sticky-note-cli 3.0.0 → 3.1.1

package/templates/hooks/sticky-utils.js

@@ -11,7 +11,6 @@ const { execFileSync } = require("child_process");
 
 // ── Cross-platform path normalization ──────────────────────
 
-// Normalize path separators to forward slashes for consistent storage/comparison.
 function normalizeSep(p) {
   return typeof p === "string" ? p.replace(/\\/g, "/") : p;
 }
@@ -35,14 +34,59 @@ const RETRY_PATTERNS = new RegExp(
 
 const FILE_PATH_PATTERN = /[\w./\\-]+\.\w{1,10}/g;
 
+// ── Secret redaction (best-effort, applied before transcripts are persisted) ──
+// This is a pattern-matching floor, not a guarantee — it catches common,
+// recognizably-shaped secrets (cloud provider keys, tokens, private key
+// blocks, labeled key=value pairs) before a transcript is written to
+// sticky-note/data and pushed to the team's remote. It will not catch novel
+// or oddly-formatted secrets. Teams handling especially sensitive sessions
+// should still set `capture_transcripts: false` for those repos.
+const REDACTION_PATTERNS = [
+  // AWS access key IDs
+  { name: "aws_access_key", re: /\bAKIA[0-9A-Z]{16}\b/g, replacement: "[REDACTED:aws_access_key]" },
+  // GitHub tokens (ghp_, gho_, ghu_, ghs_, ghr_)
+  { name: "github_token", re: /\bgh[pousr]_[A-Za-z0-9]{36,255}\b/g, replacement: "[REDACTED:github_token]" },
+  // Slack tokens
+  { name: "slack_token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,72}\b/g, replacement: "[REDACTED:slack_token]" },
+  // PEM-style private key blocks
+  { name: "private_key_block", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, replacement: "[REDACTED:private_key_block]" },
+  // Bearer tokens in headers/output
+  { name: "bearer_token", re: /\bBearer\s+[A-Za-z0-9\-_.~+/]+=*/gi, replacement: "Bearer [REDACTED:token]" },
+  // JWTs (three base64url segments)
+  { name: "jwt", re: /\bey[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g, replacement: "[REDACTED:jwt]" },
+  // Labeled secrets: api_key=..., token: "...", password=... etc. Keeps the
+  // label so the transcript still reads sensibly, redacts only the value.
+  //
+  // Deliberately no trailing ["']? here: transcripts are stored as raw JSONL
+  // text, so a value sitting right before a JSON string's closing quote is
+  // common ("...token: abc123"}) — an earlier version of this pattern also
+  // matched that closing quote and dropped it in the replacement, corrupting
+  // the line's JSON so it failed to parse back. The value class below
+  // ([^\s"'\n]{6,}) already excludes quotes, so it naturally stops just
+  // before one and the quote is left untouched in the output.
+  { name: "labeled_secret", re: /((?:api|secret|access)[_-]?key|token|password|passwd|pwd)(\s*[:=]\s*)["']?[^\s"'\n]{6,}/gi, replacement: "$1$2[REDACTED]" },
+];
+
+function redactSecrets(text) {
+  if (!text || typeof text !== "string") return text;
+  let out = text;
+  for (const pattern of REDACTION_PATTERNS) {
+    out = out.replace(pattern.re, pattern.replacement);
+  }
+  return out;
+}
+
 // ── Path helpers ──────────────────────────────────────────
 
