sticky-note-cli 3.1.40 → 3.1.42

package/bin/cli.js

@@ -720,12 +720,22 @@ async function cmdInit() {
       // Teammate flow: URL already in committed config — just need their API key
       print(`\n  Cloud backend detected: ${configStickyUrl}`);
       const keyAnswer = await ask(rl, "Enter your STICKY_API_KEY (get it from your team lead)", "");
-      if (keyAnswer.trim()) {
+      // GitHub push token — needed so session-end can push the data branch from
+      // background hook processes that don't have keychain/credential-manager access.
+      print("\n  A GitHub Personal Access Token (PAT) is needed so sticky-note can push");
+      print("  thread data in the background without requiring interactive credential access.");
+      print("  Create one at https://github.com/settings/tokens with 'repo' scope (or");
+      print("  'contents: write' for fine-grained tokens). Your team lead may share one.");
+      const pushTokenAnswer = await ask(rl, "Enter your STICKY_PUSH_TOKEN (GitHub PAT)", "");
+      if (keyAnswer.trim() || pushTokenAnswer.trim()) {
         const envPath = path.join(process.cwd(), ".env.sticky");
-        fs.writeFileSync(envPath, `STICKY_URL=${configStickyUrl}\nSTICKY_API_KEY=${keyAnswer.trim()}\n`, "utf-8");
+        let envContent = `STICKY_URL=${configStickyUrl}\n`;
+        if (keyAnswer.trim()) envContent += `STICKY_API_KEY=${keyAnswer.trim()}\n`;
+        if (pushTokenAnswer.trim()) envContent += `STICKY_PUSH_TOKEN=${pushTokenAnswer.trim()}\n`;
+        fs.writeFileSync(envPath, envContent, "utf-8");
         print("  [OK] .env.sticky written");
       } else {
-        print("  ⏭️  No API key entered — skipping .env.sticky (local-only mode)");
+        print("  ⏭️  No keys entered — skipping .env.sticky (local-only mode)");
       }
     } else {
       const cloudAnswer = await ask(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sticky-note-cli",
-  "version": "3.1.40",
+  "version": "3.1.42",
   "description": "Human-to-human handoff for AI coding assistants. Git-backed shared memory for Claude Code and Copilot CLI.",
   "license": "MIT",
   "bin": {

package/templates/hooks/data-branch.js

@@ -19,6 +19,52 @@ const DATA_REF = "refs/heads/" + DATA_BRANCH;
 
 const GIT_OPTS = { encoding: "utf-8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"] };
 
+// ── Credential helpers ────────────────────────────────────
+
+/**
+ * Read STICKY_PUSH_TOKEN from env or .env.sticky file.
+ * Returns the token string or null.
+ */
+function _getPushToken() {
+  if (process.env.STICKY_PUSH_TOKEN) return process.env.STICKY_PUSH_TOKEN;
+  try {
+    // Walk up to find .env.sticky
+    let dir = process.cwd();
+    for (let i = 0; i < 20; i++) {
+      const envPath = path.join(dir, ".env.sticky");
+      if (fs.existsSync(envPath)) {
+        const content = fs.readFileSync(envPath, "utf-8");
+        const match = content.match(/^STICKY_PUSH_TOKEN=(.+)$/m);
+        if (match) return match[1].trim();
+        break;
+      }
+      const parent = path.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  } catch (_) {}
+  return null;
+}
+
+/**
+ * Given a remote name, return an authenticated push URL if STICKY_PUSH_TOKEN
+ * is configured. Embeds the token into the HTTPS URL so the push works from
+ * any process context without needing a credential helper.
+ * Returns null if no token or remote URL is not HTTPS.
+ */
+function _getAuthenticatedUrl(remote) {
+  const token = _getPushToken();
+  if (!token) return null;
+  try {
+    const url = execFileSync("git", ["remote", "get-url", remote], GIT_OPTS).trim();
+    if (!url.startsWith("https://")) return null;
+    // Insert token: https://TOKEN@github.com/...
+    return url.replace(/^https:\/\/([^@]*)@?/, `https://${token}@`);
+  } catch (_) {
+    return null;
+  }
+}
+
 // ── Git helpers ───────────────────────────────────────────
 
 function getDefaultRemote() {
@@ -164,10 +210,13 @@ function pushDataBranch(remote, branchName, maxRetries, localMemPath, loadJsonFn
   if (!remote) return { ok: false, error: "no remote configured" };
 
   const pushSpec = DATA_REF + ":" + DATA_REF;
+  // Use token-authenticated URL if available — bypasses credential helpers so
+  // pushes work from background hook processes (no keychain/credential-manager needed).
+  const pushTarget = _getAuthenticatedUrl(remote) || remote;
 
   for (let attempt = 1; attempt <= maxRetries; attempt++) {
     try {
-      execFileSync("git", ["push", remote, pushSpec], {
+      execFileSync("git", ["push", pushTarget, pushSpec], {
         timeout: 30000, stdio: ["pipe", "pipe", "pipe"],
       });
       return { ok: true, error: null };
@@ -188,22 +237,28 @@ function pushDataBranch(remote, branchName, maxRetries, localMemPath, loadJsonFn
           ).trim();
 
