ticketlens 0.38.23 → 0.38.25

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ticketlens",
-  "version": "0.38.23",
+  "version": "0.38.25",
   "description": "Jira CLI for developers — fetch ticket context, triage your queue, and stop tab-switching. Zero dependencies, all local.",
   "type": "module",
   "bin": {

package/skills/jtb/scripts/lib/api-utils.mjs

@@ -3,7 +3,7 @@
  * Centralised here to avoid triplicating the regex and warning logic.
  */
 
-export const DEFAULT_API_BASE = 'https://api.ticketlens.app';
+export const DEFAULT_API_BASE = 'http://api.ticketlens.test';
 export const DEFAULT_SITE_BASE = 'https://ticketlens.app';
 
 // Matches localhost, 127.0.0.1, and any hostname ending in .test or .local,

package/skills/jtb/scripts/lib/mcp-server.mjs

@@ -156,6 +156,7 @@ const TOOLS = [
         summary: { type: 'string', description: 'Ticket title/summary.' },
         description: { type: 'string', description: 'Ticket description. Omit for none.' },
         attachments: { type: 'array', items: { type: 'string' }, description: 'Local file paths to attach, uploaded after the ticket is created. On Linear the image is automatically linked into the description. On Jira it becomes a real, visible attachment on the issue, but is not embedded inline in the initial description (use ticket_comment afterward for an inline thumbnail). Not supported on GitHub.' },
+        profile: { type: 'string', description: 'Connection profile to target, overriding folder-based inference and the default profile. Use this when `project` belongs to a profile other than the one auto-resolved from the current working directory.' },
       },
       required: ['summary'],
     },
@@ -386,6 +387,7 @@ function buildTicketCreateArgs(args) {
   cmdArgs.push(`--summary=${args.summary}`);
   if (args.description !== undefined) cmdArgs.push(`--description=${args.description}`);
   if (args.attachments?.length) cmdArgs.push(`--attach=${args.attachments.join(',')}`);
+  if (args.profile !== undefined) cmdArgs.push(`--profile=${args.profile}`);
   return cmdArgs;
 }
 

package/skills/jtb/scripts/lib/secret-scanner.mjs

@@ -26,10 +26,24 @@ const REFERENCE_CONTEXT_WINDOW = 20;
 // rejoined before checking. See isLabelWord for what stops a run — and the
 // documented gap in inserting genuine dictionary words as separators.
 const MAX_JOINED_CHUNKS = 4;
+// Real compound-word segments ("dual-store", "not-yet-configured") run short —
+// capping segment length keeps a long random letters-only run from masquerading
+// as one "segment" of a fake compound. See isHyphenatedWordCompound.
+const MAX_COMPOUND_SEGMENT_LENGTH = 15;
+const HYPHENATED_COMPOUND_RE = /^[A-Za-z]+(-[A-Za-z]+)+$/;
 
 const HARD_REJECT_PATTERNS = [
   { name: 'AWS access key', re: /AKIA[0-9A-Z]{16}/ },
-  { name: 'private key block', re: /-----BEGIN (RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----/ },
+  // \s* (not a literal space) between segments: this is the only entry with
+  // required internal spacing, and hardRejectRuns (no-separator rejoin) and
+  // despacedCombined (whitespace stripped) both destroy a literal space the
+  // same way they correctly neutralize whitespace-splitting on every other
+  // pattern here — so a tab, extra spaces, a newline, or no separator at all
+  // used to bypass this entry completely (backlog 1d). \s* closes all of
+  // those in one change since it's tested against combined, hardRejectRuns,
+  // and despacedCombined identically. JS's \s is already Unicode-aware
+  // (including U+FEFF), so no separate handling is needed here.
+  { name: 'private key block', re: /-----BEGIN\s*(RSA\s*|EC\s*|OPENSSH\s*|DSA\s*)?PRIVATE\s*KEY-----/ },
   { name: 'JSON Web Token (JWT)', re: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/ },
   { name: 'API key', re: /\b(sk-|gsk_)[A-Za-z0-9]{20,}\b/ },
   { name: 'GitHub token', re: /\bgh[pousr]_[A-Za-z0-9]{20,}\b/ },
@@ -124,29 +138,61 @@ function hasInternalCaseSwitch(token) {
   return /[a-z][A-Z]/.test(token);
 }
 
