@danypops/tickets 0.2.1 → 0.3.0

package/README.md

@@ -157,15 +157,54 @@ tickets auth status
 tickets auth logout github
 ```
 
+### GitHub: reuse an already-authenticated `gh` CLI session
+
+`tickets auth login --backend github --gh-cli [account]` skips the device
+flow (and the `GITHUB_OAUTH_CLIENT_ID` App registration it needs) entirely
+by reading `gh auth token` instead — never re-implement a vendor CLI's own
+auth, just consume its result via its own documented, stable interface.
+Works whether `gh` stores its token in the OS keyring or a legacy
+plaintext file. Omit `account` for `gh`'s current active account, or name
+one of `gh`'s own multiple authenticated accounts (`gh auth status` lists
+them) — pair with a distinct `--backend` name to register each as its own
+tickets backend:
+
+```bash
+tickets auth login --backend github-personal --gh-cli DanyPops
+tickets auth login --backend github-work --gh-cli work-account
+```
+
 A stored, still-fresh delegated token always takes precedence over a static
 config/env token for that backend. Tokens are written to
 `$XDG_STATE_HOME/tickets/oauth/<backend>.json`, mode `0600`, and are never
 printed by any command. **Restart the daemon** after logging in so it picks
 up the new credential — `buildRepositories()` runs once at daemon startup.
 
+### Optional: credentials via Enigma
+
+If an [Enigma](https://github.com/DanyPops/enigma) vault is running,
+tickets checks it first on every request, ahead of a stored delegated token
+and any static config/env token — a credential Enigma rotates is picked up
+on the very next call, no daemon restart needed. Purely additive: tickets
+works identically with no Enigma running at all.
+
+Register tickets as a scoped Enigma client (once), then pass the printed
+token to the daemon via `ENIGMA_CLIENT_TOKEN`:
+
+```bash
+enigma client add tickets --backends github,gitlab,jira
+# -> prints a token once; export it wherever the tickets daemon is started
+export ENIGMA_CLIENT_TOKEN=<printed token>
+```
+
+Without `ENIGMA_CLIENT_TOKEN`, tickets falls back to Enigma's shared
+admin-token file if one exists at `$XDG_STATE_HOME/enigma/token` — fine for
+a single-user machine where every local daemon is equally trusted, but a
+scoped client token is the least-privilege default.
+
 ## The `pi-tickets` extension
 
-Published as `@danypops/pi-tickets`. `../../extensions/pi-tickets/` (this repo's workspace member) registers a single `tickets` tool for
+Published as `@danypops/pi-tickets`. `../pi-tickets/` (this repo's workspace member) registers a single `tickets` tool for
 [pi](https://github.com/badlogic/pi) with one action per CLI command (`list`,
 `get`, `create`, `update`, `search`, `children`, `comments`, `comment_add`,
 `backends`, `ledger_search`, `ledger_stats`, `focus_set`, `focus_get`,
@@ -196,7 +235,7 @@ To use it, add it to pi's `settings.json`:
 ```
 
 Or, for local development against this monorepo, point at the workspace
-member directory instead: `{ "packages": ["/path/to/tickets/extensions/pi-tickets"] }`.
+member directory instead: `{ "packages": ["/path/to/tickets/packages/pi-tickets"] }`.
 
 ## Development
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danypops/tickets",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Unified CLI, daemon, and TypeScript library for issue tracking across GitHub, GitLab, and Jira.",
   "type": "module",
   "license": "MIT",
@@ -25,6 +25,7 @@
   },
   "dependencies": {
     "@danypops/daemon-kit": "^0.3.0",
+    "@danypops/enigma-client": "^0.3.0",
     "@gitbeaker/rest": "^43.8.0",
     "commander": "^12.1.0",
     "jira.js": "^5.4.0",

package/src/application/service.ts

@@ -23,12 +23,23 @@ export class NotSupportedError extends Error {
 }
 
 export class TicketService {
-  constructor(private readonly repos: Record<string, IssueRepository>) {}
+  constructor(private repos: Record<string, IssueRepository>) {}
 
   backends(): string[] {
     return Object.keys(this.repos);
   }
 
+  /**
+   * Swaps the live backend set atomically. A backend newly configured in
+   * Enigma (or removed) becomes usable on the next call without
+   * reconstructing the service or restarting the daemon -- see
+   * config.ts's createBackendRefreshTask, the maintenance task that calls
+   * this on a schedule.
+   */
+  setRepos(repos: Record<string, IssueRepository>): void {
+    this.repos = repos;
+  }
+
   private repo(backend: string): IssueRepository {
     const repo = this.repos[backend];
     if (!repo) throw new UnknownBackendError(backend, this.backends());

