ticketlens 0.38.2 → 0.38.3

package/README.md

@@ -451,7 +451,7 @@ Write directly to the ticket in its real tracker — Jira, GitHub, or Linear —
 
 `ticketlens create` creates a new ticket with a fixed minimal field set — no arbitrary custom fields. Unlike every other write command, there's no existing ticket to target, so `--profile` (or your default profile) picks the tracker instead of a ticket key. `--project` is the Jira project key or Linear team key — required for both, ignored on GitHub since its target repo is already fixed by the profile. `--type` is Jira's issue type (e.g. `"Task"`, `"Bug"`) — required for Jira, ignored elsewhere. No `--confirm` gate, same risk tier as `update`/`assign` — but this is the highest-blast-radius command in the whole family: a bad `--project`/`--type` fabricates a real, hard-to-walk-back item in a live tracker, so an invalid value surfaces the tracker's own error rather than a silent guess.
 
-**A bad `--project`/`--type` gets a better error, automatically.** If create fails because the project or issue type doesn't exist, TicketLens fetches your tracker's real, current project list (and, for Jira, the real issue types for that project) and shows them alongside the failure — e.g. `Known creatable projects: CNV1, ECNT.` — rather than a bare tracker error. This is reactive only: it never runs on a successful create, never auto-retries the write, and is cached locally per profile for 24h so a burst of failed attempts doesn't re-fetch every time.
+**A bad `--project`/`--type` gets a better error, automatically.** If create fails because the project or issue type doesn't exist, TicketLens fetches your tracker's real, current project list (and, for Jira, the real issue types for that project) and shows them alongside the failure — e.g. `Known creatable projects: CNV1, CNV2.` — rather than a bare tracker error. This is reactive only: it never runs on a successful create, never auto-retries the write, and is cached locally per profile for 24h so a burst of failed attempts doesn't re-fetch every time.
 
 All six write actions (comment/transition/assign/link/update/create) have a short local debounce (10s) against an accidental double-fire (a flaky retry, hitting enter twice), and every successful write is appended to a local, append-only audit log (`~/.ticketlens/ticket-action-log.jsonl`). A write that times out is never retried automatically — unlike Recall notes, ticket writes aren't naturally idempotent, so a timed-out attempt is surfaced to you instead of silently repeated. `duplicates` has neither, since nothing is written.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ticketlens",
-  "version": "0.38.2",
+  "version": "0.38.3",
   "description": "Jira CLI for developers — fetch ticket context, triage your queue, and stop tab-switching. Zero dependencies, all local.",
   "type": "module",
   "bin": {

package/scripts/leak-scanner.mjs

@@ -0,0 +1,86 @@
+import { readFileSync, readdirSync, existsSync, statSync } from 'node:fs';
+import { join, relative, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+// This module's own resolved path — its BANNED_PATTERNS regex literals
+// necessarily contain the banned substrings as source text, so it must
+// exclude itself from any scan or it would permanently flag itself as a
+// leak. Exposed as a parameter (not hardcoded in scanForLeaks) so tests can
+// verify the exclusion is path-exact, not a basename match that could also
+// skip an unrelated shipped file that happens to share this name.
+const SELF_PATH = resolve(fileURLToPath(import.meta.url));
+
+// Files npm ships in every tarball regardless of package.json's `files`
+// list (npm always includes these three, unconditionally).
+export const ALWAYS_SHIPPED = ['package.json', 'README.md', 'LICENSE'];
+
+export const BANNED_PATTERNS = [
+  // Not an English word — safe to match bare, without requiring the "-NNNN" suffix.
+  { name: 'Advent Jira ticket prefix', pattern: /\bECNT\b/i },
+  // "ASAP" is ordinary English; only match the ticket-key shape to avoid false positives.
+  { name: 'ASAP gateway ticket prefix', pattern: /\bASAP-\d+\b/i },
+  { name: 'pilot-client wrapper command name', pattern: /advent-ticket/i },
+  // Case-sensitive: "Advent" (proper noun, the employer) vs. lowercase "advent"
+  // (ordinary word, e.g. "the advent of AI-assisted development").
+  { name: 'employer name', pattern: /\bAdvent\b/ },
+];
+
+function isDirEntry(absPath, entry) {
+  return entry.endsWith('/') || statSync(absPath).isDirectory();
+}
+
+function collectFiles(root, entry) {
+  const absPath = join(root, entry);
+  if (!existsSync(absPath)) return [];
+  if (!isDirEntry(absPath, entry)) return [absPath];
+
+  const files = [];
+  const walk = (dir) => {
+    for (const dirent of readdirSync(dir, { withFileTypes: true })) {
+      const full = join(dir, dirent.name);
+      if (dirent.isDirectory()) walk(full);
+      else files.push(full);
+    }
+  };
+  walk(absPath);
+  return files;
+}
+
+function findViolations(root, absPath) {
+  const relPath = relative(root, absPath);
+  let content;
+  try {
+    content = readFileSync(absPath, 'utf8');
+  } catch (err) {
+    return [`${relPath} — could not read file to scan for leaks: ${err.message}`];
+  }
+
+  const violations = [];
+  content.split('\n').forEach((line, index) => {
+    for (const { name, pattern } of BANNED_PATTERNS) {
+      if (pattern.test(line)) {
+        violations.push(`${relPath}:${index + 1} — ${name} (matched ${pattern})`);
+      }
+    }
+  });
+
+  return violations;
+}
+
+/**
+ * Scans every file npm actually ships — package.json's `files` list plus
+ * the README/LICENSE/package.json npm always includes regardless of `files`
+ * — for employer/pilot-client identifying patterns.
+ * @param {string} root  absolute path to the package root
+ * @param {string[]} filesList  package.json's `files` array
+ * @param {string} [selfPath]  path to exclude from the scan (defaults to this module's own path)
+ * @returns {string[]} violation descriptions ("path:line — name (matched /re/)"), empty if clean
+ */
+export function scanForLeaks(root, filesList, selfPath = SELF_PATH) {
+  const entries = [...new Set([...filesList, ...ALWAYS_SHIPPED])];
+
+  return entries
+    .flatMap(entry => collectFiles(root, entry))
+    .filter(absPath => resolve(absPath) !== resolve(selfPath))
+    .flatMap(absPath => findViolations(root, absPath));
+}

