ticketlens 0.9.11 → 0.9.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ticketlens",
-  "version": "0.9.11",
+  "version": "0.9.13",
   "description": "Jira CLI for developers — fetch ticket context, triage your queue, and stop tab-switching. Zero dependencies, all local.",
   "type": "module",
   "bin": {

package/skills/jtb/scripts/fetch-ticket.mjs

@@ -552,6 +552,7 @@ export async function run(args, envOrOpts = process.env, fetcher = globalThis.fe
     const complianceRunner = opts.runComplianceCheck ?? runComplianceCheck;
     const complianceResult = await complianceRunner({
       brief: briefC,
+      description: ticketC.description,
       ticketKey: ticketKeyArg,
       configDir: resolvedConfigDir,
     });
@@ -1041,6 +1042,7 @@ export async function run(args, envOrOpts = process.env, fetcher = globalThis.fe
       if (args.includes('--compliance')) {
         const checkResult = await runComplianceCheck({
           brief,
+          description: cached.ticket.description,
           ticketKey,
           configDir,
         });
@@ -1227,6 +1229,7 @@ export async function run(args, envOrOpts = process.env, fetcher = globalThis.fe
   if (args.includes('--compliance')) {
     const checkResult = await runComplianceCheck({
       brief: output,
+      description: ticket.description,
       ticketKey,
       configDir,
     });

package/skills/jtb/scripts/lib/attachment-downloader.mjs

@@ -83,19 +83,10 @@ export async function downloadAttachments(ticket, opts = {}) {
       onProgress?.(`  download  ${a.filename}`);
       try {
         const headers = buildAuthHeader(env);
-        let response;
-        try {
-          // Prefer no-redirect so auth headers stay on the Jira origin.
-          response = await fetcher(a.content, { headers, redirect: 'error' });
-        } catch (err) {
-          // Jira Cloud attachment URLs sometimes redirect to CDN/S3 presigned URLs.
-          // On redirect, retry without auth — the presigned URL provides its own authentication.
-          if (err?.cause?.message?.includes('redirect mode is set to error')) {
-            response = await fetcher(a.content, { redirect: 'follow' });
-          } else {
-            throw err;
-          }
-        }
+        // Default redirect:'follow' — Jira Cloud attachment URLs may redirect to CDN/S3
+        // presigned URLs. The SSRF guard above already validates the initial URL is on
+        // the configured Jira origin, which is the relevant security boundary here.
+        const response = await fetcher(a.content, { headers });
         if (!response.ok) throw new Error(`HTTP ${response.status} (${response.statusText})`);
         const buffer = await response.arrayBuffer();
         fs.writeFileSync(localPath, Buffer.from(buffer));

package/skills/jtb/scripts/lib/compliance-checker.mjs

@@ -29,6 +29,7 @@ function formatReport({ ticketKey, requirements, analysis, usage, isPro }) {
     const icon = STATUS_ICON[status] ?? '?';
     lines.push(`  ${icon} ${requirement}`);
     if (evidence) lines.push(`      └─ ${evidence}`);
+    lines.push('');
   }
 
   lines.push('');
@@ -47,6 +48,7 @@ function formatReport({ ticketKey, requirements, analysis, usage, isPro }) {
 
 export async function runComplianceCheck({
   brief,
+  description = null,
   ticketKey,
   configDir = DEFAULT_CONFIG_DIR,
   stream = process.stderr,
@@ -70,7 +72,9 @@ export async function runComplianceCheck({
 
   incrementUsageFn(configDir);
 
-  const requirements = extractRequirementsFn(brief);
+  // Extract requirements from the ticket description only — not from comments,
+  // linked tickets, or the styled output, which would produce false positives.
+  const requirements = extractRequirementsFn(description ?? brief);
   const { diff } = findLinkedCommitsFn(ticketKey, { cwd: process.cwd() });
   const analysis = analyzeDiffFn(requirements, diff);