package/src/auth/gh-cli.ts

@@ -0,0 +1,46 @@
+/**
+ * Optional shortcut: reuse an already-authenticated `gh` CLI session instead
+ * of running tickets' own OAuth device flow. Never re-implement a vendor
+ * CLI's own auth, just delegate to it and consume the result.
+ *
+ * Deliberately shells out to `gh auth token` rather than reading gh's own
+ * credential storage directly: gh's default "secure storage" keeps the
+ * token in the OS keyring (Secret Service/libsecret on Linux, Keychain on
+ * macOS, Credential Manager on Windows) under an internal, undocumented
+ * schema -- not a published contract. `gh auth token` is gh's own
+ * documented, stable interface for exactly this scripting use case,
+ * abstracting over wherever the credential actually lives. The token never
+ * touches this process's own stdout/log output, only the returned string.
+ */
+export type GhCliTokenResult = { ok: true; token: string } | { ok: false; reason: string };
+
+export interface SpawnLike {
+	(command: string[]): { stdout: ReadableStream<Uint8Array> | number; exited: Promise<number> };
+}
+
+const defaultSpawn: SpawnLike = (command) => Bun.spawn(command, { stdout: "pipe" });
+
+/**
+ * Reads `gh auth token`'s output for the given account (gh's own `--user`
+ * flag; omit to use gh's currently active account). Never mints, never
+ * prompts, never falls back to a device flow itself.
+ */
+export async function readGhCliToken(user?: string, spawn: SpawnLike = defaultSpawn): Promise<GhCliTokenResult> {
+	const command = user ? ["gh", "auth", "token", "--user", user] : ["gh", "auth", "token"];
+	let proc: ReturnType<SpawnLike>;
+	try {
+		proc = spawn(command);
+	} catch {
+		return { ok: false, reason: "gh CLI not found -- install it (cli.github.com) or use a different login method" };
+	}
+	const [stdout, code] = await Promise.all([
+		proc.stdout instanceof ReadableStream ? new Response(proc.stdout).text() : Promise.resolve(""),
+		proc.exited,
+	]);
+	if (code !== 0) {
+		return { ok: false, reason: user ? `gh CLI has no authenticated account named "${user}" -- run \`gh auth login\` first` : "gh CLI is not authenticated -- run `gh auth login` first" };
+	}
+	const token = stdout.trim();
+	if (!token) return { ok: false, reason: "gh auth token returned no token" };
+	return { ok: true, token };
+}

package/src/cli/index.ts

@@ -11,6 +11,7 @@ import { parseStatus } from "../domain/issue.js";
 import { createTicketsClient, type TicketsRpcClient } from "../client/tickets-client.js";
 import { openUrl } from "../auth/browser.js";
 import { loginWithGitHubDeviceFlow } from "../auth/github-oauth.js";
+import { readGhCliToken } from "../auth/gh-cli.js";
 import { gitlabDeviceEndpoints, loginWithGitLabDeviceFlow } from "../auth/gitlab-oauth.js";
 import { loginWithJiraAuthorizationCode } from "../auth/jira-oauth.js";
 import { deleteToken, isTokenFresh, listStoredBackends, loadToken, saveToken } from "../auth/token-store.js";
@@ -305,12 +306,20 @@ auth
   .option("--client-secret <secret>", "OAuth client secret (Jira only — GitHub/GitLab device flow needs none)")
   .option("--url <baseUrl>", "self-managed GitLab URL (defaults to gitlab.com)")
   .option("--scope <scope>", "space-delimited OAuth scope override")
+  .option("--gh-cli [account]", "github only: reuse an already-authenticated gh CLI session instead of the device flow (omit value for gh's active account)")
   .action(async (opts) => {
     const type = opts.type ?? opts.backend;
     try {
+      if (type === "github" && opts.ghCli !== undefined) {
+        const result = await readGhCliToken(opts.ghCli === true ? undefined : opts.ghCli);
+        if (!result.ok) throw new Error(result.reason);
+        saveToken(opts.backend, { accessToken: result.token });
+        printJson({ backend: opts.backend, status: "authorized", via: "gh-cli", note: "restart the tickets daemon (or run `tickets daemon-status` after a fresh start) to pick up the new token" });
+        return;
+      }
       if (type === "github") {
         const clientId = opts.clientId ?? process.env.GITHUB_OAUTH_CLIENT_ID;
-        if (!clientId) throw new Error("--client-id or GITHUB_OAUTH_CLIENT_ID is required");
+        if (!clientId) throw new Error("--client-id or GITHUB_OAUTH_CLIENT_ID is required (or pass --gh-cli [account] to reuse an already-authenticated gh CLI session instead)");
         const token = await loginWithGitHubDeviceFlow({
           clientId,
           scope: opts.scope,

