stikfix 1.6.2 → 1.7.0

package/dist/host/src/index.js

@@ -13,11 +13,12 @@ import { writeFileSync, readFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { parseArgs } from 'node:util';
 import { pathToFileURL } from 'node:url';
-import { resolveConfig, resolveConfigValues, ensureNotesDir, writeTokenFile } from './config.js';
+import { resolveConfig, resolveConfigValues, ensureNotesDir, writeTokenFile, VERSION } from './config.js';
 import { createHostServer } from './server.js';
 import { bindServer, BIND_HOST } from './bind.js';
 import { probeExistingHost } from './probe.js';
 import { startTray } from './tray.js';
+import { runUpdateCheck } from './update-check.js';
 /**
  * Start the HTTP host. Extracted from the former top-level module body so the
  * single-executable dispatcher (exe-main.ts) can call it as `serve`, while
@@ -132,6 +133,15 @@ export async function startHttpHost(argv = process.argv.slice(2)) {
         notesDir: cfg.notesDir,
         hostPid: process.pid,
     });
+    // Host auto-update: check GitHub for a newer release on startup and every 6h.
+    // Fire-and-forget + fully swallowed — a failed check must never crash or block
+    // the host. runUpdateCheck updates the module state surfaced on GET /status.
+    void runUpdateCheck(VERSION).catch(() => { });
+    const updateTimer = setInterval(() => {
+        void runUpdateCheck(VERSION).catch(() => { });
+    }, 6 * 60 * 60 * 1000);
+    // .unref() so the interval never keeps the process alive on its own.
+    updateTimer.unref();
     // Kill the tray child when the host shuts down so a dead host has no tray.
     // (No prior signal handling existed here; these are additive.)
     let shuttingDown = false;
@@ -139,6 +149,10 @@ export async function startHttpHost(argv = process.argv.slice(2)) {
         if (shuttingDown)
             return;
         shuttingDown = true;
+        try {
+            clearInterval(updateTimer);
+        }
+        catch { /* best-effort */ }
         try {
             tray?.kill();
         }

package/dist/host/src/server.js

@@ -17,6 +17,7 @@ import { writeNote } from './write-note.js';
 import { listAnnotations, editNote, deleteNote } from './read-note.js';
 import { validateChosenFolder } from './validate-folder.js';
 import { isGitRepo, getLastGitSyncStatus, gitSyncNote } from './git-sync.js';
+import { getUpdateState } from './update-check.js';
 // ---------------------------------------------------------------------------
 // Per-request notes-dir resolution (D-04 — targetDir support)
 // ---------------------------------------------------------------------------
@@ -95,6 +96,9 @@ async function handleStatus(req, res, cfg) {
         // result of the most recent git-sync attempt (null if none yet).
         gitRepo: await isGitRepo(cfg.root),
         gitSyncStatus: getLastGitSyncStatus(),
+        // Host auto-update surface (public, non-secret): whether a newer release is
+        // available and where to get it. Consumed by the tray for 1-click apply.
+        update: getUpdateState(),
     });
     res.writeHead(200, { 'Content-Type': 'application/json' });
     res.end(body);

package/dist/host/src/tray.js

@@ -57,6 +57,13 @@ export const TRAY_PS1 = String.raw `param(
 
 $ErrorActionPreference = 'SilentlyContinue'
 
+# --- Update state (script scope) --------------------------------------------
+# Set when GET /status reports an available update; consumed by the update menu
+# item's click handler. UpdateShown gates the one-time "update available" balloon.
+$script:UpdateShown = $false
+$script:PendingUrl = ''
+$script:PendingSha = ''
+
 try {
   Add-Type -AssemblyName System.Windows.Forms
   Add-Type -AssemblyName System.Drawing
@@ -100,6 +107,45 @@ Set-SafeText "stikfix - $Name - starting on :$Port"
 # --- Context menu -----------------------------------------------------------
 $menu = New-Object System.Windows.Forms.ContextMenuStrip
 
