@kendoo.agentdesk/agentdesk 0.17.6 → 0.18.1

package/CHANGELOG.md

@@ -8,6 +8,22 @@ All user-facing changes to AgentDesk. Each entry is tagged:
 
 Internal refactors, infrastructure changes, and architectural notes are not listed here.
 
+## [0.18.1] — 2026-04-18
+
+### Fixed
+- `[CLI]` Jira permission check now trims a trailing slash from the stored base URL (a leftover double-slash could produce a spurious 404) and falls back to REST API v2 if v3 isn't exposed. The error message now includes the exact URL called so misconfigs are easier to diagnose.
+
+## [0.18.0] — 2026-04-18
+
+### Changed
+- `[CLI]` `agentdesk init` redesigned:
+  - Tracker first, then its location, then auth, then verify, then pick a project from a list fetched from the tracker API (Linear teams, Jira projects). No more asking for a project key before you've told the wizard what tracker you're using.
+  - Every credential step prints exact steps: the URL to open, the button to click, the label to use, the scopes to pick.
+  - Always asks for GitHub repo, account handle, and token — even when the tracker is Linear, Jira, or None. Agents push code via GitHub; this is no longer left to luck or a global `gh auth`.
+  - Always asks for an identity badge (optional display name).
+  - The agentdesk project key is asked last, defaulting to the tracker's project key so you don't type it twice.
+  - Verifies the GitHub token matches the account handle you typed. Warns on mismatch.
+
 ## [0.17.6] — 2026-04-18
 
 ### Fixed

package/cli/config.mjs

@@ -16,7 +16,7 @@ const DEFAULTS = {
   tracker: null,
   linear: { teamKey: null, workspace: null },
   jira: { baseUrl: null, project: null },
-  github: { repo: null },
+  github: { repo: null, login: null },
   team: null,
   commands: { test: null, build: null, lint: null },
   projectAgents: [],

package/cli/init.mjs

@@ -155,6 +155,131 @@ async function fetchServerCreds(apiKey, projectKey) {
   return {};
 }
 
