ticketlens 0.38.10 → 0.38.12

package/bin/ticketlens.mjs

@@ -262,11 +262,13 @@ switch (command) {
     if (cmdArgs.includes('--help') || cmdArgs.includes('-h')) { printLicenseHelp(); break; }
     const s = createStyler({ isTTY: process.stdout.isTTY });
     const status = checkLicense();
+    const hasLicense = Boolean(status.key);
     const daysSinceVal = status.validatedAt
       ? (Date.now() - new Date(status.validatedAt)) / 86400000
       : Infinity;
-    // Grace period: treat as inactive if not revalidated within 30 days
-    const graceExpired = daysSinceVal > 30;
+    // Grace period: treat as inactive if not revalidated within 30 days — only applies
+    // once a license has actually been activated (never conflate "never had one" with "lapsed").
+    const graceExpired = hasLicense && daysSinceVal > 30;
     process.stdout.write('\n');
     if (status.active && !graceExpired) {
       process.stdout.write(`  ${s.green('●')} ${s.bold('License active')}\n\n`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ticketlens",
-  "version": "0.38.10",
+  "version": "0.38.12",
   "description": "Jira CLI for developers — fetch ticket context, triage your queue, and stop tab-switching. Zero dependencies, all local.",
   "type": "module",
   "bin": {

package/skills/jtb/SKILL.md

@@ -1,4 +1,4 @@
-<!-- jtb-skill-version: 0.32.0 -->
+<!-- jtb-skill-version: 0.33.0 -->
 ---
 name: jtb
 description: Fetch a Jira ticket's full context (description, comments, linked issues, code references) and assemble a structured TicketBrief for implementation planning. Use when user types /jtb, mentions a Jira ticket key, or wants to plan work from a Jira ticket.
@@ -236,7 +236,7 @@ echo "The body text of the note, one or more paragraphs." | \
   ticketlens note add --title="Short title" --ticket=TICKET-KEY --tags=a,b
 ```
 
-**Choosing tags:** derive them from this note's actual content — the specific technology, error type, root cause, or affected component (e.g. `retry-backoff`, `null-pointer`, `auth-middleware`) — never the project name or a generic category word like `gotcha` or `bug`. A tag like `jtb` or `ticketlens` tells a future search nothing that the ticket/project context doesn't already say; a tag like `retry-backoff` is what actually surfaces this note when someone else hits the same problem. Same rule whether you're constructing the bash command above or calling `recall_add` directly — see its tool description for the same guidance.
+**Choosing tags:** derive them from this note's actual content — the specific technology, error type, root cause, or affected component (e.g. `retry-backoff`, `null-pointer`, `auth-middleware`) — never the project name or a generic category word like `gotcha` or `bug`. A tag like `jtb` or `ticketlens` tells a future search nothing that the ticket/project context doesn't already say; a tag like `retry-backoff` is what actually surfaces this note when someone else hits the same problem. A tag that just restates the title in different words, or one you can't trace to a specific sentence in the body, gives that same zero signal — if you can't point to the exact phrase that justifies it, drop it. Same rule whether you're constructing the bash command above or calling `recall_add` directly — see its tool description for the same guidance.
 
 To search saved notes directly (outside of automatic brief injection): `ticketlens recall "<query>"`.
 

package/skills/jtb/scripts/fetch-my-tickets.mjs

@@ -440,7 +440,7 @@ export async function run(args, envOrOpts = process.env, fetcher = globalThis.fe
   } catch { /* non-fatal */ }
 
   // Track this triage run (best-effort, non-fatal)
-  try { incrementTriageRun(configDir); } catch { /* non-fatal */ }
+  try { incrementTriageRun(configDir, resolvedProfileName); } catch { /* non-fatal */ }
 
   // --digest: POST scored results to the digest backend endpoint
   if (digestFlag) {
@@ -500,7 +500,7 @@ export async function run(args, envOrOpts = process.env, fetcher = globalThis.fe
     const cliToken = opts.cliToken ?? readCliToken(configDir) ?? null;
     const printFn = opts.print ?? ((s) => process.stdout.write(s));
     let cliActivity = null;
-    try { cliActivity = readAndResetActivity(configDir ?? DEFAULT_CONFIG_DIR); } catch { /* non-fatal */ }
+    try { cliActivity = readAndResetActivity(configDir ?? DEFAULT_CONFIG_DIR, resolvedProfileName); } catch { /* non-fatal */ }
     // Server-side notify/schedule rules must see actively-worked ('clear') tickets too —
     // only a ticket the user explicitly told the CLI to ignore is excluded from push.
     const pushable = sortByUrgency(scored.filter(s => s.urgency !== 'ignore'));

package/skills/jtb/scripts/lib/activity-counter.mjs

@@ -2,6 +2,16 @@
  * Best-effort CLI activity counter — tracks fetch, triage, and invocation
  * counts between pushes. Stored in ~/.ticketlens/activity.json.
  *
+ * fetch_count/triage_run_count are tracked per profile (data.byProfile), since
+ * they're always incremented at a point where a resolved profile is known and
+ * a push (`readAndResetActivity`) reports them for one specific profile — a
+ * push under profile A must never bundle in runs that actually happened under
+ * profile B (L-6, 2026-08-01 audit). Every other field (invocations, commands,
+ * drafts_kept, drafts_deleted, briefs_with_recall_injection) stays flat/global:
+ * they're incremented from bin/ticketlens.mjs before any command has resolved a
+ * profile at all (many commands, e.g. `license`/`cache`, have no profile concept
+ * whatsoever), so there's no meaningful profile to bucket them under.
