ticketlens 0.9.7 → 0.9.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ticketlens",
-  "version": "0.9.7",
+  "version": "0.9.9",
   "description": "Jira CLI for developers — fetch ticket context, triage your queue, and stop tab-switching. Zero dependencies, all local.",
   "type": "module",
   "bin": {

package/skills/jtb/SKILL.md

@@ -1,4 +1,4 @@
-<!-- jtb-skill-version: 0.9.7 -->
+<!-- jtb-skill-version: 0.9.9 -->
 ---
 name: jtb
 description: Fetch a Jira ticket's full context (description, comments, linked issues, code references) and assemble a structured TicketBrief for implementation planning. Use when user types /jtb, mentions a Jira ticket key, or wants to plan work from a Jira ticket.

package/skills/jtb/scripts/lib/api-utils.mjs

@@ -3,7 +3,7 @@
  * Centralised here to avoid triplicating the regex and warning logic.
  */
 
-export const DEFAULT_API_BASE = 'http://api.ticketlens.test';
+export const DEFAULT_API_BASE = 'https://api.ticketlens.app';
 
 // Matches localhost, 127.0.0.1, and any hostname ending in .test or .local,
 // with an optional port — all treated as local-only addresses.

package/skills/jtb/scripts/lib/attachment-downloader.mjs

@@ -83,7 +83,8 @@ export async function downloadAttachments(ticket, opts = {}) {
       onProgress?.(`  download  ${a.filename}`);
       try {
         const headers = buildAuthHeader(env);
-        const response = await fetcher(a.content, { headers });
+        // redirect:'error' prevents a Jira redirect from leaking auth headers to a different origin.
+        const response = await fetcher(a.content, { headers, redirect: 'error' });
         if (!response.ok) throw new Error(`HTTP ${response.status} (${response.statusText})`);
         const buffer = await response.arrayBuffer();
         fs.writeFileSync(localPath, Buffer.from(buffer));

package/skills/jtb/scripts/lib/brief-cache.mjs

@@ -19,7 +19,14 @@ export const DEFAULT_BRIEF_TTL = '4h'; // human-readable default for display/con
 export function briefCachePath(ticketKey, profileName, configDir = DEFAULT_CONFIG_DIR) {
   const safeProfile = (profileName || '_default').replace(/[^a-zA-Z0-9_\-]/g, '_');
   const safeKey = ticketKey.replace(/[^a-zA-Z0-9_\-]/g, '_');
-  return path.join(configDir, 'cache', safeProfile, safeKey, 'brief.json');
+  const resolvedDir = path.resolve(configDir);
+  const result = path.join(resolvedDir, 'cache', safeProfile, safeKey, 'brief.json');
+  // Defense-in-depth: ensure the final path cannot escape the config directory,
+  // even if configDir itself is manipulated or the sanitization above is weakened.
+  if (!result.startsWith(resolvedDir + path.sep)) {
+    throw new Error(`Cache path escapes config directory: ${result}`);
+  }
+  return result;
 }
 
 /**

package/skills/jtb/scripts/lib/help.mjs

@@ -24,8 +24,11 @@ export function printHelp({ stream = process.stdout } = {}) {
     '',
     `  ${s.bold('USAGE')}`,
     '',
-    // visible widths — target column = 36 visible chars for the command portion
-    // Groups: Console sync ─── Setup ─── Daily use ─── Account / Maintenance
+    // Alignment targets (visible chars before description):
+    //   Groups 1–2 (auth/setup):          column 40  (command portion ≤ 24)
+    //   Group 3 (daily use):              column 42  (longest: "review [--branch=BRANCH]" = 39)
+    //   Group 4 (account/maintenance):    column 43  (longest: "schedule [--stop|--status]" = 41)
+    //   cloud-keys [add|remove|list|test] is an outlier at column 50 — kept with 2-space minimum.
     `    ${s.brand('ticketlens')} login                    Connect CLI to your TicketLens account`,
     `    ${s.brand('ticketlens')} logout                   Remove stored credentials`,
     `    ${s.brand('ticketlens')} sync                     Pull tracker profiles from the console`,
@@ -35,9 +38,9 @@ export function printHelp({ stream = process.stdout } = {}) {
     `    ${s.brand('ticketlens')} config ${s.dim('[--profile=NAME]')}  Edit profile settings`,
     `    ${s.brand('ticketlens')} profiles                 List all configured profiles  ${s.dim('(alias: ls)')}`,
     '',
-    `    ${s.brand('ticketlens')} ${s.dim('<TICKET-KEY>')} ${s.dim('[options]')}   Fetch a ticket brief`,
-    `    ${s.brand('ticketlens')} get ${s.dim('<TICKET-KEY>')}         Same as above ${s.dim('(explicit alias)')}`,
-    `    ${s.brand('ticketlens')} triage ${s.dim('[options]')}         Scan your assigned tickets`,
+    `    ${s.brand('ticketlens')} ${s.dim('<TICKET-KEY>')} ${s.dim('[options]')}     Fetch a ticket brief`,
+    `    ${s.brand('ticketlens')} get ${s.dim('<TICKET-KEY>')}           Same as above ${s.dim('(explicit alias)')}`,
+    `    ${s.brand('ticketlens')} triage ${s.dim('[options]')}           Scan your assigned tickets`,
     `    ${s.brand('ticketlens')} collisions ${s.dim('[--json]')}        Show branch collisions with teammates  ${s.dim('[Team]')}`,
     `    ${s.brand('ticketlens')} review ${s.dim('[--branch=BRANCH]')}   Code-review context brief from current branch`,
     `    ${s.brand('ticketlens')} standup ${s.dim('[--since=N]')}        Standup summary from git log  ${s.dim('(last 24h by default)')}`,
@@ -45,11 +48,11 @@ export function printHelp({ stream = process.stdout } = {}) {
     `    ${s.brand('ticketlens')} history ${s.dim('<TICKET-KEY>')}       Urgency timeline for a ticket  ${s.dim('[Pro]')}`,
     `    ${s.brand('ticketlens')} stats ${s.dim('[options]')}            Personal response-time metrics from local history`,
     '',
-    `    ${s.brand('ticketlens')} delete ${s.dim('<PROFILE-NAME>')}     Remove a profile`,
-    `    ${s.brand('ticketlens')} activate ${s.dim('<KEY>')}           Activate a license key`,
-    `    ${s.brand('ticketlens')} license                  Show license status`,
-    `    ${s.brand('ticketlens')} cache ${s.dim('[size|clear]')}       Manage attachment cache  ${s.dim('(try cache --help)')}`,
-    `    ${s.brand('ticketlens')} schedule ${s.dim('[--stop|--status]')} Manage digest schedule  ${s.dim('[Pro]')}`,
+    `    ${s.brand('ticketlens')} delete ${s.dim('<PROFILE-NAME>')}       Remove a profile`,
+    `    ${s.brand('ticketlens')} activate ${s.dim('<KEY>')}              Activate a license key`,
+    `    ${s.brand('ticketlens')} license                     Show license status`,
+    `    ${s.brand('ticketlens')} cache ${s.dim('[size|clear]')}          Manage attachment cache  ${s.dim('(try cache --help)')}`,
+    `    ${s.brand('ticketlens')} schedule ${s.dim('[--stop|--status]')}  Manage digest schedule  ${s.dim('[Pro]')}`,
     `    ${s.brand('ticketlens')} cloud-keys ${s.dim('[add|remove|list|test]')}  Manage your encrypted AI provider keys  ${s.dim('[Pro]')}`,
     `    ${s.brand('ticketlens')} update-skill ${s.dim('[--dry-run]')}    Update /jtb skill in Claude Code and other AI assistants`,
     '',