+let _cachedStickyDir = null;
 function _stickyDir() {
+  if (_cachedStickyDir) return _cachedStickyDir;
   try {
     const gitDir = execFileSync("git", ["rev-parse", "--absolute-git-dir"], {
       encoding: "utf-8", timeout: 3000, stdio: ["pipe", "pipe", "pipe"],
     }).trim();
-    return path.resolve(gitDir, "sticky-note");
+    _cachedStickyDir = path.resolve(gitDir, "sticky-note");
+    return _cachedStickyDir;
   } catch (_) {
     // Fallback for non-git environments (e.g., unit tests without git init)
     const scriptDir = path.dirname(path.resolve(__filename));
@@ -103,9 +147,12 @@ function selfHealHookPaths(settingsPath) {
     if (!settingsPath) {
       settingsPath = path.join(process.cwd(), ".claude", "settings.json");
     }
-    if (!fs.existsSync(settingsPath)) return result;
-
-    const raw = fs.readFileSync(settingsPath, "utf-8");
+    let raw;
+    try {
+      raw = fs.readFileSync(settingsPath, "utf-8");
+    } catch (_) {
+      return result;
+    }
     let settings;
     try { settings = JSON.parse(raw); } catch (_) { return result; }
     if (!settings || !settings.hooks) return result;
@@ -165,6 +212,7 @@ const _paths = {
   config: "sticky-note-config.json",
   auditDir: "audit",
   presenceDir: "presence",
+  transcriptsDir: "transcripts",
   // Legacy single-file paths (for migration only)
   legacyAudit: "sticky-note-audit.jsonl",
   legacyPresence: ".sticky-presence.json",
@@ -181,6 +229,18 @@ function getPresenceDir() { return _p("presenceDir"); }
 function getLegacyAuditPath() { return _p("legacyAudit"); }
 function getLegacyPresencePath() { return _p("legacyPresence"); }
 
+// ── Transcript storage (session-level, keyed by thread ID) ────
+// Transcripts live alongside audit/presence in the sticky-note/data
+// storage layer — one JSONL file per thread, one line per contributing
+// session. Not commit-anchored (git notes) because a thread's transcript
+// belongs to the whole session, not to any single commit it produced.
+
+function getTranscriptsDir() { return _p("transcriptsDir"); }
+
+function getTranscriptPath(threadId) {
+  return path.join(getTranscriptsDir(), threadId + ".jsonl");
+}
+
 function getUserAuditPath(user) {
   if (!user) user = getUser();
   return path.join(getAuditDir(), user + ".jsonl");
@@ -245,14 +305,17 @@ function clearSessionFile() {
 
 // ── Git sync (auto-commit/push .sticky-note/ files) ──────
 
+let _cachedGitRepoRoot = null; // null = not yet computed; "" = computed but git failed
 function _gitRepoRoot() {
+  if (_cachedGitRepoRoot !== null) return _cachedGitRepoRoot || null;
   try {
-    return execFileSync("git", ["rev-parse", "--show-toplevel"], {
+    _cachedGitRepoRoot = execFileSync("git", ["rev-parse", "--show-toplevel"], {
       encoding: "utf-8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"],
     }).trim();
   } catch (_) {
-    return null;
+    _cachedGitRepoRoot = "";
   }
+  return _cachedGitRepoRoot || null;
 }
 
 /**
@@ -267,7 +330,6 @@ function syncStickyNote(opts) {
     if (!root) { result.skipped = true; return result; }
 
     const syncGuard = path.join(_stickyDir(), ".sticky-syncing");
-    if (fs.existsSync(syncGuard)) { result.skipped = true; return result; }
 
     // Check for dirty .sticky-note/ files (staged or unstaged)
     const status = execFileSync("git", [
@@ -277,8 +339,12 @@ function syncStickyNote(opts) {
 
     if (!status) { result.skipped = true; return result; }
 
-    // Write guard to prevent recursive post-commit triggers
-    fs.writeFileSync(syncGuard, process.pid.toString(), "utf-8");
+    // Write guard atomically to prevent recursive post-commit triggers
+    try {
+      fs.writeFileSync(syncGuard, process.pid.toString(), { flag: "wx", encoding: "utf-8" });
+    } catch (_) {
+      result.skipped = true; return result;
+    }
 
     try {
       // Stage the relevant files
@@ -511,9 +577,7 @@ function saveMemoryMerged(memoryPath, memory) {
   const lockPath = acquireLock(memoryPath);
   try {
     // Create backup before writing
-    if (fs.existsSync(memoryPath)) {
-      rotateBackup(memoryPath);
-    }
+    rotateBackup(memoryPath);
 