+ *
  * Intentional limitations (acceptable for a UX metric, NOT suitable for billing):
  *
  * - Not transactional: if a push succeeds server-side but the network returns
@@ -19,12 +29,13 @@ import fs from 'node:fs';
 import path from 'node:path';
 
 const ACTIVITY_FILE = 'activity.json';
+const EMPTY_PROFILE_BUCKET = { fetch_count: 0, triage_run_count: 0 };
 
 function read(configDir) {
   try {
     return JSON.parse(fs.readFileSync(path.join(configDir, ACTIVITY_FILE), 'utf8'));
   } catch {
-    return { fetch_count: 0, triage_run_count: 0, invocations: 0, commands: {}, drafts_kept: 0, drafts_deleted: 0, briefs_with_recall_injection: 0 };
+    return { byProfile: {}, invocations: 0, commands: {}, drafts_kept: 0, drafts_deleted: 0, briefs_with_recall_injection: 0 };
   }
 }
 
@@ -48,12 +59,26 @@ function increment(configDir, field) {
   return data[field];
 }
 
-export function incrementFetch(configDir) {
-  increment(configDir, 'fetch_count');
+/**
+ * @param {string} configDir
+ * @param {string} profile
+ * @param {'fetch_count'|'triage_run_count'} field
+ */
+function incrementProfileField(configDir, profile, field) {
+  const data = read(configDir);
+  if (!data.byProfile) data.byProfile = {};
+  if (!data.byProfile[profile]) data.byProfile[profile] = { ...EMPTY_PROFILE_BUCKET };
+  const bucket = data.byProfile[profile];
+  bucket[field] = (bucket[field] ?? 0) + 1;
+  write(configDir, data);
+}
+
+export function incrementFetch(configDir, profile) {
+  incrementProfileField(configDir, profile, 'fetch_count');
 }
 
-export function incrementTriageRun(configDir) {
-  increment(configDir, 'triage_run_count');
+export function incrementTriageRun(configDir, profile) {
+  incrementProfileField(configDir, profile, 'triage_run_count');
 }
 
 export function incrementInvocation(configDir) {
@@ -147,25 +172,35 @@ export function recordTokensSaved(configDir, command, tokens) {
 }
 
 /**
- * Returns the current counters and resets them to zero.
- * Call only after a confirmed successful push.
+ * Returns the current counters and resets them to zero. Call only after a
+ * confirmed successful push, for the exact profile that push was for.
+ *
+ * fetch_count/triage_run_count are scoped to the given profile — only that
+ * profile's bucket is read and reset, so a push for profile A never bundles
+ * in (or clears) runs that happened under a different profile B. Every other
+ * field stays global, same as before: reset regardless of which profile
+ * triggered this push (see the module doc comment for why).
  *
  * @param {string} configDir
+ * @param {string} profile
  * @returns {{ fetch_count: number, triage_run_count: number, invocations: number, commands: object }}
  */
-export function readAndResetActivity(configDir) {
+export function readAndResetActivity(configDir, profile) {
   const data = read(configDir);
+  const profileBucket = data.byProfile?.[profile] ?? EMPTY_PROFILE_BUCKET;
   const snapshot = {
-    fetch_count:                  data.fetch_count                  ?? 0,
-    triage_run_count:             data.triage_run_count             ?? 0,
+    fetch_count:                  profileBucket.fetch_count         ?? 0,
+    triage_run_count:             profileBucket.triage_run_count    ?? 0,
     invocations:                  data.invocations                  ?? 0,
     commands:                     data.commands                     ?? {},
     drafts_kept:                  data.drafts_kept                  ?? 0,
     drafts_deleted:               data.drafts_deleted               ?? 0,
     briefs_with_recall_injection: data.briefs_with_recall_injection ?? 0,
   };
+  const byProfile = { ...(data.byProfile ?? {}) };
+  delete byProfile[profile];
   write(configDir, {
-    fetch_count: 0, triage_run_count: 0, invocations: 0, commands: {},
+    byProfile, invocations: 0, commands: {},
     drafts_kept: 0, drafts_deleted: 0, briefs_with_recall_injection: 0,
     ...(data.pulses ? { pulses: data.pulses } : {}),
   });

package/skills/jtb/scripts/lib/help.mjs

@@ -54,13 +54,13 @@ export function printHelp({ stream = process.stdout } = {}) {
     `    ${s.brand('ticketlens')} recall sync                 Retry any notes stuck in the local queue  ${s.dim('[Team+]')}`,
     `    ${s.brand('ticketlens')} recall settings             Show effective retry-queue settings, fetched live  ${s.dim('[Team+]')}`,
     `    ${s.brand('ticketlens')} mcp                         Start the MCP stdio server (Recall + ticket writes)  ${s.dim('[Pro]')}`,
-    `    ${s.brand('ticketlens')} comment ${s.dim('<TICKET-KEY> --body=...')}  Post a comment to the tracker  ${s.dim('[Pro]')}`,
+    `    ${s.brand('ticketlens')} comment ${s.dim('<TICKET-KEY> --body=... [--attach=...]')}  Post a comment to the tracker  ${s.dim('[Pro]')}`,
     `    ${s.brand('ticketlens')} transition ${s.dim('<TICKET-KEY> [--target=... --confirm]')}  Move ticket status  ${s.dim('[Pro]')}`,
     `    ${s.brand('ticketlens')} assign ${s.dim('<TICKET-KEY> --to=me')}      Assign a ticket to yourself  ${s.dim('[Pro]')}`,
     `    ${s.brand('ticketlens')} duplicates ${s.dim('<TICKET-KEY> [--threshold=N]')}  Find likely duplicate tickets  ${s.dim('[Pro]')}`,
