ticketlens 0.38.38 → 0.38.40

package/README.md

@@ -460,7 +460,7 @@ Every note is scanned before saving — anything shaped like a real secret (API
 
 **Tags matter for search relevance.** `--tags=a,b` accepts anything, but a generic tag (the project name, "gotcha", "bug") gives future search almost nothing to match on. Tag with what the note is actually *about* — the specific technology, error type, or root cause (`retry-backoff`, `null-pointer`, `auth-middleware`) — so it surfaces when someone else hits the same problem.
 
-**Local file attachments.** `note add --attach=path1,path2` saves a screenshot or file alongside the note, in your local vault only (`~/.ticketlens/recall/<PREFIX>/<note-id>/`) — same 10 MB/file, 50 MB/call, 20-file caps as ticket attachments. Unlike ticket attachments, this is never pushed to Team Recall sync — a teammate who pulls the note gets the text only, not the file.
+**Local file attachments.** `note add --attach=path1,path2` (or the `recall_add` MCP tool's `attachments` array) saves a screenshot or file alongside the note, in your local vault only (`~/.ticketlens/recall/<PREFIX>/<note-id>/`) — same 10 MB/file, 50 MB/call, 20-file caps as ticket attachments. Unlike ticket attachments, this is never pushed to Team Recall sync — a teammate who pulls the note gets the text only, not the file.
 
 **Gaps** — every `ticketlens PROJ-123` brief also diffs the ticket's own description against its linked tickets (from the depth traversal you already requested) and its own downloaded attachments, looking for requirements mentioned there but missing here. Anything uncovered shows up under a `## Gaps` section, citing exactly where it came from — a linked ticket key or an attachment filename — as evidence, never an instruction to act on. Nothing is saved anywhere; it's recomputed fresh on every fetch. Requires a Pro license, same as Recall. No network call beyond what the brief already made.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ticketlens",
-  "version": "0.38.38",
+  "version": "0.38.40",
   "description": "Jira CLI for developers — fetch ticket context, triage your queue, and stop tab-switching. Zero dependencies, all local.",
   "type": "module",
   "bin": {

package/skills/jtb/SKILL.md

@@ -1,4 +1,4 @@
-<!-- jtb-skill-version: 0.41.0 -->
+<!-- jtb-skill-version: 0.42.0 -->
 ---
 name: jtb
 description: Fetch a Jira ticket's full context (description, comments, linked issues, code references) and assemble a structured TicketBrief for implementation planning. Use when user types /jtb, mentions a Jira ticket key, or wants to plan work from a Jira ticket.
@@ -371,7 +371,7 @@ echo "The body text of the note, one or more paragraphs." | \
 
 **Choosing tags:** derive them from this note's actual content — the specific technology, error type, root cause, or affected component (e.g. `retry-backoff`, `null-pointer`, `auth-middleware`) — never the project name or a generic category word like `gotcha` or `bug`. A tag like `jtb` or `ticketlens` tells a future search nothing that the ticket/project context doesn't already say; a tag like `retry-backoff` is what actually surfaces this note when someone else hits the same problem. A tag that just restates the title in different words, or one you can't trace to a specific sentence in the body, gives that same zero signal — if you can't point to the exact phrase that justifies it, drop it. Same rule whether you're constructing the bash command above or calling `recall_add` directly — see its tool description for the same guidance.
 
-**Attaching local files.** `note add --attach=path1,path2` (Pro) saves a screenshot or file alongside the note, in the local vault only — same 10 MB/file, 50 MB/call, 20-file caps as `ticket_create`/`ticket_comment`'s `--attach`. Unlike ticket attachments, this never uploads anywhere: it is not pushed to the team Console backend even with Team Recall sync active, so a teammate who pulls this note gets the text only, not the file. The `recall_add` MCP tool does not yet support attachments — this is CLI-only today; use the bash form above when a file needs to be attached.
+**Attaching local files.** `note add --attach=path1,path2` (Pro) saves a screenshot or file alongside the note, in the local vault only — same 10 MB/file, 50 MB/call, 20-file caps as `ticket_create`/`ticket_comment`'s `--attach`. Unlike ticket attachments, this never uploads anywhere: it is not pushed to the team Console backend even with Team Recall sync active, so a teammate who pulls this note gets the text only, not the file. The `recall_add` MCP tool has a matching `attachments` array parameter — prefer it over the bash form when available, same rule as the rest of this section.
 
