ticketlens 0.4.2 → 0.4.5

package/README.md

@@ -350,8 +350,12 @@ ticketlens sync            # Pull your latest tracker profiles from the Console
 
 Use `--manual` when there is no GUI (CI runners, SSH sessions, containers).
 
+`ticketlens logout` removes the stored Console auth token and disconnects this machine from your TicketLens account. Local Jira profiles and credentials are kept intact — re-run `ticketlens login` to reconnect.
+
 `ticketlens sync` pulls any tracker profiles you have configured in the Console and writes them locally, keeping your CLI in sync with your team settings without re-running `init`.
 
+> **Console features** — `ticketlens triage --push`, `--share`, `ticketlens collisions`, and `ticketlens schedule` all require an active Console session. Run `ticketlens login` once and the token is stored automatically.
+
 ---
 
 ### License
@@ -587,7 +591,7 @@ ticketlens CNV1-2 --summarize            # AI summary via your own API key (BYOK
 ticketlens CNV1-2 --summarize --cloud    # AI summary via TicketLens API (no local key needed)
 ticketlens CNV1-2 --handoff              # AI handoff brief from the ticket's comment thread (BYOK)
 ticketlens CNV1-2 --handoff --cloud      # AI handoff brief via TicketLens API
-ticketlens CNV1-2 --compliance           # Check ticket requirements against local diff [Free 3/mo]
+ticketlens CNV1-2 --compliance           # Check ticket requirements against local diff [Pro/Free 3/mo]
 ticketlens triage --stale=3              # Custom stale threshold (default is 5)
 ticketlens triage --digest               # POST scored triage results to digest endpoint
 ticketlens schedule                      # Set up a scheduled daily digest
@@ -735,11 +739,13 @@ npm test
 See [ROADMAP.md](ROADMAP.md) for the full plan.
 
 Recently shipped:
-- **"TicketLens for PRs"** (`ticketlens review`) — assembles a code-review context brief from your current branch: extracts linked ticket keys from the branch name and commits, fetches each ticket, and outputs a structured brief with branch, changed files, and ticket context. Styled ANSI output, spinner, flag validation with typo hints, and base-branch safety check
+- **Collision detection** (`ticketlens collisions`) — shows which files your branch shares with teammates' in-flight branches; `--push` auto-sends git branch data to the team snapshot. Team tier
+- **Shareable triage snapshot** (`ticketlens triage --share`) — generates a 24h signed URL; recipients open it in any browser, no account needed. Team tier
+- **Compliance push** (`ticketlens triage --push`) — enriches the team snapshot with per-ticket compliance status and coverage from the local ledger. Pro tier
+- **"TicketLens for PRs"** (`ticketlens review`) — assembles a code-review context brief from your current branch: linked tickets, changed files, and ticket context in one brief
 - **Confluence pages** — linked Confluence pages fetched automatically and included in the brief; origin-validated, non-fatal, capped at 10 pages
 - **Linear support** — `ticketlens init` → Linear; connects via GraphQL API key, fetches tickets, triage, and statuses
 - **GitHub Issues support** — `ticketlens init` → GitHub Issues; PAT-based, same normalized ticket shape
-- **Tracker-aware config** — `ticketlens config` shows the right labels and skips irrelevant prompts per tracker type; always re-validates the connection
 
 ---
 

package/bin/ticketlens.mjs

@@ -203,13 +203,17 @@ switch (command) {
         process.stdin.setRawMode(true);
         process.stdin.resume();
         process.stdin.setEncoding('utf8');
-        process.stdin.once('data', char => {
-          process.stdin.setRawMode(false);
-          process.stdin.pause();
+        const cleanup = () => { process.stdin.setRawMode(false); process.stdin.pause(); };
+        const onData = char => {
+          process.stdin.removeListener('end', onEnd);
+          cleanup();
           process.stderr.write('\n');
           if (char === '\x03') process.exit(0);
           res(char === 'y' || char === 'Y');
-        });
+        };
+        const onEnd = () => { process.stdin.removeListener('data', onData); cleanup(); res(false); };
+        process.stdin.once('data', onData);
+        process.stdin.once('end', onEnd);
       });
       if (!answer) {
         process.stderr.write(`  ${s.dim('Cancelled.')}\n`);
@@ -258,13 +262,13 @@ switch (command) {
 
