ticketlens 0.38.40 → 0.38.42

package/README.md

@@ -460,7 +460,7 @@ Every note is scanned before saving — anything shaped like a real secret (API
 
 **Tags matter for search relevance.** `--tags=a,b` accepts anything, but a generic tag (the project name, "gotcha", "bug") gives future search almost nothing to match on. Tag with what the note is actually *about* — the specific technology, error type, or root cause (`retry-backoff`, `null-pointer`, `auth-middleware`) — so it surfaces when someone else hits the same problem.
 
-**Local file attachments.** `note add --attach=path1,path2` (or the `recall_add` MCP tool's `attachments` array) saves a screenshot or file alongside the note, in your local vault only (`~/.ticketlens/recall/<PREFIX>/<note-id>/`) — same 10 MB/file, 50 MB/call, 20-file caps as ticket attachments. Unlike ticket attachments, this is never pushed to Team Recall sync — a teammate who pulls the note gets the text only, not the file.
+**Local file attachments.** `note add --attach=path1,path2` (or the `recall_add` MCP tool's `attachments` array) saves a screenshot or file alongside the note, in your local vault (`~/.ticketlens/recall/<PREFIX>/<note-id>/`) — same 10 MB/file, 50 MB/call, 20-file caps as ticket attachments for the local save. With Team Recall sync active, the attachment syncs too — visible and downloadable from Console > Admin > Recall — but the sync path caps at 12 MB/call (the backend's request-size limit, lower than the 50 MB local-save cap). Going over it fails the whole push, not just the attachment — the note stays saved locally, but neither its text nor the attachment reaches the team until it's pushed within the cap. Text-like attachments go through the same secret scan as the note body before syncing; a rejected scan blocks the whole push the same way.
 
 **Gaps** — every `ticketlens PROJ-123` brief also diffs the ticket's own description against its linked tickets (from the depth traversal you already requested) and its own downloaded attachments, looking for requirements mentioned there but missing here. Anything uncovered shows up under a `## Gaps` section, citing exactly where it came from — a linked ticket key or an attachment filename — as evidence, never an instruction to act on. Nothing is saved anywhere; it's recomputed fresh on every fetch. Requires a Pro license, same as Recall. No network call beyond what the brief already made.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ticketlens",
-  "version": "0.38.40",
+  "version": "0.38.42",
   "description": "Jira CLI for developers — fetch ticket context, triage your queue, and stop tab-switching. Zero dependencies, all local.",
   "type": "module",
   "bin": {

package/skills/jtb/SKILL.md

@@ -1,4 +1,4 @@
-<!-- jtb-skill-version: 0.42.0 -->
+<!-- jtb-skill-version: 0.42.2 -->
 ---
 name: jtb
 description: Fetch a Jira ticket's full context (description, comments, linked issues, code references) and assemble a structured TicketBrief for implementation planning. Use when user types /jtb, mentions a Jira ticket key, or wants to plan work from a Jira ticket.
@@ -371,7 +371,7 @@ echo "The body text of the note, one or more paragraphs." | \
 
 **Choosing tags:** derive them from this note's actual content — the specific technology, error type, root cause, or affected component (e.g. `retry-backoff`, `null-pointer`, `auth-middleware`) — never the project name or a generic category word like `gotcha` or `bug`. A tag like `jtb` or `ticketlens` tells a future search nothing that the ticket/project context doesn't already say; a tag like `retry-backoff` is what actually surfaces this note when someone else hits the same problem. A tag that just restates the title in different words, or one you can't trace to a specific sentence in the body, gives that same zero signal — if you can't point to the exact phrase that justifies it, drop it. Same rule whether you're constructing the bash command above or calling `recall_add` directly — see its tool description for the same guidance.
 
-**Attaching local files.** `note add --attach=path1,path2` (Pro) saves a screenshot or file alongside the note, in the local vault only — same 10 MB/file, 50 MB/call, 20-file caps as `ticket_create`/`ticket_comment`'s `--attach`. Unlike ticket attachments, this never uploads anywhere: it is not pushed to the team Console backend even with Team Recall sync active, so a teammate who pulls this note gets the text only, not the file. The `recall_add` MCP tool has a matching `attachments` array parameter — prefer it over the bash form when available, same rule as the rest of this section.
+**Attaching local files.** `note add --attach=path1,path2` (Pro) saves a screenshot or file alongside the note — same 10 MB/file, 50 MB/call, 20-file caps as `ticket_create`/`ticket_comment`'s `--attach` for the local save. If this account is entitled and the note syncs to a team (Team Recall sync active), the attachment syncs with it — visible and downloadable from Console > Admin > Recall, not just text-only. The sync path has a lower 12 MB/call cap than the local save (bounded by the backend's request-size limit, not the CLI). Going over it fails the whole push, not just the attachment — the note stays saved locally, but neither its text nor the attachment reaches the team until pushed within the cap. Text-like attachments (`.txt`/`.log`/`.md`/etc.) go through the same secret scan as the note body before syncing; a rejected scan blocks the whole push the same way. The `recall_add` MCP tool has a matching `attachments` array parameter — prefer it over the bash form when available, same rule as the rest of this section.
 
