sticky-note-cli 2.8.1 → 2.9.0

package/bin/cli.js

@@ -83,6 +83,28 @@ function readTemplate(name) {
   return fs.readFileSync(path.join(TEMPLATES_DIR, name), "utf-8");
 }
 
+// Replace $(git rev-parse --show-toplevel) with absolute root path
+// so hook commands work from any CWD without shell expansion.
+function resolveHookPaths(obj, rootDir) {
+  const root = rootDir.replace(/\\/g, "/");
+  const resolve = (s) =>
+    s.replace(/"\$\(git rev-parse --show-toplevel\)\//g, `"${root}/`);
+  const hooks = obj.hooks || {};
+  for (const entries of Object.values(hooks)) {
+    for (const entry of Array.isArray(entries) ? entries : []) {
+      if (entry.hooks) {
+        for (const h of entry.hooks) {
+          if (h.command) h.command = resolve(h.command);
+        }
+      }
+      if (entry.bash) entry.bash = resolve(entry.bash);
+      if (entry.powershell) entry.powershell = resolve(entry.powershell);
+      if (entry.command) entry.command = resolve(entry.command);
+    }
+  }
+  return obj;
+}
+
 function makeExecutable(filePath) {
   try {
     fs.chmodSync(filePath, 0o755);
@@ -304,6 +326,62 @@ function countJsonlLines(filePath) {
   }
 }
 
+// ──────────────────────────────────────────────
+// Copilot CLI MCP config helpers
+// ──────────────────────────────────────────────
+
+function getCopilotCliConfigDir() {
+  if (process.env.COPILOT_HOME) return process.env.COPILOT_HOME;
+  const home = process.env.HOME || process.env.USERPROFILE;
+  if (!home) return null;
+  return path.join(home, ".copilot");
+}
+
+function getCopilotCliMcpConfigPath() {
+  const dir = getCopilotCliConfigDir();
+  return dir ? path.join(dir, "mcp-config.json") : null;
+}
+
+/**
+ * Register an MCP server in Copilot CLI's ~/.copilot/mcp-config.json.
+ * Only writes if the ~/.copilot/ directory exists (Copilot CLI is installed).
+ */
+function ensureMcpInCopilotCliConfig(serverName, serverConfig) {
+  try {
+    const configDir = getCopilotCliConfigDir();
+    if (!configDir || !fs.existsSync(configDir)) return false;
+
+    const configPath = path.join(configDir, "mcp-config.json");
+    let config = {};
+    if (fs.existsSync(configPath)) {
+      try {
+        config = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+      } catch (_) {
+        config = {};
+      }
+    }
+
+    config.mcpServers = config.mcpServers || {};
+    const existing = config.mcpServers[serverName];
+    // Copilot CLI requires "tools" field — fix entries missing it
+    if (existing) {
+      if (!existing.tools) {
+        existing.tools = ["*"];
+        fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+        return true;
+      }
+      return false;
+    }
+
+    if (!serverConfig.tools) serverConfig.tools = ["*"];
+    config.mcpServers[serverName] = serverConfig;
+    fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+    return true;
+  } catch (_) {
+    return false;
+  }
+}
+
 // ──────────────────────────────────────────────
 // Auto-detection
 // ──────────────────────────────────────────────
@@ -331,6 +409,28 @@ function detectMcpServers() {
     } catch (err) { debugLog("detectMcpServers settings.json: " + (err.message || err)); }
   }
 
+  // Also detect from Copilot CLI's ~/.copilot/mcp-config.json
+  const copilotMcpPath = getCopilotCliMcpConfigPath();
+  if (copilotMcpPath && fs.existsSync(copilotMcpPath)) {
+    try {
+      const copilotMcp = JSON.parse(fs.readFileSync(copilotMcpPath, "utf-8"));
+      const mcpServers = copilotMcp.mcpServers || {};
+      for (const [name, config] of Object.entries(mcpServers)) {
+        if (servers.has(name)) continue; // repo-level takes precedence
+        const entry = {
+          name,
+          type: config.type || config.transport || "unknown",
+          source: "~/.copilot/mcp-config.json",
+        };
+        if (config.command) entry.command = config.command;
+        if (config.args) entry.args = config.args;
+        if (config.env) entry.env = config.env;
+        if (config.url) entry.url = config.url;
+        servers.set(name, entry);
+      }
+    } catch (err) { debugLog("detectMcpServers copilot mcp-config: " + (err.message || err)); }
+  }
+
   const localSettingsPath = path.join(process.cwd(), ".claude", "settings.local.json");
   if (fs.existsSync(localSettingsPath)) {
     try {
@@ -434,13 +534,18 @@ async function syncMcpFromStickyNote(rl) {
   }
 
   for (const s of missing) {
-    const config = { type: s.type || "stdio" };
-    if (s.command) config.command = s.command;
-    if (s.args) config.args = s.args;
-    if (s.env) config.env = s.env;
-    if (s.url) config.url = s.url;
-    mcpJson.mcpServers[s.name] = config;
+    const serverEntry = { type: s.type || "stdio" };
+    if (s.command) serverEntry.command = s.command;
+    if (s.args) serverEntry.args = s.args;
+    if (s.env) serverEntry.env = s.env;
+    if (s.url) serverEntry.url = s.url;
+    mcpJson.mcpServers[s.name] = serverEntry;
     print(`  [OK] Added ${s.name} to .mcp.json`);
+
+    // Also register in Copilot CLI config
+    if (ensureMcpInCopilotCliConfig(s.name, serverEntry)) {
+      print(`  [OK] Added ${s.name} to ~/.copilot/mcp-config.json`);
+    }
   }
 
   fs.writeFileSync(mcpJsonPath, JSON.stringify(mcpJson, null, 2) + "\n");
@@ -551,12 +656,14 @@ async function cmdInit() {
 