     if (subCmd === '--stop') {
       const { runScheduleStop } = await import('../skills/jtb/scripts/lib/schedule-wizard.mjs');
-      await runScheduleStop({ licenseKey: readLicense()?.key });
+      await runScheduleStop({ cliToken: readCliToken() });
       break;
     }
 
     if (subCmd === '--status') {
       const { runScheduleStatus } = await import('../skills/jtb/scripts/lib/schedule-wizard.mjs');
-      await runScheduleStatus({ licenseKey: readLicense()?.key });
+      await runScheduleStatus({ cliToken: readCliToken() });
       break;
     }
 
@@ -277,7 +281,8 @@ switch (command) {
     const { runScheduleWizard } = await import('../skills/jtb/scripts/lib/schedule-wizard.mjs');
     const { promptScheduleAnswers } = await import('../skills/jtb/scripts/lib/prompt-helpers.mjs');
     const answers = await promptScheduleAnswers(cmdArgs);
-    const result = await runScheduleWizard({ answers, licenseKey: readLicense()?.key });
+    const result = await runScheduleWizard({ answers, cliToken: readCliToken() });
+    if (!result.ok) { process.exitCode = 1; break; }
 
     process.stdout.write(`✔ Digest scheduled for ${answers.time} ${answers.timezone}\n`);
     process.stdout.write(`  Next delivery: ${result.nextDelivery}\n`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ticketlens",
-  "version": "0.4.2",
+  "version": "0.4.5",
   "description": "Jira CLI for developers — fetch ticket context, triage your queue, and stop tab-switching. Zero dependencies, all local.",
   "type": "module",
   "bin": {

package/skills/jtb/scripts/fetch-my-tickets.mjs

@@ -18,6 +18,7 @@ import { promptProfileSelect } from './lib/profile-picker.mjs';
 import { printTriageHelp } from './lib/help.mjs';
 import { handleUnknownFlags } from './lib/arg-validator.mjs';
 import { isLicensed, showUpgradePrompt, revalidateIfStale, readLicense } from './lib/license.mjs';
+import { readCliToken } from './lib/cli-auth.mjs';
 
 const DEFAULT_STATUSES = ['In Progress', 'Code Review', 'QA'];
 
@@ -334,37 +335,20 @@ export async function run(args, envOrOpts = process.env, fetcher = globalThis.fe
     return;
   }
 
