sticky-note-cli 3.1.39 → 3.1.41

package/bin/cli.js

@@ -720,12 +720,22 @@ async function cmdInit() {
       // Teammate flow: URL already in committed config — just need their API key
       print(`\n  Cloud backend detected: ${configStickyUrl}`);
       const keyAnswer = await ask(rl, "Enter your STICKY_API_KEY (get it from your team lead)", "");
-      if (keyAnswer.trim()) {
+      // GitHub push token — needed so session-end can push the data branch from
+      // background hook processes that don't have keychain/credential-manager access.
+      print("\n  A GitHub Personal Access Token (PAT) is needed so sticky-note can push");
+      print("  thread data in the background without requiring interactive credential access.");
+      print("  Create one at https://github.com/settings/tokens with 'repo' scope (or");
+      print("  'contents: write' for fine-grained tokens). Your team lead may share one.");
+      const pushTokenAnswer = await ask(rl, "Enter your STICKY_PUSH_TOKEN (GitHub PAT)", "");
+      if (keyAnswer.trim() || pushTokenAnswer.trim()) {
         const envPath = path.join(process.cwd(), ".env.sticky");
-        fs.writeFileSync(envPath, `STICKY_URL=${configStickyUrl}\nSTICKY_API_KEY=${keyAnswer.trim()}\n`, "utf-8");
+        let envContent = `STICKY_URL=${configStickyUrl}\n`;
+        if (keyAnswer.trim()) envContent += `STICKY_API_KEY=${keyAnswer.trim()}\n`;
+        if (pushTokenAnswer.trim()) envContent += `STICKY_PUSH_TOKEN=${pushTokenAnswer.trim()}\n`;
+        fs.writeFileSync(envPath, envContent, "utf-8");
         print("  [OK] .env.sticky written");
       } else {
-        print("  ⏭️  No API key entered — skipping .env.sticky (local-only mode)");
+        print("  ⏭️  No keys entered — skipping .env.sticky (local-only mode)");
       }
     } else {
       const cloudAnswer = await ask(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sticky-note-cli",
-  "version": "3.1.39",
+  "version": "3.1.41",
   "description": "Human-to-human handoff for AI coding assistants. Git-backed shared memory for Claude Code and Copilot CLI.",
   "license": "MIT",
   "bin": {
@@ -25,6 +25,7 @@
   },
   "files": [
     "bin/",
+    "src/",
     "templates/",
     "sticky-server/"
   ],
@@ -35,6 +36,6 @@
     "test": "node test/smoke.test.js"
   },
   "devDependencies": {
-    "sticky-note-cli": "^3.1.5"
+    "sticky-note-cli": "^3.1.38"
   }
 }

package/src/core/sticky-dir.js

@@ -0,0 +1,23 @@
+const fs = require("fs");
+const path = require("path");
+const { execFileSync } = require("child_process");
+
+function getActiveStickyDir(cwd) {
+  const root = cwd || process.cwd();
+  try {
+    const gitDir = execFileSync("git", ["rev-parse", "--absolute-git-dir"], {
+      encoding: "utf-8", timeout: 3000, stdio: ["pipe", "pipe", "pipe"], cwd: root,
+    }).trim();
+    const dataBranchDir = path.join(gitDir, "sticky-note");
+    if (fs.existsSync(path.join(dataBranchDir, "sticky-note.json"))) {
+      return dataBranchDir;
+    }
+  } catch (_) {
+    // not a git repo or git unavailable
+  }
+  return path.join(root, ".sticky-note");
+}
+
+module.exports = {
+  getActiveStickyDir,
+};

