ticketlens 0.38.22 → 0.38.24

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ticketlens",
-  "version": "0.38.22",
+  "version": "0.38.24",
   "description": "Jira CLI for developers — fetch ticket context, triage your queue, and stop tab-switching. Zero dependencies, all local.",
   "type": "module",
   "bin": {

package/skills/jtb/scripts/lib/connection-tester.mjs

@@ -23,6 +23,22 @@ export async function testConnections({
   for (const name of names) {
     const profile = config.profiles[name];
     const profileCreds = creds[name] || {};
+
+    if (!profileCreds.apiToken && !profileCreds.pat) {
+      // No point attempting a network call with no credentials — but still
+      // drive the session through spin()/failed()/footer() so callers that
+      // render `stream` live (e.g. onboarding.mjs's "Test connections" menu
+      // item, which discards this function's return value and relies
+      // entirely on stream output for user feedback) don't go silent.
+      const session = createSession({ baseUrl: profile.baseUrl, profileName: name, email: profile.email || undefined }, { stream });
+      const hint = `Run \`ticketlens config --profile=${name}\` to add an API token or PAT.`;
+      session.spin('Testing connection...');
+      session.failed();
+      session.footer('No credentials stored.', 'error', hint);
+      results.push({ name, ok: false, error: 'No credentials stored.', hint });
+      continue;
+    }
+
     const conn = {
       baseUrl: profile.baseUrl,
       auth: profile.auth,

package/skills/jtb/scripts/lib/doctor-checks.mjs

@@ -131,6 +131,14 @@ export async function checkConnectivity({
       };
     }
     const creds = loadCredentialsFn(configDir)[profile.name] || {};
+    if (!creds.apiToken && !creds.pat) {
+      return {
+        id: 'connectivity', label: 'Tracker connectivity', ok: false,
+        message: `Profile "${profile.name}" has no credentials stored.`,
+        hint: `Run \`ticketlens config --profile=${profile.name}\` to add an API token or PAT.`,
+        fixable: false,
+      };
+    }
     const conn = {
       baseUrl: profile.baseUrl, auth: profile.auth, email: profile.email,
       apiToken: creds.apiToken, pat: creds.pat, allowPrivateIp: profile.allowPrivateIp,

package/skills/jtb/scripts/lib/mcp-server.mjs

@@ -156,6 +156,7 @@ const TOOLS = [
         summary: { type: 'string', description: 'Ticket title/summary.' },
         description: { type: 'string', description: 'Ticket description. Omit for none.' },
         attachments: { type: 'array', items: { type: 'string' }, description: 'Local file paths to attach, uploaded after the ticket is created. On Linear the image is automatically linked into the description. On Jira it becomes a real, visible attachment on the issue, but is not embedded inline in the initial description (use ticket_comment afterward for an inline thumbnail). Not supported on GitHub.' },
+        profile: { type: 'string', description: 'Connection profile to target, overriding folder-based inference and the default profile. Use this when `project` belongs to a profile other than the one auto-resolved from the current working directory.' },
       },
       required: ['summary'],
     },
@@ -386,6 +387,7 @@ function buildTicketCreateArgs(args) {
   cmdArgs.push(`--summary=${args.summary}`);
   if (args.description !== undefined) cmdArgs.push(`--description=${args.description}`);
   if (args.attachments?.length) cmdArgs.push(`--attach=${args.attachments.join(',')}`);
+  if (args.profile !== undefined) cmdArgs.push(`--profile=${args.profile}`);
   return cmdArgs;
 }
 

package/skills/jtb/scripts/lib/secret-scanner.mjs

@@ -26,6 +26,11 @@ const REFERENCE_CONTEXT_WINDOW = 20;
 // rejoined before checking. See isLabelWord for what stops a run — and the
 // documented gap in inserting genuine dictionary words as separators.
 const MAX_JOINED_CHUNKS = 4;
+// Real compound-word segments ("dual-store", "not-yet-configured") run short —
+// capping segment length keeps a long random letters-only run from masquerading
+// as one "segment" of a fake compound. See isHyphenatedWordCompound.
+const MAX_COMPOUND_SEGMENT_LENGTH = 15;
+const HYPHENATED_COMPOUND_RE = /^[A-Za-z]+(-[A-Za-z]+)+$/;
 
 const HARD_REJECT_PATTERNS = [
   { name: 'AWS access key', re: /AKIA[0-9A-Z]{16}/ },
@@ -124,29 +129,61 @@ function hasInternalCaseSwitch(token) {
   return /[a-z][A-Z]/.test(token);
 }
 
