@andypai/agent-kanban 0.6.1 → 0.6.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@andypai/agent-kanban",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "description": "Agent-friendly kanban board CLI. Manage tasks via bash commands, parse structured JSON output.",
   "homepage": "https://github.com/abpai/agent-kanban#readme",
   "repository": {

package/src/__tests__/webhooks.test.ts

@@ -690,8 +690,8 @@ describe('Linear webhook', () => {
   })
 })
 
-describe('webhook fail-closed when secret is unset', () => {
-  test('Jira rejects unauthenticated webhooks when JIRA_WEBHOOK_SECRET is unset', async () => {
+describe('webhook open dev mode when secret is unset', () => {
+  test('Jira accepts webhooks when JIRA_WEBHOOK_SECRET is unset', async () => {
     const prev = process.env['JIRA_WEBHOOK_SECRET']
     delete process.env['JIRA_WEBHOOK_SECRET']
     try {
@@ -703,17 +703,33 @@ describe('webhook fail-closed when secret is unset', () => {
         apiToken: jiraConfig.apiToken,
       })
       const provider = new JiraProvider(db, jiraConfig, client)
-      const body = JSON.stringify({ webhookEvent: 'jira:issue_created', issue: { id: '1' } })
+      const body = JSON.stringify({
+        webhookEvent: 'jira:issue_created',
+        issue: {
+          id: '100',
+          key: 'ENG-100',
+          fields: {
+            summary: 'New issue',
+            status: { id: '1', name: 'To Do' },
+            issuetype: { id: '10000', name: 'Task' },
+            assignee: null,
+            labels: [],
+            comment: { total: 0 },
+            created: '2025-02-01T00:00:00.000Z',
+            updated: '2025-02-01T00:00:00.000Z',
+            project: { id: '1', key: 'ENG' },
+          },
+        },
+      })
       const result = await provider.handleWebhook({ headers: {}, rawBody: body })
-      expect(result.handled).toBe(false)
-      expect(result.unauthorized).toBe(true)
+      expect(result.unauthorized).not.toBe(true)
     } finally {
       if (prev === undefined) delete process.env['JIRA_WEBHOOK_SECRET']
       else process.env['JIRA_WEBHOOK_SECRET'] = prev
     }
   })
 
-  test('Linear rejects unauthenticated webhooks when LINEAR_WEBHOOK_SECRET is unset', async () => {
+  test('Linear accepts webhooks when LINEAR_WEBHOOK_SECRET is unset', async () => {
     const prev = process.env['LINEAR_WEBHOOK_SECRET']
     delete process.env['LINEAR_WEBHOOK_SECRET']
     try {
@@ -721,9 +737,9 @@ describe('webhook fail-closed when secret is unset', () => {
       seedLinear(db)
       const provider = new LinearProvider(db, 'tid', 'key')
       const body = JSON.stringify({ action: 'create', type: 'Issue', data: { id: 'i1' } })
-      const result = await provider.handleWebhook({ headers: {}, rawBody: body })
-      expect(result.handled).toBe(false)
-      expect(result.unauthorized).toBe(true)
+      // Auth passes; downstream may fail for other reasons (e.g. API credentials)
+      const result = await provider.handleWebhook({ headers: {}, rawBody: body }).catch(() => null)
+      expect(result?.unauthorized).not.toBe(true)
     } finally {
       if (prev === undefined) delete process.env['LINEAR_WEBHOOK_SECRET']
       else process.env['LINEAR_WEBHOOK_SECRET'] = prev

package/src/providers/jira-core.ts

@@ -855,6 +855,11 @@ export class JiraProviderCore implements KanbanProvider {
   // Shared webhook dispatch. Postgres wraps this with webhook-event auditing;
   // SQLite calls it directly via the default handleWebhook above.
   protected async handleWebhookCore(payload: WebhookRequest): Promise<WebhookResult> {
+    if (!process.env['JIRA_WEBHOOK_SECRET']) {
+      console.warn(
+        '[jira] JIRA_WEBHOOK_SECRET is not set — accepting webhook without signature verification (open dev mode)',
+      )
+    }
     const auth = authorizeWebhook({
       secret: process.env['JIRA_WEBHOOK_SECRET'],
       rawBody: payload.rawBody,

package/src/providers/linear-core.ts

@@ -579,6 +579,11 @@ export class LinearProviderCore implements KanbanProvider {
   // Shared webhook dispatch. Postgres wraps this with webhook-event auditing;
   // SQLite calls it directly via the default handleWebhook above.
   protected async handleWebhookCore(payload: WebhookRequest): Promise<WebhookResult> {
+    if (!process.env['LINEAR_WEBHOOK_SECRET']) {
+      console.warn(
+        '[linear] LINEAR_WEBHOOK_SECRET is not set — accepting webhook without signature verification (open dev mode)',
+      )
+    }
     const auth = authorizeWebhook({
       secret: process.env['LINEAR_WEBHOOK_SECRET'],
       rawBody: payload.rawBody,

package/src/webhooks.ts

@@ -13,10 +13,9 @@ export interface WebhookResult {
 }
 
 /**
- * Fail-closed webhook authorization. Returns a rejecting WebhookResult when the
- * secret is unset (so an anonymous caller can't inject cache writes) or when the
- * signature doesn't verify, and null when the request is authorized. Webhook
- * delivery therefore requires the provider secret to be configured.
+ * Webhook authorization. When secret is configured, verifies the HMAC signature
+ * and rejects on mismatch. When secret is unset, accepts all payloads (open dev
+ * mode — suitable when the provider webhook is not configured with a signing secret).
  */
 export function authorizeWebhook(opts: {
   secret: string | undefined
@@ -25,13 +24,7 @@ export function authorizeWebhook(opts: {
   verify: (secret: string, rawBody: string, signature: string | undefined | null) => boolean
 }): WebhookResult | null {
   const { secret, rawBody, signature, verify } = opts
-  if (!secret) {
-    return {
-      handled: false,
-      unauthorized: true,
-      message: 'Webhook secret not configured; rejecting unauthenticated webhook',
-    }
-  }
+  if (!secret) return null
   if (!verify(secret, rawBody, signature)) {
     return { handled: false, unauthorized: true, message: 'Invalid signature' }
   }