@jhizzard/termdeck-stack 0.4.10 → 0.4.12

package/assets/hooks/README.md

@@ -18,7 +18,7 @@ The hook:
 
 1. Skips transcripts smaller than 5 KB (no signal in tiny sessions —
    override via `TERMDECK_HOOK_MIN_BYTES`).
-2. Validates env vars (`SUPABASE_URL`, `SUPABASE_SERVICE_KEY`,
+2. Validates env vars (`SUPABASE_URL`, `SUPABASE_SERVICE_ROLE_KEY`,
    `OPENAI_API_KEY`); if any are missing, logs the missing list and
    exits cleanly without blocking the session close.
 3. Detects the project from `cwd` against a built-in regex table; falls
@@ -44,7 +44,7 @@ The hook needs three env vars at run time:
 | Var | What | How to set |
 |---|---|---|
 | `SUPABASE_URL` | Your Supabase project URL (e.g. `https://abc.supabase.co`) | `~/.termdeck/secrets.env` (Tier 2) |
-| `SUPABASE_SERVICE_KEY` | Service-role key with INSERT on `memory_items`. **Not the anon key.** | `~/.termdeck/secrets.env` |
+| `SUPABASE_SERVICE_ROLE_KEY` | Service-role key with INSERT on `memory_items`. **Not the anon key.** | `~/.termdeck/secrets.env` |
 | `OPENAI_API_KEY` | OpenAI key for embedding inference | `~/.termdeck/secrets.env` or your shell |
 
 Claude Code propagates the parent shell's environment into hook

package/assets/hooks/memory-session-end.js

@@ -22,7 +22,7 @@
  *
  * Required env vars (validated at entry):
  *   - SUPABASE_URL              e.g. https://<project-ref>.supabase.co
- *   - SUPABASE_SERVICE_KEY      service-role key (NOT the anon key — needs INSERT on memory_items)
+ *   - SUPABASE_SERVICE_ROLE_KEY      service-role key (NOT the anon key — needs INSERT on memory_items)
  *   - OPENAI_API_KEY            sk-... for text-embedding-3-small
  *
  * Optional:
@@ -73,7 +73,7 @@ function detectProject(cwd) {
 }
 
 function readEnv() {
-  const required = ['SUPABASE_URL', 'SUPABASE_SERVICE_KEY', 'OPENAI_API_KEY'];
+  const required = ['SUPABASE_URL', 'SUPABASE_SERVICE_ROLE_KEY', 'OPENAI_API_KEY'];
   const missing = required.filter((k) => !process.env[k]);
   if (missing.length) {
     log(`env-var-missing: ${missing.join(', ')} — set these in ~/.termdeck/secrets.env or your shell to enable Mnestra ingestion. Skipping.`);
@@ -81,7 +81,7 @@ function readEnv() {
   }
   return {
     supabaseUrl: process.env.SUPABASE_URL.replace(/\/$/, ''),
-    supabaseKey: process.env.SUPABASE_SERVICE_KEY,
+    supabaseKey: process.env.SUPABASE_SERVICE_ROLE_KEY,
     openaiKey: process.env.OPENAI_API_KEY,
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jhizzard/termdeck-stack",
-  "version": "0.4.10",
+  "version": "0.4.12",
   "description": "One-command installer for the TermDeck developer memory stack: TermDeck + Mnestra + Rumen + Supabase MCP",
   "bin": {
     "termdeck-stack": "./src/index.js"

