ticketlens 0.38.12 → 0.38.14

package/bin/ticketlens.mjs

@@ -13,6 +13,7 @@ import { run as runFetch } from '../skills/jtb/scripts/fetch-ticket.mjs';
 import { run as runTriage } from '../skills/jtb/scripts/fetch-my-tickets.mjs';
 import { run as runInit } from '../skills/jtb/scripts/lib/init-wizard.mjs';
 import { runSwitch } from '../skills/jtb/scripts/lib/profile-switcher.mjs';
+import { runProfilesSetTeam } from '../skills/jtb/scripts/lib/profile-set-team.mjs';
 import { run as runConfig } from '../skills/jtb/scripts/lib/config-wizard.mjs';
 import { activateLicense, checkLicense, revalidateIfStale, isLicensed, showUpgradePrompt, readLicense } from '../skills/jtb/scripts/lib/license.mjs';
 import { deleteProfile, loadProfiles, saveCredentialKey } from '../skills/jtb/scripts/lib/profile-resolver.mjs';
@@ -34,7 +35,7 @@ import { runStats } from '../skills/jtb/scripts/lib/run-stats.mjs';
 import { createStyler } from '../skills/jtb/scripts/lib/ansi.mjs';
 import { readCliToken, deleteCliToken } from '../skills/jtb/scripts/lib/cli-auth.mjs';
 import { runLogin } from '../skills/jtb/scripts/lib/login-flow.mjs';
-import { syncProfiles, reportSyncResult, getApiBase } from '../skills/jtb/scripts/lib/sync.mjs';
+import { syncProfiles, reportSyncResult, getApiBase, checkTeamMembershipUpdate } from '../skills/jtb/scripts/lib/sync.mjs';
 import { checkForUpdate, getUpdateHint } from '../skills/jtb/scripts/lib/update-check.mjs';
 import { incrementInvocation, incrementCommand } from '../skills/jtb/scripts/lib/activity-counter.mjs';
 import { DEFAULT_CONFIG_DIR } from '../skills/jtb/scripts/lib/config.mjs';
@@ -100,6 +101,7 @@ switch (command) {
   case 'fetch': {
     // Flow 2: fire team config check concurrently; banner shown after brief output
     const _teamCheck = checkTeamJiraConfigUpdate().catch(() => null);
+    const _membershipCheck = checkTeamMembershipUpdate().catch(() => null);
     runFetch(cmdArgs).then(async () => {
       const tcResult = await _teamCheck;
       if (tcResult?.banner) {
@@ -109,6 +111,11 @@ switch (command) {
         const s = createStyler({ isTTY: process.stderr.isTTY });
         process.stderr.write(`\n  ${s.yellow('!')} Team Jira config removed by manager — using local credentials.\n`);
       }
+      const membershipResult = await _membershipCheck;
+      if (membershipResult?.banner) {
+        const s = createStyler({ isTTY: process.stderr.isTTY });
+        process.stderr.write(`\n  ${s.yellow('!')} ${membershipResult.banner}\n`);
+      }
     }).catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
@@ -360,6 +367,22 @@ switch (command) {
 
   case 'profiles': {
     if (cmdArgs.includes('--help') || cmdArgs.includes('-h')) { printProfilesHelp(); break; }
+
+    if (cmdArgs[0] === 'set-team') {
+      const [, profileName, ...teamNameParts] = cmdArgs;
+      const teamName = teamNameParts.length > 0 ? teamNameParts.join(' ') : undefined;
+      if (!profileName) {
+        process.stderr.write('Usage: ticketlens profiles set-team <profile> [team name]\n');
+        process.exitCode = 1;
+        break;
+      }
+      runProfilesSetTeam(profileName, teamName).catch(err => {
+        process.stderr.write(`Error: ${err.message}\n`);
+        process.exitCode = 1;
+      });
+      break;
+    }
+
     const plain = cmdArgs.includes('--plain');
     const config = loadProfiles();
     printProfiles({ config, plain });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ticketlens",
-  "version": "0.38.12",
+  "version": "0.38.14",
   "description": "Jira CLI for developers — fetch ticket context, triage your queue, and stop tab-switching. Zero dependencies, all local.",
   "type": "module",
   "bin": {

package/skills/jtb/scripts/lib/ansi.mjs

@@ -86,5 +86,19 @@ export const brightCyan   = defaultStyler.brightCyan;
 export const brand        = defaultStyler.brand;
 export const isStyled     = () => defaultStyler.enabled;
 