 To search saved notes directly (outside of automatic brief injection): `ticketlens recall "<query>"`.
 

package/skills/jtb/scripts/lib/mcp-server.mjs

@@ -362,10 +362,11 @@ async function callCollisions(args, { configDir, runCollisionsFn }) {
  * `--ticket=EVIL-999` stays inert precisely because it's never anything
  * but one opaque array element.
  */
-function buildNoteAddArgs({ title, ticket, tags }) {
+function buildNoteAddArgs({ title, ticket, tags, attachments }) {
   const args = [`--title=${title}`];
   if (ticket) args.push(`--ticket=${ticket}`);
   if (Array.isArray(tags) && tags.length > 0) args.push(`--tags=${tags.join(',')}`);
+  if (Array.isArray(attachments) && attachments.length > 0) args.push(`--attach=${attachments.join(',')}`);
   return args;
 }
 

package/skills/jtb/scripts/lib/mcp-tool-schemas.mjs

@@ -165,6 +165,7 @@ export const TOOLS = [
         ticket: { type: 'string', description: 'Optional ticket key, e.g. PROJ-123.' },
         tags: { type: 'array', items: { type: 'string' }, description: 'Optional tags derived from this note\'s actual content — the specific technology, error type, root cause, or affected component (e.g. "retry-backoff", "null-pointer", "auth-middleware"). Never the project name or a generic category word like "gotcha" or "bug" — those provide no search signal to someone else looking for this note later. A tag that just restates the title in different words, or one you cannot trace to a specific sentence in the body, gives that same zero signal — if you cannot point to the exact phrase that justifies it, drop it.' },
         body: { type: 'string', description: 'The note body — one or more paragraphs.' },
+        attachments: { type: 'array', items: { type: 'string' }, description: 'Local file paths to attach (screenshots, logs, etc.), saved next to the note in the local vault. Same 10MB/file, 50MB/call, 20-file caps as ticket_comment/ticket_create. Unlike ticket attachments, these are never pushed to Team Recall sync — a teammate who pulls this note gets the text only, not the file.' },
       },
       required: ['title', 'body'],
     },

package/skills/jtb/scripts/lib/secret-scanner.mjs

@@ -150,6 +150,68 @@ const CODE_FILENAME_RE = new RegExp(`^([A-Za-z][A-Za-z-]*)\\.(${CODE_EXTENSION_A
 // text regardless of any token's label-word status.
 const FILENAME_REFERENCE_RE = new RegExp(`^[A-Za-z][A-Za-z-]*\\.(${CODE_EXTENSION_ALTERNATION})('s)?$`, 'i');
 
