ticketlens 0.4.1 → 0.4.4

package/README.md

@@ -587,7 +587,7 @@ ticketlens CNV1-2 --summarize            # AI summary via your own API key (BYOK
 ticketlens CNV1-2 --summarize --cloud    # AI summary via TicketLens API (no local key needed)
 ticketlens CNV1-2 --handoff              # AI handoff brief from the ticket's comment thread (BYOK)
 ticketlens CNV1-2 --handoff --cloud      # AI handoff brief via TicketLens API
-ticketlens CNV1-2 --compliance           # Check ticket requirements against local diff [Free 3/mo]
+ticketlens CNV1-2 --compliance           # Check ticket requirements against local diff [Pro/Free 3/mo]
 ticketlens triage --stale=3              # Custom stale threshold (default is 5)
 ticketlens triage --digest               # POST scored triage results to digest endpoint
 ticketlens schedule                      # Set up a scheduled daily digest
@@ -735,11 +735,13 @@ npm test
 See [ROADMAP.md](ROADMAP.md) for the full plan.
 
 Recently shipped:
-- **"TicketLens for PRs"** (`ticketlens review`) — assembles a code-review context brief from your current branch: extracts linked ticket keys from the branch name and commits, fetches each ticket, and outputs a structured brief with branch, changed files, and ticket context. Styled ANSI output, spinner, flag validation with typo hints, and base-branch safety check
+- **Collision detection** (`ticketlens collisions`) — shows which files your branch shares with teammates' in-flight branches; `--push` auto-sends git branch data to the team snapshot. Team tier
+- **Shareable triage snapshot** (`ticketlens triage --share`) — generates a 24h signed URL; recipients open it in any browser, no account needed. Team tier
+- **Compliance push** (`ticketlens triage --push`) — enriches the team snapshot with per-ticket compliance status and coverage from the local ledger. Pro tier
+- **"TicketLens for PRs"** (`ticketlens review`) — assembles a code-review context brief from your current branch: linked tickets, changed files, and ticket context in one brief
 - **Confluence pages** — linked Confluence pages fetched automatically and included in the brief; origin-validated, non-fatal, capped at 10 pages
 - **Linear support** — `ticketlens init` → Linear; connects via GraphQL API key, fetches tickets, triage, and statuses
 - **GitHub Issues support** — `ticketlens init` → GitHub Issues; PAT-based, same normalized ticket shape
-- **Tracker-aware config** — `ticketlens config` shows the right labels and skips irrelevant prompts per tracker type; always re-validates the connection
 
 ---
 

package/bin/ticketlens.mjs

@@ -203,13 +203,17 @@ switch (command) {
         process.stdin.setRawMode(true);
         process.stdin.resume();
         process.stdin.setEncoding('utf8');
-        process.stdin.once('data', char => {
-          process.stdin.setRawMode(false);
-          process.stdin.pause();
+        const cleanup = () => { process.stdin.setRawMode(false); process.stdin.pause(); };
+        const onData = char => {
+          process.stdin.removeListener('end', onEnd);
+          cleanup();
           process.stderr.write('\n');
           if (char === '\x03') process.exit(0);
           res(char === 'y' || char === 'Y');
-        });
+        };
+        const onEnd = () => { process.stdin.removeListener('data', onData); cleanup(); res(false); };
+        process.stdin.once('data', onData);
+        process.stdin.once('end', onEnd);
       });
       if (!answer) {
         process.stderr.write(`  ${s.dim('Cancelled.')}\n`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ticketlens",
-  "version": "0.4.1",
+  "version": "0.4.4",
   "description": "Jira CLI for developers — fetch ticket context, triage your queue, and stop tab-switching. Zero dependencies, all local.",
   "type": "module",
   "bin": {

package/skills/jtb/SKILL.md

@@ -1,4 +1,4 @@
-<!-- jtb-skill-version: 0.4.0 -->
+<!-- jtb-skill-version: 0.4.2 -->
 ---
 name: jtb
 description: Fetch a Jira ticket's full context (description, comments, linked issues, code references) and assemble a structured TicketBrief for implementation planning. Use when user types /jtb, mentions a Jira ticket key, or wants to plan work from a Jira ticket.