+# Update item — first in the menu, hidden until an update is detected. Clicking
+# it downloads the new installer, verifies its SHA-256, and runs it (one UAC
+# prompt). The elevated installer stops the old host, swaps files, and restarts
+# it; this tray self-disposes when the old host process dies.
+$miUpdate = New-Object System.Windows.Forms.ToolStripMenuItem
+$miUpdate.Text = 'Update Stikfix'
+$miUpdate.Add_Click({
+  $url = $script:PendingUrl
+  $sha = $script:PendingSha
+  if ([string]::IsNullOrEmpty($url) -or [string]::IsNullOrEmpty($sha)) {
+    try { $notify.ShowBalloonTip(5000, 'Stikfix', 'Update details unavailable', [System.Windows.Forms.ToolTipIcon]::Warning) } catch { }
+    return
+  }
+  try { $notify.ShowBalloonTip(5000, 'Stikfix', 'Downloading Stikfix update...', [System.Windows.Forms.ToolTipIcon]::Info) } catch { }
+  $tmp = Join-Path $env:TEMP 'stikfix-update-setup.exe'
+  try {
+    $wc = New-Object System.Net.WebClient
+    $wc.DownloadFile($url, $tmp)
+    $wc.Dispose()
+  } catch {
+    try { $notify.ShowBalloonTip(5000, 'Stikfix', 'Download failed', [System.Windows.Forms.ToolTipIcon]::Error) } catch { }
+    return
+  }
+  # Security gate: verify SHA-256 before executing the installer.
+  $actual = ''
+  try { $actual = (Get-FileHash -Algorithm SHA256 -LiteralPath $tmp).Hash } catch { }
+  if ([string]::IsNullOrEmpty($actual) -or ($actual -ine $sha)) {
+    try { Remove-Item -LiteralPath $tmp -Force -ErrorAction SilentlyContinue } catch { }
+    try { $notify.ShowBalloonTip(5000, 'Stikfix', 'Update verification failed - not installing.', [System.Windows.Forms.ToolTipIcon]::Error) } catch { }
+    return
+  }
+  try {
+    $notify.ShowBalloonTip(5000, 'Stikfix', "Installing update - you'll see a permission prompt.", [System.Windows.Forms.ToolTipIcon]::Info)
+    Start-Process -FilePath $tmp -ArgumentList '/SILENT','/SUPPRESSMSGBOXES','/NORESTART'
+  } catch {
+    try { $notify.ShowBalloonTip(5000, 'Stikfix', 'Could not launch the update installer.', [System.Windows.Forms.ToolTipIcon]::Error) } catch { }
+  }
+})
+
 $miOpen = New-Object System.Windows.Forms.ToolStripMenuItem
 $miOpen.Text = 'Open notes folder'
 $miOpen.Add_Click({
@@ -125,6 +171,14 @@ $miQuit.Add_Click({
 [void]$menu.Items.Add((New-Object System.Windows.Forms.ToolStripSeparator))
 [void]$menu.Items.Add($miStop)
 [void]$menu.Items.Add($miQuit)
+
+# Update item + its separator go FIRST (index 0/1), hidden until an update lands.
+$sepUpdate = New-Object System.Windows.Forms.ToolStripSeparator
+$menu.Items.Insert(0, $sepUpdate)
+$menu.Items.Insert(0, $miUpdate)
+$miUpdate.Visible = $false
+$sepUpdate.Visible = $false
+
 $notify.ContextMenuStrip = $menu
 
 # --- Status polling ---------------------------------------------------------
@@ -134,17 +188,35 @@ function Test-HostAlive {
   return [bool]$proc
 }
 
-function Test-StatusOk {
+# Fetch /status, read + parse the JSON body, and return a hashtable:
+#   @{ Ok = <bool health>; Update = <the .update object or $null> }
+# Any failure (throw, non-200, unparseable body) => @{ Ok = $false; Update = $null }.
+function Get-HostStatus {
   try {
     $req = [System.Net.WebRequest]::Create("http://127.0.0.1:$Port/status")
     $req.Method = 'GET'
     $req.Timeout = 1500
     $resp = $req.GetResponse()
     $code = [int]$resp.StatusCode
+    $body = ''
+    try {
+      $stream = $resp.GetResponseStream()
+      $reader = New-Object System.IO.StreamReader($stream)
+      $body = $reader.ReadToEnd()
+      $reader.Close()
+    } catch { }
     $resp.Close()
-    return ($code -eq 200)
+    if ($code -ne 200) { return @{ Ok = $false; Update = $null } }
+    $update = $null
+    try {
+      $json = $body | ConvertFrom-Json
+      if ($json -and ($json.PSObject.Properties.Name -contains 'update')) {
+        $update = $json.update
+      }
+    } catch { }
+    return @{ Ok = $true; Update = $update }
   } catch {
-    return $false
+    return @{ Ok = $false; Update = $null }
   }
 }
 
