ticketlens 0.40.0 → 0.41.0

package/README.md

@@ -499,7 +499,7 @@ Write directly to the ticket in its real tracker — Jira, GitHub, or Linear —
 
 `ticketlens transition` with just a ticket key lists the tracker's current valid options without changing anything (Jira: real workflow transitions for that issue; GitHub: open/closed; Linear: team-scoped workflow states). Add both `--target` and `--confirm` to execute — `--confirm` is a deliberate two-step gate: a behavioral nudge and forensic trail, not a hard security guarantee. Every write, once resolved, is re-validated against the tracker's current state immediately before executing — never a blind write against a stale option.
 
-`ticketlens assign` is self-assign only for now — `--to` must be `me`. Assigning to someone else needs a per-tracker user-lookup step this doesn't do yet, so it's deliberately out of scope until that's built.
+`ticketlens assign --to=me` self-assigns immediately, no `--confirm` needed. Any other `--to` (a name or email) assigns to another developer — Jira Cloud only for now, GitHub/Linear/Server-DC refuse cleanly. It searches Jira's real assignable-user list first: without `--confirm` it only lists the matching candidate(s), never assigns; with `--confirm` it executes only if exactly one candidate still matches (0 or 2+ always refuses). Matches are cached locally per project for 3 days.
 
 `ticketlens worklog` (or `tl worklog`) logs time on Jira tickets, always as you.
 
@@ -1121,6 +1121,7 @@ npm test
 See [ROADMAP.md](ROADMAP.md) for the full plan.
 
 Recently shipped:
+- **`ticketlens assign --to="name or email"`** — assign a ticket to another developer, not just yourself. Jira Cloud only for now; searches real assignable users first, lists matches, executes only on one confirmed match. Pro tier
 - **Console: Recall "select all N matching" bulk delete** — Gmail-style banner deletes every note matching your search/filters across all pages, not just the current one
 - **Recall Stop-hook fix** — the end-of-session Recall reminder no longer fires because of file writes; only real ticket writes (comment, transition, assign, update) arm it. Also hardened against malformed transcripts and a session-id path-collision bug found by adversarial testing
 - **Console: no repeat request on same-page menu clicks** — sidebar links, the header gear and Settings tabs skip the request when they point at the page you are on

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ticketlens",
-  "version": "0.40.0",
+  "version": "0.41.0",
   "description": "Jira CLI for developers — fetch ticket context, triage your queue, and stop tab-switching. Zero dependencies, all local.",
   "type": "module",
   "bin": {

package/skills/jtb/SKILL.md

@@ -1,4 +1,4 @@
-<!-- jtb-skill-version: 0.45.0 -->
+<!-- jtb-skill-version: 0.46.0 -->
 ---
 name: jtb
 description: Fetch a Jira ticket's full context (description, comments, linked issues, code references) and assemble a structured TicketBrief for implementation planning. Use when user types /jtb, mentions a Jira ticket key, or wants to plan work from a Jira ticket.
@@ -436,7 +436,9 @@ ticketlens comment PROD-1234 --body="Fixed in a2f9c1, deployed to staging."
 ticketlens comment PROD-1234 --body="See screenshot" --attach=./bug.png  # attach local files
 ticketlens transition PROD-1234                              # list valid transitions — read-only
 ticketlens transition PROD-1234 --target="Done" --confirm    # execute
-ticketlens assign PROD-1234 --to=me                          # assign to yourself
+ticketlens assign PROD-1234 --to=me                          # assign to yourself — immediate, no --confirm
+ticketlens assign PROD-1234 --to="Jane Dev"                  # search assignable users — read-only, lists match(es)
+ticketlens assign PROD-1234 --to="Jane Dev" --confirm        # execute — only if exactly one match (Jira Cloud only)
 ticketlens duplicates PROD-1234                               # find likely duplicates — read-only
 ticketlens link PROD-1234 PROD-5678                            # list valid link types — read-only
 ticketlens link PROD-1234 PROD-5678 --type="Duplicate" --confirm  # execute the link
@@ -451,13 +453,13 @@ ticketlens worklog PROD-1234=1h30m PROD-5678=45m --comment="Sprint work" --confi
 
 `transition` called with just a ticket key never mutates anything — it lists the tracker's current valid options (Jira: real workflow transitions for that issue; GitHub: open/closed; Linear: team-scoped workflow states). Only add `--target` **and** `--confirm` once the target has actually been confirmed with the user — `--confirm` is a deliberate two-step gate, not a formality to route around. Never guess a `--target` value; always list first, then use one of the names shown.
 