+/**
+ * True for a letters-only, hyphen-delimited token whose segments are all
+ * short enough to read as a real compound word ("dual-store", "REDIS-vs-PG",
+ * "not-yet-configured") rather than a whitespace-split secret fragment. Only
+ * consulted from isLabelWord, i.e. only affects the stopAtLabelWords:true
+ * (generic-secret entropy) pass — joinedChunkRuns's stopAtLabelWords:false
+ * pass, which is what HARD_REJECT_PATTERNS relies on to catch a whitespace-
+ * split sk-/gsk_/AKIA/gh*_/eyJ/PEM-prefixed secret, never calls isLabelWord
+ * at all, so this cannot weaken that protection (see the regression test
+ * for exactly that shape, still passing after this change).
+ *
+ * The hasInternalCaseSwitch check matters the same way it does everywhere
+ * else in this file that distinguishes base64 content from prose (see
+ * isLabelWord's plain-word branch and looksLikeCodeFilename): without it, a
+ * base64-shaped fragment like "zqXvbNmKl-PoIuYtR" reads as a "compound word"
+ * purely because it happens to contain a hyphen, which would let it stop a
+ * run the same way a real compound does — the same category of shape-based
+ * exemption that made the code-filename bypass CRITICAL. Every real compound
+ * tested (dual-store, REDIS-vs-PG, well-known, not-yet-configured, PROD-DB,
+ * end-to-end, ...) has no internal case switch, so this costs nothing.
+ */
+function isHyphenatedWordCompound(token) {
+  if (!HYPHENATED_COMPOUND_RE.test(token)) return false;
+  if (hasInternalCaseSwitch(token)) return false;
+  return token.split('-').every(segment => segment.length <= MAX_COMPOUND_SEGMENT_LENGTH);
+}
+
 /**
  * True for a token that stops a joined-chunk run: either a recognized git/
- * checksum label word ("commit", "sha256", "md5sum", ...), or an ordinary
- * English word (letters only, optionally with an internal possessive/
- * contraction apostrophe — "relay's", "doesn't" — but no base64-style case
- * switching). Anything else — a fragment containing a digit or other symbol,
- * a hyphenated compound, or an all-letter chunk that still reads as random
- * content — stays eligible to join, so a secret split by whitespace can still
- * be reassembled for the entropy check.
+ * checksum label word ("commit", "sha256", "md5sum", ...), a hyphenated
+ * compound word (see isHyphenatedWordCompound), or an ordinary English word
+ * (letters only, optionally with an internal possessive/contraction
+ * apostrophe — "relay's", "doesn't" — but no base64-style case switching).
+ * Anything else — a fragment containing a digit or other symbol, or an
+ * all-letter chunk that still reads as random content — stays eligible to
+ * join, so a secret split by whitespace can still be reassembled for the
+ * entropy check.
  *
  * The apostrophe allowance matters because without it, an ordinary possessive
  * next to another non-label token (e.g. a hyphenated compound: "relay's
  * decision-lookup") never gets a chance to stop the run — both fail to
  * qualify, so they concatenate into one artificial blob whose mixed
  * punctuation trips the entropy threshold. A real false positive, not a
- * hypothetical one (see the regression test below). Hyphenated tokens are
- * deliberately NOT given the same allowance: a short prefix + hyphen + long
- * letter-run is indistinguishable from a real compound word by shape alone
- * (e.g. "sk-abcdefghijklmnop", the letters-only half of a whitespace-split
- * API key) — see the adjacent regression test for exactly this shape. Once
- * the apostrophe fix lets "relay's" stop the run on its own, an adjacent
- * hyphenated compound is short enough on its own to fall under
- * MIN_RANDOM_TOKEN_LENGTH anyway, so it never needed the same allowance.
+ * hypothetical one (see the regression test below).
+ *
+ * Hyphenated compounds get the narrower isHyphenatedWordCompound allowance
+ * rather than the full apostrophe treatment: a short prefix + hyphen + one
+ * long unstructured letter-run (e.g. "sk-abcdefghijklmnop") still fails it —
+ * one segment exceeds MAX_COMPOUND_SEGMENT_LENGTH — so it stays eligible to
+ * join. This is belt-and-suspenders on top of the fact noted above that the
+ * hard-reject pass doesn't consult isLabelWord in the first place. Accepted
+ * trade-off: a hypothetical generic (non-hard-reject-shaped) secret that is
+ * itself letters-only, hyphen-delimited, and short-segmented would no longer
+ * bridge across a whitespace split via this path — no known real secret
+ * generator produces that shape (base32/64/hex alphabets are digit-inclusive).
  *
  * Known accepted gap: this can't tell a genuine possessive from one an
  * attacker deliberately chose as a separator to defeat the scanner (e.g.
@@ -155,12 +201,18 @@ function hasInternalCaseSwitch(token) {
  * text into false-positive "random" strings (verified empirically — see the
  * regression test for "PROD-123456 for background"). Entropy-based detection
  * is a safety net, not a cryptographic guarantee; the well-known secret
- * shapes in HARD_REJECT_PATTERNS are the layer that's fully whitespace- and
- * word-insertion-proof, since they match a specific literal prefix.
+ * shapes in HARD_REJECT_PATTERNS are the layer that's whitespace-proof,
+ * since they match a specific literal prefix — with one exception: the
+ * private-key-block entry has two internal separator points (around the
+ * optional algorithm word and before KEY), and a word inserted at either
+ * one still defeats it, exactly as it did before backlog 1d's whitespace
+ * fix (that fix closed whitespace-substitution/removal, not word
+ * insertion — the same accepted-gap class as the possessive case above).
  */
 function isLabelWord(token) {
   const stripped = stripEdgePunctuation(token);
   if (GIT_REFERENCE_WORD_RE.test(stripped)) return true;
+  if (isHyphenatedWordCompound(stripped)) return true;
   return /^[A-Za-z]+(?:'[A-Za-z]+)*$/.test(stripped) && !hasInternalCaseSwitch(stripped);
 }