sticky-note-cli 3.1.14 → 3.1.16

package/sticky-server/worker.js

@@ -11,6 +11,8 @@
  *   GET    /threads/:id       — get thread
  *   PUT    /threads/:id       — update thread
  *   DELETE /threads/:id       — tombstone thread
+ *   POST   /threads/:id/events — append event batch (local session push)
+ *   GET    /threads/:id/events — retrieve all stored events
  *   GET    /audit             — query audit (?file=, ?user=, ?since=, ?tool=)
  *   POST   /audit             — append audit record
  *   GET    /presence          — list active developers
@@ -21,6 +23,7 @@
  */
 
 import * as adapter from "./adapters/cf-kv.js";
+import { MCP_TOOL_DEFINITIONS, handleMcpTool, _commitThreadToGit, EVENT_TYPES } from "./mcp-tools.js";
 
 // ── Helpers ──────────────────────────────────────────────
 
@@ -51,6 +54,14 @@ function matchRoute(method, pathname) {
   // Thread routes
   if (method === "POST" && pathname === "/threads") return { handler: "createThread" };
   if (method === "GET" && pathname === "/threads") return { handler: "listThreads" };
+  if (method === "POST" && pathname.match(/^\/threads\/[^/]+\/events$/)) {
+    const id = pathname.split("/")[2];
+    return { handler: "appendThreadEvents", id };
+  }
+  if (method === "GET" && pathname.match(/^\/threads\/[^/]+\/events$/)) {
+    const id = pathname.split("/")[2];
+    return { handler: "getThreadEvents", id };
+  }
   if (method === "GET" && pathname.startsWith("/threads/")) {
     return { handler: "getThread", id: pathname.slice("/threads/".length) };
   }
@@ -76,6 +87,10 @@ function matchRoute(method, pathname) {
   if (method === "GET" && pathname === "/config") return { handler: "getConfig" };
   if (method === "PUT" && pathname === "/config") return { handler: "putConfig" };
 
+  // MCP routes
+  if (method === "GET" && pathname === "/mcp") return { handler: "mcpListTools" };
+  if (method === "POST" && pathname === "/mcp") return { handler: "mcpCallTool" };
+
   // Health
   if (method === "GET" && pathname === "/health") return { handler: "health" };
 
@@ -126,6 +141,20 @@ const handlers = {
     return json({ deleted: id });
   },
 
+  // ── Thread Events ──
+
+  async appendThreadEvents(request, kv, project, { id }) {
+    const body = await request.json().catch(() => ({}));
+    const events = Array.isArray(body.events) ? body.events : [];
+    await adapter.appendEvents(kv, project, id, events);
+    return json({ ok: true, appended: events.length });
+  },
+
+  async getThreadEvents(_request, kv, project, { id }) {
+    const events = await adapter.getEvents(kv, project, id);
+    return json({ events });
+  },
+
   // ── Audit ──
 
   async queryAudit(request, kv, project) {
@@ -165,6 +194,25 @@ const handlers = {
     return json({ deleted: user });
   },
 
+  // ── MCP ──
+
+  async mcpListTools() {
+    return json({ tools: MCP_TOOL_DEFINITIONS });
+  },
+
+  async mcpCallTool(request, _kv, project, _route, env) {
+    const body = await request.json().catch(() => ({}));
+    const toolName = body.tool || body.name;
+    const toolInput = body.input || body.arguments || {};
+    if (!toolName) return error("tool name required");
+    try {
+      const result = await handleMcpTool(toolName, toolInput, env, project, getOrCreateDO);
+      return json({ content: [{ type: "text", text: JSON.stringify(result) }] });
+    } catch (err) {
+      return error(err.message, 400);
+    }
+  },
+
   // ── Config ──
 
   async getConfig(_request, kv, project) {
@@ -180,6 +228,13 @@ const handlers = {
   },
 };
 
+// ── Durable Object helper ────────────────────────────────
+
+function getOrCreateDO(env, threadId) {
+  const id = env.STICKY_THREAD.idFromName(threadId);
+  return env.STICKY_THREAD.get(id);
+}
+
 // ── Worker entry point ───────────────────────────────────
 
 export default {
@@ -213,7 +268,7 @@ export default {
 
     try {
       const handler = handlers[route.handler];
-      const response = await handler(request, kv, project, route);
+      const response = await handler(request, kv, project, route, env);
 
