sticky-note-cli 3.1.11 → 3.1.13

package/bin/cli.js

@@ -95,9 +95,8 @@ function resolveHookPaths(_obj, _rootDir) {
   return;
 }
 
-// Detects hook commands in an existing settings.json that point at an absolute
-// path (likely written by an older sticky-note-cli on another developer's
-// machine). Returns the list of stale command strings, or [] if all clean.
+// Detects hook commands in an existing settings.json that are broken or stale.
+// Returns the list of stale command strings, or [] if all clean.
 function findStaleHookPaths(settings) {
   const stale = [];
   const hooks = (settings && settings.hooks) || {};
@@ -107,9 +106,6 @@ function findStaleHookPaths(settings) {
         const cmd = h && h.command;
         if (typeof cmd !== "string") continue;
         // Absolute paths (Unix /Users, /home, /root or Windows C:/, D:/ etc.)
-        // inside the hook command are the smoking gun. Match anywhere in the
-        // string — the path may be preceded by other tokens (env vars, shell
-        // prefixes) and may contain spaces.
         if (
           /["'][A-Za-z]:[\\/]/.test(cmd) ||
           /["']\/(?:Users|home|root|tmp)\//.test(cmd) ||
@@ -117,12 +113,9 @@ function findStaleHookPaths(settings) {
         ) {
           stale.push(cmd);
         }
-        // Old relative-path format: node ".claude/hooks/foo.js"
-        // This fails when Claude Code launches from a subdirectory of the
-        // project root, because the path resolves relative to the launch cwd,
-        // not relative to where .claude/settings.json lives. The fix is to
-        // use `npx sticky-note run-hook foo` which walks up to find the hooks.
-        if (/node\s+["']\.claude[\\/]hooks[\\/][^"']+\.js["']/.test(cmd)) {
+        // Broken `npx sticky-note run-hook X` — npm has no package named "sticky-note"
+        // (the package is "sticky-note-cli"). Written by earlier 3.x releases.
+        if (/^npx\s+sticky-note\s+run-hook\s+\S+/.test(cmd)) {
           stale.push(cmd);
         }
       }
@@ -3052,6 +3045,10 @@ function provisionCloudBackend() {
   if (namespaceId) {
     const tomlPath = path.join(serverDir, "wrangler.toml");
     let toml = fs.readFileSync(tomlPath, "utf-8");
+    // Reset any previously-written ID back to placeholder first, then patch.
+    // This makes re-runs idempotent even when provisionCloudBackend is called
+    // multiple times in the same init (e.g. after auto-installing wrangler).
+    toml = toml.replace(/id\s*=\s*"[^"]*"/, 'id = "PLACEHOLDER_KV_NAMESPACE_ID"');
     toml = toml.replace("PLACEHOLDER_KV_NAMESPACE_ID", namespaceId);
     fs.writeFileSync(tomlPath, toml);
     print("  [OK] wrangler.toml updated with namespace ID");
@@ -3073,7 +3070,20 @@ function provisionCloudBackend() {
 
   const urlMatch = deployResult.match(/(https:\/\/[^\s]+\.workers\.dev)/);
   const workerUrl = urlMatch ? urlMatch[1] : null;
-  const apiKey = require("crypto").randomBytes(24).toString("base64url");
+
+  // Reuse an existing API key from .env.sticky if present — prevents divergence
+  // when init is re-run on an already-provisioned repo. Only generate a new key
+  // if there isn't one already.
+  const envPath = path.join(process.cwd(), ".env.sticky");
+  let apiKey = null;
+  try {
+    const existing = fs.readFileSync(envPath, "utf-8");
+    const m = existing.match(/^STICKY_API_KEY=(.+)$/m);
+    if (m && m[1].trim()) apiKey = m[1].trim();
+  } catch (_) { /* no existing .env.sticky */ }
+  if (!apiKey) {
+    apiKey = require("crypto").randomBytes(24).toString("base64url");
+  }
 
   if (workerUrl) {
     print(`  [OK] Worker deployed: ${workerUrl}`);
@@ -3081,7 +3091,7 @@ function provisionCloudBackend() {
     print("  [OK] Worker deployed (URL not detected — check wrangler output)");
   }
 
-  // Step 3: Set API key
+  // Step 3: Set API key on Worker — always sync so Worker and .env.sticky agree
   print("  Step 3: Setting API key on Worker...");
   let secretSet = false;
   try {
@@ -3098,11 +3108,20 @@ function provisionCloudBackend() {
     if (workerUrl) print(`         Set it manually: echo '${apiKey}' | wrangler secret put STICKY_API_KEY --name ${workerName}`);
   }
 
