom?: string;
 }
 
 export interface CreateProjectResponse {
@@ -111,6 +112,9 @@ export async function createManagedProject(
 	if (options?.usePrebuilt !== undefined) {
 		requestBody.use_prebuilt = options.usePrebuilt;
 	}
+	if (options?.forkedFrom) {
+		requestBody.forked_from = options.forkedFrom;
+	}
 
 	debug("Creating managed project", {
 		name,
@@ -451,6 +455,79 @@ export async function fetchProjectResources(projectId: string): Promise<ProjectR
 	return data.resources;
 }
 
+export interface DeploymentInfo {
+	id: string;
+	status: "queued" | "building" | "live" | "failed";
+	source: string;
+	error_message: string | null;
+	message: string | null;
+	created_at: string;
+	updated_at: string;
+}
+
+export interface DeploymentListResult {
+	deployments: DeploymentInfo[];
+	total: number;
+}
+
+/**
+ * Fetch recent deployments for a managed project.
+ * Returns deployments (up to 10) and total count.
+ */
+export async function fetchDeployments(projectId: string): Promise<DeploymentListResult> {
+	const { authFetch } = await import("./auth/index.ts");
+
+	const response = await authFetch(`${getControlApiUrl()}/v1/projects/${projectId}/deployments`);
+
+	if (!response.ok) {
+		return { deployments: [], total: 0 }; // Silent fail — deployment history is supplementary
+	}
+
+	const data = (await response.json()) as { deployments: DeploymentInfo[]; total: number };
+	return { deployments: data.deployments, total: data.total };
+}
+
+export interface RollbackResponse {
+	deployment: {
+		id: string;
+		status: string;
+		source: string;
+		created_at: string;
+		updated_at: string;
+	};
+}
+
+/**
+ * Rollback a managed project to a previous deployment.
+ * If no deploymentId given, rolls back to the previous successful deployment.
+ */
+export async function rollbackDeployment(
+	projectId: string,
+	deploymentId?: string,
+): Promise<RollbackResponse> {
+	const { authFetch } = await import("./auth/index.ts");
+
+	const body: Record<string, string> = {};
+	if (deploymentId) {
+		body.deployment_id = deploymentId;
+	}
+
+	const response = await authFetch(`${getControlApiUrl()}/v1/projects/${projectId}/rollback`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify(body),
+	});
+
+	if (!response.ok) {
+		const err = (await response.json().catch(() => ({ message: "Unknown error" }))) as {
+			message?: string;
+		};
+		throw new Error(err.message || `Rollback failed: ${response.status}`);
+	}
+
+	return response.json() as Promise<RollbackResponse>;
+}
+
 /**
  * Create a resource for a managed project.
  * Uses POST /v1/projects/:id/resources/:type endpoint.
@@ -715,45 +792,6 @@ export async function getCurrentUserProfile(): Promise<UserProfile | null> {
 	}
 }
 
-export interface SourceSnapshotResponse {
-	success: boolean;
-	source_key: string;
-}
-
-/**
- * Upload a source snapshot for a project.
- * Used to enable project forking.
- */
-export async function uploadSourceSnapshot(
-	projectId: string,
-	sourceZipPath: string,
-): Promise<SourceSnapshotResponse> {
-	const { authFetch } = await import("./auth/index.ts");
-
-	const formData = new FormData();
-	const sourceFile = Bun.file(sourceZipPath);
-	formData.append("source", sourceFile);
-
-	const url = `${getControlApiUrl()}/v1/projects/${projectId}/source`;
-	debug(`Source snapshot: ${formatSize(sourceFile.size)}`);
-
-	const start = Date.now();
-	const response = await authFetch(url, {
-		method: "POST",
-		body: formData,
-	});
-	debug(`Source snapshot: ${response.status} (${((Date.now() - start) / 1000).toFixed(1)}s)`);
-
-	if (!response.ok) {
-		const error = (await response.json().catch(() => ({ message: "Upload failed" }))) as {
-			message?: string;
-		};
-		throw new Error(error.message || `Source upload failed: ${response.status}`);
-	}
-
-	return response.json() as Promise<SourceSnapshotResponse>;
-}
-
 /**
  * Publish a project to make it forkable by others.
  */