package/src/index.js

@@ -53,6 +53,34 @@ const HOOK_DEST = path.join(HOOK_DEST_DIR, 'memory-session-end.js');
 const HOOK_SOURCE = path.join(__dirname, '..', 'assets', 'hooks', 'memory-session-end.js');
 const HOOK_COMMAND = 'node ~/.claude/hooks/memory-session-end.js';
 const HOOK_TIMEOUT_SECONDS = 30;
+const SECRETS_PATH = path.join(HOME, '.termdeck', 'secrets.env');
+
+// Read ~/.termdeck/secrets.env into a plain object. Returns {} if the file
+// is absent or unreadable. Used to populate the mnestra MCP env block with
+// concrete values — Claude Code does NOT shell-expand `${VAR}` references
+// in MCP env, so writing placeholders results in mnestra receiving the
+// literal string `${SUPABASE_URL}` and Supabase rejecting it as an invalid
+// URL. Writing concrete values is the only thing that works.
+function readTermdeckSecrets() {
+  try {
+    const text = fs.readFileSync(SECRETS_PATH, 'utf8');
+    const out = {};
+    for (const raw of text.split('\n')) {
+      const line = raw.trim();
+      if (!line || line.startsWith('#')) continue;
+      const m = line.match(/^([A-Z_][A-Z0-9_]*)=(.*)$/);
+      if (!m) continue;
+      let v = m[2];
+      if (v.length >= 2 && (v[0] === '"' || v[0] === "'") && v[v.length - 1] === v[0]) {
+        v = v.slice(1, -1);
+      }
+      out[m[1]] = v;
+    }
+    return out;
+  } catch (_err) {
+    return {};
+  }
+}
 
 const LAYERS = [
   {
@@ -297,18 +325,60 @@ function wireMcpEntries(plan, opts) {
   const keptExisting = [];
 
   if (installedTiers.has(2) && !servers.mnestra) {
+    // Claude Code does NOT expand `${VAR}` in MCP env — placeholders pass
+    // through literally and mnestra rejects them as an invalid SUPABASE_URL.
+    // Read concrete values from ~/.termdeck/secrets.env. Missing keys fall
+    // back to process.env (the installer was launched from the user's shell,
+    // which may export them); if still empty, leave the key out so mnestra's
+    // own secrets.env fallback gets a chance to load it.
+    const secrets = readTermdeckSecrets();
+    const env = {};
+    for (const key of ['SUPABASE_URL', 'SUPABASE_SERVICE_ROLE_KEY', 'OPENAI_API_KEY']) {
+      const v = secrets[key] || process.env[key] || '';
+      if (v) env[key] = v;
+    }
     servers.mnestra = {
       type: 'stdio',
       command: 'mnestra',
-      env: {
-        SUPABASE_URL: '${SUPABASE_URL}',
-        SUPABASE_SERVICE_ROLE_KEY: '${SUPABASE_SERVICE_ROLE_KEY}',
-        OPENAI_API_KEY: '${OPENAI_API_KEY}',
-      },
+      env,
     };
     additions.push('mnestra');
+    if (!env.SUPABASE_URL || !env.SUPABASE_SERVICE_ROLE_KEY) {
+      process.stdout.write(
+        `${ANSI.yellow}!${ANSI.reset} mnestra MCP added with incomplete env — ` +
+        `set SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY in ${SECRETS_PATH} ` +
+        `or via \`claude mcp remove mnestra -s user\` followed by ` +
+        `\`claude mcp add mnestra -s user -e SUPABASE_URL=... -e SUPABASE_SERVICE_ROLE_KEY=... -e OPENAI_API_KEY=... -- mnestra\`.\n`
+      );
+    }
   } else if (servers.mnestra) {
-    keptExisting.push('mnestra');
+    // Repair pass: existing entry from a buggy installer (≤ 0.4.11) used
+    // `${VAR}` placeholders that Claude Code never expands. If we detect
+    // those, swap in concrete values from secrets.env / process.env.
+    const env = { ...(servers.mnestra.env || {}) };
+    let repaired = false;
+    const secrets = readTermdeckSecrets();
+    for (const key of ['SUPABASE_URL', 'SUPABASE_SERVICE_ROLE_KEY', 'OPENAI_API_KEY']) {
+      const cur = env[key];
+      const looksLikePlaceholder = typeof cur === 'string'
+        && cur.startsWith('${') && cur.endsWith('}');
+      if (looksLikePlaceholder || cur === '') {
+        const v = secrets[key] || process.env[key] || '';
+        if (v) {
+          env[key] = v;
+          repaired = true;
+        } else if (looksLikePlaceholder) {
+          delete env[key];
+          repaired = true;
+        }
+      }
+    }
+    if (repaired) {
+      servers.mnestra = { ...servers.mnestra, env };
+      additions.push('mnestra (env repaired)');
+    } else {
+      keptExisting.push('mnestra');
+    }
   }
 
   if (installedTiers.has(4) && !servers.supabase) {