ticketlens 0.38.32 → 0.38.34

package/README.md

@@ -453,7 +453,7 @@ Every note is scanned before saving — anything shaped like a real secret (API
 
 **Removing a note:** `ticketlens note delete --id="..." [--ticket=KEY]` removes a note from your local vault. Local only — if it was already pushed to a team, teammates who pulled it keep their copy; deleting it there too is a manager action from the Console (Admin > Recall).
 
-**Any MCP-capable AI harness:** `ticketlens mcp` starts a stdio [MCP](https://modelcontextprotocol.io) server exposing `fetch`, `triage`, `compliance`, `review`, `standup`, `pr`, `doctor`, `recall_add`, `recall_search`, `ticket_comment`, `ticket_transition`, `ticket_assign`, `ticket_duplicates`, `ticket_link`, `ticket_update`, and `ticket_create` as native tools — any MCP-compatible AI assistant, not just Claude Code, can call them directly instead of constructing a shell command. It's a thin adapter over the exact same code as the CLI commands above — same license gate per tool, same secret scan/local vault/tracker writes, same team sync — nothing is reimplemented. `fetch`, `doctor`, and `standup` are Free; `triage`'s base scan is Free with some options gated Pro/Team, same as the CLI (`ticketlens triage --help`); `compliance` and `pr` are Free, sharing a 3-checks/month cap on their requirements-coverage section, Pro unlimited; `review` is Free for branch/files/ticket context, with its coverage/focus section requiring Pro as a plain license check — it does not draw from that same monthly counter; every other tool needs Pro. Point your harness's MCP config at it: `{ "command": "ticketlens", "args": ["mcp"] }` — or run `ticketlens mcp install` in a project to write that entry into its `.mcp.json` for you (creates the file if it doesn't exist, merges in if it does — never touches any other entry already there; `--dry-run` to preview first).
+**Any MCP-capable AI harness:** `ticketlens mcp` starts a stdio [MCP](https://modelcontextprotocol.io) server exposing `fetch`, `triage`, `compliance`, `review`, `standup`, `pr`, `stats`, `history`, `collisions`, `doctor`, `recall_add`, `recall_search`, `ticket_comment`, `ticket_transition`, `ticket_assign`, `ticket_duplicates`, `ticket_link`, `ticket_update`, and `ticket_create` as native tools — any MCP-compatible AI assistant, not just Claude Code, can call them directly instead of constructing a shell command. It's a thin adapter over the exact same code as the CLI commands above — same license gate per tool, same secret scan/local vault/tracker writes, same team sync — nothing is reimplemented. `fetch`, `doctor`, and `standup` are Free; `triage`'s base scan is Free with some options gated Pro/Team, same as the CLI (`ticketlens triage --help`); `compliance` and `pr` are Free, sharing a 3-checks/month cap on their requirements-coverage section, Pro unlimited; `review` is Free for branch/files/ticket context, with its coverage/focus section requiring Pro as a plain license check — it does not draw from that same monthly counter; `stats` is Free with a 7-day lookback cap, Pro extends it to 30 days, same split as the CLI (`ticketlens stats --help`); `history` reads local triage history only (zero network) and requires Pro; `collisions` requires `ticketlens login` (Console access) plus a Team license; every other tool needs Pro. Point your harness's MCP config at it: `{ "command": "ticketlens", "args": ["mcp"] }` — or run `ticketlens mcp install` in a project to write that entry into its `.mcp.json` for you (creates the file if it doesn't exist, merges in if it does — never touches any other entry already there; `--dry-run` to preview first).
 
 `note add`'s save confirmation and `recall`'s search results are styled by default in a terminal; add `--plain` to either for bare, pipe-safe output. `recall` always shows each note's file ID (e.g. `[1784135399545-fe01c4.md]`) so you can open it directly (`cat ~/.ticketlens/recall/<PREFIX>/<id>`), or pass `--full` to print the full body content inline instead. Each result shows a relative time (`2h ago`, `3d ago`) rather than a bare date — the full-precision timestamp is always in the note file's own frontmatter.
 

package/bin/ticketlens.mjs

@@ -20,7 +20,7 @@ import { deleteProfile, loadProfiles, saveCredentialKey, resolveRecallStrictness
 import { run as runCache } from '../skills/jtb/scripts/lib/cache-manager.mjs';
 import { runDoctor } from '../skills/jtb/scripts/lib/doctor-command.mjs';
 import {
-  printHelp, printProfiles, printHistoryHelp,
+  printHelp, printProfiles,
   printLoginHelp, printLogoutHelp, printSyncHelp,
   printActivateHelp, printLicenseHelp, printDeleteHelp,
   printProfilesHelp, printScheduleHelp,
@@ -142,28 +142,11 @@ switch (command) {
   }
 
   case 'history': {
-    if (cmdArgs.includes('--help') || cmdArgs.includes('-h')) { printHistoryHelp(); break; }
-    if (!isLicensed('pro')) { showUpgradePrompt('pro', 'ticketlens history'); break; }
-    const ticketKey = cmdArgs[0];
-    if (!ticketKey || ticketKey.startsWith('-')) {
-      process.stderr.write('Usage: ticketlens history TICKET-KEY\n');
+    const { runHistory } = await import('../skills/jtb/scripts/lib/run-history.mjs');
+    runHistory(cmdArgs).catch(err => {
+      process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
-      break;
-    }
-    const { queryTicketHistory } = await import('../skills/jtb/scripts/lib/triage-history.mjs');
-    const entries = queryTicketHistory(ticketKey);
-    if (entries.length === 0) {
-      process.stdout.write(`No triage history found for ${ticketKey}.\n`);
-      break;
-    }
-    const hs = createStyler({ isTTY: process.stdout.isTTY });
-    process.stdout.write(`\nHistory for ${hs.bold(ticketKey)} (${entries.length} entries)\n\n`);
-    for (const e of entries) {
-      const bounce = e.bounced ? hs.yellow(' ⟳ bounced') : '';
-      const urg = e.urgency === 'needs-response' ? hs.red(e.urgency) : e.urgency === 'aging' ? hs.yellow(e.urgency) : hs.green(e.urgency);
-      process.stdout.write(`  ${hs.dim(e.date)}  [${e.profile}]  ${urg}${bounce}  ${hs.dim(e.reason)}\n`);
-    }
-    process.stdout.write('\n');
+    });
     break;
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ticketlens",
-  "version": "0.38.32",
+  "version": "0.38.34",
   "description": "Jira CLI for developers — fetch ticket context, triage your queue, and stop tab-switching. Zero dependencies, all local.",
   "type": "module",
   "bin": {

package/skills/jtb/SKILL.md

@@ -1,4 +1,4 @@
-<!-- jtb-skill-version: 0.37.0 -->
+<!-- jtb-skill-version: 0.38.0 -->
 ---
 name: jtb
 description: Fetch a Jira ticket's full context (description, comments, linked issues, code references) and assemble a structured TicketBrief for implementation planning. Use when user types /jtb, mentions a Jira ticket key, or wants to plan work from a Jira ticket.
@@ -125,6 +125,46 @@ Requires a Team license and at least one teammate in the same group. Compares yo
 
 Display the script's stdout directly. No plan mode. Stop here.
 
+If this harness has TicketLens's MCP server configured (a tool named `collisions` — often shown as `mcp__ticketlens__collisions` — visible in your tool list), prefer it over the bash form: same Team-license gate, same `ticketlens login` requirement, no shell command to construct. It accepts `json`/`plain`.
+
+---
+
+### Stats subcommand
+
+If the first argument is `stats`:
+
+Run:
+```bash
+ticketlens stats $EXTRA_ARGS
+```
+
+Where `$EXTRA_ARGS` are any flags passed (e.g. `--days=14 --format=json --profile=acme`).
+
+Shows response-time and triage-cadence metrics from local triage history: avg/median response time, clear rate, triage run count, current urgency breakdown. Read-only, entirely local — no network call. `--days=N` (default 7; Free silently caps at 7, Pro allows up to 30); `--format=plain` (default, human-readable table) or `--format=json` (scripting).
+
+Display the script's stdout directly. No plan mode. Stop here.
+
+If this harness has TicketLens's MCP server configured (a tool named `stats` — often shown as `mcp__ticketlens__stats` — visible in your tool list), prefer it over the bash form: same Free/Pro day-cap split, no shell command to construct. It accepts `profile`/`days`/`format`.
+
+---
+
+### History subcommand
+
+If the first argument is `history`:
+
+Run:
+```bash
+ticketlens history TICKET-KEY
+```
+
+Requires a ticket key as the first positional argument. Requires a Pro license.
+
+Shows the ticket's urgency timeline from local triage history — every prior triage scan that surfaced it, with the urgency level and reason computed at that point in time. Read-only, entirely local — no network call, no other flags.
+
+Display the script's stdout directly. No plan mode. Stop here.
+
+If this harness has TicketLens's MCP server configured (a tool named `history` — often shown as `mcp__ticketlens__history` — visible in your tool list), prefer it over the bash form: same Pro gate, no shell command to construct. It accepts `ticket`.
+
 ---
 
