sticky-note-cli 3.1.10 → 3.1.12

package/bin/cli.js

@@ -95,9 +95,8 @@ function resolveHookPaths(_obj, _rootDir) {
   return;
 }
 
-// Detects hook commands in an existing settings.json that point at an absolute
-// path (likely written by an older sticky-note-cli on another developer's
-// machine). Returns the list of stale command strings, or [] if all clean.
+// Detects hook commands in an existing settings.json that are broken or stale.
+// Returns the list of stale command strings, or [] if all clean.
 function findStaleHookPaths(settings) {
   const stale = [];
   const hooks = (settings && settings.hooks) || {};
@@ -107,9 +106,6 @@ function findStaleHookPaths(settings) {
         const cmd = h && h.command;
         if (typeof cmd !== "string") continue;
         // Absolute paths (Unix /Users, /home, /root or Windows C:/, D:/ etc.)
-        // inside the hook command are the smoking gun. Match anywhere in the
-        // string — the path may be preceded by other tokens (env vars, shell
-        // prefixes) and may contain spaces.
         if (
           /["'][A-Za-z]:[\\/]/.test(cmd) ||
           /["']\/(?:Users|home|root|tmp)\//.test(cmd) ||
@@ -117,12 +113,9 @@ function findStaleHookPaths(settings) {
         ) {
           stale.push(cmd);
         }
-        // Old relative-path format: node ".claude/hooks/foo.js"
-        // This fails when Claude Code launches from a subdirectory of the
-        // project root, because the path resolves relative to the launch cwd,
-        // not relative to where .claude/settings.json lives. The fix is to
-        // use `npx sticky-note run-hook foo` which walks up to find the hooks.
-        if (/node\s+["']\.claude[\\/]hooks[\\/][^"']+\.js["']/.test(cmd)) {
+        // Broken `npx sticky-note run-hook X` — npm has no package named "sticky-note"
+        // (the package is "sticky-note-cli"). Written by earlier 3.x releases.
+        if (/^npx\s+sticky-note\s+run-hook\s+\S+/.test(cmd)) {
           stale.push(cmd);
         }
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sticky-note-cli",
-  "version": "3.1.10",
+  "version": "3.1.12",
   "description": "Human-to-human handoff for AI coding assistants. Git-backed shared memory for Claude Code and Copilot CLI.",
   "license": "MIT",
   "bin": {
@@ -25,7 +25,8 @@
   },
   "files": [
     "bin/",
-    "templates/"
+    "templates/",
+    "sticky-server/"
   ],
   "engines": {
     "node": ">=16.0.0"

package/sticky-server/LICENSE

@@ -0,0 +1,31 @@
+GNU AFFERO GENERAL PUBLIC LICENSE
+Version 3, 19 November 2007
+
+Copyright (C) 2026 Dheeraj Bandaru
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published
+by the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+Additional permission under GNU AGPL version 3 section 7:
+
+If you modify this Program, or any covered work, by linking or combining
+it with other code, such combination is not considered a "covered work"
+under the AGPL, provided that the other code is licensed under a
+permissive license (MIT, BSD, Apache 2.0, or similar).
+
+---
+
+The client layer of Sticky Note (bin/, templates/, hooks) is licensed
+under the MIT License. See the root LICENSE file.
+
+Only the sticky-server/ directory is covered by this AGPL license.

