ticketlens 0.4.1 → 0.4.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ticketlens",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Jira CLI for developers — fetch ticket context, triage your queue, and stop tab-switching. Zero dependencies, all local.",
   "type": "module",
   "bin": {

package/skills/jtb/SKILL.md

@@ -1,4 +1,4 @@
-<!-- jtb-skill-version: 0.4.0 -->
+<!-- jtb-skill-version: 0.4.2 -->
 ---
 name: jtb
 description: Fetch a Jira ticket's full context (description, comments, linked issues, code references) and assemble a structured TicketBrief for implementation planning. Use when user types /jtb, mentions a Jira ticket key, or wants to plan work from a Jira ticket.

package/skills/jtb/scripts/lib/api-utils.mjs

@@ -0,0 +1,20 @@
+/**
+ * Shared API URL utilities for triage push, share, and collisions.
+ * Centralised here to avoid triplicating the regex and warning logic.
+ */
+
+export const DEFAULT_API_BASE = 'http://ticketlens.test';
+
+// Matches localhost, 127.0.0.1, and any hostname ending in .test or .local,
+// with an optional port — all treated as local-only addresses.
+const LOCAL_HOST_RE = /^https?:\/\/(localhost|127\.0\.0\.1|[^/:]+\.(test|local))(:\d+)?(\/|$)/i;
+
+export function apiBase() {
+  return process.env?.TICKETLENS_API_URL ?? DEFAULT_API_BASE;
+}
+
+export function warnIfInsecure(url, warn) {
+  if (url.startsWith('http://') && !LOCAL_HOST_RE.test(url)) {
+    warn('⚠ Warning: TICKETLENS_API_URL uses an unencrypted HTTP connection. Use https:// for production.\n');
+  }
+}

package/skills/jtb/scripts/lib/cli-auth.mjs

@@ -4,7 +4,7 @@
  * plaintext so the CLI can use it as a Bearer token.
  */
 
-import { readFileSync, writeFileSync, existsSync, mkdirSync, chmodSync } from 'node:fs';
+import { readFileSync, writeFileSync, chmodSync, existsSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { DEFAULT_CONFIG_DIR } from './config.mjs';
 
@@ -28,13 +28,14 @@ export function readCliToken(configDir = DEFAULT_CONFIG_DIR) {
 export function saveCliToken(token, configDir = DEFAULT_CONFIG_DIR) {
   mkdirSync(configDir, { recursive: true });
   const p = cliTokenPath(configDir);
-  writeFileSync(p, JSON.stringify({ token }, null, 2) + '\n', 'utf8');
+  writeFileSync(p, JSON.stringify({ token }, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
   chmodSync(p, 0o600);
 }
 
 export function deleteCliToken(configDir = DEFAULT_CONFIG_DIR) {
   const p = cliTokenPath(configDir);
   if (existsSync(p)) {
-    writeFileSync(p, JSON.stringify({}, null, 2) + '\n', 'utf8');
+    writeFileSync(p, JSON.stringify({}, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
+    chmodSync(p, 0o600);
   }
 }

package/skills/jtb/scripts/lib/license.mjs

@@ -5,13 +5,15 @@ import crypto from 'node:crypto';
 import { DEFAULT_CONFIG_DIR } from './config.mjs';
 import { createStyler } from './ansi.mjs';
 
-export // Mixed into the HMAC key so that knowing the license key alone is not sufficient
+// Mixed into the HMAC key so that knowing the license key alone is not sufficient
 // to forge a valid signature — an attacker also needs this constant from the source.
-const LICENSE_HMAC_SALT = 'tl-lic-v1';
+export const LICENSE_HMAC_SALT = 'tl-lic-v1';
 export const LICENSE_TIERS = { free: 0, pro: 1, team: 2 };
 const LICENSE_FILE = 'license.json';
+const LICENSE_SECRET_FILE = 'license-hmac-secret.json';
 const REVALIDATION_DAYS = 7;   // attempt background revalidation after this many days
 const GRACE_DAYS = 30;          // treat license as invalid if not revalidated within this window
+const MS_PER_DAY = 86400000;
 const UPGRADE_URL = 'https://ticketlens.dev/pricing';
 
 const ANSI_RE_LIC = /\x1b\[[0-9;]*m|\x1b\]8;[^\x07]*\x07/g;
@@ -20,6 +22,42 @@ function padInner(str, width) {
   return str + ' '.repeat(Math.max(0, width - visLen(str)));
 }
 