     `    ${s.brand('ticketlens')} link ${s.dim('<SOURCE> <TARGET> [--type=... --confirm]')}  Link two tickets  ${s.dim('[Pro]')}`,
     `    ${s.brand('ticketlens')} update ${s.dim('<TICKET-KEY> [--title=... --description=... --priority=... --add-labels=... --remove-labels=...]')}  Update fields  ${s.dim('[Pro]')}`,
-    `    ${s.brand('ticketlens')} create ${s.dim('--project=... [--type=...] --summary=... [--description=...]')}  Create a new ticket  ${s.dim('[Pro]')}`,
+    `    ${s.brand('ticketlens')} create ${s.dim('--project=... [--type=...] --summary=... [--description=...] [--attach=...]')}  Create a new ticket  ${s.dim('[Pro]')}`,
     '',
     `    ${s.brand('ticketlens')} delete ${s.dim('<PROFILE-NAME>')}       Remove a profile`,
     `    ${s.brand('ticketlens')} activate ${s.dim('<KEY>')}              Activate a license key`,
@@ -567,13 +567,20 @@ export function printNoteHelp({ stream = process.stdout } = {}) {
     '',
     `    ${s.dim('$')} echo "Retry needs exponential backoff" | ticketlens note add --title="Retry gotcha" --ticket=PROD-123 --tags=bug`,
     '',
-    `  ${s.bold('ticketlens note patch')} ${s.dim('--id="..." [--ticket=KEY]')}  ${s.dim('[Pro]')}`,
+    `  ${s.bold('ticketlens note patch')} ${s.dim('--id="..." [--ticket=KEY] [--expect-mtime=MS]')}  ${s.dim('[Pro]')}`,
     '',
     `  Overwrites an existing note's body with a better draft, read from stdin.`,
     `  Internal mechanism used by the jtb skill's note quality loop inside a Claude`,
     `  Code session — not typically invoked by hand. Every note it writes gets the`,
     `  same structural and secret-scan checks ${s.brand('note add')} applies to user input.`,
     '',
+    `  ${s.bold('OPTIONS')}`,
+    '',
+    `    ${s.brand('--id')}=${s.dim('ID')}             Note id to patch ${s.dim('(required)')}`,
+    `    ${s.brand('--ticket')}=${s.dim('KEY')}         Ticket this note is about ${s.dim('(optional)')}`,
+    `    ${s.brand('--expect-mtime')}=${s.dim('MS')}    File mtime (ms) the caller last observed ${s.dim('(optional)')} — a no-op,`,
+    `                          not an overwrite, if the file changed since then`,
+    '',
     `  ${s.bold('ticketlens note delete')} ${s.dim('--id="..." [--ticket=KEY] [--yes]')}  ${s.dim('[Pro]')}`,
     '',
     `  Removes a note from your local vault. Local only — if this note was already`,
@@ -646,6 +653,10 @@ export function printMcpHelp({ stream = process.stdout } = {}) {
     `  ${s.dim('restart or reconnect the MCP client to pick up the new schema. The running')}`,
     `  ${s.dim('server is always current; only the client-side copy goes stale.')}`,
     '',
+    `  ${s.dim('The [Pro] badge above describes the tools this server exposes — starting the')}`,
+    `  ${s.dim('server itself is ungated, same as `mcp install`; each tool still enforces its')}`,
+    `  ${s.dim('own license check at call time.')}`,
+    '',
     `  ${s.bold('OPTIONS')}`,
     '',
     `    ${s.brand('-h')}, ${s.brand('--help')}   Show this help`,
@@ -976,6 +987,7 @@ export function printTriageHelp({ stream = process.stdout } = {}) {
     `    ${s.brand('--digest')}           POST scored results to digest endpoint  ${s.dim('[Pro]')}`,
     `    ${s.brand('--static')}           Static table output ${s.dim('(skip interactive mode)')}`,
     `    ${s.brand('--plain')}            Plain markdown output`,
+    `    ${s.brand('--styled')}           Force ANSI-styled output ${s.dim('(even when piped)')}`,
     `    ${s.brand('-h')}, ${s.brand('--help')}         Show this help`,
     '',
     `  ${s.bold('EXAMPLES')}`,

package/skills/jtb/scripts/lib/mcp-server.mjs

@@ -36,7 +36,7 @@ const TOOLS = [
       properties: {
         title: { type: 'string', description: 'Short one-line title.' },
         ticket: { type: 'string', description: 'Optional ticket key, e.g. PROJ-123.' },
-        tags: { type: 'array', items: { type: 'string' }, description: 'Optional tags derived from this note\'s actual content — the specific technology, error type, root cause, or affected component (e.g. "retry-backoff", "null-pointer", "auth-middleware"). Never the project name or a generic category word like "gotcha" or "bug" — those provide no search signal to someone else looking for this note later.' },
+        tags: { type: 'array', items: { type: 'string' }, description: 'Optional tags derived from this note\'s actual content — the specific technology, error type, root cause, or affected component (e.g. "retry-backoff", "null-pointer", "auth-middleware"). Never the project name or a generic category word like "gotcha" or "bug" — those provide no search signal to someone else looking for this note later. A tag that just restates the title in different words, or one you cannot trace to a specific sentence in the body, gives that same zero signal — if you cannot point to the exact phrase that justifies it, drop it.' },
         body: { type: 'string', description: 'The note body — one or more paragraphs.' },
       },
       required: ['title', 'body'],
@@ -119,7 +119,7 @@ const TOOLS = [
   },
   {
     name: 'ticket_update',
