@danypops/tickets 0.2.0 → 0.3.0

package/src/adapters/jira.ts

@@ -1,36 +1,52 @@
 /**
- * Jira adapter — driven implementation of IssueRepository/CommentCapable against the
- * Jira Cloud/Server REST API v2 (docs: https://developer.atlassian.com/cloud/jira/platform/rest/v2/).
+ * Jira adapter — driven implementation of IssueRepository/CommentCapable against
+ * the Jira Cloud REST API v2, via jira.js's Version2Client (github.com/MrRefactoring/jira.js)
+ * rather than a hand-rolled HTTP client: a mature, actively-maintained,
+ * TypeScript-native client generated directly from Atlassian's own OpenAPI spec.
  * Status changes go through Jira's workflow transitions, not a direct field PUT —
  * Jira statuses are workflow-owned, so we resolve the transition whose name matches
  * the mapped target status and post to it.
+ *
+ * NOTE: assignee is deliberately NOT handled in create()/update() here — out of
+ * scope for this migration per explicit user direction, even though the mature
+ * client's `UserDetails.accountId` typing would make the fix straightforward
+ * (see RESEARCH.md for the full analysis of the bug this leaves unfixed).
  */
+import { Version2Client } from "jira.js";
+import type { HttpException } from "jira.js";
+import type { AxiosAdapter } from "axios";
 import type { Comment, CreateInput, Issue, ListFilter, Status, UpdateInput } from "../domain/issue.js";
 import { parsePriority } from "../domain/issue.js";
-import { type FetchLike, HttpClient } from "./http.js";
+import { ApiError, IssueNotFoundError } from "./errors.js";
 
 /**
  * Basic-auth mode (email + API token) hits the tenant's own *.atlassian.net
  * domain directly. OAuth 2.0 (3LO) mode (accessToken + cloudId, see
  * auth/jira-oauth.ts) instead goes through api.atlassian.com/ex/jira/{cloudId}
  * with a Bearer token — Atlassian does not accept 3LO tokens against the
- * tenant domain directly. Exactly one of the two auth modes must be given.
+ * tenant domain directly; jira.js resolves that gateway routing itself when
+ * given `authentication.oauth2`. Exactly one of the two auth modes must be given.
  */
 export type JiraOptions = JiraBasicAuthOptions | JiraOAuthOptions;
 
+const DEFAULT_TIMEOUT_MS = 30_000;
+
 export interface JiraBasicAuthOptions {
   baseUrl: string;
   email: string;
   token: string;
   project?: string;
-  fetchImpl?: FetchLike;
+  timeoutMs?: number;
+  /** Injected in tests instead of a real network call — see axios's AxiosRequestConfig.adapter. */
+  axiosAdapter?: AxiosAdapter;
 }
 
 export interface JiraOAuthOptions {
   accessToken: string;
   cloudId: string;
   project?: string;
-  fetchImpl?: FetchLike;
+  timeoutMs?: number;
+  axiosAdapter?: AxiosAdapter;
 }
 
 function isOAuthOptions(opts: JiraOptions): opts is JiraOAuthOptions {
@@ -58,22 +74,26 @@ interface JiraIssue {
   self: string;
   fields: JiraIssueFields;
 }
-interface JiraTransition {
-  id: string;
-  name: string;
-}
 interface JiraComment {
-  id: string;
-  body: string;
-  created: string;
-  updated: string;
-  author?: { displayName: string };
+  id?: string;
+  comment?: string;
+  created?: string;
+  updated?: string;
+  author?: { displayName?: string };
+}
+interface JiraFieldDetails {
+  id?: string;
+  name?: string;
+  custom?: boolean;
+  schema?: { type: string; items?: string };
 }
 
 export class JiraRepository {
   readonly name: string;
-  private readonly http: HttpClient;
+  private readonly client: Version2Client;
   private readonly project?: string;
+  /** display name (lowercased) -> { fieldId, schema type/items }, populated lazily from client.issueFields.getFields(). */
+  private customFieldCache?: Map<string, { id: string; type: string; items?: string }>;
 
   constructor(name: string, opts: JiraOptions) {
     this.name = name;
@@ -81,23 +101,23 @@ export class JiraRepository {
 