package/sticky-server/adapters/cf-kv.js

@@ -0,0 +1,203 @@
+/**
+ * Cloudflare KV adapter for Sticky Note V3.
+ *
+ * KV key schema (all prefixed by project):
+ *   {project}:thread:{uuid}           → thread JSON
+ *   {project}:thread-index            → JSON array of thread UUIDs
+ *   {project}:audit:{timestamp}:{uuid} → audit record JSON
+ *   {project}:audit-index             → JSON array of audit keys
+ *   {project}:presence:{user}         → presence record JSON
+ *   {project}:presence-index          → JSON array of usernames
+ *   {project}:config                  → config JSON
+ */
+
+// ── Threads ──────────────────────────────────────────────
+
+async function getThreads(kv, project, filters = {}) {
+  const indexKey = `${project}:thread-index`;
+  const index = JSON.parse((await kv.get(indexKey)) || "[]");
+
+  if (index.length === 0) return [];
+
+  const threads = await Promise.all(
+    index.map(async (id) => {
+      const raw = await kv.get(`${project}:thread:${id}`);
+      return raw ? JSON.parse(raw) : null;
+    })
+  );
+
+  let result = threads.filter(Boolean);
+
+  if (filters.status) {
+    result = result.filter((t) => t.status === filters.status);
+  }
+  if (filters.q) {
+    const q = filters.q.toLowerCase();
+    result = result.filter(
+      (t) =>
+        (t.narrative || "").toLowerCase().includes(q) ||
+        (t.handoff_summary || "").toLowerCase().includes(q) ||
+        (t.last_note || "").toLowerCase().includes(q) ||
+        (t.files_touched || []).some((f) => f.toLowerCase().includes(q))
+    );
+  }
+
+  return result;
+}
+
+async function getThread(kv, project, id) {
+  const raw = await kv.get(`${project}:thread:${id}`);
+  return raw ? JSON.parse(raw) : null;
+}
+
+async function putThread(kv, project, thread) {
+  const id = thread.id;
+  await kv.put(`${project}:thread:${id}`, JSON.stringify(thread));
+
+  // Update index
+  const indexKey = `${project}:thread-index`;
+  const index = JSON.parse((await kv.get(indexKey)) || "[]");
+  if (!index.includes(id)) {
+    index.push(id);
+    await kv.put(indexKey, JSON.stringify(index));
+  }
+}
+
+async function deleteThread(kv, project, id) {
+  // Tombstone: keep minimal record
+  const existing = await getThread(kv, project, id);
+  if (existing) {
+    const tombstone = {
+      id: existing.id,
+      user: existing.user,
+      status: "expired",
+      closed_at: existing.closed_at || new Date().toISOString(),
+      created_at: existing.created_at,
+    };
+    await kv.put(`${project}:thread:${id}`, JSON.stringify(tombstone));
+  }
+}
+
+// ── Audit ────────────────────────────────────────────────
+
+async function appendAudit(kv, project, record) {
+  const ts = record.timestamp || new Date().toISOString();
+  const uid = crypto.randomUUID();
+  const key = `${project}:audit:${ts}:${uid}`;
+  await kv.put(key, JSON.stringify(record));
+
+  const indexKey = `${project}:audit-index`;
+  const index = JSON.parse((await kv.get(indexKey)) || "[]");
+  index.push(key);
+
+  // Cap at 10,000 entries; trim oldest on overflow
+  if (index.length > 10000) {
+    const removed = index.splice(0, index.length - 10000);
+    await Promise.all(removed.map((k) => kv.delete(k)));
+  }
+  await kv.put(indexKey, JSON.stringify(index));
+}
+
+async function queryAudit(kv, project, filters = {}) {
+  const indexKey = `${project}:audit-index`;
+  const index = JSON.parse((await kv.get(indexKey)) || "[]");
+
+  if (index.length === 0) return [];
+
+  const records = await Promise.all(
+    index.map(async (key) => {
+      const raw = await kv.get(key);
+      return raw ? JSON.parse(raw) : null;
+    })
+  );
+
+  let result = records.filter(Boolean);
+
+  if (filters.user) {
+    result = result.filter((r) => r.user === filters.user);
+  }
+  if (filters.file) {
+    result = result.filter((r) => (r.file || "").includes(filters.file));
+  }
+  if (filters.tool) {
+    result = result.filter((r) => r.tool === filters.tool);
+  }
+  if (filters.since) {
+    const since = new Date(filters.since).getTime();
+    result = result.filter(
+      (r) => new Date(r.timestamp || 0).getTime() >= since
+    );
+  }
+
+  return result;
+}
+
+// ── Presence ─────────────────────────────────────────────
+
+const PRESENCE_TTL_SECONDS = 15 * 60; // 15 minutes
+
+async function getPresence(kv, project) {
+  const indexKey = `${project}:presence-index`;
+  const index = JSON.parse((await kv.get(indexKey)) || "[]");
+
+  if (index.length === 0) return [];
+
+  const records = await Promise.all(
+    index.map(async (user) => {
+      const raw = await kv.get(`${project}:presence:${user}`);
+      return raw ? JSON.parse(raw) : null;
+    })
+  );
+
+  return records.filter(Boolean);
+}
+
+async function upsertPresence(kv, project, record) {
+  const user = record.user;
+  await kv.put(`${project}:presence:${user}`, JSON.stringify(record), {
+    expirationTtl: PRESENCE_TTL_SECONDS,
+  });
+
+  const indexKey = `${project}:presence-index`;
+  const index = JSON.parse((await kv.get(indexKey)) || "[]");
+  if (!index.includes(user)) {
+    index.push(user);
+    await kv.put(indexKey, JSON.stringify(index));
+  }
+}
+
+async function deletePresence(kv, project, user) {
+  await kv.delete(`${project}:presence:${user}`);
+
+  const indexKey = `${project}:presence-index`;
+  const index = JSON.parse((await kv.get(indexKey)) || "[]");
+  const filtered = index.filter((u) => u !== user);
+  await kv.put(indexKey, JSON.stringify(filtered));
+}
+
+// ── Config ───────────────────────────────────────────────
+
+async function getConfig(kv, project) {
+  const raw = await kv.get(`${project}:config`);
+  return raw ? JSON.parse(raw) : null;
+}
+
+async function putConfig(kv, project, config) {
+  await kv.put(`${project}:config`, JSON.stringify(config));
+}
+
+// ── Export ────────────────────────────────────────────────
+
+export {
+  getThreads,
+  getThread,
+  putThread,
+  deleteThread,
+  appendAudit,
+  queryAudit,
+  getPresence,
+  upsertPresence,
+  deletePresence,
+  getConfig,
+  putConfig,
+};

