stikfix 1.2.0 → 1.3.0

package/dist/host/src/bootstrap/register.js

@@ -405,6 +405,64 @@ export function createLauncherFiles(opts) {
     }
     return { written, warnings };
 }
+// ---------------------------------------------------------------------------
+// registerStartup / unregisterStartup — HKCU Run entry (Windows startup autoload)
+// ---------------------------------------------------------------------------
+// HKCU Run key + value name for the "start host on Windows login" feature.
+// HKCU (Pitfall 5 — never HKLM); the value data launches the existing hidden
+// VBS launcher via wscript.exe so no console window ever appears.
+const REG_RUN_KEY = 'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run';
+const REG_RUN_VALUE = 'stikfix-host';
+/**
+ * Register the stikfix host to start automatically on Windows login by adding
+ * an HKCU Run entry that launches the existing hidden VBS launcher (created by
+ * createLauncherFiles) via wscript.exe — so no console window is shown.
+ *
+ * Value data: `wscript.exe "<abs vbsPath>"` — reuses the same VBS path that
+ * createLauncherFiles/getLauncherPaths compute (LAUNCHER_VBS_FILENAME in the
+ * stikfix data dir).
+ *
+ * Non-win32: no-op (startup autoload is Windows-only for now).
+ * execFileSync is used (NEVER exec, NEVER shell) — mirrors registerNativeHost.
+ */
+export function registerStartup(opts = {}) {
+    const plat = opts.plat ?? process.platform;
+    if (plat !== 'win32') {
+        // Startup autoload is Windows-only for now — no-op on other platforms.
+        return;
+    }
+    const home = opts.home ?? homedir();
+    const vbsPath = join(launcherDir(plat, home), LAUNCHER_VBS_FILENAME);
+    const wscriptPath = join(process.env['SystemRoot'] ?? 'C:\\Windows', 'System32', 'wscript.exe');
+    // Value data: wscript.exe "<abs vbsPath>" — the VBS launches the host hidden.
+    const runData = `"${wscriptPath}" "${vbsPath}"`;
+    const execReg = opts.execReg ?? ((args) => {
+        execFileSync('reg', args);
+    });
+    // /f overwrites any existing value without prompting (idempotent re-register).
+    execReg(['ADD', REG_RUN_KEY, '/v', REG_RUN_VALUE, '/t', 'REG_SZ', '/d', runData, '/f']);
+}
+/**
+ * Remove the HKCU Run entry created by registerStartup. Idempotent: does not
+ * throw if the value is already absent (reg DELETE /f tolerates a missing value;
+ * a non-zero exit is swallowed). Non-win32: no-op.
+ */
+export function unregisterStartup(opts = {}) {
+    const plat = opts.plat ?? process.platform;
+    if (plat !== 'win32') {
+        return;
+    }
+    const execReg = opts.execReg ?? ((args) => {
+        execFileSync('reg', args);
+    });
+    // /f suppresses the confirmation prompt and tolerates an absent value.
+    try {
+        execReg(['DELETE', REG_RUN_KEY, '/v', REG_RUN_VALUE, '/f']);
+    }
+    catch {
+        // Value may not exist — ignore (idempotent removal).
+    }
+}
 /**
  * Write the native-messaging manifest and, on Windows, register the matching
  * HKCU registry key(s):

package/dist/host/src/index.js

@@ -16,6 +16,7 @@ import { resolveConfig, resolveConfigValues, ensureNotesDir, writeTokenFile } fr
 import { createHostServer } from './server.js';
 import { bindServer, BIND_HOST } from './bind.js';
 import { probeExistingHost } from './probe.js';
+import { startTray } from './tray.js';
 // ---------------------------------------------------------------------------
 // CLI parsing (preserve Phase 1 stub options block — HOST-13)
 // ---------------------------------------------------------------------------
@@ -107,4 +108,39 @@ console.log(JSON.stringify({
     notesDir: cfg.notesDir,
     origins: cfg.origins,
 }));
+// ---------------------------------------------------------------------------
+// Windows system-tray indicator (best-effort, cosmetic, win32-only)
+// ---------------------------------------------------------------------------
+// Only reached on genuine startup — the single-instance guard above exits(0)
+// before here, so a second instance never spawns a duplicate tray.
+const tray = startTray({
+    port: boundPort,
+    root: cfg.root,
+    name: cfg.name,
+    notesDir: cfg.notesDir,
+    hostPid: process.pid,
+});
+// Kill the tray child when the host shuts down so a dead host has no tray.
+// (No prior signal handling existed here; these are additive.)