     if (isOAuthOptions(opts)) {
       if (!opts.accessToken || !opts.cloudId) throw new Error("jira: accessToken and cloudId are required for OAuth mode");
-      this.http = new HttpClient({
-        baseUrl: `https://api.atlassian.com/ex/jira/${opts.cloudId}`,
-        backend: "jira",
-        fetchImpl: opts.fetchImpl,
-        headers: { Authorization: `Bearer ${opts.accessToken}` },
+      this.client = new Version2Client({
+        authentication: { oauth2: { accessToken: opts.accessToken, cloudId: opts.cloudId } },
+        // axios's own native, tested timeout handling -- a stalled call fails predictably
+        // instead of hanging (see RESEARCH.md for the octokit throttling-plugin hang this
+        // migration found and fixed; jira.js/axios has no equivalent auto-retry-and-wait
+        // behavior by default, but had no explicit timeout either until now).
+        baseRequestConfig: { timeout: opts.timeoutMs ?? DEFAULT_TIMEOUT_MS, ...(opts.axiosAdapter ? { adapter: opts.axiosAdapter } : {}) },
       });
       return;
     }
 
     if (!opts.baseUrl) throw new Error("jira: baseUrl is required");
     if (!opts.email || !opts.token) throw new Error("jira: email and token are required");
-    const basic = Buffer.from(`${opts.email}:${opts.token}`).toString("base64");
-    this.http = new HttpClient({
-      baseUrl: opts.baseUrl,
-      backend: "jira",
-      fetchImpl: opts.fetchImpl,
-      headers: { Authorization: `Basic ${basic}` },
+    this.client = new Version2Client({
+      host: opts.baseUrl,
+      authentication: { basic: { email: opts.email, apiToken: opts.token } },
+      baseRequestConfig: { timeout: opts.timeoutMs ?? DEFAULT_TIMEOUT_MS, ...(opts.axiosAdapter ? { adapter: opts.axiosAdapter } : {}) },
     });
   }
 
@@ -113,11 +133,25 @@ export class JiraRepository {
   }
 
   async get(key: string): Promise<Issue> {
-    const raw = await this.http.get<JiraIssue>(`/rest/api/2/issue/${key}`);
-    if (!raw) throw new Error(`jira: empty response for ${key}`);
+    const raw = await this.call<JiraIssue>(() => this.client.issues.getIssue({ issueIdOrKey: key }), key);
     return toDomain(raw);
   }
 
+  /** Runs a jira.js call and maps its HttpException onto this project's shared error taxonomy. */
+  private async call<T>(fn: () => Promise<unknown>, key?: string): Promise<T> {
+    try {
+      return (await fn()) as T;
+    } catch (err) {
+      const status = (err as Partial<HttpException>)?.status;
+      if (typeof status === "number") {
+        if (status === 404) throw new IssueNotFoundError("jira", key ?? "?");
+        const message = err instanceof Error ? err.message : String(err);
+        throw new ApiError("jira", "?", key ?? "?", status, redact(message));
+      }
+      throw err;
+    }
+  }
+
   async create(input: CreateInput): Promise<Issue> {
     const project = input.project ?? this.project;
     if (!project) throw new Error("jira: project is required (pass project or set a default)");
@@ -132,8 +166,8 @@ export class JiraRepository {
     if (input.priority && input.priority !== "none") {
       fields.priority = { name: mapPriorityToJira(input.priority) };
     }
-    const result = await this.http.post<{ key: string }>("/rest/api/2/issue", { fields });
-    if (!result) throw new Error("jira: create returned no body");
+    if (input.customFields) await this.applyCustomFields(fields, input.customFields);
+    const result = await this.call<{ key: string }>(() => this.client.issues.createIssue({ fields } as never));
     return this.get(result.key);
   }
 