package/sticky-server/worker.js

@@ -0,0 +1,229 @@
+/**
+ * Sticky Note V3 — Cloudflare Worker
+ *
+ * REST API backed by Cloudflare KV.
+ * Auth: X-Sticky-API-Key header matched against STICKY_API_KEY env var.
+ * Project routing: X-Sticky-Project header (auto-set by client hooks).
+ *
+ * Endpoints:
+ *   POST   /threads          — create thread
+ *   GET    /threads           — list threads (?status=, ?q=)
+ *   GET    /threads/:id       — get thread
+ *   PUT    /threads/:id       — update thread
+ *   DELETE /threads/:id       — tombstone thread
+ *   GET    /audit             — query audit (?file=, ?user=, ?since=, ?tool=)
+ *   POST   /audit             — append audit record
+ *   GET    /presence          — list active developers
+ *   POST   /presence          — heartbeat upsert
+ *   DELETE /presence/:user    — clear presence
+ *   GET    /config            — get team config
+ *   PUT    /config            — update team config
+ */
+
+import * as adapter from "./adapters/cf-kv.js";
+
+// ── Helpers ──────────────────────────────────────────────
+
+function json(data, status = 200) {
+  return new Response(JSON.stringify(data), {
+    status,
+    headers: { "Content-Type": "application/json" },
+  });
+}
+
+function error(message, status = 400) {
+  return json({ error: message }, status);
+}
+
+function authenticate(request, env) {
+  const key = request.headers.get("X-Sticky-API-Key");
+  if (!env.STICKY_API_KEY) return true; // no key configured = open
+  return key === env.STICKY_API_KEY;
+}
+
+function getProject(request) {
+  return request.headers.get("X-Sticky-Project") || "default";
+}
+
+// ── Router ───────────────────────────────────────────────
+
+function matchRoute(method, pathname) {
+  // Thread routes
+  if (method === "POST" && pathname === "/threads") return { handler: "createThread" };
+  if (method === "GET" && pathname === "/threads") return { handler: "listThreads" };
+  if (method === "GET" && pathname.startsWith("/threads/")) {
+    return { handler: "getThread", id: pathname.slice("/threads/".length) };
+  }
+  if (method === "PUT" && pathname.startsWith("/threads/")) {
+    return { handler: "updateThread", id: pathname.slice("/threads/".length) };
+  }
+  if (method === "DELETE" && pathname.startsWith("/threads/")) {
+    return { handler: "deleteThread", id: pathname.slice("/threads/".length) };
+  }
+
+  // Audit routes
+  if (method === "GET" && pathname === "/audit") return { handler: "queryAudit" };
+  if (method === "POST" && pathname === "/audit") return { handler: "appendAudit" };
+
+  // Presence routes
+  if (method === "GET" && pathname === "/presence") return { handler: "getPresence" };
+  if (method === "POST" && pathname === "/presence") return { handler: "upsertPresence" };
+  if (method === "DELETE" && pathname.startsWith("/presence/")) {
+    return { handler: "deletePresence", user: decodeURIComponent(pathname.slice("/presence/".length)) };
+  }
+
+  // Config routes
+  if (method === "GET" && pathname === "/config") return { handler: "getConfig" };
+  if (method === "PUT" && pathname === "/config") return { handler: "putConfig" };
+
+  // Health
+  if (method === "GET" && pathname === "/health") return { handler: "health" };
+
+  return null;
+}
+
+// ── Handlers ─────────────────────────────────────────────
+
+const handlers = {
+  async health() {
+    return json({ status: "ok", version: "3.0.0" });
+  },
+
+  // ── Threads ──
+
+  async createThread(request, kv, project) {
+    const thread = await request.json();
+    if (!thread.id) return error("thread.id is required");
+    await adapter.putThread(kv, project, thread);
+    return json(thread, 201);
+  },
+
+  async listThreads(request, kv, project) {
+    const url = new URL(request.url);
