ticketlens 0.38.27 → 0.38.28

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ticketlens",
-  "version": "0.38.27",
+  "version": "0.38.28",
   "description": "Jira CLI for developers — fetch ticket context, triage your queue, and stop tab-switching. Zero dependencies, all local.",
   "type": "module",
   "bin": {

package/skills/jtb/scripts/lib/cli-auth.mjs

@@ -39,27 +39,44 @@ export function readCliToken(configDir = DEFAULT_CONFIG_DIR) {
 // Lets team-invited members get Pro-equivalent CLI access without a personal
 // TL- key, mirroring what the manager already pays for.
 //
-// Signed with a machine-bound HMAC so `tier`/`syncedAt` can't be hand-edited in
-// the file to escalate or extend entitlement. A missing or invalid signature is
-// treated as no tier at all (falls back to free) rather than trusted — self-heals
-// on the next `tl login`/`tl sync`, both of which re-write and re-sign it. A file
-// with no `syncedAt` (written before this grace-period check existed) is rejected
-// outright for the same reason, rather than treated as permanently fresh.
+// Signed with a machine-bound HMAC so `tier`/`syncedAt`/`freshMark` can't be
+// hand-edited in the file to escalate or extend entitlement. A missing or
+// invalid signature is treated as no tier at all (falls back to free) rather
+// than trusted — self-heals on the next `tl login`/`tl sync`, both of which
+// re-write and re-sign it. A file with no `syncedAt` (written before this
+// grace-period check existed) is rejected outright for the same reason,
+// rather than treated as permanently fresh.
 //
 // TEAM_TIER_GRACE_DAYS bounds how long a synced team-seat tier stays valid without
 // a fresh login/sync — mirrors license.mjs's offline GRACE_DAYS so a team member
 // removed server-side can't keep local access indefinitely just by never syncing.
+//
+// `freshMark` is a monotonic high-water mark of the latest wall-clock time this
+// file has ever been read at without a detected rollback. It is ratcheted forward
+// (never backward) on every honest read and is rejected if the clock now reads
+// earlier than it — closing the realistic attack of rolling the OS clock back
+// once, after a team seat is revoked, to keep `syncedAt` looking fresh forever.
+// It does NOT close every variant: an attacker who fakes the clock from the very
+// first read after a real sync, before any honest freshMark is ever recorded past
+// that point, is not caught — that is an inherent limit of any offline,
+// network-free grace period (the same residual gap license.json's GRACE_DAYS has
+// always had), not something this mechanism claims to solve.
 export function readCliTokenTier(configDir = DEFAULT_CONFIG_DIR) {
   const p = cliTokenPath(configDir);
   if (!existsSync(p)) return null;
   try {
     const data = JSON.parse(readFileSync(p, 'utf8'));
-    if (typeof data.tier !== 'string' || typeof data.tierSig !== 'string' || typeof data.syncedAt !== 'string') {
+    if (
+      typeof data.tier !== 'string' ||
+      typeof data.tierSig !== 'string' ||
+      typeof data.syncedAt !== 'string' ||
+      typeof data.freshMark !== 'string'
+    ) {
       return null;
     }
     const secret = readMachineSecret(configDir);
     if (!secret) return null;
-    const signed = { tier: data.tier, syncedAt: data.syncedAt };
+    const signed = { tier: data.tier, syncedAt: data.syncedAt, freshMark: data.freshMark };
     if (!verifyHmac(data.tierSig, signed, `${CLI_TOKEN_HMAC_SALT}:${secret}`)) return null;
 
     // An unparseable syncedAt gives NaN — rejected on its own line rather than
@@ -70,12 +87,38 @@ export function readCliTokenTier(configDir = DEFAULT_CONFIG_DIR) {
     const daysSinceSync = (Date.now() - syncedAtMs) / MS_PER_DAY;
     if (daysSinceSync > TEAM_TIER_GRACE_DAYS) return null;
 
+    const freshMarkMs = new Date(data.freshMark).getTime();
+    if (Number.isNaN(freshMarkMs)) return null;
+
+    const nowMs = Date.now();
+    if (nowMs < freshMarkMs) return null;
+
+    if (nowMs > freshMarkMs) {
+      // Best-effort ratchet — wrapped so a disk-write failure (full disk,
+      // permissions changed mid-session) can't turn an otherwise-valid read
+      // into a null; the mark simply stays where it was for next time.
+      try {
+        writeFreshMark(p, data, secret, nowMs);
+      } catch {
+        // ignore — ratcheting forward is an optimization, not a correctness requirement
+      }
+    }
+
     return data.tier;
   } catch {
     return null;
   }
 }
 
+function writeFreshMark(p, data, secret, nowMs) {
+  const freshMark = new Date(nowMs).toISOString();
+  const signed = { tier: data.tier, syncedAt: data.syncedAt, freshMark };
+  const tierSig = signHmac(signed, `${CLI_TOKEN_HMAC_SALT}:${secret}`);
+  const payload = { token: data.token, ...signed, tierSig };
+  writeFileSync(p, JSON.stringify(payload, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
+  chmodSync(p, 0o600);
+}
+
 export function saveCliToken(token, configDir = DEFAULT_CONFIG_DIR, tier = undefined) {
   mkdirSync(configDir, { recursive: true });
   const p = cliTokenPath(configDir);
@@ -83,8 +126,12 @@ export function saveCliToken(token, configDir = DEFAULT_CONFIG_DIR, tier = undef
   if (tier !== undefined) {
     const secret = readOrCreateMachineSecret(configDir);
     const syncedAt = new Date().toISOString();
-    const tierSig = signHmac({ tier, syncedAt }, `${CLI_TOKEN_HMAC_SALT}:${secret}`);
-    payload = { token, tier, syncedAt, tierSig };
+    // A real login/sync is itself a trusted checkpoint (it round-tripped to the
+    // server), so freshMark resets to "now" here rather than only ratcheting —
+    // unlike a local read, this is not attacker-reachable without valid credentials.
+    const freshMark = syncedAt;
+    const tierSig = signHmac({ tier, syncedAt, freshMark }, `${CLI_TOKEN_HMAC_SALT}:${secret}`);
+    payload = { token, tier, syncedAt, freshMark, tierSig };
   }
   writeFileSync(p, JSON.stringify(payload, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
   chmodSync(p, 0o600);