     // Load merge helpers (field-level thread merge)
     let mergeOneThread2Way = null;
@@ -558,6 +622,17 @@ function appendAuditLine(entry) {
   fs.appendFileSync(filePath, JSON.stringify(entry) + "\n", "utf-8");
 }
 
+/**
+ * Write an audit entry both to the local JSONL file and (fire-and-forget)
+ * to the cloud backend when cloud mode is active.
+ */
+function appendAuditLineBoth(entry, cloud) {
+  try { appendAuditLine(entry); } catch (_) {}
+  if (cloud) {
+    cloudAppendAudit(entry).catch(() => {});
+  }
+}
+
 // ── Environment helpers ───────────────────────────────────
 
 function getUser() {
@@ -608,16 +683,20 @@ function getSessionId(hookInput) {
   return "unknown";
 }
 
+let _cachedBranch = null;
 function getBranch() {
+  if (_cachedBranch !== null) return _cachedBranch;
   try {
     const result = execFileSync("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
       encoding: "utf-8",
       timeout: 5000,
       stdio: ["pipe", "pipe", "pipe"],
     }).trim();
-    return result;
+    _cachedBranch = result;
+    return _cachedBranch;
   } catch (_) {
-    return "";
+    _cachedBranch = "";
+    return _cachedBranch;
   }
 }
 
