ticketlens 0.9.17 → 0.10.0

package/bin/ticketlens.mjs

@@ -36,6 +36,7 @@ import { promptSecret, promptText } from '../skills/jtb/scripts/lib/prompt-helpe
 import { checkForUpdate, getUpdateHint } from '../skills/jtb/scripts/lib/update-check.mjs';
 import { incrementInvocation, incrementCommand } from '../skills/jtb/scripts/lib/activity-counter.mjs';
 import { DEFAULT_CONFIG_DIR } from '../skills/jtb/scripts/lib/config.mjs';
+import { applyTeamConfigOnLogin, checkTeamJiraConfigUpdate } from '../skills/jtb/scripts/lib/team-jira-sync.mjs';
 
 const TRACKED_COMMANDS = new Set([
   'triage', 'fetch', 'get', 'compliance', 'review', 'standup',
@@ -72,12 +73,24 @@ process.on('exit', () => {
 });
 
 switch (command) {
-  case 'fetch':
-    runFetch(cmdArgs).catch(err => {
+  case 'fetch': {
+    // Flow 2: fire team config check concurrently; banner shown after brief output
+    const _teamCheck = checkTeamJiraConfigUpdate().catch(() => null);
+    runFetch(cmdArgs).then(async () => {
+      const tcResult = await _teamCheck;
+      if (tcResult?.banner) {
+        const s = createStyler({ isTTY: process.stderr.isTTY });
+        process.stderr.write(`\n  ${s.yellow('!')} ${tcResult.banner}\n`);
+      } else if (tcResult?.deleted) {
+        const s = createStyler({ isTTY: process.stderr.isTTY });
+        process.stderr.write(`\n  ${s.yellow('!')} Team Jira config removed by manager — using local credentials.\n`);
+      }
+    }).catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
       process.exitCode = 1;
     });
     break;
+  }
 
   case 'triage':
     runTriage(cmdArgs).catch(err => {
@@ -481,6 +494,13 @@ switch (command) {
 
       saveCliToken(token);
       process.stderr.write(`\x1b[A\r\x1b[2K  ${s.green('✔')} Logged in.\n`);
+
+      // Flow 1: pull team Jira config for Pro/Team members (silently skipped for Free)
+      const tcLogin = await applyTeamConfigOnLogin().catch(() => null);
+      if (tcLogin?.ok) {
+        process.stderr.write(`  ${s.dim(`○ Team Jira config applied for ${s.cyan(tcLogin.groupName)}.`)}\n`);
+      }
+
       process.stderr.write(`\n  Run ${s.cyan('ticketlens sync')} to pull your connections.\n\n`);
     })().catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);
@@ -541,6 +561,14 @@ switch (command) {
         }
       }
 
+      // Flow 3: also pull team Jira config update (Pro/Team); silently skipped for Free
+      const tcSync = await checkTeamJiraConfigUpdate().catch(() => null);
+      if (tcSync?.banner) {
+        process.stderr.write(`\n  ${s.yellow('!')} ${tcSync.banner}\n`);
+      } else if (tcSync?.deleted) {
+        process.stderr.write(`\n  ${s.yellow('!')} Team Jira config removed by manager — using local credentials.\n`);
+      }
+
       process.stderr.write('\n');
     })().catch(err => {
       process.stderr.write(`Error: ${err.message}\n`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ticketlens",
-  "version": "0.9.17",
+  "version": "0.10.0",
   "description": "Jira CLI for developers — fetch ticket context, triage your queue, and stop tab-switching. Zero dependencies, all local.",
   "type": "module",
   "bin": {

package/skills/jtb/SKILL.md

@@ -1,4 +1,4 @@
-<!-- jtb-skill-version: 0.9.16 -->
+<!-- jtb-skill-version: 0.10.0 -->
 ---
 name: jtb
 description: Fetch a Jira ticket's full context (description, comments, linked issues, code references) and assemble a structured TicketBrief for implementation planning. Use when user types /jtb, mentions a Jira ticket key, or wants to plan work from a Jira ticket.
@@ -297,3 +297,14 @@ Forces a fresh fetch from Jira, bypassing the local brief cache (4-hour TTL by d
 ### --no-attachments
 
 Skip downloading and reading ticket attachments. Speeds up the fetch for tickets with large or irrelevant file attachments.
+
+### Team Jira config auto-sync (Pro/Team)
+
+Pro and Team members whose manager has configured a shared Jira profile in the Console (`/console/admin/jira`) receive the config automatically — no manual setup needed.
+
+- **On `ticketlens login`:** team config is fetched and written to the local profile immediately after authentication.
+- **On every fetch (including `/jtb TICKET-KEY`):** the CLI silently checks whether the team config has been updated since last sync. If it has, the new config is applied and a banner is printed to stderr after the brief — e.g. `! Team Jira config updated by your manager.`
+- **On `ticketlens sync`:** explicitly force-pulls the latest team config.
+- **If the team config is removed by the manager:** the CLI retains local credentials and shows a `! Team Jira config removed by manager — using local credentials.` banner.
+
+This is background behaviour — no action needed from you as an AI assistant. The banner may appear in CLI output; it is informational only.