-`assign` is self-assign only — `--to` must be `me`. There is no way to assign to anyone else yet; don't attempt a workaround (e.g. via `comment`) if the user asks for that — tell them it isn't supported.
+`assign` — `--to=me` self-assigns immediately, no `--confirm` needed. Any other `--to` (a name or email) assigns to another developer, Jira Cloud only for now — GitHub, Linear, and Jira Server/DC refuse cleanly rather than guess at unverified API behavior. It searches Jira's real assignable-user list first: called without `--confirm` it never assigns, only lists the matching candidate(s) (name + accountId, cached locally per project for 3 days); called again with the same `--to` and `--confirm`, it executes only if exactly one candidate still matches — 0 or 2+ matches always refuses, never guesses which person was meant. Never attempt a workaround (e.g. via `comment`) for a tracker `assign` refuses (GitHub/Linear/Server-DC) — tell the user it isn't supported yet.
 
 `duplicates` lists likely-duplicate tickets in the same project. On Jira, any ticket already linked as a "Duplicate" is always listed first — that's a confirmed relationship a human already recorded, not a heuristic. Everything else is ranked by local title/description overlap — no tracker scores similarity server-side, so treat those as a nudge for the user to check manually, never as a confirmed duplicate to act on unprompted (e.g. don't auto-close or auto-comment based on a match). `--threshold=N` (0–1, default 0.35) tightens or loosens what counts as a text-match — it has no effect on Jira-linked duplicates, which are always shown. An empty result is the same approximation in the other direction — the local scorer can miss a real duplicate too, so don't treat "no likely duplicates found" as proof none exist.
 
 `link SOURCE-KEY TARGET-KEY` links two tickets — direction matters: SOURCE "types" TARGET (e.g. `link A B --type=Duplicate` means A duplicates B, not the other way around). Called with just the two keys, it lists the tracker's current valid link types without changing anything — never guess `--type`; always list first, then use one of the names shown. GitHub has no generic link relationship, so linking on a GitHub-tracked ticket *closes SOURCE as a duplicate of TARGET* — a real state change, not just a relationship add — and prints an explicit warning immediately before that happens, on top of the same `--confirm` gate.
 
-`update TICKET-KEY` updates a narrow, named field set — title, description, labels, priority. At least one field is required. Labels are always add/remove (`--add-labels=a,b` / `--remove-labels=c`), never a wholesale replace — an unnamed existing label is left alone, never silently dropped. No `--confirm` needed — these are reversible metadata edits, same risk tier as `assign`.
+`update TICKET-KEY` updates a narrow, named field set — title, description, labels, priority. At least one field is required. Labels are always add/remove (`--add-labels=a,b` / `--remove-labels=c`), never a wholesale replace — an unnamed existing label is left alone, never silently dropped. No `--confirm` needed — these are reversible metadata edits, same risk tier as self-assign.
 
 `create` makes a brand-new ticket — there's no existing ticket to target, so `--project` (Jira project key / Linear team key) and `--type` (Jira issue type, ignored elsewhere) pick the destination instead of a ticket key. This is the highest-blast-radius command in the family: a bad `--project`/`--type` fabricates a real, hard-to-walk-back item in a live tracker. No `--confirm` gate — double-check the values with the user before calling it, since an invalid value surfaces the tracker's own error rather than a silent guess.
 

package/skills/jtb/scripts/lib/adapters/jira-adapter.mjs

@@ -1,4 +1,4 @@
-import { fetchTicket, fetchCurrentUser, searchTickets, fetchStatuses, fetchProjects, fetchIssueTypes, postComment, getTransitions, postTransition, assignIssue, escapeJql, getIssueLinkTypes, postIssueLink, updateIssue, createIssue, DEFAULT_SEARCH_FIELDS } from '../jira-client.mjs';
+import { fetchTicket, fetchCurrentUser, searchTickets, fetchStatuses, fetchProjects, fetchIssueTypes, postComment, getTransitions, postTransition, assignIssue, fetchAssignableUsers, escapeJql, getIssueLinkTypes, postIssueLink, updateIssue, createIssue, DEFAULT_SEARCH_FIELDS } from '../jira-client.mjs';
 import { postWorklog } from '../jira-worklog-client.mjs';
 import { uploadAttachment, resolveMediaId } from '../jira-attachment-client.mjs';
 import { readAttachments } from '../attachment-uploader.mjs';
@@ -83,6 +83,31 @@ export function createJiraAdapter(conn, { fetcher = globalThis.fetch } = {}) {
       return { assignee: me.displayName ?? value };
     },
 