   // Create settings.json (Claude Code)
   const settingsTemplate = JSON.parse(readTemplate("settings.json"));
+  resolveHookPaths(settingsTemplate, process.cwd());
   const settingsDest = path.join(process.cwd(), ".claude", "settings.json");
   fs.writeFileSync(settingsDest, JSON.stringify(settingsTemplate, null, 2) + "\n");
   print("  [OK] .claude/settings.json");
 
   // Create hooks.json (Copilot CLI)
   const hooksTemplate = JSON.parse(readTemplate("hooks.json"));
+  resolveHookPaths(hooksTemplate, process.cwd());
   const hooksDest = path.join(githubHooksDir, "hooks.json");
   fs.writeFileSync(hooksDest, JSON.stringify(hooksTemplate, null, 2) + "\n");
   print("  [OK] .github/hooks/hooks.json");
@@ -693,10 +800,11 @@ async function cmdInit() {
   copyFile(mergeDriverSrc, mergeDriverDest);
   print("  [OK] .sticky-note/merge-driver.js installed");
   try {
+    const mergeRoot = process.cwd().replace(/\\/g, "/");
     execFileSync("git", ["config", "merge.sticky-note.name", "Sticky Note thread merge"], {
       cwd: process.cwd(), stdio: ["pipe", "pipe", "pipe"],
     });
-    execFileSync("git", ["config", "merge.sticky-note.driver", "node \"$(git rev-parse --show-toplevel)/.sticky-note/merge-driver.js\" %O %A %B"], {
+    execFileSync("git", ["config", "merge.sticky-note.driver", `node "${mergeRoot}/.sticky-note/merge-driver.js" %O %A %B`], {
       cwd: process.cwd(), stdio: ["pipe", "pipe", "pipe"],
     });
     print("  [OK] git merge driver configured (merge.sticky-note)");
@@ -831,6 +939,24 @@ async function cmdInit() {
     debugLog("git add --force .claude/ failed: " + (err.message || err));
   }
 
+  // Register sticky-note MCP server in Copilot CLI's ~/.copilot/mcp-config.json
+  const stickyMcpEntry = {
+    type: "stdio",
+    command: "npx",
+    args: ["-y", "-p", "sticky-note-cli", "sticky-note", "mcp-server"],
+    tools: ["*"],
+  };
+  if (ensureMcpInCopilotCliConfig("sticky-note", stickyMcpEntry)) {
+    print("  [OK] Registered sticky-note MCP server in ~/.copilot/mcp-config.json (Copilot CLI)");
+  } else {
+    const copilotDir = getCopilotCliConfigDir();
+    if (!copilotDir || !fs.existsSync(copilotDir)) {
+      print("  ⏭️  Copilot CLI not detected (~/.copilot/ not found) — skipped mcp-config.json");
+    } else {
+      print("  ⏭️  sticky-note already registered in ~/.copilot/mcp-config.json");
+    }
+  }
+
   // Done!
   print("\n  ✨ Sticky Note V2 initialized!\n");
   print("  Next steps:");
@@ -872,6 +998,7 @@ function cmdUpdate() {
   const settingsPath = path.join(process.cwd(), ".claude", "settings.json");
   if (fs.existsSync(settingsPath)) {
     const settingsTemplate = JSON.parse(readTemplate("settings.json"));
+    resolveHookPaths(settingsTemplate, process.cwd());
     const existing = JSON.parse(fs.readFileSync(settingsPath, "utf-8"));
     existing.hooks = settingsTemplate.hooks;
     fs.writeFileSync(settingsPath, JSON.stringify(existing, null, 2) + "\n");
@@ -882,6 +1009,7 @@ function cmdUpdate() {
   const hooksPath = path.join(process.cwd(), ".github", "hooks", "hooks.json");
   if (fs.existsSync(hooksPath)) {
     const hooksTemplate = JSON.parse(readTemplate("hooks.json"));
+    resolveHookPaths(hooksTemplate, process.cwd());
     fs.writeFileSync(hooksPath, JSON.stringify(hooksTemplate, null, 2) + "\n");
     print("  [OK] .github/hooks/hooks.json (updated)");
   }
@@ -964,10 +1092,11 @@ function cmdUpdate() {
 
   // Ensure git merge driver config is set
   try {
+    const mergeRoot = process.cwd().replace(/\\/g, "/");
     execFileSync("git", ["config", "merge.sticky-note.name", "Sticky Note thread merge"], {
       cwd: process.cwd(), stdio: ["pipe", "pipe", "pipe"],
     });
-    execFileSync("git", ["config", "merge.sticky-note.driver", "node \"$(git rev-parse --show-toplevel)/.sticky-note/merge-driver.js\" %O %A %B"], {
+    execFileSync("git", ["config", "merge.sticky-note.driver", `node "${mergeRoot}/.sticky-note/merge-driver.js" %O %A %B`], {
       cwd: process.cwd(), stdio: ["pipe", "pipe", "pipe"],
     });
     print("  [OK] git merge driver configured (merge.sticky-note)");
@@ -2710,26 +2839,14 @@ async function cmdBootstrap() {
     };
 