package/skills/jtb/scripts/lib/api-utils.mjs

@@ -0,0 +1,20 @@
+/**
+ * Shared API URL utilities for triage push, share, and collisions.
+ * Centralised here to avoid triplicating the regex and warning logic.
+ */
+
+export const DEFAULT_API_BASE = 'http://ticketlens.test';
+
+// Matches localhost, 127.0.0.1, and any hostname ending in .test or .local,
+// with an optional port — all treated as local-only addresses.
+const LOCAL_HOST_RE = /^https?:\/\/(localhost|127\.0\.0\.1|[^/:]+\.(test|local))(:\d+)?(\/|$)/i;
+
+export function apiBase() {
+  return process.env?.TICKETLENS_API_URL ?? DEFAULT_API_BASE;
+}
+
+export function warnIfInsecure(url, warn) {
+  if (url.startsWith('http://') && !LOCAL_HOST_RE.test(url)) {
+    warn('⚠ Warning: TICKETLENS_API_URL uses an unencrypted HTTP connection. Use https:// for production.\n');
+  }
+}

package/skills/jtb/scripts/lib/brief-cache.mjs

@@ -82,11 +82,19 @@ export function clearBriefCache(ticketKey, profileName, configDir = DEFAULT_CONF
   } catch { /* non-fatal */ }
 }
 
+// Memoize getBriefCacheEntries per configDir within a single process invocation.
+// 5s TTL is well beyond the lifetime of any CLI run; prevents repeated stat+read+parse
+// when multiple callers (cache list, cache prune, cache status) hit the same directory.
+const _entriesCache = new Map(); // configDir → { entries, time }
+const _ENTRIES_TTL_MS = 5_000;
+
 /**
  * Returns all brief cache entries across all profiles.
  * Each entry: { profileName, ticketKey, filePath, size, mtimeMs, fetchedAt, depth }
  */
 export function getBriefCacheEntries(configDir = DEFAULT_CONFIG_DIR) {
+  const cached = _entriesCache.get(configDir);
+  if (cached && Date.now() - cached.time < _ENTRIES_TTL_MS) return cached.entries;
   const cacheDir = path.join(configDir, 'cache');
   if (!fs.existsSync(cacheDir)) return [];
 
@@ -120,6 +128,7 @@ export function getBriefCacheEntries(configDir = DEFAULT_CONFIG_DIR) {
     }
   }
 
+  _entriesCache.set(configDir, { entries, time: Date.now() });
   return entries;
 }
 

package/skills/jtb/scripts/lib/cli-auth.mjs

@@ -4,7 +4,7 @@
  * plaintext so the CLI can use it as a Bearer token.
  */
 
-import { readFileSync, writeFileSync, existsSync, mkdirSync, chmodSync } from 'node:fs';
+import { readFileSync, writeFileSync, chmodSync, existsSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { DEFAULT_CONFIG_DIR } from './config.mjs';
 
@@ -28,13 +28,14 @@ export function readCliToken(configDir = DEFAULT_CONFIG_DIR) {
 export function saveCliToken(token, configDir = DEFAULT_CONFIG_DIR) {
   mkdirSync(configDir, { recursive: true });
   const p = cliTokenPath(configDir);
-  writeFileSync(p, JSON.stringify({ token }, null, 2) + '\n', 'utf8');
+  writeFileSync(p, JSON.stringify({ token }, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
   chmodSync(p, 0o600);
 }
 
 export function deleteCliToken(configDir = DEFAULT_CONFIG_DIR) {
   const p = cliTokenPath(configDir);
   if (existsSync(p)) {
-    writeFileSync(p, JSON.stringify({}, null, 2) + '\n', 'utf8');
+    writeFileSync(p, JSON.stringify({}, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
+    chmodSync(p, 0o600);
   }
 }

package/skills/jtb/scripts/lib/ledger.mjs

@@ -8,8 +8,9 @@ import { join } from 'node:path';
 import { createHmac, randomBytes } from 'node:crypto';
 import { DEFAULT_CONFIG_DIR } from './config.mjs';
 