+    /**
+     * Resolves a free-text name/email into candidate assignable users —
+     * read-only, never assigns. Cloud only (`apiVersion === 3`): Jira
+     * Server/DC's equivalent endpoint semantics are unverified, so this
+     * refuses rather than guess at request/response shape (ROADMAP 61).
+     * Caching (3-day TTL, per project+query) is the caller's job — same
+     * split as `listIssueTypes`, which is also cache-agnostic here.
+     */
+    async searchAssignableUsers(key, query, opts = {}) {
+      if (apiVersion !== 3) {
+        throw new Error('Assigning to another developer needs Jira Cloud — Server/DC is not supported yet.');
+      }
+      const users = await fetchAssignableUsers(key, query, { ...base, ...opts });
+      return users.map(u => ({ accountId: u.accountId, displayName: u.displayName ?? u.name ?? u.accountId }));
+    },
+
+    /**
+     * Executes an assignment to a resolved accountId — always Cloud
+     * (`searchAssignableUsers` is the only path that produces one), so no
+     * apiVersion branch is needed here the way `assignToSelf` has.
+     */
+    async assignToUser(key, accountId, opts = {}) {
+      await assignIssue(key, { accountId }, { ...base, ...opts });
+    },
+
     /**
      * Candidate search for duplicate-ticket detection. Scoped to the same
      * project as `sourceKey` (derived from its own prefix) and excludes it

package/skills/jtb/scripts/lib/help.mjs

@@ -670,7 +670,9 @@ export function printMcpHelp({ stream = process.stdout } = {}) {
     `  ${s.cyan('issue_types')} is Free and Jira-only — Linear/GitHub profiles get a clear`,
     `  "not available" instead of an empty result — every other tool needs Pro.`,
     `  ${s.cyan('ticket_transition')} is destructive when called with`,
-    `  \`target\`+\`confirm: true\`; ${s.cyan('ticket_assign')} is currently self-assign only;`,
+    `  \`target\`+\`confirm: true\`; ${s.cyan('ticket_assign')}'s \`to: "me"\` self-assigns immediately,`,
+    `  no confirm needed — assigning to another developer (Jira Cloud only) resolves`,
+    `  \`to\` first and needs \`confirm: true\` once it matches exactly one candidate;`,
     `  ${s.cyan('ticket_worklog')} is Jira-only, logs as you only, and writes nothing without`,
     `  \`confirm: true\` (it previews instead) — a worklog cannot be deleted through TicketLens;`,
     `  ${s.cyan('ticket_duplicates')} is read-only; ${s.cyan('ticket_link')} on GitHub closes the source issue as a`,
@@ -778,19 +780,26 @@ export function printAssignHelp({ stream = process.stdout } = {}) {
     '',
     `  ${s.bold(s.brand('ticketlens'))} ${s.bold('assign')} ${s.dim('TICKET-KEY --to=me')}  ${s.dim('[Pro]')}`,
     '',
-    `  Assign a ticket to yourself directly in its tracker (Jira/GitHub/Linear). ${s.dim('[Pro]')}`,
-    `  Self-assign only for now — ${s.brand('--to')} must be ${s.brand('me')}. Assigning to someone else`,
-    `  isn't supported yet.`,
+    `  Assign a ticket directly in its tracker (Jira/GitHub/Linear). ${s.dim('[Pro]')}`,
+    `  ${s.brand('--to=me')} self-assigns immediately, no --confirm needed. Any other`,
+    `  ${s.brand('--to')} (a name or email) assigns to another developer — Jira Cloud`,
+    `  only for now. Resolves the name/email against real assignable users first:`,
+    `  without --confirm it lists the match(es) instead of assigning; with`,
+    `  --confirm it executes only if exactly one candidate matched. Results are`,
+    `  cached locally per project for 3 days.`,
     '',
     `  ${s.bold('OPTIONS')}`,
     '',
-    `    ${s.brand('--to')}=${s.dim('me')}       Required — only "me" is currently supported`,
-    `    ${s.brand('--profile')}=${s.dim('NAME')} Connection profile to use ${s.dim('(optional)')}`,
-    `    ${s.brand('-h')}, ${s.brand('--help')}   Show this help`,
+    `    ${s.brand('--to')}=${s.dim('me|"name or email"')}  Required`,
+    `    ${s.brand('--confirm')}        Execute an assign-to-other match ${s.dim('(not needed for --to=me)')}`,
+    `    ${s.brand('--profile')}=${s.dim('NAME')}    Connection profile to use ${s.dim('(optional)')}`,
+    `    ${s.brand('-h')}, ${s.brand('--help')}      Show this help`,
     '',
     `  ${s.bold('EXAMPLES')}`,
     '',
     `    ${s.dim('$')} ticketlens assign PROD-123 --to=me`,
+    `    ${s.dim('$')} ticketlens assign PROD-123 --to="Jane Dev"`,
+    `    ${s.dim('$')} ticketlens assign PROD-123 --to="Jane Dev" --confirm`,
     '',
   ];
   stream.write(lines.join('\n') + '\n');

package/skills/jtb/scripts/lib/jira-client.mjs

@@ -613,6 +613,39 @@ export async function assignIssue(ticketKey, assignee, opts = {}) {
   }
 }
 