@@ -1049,6 +1128,11 @@ module.exports = {
   ERROR_PATTERNS,
   RETRY_PATTERNS,
   FILE_PATH_PATTERN,
+  // Transcript capture
+  REDACTION_PATTERNS,
+  redactSecrets,
+  getTranscriptsDir,
+  getTranscriptPath,
   logHookError,
   reportHookError,
   selfHealHookPaths,
@@ -1080,6 +1164,7 @@ module.exports = {
   saveJson,
   saveMemoryMerged,
   appendAuditLine,
+  appendAuditLineBoth,
   getUser,
   detectTool,
   getSessionId,
@@ -1112,6 +1197,22 @@ module.exports = {
   markOverlapDismissed,
   // V2.5: cross-platform path helper
   normalizeSep,
+  // V3: cloud transport (opt-in when STICKY_URL is set)
+  useCloud,
+  getCloudConfig,
+  getProjectName,
+  cloudFetch,
+  cloudReadThreads,
+  cloudReadThread,
+  cloudWriteThread,
+  cloudDeleteThread,
+  cloudAppendAudit,
+  cloudQueryAudit,
+  cloudReadPresence,
+  cloudWritePresence,
+  cloudDeletePresence,
+  cloudReadConfig,
+  cloudWriteConfig,
   // V2.7: auto-sync
   syncStickyNote,
   // V2.9: Copilot CLI MCP config
@@ -1123,10 +1224,195 @@ module.exports = {
   rotateBackup,
   acquireLock,
   releaseLock,
-  // Cloud sync stubs (feature not yet implemented — on-stop.js uses these)
-  useCloud: () => false,
-  cloudReadThreads: async () => null,
-  cloudWriteThread: async () => {},
-  cloudAppendAudit: async () => {},
 };
+
+// ── V3: Cloud transport layer ─────────────────────────────
+
+function _loadEnvStickyFile() {
+  try {
+    const repoRoot = _gitRepoRoot();
+    if (!repoRoot) return {};
+    const envPath = path.join(repoRoot, ".env.sticky");
+    let raw;
+    try {
+      raw = fs.readFileSync(envPath, "utf-8");
+    } catch (_) {
+      return {};
+    }
+    const vars = {};
+    for (const line of raw.split(/\r?\n/)) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#")) continue;
+      const eq = trimmed.indexOf("=");
+      if (eq > 0) {
+        vars[trimmed.slice(0, eq).trim()] = trimmed.slice(eq + 1).trim();
+      }
+    }
+    return vars;
+  } catch (_) {
+    return {};
+  }
+}
+
+let _envStickyCache = null;
+function _getEnvSticky() {
+  if (_envStickyCache === null) {
+    _envStickyCache = _loadEnvStickyFile();
+  }
+  return _envStickyCache;
+}
+
+function getCloudConfig() {
+  const envFile = _getEnvSticky();
+  return {
+    url: process.env.STICKY_URL || envFile.STICKY_URL || "",
+    apiKey: process.env.STICKY_API_KEY || envFile.STICKY_API_KEY || "",
+  };
+}
+
+let _cachedUseCloud = null;
+function useCloud() {
+  if (_cachedUseCloud !== null) return _cachedUseCloud;
+  _cachedUseCloud = !!getCloudConfig().url;
+  return _cachedUseCloud;
+}
+
+let _cachedProjectName = null;
+function getProjectName() {
+  if (_cachedProjectName !== null) return _cachedProjectName;
+
+  // Check config override first
+  try {
+    const config = loadJson(getConfigPath(), {});
+    if (config.project) {
+      _cachedProjectName = config.project;
+      return _cachedProjectName;
+    }
+  } catch (_) {}
+
+  // Auto-detect from git remote
+  try {
+    const remote = execFileSync("git", ["remote", "get-url", "origin"], {
+      encoding: "utf-8",
+      timeout: 5000,
+      stdio: ["pipe", "pipe", "pipe"],
+    }).trim();
+    // git@github.com:Owner/Repo.git → Owner/Repo
+    // https://github.com/Owner/Repo.git → Owner/Repo
+    const match = remote.match(/[:/]([^/]+\/[^/]+?)(?:\.git)?$/);
+    if (match) {
+      _cachedProjectName = match[1];
+      return _cachedProjectName;
+    }
+  } catch (_) {}
+
+  _cachedProjectName = "default";
+  return _cachedProjectName;
+}
+
+let _cloudWarned = false;
+async function cloudFetch(method, endpoint, body) {
+  if (typeof fetch === "undefined") {
+    // Node < 18 — cloud transport not supported
+    return null;
+  }
+  const { url, apiKey } = getCloudConfig();
+  if (!url) return null;
+
+  const project = getProjectName();
+  const headers = {
+    "Content-Type": "application/json",
+    "X-Sticky-Project": project,
+  };
+  if (apiKey) {
+    headers["X-Sticky-API-Key"] = apiKey;
+  }
+
+  const opts = { method, headers };
+  if (body && (method === "POST" || method === "PUT")) {
+    opts.body = JSON.stringify(body);
+  }
+
+  try {
+    const resp = await fetch(`${url}${endpoint}`, opts);
+    if (!resp.ok) {
+      return null;
+    }
+    const text = await resp.text();
+    return text ? JSON.parse(text) : {};
+  } catch (err) {
+    if (!_cloudWarned) {
+      _cloudWarned = true;
+      process.stderr.write(
+        "[STICKY-NOTE] Cloud unreachable, using local fallback\n"
+      );
+    }
+    return null;
+  }
+}
+
+// ── Cloud: Threads ────────────────────────────────────────
+
+async function cloudReadThreads(filters) {
+  const params = new URLSearchParams();
+  if (filters && filters.status) params.set("status", filters.status);
+  if (filters && filters.q) params.set("q", filters.q);
+  const qs = params.toString();
+  const result = await cloudFetch("GET", `/threads${qs ? "?" + qs : ""}`);
+  return result ? result.threads || [] : null;
+}
+
+async function cloudReadThread(id) {
+  return await cloudFetch("GET", `/threads/${id}`);
+}
+
+async function cloudWriteThread(thread) {
+  return await cloudFetch("PUT", `/threads/${thread.id}`, thread);
+}
+
+async function cloudDeleteThread(id) {
+  return await cloudFetch("DELETE", `/threads/${id}`);
+}
+
+// ── Cloud: Audit ──────────────────────────────────────────
+
+async function cloudAppendAudit(record) {
+  return await cloudFetch("POST", "/audit", record);
+}
+
+async function cloudQueryAudit(filters) {
+  const params = new URLSearchParams();
+  if (filters && filters.user) params.set("user", filters.user);
+  if (filters && filters.file) params.set("file", filters.file);
+  if (filters && filters.tool) params.set("tool", filters.tool);
+  if (filters && filters.since) params.set("since", filters.since);
+  const qs = params.toString();
+  const result = await cloudFetch("GET", `/audit${qs ? "?" + qs : ""}`);
+  return result ? result.audit || [] : null;
+}
+
+// ── Cloud: Presence ───────────────────────────────────────
+
+async function cloudReadPresence() {
+  const result = await cloudFetch("GET", "/presence");
+  return result ? result.presence || [] : null;
+}
+
+async function cloudWritePresence(record) {
+  return await cloudFetch("POST", "/presence", record);
+}
+
+async function cloudDeletePresence(user) {
+  return await cloudFetch("DELETE", `/presence/${encodeURIComponent(user)}`);
+}
+
+// ── Cloud: Config ─────────────────────────────────────────
+
+async function cloudReadConfig() {
+  return await cloudFetch("GET", "/config");
+}
+
+async function cloudWriteConfig(config) {
+  return await cloudFetch("PUT", "/config", config);
+}
 // tier1 test