package/src/index.js

@@ -0,0 +1,57 @@
+const ui = require("./utils/ui");
+const fileIo = require("./utils/file-io");
+const semver = require("./utils/semver");
+const git = require("./utils/git");
+const hook = require("./utils/hook");
+const pkg = require("./utils/package");
+const mcpConfig = require("./mcp/config");
+const mcpDetection = require("./mcp/detection");
+const stickyDir = require("./core/sticky-dir");
+
+module.exports = {
+  ui: {
+    print: ui.print,
+    debugLog: ui.debugLog,
+    printBanner: ui.printBanner,
+    ask: ui.ask,
+    VERSION: ui.VERSION,
+  },
+  fileIo: {
+    mkdirSafe: fileIo.mkdirSafe,
+    copyFile: fileIo.copyFile,
+    readTemplate: fileIo.readTemplate,
+    readJsonSafe: fileIo.readJsonSafe,
+    readEnvSticky: fileIo.readEnvSticky,
+    makeExecutable: fileIo.makeExecutable,
+    updateInstructionSection: fileIo.updateInstructionSection,
+    countJsonlLines: fileIo.countJsonlLines,
+  },
+  semver: {
+    parseSemver: semver.parseSemver,
+    compareSemver: semver.compareSemver,
+    bumpMinVersion: semver.bumpMinVersion,
+    parseIntOr: semver.parseIntOr,
+  },
+  git: {
+    isGitRepo: git.isGitRepo,
+    getGitUserName: git.getGitUserName,
+  },
+  hook: {
+    resolveHookPaths: hook.resolveHookPaths,
+    findStaleHookPaths: hook.findStaleHookPaths,
+    installGitHook: hook.installGitHook,
+  },
+  pkg: {
+    pinCliInPackageJson: pkg.pinCliInPackageJson,
+  },
+  mcp: {
+    getCopilotCliConfigDir: mcpConfig.getCopilotCliConfigDir,
+    getCopilotCliMcpConfigPath: mcpConfig.getCopilotCliMcpConfigPath,
+    ensureMcpInCopilotCliConfig: mcpConfig.ensureMcpInCopilotCliConfig,
+    detectMcpServers: mcpDetection.detectMcpServers,
+    detectSkills: mcpDetection.detectSkills,
+  },
+  core: {
+    getActiveStickyDir: stickyDir.getActiveStickyDir,
+  },
+};

package/src/mcp/config.js

@@ -0,0 +1,55 @@
+const fs = require("fs");
+const path = require("path");
+
+function getCopilotCliConfigDir() {
+  if (process.env.COPILOT_HOME) return process.env.COPILOT_HOME;
+  const home = process.env.HOME || process.env.USERPROFILE;
+  if (!home) return null;
+  return path.join(home, ".copilot");
+}
+
+function getCopilotCliMcpConfigPath() {
+  const dir = getCopilotCliConfigDir();
+  return dir ? path.join(dir, "mcp-config.json") : null;
+}
+
+function ensureMcpInCopilotCliConfig(serverName, serverConfig) {
+  try {
+    const configDir = getCopilotCliConfigDir();
+    if (!configDir || !fs.existsSync(configDir)) return false;
+
+    const configPath = path.join(configDir, "mcp-config.json");
+    let config = {};
+    if (fs.existsSync(configPath)) {
+      try {
+        config = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+      } catch (_) {
+        config = {};
+      }
+    }
+
+    config.mcpServers = config.mcpServers || {};
+    const existing = config.mcpServers[serverName];
+    if (existing) {
+      if (!existing.tools) {
+        existing.tools = ["*"];
+        fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+        return true;
+      }
+      return false;
+    }
+
+    if (!serverConfig.tools) serverConfig.tools = ["*"];
+    config.mcpServers[serverName] = serverConfig;
+    fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
+    return true;
+  } catch (_) {
+    return false;
+  }
+}
+
+module.exports = {
+  getCopilotCliConfigDir,
+  getCopilotCliMcpConfigPath,
+  ensureMcpInCopilotCliConfig,
+};