-  // Interactive mode: TTY + not --plain + not --static
-  const wantInteractive = process.stdout.isTTY && !args.includes('--plain') && !args.includes('--static');
-  if (wantInteractive && process.stdin.setRawMode) {
-    const result = await runInteractiveList(sorted, { baseUrl: conn.baseUrl, staleDays, styled: true });
-    if (result === 'switch') {
-      const cleanArgs = args.filter(a => !a.startsWith('--profile=') && !a.startsWith('--project='));
-      return run(cleanArgs, { ...opts, env, fetcher, configDir });
-    }
-    // Fall through to push/share if those flags were passed
-    if (!pushFlag && !shareFlag) return;
-  } else {
-    const useStyled = args.includes('--styled') || (!args.includes('--plain') && process.stdout.isTTY);
-    const summary = useStyled
-      ? styleTriageSummary(sorted, { styled: true, staleDays, baseUrl: conn.baseUrl })
-      : assembleTriageSummary(sorted, { staleDays, baseUrl: conn.baseUrl });
-    process.stdout.write(summary + '\n');
-  }
-
+  // push/share run first so their result is visible before (or instead of) the TUI
   if (pushFlag) {
     const { pushTriageSnapshot } = await import('./lib/triage-push.mjs');
     const { scanCurrentBranch } = await import('./lib/branch-scanner.mjs');
     const pushFn = opts.pushFn ?? pushTriageSnapshot;
     const scanFn = opts.scanFn ?? scanCurrentBranch;
-    const licenseKey = readLicense(configDir)?.key ?? null;
+    const cliToken = opts.cliToken ?? readCliToken(configDir) ?? null;
     const printFn = opts.print ?? ((s) => process.stdout.write(s));
     await pushFn({
       sorted,
       rawTicketMap,
       profile: profileName ?? 'default',
       baseUrl: conn.baseUrl,
-      licenseKey,
+      cliToken,
       gitBranches: scanFn(),
       fetcher,
       print: printFn,
@@ -374,18 +358,35 @@ export async function run(args, envOrOpts = process.env, fetcher = globalThis.fe
   if (shareFlag) {
     const { shareTriageSnapshot } = await import('./lib/triage-share.mjs');
     const shareFn = opts.shareFn ?? shareTriageSnapshot;
-    const licenseKey = readLicense(configDir)?.key ?? null;
+    const cliToken = opts.cliToken ?? readCliToken(configDir) ?? null;
     const printFn = opts.print ?? ((s) => process.stdout.write(s));
     await shareFn({
       sorted,
       rawTicketMap,
       profile: profileName ?? 'default',
       baseUrl: conn.baseUrl,
-      licenseKey,
+      cliToken,
       fetcher,
       print: printFn,
     });
   }
+
+  // Interactive mode: TTY + not --plain + not --static
+  const wantInteractive = process.stdout.isTTY && !args.includes('--plain') && !args.includes('--static');
+  if (wantInteractive && process.stdin.setRawMode) {
+    const result = await runInteractiveList(sorted, { baseUrl: conn.baseUrl, staleDays, styled: true });
+    if (result === 'switch') {
+      const cleanArgs = args.filter(a => !a.startsWith('--profile=') && !a.startsWith('--project='));
+      return run(cleanArgs, { ...opts, env, fetcher, configDir });
+    }
+    return;
+  }
+
+  const useStyled = args.includes('--styled') || (!args.includes('--plain') && process.stdout.isTTY);
+  const summary = useStyled
+    ? styleTriageSummary(sorted, { styled: true, staleDays, baseUrl: conn.baseUrl })
+    : assembleTriageSummary(sorted, { staleDays, baseUrl: conn.baseUrl });
+  process.stdout.write(summary + '\n');
 }
 
 // Run if invoked directly

package/skills/jtb/scripts/lib/brief-cache.mjs

@@ -82,11 +82,19 @@ export function clearBriefCache(ticketKey, profileName, configDir = DEFAULT_CONF
   } catch { /* non-fatal */ }
 }
 
+// Memoize getBriefCacheEntries per configDir within a single process invocation.
+// 5s TTL is well beyond the lifetime of any CLI run; prevents repeated stat+read+parse
+// when multiple callers (cache list, cache prune, cache status) hit the same directory.
+const _entriesCache = new Map(); // configDir → { entries, time }
+const _ENTRIES_TTL_MS = 5_000;
+
 /**
  * Returns all brief cache entries across all profiles.
  * Each entry: { profileName, ticketKey, filePath, size, mtimeMs, fetchedAt, depth }
  */
 export function getBriefCacheEntries(configDir = DEFAULT_CONFIG_DIR) {
+  const cached = _entriesCache.get(configDir);
+  if (cached && Date.now() - cached.time < _ENTRIES_TTL_MS) return cached.entries;
   const cacheDir = path.join(configDir, 'cache');
   if (!fs.existsSync(cacheDir)) return [];
 