-export const ANSI_RE = /\[[0-9;]*m/g;
+export const ANSI_RE = /\x1b\[[0-9;]*m/g;
 export function stripAnsi(s) { return s.replace(ANSI_RE, ''); }
+
+// Strips ALL C0/C1 control characters and DEL — not just this app's own SGR
+// color codes (stripAnsi above only covers ESC [ ... m, not the broader
+// escape grammar: OSC, cursor movement, etc.). Apply to any server-supplied
+// string before it ever reaches a terminal write — e.g. a Console team name,
+// which is attacker-controlled (any self-registered user's account name)
+// and unfiltered server-side beyond a bare length check.
+export function sanitizeUntrustedText(s) {
+  if (typeof s !== 'string') return '';
+  return Array.from(s).filter((ch) => {
+    const code = ch.codePointAt(0);
+    return !((code >= 0x00 && code <= 0x1f) || (code >= 0x7f && code <= 0x9f));
+  }).join('');
+}

package/skills/jtb/scripts/lib/config-wizard.mjs

@@ -449,7 +449,14 @@ export async function run({ configDir = DEFAULT_CONFIG_DIR, profileName } = {})
   if (isTrustedForCurrentUrl()) updated.allowPrivateIp = true;
   else delete updated.allowPrivateIp;
 
-  const credData = (token !== existingToken)
+  // Also write on an auth-type switch even when the typed token text is
+  // unchanged — a Server/DC PAT can double as a Basic-auth password, so
+  // `basic` -> `pat` with the same secret is a real flow, not contrived.
+  // Gating on token identity alone left the stale old-type field (apiToken
+  // or pat) sitting in credentials.json indefinitely; saveProfile()'s merge
+  // only clears the opposite field when the corresponding new key is
+  // actually present in credData.
+  const credData = (token !== existingToken || auth !== profile.auth)
     ? (auth === 'pat' ? { pat: token } : { apiToken: token })
     : {};
 

package/skills/jtb/scripts/lib/help.mjs

@@ -469,6 +469,13 @@ export function printProfilesHelp({ stream = process.stdout } = {}) {
     `  List all locally configured Jira profiles and their active status.`,
     `  Also available as ${s.cyan('ticketlens ls')}.`,
     '',
+    `  ${s.bold('SUBCOMMANDS')}`,
+    '',
+    `    ${s.brand('set-team')} ${s.dim('<profile> <team name>')}`,
+    `        Route this profile's Recall notes to a specific Console team —`,
+    `        for accounts that belong to more than one team. Validated against`,
+    `        teams synced by ${s.cyan('ticketlens login')}/${s.cyan('ticketlens sync')}, but never blocked by a stale list.`,
+    '',
     `  ${s.bold('OPTIONS')}`,
     '',
     `    ${s.brand('--plain')}          Tab-separated output ${s.dim('(for scripting)')}`,
@@ -479,6 +486,7 @@ export function printProfilesHelp({ stream = process.stdout } = {}) {
     `    ${s.dim('$')} ticketlens profiles`,
     `    ${s.dim('$')} ticketlens ls`,
     `    ${s.dim('$')} ticketlens profiles --plain`,
+    `    ${s.dim('$')} ticketlens profiles set-team advent "Team Manager's Team"`,
     '',
   ];
   stream.write(lines.join('\n') + '\n');

package/skills/jtb/scripts/lib/login-flow.mjs

@@ -10,6 +10,7 @@ import { browserLogin } from './browser-login.mjs';
 import { saveCliToken } from './cli-auth.mjs';
 import { getApiBase, getConsoleBase } from './sync.mjs';
 import { applyTeamConfigOnLogin } from './team-jira-sync.mjs';
+import { saveTeams } from './profile-resolver.mjs';
 
