ticketlens 0.38.25 → 0.38.26

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ticketlens",
-  "version": "0.38.25",
+  "version": "0.38.26",
   "description": "Jira CLI for developers — fetch ticket context, triage your queue, and stop tab-switching. Zero dependencies, all local.",
   "type": "module",
   "bin": {

package/skills/jtb/scripts/lib/cli-auth.mjs

@@ -7,8 +7,12 @@
 import { readFileSync, writeFileSync, chmodSync, existsSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { DEFAULT_CONFIG_DIR } from './config.mjs';
+import { readMachineSecret, readOrCreateMachineSecret, signHmac, verifyHmac } from './machine-secret.mjs';
 
 const TOKEN_FILE = 'cli-token.json';
+// Distinct from license.mjs's LICENSE_HMAC_SALT so a license.json signature
+// can never be replayed as a valid cli-token.json tier signature, or vice versa.
+const CLI_TOKEN_HMAC_SALT = 'tl-tok-v1';
 
 export function cliTokenPath(configDir = DEFAULT_CONFIG_DIR) {
   return join(configDir, TOKEN_FILE);
@@ -29,12 +33,22 @@ export function readCliToken(configDir = DEFAULT_CONFIG_DIR) {
 // every login/sync — separate from the signed, offline license.json file.
 // Lets team-invited members get Pro-equivalent CLI access without a personal
 // TL- key, mirroring what the manager already pays for.
+//
+// Signed with a machine-bound HMAC so `tier` can't be hand-edited in the file
+// to escalate entitlement. A missing or invalid signature is treated as no
+// tier at all (falls back to free) rather than trusted — self-heals on the
+// next `tl login`/`tl sync`, both of which re-write and re-sign it.
 export function readCliTokenTier(configDir = DEFAULT_CONFIG_DIR) {
   const p = cliTokenPath(configDir);
   if (!existsSync(p)) return null;
   try {
     const data = JSON.parse(readFileSync(p, 'utf8'));
-    return typeof data.tier === 'string' ? data.tier : null;
+    if (typeof data.tier !== 'string' || typeof data.tierSig !== 'string') return null;
+    const secret = readMachineSecret(configDir);
+    if (!secret) return null;
+    return verifyHmac(data.tierSig, { tier: data.tier }, `${CLI_TOKEN_HMAC_SALT}:${secret}`)
+      ? data.tier
+      : null;
   } catch {
     return null;
   }
@@ -43,7 +57,12 @@ export function readCliTokenTier(configDir = DEFAULT_CONFIG_DIR) {
 export function saveCliToken(token, configDir = DEFAULT_CONFIG_DIR, tier = undefined) {
   mkdirSync(configDir, { recursive: true });
   const p = cliTokenPath(configDir);
-  const payload = tier === undefined ? { token } : { token, tier };
+  let payload = { token };
+  if (tier !== undefined) {
+    const secret = readOrCreateMachineSecret(configDir);
+    const tierSig = signHmac({ tier }, `${CLI_TOKEN_HMAC_SALT}:${secret}`);
+    payload = { token, tier, tierSig };
+  }
   writeFileSync(p, JSON.stringify(payload, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
   chmodSync(p, 0o600);
 }

package/skills/jtb/scripts/lib/license.mjs

@@ -1,18 +1,21 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
-import crypto from 'node:crypto';
 import { DEFAULT_CONFIG_DIR } from './config.mjs';
 import { createStyler } from './ansi.mjs';
 import { siteBase } from './api-utils.mjs';
 import { readCliTokenTier } from './cli-auth.mjs';
+import {
+  readOrCreateMachineSecret as readOrCreateHmacSecret,
+  signHmac,
+  verifyHmac as verifyLicenseHmac,
+} from './machine-secret.mjs';
 