+// Render a numbered-step box of instructions with exact URLs and button names.
+function printSteps(title, steps) {
+  const pad = "  ";
+  console.log(`${pad}${title}`);
+  console.log(`${pad}${"─".repeat(title.length)}`);
+  for (let i = 0; i < steps.length; i++) {
+    console.log(`${pad}  ${i + 1}. ${steps[i]}`);
+  }
+  console.log("");
+}
+
+// Try to detect the current git remote (origin) and parse owner/repo from
+// known GitHub URL forms. Returns "owner/repo" or null. Used as a default
+// suggestion in the GitHub step.
+function detectGitRemote(dir) {
+  try {
+    const url = execSync("git remote get-url origin", { cwd: dir, stdio: ["ignore", "pipe", "ignore"], encoding: "utf-8" }).trim();
+    let m = url.match(/github\.com[:/]([^/]+)\/([^/.]+?)(?:\.git)?$/);
+    if (m) return `${m[1]}/${m[2]}`;
+  } catch {}
+  return null;
+}
+
+// Fetch the set of "things to pick from" per tracker once the auth has been
+// verified. For Linear this is teams; Jira is projects; GitHub Issues is
+// repos (filtered to ones the token can access). Returns an array of
+// { id, name, raw } or null if listing failed — caller falls back to a
+// manual prompt.
+async function listTrackerProjects({ tracker, creds, location }) {
+  if (tracker === "linear") {
+    if (!creds.LINEAR_API_KEY) return null;
+    try {
+      const res = await fetch("https://api.linear.app/graphql", {
+        method: "POST",
+        headers: { Authorization: creds.LINEAR_API_KEY, "Content-Type": "application/json" },
+        body: JSON.stringify({ query: "{ teams(first: 50) { nodes { id key name } } }" }),
+        signal: AbortSignal.timeout(8000),
+      });
+      if (!res.ok) return null;
+      const data = await res.json();
+      const nodes = data?.data?.teams?.nodes || [];
+      return nodes.map(t => ({ id: t.key, name: `${t.name} (${t.key})`, raw: t }));
+    } catch { return null; }
+  }
+  if (tracker === "jira") {
+    if (!creds.JIRA_EMAIL || !creds.JIRA_API_TOKEN || !location) return null;
+    try {
+      const auth = "Basic " + Buffer.from(`${creds.JIRA_EMAIL}:${creds.JIRA_API_TOKEN}`).toString("base64");
+      const res = await fetch(`${location.replace(/\/+$/, "")}/rest/api/3/project/search?maxResults=50`, {
+        headers: { Authorization: auth, Accept: "application/json" },
+        signal: AbortSignal.timeout(8000),
+      });
+      if (!res.ok) return null;
+      const data = await res.json();
+      const values = data?.values || [];
+      return values.map(p => ({ id: p.key, name: `${p.name} (${p.key})`, raw: p }));
+    } catch { return null; }
+  }
+  if (tracker === "github") {
+    // GitHub has potentially thousands of repos; don't try to list — rely on
+    // the explicit repo prompt (which has a git-remote default anyway).
+    return null;
+  }
+  return null;
+}
+
+async function pickFromList(rl, prompt, items, { allowManual = true } = {}) {
+  const options = items.map(it => ({ label: it.name, value: it.id }));
+  if (allowManual) options.push({ label: "Type it manually instead", value: "__manual__" });
+  const choice = await selectOption(rl, prompt, options);
+  if (choice.value === "__manual__") return null;
+  return choice.value;
+}
+
+// Prompt for a value, showing instructions first, looping until non-empty.
+async function promptRequired(rl, label, instructions) {
+  if (instructions) printSteps(instructions.title, instructions.steps);
+  while (true) {
+    const v = (await ask(rl, `  ${label}: `)).trim();
+    if (v) return v;
+    console.log(`  ${label} is required. Ctrl+C to abort.`);
+  }
+}
+
+// Verify tracker auth with what we have in .env + server, then fetch
+// available teams/projects and let the user pick from a list.
+async function verifyAndPickTrackerProject({ rl, cwd, finalProjectKey, tracker, config, location }) {
+  console.log("  Verifying tracker access...");
+  const dotEnv = loadDotEnv(cwd);
+  const apiKey = loadApiKey(cwd);
+  const serverCreds = await fetchServerCreds(apiKey, finalProjectKey);
+  const credentials = resolveCredentialsFromEnv({ ...dotEnv, ...serverCreds });
+  const check = await checkTrackerPermissions({ tracker, config, credentials });
+  if (!check.ok) {
+    console.log("  ⚠  " + (check.errors[0] || "Verification failed"));
+    for (const e of check.errors.slice(1)) console.log(`     • ${e}`);
+    console.log("");
+    return { ok: false };
+  }
+  console.log("  ✓ Tracker access verified");
+  printIdentityEcho(check.identity);
+  console.log("");
+
+  // GitHub Issues — project = repo, already collected above. Skip the pick.
+  if (tracker === "github") return { ok: true, trackerProjectId: null };
+
+  // Fetch selectable items (Linear teams / Jira projects) and let user pick.
+  const items = await listTrackerProjects({ tracker, creds: credentials, location });
+  if (!items || items.length === 0) {
+    console.log("  Couldn't list projects automatically — type the key manually.");
+    const label = tracker === "linear" ? "Linear team key (e.g. KEN)" : "Jira project key (e.g. PROJ)";
+    const manual = await promptRequired(rl, label);
+    console.log("");
+    return { ok: true, trackerProjectId: manual };
+  }
+  console.log("");
+  const picked = await pickFromList(rl, `Pick the ${tracker === "linear" ? "team" : "project"} this agentdesk project maps to:`, items);
+  console.log("");
+  if (picked) return { ok: true, trackerProjectId: picked };
+  const label = tracker === "linear" ? "Linear team key" : "Jira project key";
+  const manual = await promptRequired(rl, label);
+  console.log("");
+  return { ok: true, trackerProjectId: manual };
+}
+
 export async function runInit(cwd, opts = {}) {
   const quick = !!opts.quick;
   const project = detectProject(cwd);
@@ -201,21 +326,14 @@ export async function runInit(cwd, opts = {}) {
   if (project.lintCommand) console.log(`  Lint:         ${project.lintCommand}`);
   if (project.testCommand || project.buildCommand || project.lintCommand) console.log("");
 
-  // --- Step 1: Project key ---
-  const defaultKey = existingConfig.projectKey || projectId;
-  let finalProjectKey;
-  if (editScope === "tracker") {
-    finalProjectKey = defaultKey;
-  } else {
-    console.log("  Step 1 of 4 — Project key");
-    console.log("");
-    const keyAnswer = await ask(rl, `  Project key (${defaultKey}): `);
-    finalProjectKey = keyAnswer.trim() || defaultKey;
-    console.log("");
-  }
+  // --- Tracker step: platform → location → auth → verify → pick project ---
+  const config = {};
+  // Initial default for the agentdesk project key. Gets overwritten with the
+  // tracker's project/team key if we learn one during verification, and the
+  // user can override at the final review screen.
+  let finalProjectKey = existingConfig.projectKey || projectId;
 