+let shuttingDown = false;
+function shutdown(signal) {
+    if (shuttingDown)
+        return;
+    shuttingDown = true;
+    try {
+        tray?.kill();
+    }
+    catch { /* best-effort */ }
+    server.close(() => process.exit(0));
+    // Fallback: exit even if server.close hangs on lingering connections.
+    setTimeout(() => process.exit(0), 1000).unref();
+    void signal;
+}
+process.on('SIGINT', () => shutdown('SIGINT'));
+process.on('SIGTERM', () => shutdown('SIGTERM'));
+// Belt-and-suspenders: also reap the tray on plain process exit.
+process.on('exit', () => { try {
+    tray?.kill();
+}
+catch { /* best-effort */ } });
 // Server runs indefinitely (Pitfall 2 — no process.exit here)

package/dist/host/src/native-host.js

@@ -14,9 +14,10 @@
  *
  * Node builtins only — no WXT, no Chrome imports.
  */
-import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
+import { readFileSync, statSync } from 'node:fs';
+import { join, basename, resolve } from 'node:path';
 import { homedir } from 'node:os';
+import { spawn } from 'node:child_process';
 import { sendNativeMessage, readNativeMessages } from './native-msg.js';
 import { pickFolder } from './folder-picker.js';
 import { validateChosenFolder } from './validate-folder.js';
@@ -27,6 +28,74 @@ export { validateChosenFolder };
 // Config + token/port resolution
 // ---------------------------------------------------------------------------
 const CONFIG_PATH = join(homedir(), '.config', 'stikfix', 'config.json');
+/**
+ * Resolve the absolute path to the HTTP host entry bundle. Prefers the
+ * `hostEntry` field written into config.json by `npx stikfix init`. If absent
+ * (older config), falls back to resolving `src/index.js` relative to THIS
+ * native host bundle's own directory — the shipped layout is
+ * dist/host/stikfix-native.cjs alongside dist/host/src/index.js, so __dirname/src/index.js
+ * is the co-located HTTP host entry.
+ */
+function resolveHostEntry(cfg) {
+    if (typeof cfg.hostEntry === 'string' && cfg.hostEntry.length > 0) {
+        return cfg.hostEntry;
+    }
+    // Fallback: dist/host/stikfix-native.cjs → dist/host/src/index.js
+    // In the esbuild CJS bundle, __dirname is the bundle's directory.
+    return join(__dirname, 'src', 'index.js');
+}
+/**
+ * Handle a START_HOST native message: validate `root` is an existing directory,
+ * then SPAWN the HTTP host as a DETACHED process (never bind/listen here —
+ * invariant T-09-07) so it outlives this one-shot native process. Replies
+ * HOST_STARTING on success, ERROR on invalid input. `out` is injectable for tests.
+ *
+ * Returns true if the host was spawned (caller should exit 0), false on a
+ * validation error (caller should exit 1). The actual process.exit is left to
+ * the caller so this helper stays unit-testable without side effects.
+ */
+export function handleStartHost(cfg, root, spawnFn = spawn, out) {
+    const emit = (msg) => (out ? sendNativeMessage(msg, out) : sendNativeMessage(msg));
+    if (typeof root !== 'string' || root.length === 0) {
+        emit({ type: 'ERROR', error: 'START_HOST requires a non-empty "root" string.' });
+        return false;
+    }
+    // Normalize the incoming root (collapse `..`, consistent separators) before
+    // using it for the directory check and the spawned host's --root arg. No
+    // confinement check — cross-project roots over the extension-exclusive native
+    // channel are intentional; normalization is the correct hardening.
+    const resolvedRoot = resolve(root);
+    // Validate root is an existing directory (no silent failure).
+    try {
+        if (!statSync(resolvedRoot).isDirectory()) {
+            emit({ type: 'ERROR', error: `START_HOST root is not a directory: ${resolvedRoot}` });
+            return false;
+        }
+    }
+    catch {
+        emit({ type: 'ERROR', error: `START_HOST root does not exist: ${resolvedRoot}` });
+        return false;
+    }
+    const nodePath = typeof cfg.nodePath === 'string' && cfg.nodePath.length > 0 ? cfg.nodePath : process.execPath;
+    const hostEntry = resolveHostEntry(cfg);
+    // CRITICAL (T-09-07): the native host MUST NOT bind/listen itself. It only
+    // spawns a SEPARATE, detached process that is the HTTP host. Detached +
+    // stdio:'ignore' + unref() so the child outlives this one-shot native process.