     if (config.env) {
-      const resolvedEnv = {};
-      let hasUnresolved = false;
+      // Keep ${VAR} placeholders in .mcp.json — never write resolved secrets
+      // to committed files. Both Claude Code and Copilot CLI resolve env vars
+      // from the process environment at MCP server spawn time.
+      const safeEnv = {};
       for (const [envKey, envVal] of Object.entries(config.env)) {
-        if (typeof envVal === "string" && envVal.startsWith("${") && envVal.endsWith("}")) {
-          const varName = envVal.slice(2, -1);
-          if (resolved[varName]) {
-            resolvedEnv[envKey] = resolved[varName];
-          } else {
-            hasUnresolved = true;
-          }
-        } else {
-          resolvedEnv[envKey] = envVal;
-        }
-      }
-      if (hasUnresolved) {
-        print(`  ⚠️  ${name}: skipped (unresolved secrets)`);
-        skipped++;
-        continue;
+        safeEnv[envKey] = envVal; // preserves "${GITHUB_TOKEN}" as-is
       }
-      serverEntry.env = resolvedEnv;
+      serverEntry.env = safeEnv;
     }
 
     mcpJson.mcpServers[name] = serverEntry;
@@ -2738,6 +2855,31 @@ async function cmdBootstrap() {
 
   fs.writeFileSync(mcpJsonPath, JSON.stringify(mcpJson, null, 2) + "\n");
 
+  // 6b. Also provision to Copilot CLI's ~/.copilot/mcp-config.json
+  // This file is local-only (not committed), so resolved secrets are safe here.
+  let copilotProvisioned = 0;
+  for (const [name, config] of serverEntries) {
+    if (mcpJson.mcpServers[name]) {
+      const copilotEntry = { ...mcpJson.mcpServers[name] };
+      // Resolve ${VAR} placeholders for local-only config
+      if (copilotEntry.env) {
+        const resolvedEnv = {};
+        for (const [envKey, envVal] of Object.entries(copilotEntry.env)) {
+          if (typeof envVal === "string" && envVal.startsWith("${") && envVal.endsWith("}")) {
+            const varName = envVal.slice(2, -1);
+            resolvedEnv[envKey] = resolved[varName] || envVal;
+          } else {
+            resolvedEnv[envKey] = envVal;
+          }
+        }
+        copilotEntry.env = resolvedEnv;
+      }
+      if (ensureMcpInCopilotCliConfig(name, copilotEntry)) {
+        copilotProvisioned++;
+      }
+    }
+  }
+
   // 7. Generate .env.example from manifest env_vars
   if (Object.keys(envVarsMeta).length > 0) {
     const lines = [
@@ -2765,6 +2907,7 @@ async function cmdBootstrap() {
   print("");
   print("  ── Summary ──");
   print(`  Provisioned: ${provisioned} server(s)`);
+  if (copilotProvisioned > 0) print(`  Copilot CLI: ${copilotProvisioned} server(s) added to ~/.copilot/mcp-config.json`);
   if (skipped > 0) print(`  Skipped:     ${skipped} server(s) (missing secrets)`);
   print(`  Config:      ${mcpJsonPath}`);
   print("");
@@ -2823,6 +2966,13 @@ function cmdEnvStatus() {
   const mcpServers = manifest.mcp_servers || {};
   const serverNames = Object.keys(mcpServers);
 
+  // Also check Copilot CLI config
+  const copilotMcpPath = getCopilotCliMcpConfigPath();
+  let copilotServers = {};
+  if (copilotMcpPath && fs.existsSync(copilotMcpPath)) {
+    copilotServers = readJsonSafe(copilotMcpPath, { mcpServers: {} }).mcpServers || {};
+  }
+
   if (serverNames.length === 0) {
     print("  MCP Servers: (none defined)");
   } else {
@@ -2830,9 +2980,14 @@ function cmdEnvStatus() {
     for (const name of serverNames) {
       const config = mcpServers[name];
       const isProvisioned = registeredServers.includes(name);
-
-      if (isProvisioned) {
-        print(`    ✅ ${name} — provisioned`);
+      const inCopilotCli = !!copilotServers[name];
+
+      if (isProvisioned && inCopilotCli) {
+        print(`    ✅ ${name} — provisioned (Claude Code + Copilot CLI)`);
+      } else if (isProvisioned) {
+        print(`    ✅ ${name} — provisioned (.mcp.json only)`);
+      } else if (inCopilotCli) {
+        print(`    ✅ ${name} — provisioned (Copilot CLI only)`);
       } else {
         // Check if it needs secrets
         const envEntries = config.env || {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sticky-note-cli",
-  "version": "2.8.1",
+  "version": "2.9.0",
   "description": "Human-to-human handoff for AI coding assistants. Git-backed shared memory for Claude Code and Copilot CLI.",
   "license": "MIT",
   "bin": {