+    const filters = {
+      status: url.searchParams.get("status") || undefined,
+      q: url.searchParams.get("q") || undefined,
+    };
+    const threads = await adapter.getThreads(kv, project, filters);
+    return json({ threads });
+  },
+
+  async getThread(_request, kv, project, { id }) {
+    const thread = await adapter.getThread(kv, project, id);
+    if (!thread) return error("Thread not found", 404);
+    return json(thread);
+  },
+
+  async updateThread(request, kv, project, { id }) {
+    const thread = await request.json();
+    thread.id = id;
+    await adapter.putThread(kv, project, thread);
+    return json(thread);
+  },
+
+  async deleteThread(_request, kv, project, { id }) {
+    await adapter.deleteThread(kv, project, id);
+    return json({ deleted: id });
+  },
+
+  // ── Audit ──
+
+  async queryAudit(request, kv, project) {
+    const url = new URL(request.url);
+    const filters = {
+      user: url.searchParams.get("user") || undefined,
+      file: url.searchParams.get("file") || undefined,
+      tool: url.searchParams.get("tool") || undefined,
+      since: url.searchParams.get("since") || undefined,
+    };
+    const records = await adapter.queryAudit(kv, project, filters);
+    return json({ audit: records });
+  },
+
+  async appendAudit(request, kv, project) {
+    const record = await request.json();
+    await adapter.appendAudit(kv, project, record);
+    return json({ ok: true }, 201);
+  },
+
+  // ── Presence ──
+
+  async getPresence(_request, kv, project) {
+    const records = await adapter.getPresence(kv, project);
+    return json({ presence: records });
+  },
+
+  async upsertPresence(request, kv, project) {
+    const record = await request.json();
+    if (!record.user) return error("record.user is required");
+    await adapter.upsertPresence(kv, project, record);
+    return json({ ok: true });
+  },
+
+  async deletePresence(_request, kv, project, { user }) {
+    await adapter.deletePresence(kv, project, user);
+    return json({ deleted: user });
+  },
+
+  // ── Config ──
+
+  async getConfig(_request, kv, project) {
+    const config = await adapter.getConfig(kv, project);
+    if (!config) return json({});
+    return json(config);
+  },
+
+  async putConfig(request, kv, project) {
+    const config = await request.json();
+    await adapter.putConfig(kv, project, config);
+    return json(config);
+  },
+};
+
+// ── Worker entry point ───────────────────────────────────
+
+export default {
+  async fetch(request, env) {
+    // CORS preflight
+    if (request.method === "OPTIONS") {
+      return new Response(null, {
+        status: 204,
+        headers: {
+          "Access-Control-Allow-Origin": "*",
+          "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
+          "Access-Control-Allow-Headers": "Content-Type, X-Sticky-API-Key, X-Sticky-Project",
+        },
+      });
+    }
+
+    // Auth
+    if (!authenticate(request, env)) {
+      return error("Unauthorized", 401);
+    }
+
+    const url = new URL(request.url);
+    const route = matchRoute(request.method, url.pathname);
+
+    if (!route) {
+      return error("Not found", 404);
+    }
+
+    const project = getProject(request);
+    const kv = env.STICKY_KV;
+
+    try {
+      const handler = handlers[route.handler];
+      const response = await handler(request, kv, project, route);
+
+      // Add CORS headers to all responses
+      const headers = new Headers(response.headers);
+      headers.set("Access-Control-Allow-Origin", "*");
+      return new Response(response.body, {
+        status: response.status,
+        headers,
+      });
+    } catch (err) {
+      return error(`Internal error: ${err.message}`, 500);
+    }
+  },
+};