@@ -120,6 +128,7 @@ export function getBriefCacheEntries(configDir = DEFAULT_CONFIG_DIR) {
     }
   }
 
+  _entriesCache.set(configDir, { entries, time: Date.now() });
   return entries;
 }
 

package/skills/jtb/scripts/lib/ledger.mjs

@@ -8,8 +8,9 @@ import { join } from 'node:path';
 import { createHmac, randomBytes } from 'node:crypto';
 import { DEFAULT_CONFIG_DIR } from './config.mjs';
 
-const LEDGER_FILE = 'ledger.jsonl';
-const KEY_FILE    = 'ledger-key';
+const LEDGER_FILE        = 'ledger.jsonl';
+const KEY_FILE           = 'ledger-key';
+const MAX_LEDGER_RECORDS = 5_000;
 
 /**
  * Append one compliance record to ledger.jsonl.
@@ -25,6 +26,7 @@ export function appendLedger(record, { configDir = DEFAULT_CONFIG_DIR, fsModule
 
   const line = JSON.stringify({ ts: new Date().toISOString(), ...record }) + '\n';
   fsModule.appendFileSync(join(configDir, LEDGER_FILE), line, 'utf8');
+  _rotateIfNeeded(configDir, fsModule);
 }
 
 /**
@@ -84,6 +86,23 @@ export function exportLedger(format, { configDir = DEFAULT_CONFIG_DIR, fsModule
 
 // ── Internal helpers ─────────────────────────────────────────────────────────
 
+function _rotateIfNeeded(configDir, fsModule) {
+  const ledgerPath = join(configDir, LEDGER_FILE);
+  // Cheap size check first — each JSONL record averages ~180 bytes, so 5000 records ≈ 900 KB.
+  // Skip the full read when the file is well under the threshold.
+  try {
+    if (fsModule.statSync(ledgerPath).size < 900_000) return;
+  } catch { return; }
+
+  let raw;
+  try { raw = fsModule.readFileSync(ledgerPath, 'utf8'); } catch { return; }
+
+  const lines = raw.split('\n').filter(l => l.trim().length > 0);
+  if (lines.length > MAX_LEDGER_RECORDS) {
+    fsModule.writeFileSync(ledgerPath, lines.slice(-MAX_LEDGER_RECORDS).join('\n') + '\n', 'utf8');
+  }
+}
+
 function _getOrCreateKey(configDir, fsModule) {
   const keyPath = join(configDir, KEY_FILE);
   try {

package/skills/jtb/scripts/lib/run-collisions.mjs

@@ -1,5 +1,6 @@
-import { readLicense } from './license.mjs';
+import { readCliToken } from './cli-auth.mjs';
 import { formatCollisions } from './collision-reporter.mjs';
+import { DEFAULT_CONFIG_DIR } from './config.mjs';
 
 import { apiBase, warnIfInsecure } from './api-utils.mjs';
 
@@ -10,35 +11,37 @@ const COLLISIONS_PATH = '/v1/triage/collisions';
  *
  * @param {string[]} args              CLI argument array (e.g. ['--json', '--plain'])
  * @param {object}   [opts]
- * @param {Function} [opts.fetcher]        Injectable fetch
- * @param {Function} [opts.print]          Output function
- * @param {Function} [opts.readLicenseFn]  Injectable license reader
+ * @param {Function} [opts.fetcher]          Injectable fetch
+ * @param {Function} [opts.print]            Output function
+ * @param {Function} [opts.readCliTokenFn]   Injectable CLI token reader
+ * @param {string}   [opts.configDir]        Config directory override
  * @returns {Promise<{ ok: boolean, status?: number }>}
  */
 export async function runCollisions(args = [], opts = {}) {
   const jsonFlag  = args.includes('--json');
   const plainFlag = args.includes('--plain');
-  const fetcher        = opts.fetcher       ?? globalThis.fetch;
-  const print          = opts.print         ?? ((s) => process.stdout.write(s));
-  const warn           = opts.warn          ?? ((s) => process.stderr.write(s));
-  const readLicenseFn  = opts.readLicenseFn ?? (() => readLicense());
+  const fetcher        = opts.fetcher        ?? globalThis.fetch;
+  const print          = opts.print          ?? ((s) => process.stdout.write(s));
+  const warn           = opts.warn           ?? ((s) => process.stderr.write(s));
+  const configDir      = opts.configDir      ?? DEFAULT_CONFIG_DIR;
+  const readCliTokenFn = opts.readCliTokenFn ?? ((dir) => readCliToken(dir));
   warnIfInsecure(apiBase(), warn);
 