       // Add CORS headers to all responses
       const headers = new Headers(response.headers);
@@ -226,4 +281,70 @@ export default {
       return error(`Internal error: ${err.message}`, 500);
     }
   },
+
+  async scheduled(event, env, ctx) {
+    ctx.waitUntil(runCrashRecovery(env));
+  },
 };
+
+// ── Crash recovery (cron) ────────────────────────────────
+
+async function runCrashRecovery(env) {
+  const projects = ["default"]; // TODO: discover from KV index if multi-project
+  const staleThresholdMs = 30 * 60 * 1000; // 30 minutes
+  const now = Date.now();
+
+  for (const project of projects) {
+    const threadsListKey = `${project}:threads_index`;
+    const threadIds = await env.STICKY_KV.get(threadsListKey, { type: "json" })
+      .catch(() => []) || [];
+
+    const metas = await Promise.all(
+      threadIds.map(id =>
+        env.STICKY_KV.get(`${project}:thread:${id}`, { type: "json" }).catch(() => null)
+      )
+    );
+    for (let i = 0; i < threadIds.length; i++) {
+      const meta = metas[i];
+      const threadId = threadIds[i];
+      if (!meta || meta.status !== "open") continue;
+
+      const lastActivity = new Date(meta.last_activity_at || meta.created_at).getTime();
+      if (now - lastActivity < staleThresholdMs) continue;
+
+      // Track last_recovery_attempt to avoid hammering
+      const lastAttempt = meta._last_recovery_attempt || 0;
+      if (now - lastAttempt < 5 * 60 * 1000) continue; // skip if tried < 5min ago
+
+      // Thread is stale — flush DO buffer and mark as stale
+      try {
+        const do_stub = getOrCreateDO(env, threadId);
+        const recovery_event = {
+          ts: new Date().toISOString(), type: EVENT_TYPES.SESSION_CLOSE, session_id: null,
+          data: { narrative: "[recovered by cron]", work_type: "unknown", handoff_summary: "", failed_approaches: [], files_touched: [] },
+        };
+
+        meta._last_recovery_attempt = now;
+        await env.STICKY_KV.put(metaKey, JSON.stringify(meta));
+
+        await do_stub.fetch(new Request("http://do/do/close", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ close_event: recovery_event }),
+        }));
+
+        meta.status = "stale";
+        meta.last_activity_at = new Date().toISOString();
+        await env.STICKY_KV.put(metaKey, JSON.stringify(meta));
+
+        // GitHub commit for stale thread — commit the already-written stale metadata directly
+        await _commitThreadToGit(env, project, threadId, getOrCreateDO).catch(() => {});
+      } catch (_) {
+        // best-effort — log to console for observability
+        console.error(`[sticky-note] crash recovery failed for thread ${threadId}`);
+      }
+    }
+  }
+}
+
+export { StickyThread } from "./sticky-thread-do.js";

package/sticky-server/wrangler.toml

@@ -5,6 +5,23 @@ compatibility_date = "2024-09-01"
 [vars]
 ENVIRONMENT = "production"
 
+# Required secrets (set via `wrangler secret put`):
+#   STICKY_API_KEY  — API key for X-Sticky-API-Key auth
+#   GITHUB_PAT      — Fine-grained PAT with Contents read+write on the target repo
+#   GITHUB_REPO     — Target repo in "owner/repo" format (e.g. "acme/frontend")
+
 [[kv_namespaces]]
 binding = "STICKY_KV"
 id = "PLACEHOLDER_KV_NAMESPACE_ID"
+
+[durable_objects]
+bindings = [
+  { name = "STICKY_THREAD", class_name = "StickyThread" }
+]
+
+[[migrations]]
+tag = "v1"
+new_classes = ["StickyThread"]
+
+[triggers]
+crons = ["*/5 * * * *"]

package/templates/gitignore-additions.txt

@@ -1,5 +1,6 @@
 # Sticky Note - local overrides (never commit these)
 .claude/settings.local.json
+.claude/worktrees/
 .env.sticky
 