+/**
+ * Searches for users assignable to a ticket — resolves a caller-typed
+ * name/email into a real accountId before assignIssue can use it.
+ *
+ * `query` is required by Jira's own API: `GET .../user/assignable/search`
+ * 400s unless `query` or `accountId` is given (verified against Atlassian's
+ * published spec — there is no "list everyone assignable" mode), so this
+ * throws early on an empty query rather than sending a request guaranteed
+ * to fail.
+ */
+export async function fetchAssignableUsers(ticketKey, query, opts = {}) {
+  const { env = process.env, fetcher = globalThis.fetch, lookup = defaultLookupFor(fetcher), apiVersion = 2, timeoutMs = 10_000, allowPrivateIp = false, maxResults = 20 } = opts;
+  if (!query) {
+    throw new Error('fetchAssignableUsers requires a non-empty query — Jira has no "list all assignable users" mode.');
+  }
+  validateBaseUrl(env.JIRA_BASE_URL, allowPrivateIp);
+  const baseUrl = env.JIRA_BASE_URL.replace(/\/$/, '');
+  const params = new URLSearchParams({ issueKey: ticketKey, query, maxResults: String(maxResults) });
+  const url = `${baseUrl}/rest/api/${apiVersion}/user/assignable/search?${params}`;
+
+  const fetchOpts = { headers: { ...buildAuthHeader(env), 'Content-Type': 'application/json' } };
+  if (timeoutMs) fetchOpts.signal = AbortSignal.timeout(timeoutMs);
+
+  const response = await guardedFetch(url, fetchOpts, { fetcher, lookup, allowPrivateIp });
+  if (!response.ok) {
+    const err = new Error(`Jira API error ${response.status} searching assignable users for ${ticketKey}`);
+    err.status = response.status;
+    throw err;
+  }
+  const raw = await response.json();
+  return raw.map(u => ({ accountId: u.accountId ?? null, name: u.name ?? null, displayName: u.displayName ?? null }));
+}
+
 /**
  * Updates a narrow, named field set on an issue. `fields` (summary,
  * description, priority) uses plain SET semantics — the same shape Jira's

package/skills/jtb/scripts/lib/mcp-server.mjs

@@ -522,7 +522,9 @@ async function callTicketAssign(args, { configDir, runTicketAssignFn }) {
     return { isError: true, content: [{ type: 'text', text: 'Missing required argument: to' }] };
   }
   const capture = capturingStream();
-  const { ok } = await runTicketAssignFn([args.ticket, `--to=${args.to}`], { configDir, stream: capture });
+  const cmdArgs = [args.ticket, `--to=${args.to}`];
+  if (args.confirm === true) cmdArgs.push('--confirm');
+  const { ok } = await runTicketAssignFn(cmdArgs, { configDir, stream: capture, cliHints: false });
   const content = [{ type: 'text', text: capture.text }];
   return ok ? { content } : { isError: true, content };
 }

package/skills/jtb/scripts/lib/mcp-tool-schemas.mjs

@@ -239,12 +239,13 @@ export const TOOLS = [
   },
   {
     name: 'ticket_assign',
-    description: 'Assign a ticket to yourself in its tracker (Jira/GitHub/Linear). Self-assign only — assigning to someone else is not supported yet. Requires a TicketLens Pro license.',
+    description: 'Assign a ticket in its tracker (Jira/GitHub/Linear). `to: "me"` self-assigns immediately, no confirm needed. Any other `to` (a name or email) assigns to another developer — Jira Cloud only for now; GitHub, Linear, and Jira Server/DC are refused. Resolves `to` against real assignable users before writing: called without `confirm: true`, it never assigns — it returns the matching candidate(s) (name + accountId) instead, so the exact person can be confirmed first. Called again with the same `to` and `confirm: true`, it executes only if `to` still resolves to exactly one candidate; 0 or 2+ matches always refuses, never guesses. Matches are cached locally per ticket\'s project for 3 days. Requires a TicketLens Pro license.',
     inputSchema: {
       type: 'object',
       properties: {
         ticket: { type: 'string', description: 'Ticket key, e.g. PROJ-123.' },
-        to: { type: 'string', description: 'Who to assign to — currently only "me" is accepted.' },
+        to: { type: 'string', description: '"me" to self-assign, or a name/email to search for and assign to another developer (Jira Cloud only).' },
+        confirm: { type: 'boolean', description: 'Must be true, alongside a `to` that resolves to exactly one match, to actually execute an assign-to-other. Not needed for `to: "me"`.' },
       },
       required: ['ticket', 'to'],
     },

