ticketlens 0.10.4 → 0.11.0

package/README.md

@@ -55,6 +55,8 @@ npx ticketlens init
 npx ticketlens CNV1-2
 ```
 
+Tip: `tl` works everywhere `ticketlens` does — running `tl`/`ticketlens config` before anything is configured also launches guided setup, no dead end. Pass `--no-input` to force non-interactive behavior even in a terminal (scripts, CI).
+
 **Prerequisites:** Node.js >=20
 
 ---
@@ -77,7 +79,7 @@ npx ticketlens CNV1-2
 | `ticketlens profiles` | List all configured profiles (alias: `ticketlens ls`) |
 | `ticketlens delete <NAME>` | Remove a profile and its credentials (prompts `y/N` in TTY; use `--yes` in scripts/CI) |
 
-`init` collects: profile name, tracker type (Jira / GitHub Issues / Linear), URL or workspace, credentials (masked), and optional ticket prefixes, project paths, and triage statuses. On connection failure, a retry menu lets you fix credentials, URL, or skip — all inputs pre-populated. `config` is tracker-aware and always re-validates the connection after edits.
+`init` collects: profile name, tracker type (Jira / GitHub Issues / Linear), URL or workspace, credentials (masked), and optional ticket prefixes, project paths, and triage statuses. On connection failure, a retry menu lets you fix credentials, URL, or skip — all inputs pre-populated. If your Jira instance sits behind a VPN and resolves to a private/internal address, you'll be asked to confirm you trust that connection before it's allowed through — a one-time confirmation, remembered per profile and scoped to that exact host (changing the URL asks again). `config` is tracker-aware and always re-validates the connection after edits.
 
 `config` uses merge semantics: new ticket prefixes and triage statuses are added to existing lists, never replaced. Partial matching resolves `QA` to `QA Testing` if that's the status in your Jira.
 

package/bin/ticketlens.mjs

@@ -7,8 +7,8 @@
  *   ticketlens triage [--stale=N] [--status=X,Y] [--profile=NAME]
  */
 
-import { createRequire } from 'node:module';
 import { parseCommand } from '../skills/jtb/scripts/lib/cli.mjs';
+import { renderWordmark } from '../skills/jtb/scripts/lib/wordmark.mjs';
 import { run as runFetch } from '../skills/jtb/scripts/fetch-ticket.mjs';
 import { run as runTriage } from '../skills/jtb/scripts/fetch-my-tickets.mjs';
 import { run as runInit } from '../skills/jtb/scripts/lib/init-wizard.mjs';
@@ -29,14 +29,13 @@ import {
 } from '../skills/jtb/scripts/lib/help.mjs';
 import { runStats } from '../skills/jtb/scripts/lib/run-stats.mjs';
 import { createStyler } from '../skills/jtb/scripts/lib/ansi.mjs';
-import { readCliToken, saveCliToken, deleteCliToken } from '../skills/jtb/scripts/lib/cli-auth.mjs';
-import { browserLogin } from '../skills/jtb/scripts/lib/browser-login.mjs';
-import { syncProfiles, getApiBase, getConsoleBase } from '../skills/jtb/scripts/lib/sync.mjs';
-import { promptSecret, promptText } from '../skills/jtb/scripts/lib/prompt-helpers.mjs';
+import { readCliToken, deleteCliToken } from '../skills/jtb/scripts/lib/cli-auth.mjs';
+import { runLogin } from '../skills/jtb/scripts/lib/login-flow.mjs';
+import { syncProfiles, reportSyncResult, getApiBase } from '../skills/jtb/scripts/lib/sync.mjs';
 import { checkForUpdate, getUpdateHint } from '../skills/jtb/scripts/lib/update-check.mjs';
 import { incrementInvocation, incrementCommand } from '../skills/jtb/scripts/lib/activity-counter.mjs';
 import { DEFAULT_CONFIG_DIR } from '../skills/jtb/scripts/lib/config.mjs';
-import { applyTeamConfigOnLogin, checkTeamJiraConfigUpdate } from '../skills/jtb/scripts/lib/team-jira-sync.mjs';
+import { checkTeamJiraConfigUpdate } from '../skills/jtb/scripts/lib/team-jira-sync.mjs';
 
 const TRACKED_COMMANDS = new Set([
   'triage', 'fetch', 'get', 'compliance', 'review', 'standup',
@@ -184,7 +183,24 @@ switch (command) {
 
     const profileArg = cmdArgs.find(a => a.startsWith('--profile='));
     const profileName = profileArg ? profileArg.split('=')[1] : undefined;
-    runConfig({ profileName }).catch(err => {
+    const isInteractive = process.stdin.isTTY && process.stdout.isTTY && !process.env.CI && !cmdArgs.includes('--no-input');
+
+    (async () => {
+      if (isInteractive) {
+        const { detectSetupState } = await import('../skills/jtb/scripts/lib/setup-state.mjs');
+        // Ready + no explicit --profile= honors the hub's own "Exit" sublabel
+        // promise ("you can rerun this any time: ticketlens config"). An
+        // explicit --profile= is a targeted, scriptable invocation — bypass
+        // the hub and edit that profile directly, unchanged from today.