package/src/mcp/detection.js

@@ -0,0 +1,127 @@
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+const { getCopilotCliMcpConfigPath } = require("./config");
+const { debugLog } = require("../utils/ui");
+
+function detectMcpServers() {
+  const servers = new Map();
+
+  const mcpJsonPath = path.join(process.cwd(), ".mcp.json");
+  if (fs.existsSync(mcpJsonPath)) {
+    try {
+      const mcpJson = JSON.parse(fs.readFileSync(mcpJsonPath, "utf-8"));
+      const mcpServers = mcpJson.mcpServers || {};
+      for (const [name, config] of Object.entries(mcpServers)) {
+        const entry = {
+          name,
+          type: config.type || config.transport || "unknown",
+          source: ".mcp.json",
+        };
+        if (config.command) entry.command = config.command;
+        if (config.args) entry.args = config.args;
+        if (config.env) entry.env = config.env;
+        if (config.url) entry.url = config.url;
+        servers.set(name, entry);
+      }
+    } catch (err) { debugLog("detectMcpServers .mcp.json: " + (err.message || err)); }
+  }
+
+  const copilotMcpPath = getCopilotCliMcpConfigPath();
+  if (copilotMcpPath && fs.existsSync(copilotMcpPath)) {
+    try {
+      const copilotMcp = JSON.parse(fs.readFileSync(copilotMcpPath, "utf-8"));
+      const mcpServers = copilotMcp.mcpServers || {};
+      for (const [name, config] of Object.entries(mcpServers)) {
+        if (servers.has(name)) continue;
+        const entry = {
+          name,
+          type: config.type || config.transport || "unknown",
+          source: "~/.copilot/mcp-config.json",
+        };
+        if (config.command) entry.command = config.command;
+        if (config.args) entry.args = config.args;
+        if (config.env) entry.env = config.env;
+        if (config.url) entry.url = config.url;
+        servers.set(name, entry);
+      }
+    } catch (err) { debugLog("detectMcpServers copilot mcp-config: " + (err.message || err)); }
+  }
+
+  const globalClaudeSettingsPath = path.join(os.homedir(), ".claude", "settings.json");
+  if (fs.existsSync(globalClaudeSettingsPath)) {
+    try {
+      const globalSettings = JSON.parse(fs.readFileSync(globalClaudeSettingsPath, "utf-8"));
+      const globalMcp = globalSettings.mcpServers || {};
+      for (const [name, config] of Object.entries(globalMcp)) {
+        if (servers.has(name)) continue;
+        if (config.type === "permission-detected") continue;
+        const entry = {
+          name,
+          type: config.type || config.transport || "stdio",
+          source: "~/.claude/settings.json",
+        };
+        if (config.command) entry.command = config.command;
+        if (config.args) entry.args = config.args;
+        if (config.env) entry.env = config.env;
+        if (config.url) entry.url = config.url;
+        servers.set(name, entry);
+      }
+    } catch (err) { debugLog("detectMcpServers global settings: " + (err.message || err)); }
+  }
+
+  const localSettingsPath = path.join(process.cwd(), ".claude", "settings.local.json");
+  if (fs.existsSync(localSettingsPath)) {
+    try {
+      const localSettings = JSON.parse(fs.readFileSync(localSettingsPath, "utf-8"));
+      const permissions = [
+        ...(localSettings.allow || []),
+        ...(localSettings.permissions?.allow || []),
+      ];
+      for (const perm of permissions) {
+        if (typeof perm === "string" && perm.startsWith("mcp__")) {
+          const serverName = perm.split("__")[1];
+          if (serverName && !servers.has(serverName)) {
+            servers.set(serverName, {
+              name: serverName,
+              type: "account-mcp",
+              source: "settings.local.json",
+            });
+          }
+        }
+      }
+    } catch (err) { debugLog("detectMcpServers settings.local.json: " + (err.message || err)); }
+  }
+
+  return Array.from(servers.values());
+}
+
+function detectSkills() {
+  const skills = new Set();
+
+  const localSettingsPath = path.join(process.cwd(), ".claude", "settings.local.json");
+  if (fs.existsSync(localSettingsPath)) {
+    try {
+      const localSettings = JSON.parse(fs.readFileSync(localSettingsPath, "utf-8"));
+      const permissions = [
+        ...(localSettings.allow || []),
+        ...(localSettings.permissions?.allow || []),
+      ];
+      for (const perm of permissions) {
+        if (typeof perm === "string") {
+          const match = perm.match(/^Skill\(([^)]+)\)/);
+          if (match) {
+            skills.add(match[1]);
+          }
+        }
+      }
+    } catch (err) { debugLog("detectSkills: " + (err.message || err)); }
+  }
+
+  return Array.from(skills);
+}
+
+module.exports = {
+  detectMcpServers,
+  detectSkills,
+};