package/templates/hooks/track-work.js

@@ -43,9 +43,12 @@ const {
   saveJson,
   saveMemoryMerged,
   appendAuditLine,
+  appendAuditLineBoth,
   getUser,
   getBranch,
   getSessionId,
+  useCloud,
+  cloudWritePresence,
   normalizeSep,
 } = utils;
 
@@ -227,6 +230,7 @@ function main() {
   }
 
   const sessionId = getSessionId(hookInput);
+  const cloud = useCloud();
 
   let toolName = hookInput.tool_name || "unknown";
   if (toolName === "unknown") {
@@ -282,27 +286,37 @@ function main() {
   if (checkpoint) {
     entry.checkpoint_topic = checkpoint.topic;
   }
-  appendAuditLine(entry);
+  appendAuditLineBoth(entry, cloud);
 
   updatePresence(user, filePath);
+  if (cloud) {
+    cloudWritePresence({
+      user,
+      last_seen: now,
+      active_files: filePath ? [filePath] : [],
+      session_id: sessionId,
+    }).catch(() => {});
+  }
 
   // V2.5: Write Git Note for write tools
   if (isWriteTool && filePath) {
     writeEditNote(sessionId, user, filePath, lineRanges, checkpoint);
   }
 
-  const serverName = autoDetectMcp(toolName);
-  if (serverName) {
-    const configPath = getConfigPath();
-    const config = loadJson(configPath, { stale_days: 14, mcp_servers: [] });
-    const mcpServers = config.mcp_servers || [];
-    const knownNames = new Set(
-      mcpServers.map((s) => (typeof s === "object" ? s.name : s))
-    );
-    if (!knownNames.has(serverName)) {
-      mcpServers.push({ name: serverName, source: "auto-detected" });
-      config.mcp_servers = mcpServers;
-      saveJson(configPath, config);
+  if (toolName && toolName.startsWith("mcp__")) {
+    const serverName = autoDetectMcp(toolName);
+    if (serverName) {
+      const configPath = getConfigPath();
+      const config = loadJson(configPath, { stale_days: 14, mcp_servers: [] });
+      const mcpServers = config.mcp_servers || [];
+      const knownNames = new Set(
+        mcpServers.map((s) => (typeof s === "object" ? s.name : s))
+      );
+      if (!knownNames.has(serverName)) {
+        mcpServers.push({ name: serverName, source: "auto-detected" });
+        config.mcp_servers = mcpServers;
+        saveJson(configPath, config);
+      }
     }
   }
 

