ticketlens 0.39.6 → 0.40.0

package/README.md

@@ -1121,6 +1121,7 @@ npm test
 See [ROADMAP.md](ROADMAP.md) for the full plan.
 
 Recently shipped:
+- **Console: Recall "select all N matching" bulk delete** — Gmail-style banner deletes every note matching your search/filters across all pages, not just the current one
 - **Recall Stop-hook fix** — the end-of-session Recall reminder no longer fires because of file writes; only real ticket writes (comment, transition, assign, update) arm it. Also hardened against malformed transcripts and a session-id path-collision bug found by adversarial testing
 - **Console: no repeat request on same-page menu clicks** — sidebar links, the header gear and Settings tabs skip the request when they point at the page you are on
 - **Worklog** (`ticketlens worklog`, `ticket_worklog` MCP) — log time on Jira tickets, preview first. Pro tier

package/bin/ticketlens.mjs

@@ -16,7 +16,7 @@ import { runSwitch } from '../skills/jtb/scripts/lib/profile-switcher.mjs';
 import { runProfilesSetTeam } from '../skills/jtb/scripts/lib/profile-set-team.mjs';
 import { run as runConfig } from '../skills/jtb/scripts/lib/config-wizard.mjs';
 import { activateLicense, checkLicense, revalidateIfStale, isLicensed, showUpgradePrompt, readLicense } from '../skills/jtb/scripts/lib/license.mjs';
-import { deleteProfile, loadProfiles, saveCredentialKey, resolveRecallStrictnessTarget, saveProfileRecallStrictness, RECALL_STRICTNESS_LEVELS } from '../skills/jtb/scripts/lib/profile-resolver.mjs';
+import { deleteProfile, loadProfiles, saveCredentialKey, resolveRecallStrictnessTarget, saveProfileRecallStrictness, RECALL_STRICTNESS_LEVELS, saveErrorReportingConsent } from '../skills/jtb/scripts/lib/profile-resolver.mjs';
 import { run as runCache } from '../skills/jtb/scripts/lib/cache-manager.mjs';
 import { runDoctor } from '../skills/jtb/scripts/lib/doctor-command.mjs';
 import {
@@ -43,6 +43,16 @@ import { incrementInvocation, incrementCommand } from '../skills/jtb/scripts/lib
 import { DEFAULT_CONFIG_DIR } from '../skills/jtb/scripts/lib/config.mjs';
 import { checkTeamJiraConfigUpdate } from '../skills/jtb/scripts/lib/team-jira-sync.mjs';
 import { maybeAutoFlush } from '../skills/jtb/scripts/lib/recall-queue.mjs';
+import { maybeReportError } from '../skills/jtb/scripts/lib/error-reporter.mjs';
+
+// Fire-and-forget (49e) — never awaited by a caller, mirrors checkForUpdate's
+// own fire-and-forget style. maybeReportError already self-catches
+// everything internally; the extra .catch(() => {}) here is a second,
+// outermost safety net so this can never produce an unhandled rejection
+// regardless of what changes inside that function later.
+function reportError(err, command) {
+  maybeReportError(err, command).catch(() => {});
+}
 
 const TRACKED_COMMANDS = new Set([
   'triage', 'fetch', 'get', 'compliance', 'review', 'standup',
@@ -121,6 +131,7 @@ switch (command) {
     }).catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
+      reportError(err, 'fetch');
     });
     break;
   }
@@ -129,6 +140,7 @@ switch (command) {
     runTriage(cmdArgs).catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
+      reportError(err, 'triage');
     });
     break;
 