package/src/utils/file-io.js

@@ -0,0 +1,96 @@
+const fs = require("fs");
+const path = require("path");
+
+function mkdirSafe(dir) {
+  if (!fs.existsSync(dir)) {
+    fs.mkdirSync(dir, { recursive: true });
+  }
+}
+
+function copyFile(src, dest) {
+  fs.copyFileSync(src, dest);
+}
+
+function readTemplate(name, templatesDir) {
+  return fs.readFileSync(path.join(templatesDir, name), "utf-8");
+}
+
+function readJsonSafe(filePath, fallback) {
+  try {
+    return JSON.parse(fs.readFileSync(filePath, "utf-8"));
+  } catch (err) {
+    return fallback;
+  }
+}
+
+function readEnvSticky(cwd) {
+  try {
+    const raw = fs.readFileSync(path.join(cwd, ".env.sticky"), "utf-8");
+    let url = "", key = "";
+    for (const line of raw.split(/\r?\n/)) {
+      const t = line.trim();
+      if (t.startsWith("STICKY_URL=")) url = t.slice("STICKY_URL=".length).trim();
+      else if (t.startsWith("STICKY_API_KEY=")) key = t.slice("STICKY_API_KEY=".length).trim();
+    }
+    return { url, key };
+  } catch (_) {
+    return { url: "", key: "" };
+  }
+}
+
+function makeExecutable(filePath) {
+  try {
+    fs.chmodSync(filePath, 0o755);
+  } catch {
+    // Windows doesn't support chmod
+  }
+}
+
+const SECTION_START = "<!-- sticky-note:start";
+const SECTION_END = "<!-- sticky-note:end -->";
+
+function updateInstructionSection(destPath, templateContent, heading) {
+  if (!fs.existsSync(destPath)) {
+    fs.writeFileSync(destPath, templateContent);
+    return true;
+  }
+
+  const existing = fs.readFileSync(destPath, "utf-8");
+  const startIdx = existing.indexOf(SECTION_START);
+  const endIdx = existing.indexOf(SECTION_END);
+
+  if (startIdx !== -1 && endIdx !== -1) {
+    const before = existing.slice(0, startIdx);
+    const after = existing.slice(endIdx + SECTION_END.length);
+    fs.writeFileSync(destPath, before + templateContent.trim() + after);
+  } else if (heading && existing.includes(heading)) {
+    const headingIdx = existing.indexOf(heading);
+    const before = existing.slice(0, headingIdx);
+    fs.writeFileSync(destPath, before + templateContent);
+  } else {
+    const sep = existing.endsWith("\n") ? "\n" : "\n\n";
+    fs.writeFileSync(destPath, existing + sep + templateContent);
+  }
+  return true;
+}
+
+function countJsonlLines(filePath) {
+  if (!fs.existsSync(filePath)) return 0;
+  try {
+    const content = fs.readFileSync(filePath, "utf-8");
+    return content.split(/\r?\n/).filter((l) => l.trim()).length;
+  } catch {
+    return 0;
+  }
+}
+
+module.exports = {
+  mkdirSafe,
+  copyFile,
+  readTemplate,
+  readJsonSafe,
+  readEnvSticky,
+  makeExecutable,
+  updateInstructionSection,
+  countJsonlLines,
+};