+function readHmacSecret(configDir) {
+  try {
+    const data = JSON.parse(fs.readFileSync(path.join(configDir, LICENSE_SECRET_FILE), 'utf8'));
+    return typeof data.secret === 'string' && data.secret.length === 64 ? data.secret : null;
+  } catch {
+    return null;
+  }
+}
+
+function readOrCreateHmacSecret(configDir) {
+  const existing = readHmacSecret(configDir);
+  if (existing) return existing;
+  fs.mkdirSync(configDir, { recursive: true });
+  const secret = crypto.randomBytes(32).toString('hex');
+  const secretPath = path.join(configDir, LICENSE_SECRET_FILE);
+  const tmp = `${secretPath}.${process.pid}.tmp`;
+  fs.writeFileSync(tmp, JSON.stringify({ secret }), { encoding: 'utf8', mode: 0o600 });
+  try {
+    // Atomic on POSIX — if we lost a concurrent race, the winner's file stays
+    fs.renameSync(tmp, secretPath);
+  } catch {
+    try { fs.unlinkSync(tmp); } catch { /* ignore cleanup failure */ }
+  }
+  // Read back: we may have lost the race; use whatever secret is on disk
+  return readHmacSecret(configDir) ?? secret;
+}
+
+function verifyLicenseHmac(sig, payload, sigKey) {
+  const expected = crypto.createHmac('sha256', sigKey)
+    .update(JSON.stringify(payload)).digest('hex');
+  const sigBuf = Buffer.from(sig, 'hex');
+  const expBuf = Buffer.from(expected, 'hex');
+  if (sigBuf.length !== expBuf.length) return false;
+  return crypto.timingSafeEqual(sigBuf, expBuf);
+}
+
 export function readLicense(configDir = DEFAULT_CONFIG_DIR) {
   const filePath = path.join(configDir, LICENSE_FILE);
   try {
@@ -27,14 +65,19 @@ export function readLicense(configDir = DEFAULT_CONFIG_DIR) {
     const { sig, ...payload } = data;
     // Legacy unsigned files are trusted; will be re-signed on next write
     if (!sig) return payload;
-    const sigKey = `${LICENSE_HMAC_SALT}:${payload.key || ''}`;
-    const expected = crypto.createHmac('sha256', sigKey)
-      .update(JSON.stringify(payload)).digest('hex');
-    const sigBuf = Buffer.from(sig, 'hex');
-    const expBuf = Buffer.from(expected, 'hex');
-    // timingSafeEqual requires equal-length buffers; unequal lengths mean tampered sig
-    if (sigBuf.length !== expBuf.length) return null;
-    return crypto.timingSafeEqual(sigBuf, expBuf) ? payload : null;
+
+    const machineSecret = readHmacSecret(configDir);
+    if (machineSecret) {
+      // Machine secret present — only accept signatures made with it
+      return verifyLicenseHmac(sig, payload, `${LICENSE_HMAC_SALT}:${machineSecret}`)
+        ? payload : null;
+    }
+
+    // No secret file yet — fall back to legacy key-based HMAC (backward compat).
+    // If valid, immediately re-sign with a machine secret to close the migration window.
+    if (!verifyLicenseHmac(sig, payload, `${LICENSE_HMAC_SALT}:${payload.key || ''}`)) return null;
+    try { writeLicense(payload, configDir); } catch { /* non-fatal — next call will retry */ }
+    return payload;
   } catch {
     return null;
   }
@@ -44,10 +87,10 @@ export function writeLicense(data, configDir = DEFAULT_CONFIG_DIR) {
   fs.mkdirSync(configDir, { recursive: true });
   const filePath = path.join(configDir, LICENSE_FILE);
   const { sig: _, ...payload } = data; // strip any existing sig before re-signing
-  const sigKey = `${LICENSE_HMAC_SALT}:${payload.key || ''}`;
-  const mac = crypto.createHmac('sha256', sigKey)
+  const secret = readOrCreateHmacSecret(configDir);
+  const mac = crypto.createHmac('sha256', `${LICENSE_HMAC_SALT}:${secret}`)
     .update(JSON.stringify(payload)).digest('hex');
-  fs.writeFileSync(filePath, JSON.stringify({ ...payload, sig: mac }), 'utf8');
+  fs.writeFileSync(filePath, JSON.stringify({ ...payload, sig: mac }), { encoding: 'utf8', mode: 0o600 });
   fs.chmodSync(filePath, 0o600);
 }
 