+    try {
+        const child = spawnFn(nodePath, [hostEntry, '--root', resolvedRoot], {
+            detached: true,
+            stdio: 'ignore',
+            windowsHide: true,
+        });
+        child.unref();
+    }
+    catch (err) {
+        emit({ type: 'ERROR', error: `Failed to start host: ${String(err.message)}` });
+        return false;
+    }
+    emit({ type: 'HOST_STARTING', root: resolvedRoot });
+    return true;
+}
 // ---------------------------------------------------------------------------
 // PICK_FOLDER handler — open the OS dialog, validate, respond, exit (Pitfall 8)
 // Folder validation lives in validate-folder.ts (shared with the HTTP server).
@@ -88,19 +157,52 @@ export function main() {
     readNativeMessages((msg) => {
         const m = msg;
         if (m.type === 'GET_TOKEN') {
+            // Optional `root`: if the inbound message carries a valid existing
+            // directory, read the token/port/identity from THAT root instead of
+            // cfg.root. Absent/invalid → exact current behavior (backward compatible).
+            let tokenRoot = cfg.root;
+            let name = cfg.name;
+            let notesDir = cfg.notesDir;
+            if (typeof m.root === 'string' && m.root.length > 0) {
+                // Caller explicitly asked for a specific root. Normalize it (collapse
+                // `..`, consistent separators), then require it to be an existing
+                // directory. NEVER silently fall back to cfg.root — that would return a
+                // DIFFERENT project's token mislabeled as the requested one.
+                const resolvedRoot = resolve(m.root);
+                let isDir = false;
+                try {
+                    isDir = statSync(resolvedRoot).isDirectory();
+                }
+                catch {
+                    isDir = false;
+                }
+                if (!isDir) {
+                    sendNativeMessage({
+                        type: 'ERROR',
+                        error: 'GET_TOKEN root not accessible: ' + resolvedRoot,
+                    });
+                    process.exit(1);
+                }
+                tokenRoot = resolvedRoot;
+                name = basename(resolvedRoot);
+                notesDir = join(resolvedRoot, 'notes');
+            }
             // Token is required ONLY for GET_TOKEN — read it lazily here.
             let token;
             try {
-                token = readFileSync(join(cfg.root, '.stikfix-token'), 'utf8').trim();
+                token = readFileSync(join(tokenRoot, '.stikfix-token'), 'utf8').trim();
             }
             catch {
-                sendNativeMessage({ type: 'ERROR', error: '.stikfix-token not found. Start the host first.' });
+                sendNativeMessage({
+                    type: 'ERROR',
+                    error: 'No .stikfix-token in ' + tokenRoot + '. Start the host first.',
+                });
                 process.exit(1);
             }
             // Port is optional — read if present; SW falls back to port scan (A5 fallback)
             let port;
             try {
-                const raw = readFileSync(join(cfg.root, '.stikfix-port'), 'utf8').trim();
+                const raw = readFileSync(join(tokenRoot, '.stikfix-port'), 'utf8').trim();
                 const parsed = parseInt(raw, 10);
                 if (!isNaN(parsed)) {
                     port = parsed;
@@ -114,11 +216,17 @@ export function main() {
                 type: 'TOKEN',
                 token,
                 port,
-                name: cfg.name,
-                notesDir: cfg.notesDir,
+                name,
+                notesDir,
             });
             process.exit(0);
         }
+        if (m.type === 'START_HOST') {
+            // Spawn a DETACHED HTTP host for the requested root, then exit (one-shot).
+            // The native host itself NEVER binds/listens (T-09-07) — it only spawns.
+            const ok = handleStartHost(cfg, m.root);
+            process.exit(ok ? 0 : 1);
+        }
         if (m.type === 'PICK_FOLDER') {
             // PICK_FOLDER is a SEPARATE spawn from GET_TOKEN (Pitfall 8) — the dialog
             // never blocks a token fetch. It does NOT require the token (read lazily

package/dist/host/src/tray.js

@@ -0,0 +1,230 @@
+/**
+ * Windows system-tray indicator for stikfix-host.
+ *
+ * Best-effort, cosmetic, Windows-only. Spawns a hidden PowerShell WinForms
+ * NotifyIcon helper that polls the host's token-less /status endpoint and shows
+ * running (green) / not-responding (grey) state, plus a context menu to open the
+ * notes folder, stop the host, or quit the tray.
+ *
+ * Hard constraints (see project CLAUDE.md):
+ *  - Node builtins only — NO new npm dependency. The tray is a PowerShell helper,
+ *    not a Node native tray lib.
+ *  - Windows-only: complete no-op (returns null) on macOS/Linux.
+ *  - Never crash the host: any failure to write the script or spawn PowerShell is
+ *    caught, logged as a single stderr line, and swallowed. A dropped note or a
+ *    failed host start because of the tray would be an unacceptable regression.