+        if (detectSetupState().status !== 'ready' || !profileName) {
+          const { run: runOnboarding } = await import('../skills/jtb/scripts/lib/onboarding.mjs');
+          await runOnboarding({ stream: process.stderr });
+          return;
+        }
+      }
+
+      await runConfig({ profileName });
+    })().catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
     });
@@ -329,12 +345,9 @@ switch (command) {
     });
     break;
 
-  case 'version': {
-    const require = createRequire(import.meta.url);
-    const pkg = require('../package.json');
-    process.stdout.write(`ticketlens v${pkg.version}\n`);
+  case 'version':
+    process.stdout.write(renderWordmark({ stream: process.stdout }));
     break;
-  }
 
   case 'schedule': {
     if (cmdArgs.includes('--help') || cmdArgs.includes('-h')) { printScheduleHelp(); break; }
@@ -430,78 +443,7 @@ switch (command) {
     const useManual = cmdArgs.includes('--manual');
 
     (async () => {
-      const s = createStyler({ isTTY: process.stderr.isTTY });
-
-      let token;
-
-      if (useManual) {
-        // ── manual paste flow (CI / headless environments) ──────────────────
-        process.stderr.write(`\n  ${s.bold('TicketLens Login')}\n`);
-        process.stderr.write(`  ${s.dim('─'.repeat(44))}\n`);
-        process.stderr.write(`  ${s.dim(`Generate a CLI token at ${s.cyan(`${getConsoleBase()}/console/account`)}`)}\n`);
-        process.stderr.write(`  ${s.dim('then paste it below.')}\n\n`);
-
-        token = await promptSecret(`CLI Token ${s.dim('(tl_…)')}:`, { stream: process.stderr });
-        if (!token.startsWith('tl_')) {
-          process.stderr.write(`  ${s.red('✖')} Token must start with ${s.dim('tl_')}\n`);
-          process.exitCode = 1;
-          return;
-        }
-      } else {
-        // ── browser flow (default) ────────────────────────────────────────
-        process.stderr.write(`\n  ${s.bold('TicketLens Login')}\n`);
-        process.stderr.write(`  ${s.dim('─'.repeat(44))}\n`);
-        process.stderr.write(`  Opening browser to authorize…\n\n`);
-        process.stderr.write(`  ${s.dim('○ Waiting for authorization (120s)…')}\n`);
-
-        try {
-          token = await browserLogin();
-        } catch (err) {
-          const cancelled = err.message === 'Authorization cancelled';
-          process.stderr.write(`\x1b[A\r\x1b[2K  ${s.red('✖')} ${cancelled ? 'Login cancelled.' : err.message}\n`);
-          if (!cancelled) {
-            process.stderr.write(`\n  ${s.dim(`Try ${s.cyan('ticketlens login --manual')} to paste a token instead.`)}\n\n`);
-          }
-          process.exitCode = cancelled ? 0 : 1;
-          return;
-        }
-      }
-
-      // ── verify token against API (both flows) ─────────────────────────
-      process.stderr.write(`\n  ${s.dim('○ Verifying token…')}\n`);
-      let res;
-      try {
-        res = await fetch(`${getApiBase()}/v1/profiles`, {
-          headers: { Authorization: `Bearer ${token}`, Accept: 'application/json' },
-          signal: AbortSignal.timeout(15000),
-        });
-      } catch {
-        process.stderr.write(`\x1b[A\r\x1b[2K  ${s.red('✖')} Could not reach ${getApiBase()} — check your connection.\n`);
-        process.exitCode = 1;
-        return;
-      }
-
-      if (res.status === 401) {
-        process.stderr.write(`\x1b[A\r\x1b[2K  ${s.red('✖')} Invalid token — check the value and try again.\n`);
-        process.exitCode = 1;
-        return;
-      }
-      if (!res.ok) {