 export async function runLogin({
   manual = false,
@@ -19,6 +20,7 @@ export async function runLogin({
   fetchFn = globalThis.fetch,
   promptSecretFn = promptSecret,
   saveCliTokenFn = saveCliToken,
+  saveTeamsFn = saveTeams,
   applyTeamConfigOnLoginFn = applyTeamConfigOnLogin,
 } = {}) {
   const s = createStyler({ isTTY: stream.isTTY });
@@ -83,12 +85,15 @@ export async function runLogin({
     return;
   }
 
-  let tier;
+  let tier, teams;
   try {
-    tier = (await res.json())?.tier;
-  } catch { /* tier is best-effort — token is still valid */ }
+    const body = await res.json();
+    tier = body?.tier;
+    teams = body?.teams;
+  } catch { /* tier/teams are best-effort — token is still valid */ }
 
   saveCliTokenFn(token, undefined, tier);
+  saveTeamsFn(Array.isArray(teams) ? teams : []);
   stream.write(`\x1b[A\r\x1b[2K  ${s.green('✔')} Logged in.\n`);
 
   // Flow 1: pull team Jira config for Pro/Team members (silently skipped for Free)

package/skills/jtb/scripts/lib/note-command.mjs

@@ -13,6 +13,7 @@ import { scanForSecrets } from './secret-scanner.mjs';
 import { checkNoteStructure } from './note-structural-check.mjs';
 import { writeNote, patchNoteBody, deleteNote, deleteNoteAnyPrefix, rebuildIndex } from './recall-vault.mjs';
 import { readCliToken } from './cli-auth.mjs';
+import { resolveProfile, loadProfileRecallTeamId } from './profile-resolver.mjs';
 import { pushNote } from './recall-sync.mjs';
 import { enqueueNote, isRetryableFailure, maybeAutoFlush } from './recall-queue.mjs';
 import { incrementDraftKept, incrementDraftDeleted } from './activity-counter.mjs';
@@ -73,6 +74,8 @@ export async function runNoteAdd(cmdArgs, {
   scanForSecretsFn = scanForSecrets,
   writeNoteFn = writeNote,
   readCliTokenFn = readCliToken,
+  resolveProfileFn = resolveProfile,
+  loadProfileRecallTeamIdFn = loadProfileRecallTeamId,
   pushNoteFn = pushNote,
   enqueueNoteFn = enqueueNote,
   isRetryableFailureFn = isRetryableFailure,
@@ -139,7 +142,10 @@ export async function runNoteAdd(cmdArgs, {
     const warn = (s) => stream.write(s);
     // Field names match PushRequest's validation rules (external_id, tickets) —
     // the backend wire contract, not the local vault's internal camelCase shape.
+    const profile = resolveProfileFn(ticketKey || null, { configDir, cwd: process.cwd() });
+    const recallTeamId = profile ? loadProfileRecallTeamIdFn(profile.name, configDir) : null;
     const payload = { external_id: id, title, tickets: ticketKeys, tags, author, sources: [], body };
+    if (recallTeamId !== null) payload.group_id = recallTeamId;
     const result = await pushNoteFn(payload, { cliToken, configDir, warn });
     if (isRetryableFailureFn(result)) {
       await enqueueNoteFn(payload, { cliToken, configDir, warn });

package/skills/jtb/scripts/lib/profile-resolver.mjs

@@ -7,6 +7,7 @@ import { readFileSync, writeFileSync, existsSync, statSync, mkdirSync } from 'no
 import { join } from 'node:path';
 import { homedir } from 'node:os';
 import { DEFAULT_CONFIG_DIR } from './config.mjs';
+import { sanitizeUntrustedText } from './ansi.mjs';
 
 /** Simple Levenshtein distance for "did you mean" suggestions. */
 function levenshtein(a, b) {
@@ -24,7 +25,7 @@ function levenshtein(a, b) {
   return dp[m];
 }
 