-  // --- Step 2: Tracker selection (platform first) ---
-  if (!quick) console.log(editScope === "tracker" ? "  Tracker setup" : "  Step 2 of 4 — Task tracker");
+  if (!quick) console.log(editScope === "tracker" ? "  Tracker" : "  Step 1 of 3 — Task tracker");
   console.log("");
   const trackerOptions = [
     { label: "Linear", value: "linear" },
@@ -223,269 +341,144 @@ export async function runInit(cwd, opts = {}) {
     { label: "GitHub Issues", value: "github" },
     { label: "None (use descriptions only)", value: null },
   ];
-
-  const selected = await selectOption(rl, "Task tracker:", trackerOptions);
-  const tracker = selected.value;
+  const tracker = (await selectOption(rl, "Task tracker:", trackerOptions)).value;
   console.log("");
-
-  // Inline guidance: dedicated-user vs personal, only when a tracker is picked.
-  printDedicatedUserChoice(tracker, quick);
-
-  // --- Step 2: Tracker configuration (details + credentials) ---
-  const config = {};
   if (tracker) config.tracker = tracker;
 
+  if (tracker) printDedicatedUserChoice(tracker, quick);
+
+  // Tracker location + auth with exact instructions, then verify.
   if (tracker === "linear") {
-    const currentWs = existingConfig.linear?.workspace || "";
-    const wsAnswer = await ask(rl, `  Linear workspace slug${currentWs ? ` (${currentWs})` : ""}: `);
-    const ws = wsAnswer.trim() || currentWs;
-    const currentTeamKey = existingConfig.linear?.teamKey || "";
-    const tkAnswer = await ask(rl, `  Linear team key${currentTeamKey ? ` (${currentTeamKey})` : ""} (e.g. KEN): `);
-    const teamKey = tkAnswer.trim() || currentTeamKey;
-    if (ws || teamKey) config.linear = { ...(ws && { workspace: ws }), ...(teamKey && { teamKey }) };
+    if (!quick) printSteps("Create a Linear API key", [
+      "Open https://linear.app/settings/api in your browser (log in first if needed).",
+      "Click \"Create key\" (top right of the API page).",
+      "Label the key: AgentDesk",
+      "Expiration: set a value matching your policy, or choose \"No expiration\".",
+      "Click \"Create\". Copy the key shown (starts with lin_api_). You will NOT see it again.",
+    ]);
+    const ws = await promptRequired(rl, "Linear workspace slug (the 'kendoo' in linear.app/kendoo)");
+    const key = await promptRequired(rl, "Linear API key you just copied");
+    saveEnvVar(cwd, "LINEAR_API_KEY", key);
+    console.log("  ✓ Saved LINEAR_API_KEY to .env");
     console.log("");
+    config.linear = { workspace: ws };
   }
 
   if (tracker === "jira") {
-    const currentUrl = existingConfig.jira?.baseUrl || "";
-    const urlAnswer = await ask(rl, `  Jira base URL${currentUrl ? ` (${currentUrl})` : ""}: `);
-    const url = urlAnswer.trim() || currentUrl;
-    const currentProj = existingConfig.jira?.project || "";
-    const projAnswer = await ask(rl, `  Jira project key${currentProj ? ` (${currentProj})` : ""} (e.g. PROJ): `);
-    const proj = projAnswer.trim() || currentProj;
-    if (url || proj) config.jira = { ...(url && { baseUrl: url }), ...(proj && { project: proj }) };
+    if (!quick) printSteps("Create a Jira API token", [
+      "Open https://id.atlassian.com/manage-profile/security/api-tokens",
+      "Click \"Create API token\".",
+      "Label: AgentDesk",
+      "Click \"Create\". Copy the token (shown once).",
+      "You'll also need the email you sign into Atlassian with.",
+    ]);
+    const baseUrl = await promptRequired(rl, "Jira tenant URL (e.g. https://yourco.atlassian.net)");
+    const email = await promptRequired(rl, "Your Atlassian login email");
+    const token = await promptRequired(rl, "Jira API token you just created");
+    saveEnvVar(cwd, "JIRA_EMAIL", email);
+    saveEnvVar(cwd, "JIRA_API_TOKEN", token);
+    console.log("  ✓ Saved JIRA_EMAIL and JIRA_API_TOKEN to .env");
     console.log("");
+    config.jira = { baseUrl: baseUrl.replace(/\/+$/, "") };
   }
 