@@ -143,8 +177,10 @@ export class JiraRepository {
     if (input.description !== undefined) fields.description = input.description;
     if (input.priority !== undefined) fields.priority = { name: mapPriorityToJira(input.priority) };
     if (input.labels !== undefined) fields.labels = input.labels;
+    if (input.customFields) await this.applyCustomFields(fields, input.customFields);
+    // assignee intentionally not handled here — see file header.
     if (Object.keys(fields).length > 0) {
-      await this.http.put(`/rest/api/2/issue/${key}`, { fields });
+      await this.call(() => this.client.issues.editIssue({ issueIdOrKey: key, fields }), key);
     }
     if (input.status !== undefined) {
       await this.transitionTo(key, input.status, input.resolution);
@@ -163,28 +199,33 @@ export class JiraRepository {
   }
 
   async listComments(key: string): Promise<Comment[]> {
-    const result = await this.http.get<{ comments: JiraComment[] }>(`/rest/api/2/issue/${key}/comment`);
+    const result = await this.call<{ comments?: JiraComment[] }>(
+      () => this.client.issueComments.getComments({ issueIdOrKey: key }),
+      key,
+    );
     return (result?.comments ?? []).map(commentToDomain);
   }
 
   async addComment(key: string, body: string): Promise<Comment> {
-    const raw = await this.http.post<JiraComment>(`/rest/api/2/issue/${key}/comment`, { body });
-    if (!raw) throw new Error("jira: add comment returned no body");
+    const raw = await this.call<JiraComment>(
+      () => this.client.issueComments.addComment({ issueIdOrKey: key, comment: body }),
+      key,
+    );
     return commentToDomain(raw);
   }
 
   private async searchJql(jql: string, limit: number): Promise<Issue[]> {
-    const result = await this.http.post<{ issues: JiraIssue[] }>("/rest/api/2/search", {
-      jql,
-      maxResults: limit,
-    });
+    const result = await this.call<{ issues?: JiraIssue[] }>(() =>
+      this.client.issueSearch.searchForIssuesUsingJqlPost({ jql, maxResults: limit }),
+    );
     return (result?.issues ?? []).map(toDomain);
   }
 
   private async transitionTo(key: string, status: Status, resolution?: string): Promise<void> {
     const target = mapStatusToJira(status);
-    const result = await this.http.get<{ transitions: JiraTransition[] }>(
-      `/rest/api/2/issue/${key}/transitions`,
+    const result = await this.call<{ transitions?: { id: string; name: string }[] }>(
+      () => this.client.issues.getTransitions({ issueIdOrKey: key }),
+      key,
     );
     const transitions = result?.transitions ?? [];
     const match = transitions.find((t) => t.name.toLowerCase() === target.toLowerCase());
@@ -192,10 +233,51 @@ export class JiraRepository {
       const available = transitions.map((t) => t.name).join(", ");
       throw new Error(`jira: no transition matching "${target}" (available: ${available})`);
     }
-    const body: Record<string, unknown> = { transition: { id: match.id } };
-    if (resolution) body.fields = { resolution: { name: resolution } };
-    await this.http.post(`/rest/api/2/issue/${key}/transitions`, body);
+    const fields = resolution ? { resolution: { name: resolution } } : undefined;
+    await this.call(() => this.client.issues.doTransition({ issueIdOrKey: key, transition: { id: match.id }, fields }), key);
+  }
+
+  /**
+   * Resolves each custom field's display name to its `customfield_XXXXX` ID via
+   * client.issueFields.getFields() (GET /rest/api/2/field) -- not a hand-maintained
+   * map -- and coerces the given string value to the shape that field's own Jira
+   * schema type expects (a plain "option"/select field wants `{value}`, an array
+   * field splits on commas, everything else passes through as a raw string).
+   */
+  private async applyCustomFields(fields: Record<string, unknown>, customFields: Record<string, string>): Promise<void> {
+    for (const [displayName, rawValue] of Object.entries(customFields)) {
+      const field = await this.resolveCustomField(displayName);
+      fields[field.id] = coerceCustomFieldValue(field, rawValue);
+    }
+  }
+
+  private async resolveCustomField(displayName: string): Promise<{ id: string; type: string; items?: string }> {
+    if (!this.customFieldCache) {
+      const all = await this.call<JiraFieldDetails[]>(() => this.client.issueFields.getFields());
+      this.customFieldCache = new Map(
+        all
+          .filter((f) => f.custom && f.id && f.name)
+          .map((f) => [f.name!.toLowerCase(), { id: f.id!, type: f.schema?.type ?? "string", items: f.schema?.items }]),
+      );
+    }
+    const field = this.customFieldCache.get(displayName.toLowerCase());
+    if (!field) throw new Error(`jira: unknown custom field "${displayName}"`);
+    return field;
+  }
+}
+
+function coerceCustomFieldValue(field: { type: string; items?: string }, rawValue: string): unknown {
+  if (field.type === "array") {
+    const parts = rawValue.split(",").map((v) => v.trim()).filter(Boolean);
+    return field.items === "option" ? parts.map((v) => ({ value: v })) : parts;
   }
+  if (field.type === "option") return { value: rawValue };
+  if (field.type === "number") return Number(rawValue);
+  return rawValue;
+}
+
+function redact(text: string): string {
+  return text.replace(/"(token|password|secret|api_key|authorization)"\s*:\s*"[^"]*"/gi, '"$1":"[redacted]"').slice(0, 2000);
 }
 