 ### Standup subcommand

package/skills/jtb/hooks/recall-nudge-lib.mjs

@@ -18,6 +18,19 @@ export const NOTE_ADD_RE = /\bticketlens\s+note\s+add\b|\/jtb\s+note\b/;
 // (mcp__<server-alias>__<tool-name>) — the server alias is whatever the user
 // named it in their own .mcp.json, so only the tool-name suffix is fixed.
 export const NOTE_ADD_MCP_RE = /^mcp__.+__recall_add$/;
+// Matches jtb's fetch: the CLI's bare/default ticket-key form ("ticketlens
+// PROJ-123" or its "tl" bin alias), the "get" alias form, and the /jtb skill
+// wrapper. Deliberately excludes an explicit "fetch" subcommand — there is
+// no such subcommand; parseCommand() (cli.mjs) only special-cases "get" as
+// an alias, so "ticketlens fetch PROJ-123" falls through to the catch-all
+// with "fetch" itself still in argv and errors as an invalid ticket key
+// (live-verified during code review) — matching it here would silently
+// swallow a broken invocation as if a real fetch had happened. Also
+// deliberately does not match any other tracked subcommand (triage/
+// compliance/etc) — those are lowercase words and can never satisfy the
+// uppercase ticket-key class required immediately after the command name.
+export const FETCH_RE = /\bticketlens\s+(?:get\s+)?[A-Z][A-Z0-9]{1,9}-\d+\b|\btl\s+(?:get\s+)?[A-Z][A-Z0-9]{1,9}-\d+\b|\/jtb\s+(?:get\s+)?[A-Z][A-Z0-9]{1,9}-\d+\b/;
+export const FETCH_MCP_RE = /^mcp__.+__fetch$/;
 
 export function readStdinJson() {
   const raw = fs.readFileSync(0, 'utf8');
@@ -99,6 +112,50 @@ export function hasRecentCapture(cwd, now = Date.now()) {
   return lastCaptureAt > 0 && (now - lastCaptureAt) < CAPTURE_FRESHNESS_MS;
 }
 
+/**
+ * Cross-session NAG marker (backlog #14) — same shape as lastCapturePath/
+ * readLastCaptureAt/writeLastCaptureAt/hasRecentCapture above, but records
+ * "we already blocked once for this directory" instead of "a note was
+ * added". Closes a gap those functions never covered: they bridge a
+ * session_id rollover only when a REAL capture landed, but a dismissed nag
+ * ("genuinely nothing qualified" — the hook's own suggested response) was
+ * never remembered anywhere. Since compaction/resume mints a brand-new
+ * session_id (see recall-nudge-stop.mjs's docstring), and that resets the
+ * per-session_id stopChecked gate, one long working session with several
+ * compaction cycles could get nagged repeatedly for the same still-ongoing
+ * work — a real, reported friction source (backlog #14), not hypothetical.
+ * Deliberately a separate marker file from lastCapture (not folded into
+ * it): a nag and a capture are different facts, and conflating them would
+ * make hasRecentCapture's "a real capture landed" guarantee ambiguous.
+ * Reuses CAPTURE_FRESHNESS_MS rather than a second magic number — the same
+ * 2-hour window is a reasonable proxy for "still the same working session"
+ * in both cases, and a distinct constant isn't justified by anything
+ * observed so far.
+ */
+export function lastNagPath(cwd) {
+  const hash = crypto.createHash('sha256').update(cwd || 'unknown').digest('hex').slice(0, 16);
+  return path.join(privateTmpDir(), `lastnag-${hash}.json`);
+}
+
+export function readLastNagAt(cwd) {
+  try {
+    return JSON.parse(fs.readFileSync(lastNagPath(cwd), 'utf8')).lastNagAt ?? 0;
+  } catch {
+    return 0;
+  }
+}
+
+export function writeLastNagAt(cwd, timestamp) {
+  try {
+    fs.writeFileSync(lastNagPath(cwd), JSON.stringify({ lastNagAt: timestamp }));
+  } catch { /* best-effort — losing this marker only costs one extra nag next rollover */ }
+}
+
+export function hasRecentNag(cwd, now = Date.now()) {
+  const lastNagAt = readLastNagAt(cwd);
+  return lastNagAt > 0 && (now - lastNagAt) < CAPTURE_FRESHNESS_MS;
+}
+
 /**
  * Reads the transcript (JSONL) and returns simple booleans about what
  * happened this session. Best-effort: any read/parse failure returns all
@@ -126,9 +183,19 @@ export function hasRecentCapture(cwd, now = Date.now()) {
  * early, and picking one deterministic match keeps this function decoupled
  * from profiles.json (it stays a pure transcript reader; profile lookup
  * and its own fallback chain belong entirely to resolveProfile()).
+ *
+ * `sawFetch` (backlog #15) is deliberately narrower than `sawTicketKey`: it
+ * only goes true when jtb's fetch tool actually ran (CLI or MCP form, same
+ * dual-detection shape as sawNoteAdd below) — not merely when a ticket-key-
+ * shaped string appears anywhere in the transcript. `sawTicketKey` false-
+ * positived on any incidental match (a doc, a code comment, a test fixture
+ * name like BETA-42), which is fine for its own low-stakes use (picking
+ * which profile's settings apply) but was wrong as shouldNag()'s nag
+ * precondition — SKILL.md's own capture guidance is scoped to "whenever
+ * jtb's fetch was used," so the hook now checks the same thing it backstops.
  */
 export function scanTranscript(transcriptPath) {
-  const result = { sawTicketKey: false, sawRecallFlag: false, sawNoteAdd: false, ticketKey: null };
+  const result = { sawTicketKey: false, sawRecallFlag: false, sawNoteAdd: false, sawFetch: false, ticketKey: null };
   let lines;
   try {
     lines = fs.readFileSync(transcriptPath, 'utf8').split('\n').filter(Boolean);
@@ -173,6 +240,10 @@ export function scanTranscript(transcriptPath) {
         const isCliNoteAdd = block.name === 'Bash' && NOTE_ADD_RE.test(block.input?.command ?? '');
         const isMcpNoteAdd = NOTE_ADD_MCP_RE.test(block.name ?? '');
         if (isCliNoteAdd || isMcpNoteAdd) result.sawNoteAdd = true;
+
+        const isCliFetch = block.name === 'Bash' && FETCH_RE.test(block.input?.command ?? '');
+        const isMcpFetch = FETCH_MCP_RE.test(block.name ?? '');
+        if (isCliFetch || isMcpFetch) result.sawFetch = true;
       }
     }
   }
@@ -191,9 +262,17 @@ export function scanTranscript(transcriptPath) {
  * compaction/session_id rollover, or nagging more than once per session).
  * Strict's actual effect on capture volume comes from SKILL.md's lowered
  * in-session capture bar, not from this function.
+ *
+ * Gated on `sawFetch`, not `sawTicketKey` (backlog #15) — including the
+ * `sawRecallFlag` broken-promise case, which is why the gate is a blanket
+ * `!sawFetch` check rather than per-branch: a flag can't legitimately fire
+ * outside real ticket work, and this keeps the whole function's trigger
+ * matching SKILL.md's own capture-guidance scope exactly ("unconditionally
+ * whenever jtb's fetch was used"), instead of firing on any incidental
+ * ticket-key-shaped string.
  */
-export function shouldNag({ sawTicketKey, sawRecallFlag, sawNoteAdd, recallStrictness = 'balanced' }) {
-  if (!sawTicketKey || sawNoteAdd) return false;
+export function shouldNag({ sawFetch, sawRecallFlag, sawNoteAdd, recallStrictness = 'balanced' }) {
+  if (!sawFetch || sawNoteAdd) return false;
   if (recallStrictness === 'loose') return sawRecallFlag; // only the broken-promise case
-  return true; // balanced and strict: ticket work with no note is enough
+  return true; // balanced and strict: a fetch with no note is enough
 }

package/skills/jtb/hooks/recall-nudge-stop.mjs

@@ -3,19 +3,28 @@
  * Stop hook — end-of-session Recall check.
  *
  * Blocks (exit 2) at most ONCE per session — never traps the user in a
- * loop regardless of how Claude responds. Two cases force a check:
+ * loop regardless of how Claude responds. Both cases below require jtb's
+ * fetch to have actually run this session (backlog #15) — a ticket-key-
+ * shaped string appearing incidentally (a doc, a code comment, a test
+ * fixture) is not enough, matching SKILL.md's own capture-guidance scope.
+ * Given that:
  *   1. Claude flagged something (🔖 Recall-flag:) but never called note add
  *      — a broken promise, the strongest signal something was missed.
  *   2. Ticket work happened all session with zero flags and zero notes
  *      — the weaker "did anything ever get considered?" catch.
- * Anything else (no ticket work at all, or a note was already added) exits
+ * Anything else (no fetch this session, or a note was already added) exits
  * clean — this must never be the reason a session can't end.
  *
  * The per-session_id "asked once" state (readState/writeState) cannot
  * survive a compaction/resume event — that hands this hook a brand-new
  * session_id, a blank dedup state, AND a blank transcript file, so a real
  * earlier capture becomes invisible. The cross-session lastCapture marker
- * (keyed by cwd, not session_id) is what actually bridges that boundary.
+ * (keyed by cwd, not session_id) is what actually bridges that boundary
+ * for a genuine capture. The parallel lastNag marker (backlog #14) bridges
+ * the same boundary for a DISMISSED nag: without it, a session that already
+ * got its one nag and was told "genuinely nothing qualified" would nag
+ * again after the next compaction/resume rollover, since that dismissal
+ * was never recorded anywhere — only a real capture was.
  *
  * Which of the two cases above actually blocks is governed by the active
  * profile's recallStrictness — see recall-nudge-lib.mjs's shouldNag() doc
@@ -30,7 +39,7 @@
  * profile, same as before (backlog #12, design spec §6).
  */
 