-  let skipGithubVerify = false;
   if (tracker === "github") {
-    const current = existingConfig.github?.repo || "";
-    const answer = await ask(rl, `  GitHub repo${current ? ` (${current})` : ""} (owner/repo): `);
-    const r = answer.trim() || current;
-    if (r) config.github = { repo: r };
-    console.log("");
-
-    // Ask which identity to use for this project, regardless of whether
-    // `gh auth` is already set up globally. Without this prompt the wizard
-    // silently reuses whichever account the user last ran `gh auth login`
-    // with, which is surprising on a machine with multiple GitHub identities.
-    let ghLogin = null;
-    try {
-      const out = execSync("gh api user --jq .login", { stdio: ["ignore", "pipe", "ignore"], encoding: "utf-8" }).trim();
-      if (out) ghLogin = out;
-    } catch {}
-    const ghOptionLabel = ghLogin
-      ? `Use gh CLI — currently authenticated as @${ghLogin}`
-      : `Use gh CLI — you'll run 'gh auth login' after this wizard`;
-    const authChoice = await selectOption(rl, "GitHub authentication for this project:", [
-      { label: ghOptionLabel, value: "gh" },
-      { label: "Paste a personal access token (use a different account)", value: "pat" },
-      { label: "Skip — configure later in the dashboard", value: "skip" },
+    // The GitHub-issues credential doubles as the git-push credential below,
+    // so we collect a full repo/login/token block up front.
+    if (!quick) printSteps("Create a GitHub personal access token", [
+      "Open https://github.com/settings/tokens (classic tokens).",
+      "Click \"Generate new token\" → \"Generate new token (classic)\".",
+      "Name: AgentDesk",
+      "Expiration: match your policy.",
+      "Scopes: check \"repo\" (full control of private repositories).",
+      "Click \"Generate token\" at the bottom. Copy the token (shown once).",
     ]);
+    const detected = detectGitRemote(cwd);
+    const repoDefault = existingConfig.github?.repo || detected || "";
+    const repo = (await ask(rl, `  GitHub repo (owner/repo)${repoDefault ? ` [${repoDefault}]` : ""}: `)).trim() || repoDefault;
+    const loginDefault = existingConfig.github?.login || "";
+    const login = (await ask(rl, `  GitHub username (the @handle that owns the token)${loginDefault ? ` [${loginDefault}]` : ""}: `)).trim() || loginDefault;
+    const token = await promptRequired(rl, "GitHub token");
+    saveEnvVar(cwd, "GITHUB_TOKEN", token);
+    console.log("  ✓ Saved GITHUB_TOKEN to .env");
     console.log("");
+    config.github = { repo, login };
+  }
 
-    if (authChoice.value === "skip") {
-      skipGithubVerify = true;
-      console.log("  Skipping verification. Configure GitHub auth later via the dashboard or re-run `agentdesk init`.");
+  // Verify tracker + fetch available projects to pick from.
+  let trackerLocation = null;
+  if (tracker === "jira") trackerLocation = config.jira?.baseUrl;
+  if (tracker) {
+    const verified = await verifyAndPickTrackerProject({ rl, cwd, finalProjectKey, tracker, config, location: trackerLocation });
+    if (!verified.ok) {
+      console.log("  Continuing without tracker verification.");
+      console.log("  You can re-run `agentdesk init` after fixing credentials.");
       console.log("");
-    } else if (authChoice.value === "pat") {
-      if (!quick) {
-        console.log("  Create a token:");
-        console.log("    1. Open https://github.com/settings/tokens");
-        console.log("    2. Click \"Generate new token (classic)\"");
-        console.log("    3. Name: AgentDesk. Scope: repo. Click Generate.");
-        console.log("    4. Copy the token and paste below.");
-        console.log("");
-      }
-      while (true) {
-        const tokenInput = (await ask(rl, "  GitHub token: ")).trim();
-        if (!tokenInput) {
-          console.log("  Token is required. Press Ctrl+C to abort.");
-          continue;
-        }
-        saveEnvVar(cwd, "GITHUB_TOKEN", tokenInput);
-        console.log("  ✓ Saved to .env (as GITHUB_TOKEN). This overrides any global gh CLI auth for this project.");
-        console.log("");
-        break;
-      }
+    } else if (verified.trackerProjectId) {
+      if (tracker === "linear") config.linear = { ...(config.linear || {}), teamKey: verified.trackerProjectId };
+      if (tracker === "jira") config.jira = { ...(config.jira || {}), project: verified.trackerProjectId };
+      // Use the tracker's project key as the default agentdesk project key.
+      if (!existingConfig.projectKey) finalProjectKey = verified.trackerProjectId.toLowerCase();
     }
   }
 