 To search saved notes directly (outside of automatic brief injection): `ticketlens recall "<query>"`.
 

package/skills/jtb/scripts/lib/mcp-tool-schemas.mjs

@@ -165,7 +165,7 @@ export const TOOLS = [
         ticket: { type: 'string', description: 'Optional ticket key, e.g. PROJ-123.' },
         tags: { type: 'array', items: { type: 'string' }, description: 'Optional tags derived from this note\'s actual content — the specific technology, error type, root cause, or affected component (e.g. "retry-backoff", "null-pointer", "auth-middleware"). Never the project name or a generic category word like "gotcha" or "bug" — those provide no search signal to someone else looking for this note later. A tag that just restates the title in different words, or one you cannot trace to a specific sentence in the body, gives that same zero signal — if you cannot point to the exact phrase that justifies it, drop it.' },
         body: { type: 'string', description: 'The note body — one or more paragraphs.' },
-        attachments: { type: 'array', items: { type: 'string' }, description: 'Local file paths to attach (screenshots, logs, etc.), saved next to the note in the local vault. Same 10MB/file, 50MB/call, 20-file caps as ticket_comment/ticket_create. Unlike ticket attachments, these are never pushed to Team Recall sync — a teammate who pulls this note gets the text only, not the file.' },
+        attachments: { type: 'array', items: { type: 'string' }, description: 'Local file paths to attach (screenshots, logs, etc.), saved next to the note in the local vault. Same 10MB/file, 50MB/call, 20-file caps as ticket_comment/ticket_create for the local save. If this account is entitled and the note syncs to a team, attachments sync too — visible and downloadable from Console > Admin > Recall — but the sync path has a lower 12MB/call cap than the local save (backend request-size limit). Going over it fails the WHOLE push (note text included), not just the attachment; the note stays saved locally either way.' },
       },
       required: ['title', 'body'],
     },

package/skills/jtb/scripts/lib/note-command.mjs

@@ -191,6 +191,13 @@ export async function runNoteAdd(cmdArgs, {
     const recallTeamId = profile ? loadProfileRecallTeamIdFn(profile.name, configDir) : null;
     const payload = { external_id: id, title, tickets: ticketKeys, tags, author, sources: [], body, captured_at: capturedAt.toISOString() };
     if (recallTeamId !== null) payload.group_id = recallTeamId;
+    // Base64 over the existing JSON push endpoint — additive to the wire
+    // contract, no new request format. Backend re-validates size/count caps
+    // independently (RecallAttachmentStorage) rather than trusting this
+    // client-side pass, same defense-in-depth posture as the secret scanner.
+    if (attachments.length > 0) {
+      payload.attachments = attachments.map(a => ({ filename: a.filename, content: a.buffer.toString('base64') }));
+    }
     const result = await pushNoteFn(payload, { cliToken, configDir, warn });
     if (isRetryableFailureFn(result)) {
       await enqueueNoteFn(payload, { cliToken, configDir, warn });

package/skills/jtb/scripts/lib/secret-scanner.mjs

@@ -172,34 +172,49 @@ const UNDERSCORE_COMPOUND_RE = /^[A-Za-z]+(_[A-Za-z]+)+$/;
 // delimiters within one candidate would need.
 const SLASH_PATH_RE = /^[A-Za-z0-9]+(\/[A-Za-z0-9]+)+\/?$/;
 
