ticketlens 0.21.4 → 0.21.5

package/bin/ticketlens.mjs

@@ -630,6 +630,16 @@ switch (command) {
       });
       break;
     }
+    if (cmdArgs[0] === 'delete') {
+      const { runNoteDelete } = await import('../skills/jtb/scripts/lib/note-command.mjs');
+      runNoteDelete(cmdArgs.slice(1)).then(({ deleted }) => {
+        if (!deleted) process.exitCode = 1;
+      }).catch(err => {
+        process.stderr.write(`Error: ${err.message}\n`);
+        process.exitCode = 1;
+      });
+      break;
+    }
     process.stderr.write('Usage: ticketlens note add --title="..." [--ticket=KEY] [--tags=a,b]\n');
     process.exitCode = 1;
     break;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ticketlens",
-  "version": "0.21.4",
+  "version": "0.21.5",
   "description": "Jira CLI for developers — fetch ticket context, triage your queue, and stop tab-switching. Zero dependencies, all local.",
   "type": "module",
   "bin": {

package/skills/jtb/scripts/lib/help.mjs

@@ -520,6 +520,12 @@ export function printNoteHelp({ stream = process.stdout } = {}) {
     `  Code session — not typically invoked by hand. Every note it writes gets the`,
     `  same structural and secret-scan checks ${s.brand('note add')} applies to user input.`,
     '',
+    `  ${s.bold('ticketlens note delete')} ${s.dim('--id="..." [--ticket=KEY]')}  ${s.dim('[Pro]')}`,
+    '',
+    `  Removes a note from your local vault. Local only — if this note was already`,
+    `  pushed to a team, teammates who pulled it keep their copy; deleting it there`,
+    `  too is a manager action from the Console (Admin > Recall).`,
+    '',
   ];
   stream.write(lines.join('\n') + '\n');
 }

package/skills/jtb/scripts/lib/note-command.mjs

@@ -11,7 +11,7 @@ import { DEFAULT_CONFIG_DIR } from './config.mjs';
 import { isLicensed, showUpgradePrompt } from './license.mjs';
 import { scanForSecrets } from './secret-scanner.mjs';
 import { checkNoteStructure } from './note-structural-check.mjs';
-import { writeNote, patchNoteBody } from './recall-vault.mjs';
+import { writeNote, patchNoteBody, deleteNote } from './recall-vault.mjs';
 import { readCliToken } from './cli-auth.mjs';
 import { pushNote } from './recall-sync.mjs';
 import { enqueueNote, isRetryableFailure, maybeAutoFlush } from './recall-queue.mjs';
@@ -210,3 +210,45 @@ export async function runNotePatch(cmdArgs, {
   stream.write(patched ? `  Updated note (${id})\n` : `  Note not updated — (${id}) not found or already changed.\n`);
   return { patched };
 }
+
+/**
+ * Implements `tl note delete` — removes a note from the local vault only.
+ *
+ * Local-only, same limitation `note patch` already documents: if this note
+ * was already pushed to a team (Team Recall enabled), teammates who already
+ * pulled it keep their copy — this does not push a tombstone. Deleting a
+ * note everywhere it's synced is a manager action from the Console today
+ * (Admin > Recall), which does propagate a tombstone on next pull.
+ *
+ * @param {string[]} cmdArgs
+ * @returns {Promise<{ deleted: boolean }>}
+ */
+export async function runNoteDelete(cmdArgs, {
+  configDir = DEFAULT_CONFIG_DIR,
+  stream = process.stderr,
+  isLicensedFn = isLicensed,
+  deleteNoteFn = deleteNote,
+} = {}) {
+  if (!isLicensedFn('pro', configDir)) {
+    showUpgradePrompt('pro', 'ticketlens note', { stream });
+    return { deleted: false };
+  }
+
+  const id = parseFlag(cmdArgs, 'id');
+  if (!id) {
+    stream.write('Usage: ticketlens note delete --id="..." [--ticket=KEY]\n');
+    return { deleted: false };
+  }
+
+  const ticketKey = parseFlag(cmdArgs, 'ticket');
+  if (ticketKey && !TICKET_KEY_PATTERN.test(ticketKey)) {
+    stream.write(`  Invalid --ticket value "${ticketKey}" — expected a ticket key like PROJ-123.\n`);
+    return { deleted: false };
+  }
+
+  const { deleted } = deleteNoteFn({ external_id: id, tickets: ticketKey ? [ticketKey] : [] }, { configDir });
+  stream.write(deleted
+    ? `  Deleted note (${id}) — local vault only; see help for team-synced notes.\n`
+    : `  Note not deleted — (${id}) not found.\n`);
+  return { deleted };
+}

