ticketlens 0.38.2 → 0.38.4

package/README.md

@@ -451,7 +451,7 @@ Write directly to the ticket in its real tracker — Jira, GitHub, or Linear —
 
 `ticketlens create` creates a new ticket with a fixed minimal field set — no arbitrary custom fields. Unlike every other write command, there's no existing ticket to target, so `--profile` (or your default profile) picks the tracker instead of a ticket key. `--project` is the Jira project key or Linear team key — required for both, ignored on GitHub since its target repo is already fixed by the profile. `--type` is Jira's issue type (e.g. `"Task"`, `"Bug"`) — required for Jira, ignored elsewhere. No `--confirm` gate, same risk tier as `update`/`assign` — but this is the highest-blast-radius command in the whole family: a bad `--project`/`--type` fabricates a real, hard-to-walk-back item in a live tracker, so an invalid value surfaces the tracker's own error rather than a silent guess.
 
-**A bad `--project`/`--type` gets a better error, automatically.** If create fails because the project or issue type doesn't exist, TicketLens fetches your tracker's real, current project list (and, for Jira, the real issue types for that project) and shows them alongside the failure — e.g. `Known creatable projects: CNV1, ECNT.` — rather than a bare tracker error. This is reactive only: it never runs on a successful create, never auto-retries the write, and is cached locally per profile for 24h so a burst of failed attempts doesn't re-fetch every time.
+**A bad `--project`/`--type` gets a better error, automatically.** If create fails because the project or issue type doesn't exist, TicketLens fetches your tracker's real, current project list (and, for Jira, the real issue types for that project) and shows them alongside the failure — e.g. `Known creatable projects: CNV1, CNV2.` — rather than a bare tracker error. This is reactive only: it never runs on a successful create, never auto-retries the write, and is cached locally per profile for 24h so a burst of failed attempts doesn't re-fetch every time.
 
 All six write actions (comment/transition/assign/link/update/create) have a short local debounce (10s) against an accidental double-fire (a flaky retry, hitting enter twice), and every successful write is appended to a local, append-only audit log (`~/.ticketlens/ticket-action-log.jsonl`). A write that times out is never retried automatically — unlike Recall notes, ticket writes aren't naturally idempotent, so a timed-out attempt is surfaced to you instead of silently repeated. `duplicates` has neither, since nothing is written.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ticketlens",
-  "version": "0.38.2",
+  "version": "0.38.4",
   "description": "Jira CLI for developers — fetch ticket context, triage your queue, and stop tab-switching. Zero dependencies, all local.",
   "type": "module",
   "bin": {

package/scripts/leak-scanner.mjs

@@ -0,0 +1,86 @@
+import { readFileSync, readdirSync, existsSync, statSync } from 'node:fs';
+import { join, relative, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+// This module's own resolved path — its BANNED_PATTERNS regex literals
+// necessarily contain the banned substrings as source text, so it must
+// exclude itself from any scan or it would permanently flag itself as a
+// leak. Exposed as a parameter (not hardcoded in scanForLeaks) so tests can
+// verify the exclusion is path-exact, not a basename match that could also
+// skip an unrelated shipped file that happens to share this name.
+const SELF_PATH = resolve(fileURLToPath(import.meta.url));
+
+// Files npm ships in every tarball regardless of package.json's `files`
+// list (npm always includes these three, unconditionally).
+export const ALWAYS_SHIPPED = ['package.json', 'README.md', 'LICENSE'];
+
+export const BANNED_PATTERNS = [
+  // Not an English word — safe to match bare, without requiring the "-NNNN" suffix.
+  { name: 'Advent Jira ticket prefix', pattern: /\bECNT\b/i },
+  // "ASAP" is ordinary English; only match the ticket-key shape to avoid false positives.
+  { name: 'ASAP gateway ticket prefix', pattern: /\bASAP-\d+\b/i },
+  { name: 'pilot-client wrapper command name', pattern: /advent-ticket/i },
+  // Case-sensitive: "Advent" (proper noun, the employer) vs. lowercase "advent"
+  // (ordinary word, e.g. "the advent of AI-assisted development").
+  { name: 'employer name', pattern: /\bAdvent\b/ },
+];
+
+function isDirEntry(absPath, entry) {
+  return entry.endsWith('/') || statSync(absPath).isDirectory();
+}
+
+function collectFiles(root, entry) {
+  const absPath = join(root, entry);
+  if (!existsSync(absPath)) return [];
+  if (!isDirEntry(absPath, entry)) return [absPath];
+
+  const files = [];
+  const walk = (dir) => {
+    for (const dirent of readdirSync(dir, { withFileTypes: true })) {
+      const full = join(dir, dirent.name);
+      if (dirent.isDirectory()) walk(full);
+      else files.push(full);
+    }
+  };
+  walk(absPath);
+  return files;
+}
+
+function findViolations(root, absPath) {
+  const relPath = relative(root, absPath);
+  let content;
+  try {
+    content = readFileSync(absPath, 'utf8');
+  } catch (err) {
+    return [`${relPath} — could not read file to scan for leaks: ${err.message}`];
+  }
+
+  const violations = [];
+  content.split('\n').forEach((line, index) => {
+    for (const { name, pattern } of BANNED_PATTERNS) {
+      if (pattern.test(line)) {
+        violations.push(`${relPath}:${index + 1} — ${name} (matched ${pattern})`);
+      }
+    }
+  });
+
+  return violations;
+}
+
+/**
+ * Scans every file npm actually ships — package.json's `files` list plus
+ * the README/LICENSE/package.json npm always includes regardless of `files`
+ * — for employer/pilot-client identifying patterns.
+ * @param {string} root  absolute path to the package root
+ * @param {string[]} filesList  package.json's `files` array
+ * @param {string} [selfPath]  path to exclude from the scan (defaults to this module's own path)
+ * @returns {string[]} violation descriptions ("path:line — name (matched /re/)"), empty if clean
+ */
+export function scanForLeaks(root, filesList, selfPath = SELF_PATH) {
+  const entries = [...new Set([...filesList, ...ALWAYS_SHIPPED])];
+
+  return entries
+    .flatMap(entry => collectFiles(root, entry))
+    .filter(absPath => resolve(absPath) !== resolve(selfPath))
+    .flatMap(absPath => findViolations(root, absPath));
+}