package/skills/jtb/scripts/lib/secret-scanner.mjs

@@ -105,7 +105,17 @@ const HARD_REJECT_PATTERNS = [
   { name: 'GitHub token', re: /\bgh[pousr]_[A-Za-z0-9]{20,}\b/ },
 ];
 
-const EMAIL_RE = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/;
+// Bounded quantifiers (RFC 5321-realistic: 64-char local part, 253-char
+// domain, 24-char TLD — no real email exceeds these) are load-bearing, not
+// cosmetic: an unbounded `+` here is a textbook O(n^2) ReDoS on any long
+// token with no '@' — the unanchored regex tries every starting position,
+// and at each one backtracks the whole remaining length one char at a time
+// before giving up. Found 2026-09-23 via adversarial testing of 49e: a
+// 500KB error message with no '@' hung the process for minutes. Affects
+// every caller of scanForSecrets (note add/patch, Recall push, and now
+// error-reporter.mjs) — fixed once here rather than length-capping each
+// call site, since the regex itself is the actual bug.
+const EMAIL_RE = /[a-zA-Z0-9._%+-]{1,64}@[a-zA-Z0-9.-]{1,253}\.[a-zA-Z]{2,24}/;
 
 // Shared between CODE_FILENAME_RE below and FILENAME_REFERENCE_RE further
 // down, the same way WHITESPACE_CLASS is shared across the whitespace

package/skills/jtb/scripts/lib/ticket-command.mjs

@@ -16,7 +16,7 @@ import { resolveConnection, findProfilesByPrefix } from './profile-resolver.mjs'
 import { resolveAdapter } from './resolve-adapter.mjs';
 import { checkCooldown, recordAction } from './ticket-action-cooldown.mjs';
 import { logAction } from './ticket-action-log.mjs';
-import { readMetadataCache, writeMetadataCache } from './ticket-metadata-cache.mjs';
+import { readMetadataCache, writeMetadataCache, isFresh, SINGLE_PROJECT_TTL_MS, mergeAssignableUsers, normalizeAssigneeQuery } from './ticket-metadata-cache.mjs';
 import { detectProjectOrTypeError, enrichCreateFailure } from './ticket-create-enrichment.mjs';
 import { TICKET_KEY_PATTERN, normalizeTicketKey } from './cli.mjs';
 import { scoreCandidates } from './duplicate-scorer.mjs';
@@ -436,13 +436,69 @@ export async function runTicketTransition(cmdArgs, {
 }
 