-import { readStdinJson, readState, writeState, scanTranscript, hasRecentCapture, writeLastCaptureAt, shouldNag } from './recall-nudge-lib.mjs';
+import { readStdinJson, readState, writeState, scanTranscript, hasRecentCapture, writeLastCaptureAt, hasRecentNag, writeLastNagAt, shouldNag } from './recall-nudge-lib.mjs';
 import { resolveProfile, normalizeRecallStrictness } from '../scripts/lib/profile-resolver.mjs';
 
 const input = readStdinJson();
@@ -40,7 +49,7 @@ const cwd = input?.cwd ?? process.cwd();
 
 if (!sessionId || !transcriptPath) process.exit(0);
 
-const { sawTicketKey, sawRecallFlag, sawNoteAdd, ticketKey } = scanTranscript(transcriptPath);
+const { sawFetch, sawRecallFlag, sawNoteAdd, ticketKey } = scanTranscript(transcriptPath);
 
 // Refreshed on every check, independent of the once-per-session gate below —
 // a capture that happens AFTER this session already nagged once must still
@@ -53,7 +62,7 @@ if (state.stopChecked) process.exit(0); // already asked once this session — r
 const profile = resolveProfile(ticketKey, { cwd });
 const recallStrictness = normalizeRecallStrictness(profile?.recallStrictness);
 
-if (!shouldNag({ sawTicketKey, sawRecallFlag, sawNoteAdd, recallStrictness })) {
+if (!shouldNag({ sawFetch, sawRecallFlag, sawNoteAdd, recallStrictness })) {
   process.exit(0); // nothing this strictness level requires a capture for
 }
 
@@ -61,8 +70,13 @@ if (hasRecentCapture(cwd)) {
   process.exit(0); // a real capture landed recently in this same directory, just under a different session_id
 }
 
+if (hasRecentNag(cwd)) {
+  process.exit(0); // already nagged recently in this same directory, just under a different session_id — a compaction/resume rollover, not a fresh session (backlog #14)
+}
+
 state.stopChecked = true;
 writeState(sessionId, state);
+writeLastNagAt(cwd, Date.now());
 
 if (sawRecallFlag) {
   process.stderr.write(

package/skills/jtb/scripts/fetch-ticket.mjs

@@ -511,7 +511,9 @@ export async function run(args, envOrOpts = process.env, fetcher = globalThis.fe
   const errStream = { write: printErrFn, isTTY };
 
   if (args.includes('--help') || args.includes('-h')) {
-    printFetchHelp();
+    // stdout's own isTTY, not the `isTTY` above (that one is documented as
+    // reflecting process.stderr.isTTY for the stderr-bound helpers below).
+    printFetchHelp({ stream: { write: printFn, isTTY: process.stdout.isTTY } });
     return;
   }
 

package/skills/jtb/scripts/lib/help.mjs

@@ -645,16 +645,20 @@ export function printMcpHelp({ stream = process.stdout } = {}) {
     `  ${s.bold(s.brand('ticketlens'))} ${s.bold('mcp')}`,
     '',
     `  Start an MCP (Model Context Protocol) stdio server exposing CLI actions as`,
-    `  native tools — ${s.cyan('fetch')}, ${s.cyan('triage')}, ${s.cyan('compliance')}, ${s.cyan('review')}, ${s.cyan('standup')}, ${s.cyan('pr')}, ${s.cyan('doctor')}, ${s.cyan('recall_add')}, ${s.cyan('recall_search')},`,
-    `  ${s.cyan('ticket_comment')}, ${s.cyan('ticket_transition')}, ${s.cyan('ticket_assign')}, ${s.cyan('ticket_duplicates')}, ${s.cyan('ticket_link')}, ${s.cyan('ticket_update')},`,
-    `  ${s.cyan('ticket_create')} — for any MCP-compatible AI harness, not just Claude Code. Thin`,
-    `  adapter over the same code as ${s.cyan('TICKET-KEY')}/${s.cyan('doctor')}/${s.cyan('triage')}/${s.cyan('compliance')}/${s.cyan('review')}/${s.cyan('standup')}/${s.cyan('pr')}/${s.cyan('note add')}/`,
-    `  ${s.cyan('recall')}/${s.cyan('comment')}/${s.cyan('transition')}/${s.cyan('assign')}/${s.cyan('duplicates')}/${s.cyan('link')}/${s.cyan('update')}/${s.cyan('create')} above.`,
+    `  native tools — ${s.cyan('fetch')}, ${s.cyan('triage')}, ${s.cyan('compliance')}, ${s.cyan('review')}, ${s.cyan('standup')}, ${s.cyan('pr')}, ${s.cyan('stats')}, ${s.cyan('history')},`,
+    `  ${s.cyan('collisions')}, ${s.cyan('doctor')}, ${s.cyan('recall_add')}, ${s.cyan('recall_search')}, ${s.cyan('ticket_comment')}, ${s.cyan('ticket_transition')},`,
+    `  ${s.cyan('ticket_assign')}, ${s.cyan('ticket_duplicates')}, ${s.cyan('ticket_link')}, ${s.cyan('ticket_update')}, ${s.cyan('ticket_create')} — for any`,
+    `  MCP-compatible AI harness, not just Claude Code. Thin adapter over the same`,
+    `  code as ${s.cyan('TICKET-KEY')}/${s.cyan('doctor')}/${s.cyan('triage')}/${s.cyan('compliance')}/${s.cyan('review')}/${s.cyan('standup')}/${s.cyan('pr')}/${s.cyan('stats')}/${s.cyan('history')}/${s.cyan('collisions')}/`,
+    `  ${s.cyan('note add')}/${s.cyan('recall')}/${s.cyan('comment')}/${s.cyan('transition')}/${s.cyan('assign')}/${s.cyan('duplicates')}/${s.cyan('link')}/${s.cyan('update')}/${s.cyan('create')} above.`,
     `  ${s.cyan('fetch')}, ${s.cyan('doctor')}, and ${s.cyan('standup')} are Free; ${s.cyan('triage')} is Free with some Pro/Team-gated`,
     `  options (see ${s.cyan('ticketlens triage --help')}); ${s.cyan('compliance')} and ${s.cyan('pr')} are Free, sharing a`,
     `  3-checks/month cap on their requirements-coverage section, Pro unlimited;`,
     `  ${s.cyan('review')} is Free for branch/files/ticket context — its coverage/focus section`,
-    `  requires Pro as a plain license check, not a draw on that same counter; every`,
+    `  requires Pro as a plain license check, not a draw on that same counter;`,
+    `  ${s.cyan('stats')} is Free with a 7-day lookback, Pro extends it to 30 days, same split`,
+    `  as ${s.cyan('ticketlens stats --help')}; ${s.cyan('history')} is entirely local and requires Pro;`,
+    `  ${s.cyan('collisions')} requires ${s.cyan('ticketlens login')} (Console access) plus a Team license — every`,
     `  other tool needs Pro. ${s.cyan('ticket_transition')} is destructive when called with`,
     `  \`target\`+\`confirm: true\`; ${s.cyan('ticket_assign')} is currently self-assign only;`,
     `  ${s.cyan('ticket_duplicates')} is read-only; ${s.cyan('ticket_link')} on GitHub closes the source issue as a`,

package/skills/jtb/scripts/lib/mcp-server.mjs

@@ -27,226 +27,13 @@ import { runRecall } from './recall-command.mjs';
 import { runTicketComment, runTicketTransitionList, runTicketTransition, runTicketAssign, runTicketDuplicates, runTicketLinkList, runTicketLink, runTicketUpdate, runTicketCreate } from './ticket-command.mjs';
 import { run as runFetchTicket } from '../fetch-ticket.mjs';
 import { run as runTriage } from '../fetch-my-tickets.mjs';
+import { runStats } from './run-stats.mjs';
+import { runHistory } from './run-history.mjs';
+import { runCollisions } from './run-collisions.mjs';
+import { TOOLS } from './mcp-tool-schemas.mjs';
 
 const PROTOCOL_VERSION = '2025-11-25';
 