-    description: 'Update a narrow, named field set on a ticket in its tracker (Jira/GitHub/Linear) — title, description, labels, priority. Labels are add/remove, never a wholesale replace: an unnamed existing label is left alone. No discovery step and no confirm required — these are reversible metadata edits, not workflow-state changes. GitHub has no priority field; passing `priority` for a GitHub-tracked ticket is refused. A call can partially succeed (e.g. title updates but a label does not resolve) — the result reports exactly what landed. Requires a TicketLens Pro license.',
+    description: 'Update a narrow, named field set on a ticket in its tracker (Jira/GitHub/Linear) — title, description, labels, priority. At least one field is required. Labels are add/remove, never a wholesale replace: an unnamed existing label is left alone. No discovery step and no confirm required — these are reversible metadata edits, not workflow-state changes. GitHub has no priority field; passing `priority` for a GitHub-tracked ticket is refused. A call can partially succeed (e.g. title updates but a label does not resolve) — the result reports exactly what landed. Requires a TicketLens Pro license.',
     inputSchema: {
       type: 'object',
       properties: {
@@ -245,13 +245,13 @@ async function callTicketTransition(args, { configDir, runTicketTransitionListFn
   }
   const capture = capturingStream();
   if (!args.target) {
-    const { ok } = await runTicketTransitionListFn([args.ticket], { configDir, stream: capture });
+    const { ok } = await runTicketTransitionListFn([args.ticket], { configDir, stream: capture, cliHints: false });
     const content = [{ type: 'text', text: capture.text }];
     return ok ? { content } : { isError: true, content };
   }
   const cmdArgs = [args.ticket, `--target=${args.target}`];
   if (args.confirm === true) cmdArgs.push('--confirm');
-  const { ok } = await runTicketTransitionFn(cmdArgs, { configDir, stream: capture });
+  const { ok } = await runTicketTransitionFn(cmdArgs, { configDir, stream: capture, cliHints: false });
   const content = [{ type: 'text', text: capture.text }];
   return ok ? { content } : { isError: true, content };
 }
@@ -296,13 +296,13 @@ async function callTicketLink(args, { configDir, runTicketLinkListFn, runTicketL
   }
   const capture = capturingStream();
   if (!args.type) {
-    const { ok } = await runTicketLinkListFn([args.ticket, args.target], { configDir, stream: capture });
+    const { ok } = await runTicketLinkListFn([args.ticket, args.target], { configDir, stream: capture, cliHints: false });
     const content = [{ type: 'text', text: capture.text }];
     return ok ? { content } : { isError: true, content };
   }
   const cmdArgs = [args.ticket, args.target, `--type=${args.type}`];
   if (args.confirm === true) cmdArgs.push('--confirm');
-  const { ok } = await runTicketLinkFn(cmdArgs, { configDir, stream: capture });
+  const { ok } = await runTicketLinkFn(cmdArgs, { configDir, stream: capture, cliHints: false });
   const content = [{ type: 'text', text: capture.text }];
   return ok ? { content } : { isError: true, content };
 }

package/skills/jtb/scripts/lib/note-command.mjs

@@ -11,7 +11,7 @@ import { DEFAULT_CONFIG_DIR } from './config.mjs';
 import { isLicensed, showUpgradePrompt } from './license.mjs';
 import { scanForSecrets } from './secret-scanner.mjs';
 import { checkNoteStructure } from './note-structural-check.mjs';
-import { writeNote, patchNoteBody, deleteNote, rebuildIndex } from './recall-vault.mjs';
+import { writeNote, patchNoteBody, deleteNote, deleteNoteAnyPrefix, rebuildIndex } from './recall-vault.mjs';
 import { readCliToken } from './cli-auth.mjs';
 import { pushNote } from './recall-sync.mjs';
 import { enqueueNote, isRetryableFailure, maybeAutoFlush } from './recall-queue.mjs';
@@ -230,6 +230,7 @@ export async function runNoteDelete(cmdArgs, {
   stdin = process.stdin,
   isLicensedFn = isLicensed,
   deleteNoteFn = deleteNote,
+  deleteNoteAnyPrefixFn = deleteNoteAnyPrefix,
   rebuildIndexFn = rebuildIndex,
   confirmFn = confirmDestructive,
 } = {}) {
@@ -257,7 +258,9 @@ export async function runNoteDelete(cmdArgs, {
     return { deleted: false };
   }
 
-  const { deleted, prefix } = deleteNoteFn({ external_id: id, tickets: ticketKey ? [ticketKey] : [] }, { configDir });
+  const { deleted, prefix } = ticketKey
+    ? deleteNoteFn({ external_id: id, tickets: [ticketKey] }, { configDir })
+    : deleteNoteAnyPrefixFn(id, { configDir });
   if (deleted) rebuildIndexFn(prefix, { configDir });
   stream.write(deleted
     ? `  Deleted note (${id}) — local vault only; see help for team-synced notes.\n`

package/skills/jtb/scripts/lib/recall-command.mjs

@@ -17,7 +17,7 @@ import { listNotes } from './recall-vault.mjs';
 import { readCliToken } from './cli-auth.mjs';
 import { pullNotes } from './recall-sync.mjs';
 import { maybeAutoFlush, flushQueue, readQueue } from './recall-queue.mjs';
-import { getEffectiveRecallSettings } from './recall-settings-sync.mjs';
+import { getEffectiveRecallSettingsWithSource } from './recall-settings-sync.mjs';
 import { styleRecallResults } from './styled-assembler.mjs';
 
 /**
@@ -98,6 +98,13 @@ export async function runRecallSync(cmdArgs, {
   return { ok: true };
 }
 
+// Keyed by the `source` getEffectiveRecallSettingsWithSource reports.