-  // --- Step 3: Verify tracker permissions (with re-prompt on failure) ---
-  if (tracker && !skipGithubVerify) {
-    let verified = false;
-    while (!verified) {
-      console.log("  Checking tracker permissions...");
-      const dotEnv = loadDotEnv(cwd);
-      const apiKey = loadApiKey(cwd);
-      const serverCreds = await fetchServerCreds(apiKey, finalProjectKey);
-      const credentials = resolveCredentialsFromEnv({ ...dotEnv, ...serverCreds });
-      const check = await checkTrackerPermissions({ tracker, config, credentials });
-
-      if (check.ok) {
-        console.log("  ✓ Tracker permissions verified (read, create, update)");
-        printIdentityEcho(check.identity);
-        console.log("");
-        verified = true;
-      } else {
-        console.log("");
-        console.log("  ⚠  Tracker permission issues:");
-        for (const err of check.errors) {
-          console.log(`     • ${err}`);
-        }
-        console.log("");
-
-        // Determine what's missing and offer to fix it
-        const missingCreds = check.errors.some(e =>
-          e.includes("Missing") && (e.includes("API_KEY") || e.includes("TOKEN") || e.includes("EMAIL"))
-        );
-
-        if (missingCreds) {
-          console.log("  Let's fix this now. I'll walk you through it.");
-          console.log("");
-
-          if (tracker === "linear") {
-            console.log("  ┌─────────────────────────────────────────────┐");
-            console.log("  │  How to get your Linear API key:            │");
-            console.log("  │                                             │");
-            console.log("  │  1. Open https://linear.app/settings/api    │");
-            console.log("  │  2. Click \"Create new API key\"              │");
-            console.log("  │  3. Give it a label (e.g. \"AgentDesk\")      │");
-            console.log("  │  4. Copy the key                            │");
-            console.log("  │  5. Paste it below                          │");
-            console.log("  └─────────────────────────────────────────────┘");
-            console.log("");
-
-            while (true) {
-              const keyInput = await ask(rl, "  Linear API key: ");
-              const key = keyInput.trim();
-              if (!key) {
-                console.log("  The API key is required for the agents to read and update your Linear tasks.");
-                console.log("");
-                continue;
-              }
-              saveEnvVar(cwd, "LINEAR_API_KEY", key);
-              console.log("  ✓ Saved to .env");
-              console.log("");
-              break;
-            }
-            continue; // Re-check with the new key
-          }
-
-          if (tracker === "jira") {
-            console.log("  ┌──────────────────────────────────────────────────────────┐");
-            console.log("  │  How to get your Jira API token:                         │");
-            console.log("  │                                                          │");
-            console.log("  │  1. Open https://id.atlassian.com/manage-profile/        │");
-            console.log("  │         security/api-tokens                              │");
-            console.log("  │  2. Click \"Create API token\"                              │");
-            console.log("  │  3. Give it a label (e.g. \"AgentDesk\")                    │");
-            console.log("  │  4. Copy the token                                       │");
-            console.log("  │                                                          │");
-            console.log("  │  You'll also need the email address you use               │");
-            console.log("  │  to log into Jira (not your username).                    │");
-            console.log("  └──────────────────────────────────────────────────────────┘");
-            console.log("");
-
-            if (!credentials.JIRA_EMAIL) {
-              while (true) {
-                const emailInput = (await ask(rl, "  Your Jira email address: ")).trim();
-                if (!emailInput || !emailInput.includes("@")) {
-                  console.log("  Please enter a valid email address (the one you use to log into Jira).");
-                  continue;
-                }
-                saveEnvVar(cwd, "JIRA_EMAIL", emailInput);
-                console.log("  ✓ Email saved");
-                break;
-              }
-            }
-
-            while (true) {
-              const tokenInput = (await ask(rl, "  Jira API token: ")).trim();
-              if (!tokenInput) {
-                console.log("  The API token is required for the agents to read and update your Jira tasks.");
-                console.log("");
-                continue;
-              }
-              saveEnvVar(cwd, "JIRA_API_TOKEN", tokenInput);
-              console.log("  ✓ Token saved to .env");
-              console.log("");
-              break;
-            }
-            continue; // Re-check
-          }
-
-          if (tracker === "github") {
-            console.log("  ┌──────────────────────────────────────────────────────────┐");
-            console.log("  │  Two ways to authenticate with GitHub:                    │");
-            console.log("  │                                                          │");
-            console.log("  │  Option A — GitHub CLI (recommended):                     │");
-            console.log("  │    Run: gh auth login                                     │");
-            console.log("  │    Then press Enter below.                                │");
-            console.log("  │                                                          │");
-            console.log("  │  Option B — Personal Access Token:                        │");
-            console.log("  │    1. Open https://github.com/settings/tokens             │");
-            console.log("  │    2. Click \"Generate new token (classic)\"                 │");