-        process.stderr.write(`\x1b[A\r\x1b[2K  ${s.red('✖')} Server returned ${res.status}. Try again later.\n`);
-        process.exitCode = 1;
-        return;
-      }
-
-      saveCliToken(token);
-      process.stderr.write(`\x1b[A\r\x1b[2K  ${s.green('✔')} Logged in.\n`);
-
-      // Flow 1: pull team Jira config for Pro/Team members (silently skipped for Free)
-      const tcLogin = await applyTeamConfigOnLogin().catch(() => null);
-      if (tcLogin?.ok) {
-        process.stderr.write(`  ${s.dim(`○ Team Jira config applied for ${s.cyan(tcLogin.groupName)}.`)}\n`);
-      }
-
-      process.stderr.write(`\n  Run ${s.cyan('ticketlens sync')} to pull your connections.\n\n`);
+      await runLogin({ manual: useManual });
     })().catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
@@ -525,42 +467,14 @@ switch (command) {
 
       const result = await syncProfiles();
 
-      if (result.error === 'no-token') {
-        process.stderr.write(`\x1b[A\r\x1b[2K  ${s.red('✖')} Not logged in. Run ${s.cyan('ticketlens login')} first.\n\n`);
-        process.exitCode = 1;
-        return;
-      }
-      if (result.error === 'unauthorized') {
-        process.stderr.write(`\x1b[A\r\x1b[2K  ${s.red('✖')} Token expired or revoked. Run ${s.cyan('ticketlens login')} to re-authenticate.\n\n`);
-        process.exitCode = 1;
-        return;
-      }
+      process.stderr.write('\x1b[A\r\x1b[2K');
+      reportSyncResult(result, { stream: process.stderr });
       if (result.error) {
-        process.stderr.write(`\x1b[A\r\x1b[2K  ${s.red('✖')} Sync failed: ${result.error}\n\n`);
+        process.stderr.write('\n');
         process.exitCode = 1;
         return;
       }
 
-      const { added, updated, unchanged, needsCredentials } = result;
-      const total = added.length + updated.length + unchanged.length;
-
-      process.stderr.write(`\x1b[A\r\x1b[2K  ${s.green('✔')} Sync complete`);
-      if (total === 0) {
-        process.stderr.write(` — no profiles on console yet.\n`);
-      } else {
-        process.stderr.write(`\n`);
-        if (added.length)     process.stderr.write(`  ${s.dim('+')} ${added.length} added: ${added.map(n => s.cyan(n)).join(', ')}\n`);
-        if (updated.length)   process.stderr.write(`  ${s.dim('↑')} ${updated.length} updated: ${updated.map(n => s.cyan(n)).join(', ')}\n`);
-        if (unchanged.length) process.stderr.write(`  ${s.dim('○')} ${unchanged.length} unchanged\n`);
-      }
-
-      if (needsCredentials.length > 0) {
-        process.stderr.write(`\n  ${s.yellow('!')} These profiles need credentials before they can be used:\n`);
-        for (const name of needsCredentials) {
-          process.stderr.write(`    ${s.dim('○')} ${s.cyan(name)} — run: ${s.bold(`ticketlens config --profile=${name}`)}\n`);
-        }
-      }
-
       // Flow 3: also pull team Jira config update (Pro/Team); silently skipped for Free
       const tcSync = await checkTeamJiraConfigUpdate().catch(() => null);
       if (tcSync?.banner) {
@@ -694,7 +608,23 @@ switch (command) {
   }
 
   case 'help':
-  default:
-    printHelp();
+  default: {
+    const isInteractive = args.length === 0 && process.stdin.isTTY && process.stdout.isTTY && !process.env.CI;
+
+    (async () => {
+      if (isInteractive) {
+        const { detectSetupState } = await import('../skills/jtb/scripts/lib/setup-state.mjs');
+        if (detectSetupState().status !== 'ready') {
+          const { run: runOnboarding } = await import('../skills/jtb/scripts/lib/onboarding.mjs');