package/skills/jtb/scripts/lib/secret-scanner.mjs

@@ -101,25 +101,41 @@ function hasInternalCaseSwitch(token) {
 /**
  * True for a token that stops a joined-chunk run: either a recognized git/
  * checksum label word ("commit", "sha256", "md5sum", ...), or an ordinary
- * English word (letters only, no base64-style case switching). Anything else —
- * a fragment containing a digit/symbol, or an all-letter chunk that still reads
- * as random content — stays eligible to join, so a secret split by whitespace
- * can still be reassembled for the entropy check.
+ * English word (letters only, optionally with an internal possessive/
+ * contraction apostrophe — "relay's", "doesn't" — but no base64-style case
+ * switching). Anything else — a fragment containing a digit or other symbol,
+ * a hyphenated compound, or an all-letter chunk that still reads as random
+ * content — stays eligible to join, so a secret split by whitespace can still
+ * be reassembled for the entropy check.
  *
- * Known accepted gap: this can't tell a genuine dictionary word from one an
+ * The apostrophe allowance matters because without it, an ordinary possessive
+ * next to another non-label token (e.g. a hyphenated compound: "relay's
+ * decision-lookup") never gets a chance to stop the run — both fail to
+ * qualify, so they concatenate into one artificial blob whose mixed
+ * punctuation trips the entropy threshold. A real false positive, not a
+ * hypothetical one (see the regression test below). Hyphenated tokens are
+ * deliberately NOT given the same allowance: a short prefix + hyphen + long
+ * letter-run is indistinguishable from a real compound word by shape alone
+ * (e.g. "sk-abcdefghijklmnop", the letters-only half of a whitespace-split
+ * API key) — see the adjacent regression test for exactly this shape. Once
+ * the apostrophe fix lets "relay's" stop the run on its own, an adjacent
+ * hyphenated compound is short enough on its own to fall under
+ * MIN_RANDOM_TOKEN_LENGTH anyway, so it never needed the same allowance.
+ *
+ * Known accepted gap: this can't tell a genuine possessive from one an
  * attacker deliberately chose as a separator to defeat the scanner (e.g.
- * splitting a secret around the word "wall"). Closing that would require
- * treating ordinary prose words as joinable too, which in turn re-joins real
- * sentence text into false-positive "random" strings (verified empirically —
- * see the regression test for "PROD-123456 for background"). Entropy-based
- * detection is a safety net, not a cryptographic guarantee; the well-known
- * secret shapes in HARD_REJECT_PATTERNS are the layer that's fully whitespace-
- * and word-insertion-proof, since they match a specific literal prefix.
+ * splitting a secret around "user's"). Closing that would require treating
+ * ordinary prose words as joinable too, which in turn re-joins real sentence
+ * text into false-positive "random" strings (verified empirically — see the
+ * regression test for "PROD-123456 for background"). Entropy-based detection
+ * is a safety net, not a cryptographic guarantee; the well-known secret
+ * shapes in HARD_REJECT_PATTERNS are the layer that's fully whitespace- and
+ * word-insertion-proof, since they match a specific literal prefix.
  */
 function isLabelWord(token) {
   const stripped = stripEdgePunctuation(token);
   if (GIT_REFERENCE_WORD_RE.test(stripped)) return true;
-  return /^[A-Za-z]+$/.test(stripped) && !hasInternalCaseSwitch(stripped);
+  return /^[A-Za-z]+(?:'[A-Za-z]+)*$/.test(stripped) && !hasInternalCaseSwitch(stripped);
 }
 
 /**