+// Underscore-delimited segments (Zend-1-style PHP class names — a common
+// legacy naming convention, e.g. "Acme_Http_ClientFactory",
+// "Zend_Http_Client") are letters-only per segment, no digit support (same
+// convention as CODE_FILENAME_RE's stem). Deliberately does NOT require
+// isHyphenatedWordCompound's "no internal case switch" guard: that guard
+// exists there to keep base64-shaped content from posing as a lowercase-
+// English hyphenated compound, but PascalCase segments ARE the real,
+// expected positive signal for a class name ("ClientFactory",
+// "SaleSystem") — requiring their absence would reject the exact
+// legitimate shape this exists to recognize. See
+// looksLikeCodeIdentifierOrPath's own comment for how this stays
+// downgrade-only despite that asymmetry.
+const UNDERSCORE_COMPOUND_RE = /^[A-Za-z]+(_[A-Za-z]+)+$/;
+
+// Slash-delimited path segments (a namespace-shaped filesystem/class path —
+// "acme/library/Billing/Client/Http/Adapter/Fetch/", optionally trailing-
+// slash-terminated). Allows digits per segment (real
+// directory/namespace segments routinely do — "v2", "api2"), unlike the
+// underscore shape above — a deliberate, narrower convention than mixing
+// delimiters within one candidate would need.
+const SLASH_PATH_RE = /^[A-Za-z0-9]+(\/[A-Za-z0-9]+)+\/?$/;
+
+/**
+ * Downgrade-only, same never-exempt treatment as looksLikeCodeFilename and
+ * looksLikeCodeSyntax below: true for a candidate shaped like a multi-segment
+ * code identifier (underscore-delimited PHP/Zend-1-style class name) or a
+ * namespace/filesystem path (slash-delimited), each segment capped at
+ * MAX_COMPOUND_SEGMENT_LENGTH so a long random run can't pose as one
+ * "segment" — same cap isHyphenatedWordCompound already uses. Backlog #17:
+ * isLabelWord's ordinary-word branch only matches letters-only tokens with
+ * no separator at all, and neither existing downgrade path below requires a
+ * file extension or bracket/paren — so a standalone identifier or path like
+ * the two shapes above had no exemption path whatsoever, unlike a hyphenated
+ * compound or a dotted filename.
+ *
+ * A disguised real secret matching either shape still surfaces as a
+ * warning, never a silent pass — see the security regression tests
+ * alongside this function's own tests for both shapes.
+ *
+ * Known accepted gap (security review, backlog #17): unlike
+ * isHyphenatedWordCompound, this has no whole-token case-switch guard (see
+ * UNDERSCORE_COMPOUND_RE's own comment for why one can't be added without
+ * rejecting the real Zend_Http_Client-shaped identifiers this exists to
+ * recognize) — so a uniform-case (all-upper or all-lower) letters-only
+ * secret needs only ONE underscore or slash inserted to downgrade from a
+ * full reject to a warning, no camouflage (fake extension, case pattern)
+ * required. Still never a silent pass — always a warning — so this is the
+ * same class of trade-off as CODE_SYNTAX_RE's even less-constrained
+ * downgrade above (any bracket/paren, no shape requirement at all), not a
+ * new exposure.
+ */
+function looksLikeCodeIdentifierOrPath(rawToken) {
+  const stripped = stripEdgePunctuation(rawToken);
+  if (UNDERSCORE_COMPOUND_RE.test(stripped)) {
+    return stripped.split('_').every(segment => segment.length <= MAX_COMPOUND_SEGMENT_LENGTH);
+  }
+  if (SLASH_PATH_RE.test(stripped)) {
+    return stripped.split('/').filter(Boolean).every(segment => segment.length <= MAX_COMPOUND_SEGMENT_LENGTH);
+  }
+  return false;
+}
+
 function looksLikeCodeFilename(rawToken) {
   const stripped = stripEdgePunctuation(rawToken);
   const match = stripped.match(CODE_FILENAME_RE);
@@ -443,7 +505,11 @@ export function scanForSecrets({ title = '', tags = [], body = '' } = {}) {
   // Downgrading to a warning — never silently dropping the signal — matches
   // how an email address is already handled below.
   const randomCandidates = candidates.filter(token => !EMAIL_RE.test(token) && looksRandom(token, combined));
-  if (randomCandidates.some(token => !looksLikeCodeFilename(token) && !looksLikeCodeSyntax(token))) {
+  if (
+    randomCandidates.some(
+      token => !looksLikeCodeFilename(token) && !looksLikeCodeSyntax(token) && !looksLikeCodeIdentifierOrPath(token),
+    )
+  ) {
     reasons.push('Contains a long, random-looking string that could be a secret.');
   }
   if (randomCandidates.some(token => looksLikeCodeFilename(token))) {
@@ -452,6 +518,9 @@ export function scanForSecrets({ title = '', tags = [], body = '' } = {}) {
   if (randomCandidates.some(token => looksLikeCodeSyntax(token))) {
     warnings.push('Contains a code-syntax-shaped token (brackets or parentheses) that also reads as high-entropy — double-check it is not a credential.');
   }
+  if (randomCandidates.some(token => looksLikeCodeIdentifierOrPath(token))) {
+    warnings.push('Contains a code-identifier-or-path-shaped token that also reads as high-entropy — double-check it is not a credential.');
+  }
 
   if (EMAIL_RE.test(combined)) {
     warnings.push('Contains an email address.');