-  // Write .env.sticky
-  if (workerUrl) {
-    const envPath = path.join(process.cwd(), ".env.sticky");
+  // Write .env.sticky only after the secret is confirmed set on the Worker,
+  // so the local key always matches what the Worker expects.
+  if (workerUrl && secretSet) {
     fs.writeFileSync(envPath, `STICKY_URL=${workerUrl}\nSTICKY_API_KEY=${apiKey}\n`, "utf-8");
     print("  [OK] .env.sticky written with STICKY_URL and STICKY_API_KEY");
+  } else if (workerUrl && !secretSet) {
+    // Secret set failed — still write .env.sticky with the key we tried,
+    // and tell the user to set it manually so both sides match.
+    fs.writeFileSync(envPath, `STICKY_URL=${workerUrl}\nSTICKY_API_KEY=${apiKey}\n`, "utf-8");
+    print("  [WARN] .env.sticky written but STICKY_API_KEY was NOT set on the Worker.");
+    print(`         Sync manually: echo '${apiKey}' | wrangler secret put STICKY_API_KEY --name ${workerName}`);
+  }
+
+  if (workerUrl) {
 
     // Write sticky_url to committed config so teammates get it on git pull
     const configPath = path.join(process.cwd(), ".sticky-note", "sticky-note-config.json");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sticky-note-cli",
-  "version": "3.1.11",
+  "version": "3.1.13",
   "description": "Human-to-human handoff for AI coding assistants. Git-backed shared memory for Claude Code and Copilot CLI.",
   "license": "MIT",
   "bin": {

package/templates/hooks/sticky-utils.js

@@ -157,13 +157,13 @@ function selfHealHookPaths(settingsPath) {
     try { settings = JSON.parse(raw); } catch (_) { return result; }
     if (!settings || !settings.hooks) return result;
 
-    // Two stale patterns:
+    // Stale patterns that need rewriting to the canonical template format:
     // 1. Absolute paths (written by older sticky-note-cli or copied from another machine)
-    // 2. Old relative form `node ".claude/hooks/foo.js"` — fails when Claude Code
-    //    launches from a subdirectory, because the path resolves relative to the
-    //    launch cwd, not the directory containing .claude/settings.json.
+    // 2. `npx sticky-note run-hook X` — broken: npm has no package named "sticky-note"
+    //    (the package is "sticky-note-cli"). Written by earlier 3.x releases via the
+    //    now-removed selfHeal rewrite. Canonical form is `node ".claude/hooks/X.js"`.
     const STALE_ABSOLUTE = /["'][A-Za-z]:[\\/]|["']\/(?:Users|home|root|tmp)\/|\$\(git rev-parse/;
-    const STALE_RELATIVE = /^node\s+["']\.claude[\\/]hooks[\\/][^"']+\.js["']\s*$/;
+    const STALE_NPX = /^npx\s+sticky-note\s+run-hook\s+(\S+)/;
     // Match the script basename in either quoted or bare form.
     const BASENAME = /([A-Za-z0-9_.-]+)\.(?:js|sh|cjs|mjs)(?:["'`\s]|$)/;
 
@@ -174,12 +174,17 @@ function selfHealHookPaths(settingsPath) {
         for (const h of (entry && entry.hooks) || []) {
           const cmd = h && h.command;
           if (typeof cmd !== "string") continue;
-          const isStale = STALE_ABSOLUTE.test(cmd) || STALE_RELATIVE.test(cmd);
-          if (!isStale) continue;
-          const m = cmd.match(BASENAME);
-          if (!m) continue;
-          const basename = m[1];
-          const newCmd = `npx sticky-note run-hook ${basename}`;
+          let basename = null;
+          // Check for broken `npx sticky-note run-hook X` pattern first
+          const npxMatch = cmd.match(STALE_NPX);
+          if (npxMatch) {
+            basename = npxMatch[1];
+          } else if (STALE_ABSOLUTE.test(cmd)) {
+            const m = cmd.match(BASENAME);
+            if (m) basename = m[1];
+          }
+          if (!basename) continue;
+          const newCmd = `node ".claude/hooks/${basename}.js"`;
           result.push({ event, oldCommand: cmd, newCommand: newCmd });
           h.command = newCmd;
           changed = true;
@@ -192,9 +197,9 @@ function selfHealHookPaths(settingsPath) {
     fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf-8");
     try {
       const summary =
-        `[STICKY-NOTE] ⚠️  Detected ${result.length} stale hook path(s) in ` +
+        `[STICKY-NOTE] ⚠️  Detected ${result.length} stale hook command(s) in ` +
         `${path.relative(process.cwd(), settingsPath) || settingsPath} — rewrote to ` +
-        `"npx sticky-note run-hook <name>" so hooks work from any subdirectory. ` +
+        `"node \\".claude/hooks/<name>.js\\"" (canonical form). ` +
         `Commit the change to share the fix with your team.`;
       process.stderr.write(summary + "\n");
       for (const { event, oldCommand, newCommand } of result.slice(0, 5)) {