package/scripts/preflight.mjs

@@ -1,6 +1,7 @@
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join, resolve } from 'node:path';
+import { scanForLeaks } from './leak-scanner.mjs';
 
 const LOCAL_RE = /localhost|127\.0\.0\.1|\.test(:\d+)?(\/|$)/i;
 
@@ -24,23 +25,54 @@ export function checkApiBase(defaultApiBase, tag = 'latest') {
   return { ok: true, reason: `production URL looks good (${defaultApiBase})` };
 }
 
+/**
+ * @param {string} root  absolute path to the package root
+ * @param {string[]} filesList  package.json's `files` array
+ * @returns {{ ok: boolean, reason: string }}
+ */
+export function checkForLeaks(root, filesList) {
+  const violations = scanForLeaks(root, filesList);
+  if (violations.length > 0) {
+    return {
+      ok: false,
+      reason: `Found ${violations.length} employer/pilot-client leak(s) in shipped files:\n` +
+        violations.map(v => `  - ${v}`).join('\n'),
+    };
+  }
+  return { ok: true, reason: 'no employer/pilot-client leaks found in shipped files' };
+}
+
+/**
+ * Prints each check's reason. On any failure, prints failures to stderr as
+ * ERRORs and exits 1 (no successes are printed in that case). Only reached
+ * when every check passes does it print each success reason to stdout.
+ * @param {{ ok: boolean, reason: string }[]} checks
+ * @param {string} logPrefix  e.g. '[preflight]' or '[publish] Preflight:'
+ */
+export function runChecks(checks, logPrefix) {
+  const failed = checks.filter(c => !c.ok);
+  if (failed.length > 0) {
+    for (const { reason } of failed) process.stderr.write(`\n${logPrefix} ERROR: ${reason}\n`);
+    process.stderr.write('\n');
+    process.exit(1);
+  }
+  for (const { reason } of checks) process.stdout.write(`${logPrefix} ${reason}\n`);
+}
+
 // Only run when invoked directly (not when imported by tests)
 const isMain = process.argv[1] && resolve(process.argv[1]) === resolve(fileURLToPath(import.meta.url));
 if (isMain) {
   const __dir = dirname(fileURLToPath(import.meta.url));
+  const root = resolve(__dir, '..');
   const apiUtilsPath = join(__dir, '../skills/jtb/scripts/lib/api-utils.mjs');
   const source = readFileSync(apiUtilsPath, 'utf8');
   const match = source.match(/export const DEFAULT_API_BASE\s*=\s*'([^']+)'/);
   const defaultApiBase = match?.[1] ?? '';
+  const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
 
   const tag = process.env.npm_config_tag;
-  const { ok, reason } = checkApiBase(defaultApiBase, tag);
-
-  if (!ok) {
-    process.stderr.write(`\n[preflight] ERROR: ${reason}\n\n`);
-    process.exit(1);
-  }
+  const checks = [checkApiBase(defaultApiBase, tag), checkForLeaks(root, pkg.files)];
 
-  process.stdout.write(`[preflight] ${reason}\n`);
+  runChecks(checks, '[preflight]');
   process.exit(0);
 }

package/scripts/publish.mjs

@@ -16,6 +16,7 @@ import { readFileSync, writeFileSync, rmSync } from 'node:fs';
 import { execSync } from 'node:child_process';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { checkApiBase, checkForLeaks, runChecks } from './preflight.mjs';
 
 const __dir  = dirname(fileURLToPath(import.meta.url));
 const ROOT   = resolve(__dir, '..');
@@ -26,6 +27,17 @@ const args    = process.argv.slice(2);
 const tag     = args.find(a => a.startsWith('--tag='))?.split('=')[1] ?? 'beta';
 const prodUrl = args.find(a => a.startsWith('--prod-url='))?.split('=')[1] ?? PROD_URL;
 
+// `npm publish <tarball-file>` (below) does NOT trigger npm's `prepublishOnly`
+// lifecycle hook — that only fires when npm packs a directory itself, not
+// when handed an already-built tarball. So these checks are run directly
+// here, not left to package.json's `prepublishOnly` script, which would
+// silently never execute during a real publish:beta/publish:latest run.
+// checkApiBase validates `prodUrl` (the value about to be swapped in and
+// shipped), not the on-disk source — the source is *supposed* to stay local.
+const pkg = JSON.parse(readFileSync(join(ROOT, 'package.json'), 'utf8'));
+const preflightChecks = [checkApiBase(prodUrl, tag), checkForLeaks(ROOT, pkg.files)];
+runChecks(preflightChecks, '[publish] Preflight:');
+
 const original = readFileSync(API_UTILS, 'utf8');
 const swapped  = original.replace(
   /export const DEFAULT_API_BASE\s*=\s*'[^']+'/,