+          await runOnboarding({ stream: process.stderr });
+          return;
+        }
+      }
+      printHelp();
+    })().catch(err => {
+      process.stderr.write(`Error: ${err.message}\n`);
+      process.exitCode = 1;
+    });
     break;
+  }
 }

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "ticketlens",
-  "version": "0.10.4",
+  "version": "0.11.0",
   "description": "Jira CLI for developers — fetch ticket context, triage your queue, and stop tab-switching. Zero dependencies, all local.",
   "type": "module",
   "bin": {
-    "ticketlens": "bin/ticketlens.mjs"
+    "ticketlens": "bin/ticketlens.mjs",
+    "tl": "bin/ticketlens.mjs"
   },
   "files": [
     "bin/",

package/scripts/postinstall.mjs

@@ -12,6 +12,7 @@ import { homedir } from 'node:os';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const SKILL_SRC = join(__dirname, '..', 'skills', 'jtb', 'SKILL.md');
+const OWN_BIN = join(__dirname, '..', 'bin', 'ticketlens.mjs');
 
 if (!existsSync(SKILL_SRC)) process.exit(0);
 
@@ -60,3 +61,36 @@ if (updated === 0 && skipped === TARGETS.length) {
   console.log('  ℹ /jtb skill not installed in any known location.');
   console.log('    To install: ticketlens update-skill');
 }
+
+// First-run banner + tl-alias status. Best-effort: npm >=7 hides this output
+// unless the user passes --foreground-scripts, so the guaranteed channel is
+// the first bare `tl`/`ticketlens` run added in a later phase. Never throws —
+// a broken banner must not break the install.
+try {
+  const { renderWordmark } = await import('../skills/jtb/scripts/lib/wordmark.mjs');
+  const { checkAliasStatus } = await import('../skills/jtb/scripts/lib/alias-status.mjs');
+  const { loadProfiles } = await import('../skills/jtb/scripts/lib/profile-resolver.mjs');
+
+  console.log('\n' + renderWordmark({ stream: process.stdout }));
+
+  const profiles = loadProfiles();
+  const isConfigured = !!(profiles && Object.keys(profiles.profiles || {}).length > 0);
+
+  const alias = checkAliasStatus({ selfBinPath: OWN_BIN });
+  if (alias.status === 'active') {
+    console.log('  ✔ Also available as: tl');
+  } else if (alias.status === 'shadowed') {
+    console.log(`  ⚠ 'tl' on this machine points to ${alias.foreignPath} — use 'ticketlens' instead.`);
+  }
+  // alias.status === 'missing' → npm bin dir not on PATH is a broader problem
+  // this script can't fix; saying nothing avoids confusing the user further.
+
+  if (isConfigured) {
+    console.log('  → Try  tl triage');
+  } else {
+    console.log('  → New here? Run  tl  to launch the guided setup.');
+  }
+  console.log('');
+} catch {
+  // Silent on failure — never breaks the install.
+}

package/skills/jtb/SKILL.md

@@ -1,4 +1,4 @@
-<!-- jtb-skill-version: 0.10.4 -->
+<!-- jtb-skill-version: 0.11.0 -->
 ---
 name: jtb
 description: Fetch a Jira ticket's full context (description, comments, linked issues, code references) and assemble a structured TicketBrief for implementation planning. Use when user types /jtb, mentions a Jira ticket key, or wants to plan work from a Jira ticket.
@@ -59,7 +59,7 @@ TicketLens supports two connection methods — check in this order:
 
 **1. Profile config (recommended):** If `~/.ticketlens/profiles.json` exists, no env vars
 are needed. Profile resolution is automatic (by ticket prefix, project path, or `--profile`).
-Setup via `ticketlens init`.
+Setup via `ticketlens init` (`tl init` also works — `tl` is shorthand for `ticketlens`).