package/src/utils/git.js

@@ -0,0 +1,27 @@
+const { execFileSync } = require("child_process");
+
+function isGitRepo() {
+  try {
+    execFileSync("git", ["rev-parse", "--is-inside-work-tree"], { stdio: "pipe" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function getGitUserName() {
+  try {
+    const name = execFileSync("git", ["config", "user.name"], {
+      encoding: "utf-8",
+      stdio: "pipe",
+    }).trim();
+    return name || null;
+  } catch {
+    return null;
+  }
+}
+
+module.exports = {
+  isGitRepo,
+  getGitUserName,
+};

package/src/utils/hook.js

@@ -0,0 +1,74 @@
+const fs = require("fs");
+const path = require("path");
+
+function resolveHookPaths(_obj, _rootDir) {
+  return;
+}
+
+function findStaleHookPaths(settings) {
+  const stale = [];
+  const hooks = (settings && settings.hooks) || {};
+  for (const entries of Object.values(hooks)) {
+    for (const entry of Array.isArray(entries) ? entries : []) {
+      for (const h of entry.hooks || []) {
+        const cmd = h && h.command;
+        if (typeof cmd !== "string") continue;
+        if (
+          /["'][A-Za-z]:[\\/]/.test(cmd) ||
+          /["']\/(?:Users|home|root|tmp)\//.test(cmd) ||
+          cmd.includes("$(git rev-parse")
+        ) {
+          stale.push(cmd);
+        }
+        if (/^npx\s+sticky-note\s+run-hook\s+\S+/.test(cmd)) {
+          stale.push(cmd);
+        }
+        if (/^node\s+"?\.claude\/hooks\//.test(cmd)) {
+          stale.push(cmd);
+        }
+      }
+    }
+  }
+  return stale;
+}
+
+function installGitHook(hookName, templatesDir) {
+  try {
+    const gitDir = path.join(process.cwd(), ".git");
+    if (!fs.existsSync(gitDir)) return false;
+    const hooksDir = path.join(gitDir, "hooks");
+
+    if (!fs.existsSync(hooksDir)) {
+      fs.mkdirSync(hooksDir, { recursive: true });
+    }
+
+    const src = path.join(templatesDir, "hooks", hookName + ".js");
+    if (!fs.existsSync(src)) return false;
+
+    if (process.platform === "win32") {
+      const shimContent =
+        `@echo off\r\nnode "%~dp0..\\..\\templates\\hooks\\${hookName}.js" %*\r\n`;
+      const dest = path.join(hooksDir, hookName);
+      fs.writeFileSync(dest, shimContent, "utf-8");
+    } else {
+      const shimContent =
+        `#!/bin/sh\nnode "$(dirname "$0")/../../templates/hooks/${hookName}.js" "$@"\n`;
+      const dest = path.join(hooksDir, hookName);
+      fs.writeFileSync(dest, shimContent, "utf-8");
+      try {
+        fs.chmodSync(dest, 0o755);
+      } catch {
+        // Windows doesn't support chmod
+      }
+    }
+    return true;
+  } catch (err) {
+    return false;
+  }
+}
+
+module.exports = {
+  resolveHookPaths,
+  findStaleHookPaths,
+  installGitHook,
+};