-function findClosest(input, candidates) {
+export function findClosest(input, candidates) {
   if (candidates.length === 0) return null;
   const lower = input.toLowerCase();
   let best = null;
@@ -55,6 +56,26 @@ export function saveDefault(name, configDir = DEFAULT_CONFIG_DIR) {
   invalidateProfilesCache(configDir);
 }
 
+// Team list synced from /v1/profiles — used to resolve a typed team name to
+// its id in `ticketlens profiles set-team` without a live network call.
+// Not credentials (the resulting recallTeamId is — see saveProfileRecallTeamId).
+export function saveTeams(teams, configDir = DEFAULT_CONFIG_DIR) {
+  mkdirSync(configDir, { recursive: true });
+  const profilesPath = join(configDir, 'profiles.json');
+  const config = loadProfiles(configDir) || { profiles: {} };
+  // A team's name is server-supplied and traces back to another user's own
+  // account name (Group::createForOwner) — unfiltered, attacker-influenceable
+  // text. Sanitized here, at the single write path, so every consumer
+  // (picker, banners, set-team messages) is safe without having to remember to.
+  config.teams = teams.map(t => ({ ...t, name: sanitizeUntrustedText(t.name) }));
+  writeFileSync(profilesPath, JSON.stringify(config, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
+  invalidateProfilesCache(configDir);
+}
+
+export function loadTeams(configDir = DEFAULT_CONFIG_DIR) {
+  return loadProfiles(configDir)?.teams ?? [];
+}
+
 export function saveProfile(name, profileData, credData, configDir = DEFAULT_CONFIG_DIR) {
   mkdirSync(configDir, { recursive: true });
   const profilesPath = join(configDir, 'profiles.json');
@@ -64,12 +85,38 @@ export function saveProfile(name, profileData, credData, configDir = DEFAULT_CON
   if (credData && Object.keys(credData).length > 0) {
     const credPath = join(configDir, 'credentials.json');
     const creds = loadCredentials(configDir);
-    creds[name] = credData;
+    // Merge, not replace — a caller re-saving apiToken/pat must never silently
+    // drop an unrelated field already stored on this profile (e.g. recallTeamId).
+    // But apiToken and pat are mutually exclusive auth methods, never both
+    // active at once — setting one must clear a stale copy of the other, or
+    // switching auth type would leave a rotated/revoked credential sitting
+    // in the sensitive-tier file indefinitely.
+    const merged = { ...(creds[name] || {}), ...credData };
+    if ('apiToken' in credData) delete merged.pat;
+    if ('pat' in credData) delete merged.apiToken;
+    creds[name] = merged;
     writeFileSync(credPath, JSON.stringify(creds, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
   }
   invalidateProfilesCache(configDir);
 }
 
+// recallTeamId lives in credentials.json (not profiles.json) — it's a
+// sensitive association (which specific Console team a specific local
+// profile/folder routes Recall notes to), not the non-secret profile shape
+// that credentials.json's sibling fields (baseUrl, prefixes) already are.
+export function saveProfileRecallTeamId(name, teamId, configDir = DEFAULT_CONFIG_DIR) {
+  mkdirSync(configDir, { recursive: true });
+  const credPath = join(configDir, 'credentials.json');
+  const creds = loadCredentials(configDir);
+  creds[name] = { ...(creds[name] || {}), recallTeamId: teamId };
+  writeFileSync(credPath, JSON.stringify(creds, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
+  invalidateProfilesCache(configDir);
+}
+
+export function loadProfileRecallTeamId(name, configDir = DEFAULT_CONFIG_DIR) {
+  return loadCredentials(configDir)[name]?.recallTeamId ?? null;
+}
+
 export function deleteProfile(name, configDir = DEFAULT_CONFIG_DIR) {
   const profilesPath = join(configDir, 'profiles.json');
   const config = loadProfiles(configDir);