+ *  - Security: the tray only GETs http://127.0.0.1:<port>/status (existing
+ *    token-less health endpoint). It weakens nothing.
+ *
+ * No side effects at import time: startTray() must be *called* to spawn anything.
+ */
+import { spawn } from 'node:child_process';
+import { writeFileSync, mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+/**
+ * Directory + path where the embedded tray script is written on each start.
+ * Rewriting every start keeps the tray script in lockstep with the host version.
+ * Exported (pure) for unit testing without spawning PowerShell.
+ */
+export function trayScriptPath() {
+    return join(homedir(), '.local', 'share', 'stikfix', 'stikfix-tray.ps1');
+}
+/**
+ * The embedded PowerShell tray script. A template constant so writing it is a
+ * plain fs write — no external file to ship, always matches this host version.
+ *
+ * Design notes:
+ *  - Robust icon: try to load a shipped stikfix.ico from a few candidate paths
+ *    (relative to the host bundle and to $Root); fall back to SystemIcons.
+ *  - Running/stopped state is shown *robustly* by switching between two stock
+ *    SystemIcons (Application = running, Warning = not responding) AND always
+ *    reflecting state in the tooltip text, so the state is obvious regardless of
+ *    whether the custom .ico loaded.
+ *  - A Timer (~3s) polls /status with a short timeout. Throw / non-200 => grey.
+ *  - The timer also checks the host process: if Get-Process -Id $HostPid is gone,
+ *    dispose the icon and exit, so a dead host removes the tray (honest presence).
+ *  - Proper WinForms message loop via ApplicationContext so menu + timer work.
+ */
+export const TRAY_PS1 = String.raw `param(
+  [int]$Port,
+  [string]$Root,
+  [string]$Name,
+  [string]$NotesDir,
+  [int]$HostPid
+)
+
+$ErrorActionPreference = 'SilentlyContinue'
+
+try {
+  Add-Type -AssemblyName System.Windows.Forms
+  Add-Type -AssemblyName System.Drawing
+} catch {
+  # Without WinForms/Drawing there is no tray to draw. Exit quietly.
+  return
+}
+
+# --- Resolve a custom app icon, else fall back to a stock icon -------------
+function Get-BaseIcon {
+  $candidates = @(
+    (Join-Path $PSScriptRoot 'stikfix.ico'),
+    (Join-Path $Root '.output\chrome-mv3\icon\stikfix.ico'),
+    (Join-Path $Root 'public\icon\stikfix.ico')
+  )
+  foreach ($p in $candidates) {
+    if ($p -and (Test-Path -LiteralPath $p)) {
+      try { return New-Object System.Drawing.Icon($p) } catch { }
+    }
+  }
+  return $null
+}
+
+$customIcon = Get-BaseIcon
+$iconRunning = if ($customIcon) { $customIcon } else { [System.Drawing.SystemIcons]::Application }
+$iconStopped = [System.Drawing.SystemIcons]::Warning
+
+# --- NotifyIcon -------------------------------------------------------------
+$notify = New-Object System.Windows.Forms.NotifyIcon
+$notify.Icon = $iconRunning
+$notify.Visible = $true
+
+# NotifyIcon.Text has a 63-char limit; guard so a long $Name never throws.
+function Set-SafeText([string]$t) {
+  if ($t.Length -gt 63) { $t = $t.Substring(0, 60) + '...' }
+  $notify.Text = $t
+}
+Set-SafeText "stikfix - $Name - starting on :$Port"
+
+# --- Context menu -----------------------------------------------------------
+$menu = New-Object System.Windows.Forms.ContextMenuStrip
+
+$miOpen = New-Object System.Windows.Forms.ToolStripMenuItem
+$miOpen.Text = 'Open notes folder'
+$miOpen.Add_Click({
+  try { Start-Process explorer.exe -ArgumentList @($NotesDir) } catch { }
+})
+
+$miStop = New-Object System.Windows.Forms.ToolStripMenuItem
+$miStop.Text = 'Stop host'
+$miStop.Add_Click({
+  try { Stop-Process -Id $HostPid -Force -ErrorAction SilentlyContinue } catch { }
+  try { $notify.Visible = $false; $notify.Dispose() } catch { }
+  [System.Windows.Forms.Application]::Exit()
+})
+
+$miQuit = New-Object System.Windows.Forms.ToolStripMenuItem
+$miQuit.Text = 'Quit tray (host keeps running)'
+$miQuit.Add_Click({
+  try { $notify.Visible = $false; $notify.Dispose() } catch { }
+  [System.Windows.Forms.Application]::Exit()
+})
+
+[void]$menu.Items.Add($miOpen)
+[void]$menu.Items.Add((New-Object System.Windows.Forms.ToolStripSeparator))
+[void]$menu.Items.Add($miStop)
+[void]$menu.Items.Add($miQuit)
+$notify.ContextMenuStrip = $menu
+
+# --- Status polling ---------------------------------------------------------
+function Test-HostAlive {
+  # $HostPid gone => host is dead.