package/scripts/preflight.mjs

@@ -1,6 +1,7 @@
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join, resolve } from 'node:path';
+import { scanForLeaks } from './leak-scanner.mjs';
 
 const LOCAL_RE = /localhost|127\.0\.0\.1|\.test(:\d+)?(\/|$)/i;
 
@@ -24,23 +25,54 @@ export function checkApiBase(defaultApiBase, tag = 'latest') {
   return { ok: true, reason: `production URL looks good (${defaultApiBase})` };
 }
 
+/**
+ * @param {string} root  absolute path to the package root
+ * @param {string[]} filesList  package.json's `files` array
+ * @returns {{ ok: boolean, reason: string }}
+ */
+export function checkForLeaks(root, filesList) {
+  const violations = scanForLeaks(root, filesList);
+  if (violations.length > 0) {
+    return {
+      ok: false,
+      reason: `Found ${violations.length} employer/pilot-client leak(s) in shipped files:\n` +
+        violations.map(v => `  - ${v}`).join('\n'),
+    };
+  }
+  return { ok: true, reason: 'no employer/pilot-client leaks found in shipped files' };
+}
+
+/**
+ * Prints each check's reason. On any failure, prints failures to stderr as
+ * ERRORs and exits 1 (no successes are printed in that case). Only reached
+ * when every check passes does it print each success reason to stdout.
+ * @param {{ ok: boolean, reason: string }[]} checks
+ * @param {string} logPrefix  e.g. '[preflight]' or '[publish] Preflight:'
+ */
+export function runChecks(checks, logPrefix) {
+  const failed = checks.filter(c => !c.ok);
+  if (failed.length > 0) {
+    for (const { reason } of failed) process.stderr.write(`\n${logPrefix} ERROR: ${reason}\n`);
+    process.stderr.write('\n');
+    process.exit(1);
+  }
+  for (const { reason } of checks) process.stdout.write(`${logPrefix} ${reason}\n`);
+}
+
 // Only run when invoked directly (not when imported by tests)
 const isMain = process.argv[1] && resolve(process.argv[1]) === resolve(fileURLToPath(import.meta.url));
 if (isMain) {
   const __dir = dirname(fileURLToPath(import.meta.url));
+  const root = resolve(__dir, '..');
   const apiUtilsPath = join(__dir, '../skills/jtb/scripts/lib/api-utils.mjs');
   const source = readFileSync(apiUtilsPath, 'utf8');
   const match = source.match(/export const DEFAULT_API_BASE\s*=\s*'([^']+)'/);
   const defaultApiBase = match?.[1] ?? '';
+  const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
 
   const tag = process.env.npm_config_tag;
-  const { ok, reason } = checkApiBase(defaultApiBase, tag);
-
-  if (!ok) {
-    process.stderr.write(`\n[preflight] ERROR: ${reason}\n\n`);
-    process.exit(1);
-  }
+  const checks = [checkApiBase(defaultApiBase, tag), checkForLeaks(root, pkg.files)];
 