+/**
+ * True for a letters-only, hyphen-delimited token whose segments are all
+ * short enough to read as a real compound word ("dual-store", "REDIS-vs-PG",
+ * "not-yet-configured") rather than a whitespace-split secret fragment. Only
+ * consulted from isLabelWord, i.e. only affects the stopAtLabelWords:true
+ * (generic-secret entropy) pass — joinedChunkRuns's stopAtLabelWords:false
+ * pass, which is what HARD_REJECT_PATTERNS relies on to catch a whitespace-
+ * split sk-/gsk_/AKIA/gh*_/eyJ/PEM-prefixed secret, never calls isLabelWord
+ * at all, so this cannot weaken that protection (see the regression test
+ * for exactly that shape, still passing after this change).
+ *
+ * The hasInternalCaseSwitch check matters the same way it does everywhere
+ * else in this file that distinguishes base64 content from prose (see
+ * isLabelWord's plain-word branch and looksLikeCodeFilename): without it, a
+ * base64-shaped fragment like "zqXvbNmKl-PoIuYtR" reads as a "compound word"
+ * purely because it happens to contain a hyphen, which would let it stop a
+ * run the same way a real compound does — the same category of shape-based
+ * exemption that made the code-filename bypass CRITICAL. Every real compound
+ * tested (dual-store, REDIS-vs-PG, well-known, not-yet-configured, PROD-DB,
+ * end-to-end, ...) has no internal case switch, so this costs nothing.
+ */
+function isHyphenatedWordCompound(token) {
+  if (!HYPHENATED_COMPOUND_RE.test(token)) return false;
+  if (hasInternalCaseSwitch(token)) return false;
+  return token.split('-').every(segment => segment.length <= MAX_COMPOUND_SEGMENT_LENGTH);
+}
+
 /**
  * True for a token that stops a joined-chunk run: either a recognized git/
- * checksum label word ("commit", "sha256", "md5sum", ...), or an ordinary
- * English word (letters only, optionally with an internal possessive/
- * contraction apostrophe — "relay's", "doesn't" — but no base64-style case
- * switching). Anything else — a fragment containing a digit or other symbol,
- * a hyphenated compound, or an all-letter chunk that still reads as random
- * content — stays eligible to join, so a secret split by whitespace can still
- * be reassembled for the entropy check.
+ * checksum label word ("commit", "sha256", "md5sum", ...), a hyphenated
+ * compound word (see isHyphenatedWordCompound), or an ordinary English word
+ * (letters only, optionally with an internal possessive/contraction
+ * apostrophe — "relay's", "doesn't" — but no base64-style case switching).
+ * Anything else — a fragment containing a digit or other symbol, or an
+ * all-letter chunk that still reads as random content — stays eligible to
+ * join, so a secret split by whitespace can still be reassembled for the
+ * entropy check.
  *
  * The apostrophe allowance matters because without it, an ordinary possessive
  * next to another non-label token (e.g. a hyphenated compound: "relay's
  * decision-lookup") never gets a chance to stop the run — both fail to
  * qualify, so they concatenate into one artificial blob whose mixed
  * punctuation trips the entropy threshold. A real false positive, not a
- * hypothetical one (see the regression test below). Hyphenated tokens are
- * deliberately NOT given the same allowance: a short prefix + hyphen + long
- * letter-run is indistinguishable from a real compound word by shape alone
- * (e.g. "sk-abcdefghijklmnop", the letters-only half of a whitespace-split
- * API key) — see the adjacent regression test for exactly this shape. Once
- * the apostrophe fix lets "relay's" stop the run on its own, an adjacent
- * hyphenated compound is short enough on its own to fall under
- * MIN_RANDOM_TOKEN_LENGTH anyway, so it never needed the same allowance.
+ * hypothetical one (see the regression test below).
+ *
+ * Hyphenated compounds get the narrower isHyphenatedWordCompound allowance
+ * rather than the full apostrophe treatment: a short prefix + hyphen + one
+ * long unstructured letter-run (e.g. "sk-abcdefghijklmnop") still fails it —
+ * one segment exceeds MAX_COMPOUND_SEGMENT_LENGTH — so it stays eligible to
+ * join. This is belt-and-suspenders on top of the fact noted above that the
+ * hard-reject pass doesn't consult isLabelWord in the first place. Accepted
+ * trade-off: a hypothetical generic (non-hard-reject-shaped) secret that is
+ * itself letters-only, hyphen-delimited, and short-segmented would no longer
+ * bridge across a whitespace split via this path — no known real secret
+ * generator produces that shape (base32/64/hex alphabets are digit-inclusive).
  *
  * Known accepted gap: this can't tell a genuine possessive from one an
  * attacker deliberately chose as a separator to defeat the scanner (e.g.
@@ -161,6 +198,7 @@ function hasInternalCaseSwitch(token) {
 function isLabelWord(token) {
   const stripped = stripEdgePunctuation(token);
   if (GIT_REFERENCE_WORD_RE.test(stripped)) return true;
+  if (isHyphenatedWordCompound(stripped)) return true;
   return /^[A-Za-z]+(?:'[A-Za-z]+)*$/.test(stripped) && !hasInternalCaseSwitch(stripped);
 }