package/skills/jtb/scripts/lib/profile-set-team.mjs

@@ -0,0 +1,69 @@
+/**
+ * ticketlens profiles set-team — maps a local Jira profile to the Console
+ * team its Recall notes should push/pull against. Stores the team's id in
+ * credentials.json (not profiles.json) — this is a sensitive association
+ * (which specific team a specific local profile/folder routes notes to),
+ * distinct from the non-secret profile shape profiles.json already carries.
+ * Resolved against the locally synced team list (refreshed by
+ * `ticketlens login`/`ticketlens sync`) — no live network call here, but
+ * never a blind write either: an unresolvable name errors instead of
+ * storing an id that doesn't exist.
+ */
+import { createStyler } from './ansi.mjs';
+import { loadProfiles, loadTeams, saveProfileRecallTeamId, findClosest } from './profile-resolver.mjs';
+import { promptSelect } from './select-prompt.mjs';
+import { DEFAULT_CONFIG_DIR } from './config.mjs';
+
+export async function runProfilesSetTeam(profileName, teamName, {
+  configDir = DEFAULT_CONFIG_DIR,
+  stream = process.stderr,
+  loadProfilesFn = loadProfiles,
+  loadTeamsFn = loadTeams,
+  saveProfileRecallTeamIdFn = saveProfileRecallTeamId,
+  promptSelectFn = promptSelect,
+} = {}) {
+  const s = createStyler({ isTTY: stream.isTTY });
+  const config = loadProfilesFn(configDir);
+  const profile = config?.profiles?.[profileName];
+
+  if (!profile) {
+    stream.write(`  ${s.red('✖')} No profile named "${profileName}". Run ${s.cyan('ticketlens profiles')} to see available profiles.\n`);
+    process.exitCode = 1;
+    return;
+  }
+
+  const teams = loadTeamsFn(configDir);
+  if (teams.length === 0) {
+    stream.write(`  ${s.red('✖')} No synced teams found. Run ${s.cyan('ticketlens sync')} first.\n`);
+    process.exitCode = 1;
+    return;
+  }
+
+  let team;
+  if (teamName) {
+    team = teams.find(t => t.name === teamName);
+    if (!team) {
+      const suggestion = findClosest(teamName, teams.map(t => t.name));
+      stream.write(`  ${s.red('✖')} "${teamName}" isn't one of your synced teams.\n`);
+      if (suggestion) stream.write(`  ${s.dim('Did you mean')} ${s.cyan(suggestion)}${s.dim('?')}\n`);
+      process.exitCode = 1;
+      return;
+    }
+  } else if (!stream.isTTY) {
+    stream.write(`  ${s.red('✖')} No team specified. Pass a team name, or run this interactively to pick one:\n`);
+    for (const t of teams) stream.write(`    ${s.cyan(t.name)} ${s.dim(`(${t.role})`)}\n`);
+    process.exitCode = 1;
+    return;
+  } else {
+    const items = teams.map(t => ({ label: t.name, sublabel: t.role }));
+    const index = await promptSelectFn(items, { stream });
+    if (index === null) {
+      stream.write(`  ${s.dim('Cancelled.')}\n`);
+      return;
+    }
+    team = teams[index];
+  }
+
+  saveProfileRecallTeamIdFn(profileName, team.id, configDir);
+  stream.write(`  ${s.green('✔')} Recall notes captured under ${s.bold(s.cyan(profileName))} will target ${s.bold(s.cyan(team.name))}.\n`);
+}

package/skills/jtb/scripts/lib/recall-command.mjs

@@ -15,6 +15,7 @@ import { TICKET_KEY_PATTERN } from './cli.mjs';
 import { isLicensed, showUpgradePrompt } from './license.mjs';
 import { listNotes } from './recall-vault.mjs';
 import { readCliToken } from './cli-auth.mjs';
+import { resolveProfile, loadProfileRecallTeamId } from './profile-resolver.mjs';
 import { pullNotes } from './recall-sync.mjs';
 import { maybeAutoFlush, flushQueue, readQueue } from './recall-queue.mjs';
 import { getEffectiveRecallSettingsWithSource } from './recall-settings-sync.mjs';
@@ -31,6 +32,8 @@ export async function runRecall(cmdArgs, {
   isLicensedFn = isLicensed,
   listNotesFn = listNotes,
   readCliTokenFn = readCliToken,
+  resolveProfileFn = resolveProfile,
+  loadProfileRecallTeamIdFn = loadProfileRecallTeamId,
   pullNotesFn = pullNotes,
   maybeAutoFlushFn = maybeAutoFlush,
 } = {}) {
@@ -45,13 +48,17 @@ export async function runRecall(cmdArgs, {
     return { ok: false };
   }
 