-  const licenseKey = readLicenseFn()?.key ?? null;
-  if (!licenseKey) {
-    print('✗ collisions requires an active Team license (ticketlens activate <key>)\n');
+  const cliToken = readCliTokenFn(configDir) ?? null;
+  if (!cliToken) {
+    print('✗ collisions requires Console access. Run ticketlens login first.\n');
     return { ok: false };
   }
 
   try {
     const res = await fetcher(`${apiBase()}${COLLISIONS_PATH}`, {
-      headers: { Authorization: `Bearer ${licenseKey}` },
+      headers: { Authorization: `Bearer ${cliToken}` },
       signal: AbortSignal.timeout(15_000),
     });
 
     if (!res.ok) {
       if (res.status === 401) {
-        print('✗ Invalid license key\n');
+        print('✗ Session expired. Run ticketlens login to reconnect.\n');
         return { ok: false, status: 401 };
       }
       if (res.status === 403) {

package/skills/jtb/scripts/lib/schedule-wizard.mjs

@@ -52,12 +52,17 @@ export function buildCronLine({ hour, minute, ticketlensBin }) {
 export async function runScheduleWizard({
   answers,
   fetcher = globalThis.fetch,
-  licenseKey,
+  cliToken,
   configDir,
   platform = osPlatform(),
   writeLocalJob = defaultWriteLocalJob,
   timeoutMs = 10_000,
+  print = s => process.stdout.write(s),
 }) {
+  if (!cliToken) {
+    print('✗ schedule requires Console access. Run ticketlens login first.\n');
+    return { ok: false };
+  }
   const { time, email, timezone } = answers;
   const [hourStr, minuteStr] = time.split(':');
   const hour = parseInt(hourStr, 10);
@@ -68,7 +73,7 @@ export async function runScheduleWizard({
     signal: AbortSignal.timeout(timeoutMs),
     headers: {
       'Content-Type': 'application/json',
-      'Authorization': `Bearer ${licenseKey}`,
+      'Authorization': `Bearer ${cliToken}`,
     },
     body: JSON.stringify({ email, timezone, deliverAt: time }),
   });
@@ -91,11 +96,20 @@ export async function runScheduleWizard({
   return data;
 }
 
-export async function runScheduleStop({ fetcher = globalThis.fetch, licenseKey, platform = osPlatform() }) {
+export async function runScheduleStop({
+  fetcher = globalThis.fetch,
+  cliToken,
+  platform = osPlatform(),
+  print = s => process.stdout.write(s),
+}) {
+  if (!cliToken) {
+    print('✗ schedule requires Console access. Run ticketlens login first.\n');
+    return;
+  }
   const res = await fetcher(SCHEDULE_URL, {
     method: 'DELETE',
     signal: AbortSignal.timeout(10_000),
-    headers: { 'Authorization': `Bearer ${licenseKey}` },
+    headers: { 'Authorization': `Bearer ${cliToken}` },
   });
   if (!res.ok) throw new Error(`Schedule API error ${res.status}`);
 
@@ -114,11 +128,19 @@ export async function runScheduleStop({ fetcher = globalThis.fetch, licenseKey,
   process.stdout.write('✔ Digest schedule removed.\n');
 }
 