-const TOOLS = [
-  {
-    name: 'fetch',
-    description: 'Fetch a ticket\'s full context brief (Jira/GitHub/Linear) — description, comments, linked tickets, code references, attachments. The core read action; free tier. Not a discovery tool — requires a known ticket key.',
-    inputSchema: {
-      type: 'object',
-      properties: {
-        ticket: { type: 'string', description: 'Ticket key, e.g. PROJ-123.' },
-        profile: { type: 'string', description: 'Connection profile to target, overriding folder-based inference and the default profile.' },
-        depth: { type: 'number', description: 'How many hops of linked tickets to traverse. Defaults to 1 (direct links only). 0 disables traversal.' },
-      },
-      required: ['ticket'],
-    },
-  },
-  {
-    name: 'triage',
-    description: 'Scan assigned tickets and surface what needs attention — replies owed, aging tickets, stale-status tickets. The base scan is free tier; some options require a TicketLens Pro or Team license.',
-    inputSchema: {
-      type: 'object',
-      properties: {
-        profile: { type: 'string', description: 'Connection profile to target, overriding folder-based inference and the default profile.' },
-        stale: { type: 'number', description: 'Days before an untouched ticket counts as aging. Defaults to 5.' },
-        status: { type: 'array', items: { type: 'string' }, description: 'Statuses to include, overriding the profile default / built-in defaults (In Progress, Code Review, QA).' },
-        sort: { type: 'string', description: 'Sort order for results, overriding the profile default.' },
-        save: { type: 'string', description: 'Write the plain-text summary to this local file path instead of (in addition to) returning it. Requires a TicketLens Pro license.' },
-        all: { type: 'boolean', description: 'Triage every configured profile, not just the resolved one. Requires a TicketLens Pro license.' },
-        digest: { type: 'boolean', description: 'Deliver the scored results to the digest backend instead of returning them as text — on success, no summary is returned, only a delivery confirmation. Requires a TicketLens Pro license.' },
-        assignee: { type: 'string', description: 'View another user\'s tickets instead of your own. Requires a TicketLens Team license.' },
-        sprint: { type: 'string', description: 'Scope to a named sprint. Requires a TicketLens Team license.' },
-        export: { type: 'string', enum: ['csv', 'json'], description: 'Write results to a file in this format instead of returning the summary text, returning the written file path instead. Requires a TicketLens Team license.' },
-        project: { type: 'string', description: 'Scope to a project/team key. Requires a TicketLens Team license.' },
-        label: { type: 'array', items: { type: 'string' }, description: 'Scope to one or more labels. Requires a TicketLens Team license.' },
-        priority: { type: 'string', description: 'Scope to a priority name, e.g. "High". Requires a TicketLens Team license.' },
-      },
-    },
-  },
-  {
-    name: 'compliance',
-    description: 'Check a ticket\'s acceptance-criteria coverage against the current git diff — extracts requirements from the ticket description, matches them against code changes, and reports a coverage percentage plus what\'s missing. Read-only; the same check `ticketlens install-hooks` runs automatically. Free tier: 3 checks per month; TicketLens Pro removes the limit.',
-    inputSchema: {
-      type: 'object',
-      properties: {
-        ticket: { type: 'string', description: 'Ticket key, e.g. PROJ-123.' },
-        profile: { type: 'string', description: 'Connection profile to target, overriding folder-based inference and the default profile.' },
-      },
-      required: ['ticket'],
-    },
-  },
-  {
-    name: 'review',
-    description: 'Assemble PR review context from the current git branch — changed files, linked-ticket summaries, and (Pro) a requirements-coverage / review-focus section extracted from the diff against acceptance criteria. Read-only; never modifies the tracker or the repo. Free tier gets branch info, changed files, and ticket context; TicketLens Pro adds the requirements-coverage and review-focus sections — same split as the `compliance` tool.',
-    inputSchema: {
-      type: 'object',
-      properties: {
-        base: { type: 'string', description: 'Base branch to diff against. Auto-detects main/master/develop when omitted. Alias of `branch` — if both are given, `base` wins.' },
-        branch: { type: 'string', description: 'Alias for `base` — same effect, provided for parity with the CLI\'s `--branch=` flag.' },
-        profile: { type: 'string', description: 'Connection profile to target, overriding folder-based inference and the default profile.' },
-      },
-    },
-  },
-  {
-    name: 'standup',
-    description: 'Summarize recent git commits grouped by linked ticket — a standup update or, with format:"pr", PR-body-style formatting. Read-only, fully free tier — no license gate on any option.',
-    inputSchema: {
-      type: 'object',
-      properties: {
-        since: { type: 'string', description: 'How far back to scan — an integer number of hours ("24") or a git-compatible date expression ("3 days ago"). Defaults to 24 hours.' },
-        format: { type: 'string', enum: ['standup', 'pr'], description: 'Output shape: "standup" (default) groups commits under a per-ticket standup update; "pr" renders the same grouped commits as PR-body-style markdown.' },
-        profile: { type: 'string', description: 'Connection profile to target, overriding folder-based inference and the default profile.' },
-      },
-    },
-  },
-  {
-    name: 'pr',
-    description: 'Assemble a ready-to-paste PR description for a ticket — what changed (from linked commits), linked tickets, and (if the ticket has acceptance criteria) a requirements-coverage section. Read-only. The requirements-coverage section reuses the same Free-tier 3-checks/month counter as the `compliance` tool — calling `pr` on a ticket with acceptance criteria counts against that shared monthly limit; TicketLens Pro removes the cap.',
-    inputSchema: {
-      type: 'object',
-      properties: {
-        ticket: { type: 'string', description: 'Ticket key, e.g. PROJ-123.' },
-        profile: { type: 'string', description: 'Connection profile to target, overriding folder-based inference and the default profile.' },
-      },
-      required: ['ticket'],
-    },
-  },
-  {
-    name: 'doctor',
-    description: 'Diagnose common TicketLens problems: profile configuration, license freshness, tracker connectivity, attachment cache health, MCP registration, and the Recall sync queue. Always returns structured JSON. Free tier, fully unrestricted — including fix.',
-    inputSchema: {
-      type: 'object',
-      properties: {
-        fix: { type: 'boolean', description: 'Attempt safe, non-destructive repairs for failing checks.' },
-        profile: { type: 'string', description: 'Scope profile/connectivity/cache checks to one profile.' },
-      },
-    },
-  },
-  {
-    name: 'recall_add',
-    description: 'Save a Recall note — a gotcha, root cause, or non-obvious decision learned this session. Requires a TicketLens Pro license.',
-    inputSchema: {
-      type: 'object',
-      properties: {
-        title: { type: 'string', description: 'Short one-line title.' },
-        ticket: { type: 'string', description: 'Optional ticket key, e.g. PROJ-123.' },
-        tags: { type: 'array', items: { type: 'string' }, description: 'Optional tags derived from this note\'s actual content — the specific technology, error type, root cause, or affected component (e.g. "retry-backoff", "null-pointer", "auth-middleware"). Never the project name or a generic category word like "gotcha" or "bug" — those provide no search signal to someone else looking for this note later. A tag that just restates the title in different words, or one you cannot trace to a specific sentence in the body, gives that same zero signal — if you cannot point to the exact phrase that justifies it, drop it.' },
-        body: { type: 'string', description: 'The note body — one or more paragraphs.' },
-      },
-      required: ['title', 'body'],
-    },
-  },
-  {
-    name: 'recall_search',
-    description: 'Search saved Recall notes by free-text query or ticket key. Requires a TicketLens Pro license.',
-    inputSchema: {
-      type: 'object',
-      properties: {
-        query: { type: 'string', description: 'Free-text query or a ticket key like PROJ-123.' },
-      },
-      required: ['query'],
-    },
-  },
-  {
-    name: 'ticket_comment',
-    description: 'Post a comment to a ticket in its tracker (Jira/GitHub/Linear). Destructive — writes directly to the live tracker, not a local Recall note. Requires a TicketLens Pro license.',
-    inputSchema: {
-      type: 'object',
-      properties: {
-        ticket: { type: 'string', description: 'Ticket key, e.g. PROJ-123.' },
-        body: { type: 'string', description: 'Comment body.' },
-        attachments: { type: 'array', items: { type: 'string' }, description: 'Local file paths to attach — images render as a real inline thumbnail in the posted comment on both Jira (Cloud and Server/Data Center) and Linear. Not supported on GitHub — no PAT-compatible upload API exists there.' },
-      },
-      required: ['ticket', 'body'],
-    },
-  },
-  {
-    name: 'ticket_transition',
-    description: 'List or execute a ticket status transition in its tracker (Jira/GitHub/Linear). Called with only `ticket`, lists the tracker\'s current valid options without changing anything. Destructive when `target` and `confirm: true` are both given — requires confirmation and writes directly to the live tracker. Requires a TicketLens Pro license.',
-    inputSchema: {
-      type: 'object',
-      properties: {
-        ticket: { type: 'string', description: 'Ticket key, e.g. PROJ-123.' },
-        target: { type: 'string', description: 'Target status/transition name. Omit to just list the tracker\'s current valid options.' },
-        confirm: { type: 'boolean', description: 'Must be true, alongside `target`, to actually execute the transition — a nudge and audit trail, not just a formality.' },
-      },
-      required: ['ticket'],
-    },
-  },
-  {
-    name: 'ticket_assign',
-    description: 'Assign a ticket to yourself in its tracker (Jira/GitHub/Linear). Self-assign only — assigning to someone else is not supported yet. Requires a TicketLens Pro license.',
-    inputSchema: {
-      type: 'object',
-      properties: {
-        ticket: { type: 'string', description: 'Ticket key, e.g. PROJ-123.' },
-        to: { type: 'string', description: 'Who to assign to — currently only "me" is accepted.' },
-      },
-      required: ['ticket', 'to'],
-    },
-  },
-  {
-    name: 'ticket_duplicates',
-    description: 'Find likely duplicate tickets in the same project (Jira/GitHub/Linear). Read-only — never links or changes anything. On Jira, any ticket already linked as a "Duplicate" is always included first (a confirmed relationship, not a guess); everything else comes from a local, approximate title/description overlap score, since no tracker scores similarity server-side. That scorer can miss real duplicates as easily as it over-matches, so an empty result means none were found, not a guarantee that none exist. Requires a TicketLens Pro license.',
-    inputSchema: {
-      type: 'object',
-      properties: {
-        ticket: { type: 'string', description: 'Ticket key, e.g. PROJ-123.' },
-        threshold: { type: 'number', description: 'Minimum match score 0-1 to report. Defaults to 0.35.' },
-      },
-      required: ['ticket'],
-    },
-  },
-  {
-    name: 'ticket_link',
-    description: 'List or execute a link between two tickets in their tracker (Jira/GitHub/Linear). Called with only `ticket`/`target`, lists the tracker\'s current valid link types without changing anything. Destructive when `type` and `confirm: true` are both given — writes directly to the live tracker. Direction matters: `ticket` "types" `target` (e.g. ticket duplicates target). On GitHub, executing CLOSES `ticket` as a duplicate of `target` — a state change, not just a relationship add like Jira/Linear. Requires a TicketLens Pro license.',
-    inputSchema: {
-      type: 'object',
-      properties: {
-        ticket: { type: 'string', description: 'Source ticket key, e.g. PROJ-123 — the one that "types" target.' },
-        target: { type: 'string', description: 'Target ticket key, e.g. PROJ-456.' },
-        type: { type: 'string', description: 'Link type name (from the list). Omit to just list the tracker\'s current valid options. GitHub only supports "duplicate".' },
-        confirm: { type: 'boolean', description: 'Must be true, alongside `type`, to actually execute the link — a nudge and audit trail, not just a formality.' },
-      },
-      required: ['ticket', 'target'],
-    },
-  },
-  {
-    name: 'ticket_update',
-    description: 'Update a narrow, named field set on a ticket in its tracker (Jira/GitHub/Linear) — title, description, labels, priority. At least one field is required. Labels are add/remove, never a wholesale replace: an unnamed existing label is left alone. No discovery step and no confirm required — these are reversible metadata edits, not workflow-state changes. GitHub has no priority field; passing `priority` for a GitHub-tracked ticket is refused. A call can partially succeed (e.g. title updates but a label does not resolve) — the result reports exactly what landed. Requires a TicketLens Pro license.',
-    inputSchema: {
-      type: 'object',
-      properties: {
-        ticket: { type: 'string', description: 'Ticket key, e.g. PROJ-123.' },
-        title: { type: 'string', description: 'New title/summary. Omit to leave unchanged.' },
-        description: { type: 'string', description: 'New description. Omit to leave unchanged.' },
-        addLabels: { type: 'array', items: { type: 'string' }, description: 'Labels to add. Existing labels not named here are left alone.' },
-        removeLabels: { type: 'array', items: { type: 'string' }, description: 'Labels to remove.' },
-        priority: { type: 'string', description: 'New priority name, e.g. "High". Not supported on GitHub.' },
-      },
-      required: ['ticket'],
-    },
-  },
-  {
-    name: 'ticket_create',
-    description: 'Create a new ticket in a tracker (Jira/GitHub/Linear) with a fixed minimal field set — no arbitrary custom fields. Architecturally unlike every other ticket-write tool: there is no existing ticket to target, so the target tracker/project is picked by the connection profile rather than a ticket key. `project` is the Jira project key or Linear team key — required for both, ignored on GitHub (its repo is fixed by the profile). `type` is the Jira issue type — required for Jira only, ignored elsewhere. Highest blast radius of the ticket-write family: a bad project/type fabricates a real, hard-to-walk-back item in a live tracker. Requires a TicketLens Pro license.',
-    inputSchema: {
-      type: 'object',
-      properties: {
-        project: { type: 'string', description: 'Jira project key or Linear team key. Required for Jira/Linear; ignored on GitHub.' },
-        type: { type: 'string', description: 'Jira issue type, e.g. "Task" or "Bug". Required for Jira only; ignored on GitHub/Linear.' },
-        summary: { type: 'string', description: 'Ticket title/summary.' },
-        description: { type: 'string', description: 'Ticket description. Omit for none.' },
-        attachments: { type: 'array', items: { type: 'string' }, description: 'Local file paths to attach, uploaded after the ticket is created. On Linear the image is automatically linked into the description. On Jira it becomes a real, visible attachment on the issue, but is not embedded inline in the initial description (use ticket_comment afterward for an inline thumbnail). Not supported on GitHub.' },
-        profile: { type: 'string', description: 'Connection profile to target, overriding folder-based inference and the default profile. Use this when `project` belongs to a profile other than the one auto-resolved from the current working directory.' },
-      },
-      required: ['summary'],
-    },
-  },
-];
 