 
 **2. Env var fallback:** If no profile config exists, these must be set:
 - `JIRA_BASE_URL` — e.g. `https://yourteam.atlassian.net`

package/skills/jtb/scripts/fetch-ticket.mjs

@@ -1134,7 +1134,7 @@ export async function run(args, envOrOpts = process.env, fetcher = globalThis.fe
       const authHeader = buildAuthHeader(jiraEnv);
       const apiVersion = conn.auth === 'cloud' ? 3 : 2;
       const jiraOrigin = new URL(jiraEnv.JIRA_BASE_URL).origin;
-      const links = await fetchRemoteLinks(ticketKey, { env: jiraEnv, fetcher, apiVersion });
+      const links = await fetchRemoteLinks(ticketKey, { env: jiraEnv, fetcher, apiVersion, allowPrivateIp: conn.allowPrivateIp });
       const MAX_CONFLUENCE_PAGES = 10;
       const safeLinks = links
         .filter(l => { try { return new URL(l.url).origin === jiraOrigin; } catch { return false; } })
@@ -1189,6 +1189,7 @@ export async function run(args, envOrOpts = process.env, fetcher = globalThis.fe
         fetcher,
         noCache: args.includes('--no-cache'),
         onProgress: (msg) => process.stderr.write(msg + '\n'),
+        allowPrivateIp: conn.allowPrivateIp,
       });
       const downloaded = ticket.localAttachments.filter(r => !r.skipped).length;
       const cached = ticket.localAttachments.filter(r => r.skipReason === 'cached').length;

package/skills/jtb/scripts/lib/adapters/jira-adapter.mjs

@@ -11,9 +11,9 @@ export function createJiraAdapter(conn, { fetcher = globalThis.fetch } = {}) {
 
   return {
     type: 'jira',
-    fetchTicket: (key, opts = {}) => fetchTicket(key, { env, fetcher, apiVersion, ...opts }),
-    fetchCurrentUser: (opts = {}) => fetchCurrentUser({ env, fetcher, apiVersion, ...opts }),
-    searchTickets: (query, opts = {}) => searchTickets(query, { env, fetcher, apiVersion, ...opts }),
-    fetchStatuses: (opts = {}) => fetchStatuses({ env, fetcher, apiVersion, ...opts }),
+    fetchTicket: (key, opts = {}) => fetchTicket(key, { env, fetcher, apiVersion, allowPrivateIp: conn.allowPrivateIp, ...opts }),
+    fetchCurrentUser: (opts = {}) => fetchCurrentUser({ env, fetcher, apiVersion, allowPrivateIp: conn.allowPrivateIp, ...opts }),
+    searchTickets: (query, opts = {}) => searchTickets(query, { env, fetcher, apiVersion, allowPrivateIp: conn.allowPrivateIp, ...opts }),
+    fetchStatuses: (opts = {}) => fetchStatuses({ env, fetcher, apiVersion, allowPrivateIp: conn.allowPrivateIp, ...opts }),
   };
 }

package/skills/jtb/scripts/lib/alias-status.mjs

@@ -0,0 +1,73 @@
+/**
+ * Detects whether the `tl` shorthand resolves to this package's own
+ * bin/ticketlens.mjs, a foreign binary shadowing it on PATH, or nothing.
+ * Pure filesystem checks only — no subprocess spawning, no network.
+ */
+
+import { existsSync, accessSync, realpathSync, constants as fsConstants } from 'node:fs';
+import { join, dirname } from 'node:path';
+
+const DEFAULT_PATHEXT = '.COM;.EXE;.BAT;.CMD';
+
+/**
+ * Scan PATH for the first executable matching binName. Never throws —
+ * an unreadable or missing directory is skipped, not fatal.
+ */
+export function findOnPath(binName, { env = process.env, platform = process.platform } = {}) {
+  const isWin = platform === 'win32';
+  // PATH delimiter depends on the target platform, not the host running this
+  // code — node:path's `delimiter` is host-bound and wrong when platform is
+  // passed explicitly (e.g. testing win32 logic from a POSIX host).
+  const dirs = (env.PATH || env.Path || '').split(isWin ? ';' : ':').filter(Boolean);
+  const candidates = isWin
+    ? [...(env.PATHEXT || DEFAULT_PATHEXT).split(';').map((ext) => binName + ext), binName]
+    : [binName];
+
+  for (const dir of dirs) {
+    for (const name of candidates) {
+      try {
+        const full = join(dir, name);
+        if (!existsSync(full)) continue;
+        // POSIX: skip non-executable matches (a shell would too). Windows PATHEXT
+        // already restricts candidates to executable extensions, so no check needed.