package/templates/environment/manifest.json

@@ -1,37 +1,37 @@
-{
-  "version": "1",
-
-  "mcp_servers": {
-    "context7": {
-      "type": "stdio",
-      "command": "npx",
-      "args": ["-y", "@upstash/context7-mcp@latest"],
-      "description": "Fetch up-to-date docs for any library",
-      "required": true
-    },
-    "github": {
-      "type": "stdio",
-      "command": "npx",
-      "args": ["-y", "@modelcontextprotocol/server-github"],
-      "env": {
-        "GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_TOKEN}"
-      },
-      "description": "GitHub API access",
-      "required": true
-    }
-  },
-
-  "permissions": [
-    "Bash(npx sticky-note:*)",
-    "Bash(npm test:*)",
-    "Bash(node:*)"
-  ],
-
-  "env_vars": {
-    "GITHUB_TOKEN": {
-      "description": "GitHub PAT with repo scope",
-      "docs_url": "https://github.com/settings/tokens",
-      "required": true
-    }
-  }
-}
+{
+  "version": "1",
+
+  "mcp_servers": {
+    "context7": {
+      "type": "stdio",
+      "command": "npx",
+      "args": ["-y", "@upstash/context7-mcp@latest"],
+      "description": "Fetch up-to-date docs for any library",
+      "required": true
+    },
+    "github": {
+      "type": "stdio",
+      "command": "npx",
+      "args": ["-y", "@modelcontextprotocol/server-github"],
+      "env": {
+        "GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_TOKEN}"
+      },
+      "description": "GitHub API access",
+      "required": true
+    }
+  },
+
+  "permissions": [
+    "Bash(npx sticky-note:*)",
+    "Bash(npm test:*)",
+    "Bash(node:*)"
+  ],
+
+  "env_vars": {
+    "GITHUB_TOKEN": {
+      "description": "GitHub PAT with repo scope",
+      "docs_url": "https://github.com/settings/tokens",
+      "required": true
+    }
+  }
+}

package/templates/hooks/session-start.js

@@ -62,6 +62,7 @@ const {
   clearActiveResumeThreadId,
   getActiveResumeThreadId,
   normalizeSep,
+  detectLostThreads,
 } = utils;
 
 // ── Stale-thread ageing ───────────────────────────────────
@@ -511,15 +512,43 @@ function ensureMcpServerRegistered() {
     }
 
     mcp.mcpServers = mcp.mcpServers || {};
-    if (mcp.mcpServers["sticky-note"]) return; // already registered
-
-    mcp.mcpServers["sticky-note"] = {
-      type: "stdio",
-      command: "npx",
-      args: ["-y", "-p", "sticky-note-cli", "sticky-note", "mcp-server"],
-    };
+    if (!mcp.mcpServers["sticky-note"]) {
+      mcp.mcpServers["sticky-note"] = {
+        type: "stdio",
+        command: "npx",
+        args: ["-y", "-p", "sticky-note-cli", "sticky-note", "mcp-server"],
+      };
+      fs.writeFileSync(mcpPath, JSON.stringify(mcp, null, 2) + "\n");
+    }
 
-    fs.writeFileSync(mcpPath, JSON.stringify(mcp, null, 2) + "\n");
+    // Also register in Copilot CLI's ~/.copilot/mcp-config.json
+    try {
+      const utils = require("./sticky-utils");
+      utils.ensureMcpInCopilotCliConfig("sticky-note", {
+        type: "stdio",
+        command: "npx",
+        args: ["-y", "-p", "sticky-note-cli", "sticky-note", "mcp-server"],
+        tools: ["*"],
+      });
+    } catch (_) {
+      // sticky-utils not available — inline fallback
+      const home = process.env.COPILOT_HOME || path.join(process.env.HOME || process.env.USERPROFILE || "", ".copilot");
+      if (home && fs.existsSync(home)) {
+        const copilotMcpPath = path.join(home, "mcp-config.json");
+        let copilotMcp = {};
+        try { copilotMcp = JSON.parse(fs.readFileSync(copilotMcpPath, "utf-8")); } catch (_) {}
+        copilotMcp.mcpServers = copilotMcp.mcpServers || {};
+        if (!copilotMcp.mcpServers["sticky-note"]) {
+          copilotMcp.mcpServers["sticky-note"] = {
+            type: "stdio",
+            command: "npx",
+            args: ["-y", "-p", "sticky-note-cli", "sticky-note", "mcp-server"],
+            tools: ["*"],
+          };
+          fs.writeFileSync(copilotMcpPath, JSON.stringify(copilotMcp, null, 2) + "\n");
+        }
+      }
+    }
   } catch (_) {
     // Non-fatal — MCP server registration is best-effort
   }
@@ -598,6 +627,15 @@ function ensureEnvironmentProvisioned() {
       if (debug) process.stderr.write(`[sticky-note] added MCP server "${name}"\n`);
     }
     if (mcpChanged) saveJson(mcpPath, mcpConfig);
+
+    // Also provision secret-free MCP servers to Copilot CLI's config
+    try {
+      const utils = require("./sticky-utils");
+      for (const [name, serverDef] of Object.entries(mcpServers)) {
+        if (hasEnvPlaceholders(serverDef)) continue;
+        utils.ensureMcpInCopilotCliConfig(name, serverDef);
+      }
+    } catch (_) { /* sticky-utils not available — skip Copilot CLI provisioning */ }
   }
 