-const LEDGER_FILE = 'ledger.jsonl';
-const KEY_FILE    = 'ledger-key';
+const LEDGER_FILE        = 'ledger.jsonl';
+const KEY_FILE           = 'ledger-key';
+const MAX_LEDGER_RECORDS = 5_000;
 
 /**
  * Append one compliance record to ledger.jsonl.
@@ -25,6 +26,7 @@ export function appendLedger(record, { configDir = DEFAULT_CONFIG_DIR, fsModule
 
   const line = JSON.stringify({ ts: new Date().toISOString(), ...record }) + '\n';
   fsModule.appendFileSync(join(configDir, LEDGER_FILE), line, 'utf8');
+  _rotateIfNeeded(configDir, fsModule);
 }
 
 /**
@@ -84,6 +86,23 @@ export function exportLedger(format, { configDir = DEFAULT_CONFIG_DIR, fsModule
 
 // ── Internal helpers ─────────────────────────────────────────────────────────
 
+function _rotateIfNeeded(configDir, fsModule) {
+  const ledgerPath = join(configDir, LEDGER_FILE);
+  // Cheap size check first — each JSONL record averages ~180 bytes, so 5000 records ≈ 900 KB.
+  // Skip the full read when the file is well under the threshold.
+  try {
+    if (fsModule.statSync(ledgerPath).size < 900_000) return;
+  } catch { return; }
+
+  let raw;
+  try { raw = fsModule.readFileSync(ledgerPath, 'utf8'); } catch { return; }
+
+  const lines = raw.split('\n').filter(l => l.trim().length > 0);
+  if (lines.length > MAX_LEDGER_RECORDS) {
+    fsModule.writeFileSync(ledgerPath, lines.slice(-MAX_LEDGER_RECORDS).join('\n') + '\n', 'utf8');
+  }
+}
+
 function _getOrCreateKey(configDir, fsModule) {
   const keyPath = join(configDir, KEY_FILE);
   try {

package/skills/jtb/scripts/lib/license.mjs

@@ -5,13 +5,15 @@ import crypto from 'node:crypto';
 import { DEFAULT_CONFIG_DIR } from './config.mjs';
 import { createStyler } from './ansi.mjs';
 
-export // Mixed into the HMAC key so that knowing the license key alone is not sufficient
+// Mixed into the HMAC key so that knowing the license key alone is not sufficient
 // to forge a valid signature — an attacker also needs this constant from the source.
-const LICENSE_HMAC_SALT = 'tl-lic-v1';
+export const LICENSE_HMAC_SALT = 'tl-lic-v1';
 export const LICENSE_TIERS = { free: 0, pro: 1, team: 2 };
 const LICENSE_FILE = 'license.json';
+const LICENSE_SECRET_FILE = 'license-hmac-secret.json';
 const REVALIDATION_DAYS = 7;   // attempt background revalidation after this many days
 const GRACE_DAYS = 30;          // treat license as invalid if not revalidated within this window
+const MS_PER_DAY = 86400000;
 const UPGRADE_URL = 'https://ticketlens.dev/pricing';
 
 const ANSI_RE_LIC = /\x1b\[[0-9;]*m|\x1b\]8;[^\x07]*\x07/g;
@@ -20,6 +22,42 @@ function padInner(str, width) {
   return str + ' '.repeat(Math.max(0, width - visLen(str)));
 }
 
