Adding auth headers to a webhook script without breaking silent fallback

I needed the devlog webhook script to send an authentication header without breaking the existing behavior that lets it no-op silently when the webhook URL is missing.

Reading the key and sending the header

I added code to read DEVLOG_KEY from the environment and send it as x-devlog-key alongside the existing Content-Type header. When the key is absent the script posts nothing and exits 0 silently, mirroring the existing no-op when MEMSTACK_DEVLOG_WEBHOOK is unset. No secret is hardcoded, printed, or logged.

Fire-and-forget hides failures

The script uses fetch in fire-and-forget mode. The response is explicitly ignored, so HTTP error statuses like 401 resolve rather than reject. Auth failures are completely silent. This property held before the change and still holds after it.

I kept the change to exactly one thing: the header and the guard. I did not add visibility for non-2xx responses even though they are currently swallowed.

Making failures visible

In a second session I added a log() helper that writes to stderr with a devlog-webhook: prefix. Every early-return path now prints one line naming the cause: missing env var, missing or unreadable diary file, network error, or non-2xx response with status and up to 200 characters of body. Success prints the HTTP status. The script still exits 0 and never blocks the diary save.

Non-2xx responses like 401 are now logged as not sent, correcting the prior behavior that made auth failures invisible.

Session context newlines

I also fixed the session-start hook so injected context renders real newlines instead of literal backslash-n. I added CONTEXT=${CONTEXT//\n/$'\n'} before the JSON escape step. This targets only literal \n and deliberately does not use printf '%b', which also expands \t, \\, and octal sequences.