 function jqlQuote(value: string): string {
@@ -302,8 +384,8 @@ function toDomain(j: JiraIssue): Issue {
 
 function commentToDomain(c: JiraComment): Comment {
   return {
-    id: c.id,
-    body: c.body,
+    id: c.id ?? "",
+    body: c.comment ?? "",
     author: c.author?.displayName,
     createdAt: c.created,
     updatedAt: c.updated,

package/src/application/service.ts

@@ -23,12 +23,23 @@ export class NotSupportedError extends Error {
 }
 
 export class TicketService {
-  constructor(private readonly repos: Record<string, IssueRepository>) {}
+  constructor(private repos: Record<string, IssueRepository>) {}
 
   backends(): string[] {
     return Object.keys(this.repos);
   }
 
+  /**
+   * Swaps the live backend set atomically. A backend newly configured in
+   * Enigma (or removed) becomes usable on the next call without
+   * reconstructing the service or restarting the daemon -- see
+   * config.ts's createBackendRefreshTask, the maintenance task that calls
+   * this on a schedule.
+   */
+  setRepos(repos: Record<string, IssueRepository>): void {
+    this.repos = repos;
+  }
+
   private repo(backend: string): IssueRepository {
     const repo = this.repos[backend];
     if (!repo) throw new UnknownBackendError(backend, this.backends());

package/src/auth/gh-cli.ts

@@ -0,0 +1,46 @@
+/**
+ * Optional shortcut: reuse an already-authenticated `gh` CLI session instead
+ * of running tickets' own OAuth device flow. Never re-implement a vendor
+ * CLI's own auth, just delegate to it and consume the result.
+ *
+ * Deliberately shells out to `gh auth token` rather than reading gh's own
+ * credential storage directly: gh's default "secure storage" keeps the
+ * token in the OS keyring (Secret Service/libsecret on Linux, Keychain on
+ * macOS, Credential Manager on Windows) under an internal, undocumented
+ * schema -- not a published contract. `gh auth token` is gh's own
+ * documented, stable interface for exactly this scripting use case,
+ * abstracting over wherever the credential actually lives. The token never
+ * touches this process's own stdout/log output, only the returned string.
+ */
+export type GhCliTokenResult = { ok: true; token: string } | { ok: false; reason: string };
+
+export interface SpawnLike {
+	(command: string[]): { stdout: ReadableStream<Uint8Array> | number; exited: Promise<number> };
+}
+
+const defaultSpawn: SpawnLike = (command) => Bun.spawn(command, { stdout: "pipe" });
+
+/**
+ * Reads `gh auth token`'s output for the given account (gh's own `--user`
+ * flag; omit to use gh's currently active account). Never mints, never
+ * prompts, never falls back to a device flow itself.
+ */
+export async function readGhCliToken(user?: string, spawn: SpawnLike = defaultSpawn): Promise<GhCliTokenResult> {
+	const command = user ? ["gh", "auth", "token", "--user", user] : ["gh", "auth", "token"];
+	let proc: ReturnType<SpawnLike>;
+	try {
+		proc = spawn(command);
+	} catch {
+		return { ok: false, reason: "gh CLI not found -- install it (cli.github.com) or use a different login method" };
+	}
+	const [stdout, code] = await Promise.all([
+		proc.stdout instanceof ReadableStream ? new Response(proc.stdout).text() : Promise.resolve(""),
+		proc.exited,
+	]);
+	if (code !== 0) {
+		return { ok: false, reason: user ? `gh CLI has no authenticated account named "${user}" -- run \`gh auth login\` first` : "gh CLI is not authenticated -- run `gh auth login` first" };
+	}
+	const token = stdout.trim();
+	if (!token) return { ok: false, reason: "gh auth token returned no token" };
+	return { ok: true, token };
+}

