sticky-note-cli 3.1.9 → 3.1.11

package/bin/cli.js

@@ -2983,6 +2983,23 @@ function cmdGc() {
 // DEPLOY-BACKEND command (V3)
 // ──────────────────────────────────────────────
 
+// Derive a safe Worker name from the git remote or cwd.
+// e.g. "BandaruDheeraj/sticky-note" → "sticky-dheeraj-sticky-note"
+function deriveWorkerName() {
+  try {
+    const remote = execSync("git remote get-url origin", { encoding: "utf-8", stdio: "pipe" }).trim();
+    const match = remote.match(/[:/]([^/]+)\/([^/]+?)(?:\.git)?$/);
+    if (match) {
+      const [, owner, repo] = match;
+      const slug = `${owner}-${repo}`.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").slice(0, 50);
+      return `sticky-${slug}`;
+    }
+  } catch (_) {}
+  // Fallback to cwd folder name
+  const folder = path.basename(process.cwd()).toLowerCase().replace(/[^a-z0-9-]/g, "-").slice(0, 40);
+  return `sticky-${folder}`;
+}
+
 // Shared provisioning logic used by both cmdInit and cmdDeployBackend.
 // Returns null if wrangler is missing.
 // Returns { workerUrl, apiKey, secretSet } on success.
@@ -3040,11 +3057,12 @@ function provisionCloudBackend() {
     print("  [OK] wrangler.toml updated with namespace ID");
   }
 
-  // Step 2: Deploy Worker
-  print("  Step 2: Deploying Worker...");
+  // Step 2: Deploy Worker (name derived from git repo for unique URL)
+  const workerName = deriveWorkerName();
+  print(`  Step 2: Deploying Worker as "${workerName}"...`);
   let deployResult;
   try {
-    deployResult = execSync("wrangler deploy", {
+    deployResult = execSync(`wrangler deploy --name ${workerName}`, {
       cwd: serverDir,
       encoding: "utf-8",
       stdio: ["pipe", "pipe", "pipe"],
@@ -3067,7 +3085,7 @@ function provisionCloudBackend() {
   print("  Step 3: Setting API key on Worker...");
   let secretSet = false;
   try {
-    execSync("wrangler secret put STICKY_API_KEY", {
+    execSync(`wrangler secret put STICKY_API_KEY --name ${workerName}`, {
       cwd: serverDir,
       input: apiKey,
       encoding: "utf-8",
@@ -3077,7 +3095,7 @@ function provisionCloudBackend() {
     secretSet = true;
   } catch (err) {
     print("  [WARN] Could not set STICKY_API_KEY automatically: " + (err.message || err));
-    if (workerUrl) print(`         Set it manually: echo '${apiKey}' | wrangler secret put STICKY_API_KEY`);
+    if (workerUrl) print(`         Set it manually: echo '${apiKey}' | wrangler secret put STICKY_API_KEY --name ${workerName}`);
   }
 
   // Write .env.sticky

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sticky-note-cli",
-  "version": "3.1.9",
+  "version": "3.1.11",
   "description": "Human-to-human handoff for AI coding assistants. Git-backed shared memory for Claude Code and Copilot CLI.",
   "license": "MIT",
   "bin": {
@@ -25,7 +25,8 @@
   },
   "files": [
     "bin/",
-    "templates/"
+    "templates/",
+    "sticky-server/"
   ],
   "engines": {
     "node": ">=16.0.0"

package/sticky-server/LICENSE

@@ -0,0 +1,31 @@
+GNU AFFERO GENERAL PUBLIC LICENSE
+Version 3, 19 November 2007
+
+Copyright (C) 2026 Dheeraj Bandaru
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published
+by the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+Additional permission under GNU AGPL version 3 section 7:
+
+If you modify this Program, or any covered work, by linking or combining
+it with other code, such combination is not considered a "covered work"
+under the AGPL, provided that the other code is licensed under a
+permissive license (MIT, BSD, Apache 2.0, or similar).
+
+---
+
+The client layer of Sticky Note (bin/, templates/, hooks) is licensed
+under the MIT License. See the root LICENSE file.
+
+Only the sticky-server/ directory is covered by this AGPL license.