+function readHmacSecret(configDir) {
+  try {
+    const data = JSON.parse(fs.readFileSync(path.join(configDir, LICENSE_SECRET_FILE), 'utf8'));
+    return typeof data.secret === 'string' && data.secret.length === 64 ? data.secret : null;
+  } catch {
+    return null;
+  }
+}
+
+function readOrCreateHmacSecret(configDir) {
+  const existing = readHmacSecret(configDir);
+  if (existing) return existing;
+  fs.mkdirSync(configDir, { recursive: true });
+  const secret = crypto.randomBytes(32).toString('hex');
+  const secretPath = path.join(configDir, LICENSE_SECRET_FILE);
+  const tmp = `${secretPath}.${process.pid}.tmp`;
+  fs.writeFileSync(tmp, JSON.stringify({ secret }), { encoding: 'utf8', mode: 0o600 });
+  try {
+    // Atomic on POSIX — if we lost a concurrent race, the winner's file stays
+    fs.renameSync(tmp, secretPath);
+  } catch {
+    try { fs.unlinkSync(tmp); } catch { /* ignore cleanup failure */ }
+  }
+  // Read back: we may have lost the race; use whatever secret is on disk
+  return readHmacSecret(configDir) ?? secret;
+}
+
+function verifyLicenseHmac(sig, payload, sigKey) {
+  const expected = crypto.createHmac('sha256', sigKey)
+    .update(JSON.stringify(payload)).digest('hex');
+  const sigBuf = Buffer.from(sig, 'hex');
+  const expBuf = Buffer.from(expected, 'hex');
+  if (sigBuf.length !== expBuf.length) return false;
+  return crypto.timingSafeEqual(sigBuf, expBuf);
+}
+
 export function readLicense(configDir = DEFAULT_CONFIG_DIR) {
   const filePath = path.join(configDir, LICENSE_FILE);
   try {
@@ -27,14 +65,19 @@ export function readLicense(configDir = DEFAULT_CONFIG_DIR) {
     const { sig, ...payload } = data;
     // Legacy unsigned files are trusted; will be re-signed on next write
     if (!sig) return payload;
-    const sigKey = `${LICENSE_HMAC_SALT}:${payload.key || ''}`;
-    const expected = crypto.createHmac('sha256', sigKey)
-      .update(JSON.stringify(payload)).digest('hex');
-    const sigBuf = Buffer.from(sig, 'hex');
-    const expBuf = Buffer.from(expected, 'hex');
-    // timingSafeEqual requires equal-length buffers; unequal lengths mean tampered sig
-    if (sigBuf.length !== expBuf.length) return null;
-    return crypto.timingSafeEqual(sigBuf, expBuf) ? payload : null;
+
+    const machineSecret = readHmacSecret(configDir);
+    if (machineSecret) {
+      // Machine secret present — only accept signatures made with it
+      return verifyLicenseHmac(sig, payload, `${LICENSE_HMAC_SALT}:${machineSecret}`)
+        ? payload : null;
+    }
+
+    // No secret file yet — fall back to legacy key-based HMAC (backward compat).
+    // If valid, immediately re-sign with a machine secret to close the migration window.
+    if (!verifyLicenseHmac(sig, payload, `${LICENSE_HMAC_SALT}:${payload.key || ''}`)) return null;
+    try { writeLicense(payload, configDir); } catch { /* non-fatal — next call will retry */ }
+    return payload;
   } catch {
     return null;
   }
@@ -44,10 +87,10 @@ export function writeLicense(data, configDir = DEFAULT_CONFIG_DIR) {
   fs.mkdirSync(configDir, { recursive: true });
   const filePath = path.join(configDir, LICENSE_FILE);
   const { sig: _, ...payload } = data; // strip any existing sig before re-signing
-  const sigKey = `${LICENSE_HMAC_SALT}:${payload.key || ''}`;
-  const mac = crypto.createHmac('sha256', sigKey)
+  const secret = readOrCreateHmacSecret(configDir);
+  const mac = crypto.createHmac('sha256', `${LICENSE_HMAC_SALT}:${secret}`)
     .update(JSON.stringify(payload)).digest('hex');
-  fs.writeFileSync(filePath, JSON.stringify({ ...payload, sig: mac }), 'utf8');
+  fs.writeFileSync(filePath, JSON.stringify({ ...payload, sig: mac }), { encoding: 'utf8', mode: 0o600 });
   fs.chmodSync(filePath, 0o600);
 }
 