-export async function runScheduleStatus({ fetcher = globalThis.fetch, licenseKey }) {
+export async function runScheduleStatus({
+  fetcher = globalThis.fetch,
+  cliToken,
+  print = s => process.stdout.write(s),
+}) {
+  if (!cliToken) {
+    print('✗ schedule requires Console access. Run ticketlens login first.\n');
+    return;
+  }
   const res = await fetcher(SCHEDULE_URL, {
     method: 'GET',
     signal: AbortSignal.timeout(10_000),
-    headers: { 'Authorization': `Bearer ${licenseKey}` },
+    headers: { 'Authorization': `Bearer ${cliToken}` },
   });
   if (!res.ok) {
     process.stdout.write('No active digest schedule found.\n');

package/skills/jtb/scripts/lib/ticket-payload.mjs

@@ -0,0 +1,19 @@
+/**
+ * Shared ticket payload builder used by triage-push and triage-share.
+ */
+
+export function buildTicketPayload(scored, rawMap, baseUrl) {
+  const raw = rawMap?.get(scored.ticketKey);
+  return {
+    key: scored.ticketKey,
+    summary: scored.summary ?? null,
+    status: scored.status ?? null,
+    assignee: raw?.assignee ?? null,
+    attention_score: null,
+    flags: scored.urgency === 'clear' ? [] : [scored.urgency],
+    compliance_coverage: null,
+    compliance_status: 'unknown',
+    url: baseUrl ? `${baseUrl}/browse/${scored.ticketKey}` : null,
+    last_updated: raw?.updated ?? null,
+  };
+}

package/skills/jtb/scripts/lib/triage-push.mjs

@@ -6,8 +6,8 @@
 import { readLedger } from './ledger.mjs';
 import { isLicensed } from './license.mjs';
 import { DEFAULT_CONFIG_DIR } from './config.mjs';
-
 import { apiBase, warnIfInsecure } from './api-utils.mjs';
+import { buildTicketPayload } from './ticket-payload.mjs';
 
 const PUSH_PATH = '/v1/triage/push';
 
@@ -16,27 +16,10 @@ const PUSH_PATH = '/v1/triage/push';
 //   https://api.ticketlens.com      → https://app.ticketlens.com/console/queue
 export function queueUrl(base) {
   const noApi = base.replace(/^(https?:\/\/)api\./, '$1');
-  // Production: ticketlens.com → app.ticketlens.com
-  const console = /ticketlens\.com/.test(noApi)
+  const consoleBase = /ticketlens\.com/.test(noApi)
     ? noApi.replace('://', '://app.')
     : noApi;
-  return console + '/console/queue';
-}
-
-function buildTicketPayload(scored, rawMap, baseUrl) {
-  const raw = rawMap?.get(scored.ticketKey);
-  return {
-    key: scored.ticketKey,
-    summary: scored.summary ?? null,
-    status: scored.status ?? null,
-    assignee: raw?.assignee ?? null,
-    attention_score: null,
-    flags: scored.urgency === 'clear' ? [] : [scored.urgency],
-    compliance_coverage: null,
-    compliance_status: 'unknown',
-    url: baseUrl ? `${baseUrl}/browse/${scored.ticketKey}` : null,
-    last_updated: raw?.updated ?? null,
-  };
+  return consoleBase + '/console/queue';
 }
 