package/templates/settings.json

@@ -6,7 +6,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "npx sticky-note run-hook session-start"
+            "command": "node \".claude/hooks/session-start.js\""
           }
         ]
       }
@@ -17,7 +17,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "npx sticky-note run-hook session-end"
+            "command": "node \".claude/hooks/session-end.js\""
           }
         ]
       }
@@ -28,7 +28,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "npx sticky-note run-hook inject-context"
+            "command": "node \".claude/hooks/inject-context.js\""
           }
         ]
       }
@@ -39,7 +39,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "npx sticky-note run-hook pre-tool-use"
+            "command": "node \".claude/hooks/pre-tool-use.js\""
           }
         ]
       }
@@ -50,7 +50,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "npx sticky-note run-hook track-work"
+            "command": "node \".claude/hooks/track-work.js\""
           }
         ]
       }
@@ -61,7 +61,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "npx sticky-note run-hook on-stop"
+            "command": "node \".claude/hooks/on-stop.js\""
           }
         ]
       }
@@ -72,7 +72,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "npx sticky-note run-hook on-error"
+            "command": "node \".claude/hooks/on-error.js\""
           }
         ]
       }

package/templates/sticky-note-config.json

@@ -4,6 +4,8 @@
   "inject_token_budget": 1000,
   "auto_sync": true,
   "auto_push": false,
+  "capture_transcripts": true,
+  "redact_transcripts": true,
   "mcp_servers": [],
   "skills": [],
   "conventions": [],

package/templates/sticky-note-install.yml

@@ -0,0 +1,80 @@
+# Sticky Note — Auto-Install GitHub Action
+#
+# Installs or updates Sticky Note hooks on every repo in your org.
+# Add this workflow to your org's .github repository, or to individual repos.
+#
+# Required org secrets:
+#   STICKY_URL     — Cloud backend URL (e.g., https://sticky.acme.workers.dev)
+#   STICKY_API_KEY — API key for cloud backend
+#
+# Optional org variables:
+#   STICKY_STALE_DAYS   — Thread expiry days (default: 14)
+#   STICKY_CONVENTIONS  — Comma-separated team conventions
+#   STICKY_MCP_SERVERS  — JSON array of MCP server configs
+
+name: Sticky Note Install
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  install:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Check if Sticky Note is installed
+        id: check
+        run: |
+          if [ -f ".claude/hooks/session-start.js" ]; then
+            echo "installed=true" >> $GITHUB_OUTPUT
+          else
+            echo "installed=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Install Sticky Note
+        if: steps.check.outputs.installed == 'false'
+        run: npx sticky-note-cli@latest init --ci --no-prompts
+        env:
+          STICKY_URL: ${{ secrets.STICKY_URL }}
+          STICKY_API_KEY: ${{ secrets.STICKY_API_KEY }}
+          STICKY_STALE_DAYS: ${{ vars.STICKY_STALE_DAYS }}
+          STICKY_CONVENTIONS: ${{ vars.STICKY_CONVENTIONS }}
+          STICKY_MCP_SERVERS: ${{ vars.STICKY_MCP_SERVERS }}
+
+      - name: Update Sticky Note
+        if: steps.check.outputs.installed == 'true'
+        run: npx sticky-note-cli@latest update --ci
+        env:
+          STICKY_URL: ${{ secrets.STICKY_URL }}
+          STICKY_API_KEY: ${{ secrets.STICKY_API_KEY }}
+
+      - name: Write .env.sticky
+        if: env.STICKY_URL != ''
+        run: |
+          echo "STICKY_URL=$STICKY_URL" > .env.sticky
+          echo "STICKY_API_KEY=$STICKY_API_KEY" >> .env.sticky
+        env:
+          STICKY_URL: ${{ secrets.STICKY_URL }}
+          STICKY_API_KEY: ${{ secrets.STICKY_API_KEY }}
+
+      - name: Commit changes
+        run: |
+          git config user.name "sticky-note[bot]"
+          git config user.email "sticky-note[bot]@users.noreply.github.com"
+          git add -A
+          if git diff --cached --quiet; then
+            echo "No changes to commit"
+          else
+            git commit -m "chore: install sticky note [sticky-note] [skip ci]"
+            git push
+          fi