-  process.stdout.write(`[preflight] ${reason}\n`);
+  runChecks(checks, '[preflight]');
   process.exit(0);
 }

package/scripts/publish.mjs

@@ -16,6 +16,7 @@ import { readFileSync, writeFileSync, rmSync } from 'node:fs';
 import { execSync } from 'node:child_process';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { checkApiBase, checkForLeaks, runChecks } from './preflight.mjs';
 
 const __dir  = dirname(fileURLToPath(import.meta.url));
 const ROOT   = resolve(__dir, '..');
@@ -26,6 +27,17 @@ const args    = process.argv.slice(2);
 const tag     = args.find(a => a.startsWith('--tag='))?.split('=')[1] ?? 'beta';
 const prodUrl = args.find(a => a.startsWith('--prod-url='))?.split('=')[1] ?? PROD_URL;
 
+// `npm publish <tarball-file>` (below) does NOT trigger npm's `prepublishOnly`
+// lifecycle hook — that only fires when npm packs a directory itself, not
+// when handed an already-built tarball. So these checks are run directly
+// here, not left to package.json's `prepublishOnly` script, which would
+// silently never execute during a real publish:beta/publish:latest run.
+// checkApiBase validates `prodUrl` (the value about to be swapped in and
+// shipped), not the on-disk source — the source is *supposed* to stay local.
+const pkg = JSON.parse(readFileSync(join(ROOT, 'package.json'), 'utf8'));
+const preflightChecks = [checkApiBase(prodUrl, tag), checkForLeaks(ROOT, pkg.files)];
+runChecks(preflightChecks, '[publish] Preflight:');
+
 const original = readFileSync(API_UTILS, 'utf8');
 const swapped  = original.replace(
   /export const DEFAULT_API_BASE\s*=\s*'[^']+'/,

package/skills/jtb/SKILL.md

@@ -1,4 +1,4 @@
-<!-- jtb-skill-version: 0.29.0 -->
+<!-- jtb-skill-version: 0.30.0 -->
 ---
 name: jtb
 description: Fetch a Jira ticket's full context (description, comments, linked issues, code references) and assemble a structured TicketBrief for implementation planning. Use when user types /jtb, mentions a Jira ticket key, or wants to plan work from a Jira ticket.
@@ -268,16 +268,22 @@ Recall notes are stored locally at `~/.ticketlens/recall/`. On a Pro account wit
 
 ---
 
-## Comment, Transition, Assign & Duplicates — write back to the tracker (Pro)
+## Comment, Transition, Assign, Duplicates, Link, Update & Create — write back to the tracker (Pro)
 
-Unlike Recall (a local note about a ticket), comment/transition/assign write directly to the ticket's real tracker — Jira, GitHub, or Linear. Only dispatch a write when the user has actually asked for the ticket to be commented on, moved, or assigned — never as a routine end-of-session action the way Recall capture is. `duplicates` is read-only and safe to run more freely — it never mutates anything.
+Unlike Recall (a local note about a ticket), these seven commands write directly to the ticket's real tracker — Jira, GitHub, or Linear. Only dispatch a write when the user has actually asked for it — never as a routine end-of-session action the way Recall capture is. `duplicates` is read-only and safe to run more freely — it never mutates anything.
 
 ```bash
 ticketlens comment PROD-1234 --body="Fixed in a2f9c1, deployed to staging."
+ticketlens comment PROD-1234 --body="See screenshot" --attach=./bug.png  # attach local files
 ticketlens transition PROD-1234                              # list valid transitions — read-only
 ticketlens transition PROD-1234 --target="Done" --confirm    # execute
 ticketlens assign PROD-1234 --to=me                          # assign to yourself
 ticketlens duplicates PROD-1234                               # find likely duplicates — read-only
+ticketlens link PROD-1234 PROD-5678                            # list valid link types — read-only
+ticketlens link PROD-1234 PROD-5678 --type="Duplicate" --confirm  # execute the link
+ticketlens update PROD-1234 --title="Fix login on mobile"     # update title/description/labels/priority
+ticketlens update PROD-1234 --add-labels=urgent --remove-labels=stale
+ticketlens create --project=PROD --type="Task" --summary="Fix login on mobile"  # create a new ticket
 ```
 