+const SOURCE_LABELS = {
+  'no-token': 'platform default — log in to pick up a team override',
+  'live': 'your team manager (or platform default if unset), fetched live just now',
+  'cache-fallback': 'last known-good cached value — live fetch failed, could be stale',
+};
+
 /**
  * Implements `tl recall settings` — read-only display of the effective
  * Recall queue settings (flush cooldown, per-request timeout, max queue
@@ -114,7 +121,7 @@ export async function runRecallSettings(cmdArgs, {
   stream = process.stdout,
   isLicensedFn = isLicensed,
   readCliTokenFn = readCliToken,
-  getEffectiveRecallSettingsFn = getEffectiveRecallSettings,
+  getEffectiveRecallSettingsWithSourceFn = getEffectiveRecallSettingsWithSource,
 } = {}) {
   if (!isLicensedFn('pro', configDir)) {
     showUpgradePrompt('pro', 'ticketlens recall', { stream });
@@ -122,13 +129,12 @@ export async function runRecallSettings(cmdArgs, {
   }
 
   const cliToken = readCliTokenFn(configDir);
-  const settings = await getEffectiveRecallSettingsFn({ cliToken, configDir });
-  const source = cliToken ? 'your team manager (or platform default if unset)' : 'platform default — log in to pick up a team override';
+  const { values: settings, source } = await getEffectiveRecallSettingsWithSourceFn({ cliToken, configDir });
 
   stream.write(`  Retry cooldown:      ${settings.flush_cooldown_ms / 60_000} min\n`);
   stream.write(`  Per-request timeout: ${settings.timeout_ms / 1_000} sec\n`);
   stream.write(`  Max queued notes:    ${settings.max_queue_size}\n`);
   stream.write(`  Queued note expiry:  ${settings.max_entry_age_ms / 86_400_000} days\n`);
-  stream.write(`  Source: ${source}\n`);
+  stream.write(`  Source: ${SOURCE_LABELS[source]}\n`);
   return { ok: true };
 }

package/skills/jtb/scripts/lib/recall-settings-sync.mjs

@@ -136,23 +136,29 @@ export async function fetchRecallSettings({
  * with a hash of cliToken so a later account switch never serves a stale
  * team's settings as a "fallback."
  *
+ * Also reports how the values were obtained, which `recall settings` needs
+ * for an accurate "Source:" line — cliToken presence alone can't tell those
+ * apart, since a live fetch and a silent cache fallback both had a token but
+ * only one is actually current. Callers that don't care use the values-only
+ * getEffectiveRecallSettings below.
+ *
  * @param {object} opts
  * @param {string} [opts.cliToken]
  * @param {string} [opts.configDir]
  * @param {() => number} [opts.now]
  * @param {Function} [opts.fetchRecallSettingsFn]
- * @returns {Promise<{flush_cooldown_ms: number, timeout_ms: number, max_queue_size: number, max_entry_age_ms: number}>}
+ * @returns {Promise<{values: object, source: 'no-token'|'live'|'cache-fallback'}>}
  */
-export async function getEffectiveRecallSettings({
+export async function getEffectiveRecallSettingsWithSource({
   cliToken,
   configDir = DEFAULT_CONFIG_DIR,
   now = () => Date.now(),
   fetchRecallSettingsFn = fetchRecallSettings,
 } = {}) {
-  if (!cliToken) return readEffectiveRecallSettings(configDir);
+  if (!cliToken) return { values: readEffectiveRecallSettings(configDir), source: 'no-token' };
 
   const result = await fetchRecallSettingsFn({ cliToken });
-  if (!result.ok) return readEffectiveRecallSettings(configDir, { cliToken });
+  if (!result.ok) return { values: readEffectiveRecallSettings(configDir, { cliToken }), source: 'cache-fallback' };
 
   writeFileAtomically(cachePath(configDir), JSON.stringify({
     values: result.values,
@@ -164,5 +170,17 @@ export async function getEffectiveRecallSettings({
   for (const field of Object.keys(DEFAULT_RECALL_SETTINGS)) {
     effective[field] = clamp(field, result.values[field]);
   }
-  return effective;
+  return { values: effective, source: 'live' };
+}
+
+/**
+ * Values-only view of the same resolution — the contract every caller other
+ * than `recall settings` (recall-queue.mjs) uses.
+ *
+ * @param {object} opts - same as getEffectiveRecallSettingsWithSource
+ * @returns {Promise<{flush_cooldown_ms: number, timeout_ms: number, max_queue_size: number, max_entry_age_ms: number}>}
+ */
+export async function getEffectiveRecallSettings(opts = {}) {
+  const { values } = await getEffectiveRecallSettingsWithSource(opts);
+  return values;
 }

package/skills/jtb/scripts/lib/recall-vault.mjs

@@ -164,6 +164,36 @@ export function deleteNote({ external_id: externalId, tickets = [] }, { configDi
   return { deleted: true, prefix };
 }
 
+/**
+ * Deletes a note when the caller doesn't know (or a CLI user didn't specify)
+ * which ticket-prefix folder it lives in — used only by `note delete` when
+ * --ticket is omitted. Unlike deleteNote, which resolves a single
+ * deterministic path from tickets[0] (required for tombstone processing to
+ * stay exact — a tombstone's tickets:[] genuinely means "this note has no
+ * ticket," not "unknown"), this searches every existing prefix folder, the
+ * same "no prefix given" fallback listNotes already uses below. _general is
+ * tried first since that's where a truly general note lives.