+// PHP static method/property/const access (Class_Name::method,
+// Class_Name::CONST), optionally prefixed by a leading backslash (PHP's
+// fully-qualified global-namespace form — stripEdgePunctuation does not
+// strip a LEADING backslash, only the trailing/leading punctuation in
+// EDGE_PUNCTUATION_RE's class). The class part reuses the same shape as
+// UNDERSCORE_COMPOUND_RE but allows a bare (non-underscore) class name too
+// — real code has both ("Zend_Http_Client::GET" and "Router::dispatch").
+// Found live: backlog #17's ORIGINAL bug report repro included this exact
+// class+member shape (`Advent_Http_ClientFactory::clientForJson`,
+// `Zend_Http_Client::GET`), but the first fix only covered the bare class
+// name in isolation — the embedded "::member" broke UNDERSCORE_COMPOUND_RE's
+// match (colons aren't letters/underscores) and no other exemption applied.
+const STATIC_REFERENCE_RE = /^\\?([A-Za-z]+(?:_[A-Za-z]+)*)::([A-Za-z_][A-Za-z0-9_]*)$/;
+
 /**
  * Downgrade-only, same never-exempt treatment as looksLikeCodeFilename and
  * looksLikeCodeSyntax below: true for a candidate shaped like a multi-segment
- * code identifier (underscore-delimited PHP/Zend-1-style class name) or a
- * namespace/filesystem path (slash-delimited), each segment capped at
- * MAX_COMPOUND_SEGMENT_LENGTH so a long random run can't pose as one
- * "segment" — same cap isHyphenatedWordCompound already uses. Backlog #17:
- * isLabelWord's ordinary-word branch only matches letters-only tokens with
- * no separator at all, and neither existing downgrade path below requires a
- * file extension or bracket/paren — so a standalone identifier or path like
- * the two shapes above had no exemption path whatsoever, unlike a hyphenated
- * compound or a dotted filename.
+ * code identifier (underscore-delimited PHP/Zend-1-style class name), a
+ * namespace/filesystem path (slash-delimited), or a PHP static method/const
+ * reference (Class_Name::member, see STATIC_REFERENCE_RE), each segment
+ * capped at MAX_COMPOUND_SEGMENT_LENGTH so a long random run can't pose as
+ * one "segment" — same cap isHyphenatedWordCompound already uses. Backlog
+ * #17: isLabelWord's ordinary-word branch only matches letters-only tokens
+ * with no separator at all, and neither existing downgrade path below
+ * requires a file extension or bracket/paren — so a standalone identifier,
+ * path, or static reference like the three shapes above had no exemption
+ * path whatsoever, unlike a hyphenated compound or a dotted filename.
  *
- * A disguised real secret matching either shape still surfaces as a
- * warning, never a silent pass — see the security regression tests
- * alongside this function's own tests for both shapes.
+ * A disguised real secret matching any of the three shapes still surfaces
+ * as a warning, never a silent pass — see the security regression tests
+ * alongside this function's own tests for all three shapes.
  *
  * Known accepted gap (security review, backlog #17): unlike
  * isHyphenatedWordCompound, this has no whole-token case-switch guard (see
  * UNDERSCORE_COMPOUND_RE's own comment for why one can't be added without
  * rejecting the real Zend_Http_Client-shaped identifiers this exists to
  * recognize) — so a uniform-case (all-upper or all-lower) letters-only
- * secret needs only ONE underscore or slash inserted to downgrade from a
- * full reject to a warning, no camouflage (fake extension, case pattern)
- * required. Still never a silent pass — always a warning — so this is the
- * same class of trade-off as CODE_SYNTAX_RE's even less-constrained
- * downgrade above (any bracket/paren, no shape requirement at all), not a
- * new exposure.
+ * secret needs only ONE underscore, slash, or "::" inserted to downgrade
+ * from a full reject to a warning, no camouflage (fake extension, case
+ * pattern) required. Still never a silent pass — always a warning — so
+ * this is the same class of trade-off as CODE_SYNTAX_RE's even less-
+ * constrained downgrade above (any bracket/paren, no shape requirement at
+ * all), not a new exposure.
  */
 function looksLikeCodeIdentifierOrPath(rawToken) {
   const stripped = stripEdgePunctuation(rawToken);
@@ -209,6 +224,12 @@ function looksLikeCodeIdentifierOrPath(rawToken) {
   if (SLASH_PATH_RE.test(stripped)) {
     return stripped.split('/').filter(Boolean).every(segment => segment.length <= MAX_COMPOUND_SEGMENT_LENGTH);
   }
+  const staticRefMatch = stripped.match(STATIC_REFERENCE_RE);
+  if (staticRefMatch) {
+    const classSegmentsWithinCap = staticRefMatch[1].split('_').every(segment => segment.length <= MAX_COMPOUND_SEGMENT_LENGTH);
+    const memberWithinCap = staticRefMatch[2].length <= MAX_COMPOUND_SEGMENT_LENGTH;
+    return classSegmentsWithinCap && memberWithinCap;
+  }
   return false;
 }