 function jsonRpcResult(id, result) {
   return JSON.stringify({ jsonrpc: '2.0', id, result }) + '\n';
@@ -471,6 +258,70 @@ async function callDoctor(args, { configDir, runDoctorFn }) {
   return { content: [{ type: 'text', text: capture.text }] };
 }
 
+/**
+ * Shared by `stats` and `history` — both wrap a run*Fn taking {configDir,
+ * print, warn} where a real report always reaches `print` on success and
+ * every failure (validation error, license gate) reaches `warn`. Same
+ * "did print receive text" success heuristic as callTriage, factored out
+ * here the way callFetchTicketRun already factors it out for the
+ * fetch/compliance/review/standup/pr family. NOT used by `collisions` —
+ * see callCollisions for why that one needs the returned {ok} instead.
+ */
+async function callPrintWarnRun(buildArgsFn, args, { configDir, runFn }, fallbackErrorText) {
+  const capture = capturingStream();
+  const errCapture = capturingStream();
+  await runFn(buildArgsFn(args), { configDir, print: capture.write, warn: errCapture.write });
+  if (capture.text) {
+    return { content: [{ type: 'text', text: capture.text }] };
+  }
+  return { isError: true, content: [{ type: 'text', text: errCapture.text || fallbackErrorText }] };
+}
+
+function buildStatsArgs({ profile, days, format }) {
+  const args = [];
+  if (profile) args.push(`--profile=${profile}`);
+  if (days !== undefined) args.push(`--days=${days}`);
+  if (format) args.push(`--format=${format}`);
+  return args;
+}
+
+async function callStats(args, { configDir, runStatsFn }) {
+  return callPrintWarnRun(buildStatsArgs, args, { configDir, runFn: runStatsFn }, 'stats failed');
+}
+
+function buildHistoryArgs({ ticket }) {
+  return [ticket];
+}
+
+async function callHistory(args, { configDir, runHistoryFn }) {
+  if (!args.ticket) {
+    return { isError: true, content: [{ type: 'text', text: 'Missing required argument: ticket' }] };
+  }
+  return callPrintWarnRun(buildHistoryArgs, args, { configDir, runFn: runHistoryFn }, 'history failed');
+}
+
+function buildCollisionsArgs({ json, plain }) {
+  const args = [];
+  if (json === true) args.push('--json');
+  if (plain === true) args.push('--plain');
+  return args;
+}
+
+/**
+ * Unlike every other read tool here, runCollisions writes its own failure
+ * messages (no-token, 401, 403, network error) through `print`, not `warn` —
+ * so the "did print receive text" heuristic used by callStats/callTriage
+ * would misreport every one of those as a success. Uses the returned {ok}
+ * instead, same as callTicketCreate.
+ */
+async function callCollisions(args, { configDir, runCollisionsFn }) {
+  const capture = capturingStream();
+  const errCapture = capturingStream();
+  const { ok } = await runCollisionsFn(buildCollisionsArgs(args), { configDir, print: capture.write, warn: errCapture.write });
+  const content = [{ type: 'text', text: capture.text }];
+  return ok ? { content } : { isError: true, content };
+}
+
 /**
  * Builds runNoteAdd's cmdArgs array. Each `--flag=value` MUST stay a single,
  * discrete array element — runNoteAdd's parseFlag matches per-element via
@@ -682,6 +533,9 @@ async function handleToolsCall(params, deps) {
   if (name === 'standup') return callStandup(args, deps);
   if (name === 'pr') return callPr(args, deps);
   if (name === 'doctor') return callDoctor(args, deps);
+  if (name === 'stats') return callStats(args, deps);
+  if (name === 'history') return callHistory(args, deps);
+  if (name === 'collisions') return callCollisions(args, deps);
   if (name === 'recall_add') return callRecallAdd(args, deps);
   if (name === 'recall_search') return callRecallSearch(args, deps);
   if (name === 'ticket_comment') return callTicketComment(args, deps);
@@ -694,7 +548,7 @@ async function handleToolsCall(params, deps) {
   return { isError: true, content: [{ type: 'text', text: `Unknown tool: ${name}` }] };
 }
 