package/src/lib/crypto.ts

@@ -0,0 +1,84 @@
+/**
+ * Client-side encryption for secrets sent to the control plane.
+ *
+ * Uses hybrid RSA-OAEP + AES-GCM so secrets of any size can be encrypted.
+ * The control plane holds the matching RSA private key as a worker secret.
+ */
+
+export interface EncryptedEnvelope {
+	__encrypted: true;
+	kid: string;
+	wrappedKey: string; // base64url
+	iv: string; // base64url
+	ciphertext: string; // base64url
+}
+
+const KEY_ID = "v1";
+
+/** RSA-OAEP-256 public key for secrets encryption (generated by scripts/generate-encryption-keypair.ts) */
+const PUBLIC_KEY_JWK: JsonWebKey = {
+	alg: "RSA-OAEP-256",
+	e: "AQAB",
+	ext: true,
+	key_ops: ["encrypt"],
+	kty: "RSA",
+	n: "q2Y4K6heGkv_ABFOYokNXcwHFLAG3JScxEhjnZQTi7K8JEdCM9inqcy3gGhtT4lP6YWqhF4IHRMFU4qhPuByLASNp3bMWzDDKlckyDeWyPRnJqjb6IvwPYLw0ky1WumjjypAX_OSpNKhuYHx1X1hu7KQq9oa3f6sHFM5XbofMM2f__HvcEHnBVgkJvjTL2dn94DPgnsmtTLSRUAde34DQnXAKjVJ2jDuoC_sDAUmcmsEZKt3AUaCTkLBtbfW-ZI6_4VD2yNw-ySuOEprhhsNi6UpbjPY1ncduB5nkNhb276kVsjWo8w89KvDlhNCRyyZ_c0QRYSxn-nYEIE3vtS_h9FC9keMcDnH_fE4VPn14cjPV_G-eiUAoow8q5qBnFEp9DaaOswZ8IwEhpaxN6jvgk1WikZIBd58WB4HHSFWQ-W-096_5FA4cltQE7Qgwy86AgPnhpuCLLTqwpx8XF3GLbWtt9h4QYpfjrLyGuj4gJWCI4AJSDY1bvqiZtTfO1LdhyiZteEH0XhSBvXjXb1dJHbNXIcrIa_owtfEKqb53AxxwTvPaZazkigT0MqZ-141e7x6kuDkG_gSSFyCGrESaAyGYRh2K4wcGuV4jyZlQ6dzbQd0DPn8uRW3kC_vpToyZxZVqWGXFD6TtMYQwo_zWK3IaYCYMB-TYBFJj8a41z8",
+};
+
+function base64urlEncode(bytes: ArrayBuffer | Uint8Array): string {
+	const u8 = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+	let bin = "";
+	for (let i = 0; i < u8.length; i++) {
+		bin += String.fromCharCode(u8[i]);
+	}
+	return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+let _cachedPublicKey: CryptoKey | null = null;
+
+async function getPublicKey(): Promise<CryptoKey> {
+	if (_cachedPublicKey) return _cachedPublicKey;
+	_cachedPublicKey = await crypto.subtle.importKey(
+		"jwk",
+		PUBLIC_KEY_JWK,
+		{ name: "RSA-OAEP", hash: "SHA-256" },
+		false,
+		["encrypt"],
+	);
+	return _cachedPublicKey;
+}
+
+/** Encrypt a single plaintext string into an encrypted envelope. */
+export async function encryptSecretValue(plaintext: string): Promise<EncryptedEnvelope> {
+	const rsaKey = await getPublicKey();
+
+	// Generate ephemeral AES-256-GCM key
+	const aesKey = await crypto.subtle.generateKey({ name: "AES-GCM", length: 256 }, true, [
+		"encrypt",
+	]);
+
+	// Encrypt plaintext with AES-GCM
+	const iv = crypto.getRandomValues(new Uint8Array(12));
+	const plainBytes = new TextEncoder().encode(plaintext);
+	const ciphertext = await crypto.subtle.encrypt({ name: "AES-GCM", iv }, aesKey, plainBytes);
+
+	// Wrap the AES key with RSA-OAEP
+	const rawAesKey = await crypto.subtle.exportKey("raw", aesKey);
+	const wrappedKey = await crypto.subtle.encrypt({ name: "RSA-OAEP" }, rsaKey, rawAesKey);
+
+	return {
+		__encrypted: true,
+		kid: KEY_ID,
+		wrappedKey: base64urlEncode(wrappedKey),
+		iv: base64urlEncode(iv),
+		ciphertext: base64urlEncode(ciphertext),
+	};
+}
+
+/**
+ * Encrypt a full secrets map (Record<string, string>) as a single envelope.
+ * The entire JSON object is serialized then encrypted as one blob.
+ */
+export async function encryptSecrets(secrets: Record<string, string>): Promise<EncryptedEnvelope> {
+	return encryptSecretValue(JSON.stringify(secrets));
+}