package/sticky-server/adapters/cf-kv.js

@@ -0,0 +1,203 @@
+/**
+ * Cloudflare KV adapter for Sticky Note V3.
+ *
+ * KV key schema (all prefixed by project):
+ *   {project}:thread:{uuid}           → thread JSON
+ *   {project}:thread-index            → JSON array of thread UUIDs
+ *   {project}:audit:{timestamp}:{uuid} → audit record JSON
+ *   {project}:audit-index             → JSON array of audit keys
+ *   {project}:presence:{user}         → presence record JSON
+ *   {project}:presence-index          → JSON array of usernames
+ *   {project}:config                  → config JSON
+ */
+
+// ── Threads ──────────────────────────────────────────────
+
+async function getThreads(kv, project, filters = {}) {
+  const indexKey = `${project}:thread-index`;
+  const index = JSON.parse((await kv.get(indexKey)) || "[]");
+
+  if (index.length === 0) return [];
+
+  const threads = await Promise.all(
+    index.map(async (id) => {
+      const raw = await kv.get(`${project}:thread:${id}`);
+      return raw ? JSON.parse(raw) : null;
+    })
+  );
+
+  let result = threads.filter(Boolean);
+
+  if (filters.status) {
+    result = result.filter((t) => t.status === filters.status);
+  }
+  if (filters.q) {
+    const q = filters.q.toLowerCase();
+    result = result.filter(
+      (t) =>
+        (t.narrative || "").toLowerCase().includes(q) ||
+        (t.handoff_summary || "").toLowerCase().includes(q) ||
+        (t.last_note || "").toLowerCase().includes(q) ||
+        (t.files_touched || []).some((f) => f.toLowerCase().includes(q))
+    );
+  }
+
+  return result;
+}
+
+async function getThread(kv, project, id) {
+  const raw = await kv.get(`${project}:thread:${id}`);
+  return raw ? JSON.parse(raw) : null;
+}
+
+async function putThread(kv, project, thread) {
+  const id = thread.id;
+  await kv.put(`${project}:thread:${id}`, JSON.stringify(thread));
+
+  // Update index
+  const indexKey = `${project}:thread-index`;
+  const index = JSON.parse((await kv.get(indexKey)) || "[]");
+  if (!index.includes(id)) {
+    index.push(id);
+    await kv.put(indexKey, JSON.stringify(index));
+  }
+}
+
+async function deleteThread(kv, project, id) {
+  // Tombstone: keep minimal record
+  const existing = await getThread(kv, project, id);
+  if (existing) {
+    const tombstone = {
+      id: existing.id,
+      user: existing.user,
+      status: "expired",
+      closed_at: existing.closed_at || new Date().toISOString(),
+      created_at: existing.created_at,
+    };
+    await kv.put(`${project}:thread:${id}`, JSON.stringify(tombstone));
+  }
+}
+
+// ── Audit ────────────────────────────────────────────────
+
+async function appendAudit(kv, project, record) {
+  const ts = record.timestamp || new Date().toISOString();
+  const uid = crypto.randomUUID();
+  const key = `${project}:audit:${ts}:${uid}`;
+  await kv.put(key, JSON.stringify(record));
+
+  const indexKey = `${project}:audit-index`;
+  const index = JSON.parse((await kv.get(indexKey)) || "[]");
+  index.push(key);
+
+  // Cap at 10,000 entries; trim oldest on overflow
+  if (index.length > 10000) {
+    const removed = index.splice(0, index.length - 10000);
+    await Promise.all(removed.map((k) => kv.delete(k)));
+  }
+  await kv.put(indexKey, JSON.stringify(index));
+}
+
+async function queryAudit(kv, project, filters = {}) {
+  const indexKey = `${project}:audit-index`;
+  const index = JSON.parse((await kv.get(indexKey)) || "[]");
+
+  if (index.length === 0) return [];
+
+  const records = await Promise.all(
+    index.map(async (key) => {
+      const raw = await kv.get(key);
+      return raw ? JSON.parse(raw) : null;
+    })
+  );
+
+  let result = records.filter(Boolean);
+
+  if (filters.user) {
+    result = result.filter((r) => r.user === filters.user);
+  }
+  if (filters.file) {
+    result = result.filter((r) => (r.file || "").includes(filters.file));
+  }
+  if (filters.tool) {
+    result = result.filter((r) => r.tool === filters.tool);
+  }
+  if (filters.since) {
+    const since = new Date(filters.since).getTime();
+    result = result.filter(
+      (r) => new Date(r.timestamp || 0).getTime() >= since
+    );
+  }
+
+  return result;
+}
+
+// ── Presence ─────────────────────────────────────────────
+
+const PRESENCE_TTL_SECONDS = 15 * 60; // 15 minutes
+
+async function getPresence(kv, project) {
+  const indexKey = `${project}:presence-index`;
+  const index = JSON.parse((await kv.get(indexKey)) || "[]");
+
+  if (index.length === 0) return [];
+
+  const records = await Promise.all(
+    index.map(async (user) => {
+      const raw = await kv.get(`${project}:presence:${user}`);
+      return raw ? JSON.parse(raw) : null;
+    })
+  );
+
+  return records.filter(Boolean);
+}
+
+async function upsertPresence(kv, project, record) {
+  const user = record.user;
+  await kv.put(`${project}:presence:${user}`, JSON.stringify(record), {
+    expirationTtl: PRESENCE_TTL_SECONDS,
+  });
+
+  const indexKey = `${project}:presence-index`;
+  const index = JSON.parse((await kv.get(indexKey)) || "[]");
+  if (!index.includes(user)) {
+    index.push(user);
+    await kv.put(indexKey, JSON.stringify(index));
+  }
+}
+
+async function deletePresence(kv, project, user) {
+  await kv.delete(`${project}:presence:${user}`);
+
+  const indexKey = `${project}:presence-index`;
+  const index = JSON.parse((await kv.get(indexKey)) || "[]");
+  const filtered = index.filter((u) => u !== user);
+  await kv.put(indexKey, JSON.stringify(filtered));
+}
+
+// ── Config ───────────────────────────────────────────────
+
+async function getConfig(kv, project) {
+  const raw = await kv.get(`${project}:config`);
+  return raw ? JSON.parse(raw) : null;
+}
+
+async function putConfig(kv, project, config) {
+  await kv.put(`${project}:config`, JSON.stringify(config));
+}
+
+// ── Export ────────────────────────────────────────────────
+
+export {
+  getThreads,
+  getThread,
+  putThread,
+  deleteThread,
+  appendAudit,
+  queryAudit,
+  getPresence,
+  upsertPresence,
+  deletePresence,
+  getConfig,
+  putConfig,
+};