 /**
@@ -47,7 +30,7 @@ function buildTicketPayload(scored, rawMap, baseUrl) {
  * @param {Map}      [opts.rawTicketMap] - Map<key, normalizedTicket>
  * @param {string}   [opts.profile]      - Resolved profile name (max 100 chars)
  * @param {string}   [opts.baseUrl]      - Jira base URL for URL construction
- * @param {string}   [opts.licenseKey]   - Bearer token for the API
+ * @param {string}   [opts.cliToken]     - CLI session token for the API
  * @param {string}   [opts.capturedAt]   - ISO 8601 timestamp (defaults to now)
  * @param {Array}    [opts.gitBranches]  - Branch metadata from scanCurrentBranch (null = not in git repo)
  * @param {Function} [opts.fetcher]      - Injectable fetch (default: globalThis.fetch)
@@ -59,7 +42,7 @@ export async function pushTriageSnapshot({
   rawTicketMap = new Map(),
   profile,
   baseUrl,
-  licenseKey,
+  cliToken,
   capturedAt,
   gitBranches,
   fetcher = globalThis.fetch,
@@ -70,8 +53,8 @@ export async function pushTriageSnapshot({
   configDir = DEFAULT_CONFIG_DIR,
 } = {}) {
   warnIfInsecure(apiBase(), warn);
-  if (!licenseKey) {
-    print('✗ --push requires an active Team license (ticketlens activate <key>)\n');
+  if (!cliToken) {
+    print('✗ --push requires Console access. Run ticketlens login first.\n');
     return { ok: false };
   }
 
@@ -110,7 +93,7 @@ export async function pushTriageSnapshot({
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
-        'Authorization': `Bearer ${licenseKey}`,
+        'Authorization': `Bearer ${cliToken}`,
       },
       body: JSON.stringify(payload),
       signal: AbortSignal.timeout(15_000),
@@ -121,6 +104,11 @@ export async function pushTriageSnapshot({
       return { ok: true, status: res.status };
     }
 
+    if (res.status === 401) {
+      print('✗ Session expired. Run ticketlens login to reconnect.\n');
+      return { ok: false, status: res.status };
+    }
+
     if (res.status === 403) {
       print('✗ --push requires a Team license\n');
       return { ok: false, status: res.status };

package/skills/jtb/scripts/lib/triage-share.mjs

@@ -29,7 +29,7 @@ function buildTicketPayload(scored, rawMap, baseUrl) {
  * @param {Map}      [opts.rawTicketMap] - Map<key, normalizedTicket>
  * @param {string}   [opts.profile]      - Resolved profile name (max 100 chars)
  * @param {string}   [opts.baseUrl]      - Jira base URL
- * @param {string}   [opts.licenseKey]   - Bearer token
+ * @param {string}   [opts.cliToken]     - CLI session token
  * @param {string}   [opts.capturedAt]   - ISO 8601 timestamp
  * @param {Function} [opts.fetcher]      - Injectable fetch
  * @param {Function} [opts.print]        - Output fn
@@ -40,15 +40,15 @@ export async function shareTriageSnapshot({
   rawTicketMap = new Map(),
   profile,
   baseUrl,
-  licenseKey,
+  cliToken,
   capturedAt,
   fetcher = globalThis.fetch,
   print = (s) => process.stdout.write(s),
   warn = (s) => process.stderr.write(s),
 } = {}) {
   warnIfInsecure(apiBase(), warn);
-  if (!licenseKey) {
-    print('✗ --share requires an active Team license (ticketlens activate <key>)\n');
+  if (!cliToken) {
+    print('✗ --share requires Console access. Run ticketlens login first.\n');
     return { ok: false };
   }
 
@@ -63,7 +63,7 @@ export async function shareTriageSnapshot({
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
-        'Authorization': `Bearer ${licenseKey}`,
+        'Authorization': `Bearer ${cliToken}`,
       },
       body: JSON.stringify(payload),
       signal: AbortSignal.timeout(15_000),
@@ -75,6 +75,11 @@ export async function shareTriageSnapshot({
       return { ok: true, status: res.status };
     }
 
+    if (res.status === 401) {
+      print('✗ Session expired. Run ticketlens login to reconnect.\n');
+      return { ok: false, status: res.status };
+    }
+
     if (res.status === 403) {
       print('✗ --share requires a Team license\n');
       return { ok: false, status: res.status };