sticky-note-cli 2.6.10 → 2.6.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sticky-note-cli",
-  "version": "2.6.10",
+  "version": "2.6.12",
   "description": "Human-to-human handoff for AI coding assistants. Git-backed shared memory for Claude Code and Copilot CLI.",
   "license": "MIT",
   "bin": {

package/templates/CLAUDE.md

@@ -189,9 +189,15 @@ if set up by `npx sticky-note init`.
 ### ⚠️ Overlap warnings (CRITICAL — always surface these)
 
 Sticky-note hooks detect when your files overlap with other teammates'
-open or stuck threads. When you see `[STICKY-NOTE] ⚠️ OVERLAP DETECTED`
-in your injected context, you **MUST** start your response with this
-exact banner format before doing ANYTHING else:
+open or stuck threads. Overlap warnings arrive through TWO channels:
+
+1. **Injected context** — `[STICKY-NOTE] ⚠️ OVERLAP DETECTED` appears in
+   your hook output. This fires on every user prompt.
+2. **Tool call deny** — Your first tool call may be denied with a reason
+   containing "CRITICAL INSTRUCTION" and the overlap details.
+
+When you receive an overlap warning through EITHER channel, you **MUST**
+start your response with this exact banner format before doing ANYTHING else:
 
 ```
 ⚠️ Overlap detected: [user] is working on [files] — [narrative summary]
@@ -202,6 +208,7 @@ Rules:
 - This banner MUST be the **very first thing** in your response
 - Do NOT bury it at the end or in a footnote
 - Do NOT rephrase it as "Also noted..." or "By the way..."
+- If a tool call was denied with overlap info, display the warning then proceed
 - Then continue with the user's actual request normally
 
 This pattern exists to prevent two teammates from wasting hours on the

package/templates/copilot-instructions.md

@@ -167,9 +167,16 @@ if set up by `npx sticky-note init`.
 ### ⚠️ Overlap warnings (CRITICAL — always surface these)
 
 Sticky-note hooks detect when your files overlap with other teammates'
-open or stuck threads. When you see `[STICKY-NOTE] ⚠️ OVERLAP DETECTED`
-in your injected context, you **MUST** start your response with this
-exact banner format before doing ANYTHING else:
+open or stuck threads. Overlap warnings arrive through TWO channels:
+
+1. **Injected context** — `[STICKY-NOTE] ⚠️ OVERLAP DETECTED` appears in
+   your `additionalContext`. This fires on every user prompt.
+2. **Tool call deny** — Your first tool call may be denied with a
+   `permissionDecisionReason` containing "CRITICAL INSTRUCTION" and the
+   overlap details. After the deny, the tool is auto-retried.
+
+When you receive an overlap warning through EITHER channel, you **MUST**
+start your response with this exact banner format before doing ANYTHING else:
 
 ```
 ⚠️ Overlap detected: [user] is working on [files] — [narrative summary]
@@ -187,6 +194,7 @@ Rules:
 - Show it BEFORE your thinking indicators (◐, ●, etc.)
 - Do NOT bury it at the end or in a footnote
 - Do NOT rephrase it as "Also noted..." or "By the way..."
+- If a tool call was denied with overlap info, display the warning then proceed
 - Then continue with the user's actual request normally
 
 This pattern exists to prevent two teammates from wasting hours on the

package/templates/hooks/inject-context.js

@@ -54,7 +54,6 @@ const {
   getResumeThreadId, findThreadById, getSessionId,
   appendAuditLine, detectTool, getConfigPath,
   isThreadInjected, markThreadInjected, normalizeSep,
-  writeOverlapSignal, isOverlapDismissed,
 } = utils;
 