+  $proc = Get-Process -Id $HostPid -ErrorAction SilentlyContinue
+  return [bool]$proc
+}
+
+function Test-StatusOk {
+  try {
+    $req = [System.Net.WebRequest]::Create("http://127.0.0.1:$Port/status")
+    $req.Method = 'GET'
+    $req.Timeout = 1500
+    $resp = $req.GetResponse()
+    $code = [int]$resp.StatusCode
+    $resp.Close()
+    return ($code -eq 200)
+  } catch {
+    return $false
+  }
+}
+
+function Update-State {
+  # If the host process is gone, remove the tray entirely (honest presence).
+  if (-not (Test-HostAlive)) {
+    try { $notify.Visible = $false; $notify.Dispose() } catch { }
+    [System.Windows.Forms.Application]::Exit()
+    return
+  }
+
+  if (Test-StatusOk) {
+    $notify.Icon = $iconRunning
+    Set-SafeText "stikfix - $Name - running on :$Port"
+  } else {
+    $notify.Icon = $iconStopped
+    Set-SafeText "stikfix - $Name - not responding"
+  }
+}
+
+$timer = New-Object System.Windows.Forms.Timer
+$timer.Interval = 3000
+$timer.Add_Tick({ Update-State })
+$timer.Start()
+
+# First update immediately so the tooltip is correct without waiting 3s.
+Update-State
+
+# --- Message loop -----------------------------------------------------------
+$ctx = New-Object System.Windows.Forms.ApplicationContext
+[System.Windows.Forms.Application]::Run($ctx)
+
+# Cleanup on exit.
+try { $timer.Stop(); $timer.Dispose() } catch { }
+try { $notify.Visible = $false; $notify.Dispose() } catch { }
+`;
+/**
+ * Start the Windows tray helper.
+ *
+ * Returns the spawned ChildProcess (so the host can kill it on shutdown), or
+ * null on any non-win32 platform or on any failure. NEVER throws.
+ */
+export function startTray(opts) {
+    if (process.platform !== 'win32') {
+        return null;
+    }
+    try {
+        const ps1Path = trayScriptPath();
+        mkdirSync(join(homedir(), '.local', 'share', 'stikfix'), { recursive: true });
+        writeFileSync(ps1Path, TRAY_PS1, { encoding: 'utf8' });
+        const child = spawn('powershell.exe', [
+            '-NoProfile',
+            '-ExecutionPolicy',
+            'Bypass',
+            '-WindowStyle',
+            'Hidden',
+            '-File',
+            ps1Path,
+            '-Port',
+            String(opts.port),
+            '-Root',
+            opts.root,
+            '-Name',
+            opts.name,
+            '-NotesDir',
+            opts.notesDir,
+            '-HostPid',
+            String(opts.hostPid),
+        ], {
+            // Not detached: we want it to be a child the host can kill on exit.
+            windowsHide: true,
+            stdio: 'ignore',
+        });
+        // A spawn error (e.g. powershell.exe missing) arrives asynchronously; swallow
+        // it so it never becomes an unhandled 'error' event that crashes the host.