 /**
- * Self-assign only — `--to` currently only accepts the literal "me".
- * Arbitrary-user assignment needs a per-tracker user-search step this
- * codebase doesn't have yet; kept as an explicit, rejected value now so
- * a future `--to=someone@else.com` doesn't silently redefine what a
- * bare/missing --to means today.
+ * Derives the project-key portion of a ticket key — used only to key the
+ * local assignable-users cache, never for validation. Jira's own API stays
+ * the source of truth for whether the ticket key is real; a ticket key
+ * this can't parse just means caching is skipped, not a hard failure.
+ */
+function projectKeyFromTicket(ticketKey) {
+  const hyphenIndex = ticketKey.lastIndexOf('-');
+  return hyphenIndex > 0 ? ticketKey.slice(0, hyphenIndex) : null;
+}
+
+/**
+ * Resolves a free-text `--to` query into assignable-user candidates,
+ * checking the local cache (3-day TTL, per project+query — ROADMAP 61)
+ * before calling the adapter. Read-only: never assigns, never touches
+ * cooldown. Exported for direct unit testing, same convention as
+ * `resolveTicketAdapter`.
+ */
+export async function resolveAssigneeCandidates(adapter, ticketKey, query, {
+  profileName,
+  configDir = DEFAULT_CONFIG_DIR,
+  readMetadataCacheFn = readMetadataCache,
+  writeMetadataCacheFn = writeMetadataCache,
+} = {}) {
+  const projectKey = projectKeyFromTicket(ticketKey);
+  const cached = readMetadataCacheFn(profileName, configDir);
+
+  if (projectKey) {
+    const normalizedQuery = normalizeAssigneeQuery(query);
+    const cachedCandidates = cached?.assignableUsersByProject?.[projectKey]?.[normalizedQuery];
+    const cachedAt = cached?.assignableUsersFetchedAt?.[projectKey]?.[normalizedQuery];
+    if (cachedCandidates && isFresh(cachedAt, SINGLE_PROJECT_TTL_MS)) {
+      return cachedCandidates;
+    }
+  }
+
+  const candidates = await adapter.searchAssignableUsers(ticketKey, query);
+
+  if (projectKey) {
+    const { assignableUsersByProject, assignableUsersFetchedAt } = mergeAssignableUsers(cached, projectKey, query, candidates);
+    writeMetadataCacheFn(profileName, {
+      projects: cached?.projects ?? [],
+      issueTypesByProject: cached?.issueTypesByProject ?? {},
+      issueTypesFetchedAt: cached?.issueTypesFetchedAt ?? {},
+      projectsFetchedAt: cached?.projectsFetchedAt ?? null,
+      assignableUsersByProject,
+      assignableUsersFetchedAt,
+    }, configDir);
+  }
+
+  return candidates;
+}
+
+/**
+ * `--to=me` self-assigns immediately — unchanged fast path, no discovery,
+ * no confirm. Any other `--to` resolves a real person first (ROADMAP 61):
+ * Jira Cloud only (Server/DC's assignable-user search is unverified —
+ * refuses cleanly rather than guessing), and only executes when exactly
+ * one candidate matches AND --confirm is given, mirroring `transition`'s
+ * list-then-confirm shape — notifying a colleague deserves the same
+ * reviewed-before-write gate as a workflow-state change.
  *
- * @param {string[]} cmdArgs - [ticketKey, '--to=me']
+ * @param {string[]} cmdArgs - [ticketKey, '--to=me'] or [ticketKey, '--to=...', '--confirm']
+ * @param {boolean} [cliHints] - see runTicketTransitionList's cliHints doc
  * @returns {Promise<{ ok: boolean }>}
  */
 export async function runTicketAssign(cmdArgs, {
@@ -454,17 +510,89 @@ export async function runTicketAssign(cmdArgs, {
   checkCooldownFn = checkCooldown,
   recordActionFn = recordAction,
   logActionFn = logAction,
+  readMetadataCacheFn = readMetadataCache,
+  writeMetadataCacheFn = writeMetadataCache,
   actor = os.userInfo().username,
+  cliHints = true,
 } = {}) {
-  const usage = 'Usage: ticketlens assign TICKET-KEY --to=me\n';
+  const usage = cliHints
+    ? 'Usage: ticketlens assign TICKET-KEY --to=me | --to="name or email" --confirm\n'
+    : 'Usage: assign requires ticket and to; a to other than "me" also needs confirm: true to execute.\n';
   if (!requireLicense(isLicensedFn, configDir, 'ticketlens assign', stream)) return { ok: false };
 
   const ticketKey = requireTicketKey(cmdArgs, usage, stream);
   if (!ticketKey) return { ok: false };
 