@@ -64,7 +107,7 @@ export function isLicensed(tier, configDir = DEFAULT_CONFIG_DIR) {
 
   // Offline grace period — reject if not revalidated within GRACE_DAYS
   if (license.validatedAt) {
-    const daysSince = (Date.now() - new Date(license.validatedAt)) / 86400000;
+    const daysSince = (Date.now() - new Date(license.validatedAt)) / MS_PER_DAY;
     if (daysSince > GRACE_DAYS) return false;
   }
 
@@ -80,7 +123,7 @@ export function revalidateIfStale(opts = {}) {
   const { configDir = DEFAULT_CONFIG_DIR, fetcher = globalThis.fetch } = opts;
   const license = readLicense(configDir);
   if (!license?.key || !license?.validatedAt) return;
-  const daysSince = (Date.now() - new Date(license.validatedAt)) / 86400000;
+  const daysSince = (Date.now() - new Date(license.validatedAt)) / MS_PER_DAY;
   if (daysSince < REVALIDATION_DAYS) return;
   revalidateLicense({ configDir, fetcher }).catch(() => {});
 }
@@ -112,14 +155,17 @@ export function showUpgradePrompt(requiredTier, featureFlag, { stream = process.
 const LEMONSQUEEZY_ACTIVATE_URL = 'https://api.lemonsqueezy.com/v1/licenses/activate';
 const LEMONSQUEEZY_VALIDATE_URL = 'https://api.lemonsqueezy.com/v1/licenses/validate';
 
-function resolveActivateUrl() {
+function resolveLicenseUrl(action, fallback) {
   const base = process.env.TICKETLENS_API_URL;
-  return base ? `${base.replace(/\/$/, '')}/v1/licenses/activate` : LEMONSQUEEZY_ACTIVATE_URL;
+  return base ? `${base.replace(/\/$/, '')}/v1/licenses/${action}` : fallback;
+}
+
+function resolveActivateUrl() {
+  return resolveLicenseUrl('activate', LEMONSQUEEZY_ACTIVATE_URL);
 }
 
 function resolveValidateUrl() {
-  const base = process.env.TICKETLENS_API_URL;
-  return base ? `${base.replace(/\/$/, '')}/v1/licenses/validate` : LEMONSQUEEZY_VALIDATE_URL;
+  return resolveLicenseUrl('validate', LEMONSQUEEZY_VALIDATE_URL);
 }
 
 function extractTier(meta) {

package/skills/jtb/scripts/lib/run-collisions.mjs

@@ -1,12 +1,9 @@
 import { readLicense } from './license.mjs';
 import { formatCollisions } from './collision-reporter.mjs';
 
-const COLLISIONS_PATH = '/v1/triage/collisions';
-const DEFAULT_API_BASE = 'http://ticketlens.test';
+import { apiBase, warnIfInsecure } from './api-utils.mjs';
 
-function apiBase() {
-  return process.env?.TICKETLENS_API_URL ?? DEFAULT_API_BASE;
-}
+const COLLISIONS_PATH = '/v1/triage/collisions';
 