@@ -138,6 +150,7 @@ switch (command) {
     runCollisions(cmdArgs).catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
+      reportError(err, 'collisions');
     });
     break;
   }
@@ -147,6 +160,7 @@ switch (command) {
     runHistory(cmdArgs).catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
+      reportError(err, 'history');
     });
     break;
   }
@@ -156,6 +170,7 @@ switch (command) {
     runStats(cmdArgs).catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
+      reportError(err, 'stats');
     });
     break;
   }
@@ -165,6 +180,7 @@ switch (command) {
     runIssueTypes(cmdArgs).catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
+      reportError(err, 'issue-types');
     });
     break;
   }
@@ -176,6 +192,7 @@ switch (command) {
     }).catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
+      reportError(err, 'doctor');
     });
     break;
   }
@@ -185,6 +202,7 @@ switch (command) {
     runInit().catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
+      reportError(err, 'init');
     });
     break;
 
@@ -193,6 +211,7 @@ switch (command) {
     runSwitch().catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
+      reportError(err, 'switch');
     });
     break;
 
@@ -219,6 +238,19 @@ switch (command) {
       break;
     }
 
+    if (cmdArgs[0] === 'set' && cmdArgs[1] === 'errorReporting') {
+      const s = createStyler({ isTTY: process.stdout.isTTY });
+      const value = cmdArgs[2];
+      if (value !== 'on' && value !== 'off') {
+        process.stderr.write(`${s.red('✖')} Missing or invalid value.\n  Usage: ticketlens config set errorReporting <on|off>\n`);
+        process.exitCode = 1;
+        break;
+      }
+      saveErrorReportingConsent(value === 'on', DEFAULT_CONFIG_DIR);
+      process.stdout.write(`  ${s.green('✔')} Error reporting ${s.bold(s.cyan(value))}\n`);
+      break;
+    }
+
     if (cmdArgs[0] === 'set' && cmdArgs[1] === 'recallStrictness') {
       const s = createStyler({ isTTY: process.stdout.isTTY });
       const value = cmdArgs[2];
@@ -265,6 +297,7 @@ switch (command) {
     })().catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
+      reportError(err, 'config');
     });
     break;
   }
@@ -290,6 +323,7 @@ switch (command) {
     }).catch(err => {
       process.stderr.write(`\n  ${s.red('✖')} Activation error: ${err.message}\n\n`);
       process.exitCode = 1;
+      reportError(err, 'activate');
     });
     break;
   }
@@ -408,6 +442,7 @@ switch (command) {
       runProfilesSetTeam(profileName, teamName).catch(err => {
         process.stderr.write(`Error: ${err.message}\n`);
         process.exitCode = 1;
+        reportError(err, 'profiles');
       });
       break;
     }
@@ -422,6 +457,7 @@ switch (command) {
     runCache(cmdArgs).catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
+      reportError(err, 'cache');
     });
     break;
 
@@ -489,6 +525,7 @@ switch (command) {
     runFetch(['install-hooks', ...cmdArgs]).catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
+      reportError(err, 'install-hooks');
     });
     break;
 
@@ -497,6 +534,7 @@ switch (command) {
     runFetch(['pr', ...cmdArgs]).catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
+      reportError(err, 'pr');
     });
     break;
 
@@ -505,6 +543,7 @@ switch (command) {
     runFetch(['review', ...cmdArgs]).catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
+      reportError(err, 'review');
     });
     break;
 
@@ -513,6 +552,7 @@ switch (command) {
     runFetch(['standup', ...cmdArgs]).catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
+      reportError(err, 'standup');
     });
     break;
 
@@ -521,6 +561,7 @@ switch (command) {
     runFetch(['ledger', ...cmdArgs]).catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
+      reportError(err, 'ledger');
     });
     break;
 
@@ -529,6 +570,7 @@ switch (command) {
     runFetch(['compliance', ...cmdArgs]).catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
+      reportError(err, 'compliance');
     });
     break;
 