 # Sticky Note - transient session/resume signals
@@ -14,6 +15,15 @@
 # Sticky Note - debug log
 .sticky-note/hook-debug.log
 .sticky-note/.sticky-debug.jsonl
+.sticky-note/.sticky-errors.log
+
+# Sticky Note - runtime internals (never commit)
+.sticky-note/.sticky-syncing
+.sticky-note/.sticky-backups/
+.sticky-note/.env-provision-hash
+.sticky-note/.overlap-warned
+.sticky-note/.overlap-pending
+.sticky-note/.overlap-dismissed
 
 # Sticky Note - legacy single files (migrated to per-user dirs)
 .sticky-note/sticky-note-audit.jsonl

package/templates/hooks/event-writer.js

@@ -0,0 +1,104 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * event-writer.js — Shared Event Schema and Builder (V4)
+ *
+ * Provides event type constants, a builder for structured events,
+ * and sanitizers for tool args and results.
+ * Imported by track-work.js, on-error.js, inject-context.js,
+ * session-start.js, and session-end.js.
+ */
+
+const crypto = require("crypto");
+
+const MAX_RESULT_BYTES = 10 * 1024;        // 10 KB cap on tool results
+const MAX_ARG_INLINE_BYTES = 1 * 1024;    // 1 KB: keep verbatim below this
+
+const EVENT_TYPES = {
+  SESSION_OPEN:         "session_open",
+  USER_PROMPT:          "user_prompt",
+  AI_THINKING:          "ai_thinking",
+  AI_RESPONSE:          "ai_response",
+  TOOL_CALL:            "tool_call",
+  TOOL_RESULT:          "tool_result",
+  TOOL_ERROR:           "tool_error",
+  TOOL_DENIED:          "tool_denied",
+  CONTEXT_COMPRESSED:   "context_compressed",
+  GIT_COMMIT:           "git_commit",
+  SUBAGENT_SPAWN:       "subagent_spawn",
+  SUBAGENT_RESULT:      "subagent_result",
+  CHECKPOINT:           "checkpoint",
+  SESSION_CLOSE:        "session_close",
+};
+
+const WRITE_TOOLS = new Set([
+  "Edit", "edit", "Write", "write", "MultiEdit", "multi_edit",
+]);
+
+/**
+ * Build a structured event object.
+ * @param {string} type - One of EVENT_TYPES values
+ * @param {object} data - Event-specific payload
+ * @param {string} sessionId - Session ID for correlation
+ * @returns {{ ts: string, type: string, session_id: string, data: object }}
+ */
+function buildEvent(type, data, sessionId) {
+  return {
+    ts: new Date().toISOString(),
+    type,
+    session_id: sessionId || null,
+    data: data || {},
+  };
+}
+
+function _sha256hex(str) {
+  return crypto.createHash("sha256").update(str).digest("hex").slice(0, 16);
+}
+
+function _refOf(str) {
+  return { _hash: _sha256hex(str), _len: str.length };
+}
+
+/**
+ * Sanitize tool call args before storing.
+ * - Non-write tools: returned unchanged.
+ * - Write tools: large string fields (old_string, new_string, content) are
+ *   replaced with a { _hash, _len } reference if they exceed MAX_ARG_INLINE_BYTES.
+ *   Short strings are kept verbatim.
+ */
+function sanitizeToolArgs(toolName, args) {
+  if (!args || typeof args !== "object" || Array.isArray(args)) return args;
+  if (!WRITE_TOOLS.has(toolName)) return args;
+
+  const out = { ...args };
+
+  for (const field of ["old_string", "new_string"]) {
+    if (typeof out[field] === "string" &&
+        Buffer.byteLength(out[field], "utf-8") > MAX_ARG_INLINE_BYTES) {
+      out[field + "_ref"] = _refOf(out[field]);
+      delete out[field];
+    }
+  }
+
+  if (typeof out.content === "string" &&
+      Buffer.byteLength(out.content, "utf-8") > MAX_ARG_INLINE_BYTES) {
+    out.content_ref = _refOf(out.content);
+    delete out.content;
+  }
+
+  return out;
+}
+
+/**
+ * Cap a tool result string to MAX_RESULT_BYTES.
+ * Non-string values are returned unchanged.
+ */
+function capResult(result) {
+  if (typeof result !== "string") return result;
+  const bytes = Buffer.byteLength(result, "utf-8");
+  if (bytes <= MAX_RESULT_BYTES) return result;
+  const cutoff = Math.floor(MAX_RESULT_BYTES * 0.95);
+  return result.slice(0, cutoff) + `...[truncated, ${bytes} bytes total]`;
+}
+
+module.exports = { EVENT_TYPES, WRITE_TOOLS, buildEvent, sanitizeToolArgs, capResult, MAX_RESULT_BYTES, MAX_ARG_INLINE_BYTES };