   // ── Skill provisioning ──
@@ -771,6 +809,20 @@ function main() {
     project: "",
     threads: [],
   });
+
+  // Rollback detection: warn if threads went missing (e.g., after git reset)
+  try {
+    const lost = detectLostThreads(memoryPath);
+    if (lost.length > 0) {
+      const ids = lost.slice(0, 5).map((t) => t.id).join(", ");
+      const extra = lost.length > 5 ? ` (+${lost.length - 5} more)` : "";
+      process.stderr.write(
+        `[sticky-note] ⚠️  ${lost.length} thread(s) missing since last backup: ${ids}${extra}\n` +
+        `[sticky-note] This may indicate a git rollback. Run 'npx sticky-note status' to inspect.\n`
+      );
+    }
+  } catch (_) { /* rollback detection must not break session */ }
+
   const config = loadJson(getConfigPath(), { stale_days: 14 });
   const staleDays = config.stale_days != null ? config.stale_days : 14;
   const autoCloseHours =

package/templates/hooks/sticky-utils.js

@@ -284,32 +284,169 @@ function loadJson(filePath, defaultVal) {
 
 function saveJson(filePath, data) {
   fs.mkdirSync(path.dirname(filePath), { recursive: true });
-  fs.writeFileSync(filePath, JSON.stringify(data, null, 2) + "\n", "utf-8");
+  // Atomic write: write to temp file then rename to prevent partial/truncated JSON
+  const tmpPath = filePath + ".tmp." + process.pid;
+  try {
+    fs.writeFileSync(tmpPath, JSON.stringify(data, null, 2) + "\n", "utf-8");
+    fs.renameSync(tmpPath, filePath);
+  } catch (err) {
+    // Rename can fail on some Windows configs; fall back to direct write
+    try { fs.unlinkSync(tmpPath); } catch (_) {}
+    fs.writeFileSync(filePath, JSON.stringify(data, null, 2) + "\n", "utf-8");
+  }
+}
+
+// ── File locking ─────────────────────────────────────────
+
+const LOCK_STALE_MS = 10000; // 10 seconds
+const LOCK_RETRY_MS = 50;
+const LOCK_MAX_RETRIES = 60; // 3 seconds max wait
+
+function acquireLock(memoryPath) {
+  const lockPath = memoryPath + ".lock";
+  for (let i = 0; i < LOCK_MAX_RETRIES; i++) {
+    try {
+      // Exclusive create — fails if lock already exists
+      fs.writeFileSync(lockPath, JSON.stringify({ pid: process.pid, ts: Date.now() }), { flag: "wx" });
+      return lockPath;
+    } catch (_) {
+      // Lock exists — check if stale
+      try {
+        const lock = JSON.parse(fs.readFileSync(lockPath, "utf-8"));
+        if (Date.now() - lock.ts > LOCK_STALE_MS) {
+          // Stale lock — remove and retry
+          try { fs.unlinkSync(lockPath); } catch (_) {}
+          continue;
+        }
+      } catch (_) {
+        // Can't read lock — remove and retry
+        try { fs.unlinkSync(lockPath); } catch (_) {}
+        continue;
+      }
+      // Lock is fresh — wait and retry
+      const waitUntil = Date.now() + LOCK_RETRY_MS;
+      while (Date.now() < waitUntil) { /* busy wait */ }
+    }
+  }
+  // Couldn't acquire after retries — proceed without lock (best effort)
+  return null;
+}
+
+function releaseLock(lockPath) {
+  if (!lockPath) return;
+  try { fs.unlinkSync(lockPath); } catch (_) {}
+}
+
+// ── Backup rotation ──────────────────────────────────────
+
+const MAX_BACKUPS = 3;
+
+function rotateBackup(memoryPath) {
+  const dir = path.dirname(memoryPath);
+  const backupDir = path.join(dir, ".sticky-backups");
+  try {
+    fs.mkdirSync(backupDir, { recursive: true });
+    // Read current file
+    const current = fs.readFileSync(memoryPath, "utf-8");
+    // Rotate: remove oldest, shift names
+    for (let i = MAX_BACKUPS; i > 1; i--) {
+      const older = path.join(backupDir, `sticky-note.${i - 1}.json`);
+      const newer = path.join(backupDir, `sticky-note.${i}.json`);
+      try {
+        if (fs.existsSync(older)) fs.renameSync(older, newer);
+      } catch (_) {}
+    }
+    // Write newest backup
+    fs.writeFileSync(path.join(backupDir, "sticky-note.1.json"), current, "utf-8");
+  } catch (_) {
+    // Backup failure is non-fatal
+  }
+}
+
+function loadLatestBackup(memoryPath) {
+  const backupDir = path.join(path.dirname(memoryPath), ".sticky-backups");
+  for (let i = 1; i <= MAX_BACKUPS; i++) {
+    try {
+      const bp = path.join(backupDir, `sticky-note.${i}.json`);
+      return JSON.parse(fs.readFileSync(bp, "utf-8"));
+    } catch (_) {
+      continue;
+    }
+  }
+  return null;
+}
+
+/**
+ * Detect threads lost since last backup (e.g., after git reset/rollback).
+ * Returns array of thread IDs that are in backup but not in current.
+ */
+function detectLostThreads(memoryPath) {
+  try {
+    const current = loadJson(memoryPath, { threads: [] });
+    const backup = loadLatestBackup(memoryPath);
+    if (!backup || !Array.isArray(backup.threads)) return [];
+    const currentIds = new Set(
+      (current.threads || []).filter(Boolean).map((t) => t.id)
+    );
+    return (backup.threads || []).filter(
+      (t) => t && t.id && !currentIds.has(t.id) && t.status !== "expired"
+    );
+  } catch (_) {
+    return [];
+  }
 }
 