package/src/cli/index.ts

@@ -11,6 +11,7 @@ import { parseStatus } from "../domain/issue.js";
 import { createTicketsClient, type TicketsRpcClient } from "../client/tickets-client.js";
 import { openUrl } from "../auth/browser.js";
 import { loginWithGitHubDeviceFlow } from "../auth/github-oauth.js";
+import { readGhCliToken } from "../auth/gh-cli.js";
 import { gitlabDeviceEndpoints, loginWithGitLabDeviceFlow } from "../auth/gitlab-oauth.js";
 import { loginWithJiraAuthorizationCode } from "../auth/jira-oauth.js";
 import { deleteToken, isTokenFresh, listStoredBackends, loadToken, saveToken } from "../auth/token-store.js";
@@ -305,12 +306,20 @@ auth
   .option("--client-secret <secret>", "OAuth client secret (Jira only — GitHub/GitLab device flow needs none)")
   .option("--url <baseUrl>", "self-managed GitLab URL (defaults to gitlab.com)")
   .option("--scope <scope>", "space-delimited OAuth scope override")
+  .option("--gh-cli [account]", "github only: reuse an already-authenticated gh CLI session instead of the device flow (omit value for gh's active account)")
   .action(async (opts) => {
     const type = opts.type ?? opts.backend;
     try {
+      if (type === "github" && opts.ghCli !== undefined) {
+        const result = await readGhCliToken(opts.ghCli === true ? undefined : opts.ghCli);
+        if (!result.ok) throw new Error(result.reason);
+        saveToken(opts.backend, { accessToken: result.token });
+        printJson({ backend: opts.backend, status: "authorized", via: "gh-cli", note: "restart the tickets daemon (or run `tickets daemon-status` after a fresh start) to pick up the new token" });
+        return;
+      }
       if (type === "github") {
         const clientId = opts.clientId ?? process.env.GITHUB_OAUTH_CLIENT_ID;
-        if (!clientId) throw new Error("--client-id or GITHUB_OAUTH_CLIENT_ID is required");
+        if (!clientId) throw new Error("--client-id or GITHUB_OAUTH_CLIENT_ID is required (or pass --gh-cli [account] to reuse an already-authenticated gh CLI session instead)");
         const token = await loginWithGitHubDeviceFlow({
           clientId,
           scope: opts.scope,

package/src/config/config.ts

@@ -7,11 +7,15 @@ import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { parse as parseYaml } from "yaml";
+import type { MaintenanceTask } from "@danypops/daemon-kit/daemon";
+import type { Logger } from "@danypops/daemon-kit/logging";
 import { GitHubRepository } from "../adapters/github.js";
 import { GitLabRepository } from "../adapters/gitlab.js";
 import { JiraRepository } from "../adapters/jira.js";
 import type { IssueRepository } from "../ports/repository.js";
+import type { TicketService } from "../application/service.js";
 import { isTokenFresh, loadToken } from "../auth/token-store.js";
+import { type TryEnigmaCredential, tryEnigmaCredential } from "@danypops/enigma-client";
 
 export interface BackendConfig {
   /** Adapter type: "github" | "gitlab" | "jira". Falls back to the config key when omitted. */
@@ -55,19 +59,30 @@ function resolveToken(cfg: BackendConfig, env: NodeJS.ProcessEnv, envFallback: s
 }
 