+  const isTicketKey = TICKET_KEY_PATTERN.test(arg);
+
   const cliToken = readCliTokenFn(configDir);
   if (cliToken) {
-    await pullNotesFn({ cliToken, configDir, ttlMs: 0 });
+    const profile = resolveProfileFn(isTicketKey ? arg : null, { configDir, cwd: process.cwd() });
+    const recallTeamId = profile ? loadProfileRecallTeamIdFn(profile.name, configDir) : null;
+    await pullNotesFn({ cliToken, configDir, ttlMs: 0, groupId: recallTeamId ?? undefined });
     await maybeAutoFlushFn({ cliToken, configDir });
   }
 
-  const filter = TICKET_KEY_PATTERN.test(arg) ? { ticketKey: arg } : { query: arg };
+  const filter = isTicketKey ? { ticketKey: arg } : { query: arg };
   const results = listNotesFn(filter, { configDir });
 
   const styled = !cmdArgs.includes('--plain') && !!stream.isTTY;

package/skills/jtb/scripts/lib/recall-sync.mjs

@@ -78,6 +78,21 @@ function writeEntitlementCheckedAt(configDir, isoTimestamp, cliToken) {
   }
 }
 
+// Shared by pushNote's and pullNotes' 422 handling — a profile's configured
+// recallTeamId that no longer matches any of this account's Console teams
+// (team deleted, or the account was removed from it) must never silently
+// drop a note or return zero pull results; both retry once against the
+// account's default team instead.
+async function isUnknownTeamRejection(res) {
+  let reason;
+  try { reason = (await res.json())?.error; } catch { /* not this case — fall through */ }
+  return reason === 'Unknown team';
+}
+
+function warnUnknownTeam(warn, groupId, fallbackAction) {
+  warn(`  ${yellow('⚠')} Team #${groupId} isn't a team on your account — ${fallbackAction} instead.\n  ${dim('→ Run')} ${cyan('ticketlens profiles set-team')} ${dim('to fix this profile\'s team mapping.')}\n`);
+}
+
 /**
  * POSTs one locally-authored note to the team backend.
  *
@@ -116,23 +131,25 @@ export async function pushNote(note, {
 
   warnIfInsecure(apiBase(), warn);
 
+  const post = (payload) => fetcher(`${apiBase()}${PUSH_PATH}`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Accept': 'application/json',
+      'Authorization': `Bearer ${cliToken}`,
+    },
+    body: JSON.stringify(payload),
+    // Without Accept: application/json, a Laravel validation failure 302-redirects
+    // instead of returning JSON, and fetch's default redirect:'follow' silently
+    // turns that into a followed 200 — a false "pushed" the user never sees fail.
+    // 'manual' makes any unexpected redirect surface as a non-ok response instead.
+    redirect: 'manual',
+    signal: AbortSignal.timeout(timeoutMs),
+  });
+
   let res;
   try {
-    res = await fetcher(`${apiBase()}${PUSH_PATH}`, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        'Accept': 'application/json',
-        'Authorization': `Bearer ${cliToken}`,
-      },
-      body: JSON.stringify(note),
-      // Without Accept: application/json, a Laravel validation failure 302-redirects
-      // instead of returning JSON, and fetch's default redirect:'follow' silently
-      // turns that into a followed 200 — a false "pushed" the user never sees fail.
-      // 'manual' makes any unexpected redirect surface as a non-ok response instead.
-      redirect: 'manual',
-      signal: AbortSignal.timeout(timeoutMs),
-    });
+    res = await post(note);
   } catch {
     warn(`  ${yellow('⚠')} Could not sync note to your team (network error) — saved locally and queued to retry automatically.\n`);
     return { ok: false };
@@ -166,6 +183,19 @@ export async function pushNote(note, {
     return { ok: false, status: res.status };
   }
 