 /**
  * Merge-on-write for the memory file. Re-reads the file from disk before
  * writing and preserves any threads (by ID) that exist on disk but not in
- * the in-memory copy. This prevents concurrent sessions or un-pulled commits
- * from silently dropping other users' threads.
+ * the in-memory copy. For same-ID threads, performs field-level 2-way merge
+ * to prevent concurrent sessions from clobbering each other's changes.
+ *
+ * Uses file locking, atomic writes, and rolling backups.
  */
 function saveMemoryMerged(memoryPath, memory) {
+  const lockPath = acquireLock(memoryPath);
   try {
-    const onDisk = loadJson(memoryPath, { threads: [] });
-    const onDiskThreads = Array.isArray(onDisk.threads) ? onDisk.threads.filter(Boolean) : [];
-    const inMemoryThreads = Array.isArray(memory.threads) ? memory.threads.filter(Boolean) : [];
-    const inMemoryIds = new Set(inMemoryThreads.map((t) => t.id));
-
-    for (const diskThread of onDiskThreads) {
-      if (diskThread.id && !inMemoryIds.has(diskThread.id)) {
-        memory.threads.push(diskThread);
+    // Create backup before writing
+    if (fs.existsSync(memoryPath)) {
+      rotateBackup(memoryPath);
+    }
+
+    // Load merge helpers (field-level thread merge)
+    let mergeOneThread2Way = null;
+    try {
+      const md = require(path.join(path.dirname(memoryPath), "merge-driver.js"));
+      mergeOneThread2Way = md.mergeOneThread2Way;
+    } catch (_) {}
+
+    try {
+      const onDisk = loadJson(memoryPath, { threads: [] });
+      const onDiskThreads = Array.isArray(onDisk.threads) ? onDisk.threads.filter(Boolean) : [];
+      const inMemoryThreads = Array.isArray(memory.threads) ? memory.threads.filter(Boolean) : [];
+      const inMemoryMap = new Map(inMemoryThreads.map((t) => [t.id, t]));
+
+      for (const diskThread of onDiskThreads) {
+        if (!diskThread.id) continue;
+        if (!inMemoryMap.has(diskThread.id)) {
+          // Thread only on disk — preserve it
+          memory.threads.push(diskThread);
+        } else if (mergeOneThread2Way) {
+          // Thread on both — field-level merge
+          const inMemThread = inMemoryMap.get(diskThread.id);
+          const merged = mergeOneThread2Way(inMemThread, diskThread);
+          // Replace in-memory version with merged version
+          const idx = memory.threads.findIndex((t) => t && t.id === diskThread.id);
+          if (idx >= 0) memory.threads[idx] = merged;
+        }
       }
+    } catch (_) {
+      // If re-read/merge fails, proceed with what we have
     }
-  } catch (_) {
-    // If re-read fails, proceed with what we have
-  }
 
-  saveJson(memoryPath, memory);
+    saveJson(memoryPath, memory);
+  } finally {
+    releaseLock(lockPath);
+  }
 }
 
 function appendAuditLine(entry) {
@@ -747,6 +884,62 @@ function clearActiveResumeThreadId() {
   }
 }
 
+// ── Copilot CLI MCP config helpers ────────────────────────
+
+function getCopilotCliConfigDir() {
+  if (process.env.COPILOT_HOME) return process.env.COPILOT_HOME;
+  const home = process.env.HOME || process.env.USERPROFILE;
+  if (!home) return null;
+  return path.join(home, ".copilot");
+}
+
+function getCopilotCliMcpConfigPath() {
+  const dir = getCopilotCliConfigDir();
+  return dir ? path.join(dir, "mcp-config.json") : null;
+}
+
+/**
+ * Register an MCP server in Copilot CLI's ~/.copilot/mcp-config.json.
+ * Only writes if the ~/.copilot/ directory already exists (Copilot CLI installed).
+ * Returns true if written, false if skipped.
+ */
+function ensureMcpInCopilotCliConfig(serverName, serverConfig) {
+  try {
+    const configDir = getCopilotCliConfigDir();
+    if (!configDir || !fs.existsSync(configDir)) return false;
+
+    const configPath = path.join(configDir, "mcp-config.json");
+    let config = {};
+    if (fs.existsSync(configPath)) {
+      try {
+        config = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+      } catch (_) {
+        config = {};
+      }
+    }
+
+    config.mcpServers = config.mcpServers || {};
+    const existing = config.mcpServers[serverName];
+    // Copilot CLI requires "tools" field — fix entries missing it
+    if (existing) {
+      if (!existing.tools) {
+        existing.tools = ["*"];
+        fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+        return true;
+      }
+      return false; // already registered with tools
+    }
+
+    // Ensure tools field is present for Copilot CLI compatibility
+    if (!serverConfig.tools) serverConfig.tools = ["*"];
+    config.mcpServers[serverName] = serverConfig;
+    fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+    return true;
+  } catch (_) {
+    return false;
+  }
+}
+
 // ── Exports ───────────────────────────────────────────────
 
 module.exports = {
@@ -816,5 +1009,14 @@ module.exports = {
   normalizeSep,
   // V2.7: auto-sync
   syncStickyNote,
+  // V2.9: Copilot CLI MCP config
+  getCopilotCliMcpConfigPath,
+  ensureMcpInCopilotCliConfig,
+  // V2.10: rollback detection + backups
+  detectLostThreads,
+  loadLatestBackup,
+  rotateBackup,
+  acquireLock,
+  releaseLock,
 };
 // tier1 test