 /**
- * Prefers a locally stored, still-fresh delegated OAuth token (see auth/,
- * populated by `tickets auth login`) over a static config/env PAT, per the
- * general "delegated auth over static token" precedence this project follows
- * for GitHub, GitLab, and Jira — see RESEARCH.md for the auth flows each
- * backend actually supports (device flow for GitHub/GitLab, authorization
- * code for Jira, which has no device flow or PKCE).
+ * Resolution order, highest priority first: (1) a running Enigma vault, if
+ * one happens to be configured for this backend — entirely optional, never a
+ * hard dependency, and bounded so Tickets never waits long for it (see
+ * @danypops/enigma-client); (2) a locally stored, still-fresh delegated OAuth
+ * token (see auth/token-store.ts, populated by `tickets auth login`); (3) a
+ * static config/env PAT. (1) is additive to the pre-Enigma precedence this
+ * project already followed for GitHub, GitLab, and Jira — see RESEARCH.md
+ * for the auth flows each backend actually supports (device flow for
+ * GitHub/GitLab, authorization code for Jira, which has no device flow or
+ * PKCE).
  */
-function preferredAuth(
+export async function preferredAuth(
   name: string,
   cfg: BackendConfig,
   env: NodeJS.ProcessEnv,
   envFallback: string,
-): { token: string | undefined; oauth: boolean; extra?: Record<string, string> } {
+  tryEnigma: TryEnigmaCredential = tryEnigmaCredential,
+): Promise<{ token: string | undefined; oauth: boolean; extra?: Record<string, string> }> {
+  // ENIGMA_CLIENT_TOKEN is this daemon's own registered-client token (`enigma client add`) --
+  // Enigma's shared admin-token file is deliberately unreadable outside its own service
+  // account, so tickets must present its own scoped token to get anything back at all.
+  const fromEnigma = await tryEnigma(name, { env, token: env.ENIGMA_CLIENT_TOKEN });
+  if (fromEnigma) return { token: fromEnigma.accessToken, oauth: true, extra: fromEnigma.extra };
+
   const stored = loadToken(name, { env });
   if (stored && isTokenFresh(stored)) {
     return { token: stored.accessToken, oauth: true, extra: stored.extra };
@@ -80,45 +95,91 @@ function preferredAuth(
  * inferrable purely from environment variables when not present in the config file.
  * Config-file entries take precedence over bare env-var inference for the same name.
  */
-export function buildRepositories(
+export async function buildRepositories(
   config: Config,
   env: NodeJS.ProcessEnv = process.env,
-): Record<string, IssueRepository> {
+  tryEnigma: TryEnigmaCredential = tryEnigmaCredential,
+): Promise<Record<string, IssueRepository>> {
   const repos: Record<string, IssueRepository> = {};
 
   for (const [name, cfg] of Object.entries(config.backends)) {
     const type = cfg.type ?? name;
-    const repo = createRepository(name, type, cfg, env);
+    const repo = await createRepository(name, type, cfg, env, tryEnigma);
     if (repo) repos[name] = repo;
   }
 
   if (!repos.github && (env.GITHUB_OWNER || env.GITHUB_TOKEN)) {
-    const repo = createRepository("github", "github", {}, env);
+    const repo = await createRepository("github", "github", {}, env, tryEnigma);
     if (repo) repos.github = repo;
   }
   if (!repos.gitlab && (env.GITLAB_PROJECT || env.GITLAB_TOKEN)) {
-    const repo = createRepository("gitlab", "gitlab", {}, env);
+    const repo = await createRepository("gitlab", "gitlab", {}, env, tryEnigma);
     if (repo) repos.gitlab = repo;
   }
   if (!repos.jira && env.JIRA_URL) {
-    const repo = createRepository("jira", "jira", {}, env);
+    const repo = await createRepository("jira", "jira", {}, env, tryEnigma);
     if (repo) repos.jira = repo;
   }
 