@@ -156,13 +228,47 @@ function Update-State {
     return
   }
 
-  if (Test-StatusOk) {
+  $status = Get-HostStatus
+  $ok = $status.Ok
+  $update = $status.Update
+
+  # Compute the base running/stopped tooltip; the update suffix is appended below.
+  if ($ok) {
     $notify.Icon = $iconRunning
-    Set-SafeText "stikfix - $Name - running on :$Port"
+    $tip = "stikfix - $Name - running on :$Port"
   } else {
     $notify.Icon = $iconStopped
-    Set-SafeText "stikfix - $Name - not responding"
+    $tip = "stikfix - $Name - not responding"
   }
+
+  # Surface an available update (guarded — $update is $null on old hosts).
+  $hasUpdate = $false
+  try { $hasUpdate = ($update -ne $null) -and ($update.available -eq $true) } catch { $hasUpdate = $false }
+
+  if ($hasUpdate) {
+    $latest = $update.latestVersion
+    $script:PendingUrl = [string]$update.url
+    $script:PendingSha = [string]$update.sha256
+    try {
+      $miUpdate.Text = "Update Stikfix (v$latest)"
+      $miUpdate.Visible = $true
+      $sepUpdate.Visible = $true
+    } catch { }
+    $tip = "$tip - update v$latest available"
+    if ($script:UpdateShown -eq $false) {
+      try {
+        $notify.ShowBalloonTip(5000, 'Stikfix update available', "Version $latest is ready. Right-click the tray icon then Update Stikfix.", [System.Windows.Forms.ToolTipIcon]::Info)
+      } catch { }
+      $script:UpdateShown = $true
+    }
+  } else {
+    try {
+      $miUpdate.Visible = $false
+      $sepUpdate.Visible = $false
+    } catch { }
+  }
+
+  Set-SafeText $tip
 }
 