package/sticky-server/worker.js

@@ -0,0 +1,229 @@
+/**
+ * Sticky Note V3 — Cloudflare Worker
+ *
+ * REST API backed by Cloudflare KV.
+ * Auth: X-Sticky-API-Key header matched against STICKY_API_KEY env var.
+ * Project routing: X-Sticky-Project header (auto-set by client hooks).
+ *
+ * Endpoints:
+ *   POST   /threads          — create thread
+ *   GET    /threads           — list threads (?status=, ?q=)
+ *   GET    /threads/:id       — get thread
+ *   PUT    /threads/:id       — update thread
+ *   DELETE /threads/:id       — tombstone thread
+ *   GET    /audit             — query audit (?file=, ?user=, ?since=, ?tool=)
+ *   POST   /audit             — append audit record
+ *   GET    /presence          — list active developers
+ *   POST   /presence          — heartbeat upsert
+ *   DELETE /presence/:user    — clear presence
+ *   GET    /config            — get team config
+ *   PUT    /config            — update team config
+ */
+
+import * as adapter from "./adapters/cf-kv.js";
+
+// ── Helpers ──────────────────────────────────────────────
+
+function json(data, status = 200) {
+  return new Response(JSON.stringify(data), {
+    status,
+    headers: { "Content-Type": "application/json" },
+  });
+}
+
+function error(message, status = 400) {
+  return json({ error: message }, status);
+}
+
+function authenticate(request, env) {
+  const key = request.headers.get("X-Sticky-API-Key");
+  if (!env.STICKY_API_KEY) return true; // no key configured = open
+  return key === env.STICKY_API_KEY;
+}
+
+function getProject(request) {
+  return request.headers.get("X-Sticky-Project") || "default";
+}
+
+// ── Router ───────────────────────────────────────────────
+
+function matchRoute(method, pathname) {
+  // Thread routes
+  if (method === "POST" && pathname === "/threads") return { handler: "createThread" };
+  if (method === "GET" && pathname === "/threads") return { handler: "listThreads" };
+  if (method === "GET" && pathname.startsWith("/threads/")) {
+    return { handler: "getThread", id: pathname.slice("/threads/".length) };
+  }
+  if (method === "PUT" && pathname.startsWith("/threads/")) {
+    return { handler: "updateThread", id: pathname.slice("/threads/".length) };
+  }
+  if (method === "DELETE" && pathname.startsWith("/threads/")) {
+    return { handler: "deleteThread", id: pathname.slice("/threads/".length) };
+  }
+
+  // Audit routes
+  if (method === "GET" && pathname === "/audit") return { handler: "queryAudit" };
+  if (method === "POST" && pathname === "/audit") return { handler: "appendAudit" };
+
+  // Presence routes
+  if (method === "GET" && pathname === "/presence") return { handler: "getPresence" };
+  if (method === "POST" && pathname === "/presence") return { handler: "upsertPresence" };
+  if (method === "DELETE" && pathname.startsWith("/presence/")) {
+    return { handler: "deletePresence", user: decodeURIComponent(pathname.slice("/presence/".length)) };
+  }
+
+  // Config routes
+  if (method === "GET" && pathname === "/config") return { handler: "getConfig" };
+  if (method === "PUT" && pathname === "/config") return { handler: "putConfig" };
+
+  // Health
+  if (method === "GET" && pathname === "/health") return { handler: "health" };
+
+  return null;
+}
+
+// ── Handlers ─────────────────────────────────────────────
+
+const handlers = {
+  async health() {
+    return json({ status: "ok", version: "3.0.0" });
+  },
+
+  // ── Threads ──
+
+  async createThread(request, kv, project) {
+    const thread = await request.json();
+    if (!thread.id) return error("thread.id is required");
+    await adapter.putThread(kv, project, thread);
+    return json(thread, 201);
+  },
+
+  async listThreads(request, kv, project) {
+    const url = new URL(request.url);
+    const filters = {
+      status: url.searchParams.get("status") || undefined,
+      q: url.searchParams.get("q") || undefined,