+        child.on('error', (e) => {
+            console.error('stikfix: tray unavailable:', e instanceof Error ? e.message : String(e));
+        });
+        return child;
+    }
+    catch (e) {
+        console.error('stikfix: tray unavailable:', e instanceof Error ? e.message : String(e));
+        return null;
+    }
+}

package/dist/host/stikfix-init.cjs

@@ -287,6 +287,35 @@ function createLauncherFiles(opts) {
   }
   return { written, warnings };
 }
+var REG_RUN_KEY = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run";
+var REG_RUN_VALUE = "stikfix-host";
+function registerStartup(opts = {}) {
+  const plat = opts.plat ?? process.platform;
+  if (plat !== "win32") {
+    return;
+  }
+  const home = opts.home ?? (0, import_node_os.homedir)();
+  const vbsPath = (0, import_node_path2.join)(launcherDir(plat, home), LAUNCHER_VBS_FILENAME);
+  const wscriptPath = (0, import_node_path2.join)(process.env["SystemRoot"] ?? "C:\\Windows", "System32", "wscript.exe");
+  const runData = `"${wscriptPath}" "${vbsPath}"`;
+  const execReg = opts.execReg ?? ((args) => {
+    (0, import_node_child_process.execFileSync)("reg", args);
+  });
+  execReg(["ADD", REG_RUN_KEY, "/v", REG_RUN_VALUE, "/t", "REG_SZ", "/d", runData, "/f"]);
+}
+function unregisterStartup(opts = {}) {
+  const plat = opts.plat ?? process.platform;
+  if (plat !== "win32") {
+    return;
+  }
+  const execReg = opts.execReg ?? ((args) => {
+    (0, import_node_child_process.execFileSync)("reg", args);
+  });
+  try {
+    execReg(["DELETE", REG_RUN_KEY, "/v", REG_RUN_VALUE, "/f"]);
+  } catch {
+  }
+}
 function registerNativeHost(opts) {
   const plat = opts.plat ?? process.platform;
   const home = opts.home ?? (0, import_node_os.homedir)();
@@ -356,7 +385,9 @@ var { values, positionals } = (0, import_node_util.parseArgs)({
     root: { type: "string" },
     "extension-id": { type: "string" },
     port: { type: "string" },
-    browser: { type: "string" }
+    browser: { type: "string" },
+    startup: { type: "boolean" },
+    "no-startup": { type: "boolean" }
   },
   strict: false
 });
@@ -369,6 +400,36 @@ function resolveBrowser(raw) {
   }
   return raw.toLowerCase() === "firefox" ? "firefox" : "chrome";
 }
+function promptLineSync() {
+  const { readSync } = require("node:fs");
+  const buf = Buffer.alloc(1);
+  let line = "";
+  for (; ; ) {
+    let bytes = 0;
+    try {
+      bytes = readSync(0, buf, 0, 1, null);
+    } catch {
+      break;
+    }
+    if (bytes === 0) break;
+    const ch = buf.toString("utf8", 0, 1);
+    if (ch === "\n") break;
+    if (ch === "\r") continue;
+    line += ch;
+  }
+  return line.trim();
+}
+function resolveStartupChoice(forceOn, forceOff, isTTY) {
+  if (forceOn) return true;
+  if (forceOff) return false;
+  if (isTTY) {
+    process.stdout.write("Start stikfix host automatically on Windows login? [Y/n] ");
+    const answer = promptLineSync().toLowerCase();
+    if (answer === "n" || answer === "no") return false;
+    return true;
+  }
+  return false;
+}
 var CONFIG_DIR = (0, import_node_path3.join)((0, import_node_os2.homedir)(), ".config", "stikfix");
 var CONFIG_PATH = (0, import_node_path3.join)(CONFIG_DIR, "config.json");
 if (subcommand === "init") {
@@ -388,8 +449,9 @@ if (subcommand === "init") {
   const root = (0, import_node_path3.resolve)(rawRoot);
   const name = (0, import_node_path3.basename)(root);
   const notesDir = (0, import_node_path3.join)(root, "notes");
+  const hostEntryPath = (0, import_node_path3.resolve)((0, import_node_path3.join)(__dirname, "src", "index.js"));
   (0, import_node_fs2.mkdirSync)(CONFIG_DIR, { recursive: true });
-  const config = { root, name, notesDir };
+  const config = { root, name, notesDir, hostEntry: hostEntryPath, nodePath: process.execPath };
   (0, import_node_fs2.writeFileSync)(CONFIG_PATH, JSON.stringify(config, null, 2), { encoding: "utf8", mode: 384 });
   const hostBinPath = (0, import_node_path3.resolve)((0, import_node_path3.join)(__dirname, "stikfix-native.cjs"));
   try {
@@ -398,7 +460,6 @@ if (subcommand === "init") {
     console.error("stikfix init: failed to register native host:", String(err));
     process.exit(1);
   }
-  const hostEntryPath = (0, import_node_path3.resolve)((0, import_node_path3.join)(__dirname, "src", "index.js"));
   const projectRoot = (0, import_node_path3.resolve)((0, import_node_path3.join)(__dirname, "..", ".."));
   const firefoxOutputCandidates = [
     (0, import_node_path3.join)(projectRoot, ".output", "firefox-mv2"),
@@ -426,6 +487,32 @@ if (subcommand === "init") {
   for (const warn of launcherResult.warnings) {
     console.warn("  [warn] " + warn);
   }