package/skills/jtb/scripts/lib/browser-login.mjs

@@ -3,6 +3,7 @@ import { randomBytes }       from 'node:crypto';
 import { spawn }             from 'node:child_process';
 import { hostname as osHostname } from 'node:os';
 import { getConsoleBase }    from './sync.mjs';
+import { readLicense }       from './license.mjs';
 
 const PORT_MIN    = 49152;
 const PORT_MAX    = 65535;
@@ -102,20 +103,35 @@ export function startLocalServer(port, expectedState, timeoutMs = TIMEOUT_MS) {
 /**
  * Full browser login flow. Opens the authorize page in the default browser,
  * waits for the callback, and returns the plaintext CLI token.
+ *
+ * @param {object}   [opts]
+ * @param {Function} [opts.readLicenseFn]  - Injectable license reader (default: readLicense)
+ * @param {Function} [opts.openBrowserFn]  - Injectable browser opener (default: openBrowser)
+ * @param {Function} [opts.startServerFn]  - Injectable local server (default: startLocalServer)
  */
-export async function browserLogin() {
+export async function browserLogin({
+  readLicenseFn = () => { try { return readLicense(); } catch { return null; } },
+  openBrowserFn = openBrowser,
+  startServerFn = (port, state) => startLocalServer(port, state),
+} = {}) {
   const state    = generateState();
   const port     = pickPort();
   const hostname = osHostname();
 
   const consoleBase = getConsoleBase();
-  const url = `${consoleBase}/console/auth/cli`
+  let url = `${consoleBase}/console/auth/cli`
     + `?port=${port}`
     + `&state=${encodeURIComponent(state)}`
-    + `&hostname=${encodeURIComponent(hostname)}`;
+    + `&hostname=${encodeURIComponent(hostname)}`
+    + `&fresh=1`;
 
-  const tokenPromise = startLocalServer(port, state);
-  openBrowser(url);
+  const license = readLicenseFn();
+  if (license?.email) {
+    url += `&email=${encodeURIComponent(license.email)}`;
+  }
+
+  const tokenPromise = startServerFn(port, state);
+  openBrowserFn(url);
 
   return tokenPromise;
 }

package/skills/jtb/scripts/lib/run-collisions.mjs

@@ -2,7 +2,7 @@ import { readCliToken } from './cli-auth.mjs';
 import { formatCollisions } from './collision-reporter.mjs';
 import { DEFAULT_CONFIG_DIR } from './config.mjs';
 import { apiBase, warnIfInsecure } from './api-utils.mjs';
-import { red, yellow, bold, cyan } from './ansi.mjs';
+import { red, yellow, bold, cyan, dim } from './ansi.mjs';
 
 const COLLISIONS_PATH = '/v1/triage/collisions';
 
@@ -41,11 +41,11 @@ export async function runCollisions(args = [], opts = {}) {
 
     if (!res.ok) {
       if (res.status === 401) {
-        print(`  ${red('✗')} Session expired. Run ${cyan('ticketlens login')} to reconnect.\n`);
+        print(`  ${red('✗')} Session expired — run ${cyan('ticketlens login')} to reconnect.\n\n`);
         return { ok: false, status: 401 };
       }
       if (res.status === 403) {
-        print(`  ${red('✗')} ${bold('collisions')} requires a Team license\n`);
+        print(`  ${red('✗')} ${bold('collisions')} requires a Team license.\n  ${dim('→ Log in with a team account:')} ${cyan('ticketlens login')}\n\n`);
         return { ok: false, status: 403 };
       }
       print(`  ${yellow('⚠')} Failed to fetch collisions (${res.status})\n`);

package/skills/jtb/scripts/lib/schedule-wizard.mjs

@@ -107,7 +107,7 @@ export async function runScheduleWizard({
 
     if (!res.ok) {
       if (res.status === 401) {
-        print(`  ${red('✗')} Session expired. Run ${cyan('ticketlens login')} to reconnect.\n`);
+        print(`  ${red('✗')} Session expired — run ${cyan('ticketlens login')} to reconnect.\n\n`);
         return { ok: false, status: 401 };
       }
       if (res.status === 403) {