   const to = parseFlag(cmdArgs, 'to');
-  if (to !== 'me') {
-    stream.write(to ? `  --to="${to}" is not yet supported — only --to=me (self-assign) is available.\n` : usage);
+  if (!to) {
+    stream.write(usage);
+    return { ok: false };
+  }
+
+  if (to === 'me') {
+    const cooldown = checkCooldownFn(ticketKey, 'assign', { configDir });
+    if (cooldown.active) {
+      stream.write(`  Skipped — ${ticketKey} was already assigned ${Math.ceil(cooldown.remainingMs / 1000)}s ago. Wait a moment before retrying.\n`);
+      return { ok: false };
+    }
+
+    const resolved = resolveTicketAdapter(ticketKey, cmdArgs, { configDir, resolveConnectionFn, resolveAdapterFn, stream });
+    if (!resolved) return { ok: false };
+    const { adapter } = resolved;
+
+    try {
+      const result = await adapter.assignToSelf(ticketKey);
+      recordActionFn(ticketKey, 'assign', { configDir });
+      logActionFn({ ticketKey, action: 'assign', actor, tracker: adapter.type, detail: { assignee: result.assignee } }, { configDir });
+      const s = createStyler({ isTTY: stream.isTTY });
+      stream.write(`  ${s.green('✔')} ${s.brand(s.bold(ticketKey))} assigned to ${s.bold(result.assignee)}.\n`);
+      return { ok: true };
+    } catch (err) {
+      stream.write(formatWriteFailure(ticketKey, err));
+      return { ok: false };
+    }
+  }
+
+  const resolved = resolveTicketAdapter(ticketKey, cmdArgs, { configDir, resolveConnectionFn, resolveAdapterFn, stream });
+  if (!resolved) return { ok: false };
+  const { adapter, conn } = resolved;
+
+  if (adapter.type !== 'jira') {
+    stream.write(`  Assigning to another developer is Jira-only right now — ${adapter.type} is not supported.\n`);
+    return { ok: false };
+  }
+  if (conn.auth !== 'cloud') {
+    stream.write('  Assigning to another developer needs Jira Cloud — Server/DC is not supported yet.\n');
+    return { ok: false };
+  }
+
+  const s = createStyler({ isTTY: stream.isTTY });
+  let candidates;
+  try {
+    candidates = await resolveAssigneeCandidates(adapter, ticketKey, to, { profileName: conn.profileName, configDir, readMetadataCacheFn, writeMetadataCacheFn });
+  } catch (err) {
+    stream.write(formatWriteFailure(ticketKey, err));
+    return { ok: false };
+  }
+
+  if (candidates.length === 0) {
+    stream.write(`  No assignable user found matching "${to}" for ${s.brand(s.bold(ticketKey))}.\n`);
+    return { ok: false };
+  }
+
+  if (candidates.length > 1) {
+    stream.write(`  ${candidates.length} users match "${to}" — narrow the query:\n\n`);
+    for (const c of candidates) stream.write(`    ${s.brand('●')} ${c.displayName}  ${s.dim(c.accountId)}\n`);
+    return { ok: false };
+  }
+
+  const [candidate] = candidates;
+
+  if (!cmdArgs.includes('--confirm')) {
+    stream.write(`  Match: ${s.bold(candidate.displayName)}  ${s.dim(candidate.accountId)}\n`);
+    stream.write(cliHints
+      ? `\n  Run again with --to="${to}" --confirm to execute.\n`
+      : `\n  Call again with to="${to}" and confirm: true to execute.\n`);
     return { ok: false };
   }
 
@@ -474,16 +602,11 @@ export async function runTicketAssign(cmdArgs, {
     return { ok: false };
   }
 
-  const resolved = resolveTicketAdapter(ticketKey, cmdArgs, { configDir, resolveConnectionFn, resolveAdapterFn, stream });
-  if (!resolved) return { ok: false };
-  const { adapter } = resolved;
-
   try {
-    const result = await adapter.assignToSelf(ticketKey);
+    await adapter.assignToUser(ticketKey, candidate.accountId);
     recordActionFn(ticketKey, 'assign', { configDir });
-    logActionFn({ ticketKey, action: 'assign', actor, tracker: adapter.type, detail: { assignee: result.assignee } }, { configDir });
-    const s = createStyler({ isTTY: stream.isTTY });
-    stream.write(`  ${s.green('✔')} ${s.brand(s.bold(ticketKey))} assigned to ${s.bold(result.assignee)}.\n`);
+    logActionFn({ ticketKey, action: 'assign', actor, tracker: adapter.type, detail: { assignee: candidate.displayName, accountId: candidate.accountId } }, { configDir });
+    stream.write(`  ${s.green('✔')} ${s.brand(s.bold(ticketKey))} assigned to ${s.bold(candidate.displayName)}.\n`);
     return { ok: true };
   } catch (err) {
     stream.write(formatWriteFailure(ticketKey, err));

package/skills/jtb/scripts/lib/ticket-metadata-cache.mjs

@@ -21,7 +21,17 @@
  *   projects: [{key, name}],
  *   issueTypesByProject:  {KEY: [{id, name}]},
  *   issueTypesFetchedAt:  {KEY: iso timestamp}  // per-project, either access pattern
+ *   assignableUsersByProject:  {KEY: {normalizedQuery: [{accountId, displayName}]}},
+ *   assignableUsersFetchedAt:  {KEY: {normalizedQuery: iso timestamp}}
  * }
+ *
+ * assignableUsersByProject/assignableUsersFetchedAt (ROADMAP 61) share this
+ * file rather than a new one — same profile-scoped Jira-lookup cache, same
+ * 3-day freshness bar as a single-project issue-types lookup. Nested one
+ * level deeper than issueTypesByProject because Jira's own
+ * `user/assignable/search` has no "list everyone" mode (query is required
+ * unless accountId is given) — there is no per-project roster to cache,
+ * only per-(project, query) result pages, each with its own clock.
  */
 
 import fs from 'node:fs';
@@ -62,6 +72,39 @@ export function mergeProjectIssueTypes(cached, projectKey, types, fetchedAt = ne
   return { issueTypesByProject, issueTypesFetchedAt };
 }
 