+  if (res.status === 422 && note.group_id !== undefined && await isUnknownTeamRejection(res)) {
+    warnUnknownTeam(warn, note.group_id, 'saved to your default team');
+    const { group_id: _omit, ...withoutGroup } = note;
+    let retryRes;
+    try {
+      retryRes = await post(withoutGroup);
+    } catch {
+      warn(`  ${yellow('⚠')} Could not sync note to your team (network error) — saved locally and queued to retry automatically.\n`);
+      return { ok: false };
+    }
+    return retryRes.ok ? { ok: true, status: retryRes.status } : { ok: false, status: retryRes.status };
+  }
+
   warn(`  ${yellow('⚠')} Could not sync note to your team (${res.status}) — saved locally only.\n`);
   return { ok: false, status: res.status };
 }
@@ -183,7 +213,9 @@ export async function pushNote(note, {
  * @param {string}   [opts.configDir]
  * @param {number}   [opts.ttlMs] - skip the network call if the last pull is more recent than this
  * @param {number}   [opts.timeoutMs] - request timeout; short for a passive/background pull, long for an explicit one
+ * @param {number}   [opts.groupId] - explicit target team id, for accounts on more than one team
  * @param {Function} [opts.fetcher]
+ * @param {Function} [opts.warn] - failure output (default: process.stderr.write)
  * @param {Function} [opts.upsertPulledNoteFn]
  * @param {Function} [opts.rebuildIndexFn]
  * @param {() => number} [opts.now]
@@ -194,7 +226,9 @@ export async function pullNotes({
   configDir = DEFAULT_CONFIG_DIR,
   ttlMs = RECALL_PULL_TTL_MS,
   timeoutMs = 15_000,
+  groupId,
   fetcher = globalThis.fetch,
+  warn = (s) => process.stderr.write(s),
   upsertPulledNoteFn = upsertPulledNote,
   rebuildIndexFn = rebuildIndex,
   deleteNoteFn = deleteNote,
@@ -209,20 +243,34 @@ export async function pullNotes({
     return { ok: true, skipped: true, count: 0 };
   }
 
-  const url = new URL(`${apiBase()}${PULL_PATH}`);
-  if (lastPulledAt) url.searchParams.set('since', lastPulledAt);
+  const buildUrl = (targetGroupId) => {
+    const url = new URL(`${apiBase()}${PULL_PATH}`);
+    if (lastPulledAt) url.searchParams.set('since', lastPulledAt);
+    if (targetGroupId !== undefined) url.searchParams.set('group_id', targetGroupId);
+    return url.toString();
+  };
+  const get = (targetGroupId) => fetcher(buildUrl(targetGroupId), {
+    headers: { 'Authorization': `Bearer ${cliToken}`, 'Accept': 'application/json' },
+    redirect: 'manual',
+    signal: AbortSignal.timeout(timeoutMs),
+  });
 
   let res;
   try {
-    res = await fetcher(url.toString(), {
-      headers: { 'Authorization': `Bearer ${cliToken}`, 'Accept': 'application/json' },
-      redirect: 'manual',
-      signal: AbortSignal.timeout(timeoutMs),
-    });
+    res = await get(groupId);
   } catch {
     return { ok: false, count: 0 };
   }
 
+  if (!res.ok && res.status === 422 && groupId !== undefined && await isUnknownTeamRejection(res)) {
+    warnUnknownTeam(warn, groupId, 'pulling from your default team');
+    try {
+      res = await get(undefined);
+    } catch {
+      return { ok: false, count: 0 };
+    }
+  }
+
   if (!res.ok) {
     return { ok: false, status: res.status, count: 0 };
   }

package/skills/jtb/scripts/lib/sync.mjs

@@ -10,11 +10,13 @@ import {
   loadProfiles,
   loadCredentials,
   saveProfile,
+  saveTeams,
+  loadTeams,
   invalidateProfilesCache,
 } from './profile-resolver.mjs';
 import { DEFAULT_CONFIG_DIR } from './config.mjs';
 import { apiBase } from './api-utils.mjs';
-import { createStyler } from './ansi.mjs';
+import { createStyler, sanitizeUntrustedText } from './ansi.mjs';
 
