sticky-note-cli 3.1.40 → 3.1.41

package/bin/cli.js

@@ -720,12 +720,22 @@ async function cmdInit() {
       // Teammate flow: URL already in committed config — just need their API key
       print(`\n  Cloud backend detected: ${configStickyUrl}`);
       const keyAnswer = await ask(rl, "Enter your STICKY_API_KEY (get it from your team lead)", "");
-      if (keyAnswer.trim()) {
+      // GitHub push token — needed so session-end can push the data branch from
+      // background hook processes that don't have keychain/credential-manager access.
+      print("\n  A GitHub Personal Access Token (PAT) is needed so sticky-note can push");
+      print("  thread data in the background without requiring interactive credential access.");
+      print("  Create one at https://github.com/settings/tokens with 'repo' scope (or");
+      print("  'contents: write' for fine-grained tokens). Your team lead may share one.");
+      const pushTokenAnswer = await ask(rl, "Enter your STICKY_PUSH_TOKEN (GitHub PAT)", "");
+      if (keyAnswer.trim() || pushTokenAnswer.trim()) {
         const envPath = path.join(process.cwd(), ".env.sticky");
-        fs.writeFileSync(envPath, `STICKY_URL=${configStickyUrl}\nSTICKY_API_KEY=${keyAnswer.trim()}\n`, "utf-8");
+        let envContent = `STICKY_URL=${configStickyUrl}\n`;
+        if (keyAnswer.trim()) envContent += `STICKY_API_KEY=${keyAnswer.trim()}\n`;
+        if (pushTokenAnswer.trim()) envContent += `STICKY_PUSH_TOKEN=${pushTokenAnswer.trim()}\n`;
+        fs.writeFileSync(envPath, envContent, "utf-8");
         print("  [OK] .env.sticky written");
       } else {
-        print("  ⏭️  No API key entered — skipping .env.sticky (local-only mode)");
+        print("  ⏭️  No keys entered — skipping .env.sticky (local-only mode)");
       }
     } else {
       const cloudAnswer = await ask(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sticky-note-cli",
-  "version": "3.1.40",
+  "version": "3.1.41",
   "description": "Human-to-human handoff for AI coding assistants. Git-backed shared memory for Claude Code and Copilot CLI.",
   "license": "MIT",
   "bin": {

package/templates/hooks/data-branch.js

@@ -19,6 +19,52 @@ const DATA_REF = "refs/heads/" + DATA_BRANCH;
 
 const GIT_OPTS = { encoding: "utf-8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"] };
 
+// ── Credential helpers ────────────────────────────────────
+
+/**
+ * Read STICKY_PUSH_TOKEN from env or .env.sticky file.
+ * Returns the token string or null.
+ */
+function _getPushToken() {
+  if (process.env.STICKY_PUSH_TOKEN) return process.env.STICKY_PUSH_TOKEN;
+  try {
+    // Walk up to find .env.sticky
+    let dir = process.cwd();
+    for (let i = 0; i < 20; i++) {
+      const envPath = path.join(dir, ".env.sticky");
+      if (fs.existsSync(envPath)) {
+        const content = fs.readFileSync(envPath, "utf-8");
+        const match = content.match(/^STICKY_PUSH_TOKEN=(.+)$/m);
+        if (match) return match[1].trim();
+        break;
+      }
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  } catch (_) {}
+  return null;
+}
+
+/**
+ * Given a remote name, return an authenticated push URL if STICKY_PUSH_TOKEN
+ * is configured. Embeds the token into the HTTPS URL so the push works from
+ * any process context without needing a credential helper.
+ * Returns null if no token or remote URL is not HTTPS.
+ */
+function _getAuthenticatedUrl(remote) {
+  const token = _getPushToken();
+  if (!token) return null;
+  try {
+    const url = execFileSync("git", ["remote", "get-url", remote], GIT_OPTS).trim();
+    if (!url.startsWith("https://")) return null;
+    // Insert token: https://TOKEN@github.com/...
+    return url.replace(/^https:\/\/([^@]*)@?/, `https://${token}@`);
+  } catch (_) {
+    return null;
+  }
+}
+
 // ── Git helpers ───────────────────────────────────────────
 
 function getDefaultRemote() {
@@ -164,10 +210,13 @@ function pushDataBranch(remote, branchName, maxRetries, localMemPath, loadJsonFn
   if (!remote) return { ok: false, error: "no remote configured" };
 
   const pushSpec = DATA_REF + ":" + DATA_REF;
+  // Use token-authenticated URL if available — bypasses credential helpers so
+  // pushes work from background hook processes (no keychain/credential-manager needed).
+  const pushTarget = _getAuthenticatedUrl(remote) || remote;
 
   for (let attempt = 1; attempt <= maxRetries; attempt++) {
     try {
-      execFileSync("git", ["push", remote, pushSpec], {
+      execFileSync("git", ["push", pushTarget, pushSpec], {
         timeout: 30000, stdio: ["pipe", "pipe", "pipe"],
       });
       return { ok: true, error: null };

package/templates/hooks/sticky-utils.js

@@ -641,6 +641,15 @@ function appendAuditLineBoth(entry, cloud) {
 // ── Environment helpers ───────────────────────────────────
 
 function getUser() {
+  // Prefer git config user.name — consistent across machines regardless of OS login name.
+  // Fall back to OS env vars, then "unknown".
+  try {
+    const { execFileSync } = require("child_process");
+    const name = execFileSync("git", ["config", "user.name"], {
+      encoding: "utf-8", timeout: 3000, stdio: ["pipe", "pipe", "pipe"],
+    }).trim();
+    if (name) return name;
+  } catch (_) {}
   return process.env.USER || process.env.USERNAME || "unknown";
 }