-            console.log("  │    3. Select the \"repo\" scope                              │");
-            console.log("  │    4. Generate and copy the token                         │");
-            console.log("  │    5. Paste it below                                      │");
-            console.log("  └──────────────────────────────────────────────────────────┘");
-            console.log("");
-
-            const tokenInput = await ask(rl, "  GitHub token (or Enter if using gh CLI): ");
-            const token = tokenInput.trim();
-            if (token) {
-              saveEnvVar(cwd, "GITHUB_TOKEN", token);
-              console.log("  ✓ Token saved to .env");
-              console.log("");
-            } else {
-              console.log("  OK, will check gh CLI authentication...");
-              console.log("");
-            }
-            continue; // Re-check
-          }
-        }
-
-        // Non-credential error (wrong team key, wrong URL, network issue, etc.)
-        console.log("");
-        const choice = await selectOption(rl, "What would you like to do?", [
-          { label: "Fix it and try again", value: "retry" },
-          { label: "Continue without tracker verification (fix later in dashboard)", value: "skip" },
-          { label: "Choose a different tracker platform", value: "change" },
-        ]);
-
-        if (choice.value === "retry") {
-          // Re-prompt for the tracker details that might be wrong
-          if (tracker === "linear" && config.linear) {
-            const wsAnswer = await ask(rl, `  Linear workspace slug (${config.linear.workspace || ""}): `);
-            if (wsAnswer.trim()) config.linear.workspace = wsAnswer.trim();
-            const tkAnswer = await ask(rl, `  Linear team key (${config.linear.teamKey || ""}): `);
-            if (tkAnswer.trim()) config.linear.teamKey = tkAnswer.trim();
-          }
-          if (tracker === "jira" && config.jira) {
-            const urlAnswer = await ask(rl, `  Jira base URL (${config.jira.baseUrl || ""}): `);
-            if (urlAnswer.trim()) config.jira.baseUrl = urlAnswer.trim();
-            const projAnswer = await ask(rl, `  Jira project key (${config.jira.project || ""}): `);
-            if (projAnswer.trim()) config.jira.project = projAnswer.trim();
-          }
-          if (tracker === "github" && config.github) {
-            const repoAnswer = await ask(rl, `  GitHub repo (${config.github.repo || ""}): `);
-            if (repoAnswer.trim()) config.github.repo = repoAnswer.trim();
-          }
-          console.log("");
-          continue;
-        } else if (choice.value === "change") {
-          rl.close();
-          return runInit(cwd);
-        } else {
-          console.log("");
-          console.log("  Continuing without tracker verification.");
-          console.log("  You can configure credentials later at agentdesk.live or re-run 'agentdesk init'.");
-          console.log("");
-          verified = true;
-        }
+  // --- GitHub block (always — even when tracker is Linear/Jira/None) ---
+  // This configures the credential agents use for git push, PRs, and
+  // GitHub API calls. When tracker is already GitHub Issues the block
+  // above already collected repo+login+token, so skip the duplicate.
+  let githubLogin = config.github?.login || null;
+  if (tracker !== "github") {
+    if (!quick) {
+      console.log("  ─".repeat(30));
+      console.log("  GitHub access (required — agents push code and open PRs here)");
+      console.log("");
+    }
+    if (!quick) printSteps("Create a GitHub personal access token", [
+      "Open https://github.com/settings/tokens (classic tokens).",
+      "Click \"Generate new token\" → \"Generate new token (classic)\".",
+      "Name: AgentDesk",
+      "Expiration: match your policy.",
+      "Scopes: check \"repo\" (full control of private repositories).",
+      "Click \"Generate token\" at the bottom. Copy the token (shown once).",
+    ]);
+    const detected = detectGitRemote(cwd);
+    const repoDefault = existingConfig.github?.repo || detected || "";
+    const repo = (await ask(rl, `  GitHub repo (owner/repo)${repoDefault ? ` [${repoDefault}]` : ""}: `)).trim() || repoDefault;
+    const loginDefault = existingConfig.github?.login || "";
+    const login = (await ask(rl, `  GitHub username (the @handle that owns the token)${loginDefault ? ` [${loginDefault}]` : ""}: `)).trim() || loginDefault;
+    const token = await promptRequired(rl, "GitHub token");
+    saveEnvVar(cwd, "GITHUB_TOKEN", token);
+    console.log("  ✓ Saved GITHUB_TOKEN to .env");
+    console.log("");
+    config.github = { repo, login };
+    githubLogin = login;
+
+    // Verify token matches the user-stated login.
+    try {
+      const env = { ...process.env, GH_TOKEN: token };
+      const who = execSync("gh api user --jq .login", { env, stdio: ["ignore", "pipe", "ignore"], encoding: "utf-8" }).trim();
+      if (who && login && who.toLowerCase() !== login.toLowerCase()) {
+        console.log(`  ⚠  Token is valid but authenticates as @${who}, not @${login}. Agents will post as @${who}.`);
+      } else if (who) {
+        console.log(`  ✓ GitHub verified as @${who}`);
       }
+    } catch {
+      console.log("  ⚠  Could not verify the GitHub token (gh CLI missing or network unreachable). Saved anyway — verify later in the dashboard.");
     }
+    console.log("");
+  }
+
+  // Identity badge — always ask (optional).
+  const badgeDefault = existingConfig.identityBadge || "";
+  const badge = (await ask(rl, `  Identity badge (display name for AgentDesk)${badgeDefault ? ` [${badgeDefault}]` : ""} [optional]: `)).trim() || badgeDefault;
+  if (badge) config.identityBadge = badge;
+  console.log("");
+
+  // --- Final step: agentdesk project key (with the tracker-derived default) ---
+  if (!quick) {
+    const keyAnswer = await ask(rl, `  AgentDesk project key [${finalProjectKey}]: `);
+    if (keyAnswer.trim()) finalProjectKey = keyAnswer.trim();
+    console.log("");
   }
 