+  if (process.platform === "win32") {
+    const wantStartup = resolveStartupChoice(
+      values["startup"] === true,
+      values["no-startup"] === true,
+      Boolean(process.stdin.isTTY)
+    );
+    if (wantStartup) {
+      try {
+        registerStartup();
+        console.log("  Startup:      enabled \u2014 the host will start on Windows login.");
+      } catch (err) {
+        console.warn(
+          "  [warn] Could not register Windows startup autoload (non-fatal): " + String(err)
+        );
+      }
+    } else {
+      try {
+        unregisterStartup();
+      } catch {
+      }
+      const hint = values["no-startup"] !== true && !process.stdin.isTTY ? " (enable later with: npx stikfix init --root <dir> --startup)" : "";
+      console.log("  Startup:      not enabled" + hint + ".");
+    }
+  } else if (values["startup"] === true) {
+    console.log("  Startup:      skipped \u2014 startup autoload is Windows-only for now.");
+  }
   console.log("");
   console.log("stikfix: native host registered successfully.");
   console.log("");
@@ -486,10 +573,16 @@ if (subcommand === "init") {
   } catch (err) {
     console.error("stikfix uninstall: error removing native-host manifest:", String(err));
   }
+  try {
+    unregisterStartup();
+  } catch (err) {
+    console.error("stikfix uninstall: error removing startup entry:", String(err));
+  }
   (0, import_node_fs2.rmSync)(CONFIG_PATH, { force: true });
   console.log("stikfix: native host unregistered.");
   console.log("  manifest removed");
   console.log("  launcher files removed");
+  console.log("  startup entry removed");
   console.log("  config removed");
 } else {
   console.error("Usage: npx stikfix <init|uninstall> [--root <dir>] [--browser <chrome|firefox>] [--extension-id <id>] [--port <port>]");

package/dist/host/stikfix-native.cjs

@@ -21,6 +21,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var native_host_exports = {};
 __export(native_host_exports, {
   handlePickFolder: () => handlePickFolder,
+  handleStartHost: () => handleStartHost,
   main: () => main,
   validateChosenFolder: () => validateChosenFolder
 });
@@ -28,6 +29,7 @@ module.exports = __toCommonJS(native_host_exports);
 var import_node_fs2 = require("node:fs");
 var import_node_path2 = require("node:path");
 var import_node_os = require("node:os");
+var import_node_child_process2 = require("node:child_process");
 
 // host/src/native-msg.ts
 function encodeNativeMessage(msg) {
@@ -107,11 +109,11 @@ function buildPickerArgs(plat = process.platform, title = "Choose folder") {
 }
 async function pickFolder(title = "Choose a project folder", plat = process.platform) {
   if (plat === "darwin") {
-    return new Promise((resolve2) => {
+    return new Promise((resolve3) => {
       const { args } = buildPickerArgs("darwin", title);
       (0, import_node_child_process.execFile)("osascript", args, { timeout: 12e4 }, (err, stdout) => {
         if (err || !stdout.trim()) {
-          resolve2(null);
+          resolve3(null);
           return;
         }
         const raw = stdout.trim();
@@ -120,7 +122,7 @@ async function pickFolder(title = "Choose a project folder", plat = process.plat
           ["-e", `POSIX path of (${raw})`],
           {},
           (e2, out2) => {
-            resolve2(e2 ? null : out2.trim() || null);
+            resolve3(e2 ? null : out2.trim() || null);
           }
         );
       });
@@ -128,9 +130,9 @@ async function pickFolder(title = "Choose a project folder", plat = process.plat
   }
   if (plat === "win32") {
     const { cmd, args } = buildPickerArgs("win32", title);
-    return new Promise((resolve2) => {
+    return new Promise((resolve3) => {
       (0, import_node_child_process.execFile)(cmd, args, { timeout: 12e4 }, (err, stdout) => {
-        resolve2(err ? null : stdout.trim() || null);
+        resolve3(err ? null : stdout.trim() || null);
       });
     });
   }
@@ -141,19 +143,19 @@ async function pickFolder(title = "Choose a project folder", plat = process.plat
   return null;
 }
 function tryLinuxPicker(tool, title) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const args = tool === "zenity" ? ["--file-selection", "--directory", `--title=${title}`] : ["--getexistingdirectory", "/home"];
     (0, import_node_child_process.execFile)(tool, args, { timeout: 12e4 }, (err, stdout) => {
       if (err) {
         const e = err;
         if (e.code === "ENOENT") {
-          resolve2(void 0);
+          resolve3(void 0);
         } else {
-          resolve2(null);
+          resolve3(null);
         }
         return;
       }
-      resolve2(stdout.trim() || null);
+      resolve3(stdout.trim() || null);