package/src/lib/debug.ts

@@ -1,6 +1,7 @@
 // Debug utilities for timing and verbose logging
 
-let debugEnabled = false;
+let debugEnabled =
+	process.env.JACK_DEBUG === "1" || process.env.JACK_DEBUG === "true";
 const timers: Map<string, number> = new Map();
 const startTime = Date.now();
 

package/src/lib/deploy-upload.ts

@@ -6,6 +6,7 @@ import { readFile } from "node:fs/promises";
 import type { AssetManifest } from "./asset-hash.ts";
 import { authFetch } from "./auth/index.ts";
 import { getControlApiUrl } from "./control-plane.ts";
+import { encryptSecrets } from "./crypto.ts";
 import { debug } from "./debug.ts";
 import { formatSize } from "./format.ts";
 
@@ -18,6 +19,7 @@ export interface DeployUploadOptions {
 	secretsPath?: string;
 	assetsZipPath?: string;
 	assetManifest?: AssetManifest;
+	message?: string;
 }
 
 export interface DeployUploadResult {
@@ -25,6 +27,7 @@ export interface DeployUploadResult {
 	project_id: string;
 	status: "queued" | "building" | "live" | "failed";
 	source: string;
+	error_message: string | null;
 	created_at: string;
 }
 
@@ -65,13 +68,16 @@ export async function uploadDeployment(options: DeployUploadOptions): Promise<De
 	}
 
 	if (options.secretsPath) {
-		const secretsContent = await readFile(options.secretsPath);
+		const secretsContent = await readFile(options.secretsPath, "utf-8");
+		const secretsJson = JSON.parse(secretsContent) as Record<string, string>;
+		const encryptedEnvelope = await encryptSecrets(secretsJson);
+		const encryptedPayload = JSON.stringify(encryptedEnvelope);
 		formData.append(
 			"secrets",
-			new Blob([secretsContent], { type: "application/json" }),
+			new Blob([encryptedPayload], { type: "application/json" }),
 			"secrets.json",
 		);
-		totalSize += secretsContent.length;
+		totalSize += encryptedPayload.length;
 	}
 
 	if (options.assetsZipPath) {
@@ -91,6 +97,10 @@ export async function uploadDeployment(options: DeployUploadOptions): Promise<De
 		totalSize += manifestJson.length;
 	}
 
+	if (options.message) {
+		formData.append("message", options.message);
+	}
+
 	const prepareMs = Date.now() - prepareStart;
 	debug(`Payload ready: ${formatSize(totalSize)} (${prepareMs}ms)`);
 

package/src/lib/hooks.ts

@@ -533,8 +533,7 @@ const actionHandlers: {
 					const { isCancel, text } = await import("@clack/prompts");
 					const value = await text({ message: promptMsg });
 
-					if (isCancel(value) || !value.trim()) {
-						ui.warn(`Skipped ${action.key}`);
+					if (isCancel(value) || !value || !value.trim()) {
 						return false;
 					}
 
@@ -702,7 +701,9 @@ const actionHandlers: {
 		const proc = Bun.spawn(["sh", "-c", command], {
 			cwd,
 			stdin: interactive ? "inherit" : "ignore",
-			stdout: "inherit",
+			// In non-interactive mode (MCP), stdout must NOT inherit because it would
+			// write into the JSON-RPC stdio transport and corrupt the protocol.
+			stdout: interactive ? "inherit" : "pipe",
 			stderr: "inherit",
 		});
 		await proc.exited;