package/src/utils/package.js

@@ -0,0 +1,41 @@
+const fs = require("fs");
+const path = require("path");
+const { compareSemver } = require("./semver");
+const { print } = require("./ui");
+const { VERSION } = require("./ui");
+
+function pinCliInPackageJson() {
+  const pkgPath = path.join(process.cwd(), "package.json");
+  if (!fs.existsSync(pkgPath)) {
+    print("  ⏭️  No package.json found — skipping devDependency pin");
+    return;
+  }
+  let pkg;
+  try {
+    pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+  } catch (err) {
+    print(`  ⏭️  Could not parse package.json: ${err.message}`);
+    return;
+  }
+  pkg.devDependencies = pkg.devDependencies || {};
+  const existing = pkg.devDependencies["sticky-note-cli"];
+  const desired = `^${VERSION}`;
+  if (existing) {
+    const existingClean = String(existing).replace(/^[\^~]/, "");
+    if (compareSemver(existingClean, VERSION) >= 0) {
+      print(`  ⏭️  package.json devDependencies already pin sticky-note-cli ${existing}`);
+      return;
+    }
+  }
+  pkg.devDependencies["sticky-note-cli"] = desired;
+  pkg.devDependencies = Object.fromEntries(
+    Object.entries(pkg.devDependencies).sort(([a], [b]) => a.localeCompare(b))
+  );
+  fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n");
+  print(`  [OK] package.json devDependencies: sticky-note-cli ${desired}`);
+  print("       Run `npm install` to lock the version for your team.");
+}
+
+module.exports = {
+  pinCliInPackageJson,
+};

package/src/utils/semver.js

@@ -0,0 +1,34 @@
+function parseSemver(v) {
+  if (typeof v !== "string") return null;
+  const m = v.trim().replace(/^v/, "").match(/^(\d+)\.(\d+)(?:\.(\d+))?/);
+  if (!m) return null;
+  return [Number(m[1]), Number(m[2]), Number(m[3] || 0)];
+}
+
+function compareSemver(a, b) {
+  const pa = parseSemver(a), pb = parseSemver(b);
+  if (!pa && !pb) return 0;
+  if (!pa) return 1;
+  if (!pb) return -1;
+  for (let i = 0; i < 3; i++) {
+    if (pa[i] !== pb[i]) return pa[i] < pb[i] ? -1 : 1;
+  }
+  return 0;
+}
+
+function bumpMinVersion(existing, current) {
+  if (!existing) return current;
+  return compareSemver(existing, current) >= 0 ? existing : current;
+}
+
+function parseIntOr(str, fallback) {
+  const n = parseInt(str, 10);
+  return Number.isNaN(n) ? fallback : n;
+}
+
+module.exports = {
+  parseSemver,
+  compareSemver,
+  bumpMinVersion,
+  parseIntOr,
+};

package/src/utils/ui.js

@@ -0,0 +1,38 @@
+const fs = require("fs");
+const path = require("path");
+
+const VERSION = require("../../package.json").version;
+
+function print(msg) {
+  process.stdout.write(msg + "\n");
+}
+
+function debugLog(msg) {
+  if (process.env.STICKY_DEBUG) {
+    process.stderr.write(`[sticky-note] ${msg}\n`);
+  }
+}
+
+function printBanner() {
+  print("");
+  print(`  📌 sticky-note v${VERSION}`);
+  print("  Human-to-human handoff for AI coding assistants");
+  print("");
+}
+
+function ask(rl, question, defaultVal) {
+  return new Promise((resolve) => {
+    const suffix = defaultVal !== undefined ? ` (${defaultVal})` : "";
+    rl.question(`  ${question}${suffix}: `, (answer) => {
+      resolve(answer.trim() || (defaultVal !== undefined ? String(defaultVal) : ""));
+    });
+  });
+}
+
+module.exports = {
+  print,
+  debugLog,
+  printBanner,
+  ask,
+  VERSION,
+};

package/templates/hooks/data-branch.js

@@ -19,6 +19,52 @@ const DATA_REF = "refs/heads/" + DATA_BRANCH;
 
 const GIT_OPTS = { encoding: "utf-8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"] };
 