+        if (!isWin) accessSync(full, fsConstants.X_OK);
+        return full;
+      } catch {
+        continue;
+      }
+    }
+  }
+  return null;
+}
+
+/**
+ * Compare where `tl` resolves against our own installed ticketlens binary.
+ * POSIX: realpath comparison (npm bins are symlinks) against selfBinPath.
+ * Windows: npm .cmd/.ps1 shims aren't real symlinks, and selfBinPath (the
+ * package's internal target script under node_modules) lives in a different
+ * directory than the shims themselves — comparing against it always reads
+ * as foreign. Instead, npm always installs every bin entry from one package
+ * into the same shim directory together, so confirm ownership by checking
+ * whether a `ticketlens` shim sits alongside the found `tl` shim.
+ */
+export function checkAliasStatus({ selfBinPath, env = process.env, platform = process.platform } = {}) {
+  try {
+    const tlPath = findOnPath('tl', { env, platform });
+    if (!tlPath) return { status: 'missing' };
+
+    if (platform === 'win32') {
+      const ticketlensPath = findOnPath('ticketlens', { env, platform });
+      return ticketlensPath && dirname(tlPath) === dirname(ticketlensPath)
+        ? { status: 'active' }
+        : { status: 'shadowed', foreignPath: tlPath };
+    }
+
+    const resolvedTl = realpathSync(tlPath);
+    const resolvedSelf = realpathSync(selfBinPath);
+    return resolvedTl === resolvedSelf
+      ? { status: 'active' }
+      : { status: 'shadowed', foreignPath: tlPath };
+  } catch {
+    return { status: 'missing' };
+  }
+}

package/skills/jtb/scripts/lib/api-utils.mjs

@@ -4,7 +4,7 @@
  */
 
 export const DEFAULT_API_BASE = 'https://api.ticketlens.app';
-export const DEFAULT_SITE_BASE = 'https://ticketlens.dev';
+export const DEFAULT_SITE_BASE = 'https://ticketlens.app';
 
 // Matches localhost, 127.0.0.1, and any hostname ending in .test or .local,
 // with an optional port — all treated as local-only addresses.

package/skills/jtb/scripts/lib/attachment-downloader.mjs

@@ -20,10 +20,15 @@ const MAX_REDIRECT_HOPS = 2;
  * code-review remediation). Auth headers are only ever sent on the initial
  * request — every hop after that is auth-less, matching Jira Cloud's
  * presigned-URL CDN redirect model.
+ *
+ * `allowPrivateIp` only ever applies to the initial hop (the user's own
+ * trusted Jira origin). A redirect target is server-controlled — a
+ * categorically different trust domain — so it is never passed through,
+ * regardless of the caller's trust level.
  */
-async function followValidatedRedirects(initialUrl, fetcher, lookup, headers) {
+async function followValidatedRedirects(initialUrl, fetcher, lookup, headers, allowPrivateIp = false) {
   let url = initialUrl;
-  await validateResolvedHost(new URL(url).hostname, lookup);
+  await validateResolvedHost(new URL(url).hostname, lookup, allowPrivateIp);
   let response = await fetcher(url, { headers, redirect: 'manual' });
   let hops = 0;
   while (response.status >= 300 && response.status < 400) {
@@ -53,6 +58,7 @@ async function followValidatedRedirects(initialUrl, fetcher, lookup, headers) {
  * @param {string} opts.configDir Base config dir (default: ~/.ticketlens)
  * @param {boolean} opts.noCache  Force re-download even if cached (default: false)
  * @param {Function} opts.onProgress  Optional callback(msg: string) for progress lines
+ * @param {boolean} opts.allowPrivateIp  Skip the private-IP DNS check on the initial hop only (default: false)
  *
  * @returns {Promise<Array<{filename, mimeType, size, localPath, skipped, skipReason, error}>>}
  */
@@ -64,6 +70,7 @@ export async function downloadAttachments(ticket, opts = {}) {
     configDir = DEFAULT_CONFIG_DIR,
     noCache = false,
     onProgress = null,
+    allowPrivateIp = false,
   } = opts;
 
   const attachments = (ticket.attachments ?? []).filter(a => a.content);