+ *
+ * @param {string} externalId
+ * @param {{ configDir?: string }} [opts]
+ * @returns {{ deleted: boolean, prefix: string|null }}
+ */
+export function deleteNoteAnyPrefix(externalId, { configDir = DEFAULT_CONFIG_DIR } = {}) {
+  if (!EXTERNAL_ID_PATTERN.test(externalId)) {
+    throw new Error(`Invalid externalId: "${externalId}"`);
+  }
+
+  const prefixes = [GENERAL_BUCKET, ...allPrefixDirs(configDir).filter(p => p !== GENERAL_BUCKET)];
+  for (const prefix of prefixes) {
+    const notePath = path.join(prefixDir(configDir, prefix), externalId);
+    if (fs.existsSync(notePath)) {
+      fs.unlinkSync(notePath);
+      return { deleted: true, prefix };
+    }
+  }
+  return { deleted: false, prefix: null };
+}
+
 /**
  * Overwrites an existing local note's body in place — used by the jtb skill's
  * generator/validator quality loop to swap in a better draft after `note add`

package/skills/jtb/scripts/lib/run-stats.mjs

@@ -1,5 +1,5 @@
 import { computeResponseMetrics, DEFAULT_CONFIG_DIR } from './triage-history.mjs';
-import { loadProfiles } from './profile-resolver.mjs';
+import { resolveConnection } from './profile-resolver.mjs';
 import { isLicensed as defaultIsLicensed } from './license.mjs';
 import { createStyler } from './ansi.mjs';
 import { handleUnknownFlags } from './arg-validator.mjs';
@@ -51,12 +51,11 @@ export async function runStats(args = [], opts = {}) {
   const isPro = isLic('pro', configDir);
   const days  = (!isPro && parsedDays > FREE_DAYS_CAP) ? FREE_DAYS_CAP : parsedDays;
 
-  // Resolve profile name
-  let profile = profileArg ? profileArg.split('=')[1] : null;
-  if (!profile) {
-    const config = loadProfiles(configDir);
-    profile = config?.default ?? 'default';
-  }
+  // Resolve profile name (same chain as triage: --profile flag → cwd projectPaths → config.default)
+  const explicitProfile = profileArg ? profileArg.split('=')[1] : undefined;
+  const cwd = opts.cwd ?? process.cwd();
+  const conn = resolveConnection(null, { configDir, profileName: explicitProfile, cwd });
+  const profile = conn.profileName ?? 'default';
 
   let metrics;
   try {

package/skills/jtb/scripts/lib/secret-scanner.mjs

@@ -142,19 +142,31 @@ function isLabelWord(token) {
  * Rejoins runs of adjacent whitespace-separated tokens (no separator) so a secret
  * broken up by whitespace — accidental soft-wrap, or a deliberate space/tab/
  * newline inserted to dodge the scanner — still reads as one contiguous string.
- * A run only stops at a label word (see isLabelWord), so a real context word
- * like "commit" can't glue onto an unrelated payload.
+ *
+ * `stopAtLabelWords` (the default) ends a run at a label word (see isLabelWord),
+ * so a real context word like "commit" can't glue onto an unrelated payload and
+ * trip the entropy heuristic. Pass false for the HARD_REJECT_PATTERNS pass: those
+ * match an exact literal prefix (AKIA, sk-, ghp_, eyJ, -----BEGIN) rather than
+ * guessing from shape, so ordinary prose can't turn into a false positive there —
+ * and a fixed secret prefix can itself look like an ordinary word to isLabelWord
+ * ("AKIA" is indistinguishable from an acronym by that heuristic), which would
+ * otherwise stop it from ever rejoining with a whitespace-split suffix.
+ *
+ * Either way a run only ever extends forward from its own start index, so a word
+ * standing immediately *before* a secret is never glued onto it — that's what
+ * keeps the leading \b anchor in the boundary-anchored patterns intact.
  *
  * @param {string[]} tokens
+ * @param {{ stopAtLabelWords?: boolean }} [opts]
  * @returns {string[]}
  */
-function joinedChunkRuns(tokens) {
+function joinedChunkRuns(tokens, { stopAtLabelWords = true } = {}) {
   const runs = [];
   for (let i = 0; i < tokens.length; i++) {
-    if (isLabelWord(tokens[i])) continue;
+    if (stopAtLabelWords && isLabelWord(tokens[i])) continue;
     let joined = tokens[i];
     for (let j = i + 1; j < Math.min(tokens.length, i + MAX_JOINED_CHUNKS); j++) {
-      if (isLabelWord(tokens[j])) break;
+      if (stopAtLabelWords && isLabelWord(tokens[j])) break;
       joined += tokens[j];
       runs.push(joined);
     }
@@ -171,19 +183,34 @@ export function scanForSecrets({ title = '', tags = [], body = '' } = {}) {
   const reasons = [];
   const warnings = [];
 
+  const tokens = combined.split(/\s+/).filter(Boolean);
+  const candidates = [...tokens, ...joinedChunkRuns(tokens)];
+
   // A known secret shape (AWS key, API key prefix, JWT, PEM block...) is recognized
-  // by a specific literal prefix, so it's safe to also check a fully whitespace-
-  // stripped variant of the text — a stray space/tab/newline dropped into the
-  // secret (soft-wrap or deliberate evasion) can't hide it from its own shape.