+// ── Credential helpers ────────────────────────────────────
+
+/**
+ * Read STICKY_PUSH_TOKEN from env or .env.sticky file.
+ * Returns the token string or null.
+ */
+function _getPushToken() {
+  if (process.env.STICKY_PUSH_TOKEN) return process.env.STICKY_PUSH_TOKEN;
+  try {
+    // Walk up to find .env.sticky
+    let dir = process.cwd();
+    for (let i = 0; i < 20; i++) {
+      const envPath = path.join(dir, ".env.sticky");
+      if (fs.existsSync(envPath)) {
+        const content = fs.readFileSync(envPath, "utf-8");
+        const match = content.match(/^STICKY_PUSH_TOKEN=(.+)$/m);
+        if (match) return match[1].trim();
+        break;
+      }
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  } catch (_) {}
+  return null;
+}
+
+/**
+ * Given a remote name, return an authenticated push URL if STICKY_PUSH_TOKEN
+ * is configured. Embeds the token into the HTTPS URL so the push works from
+ * any process context without needing a credential helper.
+ * Returns null if no token or remote URL is not HTTPS.
+ */
+function _getAuthenticatedUrl(remote) {
+  const token = _getPushToken();
+  if (!token) return null;
+  try {
+    const url = execFileSync("git", ["remote", "get-url", remote], GIT_OPTS).trim();
+    if (!url.startsWith("https://")) return null;
+    // Insert token: https://TOKEN@github.com/...
+    return url.replace(/^https:\/\/([^@]*)@?/, `https://${token}@`);
+  } catch (_) {
+    return null;
+  }
+}
+
 // ── Git helpers ───────────────────────────────────────────
 
 function getDefaultRemote() {
@@ -41,11 +87,23 @@ function readFileFromBranch(ref, filePath) {
   }
 }
 
+/** Returns all file paths in a git ref as an array. */
+function listFilesInBranch(ref) {
+  try {
+    const out = execFileSync("git", ["ls-tree", "-r", "--name-only", ref], GIT_OPTS);
+    return out.trim().split(/\r?\n/).filter(Boolean);
+  } catch (_) {
+    return [];
+  }
+}
+
 /**
  * Commit { relativePath: content } to a branch using git plumbing.
  * Does not touch the working tree or the main index. Returns the new commit SHA.
+ * explicitParentSha: if provided, use this SHA as the parent instead of the
+ * current local branch tip (used during retry to parent off the remote SHA).
  */
-function commitFilesToBranch(branchName, fileMap) {
+function commitFilesToBranch(branchName, fileMap, explicitParentSha) {
   const branchRef = "refs/heads/" + branchName;
   const tmpIndex = path.join(
     os.tmpdir(),
@@ -53,13 +111,15 @@ function commitFilesToBranch(branchName, fileMap) {
   );
 
   try {
-    let parentSha = null;
-    try {
-      parentSha = execFileSync("git", ["rev-parse", "--verify", branchRef], {
-        encoding: "utf-8", timeout: 3000, stdio: ["pipe", "pipe", "pipe"],
-      }).trim();
-    } catch (_) {
-      // Branch doesn't exist yet — first commit creates it as orphan
+    let parentSha = explicitParentSha || null;
+    if (!parentSha) {
+      try {
+        parentSha = execFileSync("git", ["rev-parse", "--verify", branchRef], {
+          encoding: "utf-8", timeout: 3000, stdio: ["pipe", "pipe", "pipe"],
+        }).trim();
+      } catch (_) {
+        // Branch doesn't exist yet — first commit creates it as orphan
+      }
     }
 
     const indexEnv = { ...process.env, GIT_INDEX_FILE: tmpIndex };
@@ -150,10 +210,13 @@ function pushDataBranch(remote, branchName, maxRetries, localMemPath, loadJsonFn
   if (!remote) return { ok: false, error: "no remote configured" };
 
   const pushSpec = DATA_REF + ":" + DATA_REF;
+  // Use token-authenticated URL if available — bypasses credential helpers so
+  // pushes work from background hook processes (no keychain/credential-manager needed).
+  const pushTarget = _getAuthenticatedUrl(remote) || remote;
 
   for (let attempt = 1; attempt <= maxRetries; attempt++) {
     try {
-      execFileSync("git", ["push", remote, pushSpec], {
+      execFileSync("git", ["push", pushTarget, pushSpec], {
         timeout: 30000, stdio: ["pipe", "pipe", "pipe"],
       });
       return { ok: true, error: null };
@@ -162,15 +225,40 @@ function pushDataBranch(remote, branchName, maxRetries, localMemPath, loadJsonFn
         return { ok: false, error: err.message };
       }
 