@@ -118,7 +125,7 @@ export async function downloadAttachments(ticket, opts = {}) {
       onProgress?.(`  download  ${a.filename}`);
       try {
         const headers = buildAuthHeader(env);
-        const response = await followValidatedRedirects(a.content, fetcher, lookup, headers);
+        const response = await followValidatedRedirects(a.content, fetcher, lookup, headers, allowPrivateIp);
         if (!response.ok) throw new Error(`HTTP ${response.status} (${response.statusText})`);
         const buffer = await response.arrayBuffer();
         fs.writeFileSync(localPath, Buffer.from(buffer));

package/skills/jtb/scripts/lib/cli.mjs

@@ -8,7 +8,7 @@ export const TICKET_KEY_PATTERN = /^[A-Z][A-Z0-9]+-\d+$/;
 export function parseCommand(args) {
   const first = args[0];
 
-  if (args.length === 0 || first === '--help' || first === '-h') {
+  if (args.length === 0 || first === '--help' || first === '-h' || first === '--no-input') {
     return { command: 'help', args: [] };
   }
 

package/skills/jtb/scripts/lib/config-wizard.mjs

@@ -16,7 +16,7 @@ import { loadProfiles, loadCredentials, saveProfile } from './profile-resolver.m
 import { promptSelect } from './select-prompt.mjs';
 import { parseAge } from './cache-manager.mjs';
 import { DEFAULT_BRIEF_TTL } from './brief-cache.mjs';
-import { DEFAULT_CONFIG_DIR } from './config.mjs';
+import { DEFAULT_CONFIG_DIR, hostnameOf } from './config.mjs';
 import { visLen, SERVER_AUTH_TYPES, promptText, promptSecret, promptYN } from './prompt-helpers.mjs';
 import { isLicensed } from './license.mjs';
 import { siteBase } from './api-utils.mjs';
@@ -103,6 +103,10 @@ export async function run({ configDir = DEFAULT_CONFIG_DIR, profileName } = {})
   let email = profile.email || '';
   const existingToken = profileCreds.pat || profileCreds.apiToken || '';
   let token = existingToken;
+  // Trust is bound to the exact hostname it was granted for — never a flat
+  // per-profile boolean. Editing the URL to a different host must re-trigger
+  // the private-IP block and a fresh "Trust this connection?" prompt.
+  let trustedHostname = (profile.allowPrivateIp && hostnameOf(profile.baseUrl)) || null;
 
   // ── URL ───────────────────────────────────────────────────────────────────
   const urlTyped = await promptText(
@@ -158,6 +162,24 @@ export async function run({ configDir = DEFAULT_CONFIG_DIR, profileName } = {})
   let connected = false;
   let startFrom = 'test';
 
+  function isTrustedForCurrentUrl() {
+    return trustedHostname !== null && hostnameOf(url) === trustedHostname;
+  }
+
+  async function attemptConnection() {
+    if (isJira) {
+      const testEnv = {
+        JIRA_BASE_URL: url,
+        JIRA_EMAIL: email,
+        JIRA_API_TOKEN: auth !== 'pat' ? token : '',
+        JIRA_PAT: auth === 'pat' ? token : '',
+      };
+      await fetchCurrentUser({ env: testEnv, apiVersion: auth === 'cloud' ? 3 : 2, allowPrivateIp: isTrustedForCurrentUrl() });
+    } else {
+      await resolveAdapter({ baseUrl: url, auth: trackerType, apiToken: token }).fetchCurrentUser();
+    }
+  }
+
   setupLoop: while (true) {
     // Re-prompt URL + auth (on retry with 'url' option)
     if (startFrom === 'url') {
@@ -216,17 +238,7 @@ export async function run({ configDir = DEFAULT_CONFIG_DIR, profileName } = {})
       session.spin('Testing connection...');
 
       try {
-        if (isJira) {
-          const testEnv = {
-            JIRA_BASE_URL: url,
-            JIRA_EMAIL: email,
-            JIRA_API_TOKEN: auth !== 'pat' ? token : '',
-            JIRA_PAT: auth === 'pat' ? token : '',
-          };
-          await fetchCurrentUser({ env: testEnv, apiVersion: auth === 'cloud' ? 3 : 2 });
-        } else {
-          await resolveAdapter({ baseUrl: url, auth: trackerType, apiToken: token }).fetchCurrentUser();
-        }
+        await attemptConnection();
         session.connected();
         connected = true;
