@claudemini/shit-cli 1.8.0 → 1.8.1

package/README.md

@@ -262,7 +262,30 @@ shit-cli can send webhook notifications to external systems (Slack, Lark, CI, cu
 
 ### Configuration
 
-Add a `webhooks` field to `.shit-logs/config.json`:
+Webhook supports three configuration sources (highest priority first):
+
+**1. Environment variables** (highest priority):
+
+```bash
+export SHIT_WEBHOOK_URL=https://example.com/hook
+export SHIT_WEBHOOK_SECRET=my-secret        # HMAC-SHA256 signing
+export SHIT_WEBHOOK_AUTH_TOKEN=bearer-token  # Bearer auth (alternative to secret)
+export SHIT_WEBHOOK_EVENTS=session.ended,review.completed
+```
+
+**2. `.shit-logs/config.json` `env` field**:
+
+```json
+{
+  "env": {
+    "SHIT_WEBHOOK_URL": "https://example.com/hook",
+    "SHIT_WEBHOOK_SECRET": "my-secret",
+    "SHIT_WEBHOOK_EVENTS": "session.ended,review.completed"
+  }
+}
+```
+
+**3. `.shit-logs/config.json` `webhooks` field** (lowest priority):
 
 ```json
 {
@@ -277,15 +300,6 @@ Add a `webhooks` field to `.shit-logs/config.json`:
 }
 ```
 
-Or use environment variables (higher priority than config.json):
-
-```bash
-export SHIT_WEBHOOK_URL=https://example.com/hook
-export SHIT_WEBHOOK_SECRET=my-secret        # HMAC-SHA256 signing
-export SHIT_WEBHOOK_AUTH_TOKEN=bearer-token  # Bearer auth (alternative to secret)
-export SHIT_WEBHOOK_EVENTS=session.ended,review.completed
-```
-
 ### Authentication
 
 - **HMAC-SHA256** — Set `secret` or `SHIT_WEBHOOK_SECRET`. Adds `X-Signature-256: sha256=<hex>` header (GitHub-compatible format).

package/lib/webhook.js

@@ -11,22 +11,29 @@ import { request as httpRequest } from 'http';
 
 /**
  * Load webhook configuration from .shit-logs/config.json + environment variables.
- * Env vars take precedence over config.json values.
+ * Priority (highest wins): process.env > config.json env > config.json webhooks
  */
 export function loadWebhookConfig(projectRoot) {
   let fileConfig = {};
+  let configEnv = {};
   const configPath = join(projectRoot, '.shit-logs', 'config.json');
   if (existsSync(configPath)) {
     try {
       const raw = JSON.parse(readFileSync(configPath, 'utf-8'));
       fileConfig = raw.webhooks || {};
+      if (raw.env && typeof raw.env === 'object') {
+        configEnv = raw.env;
+      }
     } catch { /* ignore malformed config */ }
   }
 
-  const url = process.env.SHIT_WEBHOOK_URL || fileConfig.url;
+  // Resolve: process.env > config.json env > config.json webhooks field
+  const env = (key) => process.env[key] || configEnv[key] || '';
+
+  const url = env('SHIT_WEBHOOK_URL') || fileConfig.url;
   if (!url) return null;
 
-  const envEvents = process.env.SHIT_WEBHOOK_EVENTS;
+  const envEvents = env('SHIT_WEBHOOK_EVENTS');
   const events = envEvents
     ? envEvents.split(',').map(e => e.trim()).filter(Boolean)
     : (Array.isArray(fileConfig.events) ? fileConfig.events : []);
@@ -34,8 +41,8 @@ export function loadWebhookConfig(projectRoot) {
   return {
     url,
     events,
-    secret: process.env.SHIT_WEBHOOK_SECRET || fileConfig.secret || '',
-    auth_token: process.env.SHIT_WEBHOOK_AUTH_TOKEN || fileConfig.auth_token || '',
+    secret: env('SHIT_WEBHOOK_SECRET') || fileConfig.secret || '',
+    auth_token: env('SHIT_WEBHOOK_AUTH_TOKEN') || fileConfig.auth_token || '',
     headers: fileConfig.headers || {},
     timeout_ms: fileConfig.timeout_ms || 5000,
     retry: typeof fileConfig.retry === 'number' ? fileConfig.retry : 1,
@@ -169,12 +176,14 @@ export default async function webhook(args) {
     console.log('  --test    Send a test webhook ping');
     console.log('  --help    Show this help');
     console.log('');
-    console.log('Configuration:');
-    console.log('  Set webhooks in .shit-logs/config.json or via environment variables:');
+    console.log('Configuration (highest priority first):');
+    console.log('  1. Environment variables:');
     console.log('    SHIT_WEBHOOK_URL        Webhook endpoint URL');
     console.log('    SHIT_WEBHOOK_SECRET     HMAC-SHA256 signing secret');
     console.log('    SHIT_WEBHOOK_AUTH_TOKEN  Bearer token');
     console.log('    SHIT_WEBHOOK_EVENTS     Comma-separated event list');
+    console.log('  2. .shit-logs/config.json "env" field');
+    console.log('  3. .shit-logs/config.json "webhooks" field');
     return 0;
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claudemini/shit-cli",
-  "version": "1.8.0",
+  "version": "1.8.1",
   "description": "Session-based Hook Intelligence Tracker - Zero-dependency memory system for human-AI coding sessions",
   "type": "module",
   "bin": {