 // Mixed into the HMAC key so that knowing the license key alone is not sufficient
 // to forge a valid signature — an attacker also needs this constant from the source.
 export const LICENSE_HMAC_SALT = 'tl-lic-v1';
 export const LICENSE_TIERS = { free: 0, pro: 1, team: 2 };
 const LICENSE_FILE = 'license.json';
-const LICENSE_SECRET_FILE = 'license-hmac-secret.json';
 const REVALIDATION_DAYS = 7;   // attempt background revalidation after this many days
 export const GRACE_DAYS = 30;   // treat license as invalid if not revalidated within this window
 const MS_PER_DAY = 86400000;
@@ -24,62 +27,23 @@ function padInner(str, width) {
   return str + ' '.repeat(Math.max(0, width - visLen(str)));
 }
 
-function readHmacSecret(configDir) {
-  try {
-    const data = JSON.parse(fs.readFileSync(path.join(configDir, LICENSE_SECRET_FILE), 'utf8'));
-    return typeof data.secret === 'string' && data.secret.length === 64 ? data.secret : null;
-  } catch {
-    return null;
-  }
-}
-
-function readOrCreateHmacSecret(configDir) {
-  const existing = readHmacSecret(configDir);
-  if (existing) return existing;
-  fs.mkdirSync(configDir, { recursive: true });
-  const secret = crypto.randomBytes(32).toString('hex');
-  const secretPath = path.join(configDir, LICENSE_SECRET_FILE);
-  const tmp = `${secretPath}.${process.pid}.tmp`;
-  fs.writeFileSync(tmp, JSON.stringify({ secret }), { encoding: 'utf8', mode: 0o600 });
-  try {
-    // Atomic on POSIX — if we lost a concurrent race, the winner's file stays
-    fs.renameSync(tmp, secretPath);
-  } catch {
-    try { fs.unlinkSync(tmp); } catch { /* ignore cleanup failure */ }
-  }
-  // Read back: we may have lost the race; use whatever secret is on disk
-  return readHmacSecret(configDir) ?? secret;
-}
-
-function verifyLicenseHmac(sig, payload, sigKey) {
-  const expected = crypto.createHmac('sha256', sigKey)
-    .update(JSON.stringify(payload)).digest('hex');
-  const sigBuf = Buffer.from(sig, 'hex');
-  const expBuf = Buffer.from(expected, 'hex');
-  if (sigBuf.length !== expBuf.length) return false;
-  return crypto.timingSafeEqual(sigBuf, expBuf);
-}
-
 export function readLicense(configDir = DEFAULT_CONFIG_DIR) {
   const filePath = path.join(configDir, LICENSE_FILE);
   try {
     const data = JSON.parse(fs.readFileSync(filePath, 'utf8'));
     const { sig, ...payload } = data;
-    // Legacy unsigned files are trusted; will be re-signed on next write
-    if (!sig) return payload;
-
-    const machineSecret = readHmacSecret(configDir);
-    if (machineSecret) {
-      // Machine secret present — only accept signatures made with it
-      return verifyLicenseHmac(sig, payload, `${LICENSE_HMAC_SALT}:${machineSecret}`)
-        ? payload : null;
-    }
-
-    // No secret file yet — fall back to legacy key-based HMAC (backward compat).
-    // If valid, immediately re-sign with a machine secret to close the migration window.
-    if (!verifyLicenseHmac(sig, payload, `${LICENSE_HMAC_SALT}:${payload.key || ''}`)) return null;
-    try { writeLicense(payload, configDir); } catch { /* non-fatal — next call will retry */ }
-    return payload;
+    // No signature means no verifiable authenticity — trusting it would let
+    // anyone fabricate a license.json from scratch with no sig field at all.
+    if (!sig) return null;
+
+    // Always verify against the machine secret (created here if this is the
+    // first read ever, e.g. fresh install). There is deliberately no fallback
+    // to a "legacy key-based HMAC" scheme — a signature derived from a key
+    // that lives inside the same payload it signs proves nothing; anyone can
+    // compute it themselves without ever owning a real license.
+    const machineSecret = readOrCreateHmacSecret(configDir);
+    return verifyLicenseHmac(sig, payload, `${LICENSE_HMAC_SALT}:${machineSecret}`)
+      ? payload : null;
   } catch {
     return null;
   }
@@ -90,8 +54,7 @@ export function writeLicense(data, configDir = DEFAULT_CONFIG_DIR) {
   const filePath = path.join(configDir, LICENSE_FILE);
   const { sig: _, ...payload } = data; // strip any existing sig before re-signing
   const secret = readOrCreateHmacSecret(configDir);
-  const mac = crypto.createHmac('sha256', `${LICENSE_HMAC_SALT}:${secret}`)
-    .update(JSON.stringify(payload)).digest('hex');
+  const mac = signHmac(payload, `${LICENSE_HMAC_SALT}:${secret}`);
   fs.writeFileSync(filePath, JSON.stringify({ ...payload, sig: mac }), { encoding: 'utf8', mode: 0o600 });
   fs.chmodSync(filePath, 0o600);
 }