 // ── Git helpers ───────────────────────────────────────────
@@ -151,8 +150,9 @@ function detectAndFormatOverlaps(threads, currentUser) {
   });
 
   const lines = [
-    "## [STICKY-NOTE] ⚠️ OVERLAP DETECTED — TELL THE USER IMMEDIATELY\n",
-    "**IMPORTANT: You MUST surface this warning to the user before doing anything else.**\n",
+    "## [STICKY-NOTE] ⚠️ OVERLAP DETECTED\n",
+    "**CRITICAL INSTRUCTION: Display the overlap warning below as the FIRST line of your response.",
+    "Do NOT skip this. Do NOT rephrase it. Do NOT bury it.**\n",
     "Someone else is working on files you're touching:\n",
   ];
   for (const { thread, overlap } of warnings) {
@@ -529,10 +529,6 @@ function main() {
     // Even with no scored threads, check for overlaps
     const overlapWarning = detectAndFormatOverlaps(threads, currentUser);
     if (overlapWarning) {
-      // Write signal file for preToolUse deny (user-visible in Copilot CLI)
-      if (_isCopilotCli() && !isOverlapDismissed()) {
-        writeOverlapSignal(overlapWarning);
-      }
       _auditInject("no_scored_threads", 0);
       _emit(overlapWarning);
       return;
@@ -590,10 +586,6 @@ function main() {
   // Prepend overlap warning if other users' threads touch the same files
   const overlapWarning = detectAndFormatOverlaps(threads, currentUser);
   if (overlapWarning) {
-    // Write signal file for preToolUse deny (user-visible in Copilot CLI)
-    if (_isCopilotCli() && !isOverlapDismissed()) {
-      writeOverlapSignal(overlapWarning);
-    }
     output = overlapWarning + "\n" + output;
   }
 

package/templates/hooks/pre-tool-use.js

@@ -61,8 +61,11 @@ const {
   appendAuditLine,
   isThreadInjected,
   markThreadInjected,
-  readAndDeleteOverlapSignal,
-  markOverlapDismissed,
+  isOverlapWarned,
+  markOverlapWarned,
+  getMemoryPath,
+  loadJson,
+  normalizeSep,
 } = utils;
 
 // ── File path extraction from tool input ──────────────────
@@ -133,49 +136,93 @@ function formatThreadForInjection(threadData, file) {
   return lines.join("\n");
 }
 
-// ── Overlap deny via signal file (Copilot CLI only) ───────
-// inject-context.js writes .overlap-pending with the warning text.
-// We read+delete it atomically and return a deny. No shared state,
-// no TTL, no session-ID issues.
+// ── Overlap deny via COPILOT_LOADER_PID (Copilot CLI only) ──
+// Each Copilot CLI session has a unique COPILOT_LOADER_PID env var.
+// On the first tool call, if overlaps exist, deny with the warning.
+// The warned state is keyed by PID so concurrent sessions don't interfere.
+
+const { execSync } = require("child_process");
+
+function _getRecentlyModifiedFiles() {
+  const files = new Set();
+  for (const target of ["HEAD~5", "HEAD~1"]) {
+    try {
+      const result = execSync(`git diff --name-only ${target}`, {
+        encoding: "utf-8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"],
+      });
+      for (const f of result.trim().split(/\r?\n/)) {
+        if (f.trim()) files.add(f.trim());
+      }
+      break;
+    } catch (_) { /* target doesn't exist */ }
+  }
+  try {
+    const result = execSync("git diff --name-only", {
+      encoding: "utf-8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"],
+    });
+    for (const f of result.trim().split(/\r?\n/)) {
+      if (f.trim()) files.add(f.trim());
+    }
+  } catch (_) { /* ignore */ }
+  return files;
+}
 
-function _checkOverlapSignal() {
+function _checkOverlapsAndDeny() {
   if (!_isCopilotCli()) return null;
+  if (!process.env.COPILOT_LOADER_PID) return null;
+  if (isOverlapWarned()) return null;
 