+/**
+ * Trim + lowercase — the one normalization every assignable-users cache
+ * read and write must agree on, so "Jane", " jane ", and "JANE" share one
+ * cache entry instead of three.
+ */
+export function normalizeAssigneeQuery(query) {
+  return String(query).trim().toLowerCase();
+}
+
+/**
+ * Merges one (project, query) assignable-users search result into an
+ * existing (possibly null) cached map — same shape and same
+ * Object.create(null) defense as mergeProjectIssueTypes, one level deeper
+ * since a project can have many independently-fresh cached queries. Both
+ * projectKey and the normalized query are unvalidated values reaching a
+ * key position.
+ */
+export function mergeAssignableUsers(cached, projectKey, query, candidates, fetchedAt = new Date().toISOString()) {
+  const normalizedQuery = normalizeAssigneeQuery(query);
+
+  const assignableUsersByProject = Object.assign(Object.create(null), cached?.assignableUsersByProject ?? {});
+  const projectQueries = Object.assign(Object.create(null), assignableUsersByProject[projectKey] ?? {});
+  projectQueries[normalizedQuery] = candidates;
+  assignableUsersByProject[projectKey] = projectQueries;
+
+  const assignableUsersFetchedAt = Object.assign(Object.create(null), cached?.assignableUsersFetchedAt ?? {});
+  const projectQueryTimestamps = Object.assign(Object.create(null), assignableUsersFetchedAt[projectKey] ?? {});
+  projectQueryTimestamps[normalizedQuery] = fetchedAt;
+  assignableUsersFetchedAt[projectKey] = projectQueryTimestamps;
+
+  return { assignableUsersByProject, assignableUsersFetchedAt };
+}
+
 /**
  * Returns the absolute path to the ticket-metadata cache file for a profile.
  */
@@ -84,7 +127,7 @@ export function metadataCachePath(profileName, configDir = DEFAULT_CONFIG_DIR) {
  * @param {string|null} profileName
  * @param {string} [configDir]
  * @param {number} [ttlMs] - override TTL in ms for this file's own GC deletion; defaults to METADATA_TTL_MS (7d)
- * @returns {{ projects: {key:string,name:string}[], issueTypesByProject: object, issueTypesFetchedAt: object, projectsFetchedAt: string|null, fetchedAt: string } | null}
+ * @returns {{ projects: {key:string,name:string}[], issueTypesByProject: object, issueTypesFetchedAt: object, assignableUsersByProject: object, assignableUsersFetchedAt: object, projectsFetchedAt: string|null, fetchedAt: string } | null}
  */
 export function readMetadataCache(profileName, configDir = DEFAULT_CONFIG_DIR, ttlMs = METADATA_TTL_MS) {
   const filePath = metadataCachePath(profileName, configDir);
@@ -107,6 +150,8 @@ export function readMetadataCache(profileName, configDir = DEFAULT_CONFIG_DIR, t
     projects: data.projects ?? [],
     issueTypesByProject: data.issueTypesByProject ?? {},
     issueTypesFetchedAt: data.issueTypesFetchedAt ?? {},
+    assignableUsersByProject: data.assignableUsersByProject ?? {},
+    assignableUsersFetchedAt: data.assignableUsersFetchedAt ?? {},
     projectsFetchedAt: data.projectsFetchedAt ?? null,
     fetchedAt: data.fetchedAt,
   };
@@ -119,7 +164,7 @@ export function readMetadataCache(profileName, configDir = DEFAULT_CONFIG_DIR, t
  * updates (e.g. a single-project fetch merging into an existing
  * multi-project cache) — this function persists exactly what it's given.
  */
-export function writeMetadataCache(profileName, { projects = [], issueTypesByProject = {}, issueTypesFetchedAt = {}, projectsFetchedAt = null } = {}, configDir = DEFAULT_CONFIG_DIR) {
+export function writeMetadataCache(profileName, { projects = [], issueTypesByProject = {}, issueTypesFetchedAt = {}, assignableUsersByProject = {}, assignableUsersFetchedAt = {}, projectsFetchedAt = null } = {}, configDir = DEFAULT_CONFIG_DIR) {
   const filePath = metadataCachePath(profileName, configDir);
   try {
     fs.mkdirSync(path.dirname(filePath), { recursive: true });
@@ -129,6 +174,8 @@ export function writeMetadataCache(profileName, { projects = [], issueTypesByPro
       projects,
       issueTypesByProject,
       issueTypesFetchedAt,
+      assignableUsersByProject,
+      assignableUsersFetchedAt,
     }));
   } catch {
     // Non-fatal