package/templates/merge-driver.js

@@ -1,89 +1,218 @@
-#!/usr/bin/env node
-/**
- * Git custom merge driver for sticky-note.json
- *
- * Merges threads by ID instead of line-based union merge.
- * For threads present in both sides, the version with the latest
- * last_activity_at wins. Threads unique to either side are preserved.
- *
- * Usage (called by git automatically):
- *   node .sticky-note/merge-driver.js %O %A %B
- *
- * %O = ancestor, %A = ours (result written here), %B = theirs
- */
-
-const fs = require("fs");
-
-function loadJson(filePath) {
-  try {
-    return JSON.parse(fs.readFileSync(filePath, "utf-8"));
-  } catch (_) {
-    return { version: "2", project: "", threads: [] };
-  }
-}
-
-function getTimestamp(thread) {
-  const ts = thread.last_activity_at || thread.closed_at || thread.created_at || "";
-  if (!ts) return 0;
-  const t = new Date(ts).getTime();
-  return isNaN(t) ? 0 : t;
-}
-
-function mergeThreads(ancestor, ours, theirs) {
-  const ancestorMap = new Map((ancestor.threads || []).map((t) => [t.id, t]));
-  const oursMap = new Map((ours.threads || []).map((t) => [t.id, t]));
-  const theirsMap = new Map((theirs.threads || []).map((t) => [t.id, t]));
-
-  const allIds = new Set([...oursMap.keys(), ...theirsMap.keys()]);
-  const merged = [];
-
-  for (const id of allIds) {
-    const inOurs = oursMap.has(id);
-    const inTheirs = theirsMap.has(id);
-    const inAncestor = ancestorMap.has(id);
-
-    if (inOurs && inTheirs) {
-      // Both sides have it — pick the most recently active version
-      const o = oursMap.get(id);
-      const t = theirsMap.get(id);
-      merged.push(getTimestamp(o) >= getTimestamp(t) ? o : t);
-    } else if (inOurs && !inTheirs) {
-      // Only in ours — keep unless theirs deliberately removed it
-      if (inAncestor) {
-        // Was in ancestor, theirs removed it — respect the deletion
-      } else {
-        merged.push(oursMap.get(id));
-      }
-    } else if (!inOurs && inTheirs) {
-      // Only in theirs — keep unless ours deliberately removed it
-      if (inAncestor) {
-        // Was in ancestor, ours removed it — respect the deletion
-      } else {
-        merged.push(theirsMap.get(id));
-      }
-    }
-  }
-
-  return merged;
-}
-
-// ── Main ──────────────────────────────────────────────────
-
-const [ancestorPath, oursPath, theirsPath] = process.argv.slice(2);
-
-if (!ancestorPath || !oursPath || !theirsPath) {
-  process.stderr.write("Usage: merge-driver.js <ancestor> <ours> <theirs>\n");
-  process.exit(1);
-}
-
-const ancestor = loadJson(ancestorPath);
-const ours = loadJson(oursPath);
-const theirs = loadJson(theirsPath);
-
-const mergedThreads = mergeThreads(ancestor, ours, theirs);
-
-// Use ours as the base for non-thread fields (version, project, etc.)
-const result = { ...ours, threads: mergedThreads };
-
-fs.writeFileSync(oursPath, JSON.stringify(result, null, 2) + "\n", "utf-8");
-process.exit(0);
+#!/usr/bin/env node
+/**
+ * Git custom merge driver for sticky-note.json
+ *
+ * Merges threads by ID with field-level 3-way merge instead of
+ * line-based union merge. For threads present in both sides, each
+ * field is merged individually using ancestor-aware rules.
+ *
+ * Usage (called by git automatically):
+ *   node .sticky-note/merge-driver.js %O %A %B
+ *
+ * %O = ancestor, %A = ours (result written here), %B = theirs
+ *
+ * Also exports merge helpers for use by sticky-utils.js saveMemoryMerged().
+ */
+
+const fs = require("fs");
+
+// Fields that are merged as set-union (deduplicated)
+const SET_UNION_FIELDS = [
+  "files_touched", "contributors", "related_session_ids",
+];
+
+// Fields that are merged as ordered-dedupe with a size cap
+const CAPPED_ARRAY_FIELDS = {
+  prompts: 20,
+  activities: 20,
+};
+
+// Fields merged by deduping on stringified value
+const DEDUPE_ARRAY_FIELDS = [
+  "failed_approaches", "resume_chain", "resume_history",
+];
+
+function loadJsonStrict(filePath) {
+  const raw = fs.readFileSync(filePath, "utf-8");
+  return JSON.parse(raw);
+}
+
+function loadJsonSafe(filePath) {
+  try {
+    return JSON.parse(fs.readFileSync(filePath, "utf-8"));
+  } catch (_) {
+    return { version: "2", project: "", threads: [] };
+  }
+}
+
+function getTimestamp(thread) {
+  if (!thread) return 0;
+  const ts = thread.last_activity_at || thread.closed_at || thread.created_at || "";
+  if (!ts) return 0;
+  const t = new Date(ts).getTime();
+  return isNaN(t) ? 0 : t;
+}
+
+function jsonEqual(a, b) {
+  return JSON.stringify(a) === JSON.stringify(b);
+}
+
+function dedupeArray(arr) {
+  const seen = new Set();
+  const result = [];
+  for (const item of arr) {
+    const key = typeof item === "string" ? item : JSON.stringify(item);
+    if (!seen.has(key)) {
+      seen.add(key);
+      result.push(item);
+    }
+  }
+  return result;
+}
+
+function sumToolCalls(a, b) {
+  if (!a && !b) return {};