+  // by a specific literal prefix. Checked three ways, each catching what the
+  // others miss:
+  //   1. combined            — the unsplit occurrence.
+  //   2. hardRejectRuns      — each individually rejoined run (bounded to
+  //      MAX_JOINED_CHUNKS tokens), which keeps the leading \b anchor intact
+  //      for the two boundary-anchored patterns (API key, GitHub token) —
+  //      stripping whitespace from the whole note at once would instead glue
+  //      an unrelated preceding word onto the secret's first character and
+  //      kill that anchor. This is the primary, anchor-safe check.
+  //   3. despacedCombined    — the whole note with all whitespace stripped,
+  //      unbounded in length. A fallback for fragmentation wider than
+  //      MAX_JOINED_CHUNKS tokens (e.g. a secret typed one character per
+  //      token) that #2's bounded window can't reach. Reintroduces the same
+  //      anchor risk #2 was built to avoid, but only as an additional check
+  //      alongside #2, never instead of it — it can only add a detection
+  //      that #1/#2 missed, never remove one they already caught.
   const despacedCombined = combined.replace(/\s+/g, '');
+  const hardRejectRuns = joinedChunkRuns(tokens, { stopAtLabelWords: false });
   for (const { name, re } of HARD_REJECT_PATTERNS) {
-    if (re.test(combined) || re.test(despacedCombined)) {
+    if (re.test(combined) || hardRejectRuns.some(c => re.test(c)) || re.test(despacedCombined)) {
       reasons.push(`Looks like a${/^[aeiou]/i.test(name) ? 'n' : ''} ${name}.`);
     }
   }
 
-  const tokens = combined.split(/\s+/).filter(Boolean);
-  const candidates = [...tokens, ...joinedChunkRuns(tokens)];
   // A candidate containing a real email address is skipped: with ordinary words
   // now eligible to join (needed to catch e.g. "wall"-separated or base64-letter-
   // only split secrets), an email joined with an adjacent word can produce a long

package/skills/jtb/scripts/lib/ticket-command.mjs

@@ -311,6 +311,9 @@ export async function runTicketComment(cmdArgs, {
  * transition options for the ticket.
  *
  * @param {string[]} cmdArgs - [ticketKey]
+ * @param {boolean} [cliHints] - true (default) prints CLI flag syntax
+ *   (--target=, --confirm) in the hint; false prints MCP-shaped named-arg
+ *   wording instead — set by mcp-server.mjs's ticket_transition call sites.
  * @returns {Promise<{ ok: boolean, options?: object[] }>}
  */
 export async function runTicketTransitionList(cmdArgs, {
@@ -319,6 +322,7 @@ export async function runTicketTransitionList(cmdArgs, {
   isLicensedFn = isLicensed,
   resolveConnectionFn = resolveConnection,
   resolveAdapterFn = resolveAdapter,
+  cliHints = true,
 } = {}) {
   const usage = 'Usage: ticketlens transition TICKET-KEY [--target="..." --confirm]\n';
   if (!requireLicense(isLicensedFn, configDir, 'ticketlens transition', stream)) return { ok: false };
@@ -338,7 +342,9 @@ export async function runTicketTransitionList(cmdArgs, {
     }
     stream.write(`  Valid transitions for ${s.brand(s.bold(ticketKey))}:\n\n`);
     for (const o of options) stream.write(`    ${s.brand('●')} ${o.name}\n`);
-    stream.write(`\n  Run again with --target="<name>" --confirm to execute.\n`);
+    stream.write(cliHints
+      ? `\n  Run again with --target="<name>" --confirm to execute.\n`
+      : `\n  Call again with target="<name>" and confirm: true to execute.\n`);
     return { ok: true, options };
   } catch (err) {
     stream.write(formatWriteFailure(ticketKey, err));
@@ -351,6 +357,7 @@ export async function runTicketTransitionList(cmdArgs, {
  * without --confirm is treated as incomplete input, never silently executed.
  *
  * @param {string[]} cmdArgs - [ticketKey, '--target=...', '--confirm']
+ * @param {boolean} [cliHints] - see runTicketTransitionList's cliHints doc
  * @returns {Promise<{ ok: boolean, reason?: string }>}
  */
 export async function runTicketTransition(cmdArgs, {
@@ -363,6 +370,7 @@ export async function runTicketTransition(cmdArgs, {
   recordActionFn = recordAction,
   logActionFn = logAction,
   actor = os.userInfo().username,
+  cliHints = true,
 } = {}) {
   const usage = 'Usage: ticketlens transition TICKET-KEY --target="..." --confirm\n';
   if (!requireLicense(isLicensedFn, configDir, 'ticketlens transition', stream)) return { ok: false };
@@ -376,7 +384,9 @@ export async function runTicketTransition(cmdArgs, {
     return { ok: false };
   }
   if (!cmdArgs.includes('--confirm')) {
-    stream.write(`  Refusing to transition ${ticketKey} to "${target}" without --confirm. Re-run with --confirm once you've reviewed the target.\n`);
+    stream.write(cliHints
+      ? `  Refusing to transition ${ticketKey} to "${target}" without --confirm. Re-run with --confirm once you've reviewed the target.\n`
+      : `  Refusing to transition ${ticketKey} to "${target}" without confirm: true. Call again with confirm: true once you've reviewed the target.\n`);
     return { ok: false };
   }
 
@@ -552,6 +562,7 @@ export async function runTicketDuplicates(cmdArgs, {
  * so that asymmetry is surfaced here before a caller ever reaches --confirm.