@@ -549,6 +591,7 @@ switch (command) {
     })().catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
+      reportError(err, 'login');
     });
     break;
   }
@@ -589,6 +632,7 @@ switch (command) {
     })().catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
+      reportError(err, 'sync');
     });
     break;
   }
@@ -707,6 +751,7 @@ switch (command) {
     })().catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
+      reportError(err, 'cloud-keys');
     });
     break;
   }
@@ -720,6 +765,7 @@ switch (command) {
       }).catch(err => {
         process.stderr.write(`Error: ${err.message}\n`);
         process.exitCode = 1;
+        reportError(err, 'note');
       });
       break;
     }
@@ -730,6 +776,7 @@ switch (command) {
       }).catch(err => {
         process.stderr.write(`Error: ${err.message}\n`);
         process.exitCode = 1;
+        reportError(err, 'note');
       });
       break;
     }
@@ -740,6 +787,7 @@ switch (command) {
       }).catch(err => {
         process.stderr.write(`Error: ${err.message}\n`);
         process.exitCode = 1;
+        reportError(err, 'note');
       });
       break;
     }
@@ -757,6 +805,7 @@ switch (command) {
       }).catch(err => {
         process.stderr.write(`Error: ${err.message}\n`);
         process.exitCode = 1;
+        reportError(err, 'recall');
       });
       break;
     }
@@ -767,6 +816,7 @@ switch (command) {
       }).catch(err => {
         process.stderr.write(`Error: ${err.message}\n`);
         process.exitCode = 1;
+        reportError(err, 'recall');
       });
       break;
     }
@@ -776,6 +826,7 @@ switch (command) {
     }).catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
+      reportError(err, 'recall');
     });
     break;
   }
@@ -803,6 +854,7 @@ switch (command) {
     }).catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
+      reportError(err, 'comment');
     });
     break;
   }
@@ -819,6 +871,7 @@ switch (command) {
     }).catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
+      reportError(err, 'transition');
     });
     break;
   }
@@ -831,6 +884,7 @@ switch (command) {
     }).catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
+      reportError(err, 'assign');
     });
     break;
   }
@@ -843,6 +897,7 @@ switch (command) {
     }).catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
+      reportError(err, 'worklog');
     });
     break;
   }
@@ -855,6 +910,7 @@ switch (command) {
     }).catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
+      reportError(err, 'duplicates');
     });
     break;
   }
@@ -871,6 +927,7 @@ switch (command) {
     }).catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
+      reportError(err, 'link');
     });
     break;
   }
@@ -883,6 +940,7 @@ switch (command) {
     }).catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
+      reportError(err, 'update');
     });
     break;
   }
@@ -895,6 +953,7 @@ switch (command) {
     }).catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
+      reportError(err, 'create');
     });
     break;
   }
@@ -916,6 +975,7 @@ switch (command) {
     })().catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
+      reportError(err, command);
     });
     break;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ticketlens",
-  "version": "0.39.6",
+  "version": "0.40.0",
   "description": "Jira CLI for developers — fetch ticket context, triage your queue, and stop tab-switching. Zero dependencies, all local.",
   "type": "module",
   "bin": {

package/skills/jtb/SKILL.md

@@ -1,4 +1,4 @@
-<!-- jtb-skill-version: 0.44.2 -->
+<!-- jtb-skill-version: 0.45.0 -->
 ---
 name: jtb
 description: Fetch a Jira ticket's full context (description, comments, linked issues, code references) and assemble a structured TicketBrief for implementation planning. Use when user types /jtb, mentions a Jira ticket key, or wants to plan work from a Jira ticket.
@@ -510,6 +510,19 @@ A report with `ok: false` is a successful tool call describing failures, not a t
 
