@kendoo.agentdesk/agentdesk 0.18.1 → 0.18.3

package/CHANGELOG.md

@@ -8,6 +8,16 @@ All user-facing changes to AgentDesk. Each entry is tagged:
 
 Internal refactors, infrastructure changes, and architectural notes are not listed here.
 
+## [0.18.3] — 2026-04-18
+
+### Fixed
+- `[CLI]` Tracker credentials: if a project has credentials stored both locally (`.env`) and on the server, the local value now wins. Previously the server's copy overrode `.env`, which meant that rotating a Jira / Linear / GitHub token locally didn't take effect while the server still held the old one.
+
+## [0.18.2] — 2026-04-18
+
+### Fixed
+- `[CLI]` Jira tracker check no longer blocks on a 404 from the `mypermissions` endpoint (some tenants don't expose it). Auth verification now lives in the `/myself` call; `mypermissions` is best-effort and only reports missing permissions if the tenant returns them. A 404 on `/myself` itself still fails loudly — that's a real configuration problem.
+
 ## [0.18.1] — 2026-04-18
 
 ### Fixed

package/cli/init.mjs

@@ -246,7 +246,8 @@ async function verifyAndPickTrackerProject({ rl, cwd, finalProjectKey, tracker,
   const dotEnv = loadDotEnv(cwd);
   const apiKey = loadApiKey(cwd);
   const serverCreds = await fetchServerCreds(apiKey, finalProjectKey);
-  const credentials = resolveCredentialsFromEnv({ ...dotEnv, ...serverCreds });
+  // .env wins over server credentials — fresh local rotation beats stale server state.
+  const credentials = resolveCredentialsFromEnv({ ...serverCreds, ...dotEnv });
   const check = await checkTrackerPermissions({ tracker, config, credentials });
   if (!check.ok) {
     console.log("  ⚠  " + (check.errors[0] || "Verification failed"));

package/cli/team.mjs

@@ -112,7 +112,9 @@ export async function runTeam(taskId, opts = {}) {
       } catch {}
     }
 
-    const credentials = resolveCredentialsFromEnv({ ...projectEnvVars, ...serverCreds });
+    // .env wins over server credentials — a freshly-rotated token in the
+    // user's project should beat a stale one left behind on the server.
+    const credentials = resolveCredentialsFromEnv({ ...serverCreds, ...projectEnvVars });
     const check = await checkTrackerPermissions({ tracker, config, credentials });
 
     if (!check.ok) {

package/cli/tracker-check.mjs

@@ -98,68 +98,79 @@ async function checkJira({ baseUrl, project }, creds) {
   // produce `...net//rest/...` which some Atlassian paths reject.
   const cleanBase = String(baseUrl || "").replace(/\/+$/, "");
 
-  // Fetch the authenticated user so we can report "Posting as X".
-  try {
-    const meRes = await fetch(`${cleanBase}/rest/api/3/myself`, {
-      headers: { Authorization: auth, Accept: "application/json" },
-      signal: AbortSignal.timeout(10000),
-    });
-    if (meRes.ok) {
-      const me = await meRes.json();
-      identity = { name: me.displayName || email, email: me.emailAddress || email, id: me.accountId };
+  // Primary check: /myself. If this works, the tenant + auth are fine.
+  // Try v3 first, fall back to v2 on 404. This is what we report to the
+  // user as "auth works"; mypermissions is now a best-effort follow-up.
+  let myselfRes = null;
+  let lastUrl = "";
+  for (const v of ["3", "2"]) {
+    lastUrl = `${cleanBase}/rest/api/${v}/myself`;
+    try {
+      myselfRes = await fetch(lastUrl, {
+        headers: { Authorization: auth, Accept: "application/json" },
+        signal: AbortSignal.timeout(10000),
+      });
+      if (myselfRes.status !== 404) break;
+    } catch (e) {
+      if (e.name === "AbortError" || e.name === "TimeoutError") {
+        return { ok: false, errors: [`Cannot reach Jira at ${cleanBase} — request timed out`] };
+      }
+      return { ok: false, errors: [`Cannot reach Jira at ${cleanBase}: ${e.message}`] };
     }
+  }
+  if (!myselfRes) return { ok: false, errors: [`Cannot reach Jira at ${cleanBase}`] };
+  if (myselfRes.status === 401) {
+    return { ok: false, errors: ["Jira authentication failed — check JIRA_EMAIL and JIRA_API_TOKEN"] };
+  }
+  if (myselfRes.status === 403) {
+    return { ok: false, errors: ["Jira access forbidden — your account may lack access to this tenant"] };
+  }
+  if (myselfRes.status === 404) {
+    return { ok: false, errors: [`Jira API not found at ${cleanBase} (tried /rest/api/3/myself and /rest/api/2/myself). Confirm the base URL is the Atlassian tenant root and Jira is enabled on this tenant.`] };
+  }
+  if (!myselfRes.ok) {
+    return { ok: false, errors: [`Jira API error (${myselfRes.status}) calling ${lastUrl}`] };
+  }
+  try {
+    const me = await myselfRes.json();
+    identity = { name: me.displayName || email, email: me.emailAddress || email, id: me.accountId };
   } catch {}
 