     });
   });
 }
@@ -186,6 +188,44 @@ function validateChosenFolder(folder, plat = process.platform) {
 
 // host/src/native-host.ts
 var CONFIG_PATH = (0, import_node_path2.join)((0, import_node_os.homedir)(), ".config", "stikfix", "config.json");
+function resolveHostEntry(cfg) {
+  if (typeof cfg.hostEntry === "string" && cfg.hostEntry.length > 0) {
+    return cfg.hostEntry;
+  }
+  return (0, import_node_path2.join)(__dirname, "src", "index.js");
+}
+function handleStartHost(cfg, root, spawnFn = import_node_child_process2.spawn, out) {
+  const emit = (msg) => out ? sendNativeMessage(msg, out) : sendNativeMessage(msg);
+  if (typeof root !== "string" || root.length === 0) {
+    emit({ type: "ERROR", error: 'START_HOST requires a non-empty "root" string.' });
+    return false;
+  }
+  const resolvedRoot = (0, import_node_path2.resolve)(root);
+  try {
+    if (!(0, import_node_fs2.statSync)(resolvedRoot).isDirectory()) {
+      emit({ type: "ERROR", error: `START_HOST root is not a directory: ${resolvedRoot}` });
+      return false;
+    }
+  } catch {
+    emit({ type: "ERROR", error: `START_HOST root does not exist: ${resolvedRoot}` });
+    return false;
+  }
+  const nodePath = typeof cfg.nodePath === "string" && cfg.nodePath.length > 0 ? cfg.nodePath : process.execPath;
+  const hostEntry = resolveHostEntry(cfg);
+  try {
+    const child = spawnFn(nodePath, [hostEntry, "--root", resolvedRoot], {
+      detached: true,
+      stdio: "ignore",
+      windowsHide: true
+    });
+    child.unref();
+  } catch (err) {
+    emit({ type: "ERROR", error: `Failed to start host: ${String(err.message)}` });
+    return false;
+  }
+  emit({ type: "HOST_STARTING", root: resolvedRoot });
+  return true;
+}
 async function handlePickFolder(origin, pickFn = pickFolder, plat = process.platform, out) {
   let chosen;
   try {
@@ -211,16 +251,41 @@ function main() {
   readNativeMessages((msg) => {
     const m = msg;
     if (m.type === "GET_TOKEN") {
+      let tokenRoot = cfg.root;
+      let name = cfg.name;
+      let notesDir = cfg.notesDir;
+      if (typeof m.root === "string" && m.root.length > 0) {
+        const resolvedRoot = (0, import_node_path2.resolve)(m.root);
+        let isDir = false;
+        try {
+          isDir = (0, import_node_fs2.statSync)(resolvedRoot).isDirectory();
+        } catch {
+          isDir = false;
+        }
+        if (!isDir) {
+          sendNativeMessage({
+            type: "ERROR",
+            error: "GET_TOKEN root not accessible: " + resolvedRoot
+          });
+          process.exit(1);
+        }
+        tokenRoot = resolvedRoot;
+        name = (0, import_node_path2.basename)(resolvedRoot);
+        notesDir = (0, import_node_path2.join)(resolvedRoot, "notes");
+      }
       let token;
       try {
-        token = (0, import_node_fs2.readFileSync)((0, import_node_path2.join)(cfg.root, ".stikfix-token"), "utf8").trim();
+        token = (0, import_node_fs2.readFileSync)((0, import_node_path2.join)(tokenRoot, ".stikfix-token"), "utf8").trim();
       } catch {
-        sendNativeMessage({ type: "ERROR", error: ".stikfix-token not found. Start the host first." });
+        sendNativeMessage({
+          type: "ERROR",
+          error: "No .stikfix-token in " + tokenRoot + ". Start the host first."
+        });
         process.exit(1);
       }
       let port;
       try {
-        const raw = (0, import_node_fs2.readFileSync)((0, import_node_path2.join)(cfg.root, ".stikfix-port"), "utf8").trim();
+        const raw = (0, import_node_fs2.readFileSync)((0, import_node_path2.join)(tokenRoot, ".stikfix-port"), "utf8").trim();
         const parsed = parseInt(raw, 10);
         if (!isNaN(parsed)) {
           port = parsed;
@@ -231,11 +296,15 @@ function main() {
         type: "TOKEN",
         token,
         port,
-        name: cfg.name,
-        notesDir: cfg.notesDir
+        name,
+        notesDir
       });
       process.exit(0);
     }
+    if (m.type === "START_HOST") {
+      const ok = handleStartHost(cfg, m.root);
+      process.exit(ok ? 0 : 1);
+    }
     if (m.type === "PICK_FOLDER") {
       handlePickFolder(m.origin).then(
         () => process.exit(0),
@@ -252,6 +321,7 @@ if (typeof require !== "undefined" && typeof module !== "undefined" && require.m
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   handlePickFolder,
+  handleStartHost,
   main,
   validateChosenFolder
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stikfix",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Pin sticky notes on any page — your AI reads them.",
   "license": "MIT",
   "author": "Omer Nesher <omernesher@gmail.com>",