 ---
 
+## Opt-in error reporting
+
+Off by default. The first time a command hits a genuine unexpected error while running in a real interactive terminal, TicketLens asks once — "Would you like TicketLens to send reports about issues, bugs, and errors to improve your experience?" — and remembers the answer permanently, never asking again. It never asks under an MCP-connected harness, CI, or any piped/non-interactive invocation; in those contexts an undecided consent state just stays undecided and nothing is sent.
+
+When consent is `on`, an unexpected error triggers a best-effort, fire-and-forget report — CLI version, OS, the command name, the error message, and a stack trace. This never delays or affects the command's own exit code or stderr output; a failed or slow send is silently dropped. The message and stack trace are scanned for secret-shaped content (same scanner `note add` uses) before anything leaves the machine — a flagged report is dropped, not sent redacted. No account, profile name, ticket data, or credential ever leaves the machine as part of this — reports are anonymous.
+
+```bash
+ticketlens config set errorReporting on     # opt in explicitly, skip the prompt
+ticketlens config set errorReporting off    # opt out — also the way to change your mind after saying yes
+```
+
+---
+
 ## Gaps — cross-ticket evidence (Pro)
 
 If the TicketBrief includes a `## Gaps` section, each entry is a requirement found in a linked ticket or in one of this ticket's own attachments that doesn't appear to be covered by this ticket's description. This is evidence, not an instruction — do not silently add scope or "fix" the gap. Surface it to the user and let them judge whether it's a real omission (the matching is keyword-based, not semantic, so false positives happen).

package/skills/jtb/scripts/lib/error-reporter.mjs

@@ -0,0 +1,110 @@
+/**
+ * Opt-in CLI error/diagnostic reporting (49e). Wraps every command's
+ * top-level .catch() in bin/ticketlens.mjs via handleCommandError() there.
+ *
+ * Consent is asked at most once, ever, and only when a real error just
+ * happened and the process's stdin+stderr are both a real terminal, outside
+ * CI — never under MCP stdio (that path has no wiring to this function at
+ * all) or CI. isInteractive is a TTY check, not an output-format check: a
+ * human can be genuinely present and able to answer a stderr prompt
+ * regardless of what flags the command itself was given.
+ *
+ * The prompt is still bounded (PROMPT_TIMEOUT_MS, via promptYN's timeoutMs —
+ * see prompt-helpers.mjs) so an unanswered question can never hang the
+ * process indefinitely (security review finding, 2026-09-23: the first
+ * version had no timeout here — an orphaned raw-mode stdin listener keeps
+ * Node's event loop alive regardless of what a caller does with the
+ * returned promise, so the timeout has to live inside promptYN itself, not
+ * be raced against externally). A timeout resolves to `null`, distinct from
+ * a real `false` answer — it is never persisted, so an AFK/non-responsive
+ * user is asked again on the next real error, not permanently opted out.
+ *
+ * Once a real (non-null) answer is given, it's never asked again
+ * (loadErrorReportingConsent/saveErrorReportingConsent, profile-resolver.mjs).
+ *
+ * Sending is entirely best-effort: a broken network, a rejected promptFn, or
+ * a scan false-positive must never surface past this function, since it
+ * runs inside an error path that already has its own real error to report
+ * to the user via stderr.
+ */
+
+import { DEFAULT_CONFIG_DIR } from './config.mjs';
+import { getVersion } from './config.mjs';
+import { apiBase } from './api-utils.mjs';
+import { promptYN } from './prompt-helpers.mjs';
+import { loadErrorReportingConsent, saveErrorReportingConsent } from './profile-resolver.mjs';
+import { readLicense } from './license.mjs';
+import { scanForSecrets, containsKnownSecretPattern } from './secret-scanner.mjs';
+
+const CONSENT_QUESTION = 'Would you like TicketLens to send reports about issues, bugs, and errors to improve your experience?';
+// Human reaction time, not a network call — generous, but still a hard
+// upper bound on how long an unanswered prompt can keep the process open.
+const PROMPT_TIMEOUT_MS = 15_000;
+
+function defaultIsInteractive() {
+  return Boolean(process.stdin.isTTY && process.stderr.isTTY && !process.env.CI);
+}
+
+export async function maybeReportError(err, command, {
+  configDir = DEFAULT_CONFIG_DIR,
+  isInteractive = defaultIsInteractive(),
+  promptFn = promptYN,
+  fetcher = globalThis.fetch,
+  stream = process.stderr,
+  promptTimeoutMs = PROMPT_TIMEOUT_MS,
+} = {}) {
+  try {
+    let consent = loadErrorReportingConsent(configDir);
+
+    if (consent === undefined) {
+      // Never ask outside a real terminal — undecided stays undecided until
+      // a real interactive session hits an error and can actually answer.
+      if (!isInteractive) return;
+      consent = await promptFn(CONSENT_QUESTION, { stream, timeoutMs: promptTimeoutMs });
+      // null = timed out with no answer — stays undecided, ask again next
+      // time, never persisted as a real (permanent) decision.
+      if (consent === null) return;
+      saveErrorReportingConsent(consent, configDir);
+    }
+
+    if (!consent) return;
+
+    const message = err?.message ?? String(err);
+    const stackTrace = err?.stack;
+
+    // Client-side pre-check only — the backend re-scans independently
+    // (RecallSecretScanner, defense in depth), so this just avoids a
+    // pointless network call when the server would reject it anyway.
+    //
+    // message uses the full entropy-aware scan (real free text — a user- or
+    // library-authored string, same as a Recall note body). stack_trace
+    // uses the narrower known-pattern-only check: a V8 stack trace's own
+    // "at fn (path:line:col)" frames are machine-generated and false-positive
+    // almost every line on the entropy heuristic (found 2026-09-23) — a real
+    // secret embedded in one still has a literal known prefix and is still
+    // caught by containsKnownSecretPattern.
+    const messageScan = scanForSecrets({ title: command ?? '', body: message });
+    if (messageScan.rejected) return;
+    if (stackTrace && containsKnownSecretPattern(stackTrace)) return;
+
+    const license = readLicense(configDir);
+    const payload = {
+      cli_version: getVersion(),
+      os: process.platform,
+      command: command || undefined,
+      message,
+      stack_trace: stackTrace || undefined,
+      profile_tier: license?.tier || undefined,
+    };
+
+    await fetcher(`${apiBase()}/v1/reports`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(payload),
+      signal: AbortSignal.timeout(5000),
+    });
+  } catch {
+    // Best-effort — never let a broken reporting path affect the real error
+    // the caller is already handling.
+  }
+}