+  const result = { ...(a || {}) };
+  for (const [key, val] of Object.entries(b || {})) {
+    result[key] = (result[key] || 0) + (typeof val === "number" ? val : 0);
+  }
+  return result;
+}
+
+/**
+ * Merge a single thread using 3-way (ancestor-aware) or 2-way merge.
+ * @param {object|null} ancestor - ancestor version (null for 2-way merge)
+ * @param {object} ours - our version
+ * @param {object} theirs - their version
+ * @returns {object} merged thread
+ */
+function mergeOneThread(ancestor, ours, theirs) {
+  const merged = { ...ours };
+  const allKeys = new Set([...Object.keys(ours), ...Object.keys(theirs)]);
+
+  for (const key of allKeys) {
+    if (key === "id") continue; // never change ID
+    const oVal = ours[key];
+    const tVal = theirs[key];
+
+    // If both sides are the same, nothing to merge
+    if (jsonEqual(oVal, tVal)) continue;
+
+    if (ancestor) {
+      // 3-way merge: check what changed from ancestor
+      const aVal = ancestor[key];
+      const oursChanged = !jsonEqual(oVal, aVal);
+      const theirsChanged = !jsonEqual(tVal, aVal);
+
+      if (!oursChanged && theirsChanged) {
+        // Only theirs changed — take theirs
+        merged[key] = tVal;
+        continue;
+      } else if (oursChanged && !theirsChanged) {
+        // Only ours changed — already in merged
+        continue;
+      }
+      // Both changed — fall through to conflict resolution
+    }
+
+    // Conflict resolution (both changed, or 2-way merge)
+    if (SET_UNION_FIELDS.includes(key)) {
+      merged[key] = dedupeArray([...(oVal || []), ...(tVal || [])]);
+    } else if (key in CAPPED_ARRAY_FIELDS) {
+      merged[key] = dedupeArray([...(oVal || []), ...(tVal || [])]).slice(
+        -(CAPPED_ARRAY_FIELDS[key])
+      );
+    } else if (DEDUPE_ARRAY_FIELDS.includes(key)) {
+      merged[key] = dedupeArray([...(oVal || []), ...(tVal || [])]);
+    } else if (key === "tool_calls") {
+      merged[key] = sumToolCalls(oVal, tVal);
+    } else {
+      // Scalar conflict: take from the more recently active side
+      merged[key] = getTimestamp(ours) >= getTimestamp(theirs) ? oVal : tVal;
+    }
+  }
+
+  return merged;
+}
+
+/**
+ * 2-way merge for concurrent local writes (no ancestor available).
+ */
+function mergeOneThread2Way(ours, theirs) {
+  return mergeOneThread(null, ours, theirs);
+}
+
+function mergeThreads(ancestor, ours, theirs) {
+  const ancestorMap = new Map((ancestor.threads || []).filter(Boolean).map((t) => [t.id, t]));
+  const oursMap = new Map((ours.threads || []).filter(Boolean).map((t) => [t.id, t]));
+  const theirsMap = new Map((theirs.threads || []).filter(Boolean).map((t) => [t.id, t]));
+
+  const allIds = new Set([...oursMap.keys(), ...theirsMap.keys()]);
+  const merged = [];
+
+  for (const id of allIds) {
+    const inOurs = oursMap.has(id);
+    const inTheirs = theirsMap.has(id);
+    const inAncestor = ancestorMap.has(id);
+
+    if (inOurs && inTheirs) {
+      // Both sides have it — field-level merge
+      merged.push(
+        mergeOneThread(ancestorMap.get(id) || null, oursMap.get(id), theirsMap.get(id))
+      );
+    } else if (inOurs && !inTheirs) {
+      if (inAncestor) {
+        // Was in ancestor, theirs removed it — respect the deletion
+      } else {
+        merged.push(oursMap.get(id));
+      }
+    } else if (!inOurs && inTheirs) {
+      if (inAncestor) {
+        // Was in ancestor, ours removed it — respect the deletion
+      } else {
+        merged.push(theirsMap.get(id));
+      }
+    }
+  }
+
+  return merged;
+}
+
+// ── Main (only when run directly by git) ──────────────────
+
+if (require.main === module) {
+  const [ancestorPath, oursPath, theirsPath] = process.argv.slice(2);
+
+  if (!ancestorPath || !oursPath || !theirsPath) {
+    process.stderr.write("Usage: merge-driver.js <ancestor> <ours> <theirs>\n");
+    process.exit(1);
+  }
+
+  // Ancestor may not exist (new file) — safe fallback is OK
+  const ancestor = loadJsonSafe(ancestorPath);
+
+  // Ours and theirs must be valid JSON — fail to git conflict if not
+  let ours, theirs;
+  try {
+    ours = loadJsonStrict(oursPath);
+  } catch (err) {
+    process.stderr.write(`[sticky-note] merge-driver: failed to parse ours (${oursPath}): ${err.message}\n`);
+    process.exit(1);
+  }
+  try {
+    theirs = loadJsonStrict(theirsPath);
+  } catch (err) {
+    process.stderr.write(`[sticky-note] merge-driver: failed to parse theirs (${theirsPath}): ${err.message}\n`);
+    process.exit(1);
+  }
+
+  const mergedThreads = mergeThreads(ancestor, ours, theirs);
+  const result = { ...ours, threads: mergedThreads };
+
+  fs.writeFileSync(oursPath, JSON.stringify(result, null, 2) + "\n", "utf-8");
+  process.exit(0);
+}
+
+// ── Exports for use by sticky-utils.js ────────────────────
+
+module.exports = { mergeOneThread, mergeOneThread2Way, mergeThreads, getTimestamp };