         break setupLoop;
@@ -234,6 +246,15 @@ export async function run({ configDir = DEFAULT_CONFIG_DIR, profileName } = {})
         session.failed();
         const classified = classifyError(err, { baseUrl: url, profileName: target });
         session.footer(classified.message, 'error', classified.hint);
+
+        if (classified.privateIpBlocked) {
+          const trust = await promptYN('Trust this connection?', { stream });
+          if (trust) {
+            trustedHostname = hostnameOf(url);
+            startFrom = 'test';
+            continue setupLoop;
+          }
+        }
       }
 
       stream.write(`\n  ${s.dim('What would you like to do?')}\n\n`);
@@ -326,7 +347,7 @@ export async function run({ configDir = DEFAULT_CONFIG_DIR, profileName } = {})
             JIRA_API_TOKEN: auth !== 'pat' ? token : '',
             JIRA_PAT: auth === 'pat' ? token : '',
           };
-          available = await fetchStatuses({ env: validateEnv, apiVersion: auth === 'cloud' ? 3 : 2 });
+          available = await fetchStatuses({ env: validateEnv, apiVersion: auth === 'cloud' ? 3 : 2, allowPrivateIp: isTrustedForCurrentUrl() });
         } else {
           available = await resolveAdapter({ baseUrl: url, auth: trackerType, apiToken: token }).fetchStatuses();
         }
@@ -397,6 +418,8 @@ export async function run({ configDir = DEFAULT_CONFIG_DIR, profileName } = {})
   else delete updated.projectPaths;
   if (cacheTtl && cacheTtl !== DEFAULT_BRIEF_TTL) updated.cacheTtl = cacheTtl;
   else delete updated.cacheTtl;
+  if (isTrustedForCurrentUrl()) updated.allowPrivateIp = true;
+  else delete updated.allowPrivateIp;
 
   const credData = (token !== existingToken)
     ? (auth === 'pat' ? { pat: token } : { apiToken: token })

package/skills/jtb/scripts/lib/config.mjs

@@ -11,21 +11,35 @@ import { homedir } from 'node:os';
 /** Canonical config directory: ~/.ticketlens */
 export const DEFAULT_CONFIG_DIR = join(homedir(), '.ticketlens');
 
-/** Read package.json version once per process, memoized.
+/** Read package.json once per process, memoized.
  * Uses realpathSync to resolve symlinks before navigating, so the correct
- * package.json is found whether the module is loaded via a symlink or directly.
+ * package.json is found whether the module is loaded via a symlink (e.g.
+ * the npm-managed `tl` bin) or directly.
  */
-let _version;
-export function getVersion() {
-  if (_version) return _version;
+let _pkg;
+function _readPkg() {
+  if (_pkg) return _pkg;
   try {
     const realDir = dirname(realpathSync(fileURLToPath(import.meta.url)));
-    const pkg = JSON.parse(readFileSync(join(realDir, '..', '..', '..', '..', 'package.json'), 'utf8'));
-    _version = pkg.version || '0.0.0';
+    _pkg = JSON.parse(readFileSync(join(realDir, '..', '..', '..', '..', 'package.json'), 'utf8'));
   } catch {
-    _version = '0.0.0';
+    _pkg = {};
   }
-  return _version;
+  return _pkg;
+}
+
+export function getVersion() {
+  return _readPkg().version || '0.0.0';
+}
+
+/** Metadata used by the first-run wordmark banner. */
+export function getPackageMeta() {
+  const pkg = _readPkg();
+  return {
+    version: pkg.version || '0.0.0',
+    author: pkg.author || 'unknown',
+    repository: typeof pkg.repository === 'string' ? pkg.repository : (pkg.repository?.url || ''),
+  };
 }
 
 /** Human-readable relative time from an ISO date string. */
@@ -54,6 +68,12 @@ export function stripCr(str) {
   return str.replace(/\r/g, '');
 }
 
+/** Parse a URL's hostname, or null if unparseable. Used to scope trust
+ * grants (e.g. allowPrivateIp) to the exact host they were confirmed for. */
+export function hostnameOf(url) {
+  try { return new URL(url).hostname; } catch { return null; }
+}
+
 /**
  * Build the env-like object expected by jira-client functions.
  * @param {{ baseUrl: string, pat?: string, email?: string, apiToken?: string }} conn