package/skills/jtb/scripts/lib/team-jira-sync.mjs

@@ -0,0 +1,185 @@
+/**
+ * Fetches and applies the team Jira config shared by the manager.
+ * Non-secret fields only (URL, auth type, prefixes, project paths, triage statuses).
+ * Each member stores their own Jira credentials locally.
+ */
+
+import { writeFileSync, readFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { readCliToken } from './cli-auth.mjs';
+import { saveProfile, loadProfiles } from './profile-resolver.mjs';
+import { apiBase } from './api-utils.mjs';
+import { DEFAULT_CONFIG_DIR } from './config.mjs';
+
+const META_FILE = 'team-jira-meta.json';
+
+function metaPath(configDir) {
+  return join(configDir, META_FILE);
+}
+
+function readMeta(configDir) {
+  const p = metaPath(configDir);
+  if (!existsSync(p)) return null;
+  try {
+    return JSON.parse(readFileSync(p, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function writeMeta(configDir, data) {
+  writeFileSync(metaPath(configDir), JSON.stringify(data, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
+}
+
+/**
+ * Fetches GET /v1/team/config from the API.
+ *
+ * @param {object} opts
+ * @param {string} [opts.configDir]
+ * @param {Function} [opts.fetcher] - injectable fetch for testing
+ * @returns {Promise<{error: string, [key: string]: any} | object>}
+ */
+export async function fetchTeamJiraConfig({ configDir = DEFAULT_CONFIG_DIR, fetcher = fetch } = {}) {
+  const token = readCliToken(configDir);
+  if (!token) return { error: 'no-token' };
+
+  const url = `${apiBase()}/v1/team/config`;
+  let res;
+  try {
+    res = await fetcher(url, {
+      headers: { Authorization: `Bearer ${token}`, Accept: 'application/json' },
+      signal: AbortSignal.timeout(10000),
+    });
+  } catch (e) {
+    return { error: 'network', message: e.message };
+  }
+
+  if (res.status === 403) return { error: 'http-403' };
+  if (res.status === 404) return { error: 'http-404' };
+  if (!res.ok) return { error: `http-${res.status}` };
+
+  try {
+    return await res.json();
+  } catch (e) {
+    return { error: 'parse', message: e.message };
+  }
+}
+
+/**
+ * Converts API team config response to a CLI profile data object.
+ */
+function teamConfigToCliProfile(apiData) {
+  const profile = { baseUrl: apiData.jira_base_url, auth: apiData.auth_type };
+  if (apiData.prefixes?.length)        profile.ticketPrefixes  = apiData.prefixes;
+  if (apiData.project_paths?.length)   profile.projectPaths    = apiData.project_paths;
+  if (apiData.triage_statuses?.length) profile.triageStatuses  = apiData.triage_statuses;
+  return profile;
+}
+
+/**
+ * Writes team config to the named profile without touching credentials.
+ * Returns { error, message } on failure — never throws.
+ */
+async function applyTeamJiraConfig(groupName, profileData, configDir) {
+  try {
+    await saveProfile(groupName, profileData, null, configDir);
+    return { ok: true };
+  } catch (e) {
+    return { error: 'save-failed', message: e.message };
+  }
+}
+
+/**
+ * Silently checks whether the team Jira config has changed since last fetch.
+ * Applies the new config and returns a banner string if changed.
+ * Never throws — always returns an object.
+ *
+ * @param {object} opts
+ * @param {string} [opts.configDir]
+ * @param {Function} [opts.fetcher]
+ * @returns {Promise<{updated: boolean, deleted?: boolean, banner?: string, error?: string}>}
+ */
+export async function checkTeamJiraConfigUpdate({ configDir = DEFAULT_CONFIG_DIR, fetcher = fetch } = {}) {
+  const apiData = await fetchTeamJiraConfig({ configDir, fetcher });
+
+  if (apiData.error === 'http-403') return { updated: false };
+  if (apiData.error === 'http-404') return { updated: false, deleted: true };
+  if (apiData.error)               return { updated: false, error: apiData.error };
+
+  const meta = readMeta(configDir);
+
+  // No change since last fetch — skip silently
+  if (meta?.updated_at && meta.updated_at === apiData.updated_at) {
+    return { updated: false };
+  }
+
+  const groupName = String(apiData.group_name ?? '').trim().slice(0, 100);
+  if (!groupName || /^(__proto__|constructor|prototype)$/.test(groupName)) {
+    return { updated: false, error: 'invalid-group-name' };
+  }
+  const profileData = teamConfigToCliProfile(apiData);
+  const applied     = await applyTeamJiraConfig(groupName, profileData, configDir);
+
+  if (applied.error) return { updated: false, error: applied.error };
+
+  try {
+    writeMeta(configDir, {
+      group_name:    groupName,
+      updated_at:    apiData.updated_at,
+      jira_base_url: apiData.jira_base_url,
+      auth_type:     apiData.auth_type,
+    });
+  } catch {
+    return { updated: false, error: 'meta-write-failed' };
+  }
+
+  const changedFields = [];
+  if (meta?.jira_base_url && meta.jira_base_url !== apiData.jira_base_url) changedFields.push('Jira URL');
+  if (meta?.auth_type      && meta.auth_type     !== apiData.auth_type)     changedFields.push('auth type');
+
+  const detail = changedFields.length > 0
+    ? ` (${changedFields.join(', ')} changed)`
+    : '';
+
+  const banner = `⚠ Team Jira config updated by manager (${apiData.updated_at})${detail}.`;
+
+  return { updated: true, banner, groupName };
+}
+
+/**
+ * Fetches team Jira config on first login and applies it.
+ * Returns the group name so the caller can prompt for personal credentials.
+ *
+ * @param {object} opts
+ * @param {string} [opts.configDir]
+ * @param {Function} [opts.fetcher]
+ * @returns {Promise<{ok: boolean, groupName?: string, error?: string}>}
+ */
+export async function applyTeamConfigOnLogin({ configDir = DEFAULT_CONFIG_DIR, fetcher = fetch } = {}) {
+  const apiData = await fetchTeamJiraConfig({ configDir, fetcher });
+
+  // Free tier / no token / network error — silently skip (not a blocker for login)
+  if (apiData.error) return { ok: false, error: apiData.error };
+
+  const groupName = String(apiData.group_name ?? '').trim().slice(0, 100);
+  if (!groupName || /^(__proto__|constructor|prototype)$/.test(groupName)) {
+    return { ok: false, error: 'invalid-group-name' };
+  }
+  const profileData = teamConfigToCliProfile(apiData);
+  const applied     = await applyTeamJiraConfig(groupName, profileData, configDir);
+
+  if (applied.error) return { ok: false, error: applied.error };
+
+  try {
+    writeMeta(configDir, {
+      group_name:    groupName,
+      updated_at:    apiData.updated_at,
+      jira_base_url: apiData.jira_base_url,
+      auth_type:     apiData.auth_type,
+    });
+  } catch {
+    return { ok: false, error: 'meta-write-failed' };
+  }
+
+  return { ok: true, groupName, authType: apiData.auth_type };
+}