package/sticky-server/wrangler.toml

@@ -0,0 +1,10 @@
+name = "sticky-note-server"
+main = "worker.js"
+compatibility_date = "2024-09-01"
+
+[vars]
+ENVIRONMENT = "production"
+
+[[kv_namespaces]]
+binding = "STICKY_KV"
+id = "PLACEHOLDER_KV_NAMESPACE_ID"

package/templates/hooks/sticky-utils.js

@@ -157,13 +157,13 @@ function selfHealHookPaths(settingsPath) {
     try { settings = JSON.parse(raw); } catch (_) { return result; }
     if (!settings || !settings.hooks) return result;
 
-    // Two stale patterns:
+    // Stale patterns that need rewriting to the canonical template format:
     // 1. Absolute paths (written by older sticky-note-cli or copied from another machine)
-    // 2. Old relative form `node ".claude/hooks/foo.js"` — fails when Claude Code
-    //    launches from a subdirectory, because the path resolves relative to the
-    //    launch cwd, not the directory containing .claude/settings.json.
+    // 2. `npx sticky-note run-hook X` — broken: npm has no package named "sticky-note"
+    //    (the package is "sticky-note-cli"). Written by earlier 3.x releases via the
+    //    now-removed selfHeal rewrite. Canonical form is `node ".claude/hooks/X.js"`.
     const STALE_ABSOLUTE = /["'][A-Za-z]:[\\/]|["']\/(?:Users|home|root|tmp)\/|\$\(git rev-parse/;
-    const STALE_RELATIVE = /^node\s+["']\.claude[\\/]hooks[\\/][^"']+\.js["']\s*$/;
+    const STALE_NPX = /^npx\s+sticky-note\s+run-hook\s+(\S+)/;
     // Match the script basename in either quoted or bare form.
     const BASENAME = /([A-Za-z0-9_.-]+)\.(?:js|sh|cjs|mjs)(?:["'`\s]|$)/;
 
@@ -174,12 +174,17 @@ function selfHealHookPaths(settingsPath) {
         for (const h of (entry && entry.hooks) || []) {
           const cmd = h && h.command;
           if (typeof cmd !== "string") continue;
-          const isStale = STALE_ABSOLUTE.test(cmd) || STALE_RELATIVE.test(cmd);
-          if (!isStale) continue;
-          const m = cmd.match(BASENAME);
-          if (!m) continue;
-          const basename = m[1];
-          const newCmd = `npx sticky-note run-hook ${basename}`;
+          let basename = null;
+          // Check for broken `npx sticky-note run-hook X` pattern first
+          const npxMatch = cmd.match(STALE_NPX);
+          if (npxMatch) {
+            basename = npxMatch[1];
+          } else if (STALE_ABSOLUTE.test(cmd)) {
+            const m = cmd.match(BASENAME);
+            if (m) basename = m[1];
+          }
+          if (!basename) continue;
+          const newCmd = `node ".claude/hooks/${basename}.js"`;
           result.push({ event, oldCommand: cmd, newCommand: newCmd });
           h.command = newCmd;
           changed = true;
@@ -192,9 +197,9 @@ function selfHealHookPaths(settingsPath) {
     fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf-8");
     try {
       const summary =
-        `[STICKY-NOTE] ⚠️  Detected ${result.length} stale hook path(s) in ` +
+        `[STICKY-NOTE] ⚠️  Detected ${result.length} stale hook command(s) in ` +
         `${path.relative(process.cwd(), settingsPath) || settingsPath} — rewrote to ` +
-        `"npx sticky-note run-hook <name>" so hooks work from any subdirectory. ` +
+        `"node \\".claude/hooks/<name>.js\\"" (canonical form). ` +
         `Commit the change to share the fix with your team.`;
       process.stderr.write(summary + "\n");
       for (const { event, oldCommand, newCommand } of result.slice(0, 5)) {