package/skills/jtb/scripts/lib/machine-secret.mjs

@@ -0,0 +1,50 @@
+/**
+ * Machine-bound secret used to HMAC-sign local trust files (license.json,
+ * cli-token.json) so their contents can't be hand-edited without detection.
+ * The secret never leaves the machine and is never sent to the server.
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+
+const SECRET_FILE = 'license-hmac-secret.json';
+
+export function readMachineSecret(configDir) {
+  try {
+    const data = JSON.parse(fs.readFileSync(path.join(configDir, SECRET_FILE), 'utf8'));
+    return typeof data.secret === 'string' && data.secret.length === 64 ? data.secret : null;
+  } catch {
+    return null;
+  }
+}
+
+export function readOrCreateMachineSecret(configDir) {
+  const existing = readMachineSecret(configDir);
+  if (existing) return existing;
+  fs.mkdirSync(configDir, { recursive: true });
+  const secret = crypto.randomBytes(32).toString('hex');
+  const secretPath = path.join(configDir, SECRET_FILE);
+  const tmp = `${secretPath}.${process.pid}.tmp`;
+  fs.writeFileSync(tmp, JSON.stringify({ secret }), { encoding: 'utf8', mode: 0o600 });
+  try {
+    // Atomic on POSIX — if we lost a concurrent race, the winner's file stays
+    fs.renameSync(tmp, secretPath);
+  } catch {
+    try { fs.unlinkSync(tmp); } catch { /* ignore cleanup failure */ }
+  }
+  // Read back: we may have lost the race; use whatever secret is on disk
+  return readMachineSecret(configDir) ?? secret;
+}
+
+export function signHmac(payload, sigKey) {
+  return crypto.createHmac('sha256', sigKey).update(JSON.stringify(payload)).digest('hex');
+}
+
+export function verifyHmac(sig, payload, sigKey) {
+  const expected = signHmac(payload, sigKey);
+  const sigBuf = Buffer.from(sig, 'hex');
+  const expBuf = Buffer.from(expected, 'hex');
+  if (sigBuf.length !== expBuf.length) return false;
+  return crypto.timingSafeEqual(sigBuf, expBuf);
+}

package/skills/jtb/scripts/lib/secret-scanner.mjs

@@ -32,18 +32,40 @@ const MAX_JOINED_CHUNKS = 4;
 const MAX_COMPOUND_SEGMENT_LENGTH = 15;
 const HYPHENATED_COMPOUND_RE = /^[A-Za-z]+(-[A-Za-z]+)+$/;
 