-  // Use Jira's mypermissions endpoint to check all permissions at once.
-  // Try REST v3 first (Jira Cloud), fall back to v2 on 404 (older tenants /
-  // Data Center installs where v3 isn't exposed).
-  const permissionsToCheck = "BROWSE_PROJECTS,CREATE_ISSUES,EDIT_ISSUES,ADD_COMMENTS,TRANSITION_ISSUES";
-  const tryVersions = ["3", "2"];
-  let res = null;
-  let lastUrl = "";
+  // Best-effort permission check. If it 404s or otherwise fails, we log the
+  // specific perms we COULD verify and return ok — the user's auth works;
+  // any missing permission will surface when the agent tries the operation.
   try {
-    for (const v of tryVersions) {
+    const permissionsToCheck = "BROWSE_PROJECTS,CREATE_ISSUES,EDIT_ISSUES,ADD_COMMENTS,TRANSITION_ISSUES";
+    let permRes = null;
+    for (const v of ["3", "2"]) {
       const url = `${cleanBase}/rest/api/${v}/mypermissions?permissions=${permissionsToCheck}` +
         (project ? `&projectKey=${project}` : "");
-      lastUrl = url;
-      res = await fetch(url, {
+      permRes = await fetch(url, {
         headers: { Authorization: auth, Accept: "application/json" },
         signal: AbortSignal.timeout(10000),
       });
-      if (res.status !== 404) break;
-    }
-
-    if (res.status === 401) {
-      return { ok: false, errors: ["Jira authentication failed — check JIRA_EMAIL and JIRA_API_TOKEN"] };
-    }
-    if (res.status === 403) {
-      return { ok: false, errors: ["Jira access forbidden — your account may lack access to this project"] };
-    }
-    if (!res.ok) {
-      return { ok: false, errors: [`Jira API error (${res.status}) calling ${lastUrl} — check that the base URL is the Atlassian tenant root (e.g. https://yourco.atlassian.net) without a path.`] };
+      if (permRes.status !== 404) break;
     }
-
-    const data = await res.json();
-    const perms = data.permissions || {};
-
-    const permMap = {
-      BROWSE_PROJECTS: "read tasks",
-      CREATE_ISSUES: "create tasks",
-      EDIT_ISSUES: "update tasks",
-      ADD_COMMENTS: "add comments",
-      TRANSITION_ISSUES: "change task status",
-    };
-
-    for (const [key, label] of Object.entries(permMap)) {
-      if (perms[key] && !perms[key].havePermission) {
-        errors.push(`Missing permission: ${label} (${key})`);
+    if (permRes && permRes.ok) {
+      const data = await permRes.json();
+      const perms = data.permissions || {};
+      const permMap = {
+        BROWSE_PROJECTS: "read tasks",
+        CREATE_ISSUES: "create tasks",
+        EDIT_ISSUES: "update tasks",
+        ADD_COMMENTS: "add comments",
+        TRANSITION_ISSUES: "change task status",
+      };
+      for (const [key, label] of Object.entries(permMap)) {
+        if (perms[key] && !perms[key].havePermission) {
+          errors.push(`Missing permission: ${label} (${key})`);
+        }
       }
     }
-  } catch (e) {
-    if (e.name === "AbortError" || e.name === "TimeoutError") {
-      return { ok: false, errors: [`Cannot reach Jira at ${cleanBase} — request timed out`] };
-    }
-    return { ok: false, errors: [`Cannot reach Jira at ${cleanBase}: ${e.message}`] };
+    // If mypermissions failed, silently skip — agent will hit real errors
+    // when it tries an operation, which is more accurate anyway.
+  } catch {
+    // Ignore — auth already verified via /myself above.
   }
 
   return { ok: errors.length === 0, errors, identity };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kendoo.agentdesk/agentdesk",
-  "version": "0.18.1",
+  "version": "0.18.3",
   "description": "AI team orchestrator for Claude Code — run collaborative agent sessions from your terminal",
   "type": "module",
   "bin": {