 `transition` called with just a ticket key never mutates anything — it lists the tracker's current valid options (Jira: real workflow transitions for that issue; GitHub: open/closed; Linear: team-scoped workflow states). Only add `--target` **and** `--confirm` once the target has actually been confirmed with the user — `--confirm` is a deliberate two-step gate, not a formality to route around. Never guess a `--target` value; always list first, then use one of the names shown.
@@ -286,11 +292,19 @@ ticketlens duplicates PROD-1234                               # find likely dupl
 
 `duplicates` lists likely-duplicate tickets in the same project. On Jira, any ticket already linked as a "Duplicate" is always listed first — that's a confirmed relationship a human already recorded, not a heuristic. Everything else is ranked by local title/description overlap — no tracker scores similarity server-side, so treat those as a nudge for the user to check manually, never as a confirmed duplicate to act on unprompted (e.g. don't auto-close or auto-comment based on a match). `--threshold=N` (0–1, default 0.35) tightens or loosens what counts as a text-match — it has no effect on Jira-linked duplicates, which are always shown.
 
-The three write actions (comment/transition/assign) have a short local debounce (10s) against an accidental double-fire, and every write is appended to a local audit log (`~/.ticketlens/ticket-action-log.jsonl`). A write that times out is never retried automatically — surface the failure to the user rather than silently re-attempting, since a ticket write isn't naturally idempotent the way a Recall note save is. `duplicates` has neither, since nothing is written.
+`link SOURCE-KEY TARGET-KEY` links two tickets — direction matters: SOURCE "types" TARGET (e.g. `link A B --type=Duplicate` means A duplicates B, not the other way around). Called with just the two keys, it lists the tracker's current valid link types without changing anything — never guess `--type`; always list first, then use one of the names shown. GitHub has no generic link relationship, so linking on a GitHub-tracked ticket *closes SOURCE as a duplicate of TARGET* — a real state change, not just a relationship add — and prints an explicit warning immediately before that happens, on top of the same `--confirm` gate.
+
+`update TICKET-KEY` updates a narrow, named field set — title, description, labels, priority. At least one field is required. Labels are always add/remove (`--add-labels=a,b` / `--remove-labels=c`), never a wholesale replace — an unnamed existing label is left alone, never silently dropped. No `--confirm` needed — these are reversible metadata edits, same risk tier as `assign`.
+
+`create` makes a brand-new ticket — there's no existing ticket to target, so `--project` (Jira project key / Linear team key) and `--type` (Jira issue type, ignored elsewhere) pick the destination instead of a ticket key. This is the highest-blast-radius command in the family: a bad `--project`/`--type` fabricates a real, hard-to-walk-back item in a live tracker. No `--confirm` gate — double-check the values with the user before calling it, since an invalid value surfaces the tracker's own error rather than a silent guess.
+
+`--attach=path1,path2` (comma-separated local file paths) is available on `comment` and `create` only. Images render as an inline thumbnail on Jira and Linear; GitHub has no attachment upload API, so `--attach` is unsupported there.
+
+The six write actions (comment/transition/assign/link/update/create) have a short local debounce (10s) against an accidental double-fire, and every write is appended to a local audit log (`~/.ticketlens/ticket-action-log.jsonl`). A write that times out is never retried automatically — surface the failure to the user rather than silently re-attempting, since a ticket write isn't naturally idempotent the way a Recall note save is. `duplicates` has neither, since nothing is written.
 
 **Pick exactly one path per action — never both.** If this harness has TicketLens's MCP server configured (tools named `ticket_comment`/`ticket_transition`/`ticket_assign`/`ticket_duplicates`/`ticket_link`/`ticket_update`/`ticket_create` — often shown as `mcp__ticketlens__ticket_comment` etc. — visible in your tool list), **use those tools, not the bash commands above** — same license gate, same cooldown, same audit log. Only fall back to the bash form when the MCP tools are genuinely absent from your tool list; if that's because this project has never registered the server, see the `ticketlens mcp install` note above (Recall section) — same guidance applies here.
 
-Requires a Pro license — on Free, all four no-op with an upgrade hint on stderr.
+Requires a Pro license — on Free, all seven no-op with an upgrade hint on stderr.
 
 ---
 

package/skills/jtb/scripts/fetch-my-tickets.mjs

@@ -111,7 +111,7 @@ export async function run(args, envOrOpts = process.env, fetcher = globalThis.fe
   if (pushFlag) {
     const pushToken = opts.cliToken ?? readCliToken(configDir) ?? null;
     if (!pushToken) {
-      process.stderr.write('Error: --push requires authentication. Run `ticketlens auth login` to connect your account.\n');
+      process.stderr.write('Error: --push requires authentication. Run `ticketlens login` to connect your account.\n');
       process.exitCode = 1;
       return;
     }