 $timer = New-Object System.Windows.Forms.Timer

package/dist/host/src/update-check.js

@@ -0,0 +1,134 @@
+/**
+ * Host auto-update check for stikfix-host.
+ *
+ * The host periodically asks GitHub for the latest published release manifest
+ * (`latest.json`) and, if a newer version is available, advertises it on
+ * GET /status (`update.available` / `latestVersion` / `url` / `sha256`) so the
+ * system-tray helper can offer a one-click apply.
+ *
+ * Design mirrors the git-sync module singleton pattern (getLastGitSyncStatus):
+ * a module-level UpdateState is mutated by runUpdateCheck and read by
+ * getUpdateState. All network I/O is fully defensive — fetchLatestManifest and
+ * runUpdateCheck NEVER throw (a failed check must never crash the host).
+ *
+ * Node builtins only — uses the Node 20 global `fetch` (follows redirects),
+ * consistent with lib/discovery.ts. No new npm dependency.
+ */
+// ---------------------------------------------------------------------------
+// Semver compare (plain MAJOR.MINOR.PATCH, no external dep)
+// ---------------------------------------------------------------------------
+/**
+ * Compare two dotted-integer version strings.
+ *
+ * Each segment is parsed with parseInt so a non-numeric suffix (e.g. "1.7.0-rc1")
+ * contributes only its leading integer. Missing segments count as 0, so
+ * "1.7" === "1.7.0". A malformed/empty string parses every segment as 0.
+ *
+ * @returns -1 if a < b, 0 if equal, 1 if a > b.
+ */
+export function compareSemver(a, b) {
+    const parse = (v) => String(v ?? '')
+        .split('.')
+        .map((seg) => {
+        const n = parseInt(seg, 10);
+        return Number.isNaN(n) ? 0 : n;
+    });
+    const pa = parse(a);
+    const pb = parse(b);
+    const len = Math.max(pa.length, pb.length);
+    for (let i = 0; i < len; i++) {
+        const x = pa[i] ?? 0;
+        const y = pb[i] ?? 0;
+        if (x < y)
+            return -1;
+        if (x > y)
+            return 1;
+    }
+    return 0;
+}
+let updateState = {
+    available: false,
+    latestVersion: null,
+    url: null,
+    sha256: null,
+    checkedAt: 0,
+    error: null,
+};
+/** Read the most recent update-check result (for GET /status). */
+export function getUpdateState() {
+    return updateState;
+}
+/** Test-only: reset the module singleton back to its initial shape. */
+export function __resetUpdateStateForTests() {
+    updateState = {
+        available: false,
+        latestVersion: null,
+        url: null,
+        sha256: null,
+        checkedAt: 0,
+        error: null,
+    };
+}
+export const UPDATE_MANIFEST_URL = process.env.STIKFIX_UPDATE_MANIFEST_URL ||
+    'https://github.com/omernesh/stikfix/releases/latest/download/latest.json';
+/**
+ * GET the latest-release manifest and validate its shape.
+ *
+ * Returns null on any non-2xx, network error, JSON-parse error, or an invalid
+ * shape (missing/blank version|url, or a sha256 that is not 64 hex chars).
+ * NEVER throws — the caller treats null as "no usable manifest this time".
+ */
+export async function fetchLatestManifest(fetchImpl = fetch, url = UPDATE_MANIFEST_URL) {
+    try {
+        const resp = await fetchImpl(url, { signal: AbortSignal.timeout(8000) });
+        if (!resp.ok)
+            return null;
+        const data = (await resp.json());
+        if (!data || typeof data !== 'object')
+            return null;
+        const { version, url: dlUrl, sha256 } = data;
+        if (typeof version !== 'string' || version.length === 0 ||
+            typeof dlUrl !== 'string' || dlUrl.length === 0 ||
+            typeof sha256 !== 'string' || !/^[0-9a-f]{64}$/i.test(sha256)) {
+            return null;
+        }
+        return { version, url: dlUrl, sha256 };
+    }
+    catch {
+        return null;
+    }
+}
+// ---------------------------------------------------------------------------
+// runUpdateCheck — refresh the module state
+// ---------------------------------------------------------------------------
+/**
+ * Fetch the manifest, compare against the running version, and update the
+ * module-level UpdateState.
+ *
+ * On a failed fetch/parse: keep any prior successful result's
+ * available/latestVersion/url/sha256 fields, set error = 'update check failed',
+ * and do NOT bump checkedAt.
+ *
+ * On success: available = remote > current; latestVersion always set to the
+ * remote version; url/sha256 set only when an update is available; error null;
+ * checkedAt = now.
+ *
+ * Safe to call with no network (inject fetchImpl in tests). NEVER throws.
+ */
+export async function runUpdateCheck(currentVersion, fetchImpl = fetch) {
+    const manifest = await fetchLatestManifest(fetchImpl);
+    if (manifest === null) {
+        updateState = { ...updateState, error: 'update check failed' };
+        return updateState;
+    }
+    const avail = compareSemver(manifest.version, currentVersion) > 0;
+    updateState = {
+        available: avail,
+        latestVersion: manifest.version,
+        url: avail ? manifest.url : null,
+        sha256: avail ? manifest.sha256 : null,
+        checkedAt: Date.now(),
+        error: null,
+    };
+    return updateState;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stikfix",
-  "version": "1.6.2",
+  "version": "1.7.0",
   "description": "Pin sticky notes on any page — your AI reads them.",
   "license": "MIT",
   "author": "Omer Nesher <omernesher@gmail.com>",
@@ -53,6 +53,7 @@
     "check": "tsc --noEmit && tsc --noEmit -p tsconfig.host.json && node scripts/clean-room-check.mjs && node scripts/host-smoke-test.mjs && npm run test:lib && npm test",
     "pack:crx": "node scripts/pack-crx.mjs",
     "gen:update-xml": "node scripts/gen-update-xml.mjs",
+    "gen:latest-json": "node scripts/gen-latest-json.mjs",
     "build:sea": "node scripts/build-sea.mjs",
     "build:installer": "node scripts/build-installer.mjs",
     "postinstall": "node -e \"try{require.resolve('wxt');require('node:child_process').execSync('wxt prepare',{stdio:'inherit'})}catch(e){}\""