   return repos;
 }
 
-function createRepository(
+export type BuildRepositories = typeof buildRepositories;
+
+/**
+ * Re-runs buildRepositories on a schedule and swaps the result into a live
+ * TicketService via setRepos -- the counterpart to token-provider.ts's
+ * per-request freshness in Pipes, one level up: this refreshes which
+ * backends exist at all, not just an existing backend's token. A backend
+ * enigma login just made available becomes callable without a daemon
+ * restart; a removed one stops being offered. A failed refresh (Enigma
+ * unreachable, transient) keeps the previous backend set rather than
+ * wiping it out.
+ */
+export function createBackendRefreshTask(
+  service: TicketService,
+  config: Config,
+  buildRepos: BuildRepositories,
+  intervalMs: number,
+  logger?: Logger,
+): MaintenanceTask {
+  return {
+    name: "backend-refresh",
+    intervalMs,
+    run: async () => {
+      const before = new Set(service.backends());
+      let fresh: Record<string, IssueRepository>;
+      try {
+        fresh = await buildRepos(config);
+      } catch (error) {
+        logger?.warn("backend refresh failed, keeping previous backend set", {
+          error: error instanceof Error ? error.message : String(error),
+        });
+        return;
+      }
+      service.setRepos(fresh);
+      const after = new Set(Object.keys(fresh));
+      const added = [...after].filter((backend) => !before.has(backend));
+      const removed = [...before].filter((backend) => !after.has(backend));
+      if (added.length > 0 || removed.length > 0) {
+        logger?.info("backend set changed", { added, removed });
+      }
+    },
+  };
+}
+
+async function createRepository(
   name: string,
   type: string,
   cfg: BackendConfig,
   env: NodeJS.ProcessEnv,
-): IssueRepository | undefined {
+  tryEnigma: TryEnigmaCredential,
+): Promise<IssueRepository | undefined> {
   switch (type) {
     case "github": {
       const owner = cfg.owner ?? env.GITHUB_OWNER;
       if (!owner) return undefined;
-      const auth = preferredAuth(name, cfg, env, "GITHUB_TOKEN");
+      const auth = await preferredAuth(name, cfg, env, "GITHUB_TOKEN", tryEnigma);
       return new GitHubRepository(name, {
         owner,
         repo: cfg.repo ?? env.GITHUB_REPO,
@@ -129,7 +190,7 @@ function createRepository(
     case "gitlab": {
       const project = cfg.project ?? env.GITLAB_PROJECT;
       if (!project) return undefined;
-      const auth = preferredAuth(name, cfg, env, "GITLAB_TOKEN");
+      const auth = await preferredAuth(name, cfg, env, "GITLAB_TOKEN", tryEnigma);
       return new GitLabRepository(name, {
         projectId: project,
         token: auth.token,
@@ -138,7 +199,7 @@ function createRepository(
       });
     }
     case "jira": {
-      const auth = preferredAuth(name, cfg, env, "JIRA_API_TOKEN");
+      const auth = await preferredAuth(name, cfg, env, "JIRA_API_TOKEN", tryEnigma);
       if (auth.oauth && auth.token && auth.extra?.cloudId) {
         return new JiraRepository(name, {
           accessToken: auth.token,

package/src/daemon/bootstrap.ts

@@ -11,7 +11,7 @@ import { ensureAuthToken, type PathEnvironment, resolveDaemonPaths } from "@dany
 import { checkpoint, openSqliteWithPragmas } from "@danypops/daemon-kit/storage";
 import type { StartDaemonOptions } from "@danypops/daemon-kit/daemon";
 import { TicketService } from "../application/service.js";
-import { buildRepositories, type Config, loadConfig } from "../config/config.js";
+import { buildRepositories, type BuildRepositories, type Config, createBackendRefreshTask, loadConfig } from "../config/config.js";
 import type { IssueRepository } from "../ports/repository.js";
 import { FOCUS_MIGRATIONS, FocusStore } from "./focus.js";
 import { Ledger, LEDGER_MIGRATIONS } from "./ledger.js";
@@ -22,12 +22,20 @@ import { createSyncTask } from "./poller.js";
 export interface BootstrapOptions {
   pathEnv?: PathEnvironment;
   config?: Config;
-  /** Injected directly in tests instead of building from config/env. */
+  /**
+   * Injected directly in tests instead of building from config/env. Also
+   * disables the live backend-refresh task -- an injected repo set is a
+   * fixed test fixture, not something to re-resolve from Enigma/config.
+   */
   repos?: Record<string, IssueRepository>;
+  /** Injected in tests to control which backends a refresh cycle resolves to, without a real Enigma/GitHub/GitLab/Jira. */
+  buildRepositories?: BuildRepositories;
   version?: string;
   logger?: Logger;
   syncIntervalMs?: number;
   checkpointIntervalMs?: number;
+  /** How often the live backend set re-resolves from config/env/Enigma. Ignored when repos is injected. */
+  backendRefreshIntervalMs?: number;
   /**
    * Overrides the daemon.shutdown op's effect. Defaults to sending this
    * process SIGTERM, which daemon-kit's runDaemonProcess already handles
@@ -47,15 +55,18 @@ export interface BootstrappedDaemon {
 