 export const getApiBase     = () => apiBase();
 // Strip the api. subdomain to get the console base URL (e.g. api.ticketlens.app → ticketlens.app)
@@ -89,6 +91,7 @@ export async function syncProfiles({
   try { json = await res.json(); } catch { return { error: 'invalid-json' }; }
 
   if (typeof json?.tier === 'string') saveCliTokenTier(json.tier, configDir);
+  saveTeams(Array.isArray(json?.teams) ? json.teams : [], configDir);
 
   const remoteProfiles = Array.isArray(json?.profiles) ? json.profiles : [];
   const localConfig  = loadProfiles(configDir) || { profiles: {} };
@@ -125,6 +128,69 @@ export async function syncProfiles({
   return { added, updated, unchanged, needsCredentials };
 }
 
+/**
+ * Fire-and-forget check for team membership drift (invited to a new team,
+ * removed from one) — same shape as team-jira-sync.mjs's
+ * checkTeamJiraConfigUpdate, reusing the same /v1/profiles endpoint
+ * syncProfiles() already calls rather than a live-diff-only 403/404 branch.
+ * Never blocks or throws — a background check must never break the actual
+ * command it's riding alongside.
+ *
+ * @param {object} [opts]
+ * @param {string}   [opts.configDir]
+ * @param {Function} [opts.fetcher]
+ * @returns {Promise<{updated: boolean, banner?: string}>}
+ */
+export async function checkTeamMembershipUpdate({ configDir = DEFAULT_CONFIG_DIR, fetcher = globalThis.fetch } = {}) {
+  const token = readCliToken(configDir);
+  if (!token) return { updated: false };
+
+  let res;
+  try {
+    res = await fetcher(`${getApiBase()}/v1/profiles`, {
+      headers: { Authorization: `Bearer ${token}`, Accept: 'application/json' },
+      signal: AbortSignal.timeout(10000),
+    });
+  } catch {
+    return { updated: false };
+  }
+  if (!res.ok) return { updated: false };
+
+  let json;
+  try { json = await res.json(); } catch { return { updated: false }; }
+
+  // Sanitized immediately on receipt — remoteTeams feeds both the banner
+  // text below (built before saveTeams' own sanitization would ever run)
+  // and the persisted cache, so both must see the cleaned name.
+  const remoteTeams = (Array.isArray(json?.teams) ? json.teams : [])
+    .map(t => ({ ...t, name: sanitizeUntrustedText(t.name) }));
+  const localTeams  = loadTeams(configDir);
+  const localIds    = new Set(localTeams.map(t => t.id));
+  const remoteIds   = new Set(remoteTeams.map(t => t.id));
+
+  const added   = remoteTeams.filter(t => !localIds.has(t.id));
+  const removed = localTeams.filter(t => !remoteIds.has(t.id));
+  // A rename or role change (same id, different name/role) is neither an
+  // add nor a remove, but the stale local copy must not be left behind.
+  const changed = remoteTeams.some(t => {
+    const local = localTeams.find(l => l.id === t.id);
+    return local && (local.name !== t.name || local.role !== t.role);
+  });
+
+  if (added.length === 0 && removed.length === 0 && !changed) return { updated: false };
+
+  saveTeams(remoteTeams, configDir);
+
+  if (added.length === 0 && removed.length === 0) return { updated: false };
+
+  const lines = [
+    ...added.map(t => `You now have access to "${t.name}" — link a profile with: ticketlens profiles set-team <profile> "${t.name}"`),
+    ...removed.map(t => `You no longer have access to "${t.name}".`),
+  ];
+
+  return { updated: true, banner: lines.join('\n  ') };
+}
+
 /**
  * Formats a syncProfiles() result to a stream. Shared by `ticketlens sync`
  * and the onboarding hub's "Console login" step so both report the same