package/src/config/config.ts

@@ -7,12 +7,15 @@ import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { parse as parseYaml } from "yaml";
+import type { MaintenanceTask } from "@danypops/daemon-kit/daemon";
+import type { Logger } from "@danypops/daemon-kit/logging";
 import { GitHubRepository } from "../adapters/github.js";
 import { GitLabRepository } from "../adapters/gitlab.js";
 import { JiraRepository } from "../adapters/jira.js";
 import type { IssueRepository } from "../ports/repository.js";
+import type { TicketService } from "../application/service.js";
 import { isTokenFresh, loadToken } from "../auth/token-store.js";
-import { type TryEnigmaCredential, tryEnigmaCredential } from "../auth/enigma-source.js";
+import { type TryEnigmaCredential, tryEnigmaCredential } from "@danypops/enigma-client";
 
 export interface BackendConfig {
   /** Adapter type: "github" | "gitlab" | "jira". Falls back to the config key when omitted. */
@@ -59,7 +62,7 @@ function resolveToken(cfg: BackendConfig, env: NodeJS.ProcessEnv, envFallback: s
  * Resolution order, highest priority first: (1) a running Enigma vault, if
  * one happens to be configured for this backend — entirely optional, never a
  * hard dependency, and bounded so Tickets never waits long for it (see
- * auth/enigma-source.ts); (2) a locally stored, still-fresh delegated OAuth
+ * @danypops/enigma-client); (2) a locally stored, still-fresh delegated OAuth
  * token (see auth/token-store.ts, populated by `tickets auth login`); (3) a
  * static config/env PAT. (1) is additive to the pre-Enigma precedence this
  * project already followed for GitHub, GitLab, and Jira — see RESEARCH.md
@@ -74,7 +77,10 @@ export async function preferredAuth(
   envFallback: string,
   tryEnigma: TryEnigmaCredential = tryEnigmaCredential,
 ): Promise<{ token: string | undefined; oauth: boolean; extra?: Record<string, string> }> {
-  const fromEnigma = await tryEnigma(name, { env });
+  // ENIGMA_CLIENT_TOKEN is this daemon's own registered-client token (`enigma client add`) --
+  // Enigma's shared admin-token file is deliberately unreadable outside its own service
+  // account, so tickets must present its own scoped token to get anything back at all.
+  const fromEnigma = await tryEnigma(name, { env, token: env.ENIGMA_CLIENT_TOKEN });
   if (fromEnigma) return { token: fromEnigma.accessToken, oauth: true, extra: fromEnigma.extra };
 
   const stored = loadToken(name, { env });
@@ -118,6 +124,50 @@ export async function buildRepositories(
   return repos;
 }
 
+export type BuildRepositories = typeof buildRepositories;
+
+/**
+ * Re-runs buildRepositories on a schedule and swaps the result into a live
+ * TicketService via setRepos -- the counterpart to token-provider.ts's
+ * per-request freshness in Pipes, one level up: this refreshes which
+ * backends exist at all, not just an existing backend's token. A backend
+ * enigma login just made available becomes callable without a daemon
+ * restart; a removed one stops being offered. A failed refresh (Enigma
+ * unreachable, transient) keeps the previous backend set rather than
+ * wiping it out.
+ */
+export function createBackendRefreshTask(
+  service: TicketService,
+  config: Config,
+  buildRepos: BuildRepositories,
+  intervalMs: number,
+  logger?: Logger,
+): MaintenanceTask {
+  return {
+    name: "backend-refresh",
+    intervalMs,
+    run: async () => {
+      const before = new Set(service.backends());
+      let fresh: Record<string, IssueRepository>;
+      try {
+        fresh = await buildRepos(config);
+      } catch (error) {
+        logger?.warn("backend refresh failed, keeping previous backend set", {
+          error: error instanceof Error ? error.message : String(error),
+        });
+        return;
+      }
+      service.setRepos(fresh);
+      const after = new Set(Object.keys(fresh));
+      const added = [...after].filter((backend) => !before.has(backend));
+      const removed = [...before].filter((backend) => !after.has(backend));
+      if (added.length > 0 || removed.length > 0) {
+        logger?.info("backend set changed", { added, removed });
+      }
+    },
+  };
+}
+
 async function createRepository(
   name: string,
   type: string,