-async function handleMessage(raw, { configDir, runFetchTicketFn, runTriageFn, runDoctorFn, runNoteAddFn, runRecallFn, runTicketCommentFn, runTicketTransitionListFn, runTicketTransitionFn, runTicketAssignFn, runTicketDuplicatesFn, runTicketLinkListFn, runTicketLinkFn, runTicketUpdateFn, runTicketCreateFn }) {
+async function handleMessage(raw, { configDir, runFetchTicketFn, runTriageFn, runDoctorFn, runStatsFn, runHistoryFn, runCollisionsFn, runNoteAddFn, runRecallFn, runTicketCommentFn, runTicketTransitionListFn, runTicketTransitionFn, runTicketAssignFn, runTicketDuplicatesFn, runTicketLinkListFn, runTicketLinkFn, runTicketUpdateFn, runTicketCreateFn }) {
   let msg;
   try {
     msg = JSON.parse(raw);
@@ -724,7 +578,7 @@ async function handleMessage(raw, { configDir, runFetchTicketFn, runTriageFn, ru
 
   if (method === 'tools/call') {
     try {
-      const result = await handleToolsCall(params, { configDir, runFetchTicketFn, runTriageFn, runDoctorFn, runNoteAddFn, runRecallFn, runTicketCommentFn, runTicketTransitionListFn, runTicketTransitionFn, runTicketAssignFn, runTicketDuplicatesFn, runTicketLinkListFn, runTicketLinkFn, runTicketUpdateFn, runTicketCreateFn });
+      const result = await handleToolsCall(params, { configDir, runFetchTicketFn, runTriageFn, runDoctorFn, runStatsFn, runHistoryFn, runCollisionsFn, runNoteAddFn, runRecallFn, runTicketCommentFn, runTicketTransitionListFn, runTicketTransitionFn, runTicketAssignFn, runTicketDuplicatesFn, runTicketLinkListFn, runTicketLinkFn, runTicketUpdateFn, runTicketCreateFn });
       return jsonRpcResult(id, result);
     } catch (err) {
       return jsonRpcError(id ?? null, -32603, `Internal error: ${err.message}`);
@@ -748,6 +602,9 @@ export function runMcpServer({
   runFetchTicketFn = runFetchTicket,
   runTriageFn = runTriage,
   runDoctorFn = runDoctor,
+  runStatsFn = runStats,
+  runHistoryFn = runHistory,
+  runCollisionsFn = runCollisions,
   runNoteAddFn = runNoteAdd,
   runRecallFn = runRecall,
   runTicketCommentFn = runTicketComment,
@@ -778,7 +635,7 @@ export function runMcpServer({
     // never resolving (a dropped rejection isn't a resolution) — the
     // server would hang on shutdown instead of exiting.
     queue = queue.then(async () => {
-      const response = await handleMessage(line, { configDir, runFetchTicketFn, runTriageFn, runDoctorFn, runNoteAddFn, runRecallFn, runTicketCommentFn, runTicketTransitionListFn, runTicketTransitionFn, runTicketAssignFn, runTicketDuplicatesFn, runTicketLinkListFn, runTicketLinkFn, runTicketUpdateFn, runTicketCreateFn });
+      const response = await handleMessage(line, { configDir, runFetchTicketFn, runTriageFn, runDoctorFn, runStatsFn, runHistoryFn, runCollisionsFn, runNoteAddFn, runRecallFn, runTicketCommentFn, runTicketTransitionListFn, runTicketTransitionFn, runTicketAssignFn, runTicketDuplicatesFn, runTicketLinkListFn, runTicketLinkFn, runTicketUpdateFn, runTicketCreateFn });
       if (response) stdout.write(response);
     }).catch(() => {});
   });