@@ -64,7 +107,7 @@ export function isLicensed(tier, configDir = DEFAULT_CONFIG_DIR) {
 
   // Offline grace period — reject if not revalidated within GRACE_DAYS
   if (license.validatedAt) {
-    const daysSince = (Date.now() - new Date(license.validatedAt)) / 86400000;
+    const daysSince = (Date.now() - new Date(license.validatedAt)) / MS_PER_DAY;
     if (daysSince > GRACE_DAYS) return false;
   }
 
@@ -80,7 +123,7 @@ export function revalidateIfStale(opts = {}) {
   const { configDir = DEFAULT_CONFIG_DIR, fetcher = globalThis.fetch } = opts;
   const license = readLicense(configDir);
   if (!license?.key || !license?.validatedAt) return;
-  const daysSince = (Date.now() - new Date(license.validatedAt)) / 86400000;
+  const daysSince = (Date.now() - new Date(license.validatedAt)) / MS_PER_DAY;
   if (daysSince < REVALIDATION_DAYS) return;
   revalidateLicense({ configDir, fetcher }).catch(() => {});
 }
@@ -112,14 +155,17 @@ export function showUpgradePrompt(requiredTier, featureFlag, { stream = process.
 const LEMONSQUEEZY_ACTIVATE_URL = 'https://api.lemonsqueezy.com/v1/licenses/activate';
 const LEMONSQUEEZY_VALIDATE_URL = 'https://api.lemonsqueezy.com/v1/licenses/validate';
 
-function resolveActivateUrl() {
+function resolveLicenseUrl(action, fallback) {
   const base = process.env.TICKETLENS_API_URL;
-  return base ? `${base.replace(/\/$/, '')}/v1/licenses/activate` : LEMONSQUEEZY_ACTIVATE_URL;
+  return base ? `${base.replace(/\/$/, '')}/v1/licenses/${action}` : fallback;
+}
+
+function resolveActivateUrl() {
+  return resolveLicenseUrl('activate', LEMONSQUEEZY_ACTIVATE_URL);
 }
 
 function resolveValidateUrl() {
-  const base = process.env.TICKETLENS_API_URL;
-  return base ? `${base.replace(/\/$/, '')}/v1/licenses/validate` : LEMONSQUEEZY_VALIDATE_URL;
+  return resolveLicenseUrl('validate', LEMONSQUEEZY_VALIDATE_URL);
 }
 
 function extractTier(meta) {

package/skills/jtb/scripts/lib/run-collisions.mjs

@@ -1,12 +1,9 @@
 import { readLicense } from './license.mjs';
 import { formatCollisions } from './collision-reporter.mjs';
 
-const COLLISIONS_PATH = '/v1/triage/collisions';
-const DEFAULT_API_BASE = 'http://ticketlens.test';
+import { apiBase, warnIfInsecure } from './api-utils.mjs';
 
-function apiBase() {
-  return process.env?.TICKETLENS_API_URL ?? DEFAULT_API_BASE;
-}
+const COLLISIONS_PATH = '/v1/triage/collisions';
 