+// U+200B (ZERO WIDTH SPACE) is added explicitly: despite the name, it does
+// NOT carry the Unicode White_Space property (General_Category=Cf, not Zs),
+// so it's excluded from JS's native \s (ECMA-262 WhiteSpace production) —
+// the one gap backlog 1c/1d's U+FEFF handling didn't already cover for free,
+// since \s does include U+FEFF. Without this, a secret split by U+200B stays
+// as one unsplit token, invisible to the direct match, hardRejectRuns
+// (nothing to rejoin), and despacedCombined (not stripped) alike — only
+// entropy would catch it, and only by chance (backlog 1e). Shared as a
+// fragment (not just inside the tokenize/despace regexes below) so the PEM
+// entry in HARD_REJECT_PATTERNS stays in sync with it automatically —
+// mirrors RecallSecretScanner.php's WHITESPACE_CLASS.
+const WHITESPACE_CLASS = '[\\s\\u200B]';
+const WHITESPACE_SPLIT_RE = new RegExp(WHITESPACE_CLASS + '+');
+const WHITESPACE_STRIP_RE = new RegExp(WHITESPACE_CLASS + '+', 'g');
+
 const HARD_REJECT_PATTERNS = [
   { name: 'AWS access key', re: /AKIA[0-9A-Z]{16}/ },
-  // \s* (not a literal space) between segments: this is the only entry with
-  // required internal spacing, and hardRejectRuns (no-separator rejoin) and
-  // despacedCombined (whitespace stripped) both destroy a literal space the
-  // same way they correctly neutralize whitespace-splitting on every other
-  // pattern here — so a tab, extra spaces, a newline, or no separator at all
-  // used to bypass this entry completely (backlog 1d). \s* closes all of
-  // those in one change since it's tested against combined, hardRejectRuns,
-  // and despacedCombined identically. JS's \s is already Unicode-aware
-  // (including U+FEFF), so no separate handling is needed here.
-  { name: 'private key block', re: /-----BEGIN\s*(RSA\s*|EC\s*|OPENSSH\s*|DSA\s*)?PRIVATE\s*KEY-----/ },
+  // WHITESPACE_CLASS* (not a literal space) between segments: this is the
+  // only entry with required internal spacing, and hardRejectRuns
+  // (no-separator rejoin) and despacedCombined (whitespace stripped) both
+  // destroy a literal space the same way they correctly neutralize
+  // whitespace-splitting on every other pattern here — so a tab, extra
+  // spaces, a newline, Unicode whitespace, or no separator at all bypassed
+  // this entry until backlog 1d closed it, and U+200B specifically until
+  // backlog 1e (see WHITESPACE_CLASS above). Built with `new RegExp` instead
+  // of a literal so it reuses the exact same class as
+  // WHITESPACE_SPLIT_RE/WHITESPACE_STRIP_RE — a literal duplicate here is
+  // exactly how the /u flag itself drifted out of sync in backlog 1c.
+  {
+    name: 'private key block',
+    re: new RegExp(
+      `-----BEGIN${WHITESPACE_CLASS}*(RSA${WHITESPACE_CLASS}*|EC${WHITESPACE_CLASS}*|OPENSSH${WHITESPACE_CLASS}*|DSA${WHITESPACE_CLASS}*)?PRIVATE${WHITESPACE_CLASS}*KEY-----`,
+    ),
+  },
   { name: 'JSON Web Token (JWT)', re: /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/ },
   { name: 'API key', re: /\b(sk-|gsk_)[A-Za-z0-9]{20,}\b/ },
   { name: 'GitHub token', re: /\bgh[pousr]_[A-Za-z0-9]{20,}\b/ },
@@ -271,7 +293,7 @@ export function scanForSecrets({ title = '', tags = [], body = '' } = {}) {
   // an exact literal prefix (AKIA, sk-, ghp_, eyJ, -----BEGIN), so joining
   // across a field boundary can't turn them into a false positive the way
   // entropy can.
-  const fieldTokenGroups = [title, ...tags, body].map(field => field.split(/\s+/).filter(Boolean));
+  const fieldTokenGroups = [title, ...tags, body].map(field => field.split(WHITESPACE_SPLIT_RE).filter(Boolean));
   const tokens = fieldTokenGroups.flat();
   const candidates = [...tokens, ...fieldTokenGroups.flatMap(group => joinedChunkRuns(group))];
 
@@ -292,7 +314,7 @@ export function scanForSecrets({ title = '', tags = [], body = '' } = {}) {
   //      anchor risk #2 was built to avoid, but only as an additional check
   //      alongside #2, never instead of it — it can only add a detection
   //      that #1/#2 missed, never remove one they already caught.
-  const despacedCombined = combined.replace(/\s+/g, '');
+  const despacedCombined = combined.replace(WHITESPACE_STRIP_RE, '');
   const hardRejectRuns = joinedChunkRuns(tokens, { stopAtLabelWords: false });
   for (const { name, re } of HARD_REJECT_PATTERNS) {
     if (re.test(combined) || hardRejectRuns.some(c => re.test(c)) || re.test(despacedCombined)) {