package/skills/jtb/scripts/lib/profile-resolver.mjs

@@ -80,6 +80,23 @@ export function loadTeams(configDir = DEFAULT_CONFIG_DIR) {
   return loadProfiles(configDir)?.teams ?? [];
 }
 
+// Opt-in CLI error/diagnostic reporting (49e) — global, not per-profile: one
+// machine, one consent decision, unlike recallStrictness. Tri-state via
+// `undefined` (never asked) vs. `true`/`false` (asked once, answer
+// persisted) — the consent prompt fires at most once per install.
+export function saveErrorReportingConsent(consent, configDir = DEFAULT_CONFIG_DIR) {
+  mkdirSync(configDir, { recursive: true });
+  const profilesPath = join(configDir, 'profiles.json');
+  const config = loadProfiles(configDir) || { profiles: {} };
+  config.errorReporting = consent;
+  writeFileSync(profilesPath, JSON.stringify(config, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
+  invalidateProfilesCache(configDir);
+}
+
+export function loadErrorReportingConsent(configDir = DEFAULT_CONFIG_DIR) {
+  return loadProfiles(configDir)?.errorReporting;
+}
+
 export function saveProfile(name, profileData, credData, configDir = DEFAULT_CONFIG_DIR) {
   mkdirSync(configDir, { recursive: true });
   const profilesPath = join(configDir, 'profiles.json');

package/skills/jtb/scripts/lib/prompt-helpers.mjs

@@ -194,22 +194,53 @@ export function promptRecallPulse(question, { stream = process.stderr } = {}) {
   }));
 }
 