 /**
  * Fetches cross-team branch collision data from the TicketLens API and prints results.
@@ -23,7 +20,9 @@ export async function runCollisions(args = [], opts = {}) {
   const plainFlag = args.includes('--plain');
   const fetcher        = opts.fetcher       ?? globalThis.fetch;
   const print          = opts.print         ?? ((s) => process.stdout.write(s));
+  const warn           = opts.warn          ?? ((s) => process.stderr.write(s));
   const readLicenseFn  = opts.readLicenseFn ?? (() => readLicense());
+  warnIfInsecure(apiBase(), warn);
 
   const licenseKey = readLicenseFn()?.key ?? null;
   if (!licenseKey) {
@@ -38,8 +37,14 @@ export async function runCollisions(args = [], opts = {}) {
     });
 
     if (!res.ok) {
-      if (res.status === 401) { print('✗ Invalid license key\n');              return { ok: false, status: 401 }; }
-      if (res.status === 403) { print('✗ collisions requires a Team license\n'); return { ok: false, status: 403 }; }
+      if (res.status === 401) {
+        print('✗ Invalid license key\n');
+        return { ok: false, status: 401 };
+      }
+      if (res.status === 403) {
+        print('✗ collisions requires a Team license\n');
+        return { ok: false, status: 403 };
+      }
       print(`⚠ Failed to fetch collisions (${res.status})\n`);
       return { ok: false, status: res.status };
     }

package/skills/jtb/scripts/lib/triage-push.mjs

@@ -7,13 +7,9 @@ import { readLedger } from './ledger.mjs';
 import { isLicensed } from './license.mjs';
 import { DEFAULT_CONFIG_DIR } from './config.mjs';
 
-const PUSH_PATH = '/v1/triage/push';
-// Local dev: http://ticketlens.test — production override via TICKETLENS_API_URL env var
-const DEFAULT_API_BASE = 'http://ticketlens.test';
+import { apiBase, warnIfInsecure } from './api-utils.mjs';
 
-function apiBase() {
-  return process.env?.TICKETLENS_API_URL ?? DEFAULT_API_BASE;
-}
+const PUSH_PATH = '/v1/triage/push';
 
 // Derive console queue URL from API base:
 //   http://api.ticketlens.test      → http://ticketlens.test/console/queue
@@ -68,10 +64,12 @@ export async function pushTriageSnapshot({
   gitBranches,
   fetcher = globalThis.fetch,
   print = (s) => process.stdout.write(s),
+  warn = (s) => process.stderr.write(s),
   readLedgerFn = readLedger,
   isLicensedFn = isLicensed,
   configDir = DEFAULT_CONFIG_DIR,
 } = {}) {
+  warnIfInsecure(apiBase(), warn);
   if (!licenseKey) {
     print('✗ --push requires an active Team license (ticketlens activate <key>)\n');
     return { ok: false };
@@ -81,9 +79,8 @@ export async function pushTriageSnapshot({
 
   if (isLicensedFn('pro', configDir)) {
     try {
-      const entries = readLedgerFn({ configDir });
       const latestByKey = new Map();
-      for (const entry of entries) {
+      for (const entry of readLedgerFn({ configDir })) {
         const prev = latestByKey.get(entry.ticketKey);
         if (!prev || entry.ts > prev.ts) latestByKey.set(entry.ticketKey, entry);
       }

package/skills/jtb/scripts/lib/triage-share.mjs

@@ -3,12 +3,9 @@
  * Errors are non-fatal — share failure must never suppress triage output.
  */
 
-const SHARE_PATH = '/v1/triage/share';
-const DEFAULT_API_BASE = 'http://ticketlens.test';
+import { apiBase, warnIfInsecure } from './api-utils.mjs';
 
-function apiBase() {
-  return process.env?.TICKETLENS_API_URL ?? DEFAULT_API_BASE;
-}
+const SHARE_PATH = '/v1/triage/share';
 
 function buildTicketPayload(scored, rawMap, baseUrl) {
   const raw = rawMap?.get(scored.ticketKey);
@@ -47,7 +44,9 @@ export async function shareTriageSnapshot({
   capturedAt,
   fetcher = globalThis.fetch,
   print = (s) => process.stdout.write(s),
+  warn = (s) => process.stderr.write(s),
 } = {}) {
+  warnIfInsecure(apiBase(), warn);
   if (!licenseKey) {
     print('✗ --share requires an active Team license (ticketlens activate <key>)\n');
     return { ok: false };