package/templates/hooks/inject-context.js

@@ -410,18 +410,23 @@ async function main() {
     }
   }
 
-  // Audit the user prompt
-  try {
-    const promptAudit = {
-      type: "user_prompt",
-      user: getUser(),
-      ts: new Date().toISOString(),
-      session_id: sessionId,
-      prompt: prompt.substring(0, 500),
-    };
-    appendAuditLineBoth(promptAudit, cloud);
-  } catch (_) {
-    // ignore
+  // Capture user_prompt event for AI blame
+  let eventWriter = null;
+  try { eventWriter = require("./event-writer.js"); } catch (_) {}
+
+  if (eventWriter) {
+    try {
+      const promptEntry = eventWriter.buildEvent(
+        eventWriter.EVENT_TYPES.USER_PROMPT,
+        { content: prompt },       // verbatim, no truncation
+        sessionId
+      );
+      // Keep legacy `prompt` field for backward compat with existing audit queries
+      promptEntry.prompt = prompt.substring(0, 500);
+      appendAuditLineBoth(promptEntry, cloud);
+    } catch (_) {
+      // ignore
+    }
   }
 
   // Auto-checkpoint: tag subsequent edits with what the user asked for

package/templates/hooks/on-error.js

@@ -8,8 +8,6 @@
  * Appends JSONL audit line.
  */
 
-const crypto = require("crypto");
-
 function _safeExit() {
   try {
     process.stdout.write(JSON.stringify({ output: "" }) + "\n");
@@ -39,6 +37,20 @@ try {
   _safeExit();
 }
 
+let eventWriter = null;
+try { eventWriter = require("./event-writer.js"); } catch (_) {}
+
+function _isDenial(hookInput) {
+  if (hookInput.blocked === true) return true;
+  const msg = (hookInput.error || hookInput.message || "").toLowerCase();
+  return (
+    msg.includes("blocked by the user") ||
+    msg.includes("user rejected") ||
+    msg.includes("permission denied by user") ||
+    msg.includes("tool was blocked")
+  );
+}
+
 async function main() {
   let hookInput = {};
   try {
@@ -113,6 +125,38 @@ async function main() {
   };
   appendAuditLineBoth(auditEntry, cloud);
 
+  // Write structured event for AI blame
+  if (eventWriter) {
+    try {
+      const isDenial = _isDenial(hookInput);
+      if (isDenial) {
+        const denialEvent = eventWriter.buildEvent(
+          eventWriter.EVENT_TYPES.TOOL_DENIED,
+          {
+            tool: toolName,
+            args: eventWriter.sanitizeToolArgs(toolName, hookInput.tool_input || {}),
+            reason: errorMsg,
+          },
+          sessionId
+        );
+        appendAuditLineBoth(denialEvent, cloud);
+      } else {
+        const errorEvent = eventWriter.buildEvent(
+          eventWriter.EVENT_TYPES.TOOL_ERROR,
+          {
+            tool: toolName,
+            args: eventWriter.sanitizeToolArgs(toolName, hookInput.tool_input || {}),
+            error: errorMsg,
+          },
+          sessionId
+        );
+        appendAuditLineBoth(errorEvent, cloud);
+      }
+    } catch (_) {
+      // best-effort
+    }
+  }
+
   saveMemoryMerged(memoryPath, memory);
   if (cloud) {
     const threadToSync = existing || threads[threads.length - 1];