package/src/daemon/bootstrap.ts

@@ -11,7 +11,7 @@ import { ensureAuthToken, type PathEnvironment, resolveDaemonPaths } from "@dany
 import { checkpoint, openSqliteWithPragmas } from "@danypops/daemon-kit/storage";
 import type { StartDaemonOptions } from "@danypops/daemon-kit/daemon";
 import { TicketService } from "../application/service.js";
-import { buildRepositories, type Config, loadConfig } from "../config/config.js";
+import { buildRepositories, type BuildRepositories, type Config, createBackendRefreshTask, loadConfig } from "../config/config.js";
 import type { IssueRepository } from "../ports/repository.js";
 import { FOCUS_MIGRATIONS, FocusStore } from "./focus.js";
 import { Ledger, LEDGER_MIGRATIONS } from "./ledger.js";
@@ -22,12 +22,20 @@ import { createSyncTask } from "./poller.js";
 export interface BootstrapOptions {
   pathEnv?: PathEnvironment;
   config?: Config;
-  /** Injected directly in tests instead of building from config/env. */
+  /**
+   * Injected directly in tests instead of building from config/env. Also
+   * disables the live backend-refresh task -- an injected repo set is a
+   * fixed test fixture, not something to re-resolve from Enigma/config.
+   */
   repos?: Record<string, IssueRepository>;
+  /** Injected in tests to control which backends a refresh cycle resolves to, without a real Enigma/GitHub/GitLab/Jira. */
+  buildRepositories?: BuildRepositories;
   version?: string;
   logger?: Logger;
   syncIntervalMs?: number;
   checkpointIntervalMs?: number;
+  /** How often the live backend set re-resolves from config/env/Enigma. Ignored when repos is injected. */
+  backendRefreshIntervalMs?: number;
   /**
    * Overrides the daemon.shutdown op's effect. Defaults to sending this
    * process SIGTERM, which daemon-kit's runDaemonProcess already handles
@@ -47,6 +55,7 @@ export interface BootstrappedDaemon {
 
 const DEFAULT_SYNC_INTERVAL_MS = 5 * 60_000;
 const DEFAULT_CHECKPOINT_INTERVAL_MS = 10 * 60_000;
+const DEFAULT_BACKEND_REFRESH_INTERVAL_MS = 30_000;
 
 export async function bootstrap(opts: BootstrapOptions = {}): Promise<BootstrappedDaemon> {
   const paths = resolveDaemonPaths(TICKETS_DAEMON_NAMES, opts.pathEnv);
@@ -55,7 +64,9 @@ export async function bootstrap(opts: BootstrapOptions = {}): Promise<Bootstrapp
   const ledger = new Ledger(db);
   const focusStore = new FocusStore(db);
   const logger = opts.logger ?? createLogger("tickets-daemon", { levelEnvVar: "TICKETS_LOG_LEVEL" });
-  const repos = opts.repos ?? (await buildRepositories(opts.config ?? loadConfig()));
+  const config = opts.config ?? loadConfig();
+  const buildRepos = opts.buildRepositories ?? buildRepositories;
+  const repos = opts.repos ?? (await buildRepos(config));
   const service = new TicketService(repos);
   const version = opts.version ?? "0.0.0-dev";
 
@@ -64,12 +75,17 @@ export async function bootstrap(opts: BootstrapOptions = {}): Promise<Bootstrapp
     handlePath: paths.handle,
     logger,
     maintenanceTasks: [
-      createSyncTask(service, ledger, Object.keys(repos), opts.syncIntervalMs ?? DEFAULT_SYNC_INTERVAL_MS, logger),
+      createSyncTask(service, ledger, opts.syncIntervalMs ?? DEFAULT_SYNC_INTERVAL_MS, logger),
       {
         name: "checkpoint",
         intervalMs: opts.checkpointIntervalMs ?? DEFAULT_CHECKPOINT_INTERVAL_MS,
         run: () => checkpoint(db),
       },
+      // Only when repos came from real config/env/Enigma resolution -- an
+      // injected test fixture (opts.repos) has no config to re-resolve from.
+      ...(opts.repos === undefined
+        ? [createBackendRefreshTask(service, config, buildRepos, opts.backendRefreshIntervalMs ?? DEFAULT_BACKEND_REFRESH_INTERVAL_MS, logger)]
+        : []),
     ],
     buildApp: () =>
       buildApp({