package/skills/jtb/scripts/lib/mcp-tool-schemas.mjs

@@ -0,0 +1,257 @@
+/**
+ * JSON-RPC `tools/list` schema definitions for every MCP tool `mcp-server.mjs`
+ * exposes. Pure data — no logic, no imports — extracted out of mcp-server.mjs
+ * to keep that file under the project's 800-line cap. Order here is the order
+ * clients see in `tools/list`.
+ */
+export const TOOLS = [
+  {
+    name: 'fetch',
+    description: 'Fetch a ticket\'s full context brief (Jira/GitHub/Linear) — description, comments, linked tickets, code references, attachments. The core read action; free tier. Not a discovery tool — requires a known ticket key.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        ticket: { type: 'string', description: 'Ticket key, e.g. PROJ-123.' },
+        profile: { type: 'string', description: 'Connection profile to target, overriding folder-based inference and the default profile.' },
+        depth: { type: 'number', description: 'How many hops of linked tickets to traverse. Defaults to 1 (direct links only). 0 disables traversal.' },
+      },
+      required: ['ticket'],
+    },
+  },
+  {
+    name: 'triage',
+    description: 'Scan assigned tickets and surface what needs attention — replies owed, aging tickets, stale-status tickets. The base scan is free tier; some options require a TicketLens Pro or Team license.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        profile: { type: 'string', description: 'Connection profile to target, overriding folder-based inference and the default profile.' },
+        stale: { type: 'number', description: 'Days before an untouched ticket counts as aging. Defaults to 5.' },
+        status: { type: 'array', items: { type: 'string' }, description: 'Statuses to include, overriding the profile default / built-in defaults (In Progress, Code Review, QA).' },
+        sort: { type: 'string', description: 'Sort order for results, overriding the profile default.' },
+        save: { type: 'string', description: 'Write the plain-text summary to this local file path instead of (in addition to) returning it. Requires a TicketLens Pro license.' },
+        all: { type: 'boolean', description: 'Triage every configured profile, not just the resolved one. Requires a TicketLens Pro license.' },
+        digest: { type: 'boolean', description: 'Deliver the scored results to the digest backend instead of returning them as text — on success, no summary is returned, only a delivery confirmation. Requires a TicketLens Pro license.' },
+        assignee: { type: 'string', description: 'View another user\'s tickets instead of your own. Requires a TicketLens Team license.' },
+        sprint: { type: 'string', description: 'Scope to a named sprint. Requires a TicketLens Team license.' },
+        export: { type: 'string', enum: ['csv', 'json'], description: 'Write results to a file in this format instead of returning the summary text, returning the written file path instead. Requires a TicketLens Team license.' },
+        project: { type: 'string', description: 'Scope to a project/team key. Requires a TicketLens Team license.' },
+        label: { type: 'array', items: { type: 'string' }, description: 'Scope to one or more labels. Requires a TicketLens Team license.' },
+        priority: { type: 'string', description: 'Scope to a priority name, e.g. "High". Requires a TicketLens Team license.' },
+      },
+    },
+  },
+  {
+    name: 'compliance',
+    description: 'Check a ticket\'s acceptance-criteria coverage against the current git diff — extracts requirements from the ticket description, matches them against code changes, and reports a coverage percentage plus what\'s missing. Read-only; the same check `ticketlens install-hooks` runs automatically. Free tier: 3 checks per month; TicketLens Pro removes the limit.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        ticket: { type: 'string', description: 'Ticket key, e.g. PROJ-123.' },
+        profile: { type: 'string', description: 'Connection profile to target, overriding folder-based inference and the default profile.' },
+      },
+      required: ['ticket'],
+    },
+  },
+  {
+    name: 'review',
+    description: 'Assemble PR review context from the current git branch — changed files, linked-ticket summaries, and (Pro) a requirements-coverage / review-focus section extracted from the diff against acceptance criteria. Read-only; never modifies the tracker or the repo. Free tier gets branch info, changed files, and ticket context; TicketLens Pro adds the requirements-coverage and review-focus sections — same split as the `compliance` tool.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        base: { type: 'string', description: 'Base branch to diff against. Auto-detects main/master/develop when omitted. Alias of `branch` — if both are given, `base` wins.' },
+        branch: { type: 'string', description: 'Alias for `base` — same effect, provided for parity with the CLI\'s `--branch=` flag.' },
+        profile: { type: 'string', description: 'Connection profile to target, overriding folder-based inference and the default profile.' },
+      },
+    },
+  },
+  {
+    name: 'standup',
+    description: 'Summarize recent git commits grouped by linked ticket — a standup update or, with format:"pr", PR-body-style formatting. Read-only, fully free tier — no license gate on any option.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        since: { type: 'string', description: 'How far back to scan — an integer number of hours ("24") or a git-compatible date expression ("3 days ago"). Defaults to 24 hours.' },
+        format: { type: 'string', enum: ['standup', 'pr'], description: 'Output shape: "standup" (default) groups commits under a per-ticket standup update; "pr" renders the same grouped commits as PR-body-style markdown.' },
+        profile: { type: 'string', description: 'Connection profile to target, overriding folder-based inference and the default profile.' },
+      },
+    },
+  },
+  {
+    name: 'pr',
+    description: 'Assemble a ready-to-paste PR description for a ticket — what changed (from linked commits), linked tickets, and (if the ticket has acceptance criteria) a requirements-coverage section. Read-only. The requirements-coverage section reuses the same Free-tier 3-checks/month counter as the `compliance` tool — calling `pr` on a ticket with acceptance criteria counts against that shared monthly limit; TicketLens Pro removes the cap.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        ticket: { type: 'string', description: 'Ticket key, e.g. PROJ-123.' },
+        profile: { type: 'string', description: 'Connection profile to target, overriding folder-based inference and the default profile.' },
+      },
+      required: ['ticket'],
+    },
+  },
+  {
+    name: 'stats',
+    description: 'Show response-time and triage-cadence metrics from local triage history — average/median response time, clear rate, triage run count, current urgency breakdown. Read-only, entirely local — no network call. Free tier: 7-day lookback max; TicketLens Pro extends it to 30 days.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        profile: { type: 'string', description: 'Connection profile to target, overriding folder-based inference and the default profile.' },
+        days: { type: 'number', description: 'Lookback window in days. Defaults to 7. Free tier is silently capped at 7; TicketLens Pro allows up to 30.' },
+        format: { type: 'string', enum: ['plain', 'json'], description: 'Output shape: "plain" (default) is a human-readable table; "json" is structured for scripting.' },
+      },
+    },
+  },
+  {
+    name: 'history',
+    description: 'Show a ticket\'s urgency timeline from local triage history — every prior triage scan that surfaced it, with the urgency level and reason computed at that point in time. Read-only, entirely local — no network call. Requires a TicketLens Pro license.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        ticket: { type: 'string', description: 'Ticket key, e.g. PROJ-123.' },
+      },
+      required: ['ticket'],
+    },
+  },
+  {
+    name: 'collisions',
+    description: 'Show branches where your changed files overlap with a teammate\'s — compares your current branch against teammates\' recent branches (within 7 days) pushed via `ticketlens triage --push`. Requires `ticketlens login` (Console access) and a TicketLens Team license.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        json: { type: 'boolean', description: 'Return a raw JSON array of collision objects instead of a formatted report.' },
+        plain: { type: 'boolean', description: 'Plain text output with no ANSI colour.' },
+      },
+    },
+  },
+  {
+    name: 'doctor',
+    description: 'Diagnose common TicketLens problems: profile configuration, license freshness, tracker connectivity, attachment cache health, MCP registration, and the Recall sync queue. Always returns structured JSON. Free tier, fully unrestricted — including fix.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        fix: { type: 'boolean', description: 'Attempt safe, non-destructive repairs for failing checks.' },
+        profile: { type: 'string', description: 'Scope profile/connectivity/cache checks to one profile.' },
+      },
+    },
+  },
+  {
+    name: 'recall_add',
+    description: 'Save a Recall note — a gotcha, root cause, or non-obvious decision learned this session. Requires a TicketLens Pro license.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        title: { type: 'string', description: 'Short one-line title.' },
+        ticket: { type: 'string', description: 'Optional ticket key, e.g. PROJ-123.' },
+        tags: { type: 'array', items: { type: 'string' }, description: 'Optional tags derived from this note\'s actual content — the specific technology, error type, root cause, or affected component (e.g. "retry-backoff", "null-pointer", "auth-middleware"). Never the project name or a generic category word like "gotcha" or "bug" — those provide no search signal to someone else looking for this note later. A tag that just restates the title in different words, or one you cannot trace to a specific sentence in the body, gives that same zero signal — if you cannot point to the exact phrase that justifies it, drop it.' },
+        body: { type: 'string', description: 'The note body — one or more paragraphs.' },
+      },
+      required: ['title', 'body'],
+    },
+  },
+  {
+    name: 'recall_search',
+    description: 'Search saved Recall notes by free-text query or ticket key. Requires a TicketLens Pro license.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        query: { type: 'string', description: 'Free-text query or a ticket key like PROJ-123.' },
+      },
+      required: ['query'],
+    },
+  },
+  {
+    name: 'ticket_comment',
+    description: 'Post a comment to a ticket in its tracker (Jira/GitHub/Linear). Destructive — writes directly to the live tracker, not a local Recall note. Requires a TicketLens Pro license.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        ticket: { type: 'string', description: 'Ticket key, e.g. PROJ-123.' },
+        body: { type: 'string', description: 'Comment body.' },
+        attachments: { type: 'array', items: { type: 'string' }, description: 'Local file paths to attach — images render as a real inline thumbnail in the posted comment on both Jira (Cloud and Server/Data Center) and Linear. Not supported on GitHub — no PAT-compatible upload API exists there.' },
+      },
+      required: ['ticket', 'body'],
+    },
+  },
+  {
+    name: 'ticket_transition',
+    description: 'List or execute a ticket status transition in its tracker (Jira/GitHub/Linear). Called with only `ticket`, lists the tracker\'s current valid options without changing anything. Destructive when `target` and `confirm: true` are both given — requires confirmation and writes directly to the live tracker. Requires a TicketLens Pro license.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        ticket: { type: 'string', description: 'Ticket key, e.g. PROJ-123.' },
+        target: { type: 'string', description: 'Target status/transition name. Omit to just list the tracker\'s current valid options.' },
+        confirm: { type: 'boolean', description: 'Must be true, alongside `target`, to actually execute the transition — a nudge and audit trail, not just a formality.' },
+      },
+      required: ['ticket'],
+    },
+  },
+  {
+    name: 'ticket_assign',
+    description: 'Assign a ticket to yourself in its tracker (Jira/GitHub/Linear). Self-assign only — assigning to someone else is not supported yet. Requires a TicketLens Pro license.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        ticket: { type: 'string', description: 'Ticket key, e.g. PROJ-123.' },
+        to: { type: 'string', description: 'Who to assign to — currently only "me" is accepted.' },
+      },
+      required: ['ticket', 'to'],
+    },
+  },
+  {
+    name: 'ticket_duplicates',
+    description: 'Find likely duplicate tickets in the same project (Jira/GitHub/Linear). Read-only — never links or changes anything. On Jira, any ticket already linked as a "Duplicate" is always included first (a confirmed relationship, not a guess); everything else comes from a local, approximate title/description overlap score, since no tracker scores similarity server-side. That scorer can miss real duplicates as easily as it over-matches, so an empty result means none were found, not a guarantee that none exist. Requires a TicketLens Pro license.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        ticket: { type: 'string', description: 'Ticket key, e.g. PROJ-123.' },
+        threshold: { type: 'number', description: 'Minimum match score 0-1 to report. Defaults to 0.35.' },
+      },
+      required: ['ticket'],
+    },
+  },
+  {
+    name: 'ticket_link',
+    description: 'List or execute a link between two tickets in their tracker (Jira/GitHub/Linear). Called with only `ticket`/`target`, lists the tracker\'s current valid link types without changing anything. Destructive when `type` and `confirm: true` are both given — writes directly to the live tracker. Direction matters: `ticket` "types" `target` (e.g. ticket duplicates target). On GitHub, executing CLOSES `ticket` as a duplicate of `target` — a state change, not just a relationship add like Jira/Linear. Requires a TicketLens Pro license.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        ticket: { type: 'string', description: 'Source ticket key, e.g. PROJ-123 — the one that "types" target.' },
+        target: { type: 'string', description: 'Target ticket key, e.g. PROJ-456.' },
+        type: { type: 'string', description: 'Link type name (from the list). Omit to just list the tracker\'s current valid options. GitHub only supports "duplicate".' },
+        confirm: { type: 'boolean', description: 'Must be true, alongside `type`, to actually execute the link — a nudge and audit trail, not just a formality.' },
+      },
+      required: ['ticket', 'target'],
+    },
+  },
+  {
+    name: 'ticket_update',
+    description: 'Update a narrow, named field set on a ticket in its tracker (Jira/GitHub/Linear) — title, description, labels, priority. At least one field is required. Labels are add/remove, never a wholesale replace: an unnamed existing label is left alone. No discovery step and no confirm required — these are reversible metadata edits, not workflow-state changes. GitHub has no priority field; passing `priority` for a GitHub-tracked ticket is refused. A call can partially succeed (e.g. title updates but a label does not resolve) — the result reports exactly what landed. Requires a TicketLens Pro license.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        ticket: { type: 'string', description: 'Ticket key, e.g. PROJ-123.' },
+        title: { type: 'string', description: 'New title/summary. Omit to leave unchanged.' },
+        description: { type: 'string', description: 'New description. Omit to leave unchanged.' },
+        addLabels: { type: 'array', items: { type: 'string' }, description: 'Labels to add. Existing labels not named here are left alone.' },
+        removeLabels: { type: 'array', items: { type: 'string' }, description: 'Labels to remove.' },
+        priority: { type: 'string', description: 'New priority name, e.g. "High". Not supported on GitHub.' },
+      },
+      required: ['ticket'],
+    },
+  },
+  {
+    name: 'ticket_create',
+    description: 'Create a new ticket in a tracker (Jira/GitHub/Linear) with a fixed minimal field set — no arbitrary custom fields. Architecturally unlike every other ticket-write tool: there is no existing ticket to target, so the target tracker/project is picked by the connection profile rather than a ticket key. `project` is the Jira project key or Linear team key — required for both, ignored on GitHub (its repo is fixed by the profile). `type` is the Jira issue type — required for Jira only, ignored elsewhere. Highest blast radius of the ticket-write family: a bad project/type fabricates a real, hard-to-walk-back item in a live tracker. Requires a TicketLens Pro license.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        project: { type: 'string', description: 'Jira project key or Linear team key. Required for Jira/Linear; ignored on GitHub.' },
+        type: { type: 'string', description: 'Jira issue type, e.g. "Task" or "Bug". Required for Jira only; ignored on GitHub/Linear.' },
+        summary: { type: 'string', description: 'Ticket title/summary.' },
+        description: { type: 'string', description: 'Ticket description. Omit for none.' },
+        attachments: { type: 'array', items: { type: 'string' }, description: 'Local file paths to attach, uploaded after the ticket is created. On Linear the image is automatically linked into the description. On Jira it becomes a real, visible attachment on the issue, but is not embedded inline in the initial description (use ticket_comment afterward for an inline thumbnail). Not supported on GitHub.' },
+        profile: { type: 'string', description: 'Connection profile to target, overriding folder-based inference and the default profile. Use this when `project` belongs to a profile other than the one auto-resolved from the current working directory.' },
+      },
+      required: ['summary'],
+    },
+  },
+];