  *
  * @param {string[]} cmdArgs - [sourceKey, targetKey]
+ * @param {boolean} [cliHints] - see runTicketTransitionList's cliHints doc
  * @returns {Promise<{ ok: boolean, types?: string[] }>}
  */
 export async function runTicketLinkList(cmdArgs, {
@@ -560,6 +571,7 @@ export async function runTicketLinkList(cmdArgs, {
   isLicensedFn = isLicensed,
   resolveConnectionFn = resolveConnection,
   resolveAdapterFn = resolveAdapter,
+  cliHints = true,
 } = {}) {
   const usage = 'Usage: ticketlens link SOURCE-KEY TARGET-KEY [--type="..." --confirm]\n';
   if (!requireLicense(isLicensedFn, configDir, 'ticketlens link', stream)) return { ok: false };
@@ -585,7 +597,9 @@ export async function runTicketLinkList(cmdArgs, {
     if (adapter.type === 'github') {
       stream.write(`  Note: GitHub has no generic link relationship — linking will CLOSE ${sourceKey} as a duplicate of ${targetKey}.\n`);
     }
-    stream.write(`  Run again with --type="<name>" --confirm to execute — ${sourceKey} will be recorded as the one that "types" ${targetKey}.\n`);
+    stream.write(cliHints
+      ? `  Run again with --type="<name>" --confirm to execute — ${sourceKey} will be recorded as the one that "types" ${targetKey}.\n`
+      : `  Call again with type="<name>" and confirm: true to execute — ${sourceKey} will be recorded as the one that "types" ${targetKey}.\n`);
     return { ok: true, types };
   } catch (err) {
     stream.write(formatLinkListFailure(sourceKey, err));
@@ -602,6 +616,7 @@ export async function runTicketLinkList(cmdArgs, {
  * anything else) with targetKey/type carried in detail instead.
  *
  * @param {string[]} cmdArgs - [sourceKey, targetKey, '--type=...', '--confirm']
+ * @param {boolean} [cliHints] - see runTicketTransitionList's cliHints doc
  * @returns {Promise<{ ok: boolean, reason?: string }>}
  */
 export async function runTicketLink(cmdArgs, {
@@ -614,6 +629,7 @@ export async function runTicketLink(cmdArgs, {
   recordActionFn = recordAction,
   logActionFn = logAction,
   actor = os.userInfo().username,
+  cliHints = true,
 } = {}) {
   const usage = 'Usage: ticketlens link SOURCE-KEY TARGET-KEY --type="..." --confirm\n';
   if (!requireLicense(isLicensedFn, configDir, 'ticketlens link', stream)) return { ok: false };
@@ -629,7 +645,9 @@ export async function runTicketLink(cmdArgs, {
     return { ok: false };
   }
   if (!cmdArgs.includes('--confirm')) {
-    stream.write(`  Refusing to link ${sourceKey} to ${targetKey} as "${type}" without --confirm. Re-run with --confirm once you've reviewed the target.\n`);
+    stream.write(cliHints
+      ? `  Refusing to link ${sourceKey} to ${targetKey} as "${type}" without --confirm. Re-run with --confirm once you've reviewed the target.\n`
+      : `  Refusing to link ${sourceKey} to ${targetKey} as "${type}" without confirm: true. Call again with confirm: true once you've reviewed the target.\n`);
     return { ok: false };
   }
 

package/skills/jtb/scripts/lib/triage-history.mjs

@@ -70,7 +70,23 @@ export function saveTriageSnapshot(tickets, {
   const dir = join(configDir, 'triage-history', dateStr);
   fsModule.mkdirSync(dir, { recursive: true });
   const filePath = snapshotPath(configDir, dateStr, profile);
-  const envelope = { captured_at: now.toISOString(), tickets };
+
+  // A same-day re-run (e.g. a narrower, filtered, or exploratory `triage`
+  // invocation after an earlier fuller one) must not silently discard
+  // tickets the earlier run already captured for today — stats/history read
+  // this file as "the" snapshot for the day. The current run's data always
+  // wins for any ticket it covers (freshest known state); a ticket only
+  // present in the earlier snapshot is carried forward untouched.
+  const earlier = loadSnapshotForDate(dateStr, profile, configDir, fsModule);
+  const earlierTickets = Array.isArray(earlier?.tickets) ? earlier.tickets : [];
+  const currentKeys = new Set(tickets.map(t => t.ticketKey));
+  const merged = [...tickets, ...earlierTickets.filter(t => !currentKeys.has(t.ticketKey))];
+
+  // `date` is the same local dateStr the file is stored under — captured_at
+  // stays UTC for precise ordering, but nothing should ever need to infer
+  // "which day" a snapshot belongs to by parsing captured_at, since that can
+  // disagree with the local-date directory name near midnight.
+  const envelope = { captured_at: now.toISOString(), date: dateStr, tickets: merged };
   fsModule.writeFileSync(filePath, JSON.stringify(envelope, null, 2), 'utf8');
 }
 

package/skills/jtb/scripts/lib/triage-push.mjs

@@ -73,6 +73,9 @@ export async function pushTriageSnapshot({
       tickets = tickets.map(t => {
         const entry = latestByKey.get(t.key);
         if (!entry) return t;
+        if (entry.noCriteria) {
+          return { ...t, compliance_coverage: null, compliance_status: 'no-criteria' };
+        }
         return {
           ...t,
           compliance_coverage: entry.coverage ?? null,