+    };
+    const threads = await adapter.getThreads(kv, project, filters);
+    return json({ threads });
+  },
+
+  async getThread(_request, kv, project, { id }) {
+    const thread = await adapter.getThread(kv, project, id);
+    if (!thread) return error("Thread not found", 404);
+    return json(thread);
+  },
+
+  async updateThread(request, kv, project, { id }) {
+    const thread = await request.json();
+    thread.id = id;
+    await adapter.putThread(kv, project, thread);
+    return json(thread);
+  },
+
+  async deleteThread(_request, kv, project, { id }) {
+    await adapter.deleteThread(kv, project, id);
+    return json({ deleted: id });
+  },
+
+  // ── Audit ──
+
+  async queryAudit(request, kv, project) {
+    const url = new URL(request.url);
+    const filters = {
+      user: url.searchParams.get("user") || undefined,
+      file: url.searchParams.get("file") || undefined,
+      tool: url.searchParams.get("tool") || undefined,
+      since: url.searchParams.get("since") || undefined,
+    };
+    const records = await adapter.queryAudit(kv, project, filters);
+    return json({ audit: records });
+  },
+
+  async appendAudit(request, kv, project) {
+    const record = await request.json();
+    await adapter.appendAudit(kv, project, record);
+    return json({ ok: true }, 201);
+  },
+
+  // ── Presence ──
+
+  async getPresence(_request, kv, project) {
+    const records = await adapter.getPresence(kv, project);
+    return json({ presence: records });
+  },
+
+  async upsertPresence(request, kv, project) {
+    const record = await request.json();
+    if (!record.user) return error("record.user is required");
+    await adapter.upsertPresence(kv, project, record);
+    return json({ ok: true });
+  },
+
+  async deletePresence(_request, kv, project, { user }) {
+    await adapter.deletePresence(kv, project, user);
+    return json({ deleted: user });
+  },
+
+  // ── Config ──
+
+  async getConfig(_request, kv, project) {
+    const config = await adapter.getConfig(kv, project);
+    if (!config) return json({});
+    return json(config);
+  },
+
+  async putConfig(request, kv, project) {
+    const config = await request.json();
+    await adapter.putConfig(kv, project, config);
+    return json(config);
+  },
+};
+
+// ── Worker entry point ───────────────────────────────────
+
+export default {
+  async fetch(request, env) {
+    // CORS preflight
+    if (request.method === "OPTIONS") {
+      return new Response(null, {
+        status: 204,
+        headers: {
+          "Access-Control-Allow-Origin": "*",
+          "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
+          "Access-Control-Allow-Headers": "Content-Type, X-Sticky-API-Key, X-Sticky-Project",
+        },
+      });
+    }
+
+    // Auth
+    if (!authenticate(request, env)) {
+      return error("Unauthorized", 401);
+    }
+
+    const url = new URL(request.url);
+    const route = matchRoute(request.method, url.pathname);
+
+    if (!route) {
+      return error("Not found", 404);
+    }
+
+    const project = getProject(request);
+    const kv = env.STICKY_KV;
+
+    try {
+      const handler = handlers[route.handler];
+      const response = await handler(request, kv, project, route);
+
+      // Add CORS headers to all responses
+      const headers = new Headers(response.headers);
+      headers.set("Access-Control-Allow-Origin", "*");
+      return new Response(response.body, {
+        status: response.status,
+        headers,
+      });
+    } catch (err) {
+      return error(`Internal error: ${err.message}`, 500);
+    }
+  },
+};

package/sticky-server/wrangler.toml

@@ -0,0 +1,10 @@
+name = "sticky-note-server"
+main = "worker.js"
+compatibility_date = "2024-09-01"
+
+[vars]
+ENVIRONMENT = "production"
+
+[[kv_namespaces]]
+binding = "STICKY_KV"
+id = "PLACEHOLDER_KV_NAMESPACE_ID"