package/skills/jtb/scripts/lib/run-history.mjs

@@ -0,0 +1,50 @@
+import { queryTicketHistory, DEFAULT_CONFIG_DIR } from './triage-history.mjs';
+import { isLicensed as defaultIsLicensed, showUpgradePrompt } from './license.mjs';
+import { createStyler } from './ansi.mjs';
+import { printHistoryHelp } from './help.mjs';
+
+/**
+ * Prints a ticket's local triage-history timeline. Extracted from
+ * bin/ticketlens.mjs's inline 'history' case so the MCP `history` tool has
+ * a CLI-layer function to wrap, same as every other MCP tool (see
+ * mcp-server.mjs's file header). Read-only, entirely local — no network call.
+ */
+export async function runHistory(args = [], opts = {}) {
+  const print   = opts.print         ?? ((s) => process.stdout.write(s));
+  const warn    = opts.warn          ?? ((s) => process.stderr.write(s));
+  const configDir = opts.configDir   ?? DEFAULT_CONFIG_DIR;
+  const isLic   = opts.isLicensed    ?? defaultIsLicensed;
+  const queryFn = opts.queryTicketHistoryFn ?? queryTicketHistory;
+
+  if (args.includes('--help') || args.includes('-h')) {
+    printHistoryHelp({ stream: { write: print, isTTY: process.stdout.isTTY } });
+    return;
+  }
+
+  if (!isLic('pro', configDir)) {
+    showUpgradePrompt('pro', 'ticketlens history', { stream: { write: warn, isTTY: process.stderr.isTTY } });
+    return;
+  }
+
+  const ticketKey = args[0];
+  if (!ticketKey || ticketKey.startsWith('-')) {
+    warn('Usage: ticketlens history TICKET-KEY\n');
+    process.exitCode = 1;
+    return;
+  }
+
+  const entries = queryFn(ticketKey, { configDir });
+  if (entries.length === 0) {
+    print(`No triage history found for ${ticketKey}.\n`);
+    return;
+  }
+
+  const hs = createStyler({ isTTY: process.stdout.isTTY });
+  print(`\nHistory for ${hs.bold(ticketKey)} (${entries.length} entries)\n\n`);
+  for (const e of entries) {
+    const bounce = e.bounced ? hs.yellow(' ⟳ bounced') : '';
+    const urg = e.urgency === 'needs-response' ? hs.red(e.urgency) : e.urgency === 'aging' ? hs.yellow(e.urgency) : hs.green(e.urgency);
+    print(`  ${hs.dim(e.date)}  [${e.profile}]  ${urg}${bounce}  ${hs.dim(e.reason)}\n`);
+  }
+  print('\n');
+}

package/skills/jtb/scripts/lib/secret-scanner.mjs

@@ -73,6 +73,11 @@ const HARD_REJECT_PATTERNS = [
 
 const EMAIL_RE = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/;
 
+// Shared between CODE_FILENAME_RE below and FILENAME_REFERENCE_RE further
+// down, the same way WHITESPACE_CLASS is shared across the whitespace
+// regexes above — one definition so the two can't silently drift apart.
+const CODE_EXTENSION_ALTERNATION = 'php|m?js|tsx?|jsx|py|rb|java|go|rs|vue|s?css|md|json|ya?ml|sh';
+
 // A letters-only token ending in a recognized source-file extension reads as
 // high-entropy the same way a real secret does — a class name doubling as its
 // filename is the common case, but a deliberately-renamed or accidentally
@@ -86,17 +91,60 @@ const EMAIL_RE = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/;
 // not a shortcut inside looksRandom itself. A bare identifier with no
 // extension (a method name, not a filename) isn't covered by this at all —
 // that shape is indistinguishable from a base64 secret fragment either way.
-const CODE_FILENAME_RE = /^[A-Za-z]+\.(php|m?js|tsx?|jsx|py|rb|java|go|rs|vue|s?css|md|json|ya?ml|sh)$/i;
+//
+// Stem allows hyphens (this project's own file-naming convention —
+// "recall-nudge-stop.mjs", "secret-scanner.mjs") captured as group 1, so
+// looksLikeCodeFilename can judge a kebab-case stem the same way
+// isHyphenatedWordCompound already judges one elsewhere in this file (see
+// its call below) — a real multi-word filename reads as short, plausible
+// segments, not one long random run.
+const CODE_FILENAME_RE = new RegExp(`^([A-Za-z][A-Za-z-]*)\\.(${CODE_EXTENSION_ALTERNATION})$`, 'i');
+
+// A hyphenated-stem filename (this project's own file-naming convention —
+// "secret-scanner.mjs", "note-command.mjs") optionally followed by a
+// directly-attached possessive apostrophe-s ("note-command.mjs's") stops a
+// joinedChunkRuns run the same way any other label word does (see
+// isLabelWord below). Deliberately a SEPARATE regex from CODE_FILENAME_RE
+// above rather than a loosened version of it: CODE_FILENAME_RE feeds
+// looksLikeCodeFilename's downgrade-a-reject-to-a-warning path and is
+// guarded by hasInternalCaseSwitch specifically so a random single-case
+// string plus a fake extension can't be silently waved through (see its
+// docstring) — loosening that guard is out of scope here and unnecessary:
+// this regex only ever stops a *run*, it never exempts a token from the
+// standalone entropy check (every token stays in the flat `tokens` array
+// in scanForSecrets regardless of isLabelWord), so it cannot itself bypass
+// detection the way a change to CODE_FILENAME_RE could.
+//
+// Known accepted gap, same class as isLabelWord's ordinary-word and
+// hyphenated-compound allowances below: a deliberate attacker could append
+// a fake ".mjs" (optionally + "'s") to the first half of a fragmented
+// secret specifically to stop the join here. Not a new exposure — this
+// file already accepts that an ordinary word or short hyphenated compound
+// can be used the same way (see isLabelWord's "Known accepted gap"
+// comment). HARD_REJECT_PATTERNS are unaffected either way: that pass uses
+// stopAtLabelWords:false and also checks the raw combined/despacedCombined
+// text regardless of any token's label-word status.
+const FILENAME_REFERENCE_RE = new RegExp(`^[A-Za-z][A-Za-z-]*\\.(${CODE_EXTENSION_ALTERNATION})('s)?$`, 'i');
 
 function looksLikeCodeFilename(rawToken) {
   const stripped = stripEdgePunctuation(rawToken);
   const match = stripped.match(CODE_FILENAME_RE);
-  // Requiring an internal case switch in the stem (the same signal used to
-  // detect base64 content elsewhere in this file) means a genuinely random
-  // single-case letter run plus a fake extension gets no special treatment
-  // at all — only tokens that already look like a real PascalCase/camelCase
-  // identifier reach the softer warning path below.
-  return match !== null && hasInternalCaseSwitch(match[0]);
+  if (match === null) return false;
+  // Two independent ways a filename-shaped token reads as "structured, not
+  // random" rather than a disguised secret: an internal case switch (the
+  // same signal used to detect base64 content elsewhere in this file) is
+  // the PascalCase/camelCase signal; isHyphenatedWordCompound (already
+  // defined above, already reused this way for the join-stopping check) is
+  // the kebab-case signal — this project's own actual file-naming
+  // convention. A genuinely random single-case, non-hyphenated letter run
+  // plus a fake extension satisfies neither and gets no special treatment
+  // at all — only tokens that already look like a real filename (either
+  // convention) reach the softer warning path below.
+  return hasInternalCaseSwitch(match[0]) || isHyphenatedWordCompound(match[1]);
+}
+
+function looksLikeFilenameReference(strippedToken) {
+  return FILENAME_REFERENCE_RE.test(strippedToken);
 }
 
 function shannonEntropy(token) {
@@ -190,13 +238,25 @@ function isHyphenatedWordCompound(token) {
 /**
  * True for a token that stops a joined-chunk run: either a recognized git/
  * checksum label word ("commit", "sha256", "md5sum", ...), a hyphenated
- * compound word (see isHyphenatedWordCompound), or an ordinary English word
- * (letters only, optionally with an internal possessive/contraction
- * apostrophe — "relay's", "doesn't" — but no base64-style case switching).
- * Anything else — a fragment containing a digit or other symbol, or an
- * all-letter chunk that still reads as random content — stays eligible to
- * join, so a secret split by whitespace can still be reassembled for the
- * entropy check.
+ * compound word (see isHyphenatedWordCompound), a filename reference (see
+ * FILENAME_REFERENCE_RE — "note-command.mjs", "note-command.mjs's"), or an
+ * ordinary English word (letters only, optionally with an internal
+ * possessive/contraction apostrophe — "relay's", "doesn't" — but no
+ * base64-style case switching). Anything else — a fragment containing a
+ * digit or other symbol, or an all-letter chunk that still reads as random
+ * content — stays eligible to join, so a secret split by whitespace can
+ * still be reassembled for the entropy check.
+ *
+ * Filename references (backlog #13) matter for the same reason the
+ * apostrophe allowance below does: "note-command.mjs's runNoteAdd" is
+ * ordinary engineering prose (a filename possessive next to an identifier),
+ * but before this allowance neither token qualified as a label word — the
+ * filename fails the ordinary-word branch (hyphen and period aren't
+ * letters) and the identifier fails it too (camelCase has an internal case
+ * switch, by design) — so they glued into one candidate that tripped the
+ * entropy threshold. See FILENAME_REFERENCE_RE's own comment for why this
+ * is scoped separately from CODE_FILENAME_RE/looksLikeCodeFilename and
+ * cannot reopen that function's CRITICAL-bypass guard.
  *
  * The apostrophe allowance matters because without it, an ordinary possessive
  * next to another non-label token (e.g. a hyphenated compound: "relay's
@@ -235,6 +295,7 @@ function isLabelWord(token) {
   const stripped = stripEdgePunctuation(token);
   if (GIT_REFERENCE_WORD_RE.test(stripped)) return true;
   if (isHyphenatedWordCompound(stripped)) return true;
+  if (looksLikeFilenameReference(stripped)) return true;
   return /^[A-Za-z]+(?:'[A-Za-z]+)*$/.test(stripped) && !hasInternalCaseSwitch(stripped);
 }