 const DEFAULT_SYNC_INTERVAL_MS = 5 * 60_000;
 const DEFAULT_CHECKPOINT_INTERVAL_MS = 10 * 60_000;
+const DEFAULT_BACKEND_REFRESH_INTERVAL_MS = 30_000;
 
-export function bootstrap(opts: BootstrapOptions = {}): BootstrappedDaemon {
+export async function bootstrap(opts: BootstrapOptions = {}): Promise<BootstrappedDaemon> {
   const paths = resolveDaemonPaths(TICKETS_DAEMON_NAMES, opts.pathEnv);
   const token = ensureAuthToken(paths.token, "Tickets");
   const db = openSqliteWithPragmas(paths.database, { migrations: [...LEDGER_MIGRATIONS, ...FOCUS_MIGRATIONS] });
   const ledger = new Ledger(db);
   const focusStore = new FocusStore(db);
   const logger = opts.logger ?? createLogger("tickets-daemon", { levelEnvVar: "TICKETS_LOG_LEVEL" });
-  const repos = opts.repos ?? buildRepositories(opts.config ?? loadConfig());
+  const config = opts.config ?? loadConfig();
+  const buildRepos = opts.buildRepositories ?? buildRepositories;
+  const repos = opts.repos ?? (await buildRepos(config));
   const service = new TicketService(repos);
   const version = opts.version ?? "0.0.0-dev";
 
@@ -64,12 +75,17 @@ export function bootstrap(opts: BootstrapOptions = {}): BootstrappedDaemon {
     handlePath: paths.handle,
     logger,
     maintenanceTasks: [
-      createSyncTask(service, ledger, Object.keys(repos), opts.syncIntervalMs ?? DEFAULT_SYNC_INTERVAL_MS, logger),
+      createSyncTask(service, ledger, opts.syncIntervalMs ?? DEFAULT_SYNC_INTERVAL_MS, logger),
       {
         name: "checkpoint",
         intervalMs: opts.checkpointIntervalMs ?? DEFAULT_CHECKPOINT_INTERVAL_MS,
         run: () => checkpoint(db),
       },
+      // Only when repos came from real config/env/Enigma resolution -- an
+      // injected test fixture (opts.repos) has no config to re-resolve from.
+      ...(opts.repos === undefined
+        ? [createBackendRefreshTask(service, config, buildRepos, opts.backendRefreshIntervalMs ?? DEFAULT_BACKEND_REFRESH_INTERVAL_MS, logger)]
+        : []),
     ],
     buildApp: () =>
       buildApp({

package/src/daemon/main.ts

@@ -10,7 +10,7 @@ import { readPackageVersion } from "@danypops/daemon-kit/version";
 import { bootstrap } from "./bootstrap.js";
 
 const version = readPackageVersion(new URL("../../package.json", import.meta.url), "Tickets");
-const { options } = bootstrap({ version });
+const { options } = await bootstrap({ version });
 
 runDaemonProcess({
   ...options,

package/src/daemon/ops.ts

@@ -1,6 +1,6 @@
 /**
  * The RPC protocol shared between the tickets daemon (server.ts, running under
- * Bun) and every client (cli/index.ts, extensions/pi-tickets, running under
+ * Bun) and every client (cli/index.ts, packages/pi-tickets, running under
  * whatever consumes this package). Pure types, zero runtime imports, safe to
  * import from either side without pulling in bun:sqlite or Bun.serve.
  */