           // Build merged file map: start with remote files as base, then
-          // overlay local files so this user's audit/presence are preserved
+          // overlay local files so this user's audit/presence are preserved.
+          // Capture remote sticky-note.json BEFORE the local overlay so we
+          // have the actual remote content to merge (not the local overwrite).
           const fileMap = {};
           const localRef = "refs/heads/" + branchName;
+          let remoteStickyContent = null;
           for (const f of listFilesInBranch(fetchResult.remoteRef)) {
             const content = readFileFromBranch(fetchResult.remoteRef, f);
-            if (content !== null) fileMap[f] = content;
+            if (content !== null) {
+              fileMap[f] = content;
+              if (f === "sticky-note.json") remoteStickyContent = content;
+            }
           }
           for (const f of listFilesInBranch(localRef)) {
             const content = readFileFromBranch(localRef, f);
             if (content !== null) fileMap[f] = content;
           }
 
-          // Merge sticky-note.json from both sides
-          if (localMemPath && fileMap["sticky-note.json"]) {
+          // Merge sticky-note.json from both sides using captured remote content
+          if (localMemPath && remoteStickyContent) {
             mergeAndSaveFromRemote(
-              localMemPath, fileMap["sticky-note.json"], loadJsonFn, saveJsonFn
+              localMemPath, remoteStickyContent, loadJsonFn, saveJsonFn
             );
             fileMap["sticky-note.json"] = fs.readFileSync(localMemPath, "utf-8");
           }
@@ -214,9 +269,12 @@ function pushDataBranch(remote, branchName, maxRetries, localMemPath, loadJsonFn
         }
       } catch (_) {}
 
-      // Brief exponential backoff (busy-wait — synchronous context)
-      const end = Date.now() + Math.pow(2, attempt) * 300;
-      while (Date.now() < end) {}
+      // Brief exponential backoff — use Atomics.wait to block without CPU spin
+      try {
+        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, Math.pow(2, attempt) * 300);
+      } catch (_) {
+        // Atomics.wait unavailable (e.g. SharedArrayBuffer disabled) — skip delay
+      }
     }
   }
   return { ok: false, error: "max retries exceeded" };
@@ -264,9 +322,16 @@ function mergeAndSaveFromRemote(localMemPath, remoteContent, loadJsonFn, saveJso
     return; // corrupt remote — skip
   }
 
-  const localMemory = loadJsonFn
-    ? loadJsonFn(localMemPath, { ...EMPTY_MEMORY })
-    : { ...EMPTY_MEMORY };
+  let localMemory;
+  if (loadJsonFn) {
+    localMemory = loadJsonFn(localMemPath, { ...EMPTY_MEMORY });
+  } else {
+    try {
+      localMemory = JSON.parse(fs.readFileSync(localMemPath, "utf-8"));
+    } catch (_) {
+      localMemory = { ...EMPTY_MEMORY };
+    }
+  }
 
   const localThreads = Array.isArray(localMemory.threads) ? localMemory.threads.filter(Boolean) : [];
   const remoteThreads = Array.isArray(remoteMemory.threads) ? remoteMemory.threads.filter(Boolean) : [];

package/templates/hooks/sticky-utils.js

@@ -641,6 +641,14 @@ function appendAuditLineBoth(entry, cloud) {
 // ── Environment helpers ───────────────────────────────────
 
 function getUser() {
+  // Prefer git config user.name — consistent across machines regardless of OS login name.
+  // Fall back to OS env vars, then "unknown".
+  try {
+    const name = execFileSync("git", ["config", "user.name"], {
+      encoding: "utf-8", timeout: 3000, stdio: ["pipe", "pipe", "pipe"],
+    }).trim();
+    if (name) return name;
+  } catch (_) {}
   return process.env.USER || process.env.USERNAME || "unknown";
 }
 
@@ -1272,6 +1280,7 @@ function getCloudConfig() {
   return {
     url: process.env.STICKY_URL || envFile.STICKY_URL || "",
     apiKey: process.env.STICKY_API_KEY || envFile.STICKY_API_KEY || "",
+    pushToken: process.env.STICKY_PUSH_TOKEN || envFile.STICKY_PUSH_TOKEN || "",
   };
 }