-      // Fetch, merge, and re-commit so the next push attempt advances the ref
+      // Fetch remote, build a merged file map (local files + remote files +
+      // merged sticky-note.json), then re-commit parented off the remote SHA
+      // so the next push attempt is a fast-forward.
       try {
         const fetchResult = fetchDataBranch(remote, branchName);
-        if (fetchResult.ok && fetchResult.remoteRef && localMemPath) {
-          const remoteContent = readFileFromBranch(fetchResult.remoteRef, "sticky-note.json");
-          if (remoteContent) {
-            mergeAndSaveFromRemote(localMemPath, remoteContent, loadJsonFn, saveJsonFn);
-            const mergedContent = fs.readFileSync(localMemPath, "utf-8");
-            commitFilesToBranch(branchName, { "sticky-note.json": mergedContent });
+        if (fetchResult.ok && fetchResult.remoteRef) {
+          // Get the remote SHA to use as parent for the re-commit
+          const remoteSha = execFileSync(
+            "git", ["rev-parse", fetchResult.remoteRef], GIT_OPTS
+          ).trim();
+
+          // Build merged file map: start with remote files as base, then
+          // overlay local files so this user's audit/presence are preserved
+          const fileMap = {};
+          const localRef = "refs/heads/" + branchName;
+          for (const f of listFilesInBranch(fetchResult.remoteRef)) {
+            const content = readFileFromBranch(fetchResult.remoteRef, f);
+            if (content !== null) fileMap[f] = content;
+          }
+          for (const f of listFilesInBranch(localRef)) {
+            const content = readFileFromBranch(localRef, f);
+            if (content !== null) fileMap[f] = content;
+          }
+
+          // Merge sticky-note.json from both sides
+          if (localMemPath && fileMap["sticky-note.json"]) {
+            mergeAndSaveFromRemote(
+              localMemPath, fileMap["sticky-note.json"], loadJsonFn, saveJsonFn
+            );
+            fileMap["sticky-note.json"] = fs.readFileSync(localMemPath, "utf-8");
+          }
+
+          if (Object.keys(fileMap).length > 0) {
+            commitFilesToBranch(branchName, fileMap, remoteSha);
           }
         }
       } catch (_) {}

package/templates/hooks/pre-tool-use.js

@@ -193,7 +193,11 @@ async function main() {
     const toolInput = hookInput.tool_input || hookInput.input || hookInput.toolArgs || {};
     const cmd = typeof toolInput === "string" ? toolInput : (toolInput.command || "");
     if (/\bgit\s+(pull|merge|rebase|fetch)\b/.test(cmd)) {
-      try { syncStickyNote({}); } catch (_) {}
+      try {
+        syncStickyNote({});
+      } catch (err) {
+        _emit(`[STICKY-NOTE] ⚠️ Auto-sync before git operation failed: ${err && err.message ? err.message : err}\nSticky-note files may be dirty — run \`npx sticky-note pull\` manually to avoid conflicts.`);
+      }
     }
   }
 

package/templates/hooks/sticky-utils.js

@@ -641,6 +641,15 @@ function appendAuditLineBoth(entry, cloud) {
 // ── Environment helpers ───────────────────────────────────
 
 function getUser() {
+  // Prefer git config user.name — consistent across machines regardless of OS login name.
+  // Fall back to OS env vars, then "unknown".
+  try {
+    const { execFileSync } = require("child_process");
+    const name = execFileSync("git", ["config", "user.name"], {
+      encoding: "utf-8", timeout: 3000, stdio: ["pipe", "pipe", "pipe"],
+    }).trim();
+    if (name) return name;
+  } catch (_) {}
   return process.env.USER || process.env.USERNAME || "unknown";
 }