-export function promptYN(question, { stream = process.stderr } = {}) {
+/**
+ * @param {string} question
+ * @param {{ stream?: NodeJS.WriteStream, timeoutMs?: number }} [opts]
+ * @param {number} [opts.timeoutMs] - Optional. When set, an unanswered
+ *   prompt resolves to `null` (not `false`) after this many ms, cleanly
+ *   releasing raw mode and removing the listener first — this is what
+ *   actually lets the process exit; merely racing the returned promise at
+ *   the call site does nothing, since an orphaned raw-mode stdin listener
+ *   keeps the event loop alive regardless. `null` (not `false`), so a
+ *   caller can tell "timed out" apart from a real "no" answer and, e.g.,
+ *   avoid permanently persisting a decision the user never actually made.
+ *   Omitted entirely for the setup-wizard callers (config-wizard.mjs,
+ *   init-wizard.mjs, onboarding.mjs) — an unbounded wait is the right
+ *   behavior for a prompt the user is actively mid-flow on.
+ */
+export function promptYN(question, { stream = process.stderr, timeoutMs } = {}) {
   const s = createStyler({ isTTY: stream.isTTY });
   stream.write(`\n  ${question}  ${s.dim('y/N')}  `);
   return flushStdin().then(() => new Promise(res => {
     const stdin = process.stdin;
-    stdin.setRawMode(true);
-    stdin.resume();
-    stdin.setEncoding('utf8');
-    function onData(char) {
+    let timer = null;
+    function cleanup() {
       stdin.setRawMode(false);
       stdin.pause();
       stdin.removeListener('data', onData);
+      if (timer) clearTimeout(timer);
+    }
+    function onData(char) {
+      cleanup();
       stream.write('\n');
       if (char === '\x03') process.exit(0);
       res(char === 'y' || char === 'Y');
     }
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdin.setEncoding('utf8');
     stdin.on('data', onData);
+    if (timeoutMs) {
+      // Deliberately NOT unref'd: this timer is what bounds the wait — an
+      // unref'd timer doesn't count toward Node keeping the process alive,
+      // so if nothing else were holding the loop open, the process (or a
+      // test runner's own loop-empty detection) could end before the timer
+      // ever fires, leaving the promise permanently pending. A live TTY's
+      // own stdin.resume() already keeps the process alive regardless; this
+      // timer only needs to fire and clean up before that natural lifetime
+      // runs out, which is the entire point of having it.
+      timer = setTimeout(() => { cleanup(); stream.write('\n'); res(null); }, timeoutMs);
+    }
   }));
 }

package/skills/jtb/scripts/lib/secret-scanner.mjs

@@ -475,6 +475,28 @@ function joinedChunkRuns(tokens, { stopAtLabelWords = true } = {}) {
   return runs;
 }
 
+/**
+ * HARD_REJECT_PATTERNS only — no tokenization, no entropy heuristic. For
+ * machine-generated text that is never free-form user prose (a V8 stack
+ * trace's "at fn (path:line:col)" frames, in practice), where the entropy
+ * heuristic false-positives on nearly every line: short, punctuation-dense,
+ * path-heavy tokens read as "random" to it even though none of it is a
+ * secret. A real secret embedded in such text (e.g. a token baked into an
+ * error message that then appears in the trace's own first line) still has
+ * a literal prefix (AKIA/eyJ/sk-/-----BEGIN/etc.) and is still caught here —
+ * only the generic "long random-looking string" class of rejection is
+ * skipped, deliberately, for this one call site.
+ *
+ * @param {string} text
+ * @returns {boolean}
+ */
+export function containsKnownSecretPattern(text) {
+  const tokens = text.split(WHITESPACE_SPLIT_RE).filter(Boolean);
+  const despaced = text.replace(WHITESPACE_STRIP_RE, '');
+  const runs = joinedChunkRuns(tokens, { stopAtLabelWords: false });
+  return HARD_REJECT_PATTERNS.some(({ re }) => re.test(text) || runs.some(c => re.test(c)) || re.test(despaced));
+}
+
 /**
  * @param {{ title?: string, tags?: string[], body?: string }} note
  * @returns {{ rejected: boolean, reasons: string[], warnings: string[] }}