ticketlens 0.16.0 → 0.16.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ticketlens",
-  "version": "0.16.0",
+  "version": "0.16.1",
   "description": "Jira CLI for developers — fetch ticket context, triage your queue, and stop tab-switching. Zero dependencies, all local.",
   "type": "module",
   "bin": {

package/skills/jtb/SKILL.md

@@ -1,4 +1,4 @@
-<!-- jtb-skill-version: 0.16.0 -->
+<!-- jtb-skill-version: 0.16.1 -->
 ---
 name: jtb
 description: Fetch a Jira ticket's full context (description, comments, linked issues, code references) and assemble a structured TicketBrief for implementation planning. Use when user types /jtb, mentions a Jira ticket key, or wants to plan work from a Jira ticket.

package/skills/jtb/scripts/lib/recall-sync.mjs

@@ -15,6 +15,7 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
+import { createHash } from 'node:crypto';
 import { DEFAULT_CONFIG_DIR } from './config.mjs';
 import { apiBase, warnIfInsecure } from './api-utils.mjs';
 import { upsertPulledNote, rebuildIndex, deleteNote } from './recall-vault.mjs';
@@ -23,7 +24,9 @@ import { red, yellow, dim, cyan } from './ansi.mjs';
 const PUSH_PATH = '/v1/recall/push';
 const PULL_PATH = '/v1/recall/pull';
 export const RECALL_PULL_TTL_MS = 4 * 60 * 60 * 1000; // 4 hours, matches BRIEF_TTL_MS
+export const RECALL_ENTITLEMENT_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours — entitlement changes are owner-driven and rare
 const PULL_STATE_FILE = 'recall-pull-state.json';
+const ENTITLEMENT_STATE_FILE = 'recall-entitlement-state.json';
 
 function pullStatePath(configDir) {
   return path.join(configDir, PULL_STATE_FILE);
@@ -45,6 +48,36 @@ function writeLastPulledAt(configDir, isoTimestamp) {
   }
 }
 
+function entitlementCachePath(configDir) {
+  return path.join(configDir, ENTITLEMENT_STATE_FILE);
+}
+
+// Never store the raw token — only a hash, used solely to detect an account
+// switch (e.g. login as someone else) so a stale cache never suppresses a
+// different account's push. Found via Local Live Test: configDir alone is
+// not a valid cache key — cli-token.json can change without configDir changing.
+function hashToken(cliToken) {
+  return createHash('sha256').update(cliToken).digest('hex');
+}
+
+function readEntitlementCheckedAt(configDir, cliToken) {
+  try {
+    const cached = JSON.parse(fs.readFileSync(entitlementCachePath(configDir), 'utf8'));
+    if (cached.tokenHash !== hashToken(cliToken)) return null;
+    return cached.checkedAt ?? null;
+  } catch {
+    return null;
+  }
+}
+
+function writeEntitlementCheckedAt(configDir, isoTimestamp, cliToken) {
+  try {
+    fs.writeFileSync(entitlementCachePath(configDir), JSON.stringify({ checkedAt: isoTimestamp, tokenHash: hashToken(cliToken) }), 'utf8');
+  } catch {
+    // Non-fatal — worst case the next save warns again instead of staying silent.
+  }
+}
+
 /**
  * POSTs one locally-authored note to the team backend.
  *
@@ -61,13 +94,22 @@ export async function pushNote(note, {
   cliToken,
   configDir = DEFAULT_CONFIG_DIR,
   timeoutMs = 15_000,
+  ttlMs = RECALL_ENTITLEMENT_TTL_MS,
   fetcher = globalThis.fetch,
   warn = (s) => process.stderr.write(s),
+  now = () => Date.now(),
 } = {}) {
   if (!cliToken) {
     return { ok: false };
   }
 
+  // A non-entitled account gets this same 403 on every save until the owner
+  // flips the Recall grant — without this, the warning below repeats forever.
+  const checkedAt = readEntitlementCheckedAt(configDir, cliToken);
+  if (checkedAt && now() - new Date(checkedAt).getTime() < ttlMs) {
+    return { ok: false, skipped: true };
+  }
+
   warnIfInsecure(apiBase(), warn);
 
   let res;
@@ -110,9 +152,12 @@ export async function pushNote(note, {
     let reason;
     try { reason = (await res.json())?.error; } catch { /* fall through to the generic message below */ }
     if (reason === 'No team found') {
+      // Deliberately never cached: joining a team is a fast, self-directed fix,
+      // unlike entitlement (which waits on the owner) — the nudge stays useful.
       warn(`  ${yellow('⚠')} You're not on a team yet, so there's nowhere to sync this note — saved locally only.\n`);
     } else {
       warn(`  ${yellow('⚠')} Your plan doesn't include team Recall sync — saved locally only.\n`);
+      writeEntitlementCheckedAt(configDir, new Date(now()).toISOString(), cliToken);
     }
     return { ok: false, status: res.status };
   }