package/src/daemon/ops.ts

@@ -1,6 +1,6 @@
 /**
  * The RPC protocol shared between the tickets daemon (server.ts, running under
- * Bun) and every client (cli/index.ts, extensions/pi-tickets, running under
+ * Bun) and every client (cli/index.ts, packages/pi-tickets, running under
  * whatever consumes this package). Pure types, zero runtime imports, safe to
  * import from either side without pulling in bun:sqlite or Bun.serve.
  */

package/src/daemon/poller.ts

@@ -35,10 +35,16 @@ export async function syncOnce(
   return results;
 }
 
+/**
+ * Reads the backend list fresh from service.backends() on every tick,
+ * rather than a list frozen at task-creation time -- a backend the
+ * refresh task (config.ts's createBackendRefreshTask) just added to the
+ * service is synced on this task's very next run, no daemon restart or
+ * task rebuild needed.
+ */
 export function createSyncTask(
   service: TicketService,
   ledger: Ledger,
-  backends: string[],
   intervalMs: number,
   logger?: Logger,
 ): MaintenanceTask {
@@ -46,7 +52,7 @@ export function createSyncTask(
     name: "ledger-sync",
     intervalMs,
     run: async () => {
-      await syncOnce(service, ledger, backends, logger);
+      await syncOnce(service, ledger, service.backends(), logger);
     },
   };
 }

package/src/auth/enigma-source.ts

@@ -1,65 +0,0 @@
-/**
- * Optional credential source: a running Enigma vault (github.com/DanyPops/enigma),
- * if one happens to be configured on this machine. Purely additive — Tickets
- * has never imported Enigma's package and never will; this talks to Enigma's
- * loopback HTTP API using only @danypops/daemon-kit, which Tickets already
- * depends on for its own daemon plumbing. Enigma's discovery contract is three
- * stable, documented constants (its state-directory name and its handle/token
- * filenames), not an import of Enigma's own source.
- *
- * Never creates Enigma's handle or token files — those are strictly Enigma's
- * own job on its first boot. A consumer that could mint them would be a real
- * security problem, not a convenience. Absence of either file means "Enigma
- * isn't running or isn't configured for this backend," not an error: every
- * failure path here resolves `undefined` rather than throwing, and the whole
- * attempt is time-bounded so a slow or hung Enigma can never stall Tickets'
- * own startup.
- */
-import { existsSync, readFileSync } from "node:fs";
-import { readDaemonHandle, resolveDaemonPaths } from "@danypops/daemon-kit/paths";
-import { createVaultClient, type RefreshableAccessToken } from "@danypops/daemon-kit/vault";
-
-const ENIGMA_STATE_DIRECTORY_NAME = "enigma";
-const ENIGMA_HANDLE_FILENAME = "handle.json";
-const ENIGMA_TOKEN_FILENAME = "token";
-const ENIGMA_LOOKUP_TIMEOUT_MS = 500;
-
-export interface TryEnigmaCredentialEnv {
-	env?: Record<string, string | undefined>;
-	/** Injectable for tests; production default is the real fetch, bounded by AbortSignal.timeout. */
-	fetchImpl?: typeof fetch;
-}
-
-export type TryEnigmaCredential = (backend: string, opts?: TryEnigmaCredentialEnv) => Promise<RefreshableAccessToken | undefined>;
-
-export const tryEnigmaCredential: TryEnigmaCredential = async (backend, opts = {}) => {
-	const env = opts.env ?? process.env;
-	const paths = resolveDaemonPaths(
-		{ stateDirectoryName: ENIGMA_STATE_DIRECTORY_NAME, handleFilename: ENIGMA_HANDLE_FILENAME, tokenFilename: ENIGMA_TOKEN_FILENAME, databaseFilename: "", systemdUnitName: "" },
-		{ env },
-	);
-
-	const handle = readDaemonHandle(paths.handle);
-	if (!handle) return undefined; // Enigma isn't running -- not an error, just not present
-
-	if (!existsSync(paths.token)) return undefined; // never ensureAuthToken here -- read-only, never mint Enigma's own token
-	let token: string;
-	try {
-		token = readFileSync(paths.token, "utf8").trim();
-	} catch {
-		return undefined;
-	}
-
-	const fetchImpl = opts.fetchImpl ?? fetch;
-	const client = createVaultClient({
-		baseUrl: `http://${handle.host}:${handle.port}`,
-		authToken: token,
-		fetchImpl: (url, init) => fetchImpl(url, { ...init, signal: AbortSignal.timeout(ENIGMA_LOOKUP_TIMEOUT_MS) }),
-	});
-
-	try {
-		return await client.getCredentials(backend);
-	} catch {
-		return undefined; // unreachable, timed out, or any other transport failure -- fall through silently
-	}
-};