 /**
  * Fetches cross-team branch collision data from the TicketLens API and prints results.
@@ -23,7 +20,9 @@ export async function runCollisions(args = [], opts = {}) {
   const plainFlag = args.includes('--plain');
   const fetcher        = opts.fetcher       ?? globalThis.fetch;
   const print          = opts.print         ?? ((s) => process.stdout.write(s));
+  const warn           = opts.warn          ?? ((s) => process.stderr.write(s));
   const readLicenseFn  = opts.readLicenseFn ?? (() => readLicense());
+  warnIfInsecure(apiBase(), warn);
 
   const licenseKey = readLicenseFn()?.key ?? null;
   if (!licenseKey) {
@@ -38,8 +37,14 @@ export async function runCollisions(args = [], opts = {}) {
     });
 
     if (!res.ok) {
-      if (res.status === 401) { print('✗ Invalid license key\n');              return { ok: false, status: 401 }; }
-      if (res.status === 403) { print('✗ collisions requires a Team license\n'); return { ok: false, status: 403 }; }
+      if (res.status === 401) {
+        print('✗ Invalid license key\n');
+        return { ok: false, status: 401 };
+      }
+      if (res.status === 403) {
+        print('✗ collisions requires a Team license\n');
+        return { ok: false, status: 403 };
+      }
       print(`⚠ Failed to fetch collisions (${res.status})\n`);
       return { ok: false, status: res.status };
     }

package/skills/jtb/scripts/lib/triage-push.mjs

@@ -7,13 +7,9 @@ import { readLedger } from './ledger.mjs';
 import { isLicensed } from './license.mjs';
 import { DEFAULT_CONFIG_DIR } from './config.mjs';
 
-const PUSH_PATH = '/v1/triage/push';
-// Local dev: http://ticketlens.test — production override via TICKETLENS_API_URL env var
-const DEFAULT_API_BASE = 'http://ticketlens.test';
+import { apiBase, warnIfInsecure } from './api-utils.mjs';
 
-function apiBase() {
-  return process.env?.TICKETLENS_API_URL ?? DEFAULT_API_BASE;
-}
+const PUSH_PATH = '/v1/triage/push';
 
 // Derive console queue URL from API base:
 //   http://api.ticketlens.test      → http://ticketlens.test/console/queue
@@ -68,10 +64,12 @@ export async function pushTriageSnapshot({
   gitBranches,
   fetcher = globalThis.fetch,
   print = (s) => process.stdout.write(s),
+  warn = (s) => process.stderr.write(s),
   readLedgerFn = readLedger,
   isLicensedFn = isLicensed,
   configDir = DEFAULT_CONFIG_DIR,
 } = {}) {
+  warnIfInsecure(apiBase(), warn);
   if (!licenseKey) {
     print('✗ --push requires an active Team license (ticketlens activate <key>)\n');
     return { ok: false };
@@ -81,9 +79,8 @@ export async function pushTriageSnapshot({
 
   if (isLicensedFn('pro', configDir)) {
     try {
-      const entries = readLedgerFn({ configDir });
       const latestByKey = new Map();
-      for (const entry of entries) {
+      for (const entry of readLedgerFn({ configDir })) {
         const prev = latestByKey.get(entry.ticketKey);
         if (!prev || entry.ts > prev.ts) latestByKey.set(entry.ticketKey, entry);
       }

package/skills/jtb/scripts/lib/triage-share.mjs

@@ -3,12 +3,9 @@
  * Errors are non-fatal — share failure must never suppress triage output.
  */
 
-const SHARE_PATH = '/v1/triage/share';
-const DEFAULT_API_BASE = 'http://ticketlens.test';
+import { apiBase, warnIfInsecure } from './api-utils.mjs';
 
-function apiBase() {
-  return process.env?.TICKETLENS_API_URL ?? DEFAULT_API_BASE;
-}
+const SHARE_PATH = '/v1/triage/share';
 
 function buildTicketPayload(scored, rawMap, baseUrl) {
   const raw = rawMap?.get(scored.ticketKey);
@@ -47,7 +44,9 @@ export async function shareTriageSnapshot({
   capturedAt,
   fetcher = globalThis.fetch,
   print = (s) => process.stdout.write(s),
+  warn = (s) => process.stderr.write(s),
 } = {}) {
+  warnIfInsecure(apiBase(), warn);
   if (!licenseKey) {
     print('✗ --share requires an active Team license (ticketlens activate <key>)\n');
     return { ok: false };