package/skills/jtb/scripts/lib/triage-push.mjs

@@ -8,7 +8,7 @@ import { isLicensed } from './license.mjs';
 import { DEFAULT_CONFIG_DIR } from './config.mjs';
 import { apiBase, warnIfInsecure } from './api-utils.mjs';
 import { buildTicketPayload } from './ticket-payload.mjs';
-import { red, green, yellow, bold, cyan } from './ansi.mjs';
+import { red, green, yellow, bold, cyan, dim } from './ansi.mjs';
 
 const PUSH_PATH = '/v1/triage/push';
 
@@ -109,12 +109,12 @@ export async function pushTriageSnapshot({
     }
 
     if (res.status === 401) {
-      print(`  ${red('✗')} Session expired. Run ${cyan('ticketlens login')} to reconnect.\n`);
+      print(`  ${red('✗')} Session expired.\n  ${dim('→ Run')} ${cyan('ticketlens login')} ${dim('to reconnect.')}\n\n`);
       return { ok: false, status: res.status };
     }
 
     if (res.status === 403) {
-      print(`  ${red('✗')} ${bold('--push')} requires a Team license\n`);
+      print(`  ${red('✗')} ${bold('--push')} requires a Team license.\n  ${dim('→ Log in with a team account:')} ${cyan('ticketlens login')}\n\n`);
       return { ok: false, status: res.status };
     }
 

package/skills/jtb/scripts/lib/triage-share.mjs

@@ -4,7 +4,7 @@
  */
 
 import { apiBase, warnIfInsecure } from './api-utils.mjs';
-import { red, green, yellow, bold, cyan } from './ansi.mjs';
+import { red, green, yellow, bold, cyan, dim } from './ansi.mjs';
 
 const SHARE_PATH = '/v1/triage/share';
 
@@ -77,12 +77,12 @@ export async function shareTriageSnapshot({
     }
 
     if (res.status === 401) {
-      print(`  ${red('✗')} Session expired. Run ${cyan('ticketlens login')} to reconnect.\n`);
+      print(`  ${red('✗')} Session expired — run ${cyan('ticketlens login')} to reconnect.\n\n`);
       return { ok: false, status: res.status };
     }
 
     if (res.status === 403) {
-      print(`  ${red('✗')} ${bold('--share')} requires a Team license\n`);
+      print(`  ${red('✗')} ${bold('--share')} requires a Team license.\n  ${dim('→ Log in with a team account:')} ${cyan('ticketlens login')}\n\n`);
       return { ok: false, status: res.status };
     }