-  const signalContent = readAndDeleteOverlapSignal();
-  if (!signalContent) return null;
-
-  // Extract a concise version for the deny reason
-  // The signal file contains the full markdown warning from detectAndFormatOverlaps
-  const lines = signalContent.split("\n").filter((l) => l.trim());
-  const denyLines = ["⚠️ OVERLAP DETECTED — someone else is working on files you're touching:"];
-  for (const line of lines) {
-    // Include lines that show user/file info (start with "- [")
-    if (line.trimStart().startsWith("- [")) {
-      denyLines.push("  " + line.trim().replace(/^- /, ""));
-    }
+  let threads;
+  try {
+    const data = loadJson(getMemoryPath());
+    threads = data.threads || [];
+  } catch (_) {
+    return null;
+  }
+
+  const currentUser = getUser();
+  const modifiedFiles = _getRecentlyModifiedFiles();
+  if (modifiedFiles.size === 0) return null;
+
+  const warnings = [];
+  for (const thread of threads.filter((t) => t.status === "open" || t.status === "stuck")) {
+    const threadUser = thread.user || thread.author || "";
+    if (threadUser === currentUser) continue;
+    const threadFiles = (thread.files_touched || []).map(normalizeSep);
+    const overlap = threadFiles.filter((f) => modifiedFiles.has(f));
+    if (overlap.length > 0) warnings.push({ thread, overlap });
   }
-  if (denyLines.length === 1) {
-    // Fallback: just use first 300 chars of signal
-    denyLines.push(signalContent.substring(0, 300));
+
+  if (warnings.length === 0) return null;
+
+  const lines = [
+    "CRITICAL INSTRUCTION: Before doing anything else, display the following overlap warning to the user.",
+    "This is NOT optional. Show it as the FIRST line of your response.\n",
+  ];
+  for (const { thread, overlap } of warnings) {
+    const user = thread.user || thread.author || "unknown";
+    const status = thread.status === "stuck" ? "STUCK" : "OPEN";
+    const snip = (thread.narrative || thread.last_note || "").substring(0, 80);
+    const threadId = (thread.id || "").substring(0, 8);
+    lines.push(`⚠️ Overlap detected: ${user} is working on ${overlap.join(", ")}${snip ? " — " + snip : ""}`);
+    lines.push(`   Status: ${status} | Resume: npx sticky-note resume ${threadId}`);
   }
-  denyLines.push("Consider coordinating before proceeding. This tool call will be auto-retried.");
+  lines.push("\nAfter displaying the warning, continue with the user's request. This tool call will be auto-retried.");
 
-  // Mark as dismissed so inject-context doesn't re-create signal for 5 minutes
-  markOverlapDismissed();
+  markOverlapWarned();
 
-  // Audit
   try {
     appendAuditLine({
       type: "overlap_deny",
-      user: getUser(),
+      user: currentUser,
       ts: new Date().toISOString(),
-      session_id: getSessionId({}),
+      copilot_pid: process.env.COPILOT_LOADER_PID,
     });
   } catch (_) { /* ignore */ }
 
   return {
     permissionDecision: "deny",
-    permissionDecisionReason: denyLines.join("\n"),
+    permissionDecisionReason: lines.join("\n"),
   };
 }
 
@@ -195,8 +242,8 @@ function main() {
   const sessionId = getSessionId(hookInput);
 
   // ── Overlap deny gate (Copilot CLI only) ──
-  // Check if inject-context.js wrote a pending overlap signal file.
-  const denyResult = _checkOverlapSignal();
+  // Detect overlaps and deny on first tool call, keyed by COPILOT_LOADER_PID.
+  const denyResult = _checkOverlapsAndDeny();
   if (denyResult) {
     process.stdout.write(JSON.stringify(denyResult) + "\n");
     return;

package/templates/hooks/sticky-utils.js

@@ -590,49 +590,53 @@ function markThreadInjected(threadId, sessionId) {
   saveInjectedSet(data);
 }
 
-// ── Overlap signal file (V2.6.10) ─────────────────────────
-// Signal file approach: inject-context.js writes .overlap-pending with the
-// warning text. pre-tool-use.js reads+deletes it atomically and returns a
-// deny with the content. This avoids shared-state / TTL / session-ID issues.
+// ── Overlap warning tracking (V2.6.11) ────────────────────
+// Uses COPILOT_LOADER_PID to identify each Copilot CLI session uniquely.
+// Each session gets its own overlap-warned flag, preventing cross-session
+// poisoning. The flag file stores a JSON object keyed by PID.
 