   // --- Summary + confirm before write ---
@@ -496,26 +489,22 @@ export async function runInit(cwd, opts = {}) {
 
   merged.projectKey = finalProjectKey;
 
-  if (tracker) {
-    merged.tracker = tracker;
-    if (config.linear) merged.linear = config.linear;
-    if (config.jira) merged.jira = config.jira;
-    if (config.github) merged.github = config.github;
-  } else {
-    delete merged.tracker;
-    delete merged.linear;
-    delete merged.jira;
-    delete merged.github;
-  }
+  if (tracker) merged.tracker = tracker;
+  else delete merged.tracker;
+  if (config.linear) merged.linear = config.linear; else if (!tracker) delete merged.linear;
+  if (config.jira) merged.jira = config.jira; else if (!tracker) delete merged.jira;
+  if (config.github) merged.github = config.github;
+  if (config.identityBadge) merged.identityBadge = config.identityBadge;
 
   if (!quick) {
     console.log("  Review");
     console.log("  ──────");
-    console.log(`    Project key:  ${merged.projectKey}`);
-    console.log(`    Tracker:      ${merged.tracker || "none"}`);
-    if (merged.linear) console.log(`    Linear:       workspace=${merged.linear.workspace || "-"}, team=${merged.linear.teamKey || "-"}`);
-    if (merged.jira) console.log(`    Jira:         ${merged.jira.baseUrl || "-"}, project=${merged.jira.project || "-"}`);
-    if (merged.github) console.log(`    GitHub:       ${merged.github.repo || "-"}`);
+    console.log(`    Project key:      ${merged.projectKey}`);
+    console.log(`    Tracker:          ${merged.tracker || "none"}`);
+    if (merged.linear) console.log(`    Linear:           workspace=${merged.linear.workspace || "-"}, team=${merged.linear.teamKey || "-"}`);
+    if (merged.jira) console.log(`    Jira:             ${merged.jira.baseUrl || "-"}, project=${merged.jira.project || "-"}`);
+    if (merged.github) console.log(`    GitHub:           repo=${merged.github.repo || "-"}, user=@${merged.github.login || "-"}`);
+    if (merged.identityBadge) console.log(`    Identity badge:   ${merged.identityBadge}`);
     console.log("");
     const confirm = (await ask(rl, "  Save this config? [Y/n]: ")).trim().toLowerCase();
     if (confirm && confirm !== "y" && confirm !== "yes") {

package/cli/tracker-check.mjs

@@ -94,9 +94,13 @@ async function checkJira({ baseUrl, project }, creds) {
   let identity = null;
   const auth = "Basic " + Buffer.from(`${email}:${token}`).toString("base64");
 
+  // Normalize the base URL: trim trailing slashes, so `...net/` doesn't
+  // produce `...net//rest/...` which some Atlassian paths reject.
+  const cleanBase = String(baseUrl || "").replace(/\/+$/, "");
+
   // Fetch the authenticated user so we can report "Posting as X".
   try {
-    const meRes = await fetch(`${baseUrl}/rest/api/3/myself`, {
+    const meRes = await fetch(`${cleanBase}/rest/api/3/myself`, {
       headers: { Authorization: auth, Accept: "application/json" },
       signal: AbortSignal.timeout(10000),
     });
@@ -106,15 +110,24 @@ async function checkJira({ baseUrl, project }, creds) {
     }
   } catch {}
 
-  // Use Jira's mypermissions endpoint to check all permissions at once
+  // Use Jira's mypermissions endpoint to check all permissions at once.
+  // Try REST v3 first (Jira Cloud), fall back to v2 on 404 (older tenants /
+  // Data Center installs where v3 isn't exposed).
   const permissionsToCheck = "BROWSE_PROJECTS,CREATE_ISSUES,EDIT_ISSUES,ADD_COMMENTS,TRANSITION_ISSUES";
+  const tryVersions = ["3", "2"];
+  let res = null;
+  let lastUrl = "";
   try {
-    const url = `${baseUrl}/rest/api/3/mypermissions?permissions=${permissionsToCheck}` +
-      (project ? `&projectKey=${project}` : "");
-    const res = await fetch(url, {
-      headers: { Authorization: auth, Accept: "application/json" },
-      signal: AbortSignal.timeout(10000),
-    });
+    for (const v of tryVersions) {
+      const url = `${cleanBase}/rest/api/${v}/mypermissions?permissions=${permissionsToCheck}` +
+        (project ? `&projectKey=${project}` : "");
+      lastUrl = url;
+      res = await fetch(url, {
+        headers: { Authorization: auth, Accept: "application/json" },
+        signal: AbortSignal.timeout(10000),
+      });
+      if (res.status !== 404) break;
+    }
 
     if (res.status === 401) {
       return { ok: false, errors: ["Jira authentication failed — check JIRA_EMAIL and JIRA_API_TOKEN"] };
@@ -123,7 +136,7 @@ async function checkJira({ baseUrl, project }, creds) {
       return { ok: false, errors: ["Jira access forbidden — your account may lack access to this project"] };
     }
     if (!res.ok) {
-      return { ok: false, errors: [`Jira API error (${res.status}) — check your base URL: ${baseUrl}`] };
+      return { ok: false, errors: [`Jira API error (${res.status}) calling ${lastUrl} — check that the base URL is the Atlassian tenant root (e.g. https://yourco.atlassian.net) without a path.`] };
     }
 
     const data = await res.json();
@@ -144,9 +157,9 @@ async function checkJira({ baseUrl, project }, creds) {
     }
   } catch (e) {
     if (e.name === "AbortError" || e.name === "TimeoutError") {
-      return { ok: false, errors: [`Cannot reach Jira at ${baseUrl} — request timed out`] };
+      return { ok: false, errors: [`Cannot reach Jira at ${cleanBase} — request timed out`] };
     }
-    return { ok: false, errors: [`Cannot reach Jira at ${baseUrl}: ${e.message}`] };
+    return { ok: false, errors: [`Cannot reach Jira at ${cleanBase}: ${e.message}`] };
   }
 
   return { ok: errors.length === 0, errors, identity };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kendoo.agentdesk/agentdesk",
-  "version": "0.17.6",
+  "version": "0.18.1",
   "description": "AI team orchestrator for Claude Code — run collaborative agent sessions from your terminal",
   "type": "module",
   "bin": {