-const _overlapPendingPath = () => path.join(_stickyDir(), ".overlap-pending");
-const _overlapDismissedPath = () => path.join(_stickyDir(), ".overlap-dismissed");
+const _overlapFlagPath = () => path.join(_stickyDir(), ".overlap-warned");
 
-function writeOverlapSignal(text) {
-  try {
-    fs.writeFileSync(_overlapPendingPath(), text, "utf-8");
-  } catch (_) { /* ignore */ }
+function _getCopilotPid() {
+  return process.env.COPILOT_LOADER_PID || null;
 }
 
-function readAndDeleteOverlapSignal() {
+function isOverlapWarned() {
+  const pid = _getCopilotPid();
+  if (!pid) return false;
   try {
-    const content = fs.readFileSync(_overlapPendingPath(), "utf-8");
-    fs.unlinkSync(_overlapPendingPath());
-    return content || null;
-  } catch (_) {
-    return null;
-  }
-}
-
-function isOverlapDismissed(ttlMs) {
-  try {
-    const raw = fs.readFileSync(_overlapDismissedPath(), "utf-8").trim();
-    const elapsed = Date.now() - new Date(raw).getTime();
-    return elapsed < (ttlMs || 300000); // default 5 minutes
+    const data = JSON.parse(fs.readFileSync(_overlapFlagPath(), "utf-8"));
+    return !!data[pid];
   } catch (_) {
     return false;
   }
 }
 
-function markOverlapDismissed() {
+function markOverlapWarned() {
+  const pid = _getCopilotPid();
+  if (!pid) return;
+  let data = {};
   try {
-    fs.writeFileSync(_overlapDismissedPath(), new Date().toISOString(), "utf-8");
+    data = JSON.parse(fs.readFileSync(_overlapFlagPath(), "utf-8"));
+  } catch (_) { /* empty or missing */ }
+  // Clean up stale PIDs (older than 1 hour)
+  const now = Date.now();
+  for (const [k, v] of Object.entries(data)) {
+    if (now - v > 3600000) delete data[k];
+  }
+  data[pid] = now;
+  try {
+    fs.writeFileSync(_overlapFlagPath(), JSON.stringify(data), "utf-8");
   } catch (_) { /* ignore */ }
 }
 
-// Legacy stubs — kept for API compat
-function isOverlapWarned() { return false; }
-function markOverlapWarned() { /* no-op */ }
+// Signal file helpers — kept for backward compat but no longer primary
+const _overlapPendingPath = () => path.join(_stickyDir(), ".overlap-pending");
+const _overlapDismissedPath = () => path.join(_stickyDir(), ".overlap-dismissed");
+function writeOverlapSignal(text) { try { fs.writeFileSync(_overlapPendingPath(), text, "utf-8"); } catch (_) {} }
+function readAndDeleteOverlapSignal() { try { const c = fs.readFileSync(_overlapPendingPath(), "utf-8"); fs.unlinkSync(_overlapPendingPath()); return c || null; } catch (_) { return null; } }
+function isOverlapDismissed(ttlMs) { try { const e = Date.now() - new Date(fs.readFileSync(_overlapDismissedPath(), "utf-8").trim()).getTime(); return e < (ttlMs || 300000); } catch (_) { return false; } }
+function markOverlapDismissed() { try { fs.writeFileSync(_overlapDismissedPath(), new Date().toISOString(), "utf-8"); } catch (_) {} }
 
 // ── Active resumed thread tracking (V2.5) ─────────────────