package/skills/jtb/scripts/lib/jira-client.mjs

@@ -81,6 +81,35 @@ export function normalizeTicket(raw) {
   };
 }
 
+// RFC-1918 + link-local + loopback + localhost blocked to prevent SSRF.
+const BLOCKED_PATTERNS = [
+  /^127\./,
+  /^10\./,
+  /^172\.(1[6-9]|2\d|3[01])\./,
+  /^192\.168\./,
+  /^169\.254\./,
+  /^0\.0\.0\.0$/,
+  /^::1$/,
+  /^::ffff:/i,
+  /^fc00:/i,
+  /^fe80:/i,
+  /^localhost$/i,
+];
+
+export function validateBaseUrl(url) {
+  let parsed;
+  try { parsed = new URL(url); } catch {
+    throw new Error(`JIRA_BASE_URL is not a valid URL: ${url}`);
+  }
+  if (parsed.protocol !== 'https:') {
+    throw new Error(`JIRA_BASE_URL must use HTTPS (got ${parsed.protocol})`);
+  }
+  const hostname = parsed.hostname.replace(/^\[|\]$/g, '');
+  if (BLOCKED_PATTERNS.some(re => re.test(hostname))) {
+    throw new Error(`JIRA_BASE_URL hostname is blocked (${hostname})`);
+  }
+}
+
 export function buildAuthHeader(env) {
   if (env.JIRA_PAT) {
     return { Authorization: `Bearer ${env.JIRA_PAT}` };
@@ -91,6 +120,7 @@ export function buildAuthHeader(env) {
 
 export async function fetchCurrentUser(opts = {}) {
   const { env = process.env, fetcher = globalThis.fetch, apiVersion = 2, timeoutMs = 10_000 } = opts;
+  validateBaseUrl(env.JIRA_BASE_URL);
   const baseUrl = env.JIRA_BASE_URL.replace(/\/$/, '');
   const headers = { ...buildAuthHeader(env), 'Content-Type': 'application/json' };
 
@@ -116,6 +146,7 @@ export async function fetchCurrentUser(opts = {}) {
 
 export async function fetchStatuses(opts = {}) {
   const { env = process.env, fetcher = globalThis.fetch, apiVersion = 2, timeoutMs = 10_000 } = opts;
+  validateBaseUrl(env.JIRA_BASE_URL);
   const baseUrl = env.JIRA_BASE_URL.replace(/\/$/, '');
   const headers = { ...buildAuthHeader(env), 'Content-Type': 'application/json' };
 
@@ -136,6 +167,7 @@ export async function fetchStatuses(opts = {}) {
 
 export async function searchTickets(jql, opts = {}) {
   const { env = process.env, fetcher = globalThis.fetch, maxResults = 50, apiVersion = 2, timeoutMs = 10_000, expandChangelog = false } = opts;
+  validateBaseUrl(env.JIRA_BASE_URL);
   const baseUrl = env.JIRA_BASE_URL.replace(/\/$/, '');
   const headers = { ...buildAuthHeader(env), 'Content-Type': 'application/json' };
 
@@ -163,6 +195,7 @@ export async function searchTickets(jql, opts = {}) {
 
 export async function fetchRemoteLinks(ticketKey, opts = {}) {
   const { env = process.env, fetcher = globalThis.fetch, apiVersion = 2, timeoutMs = 10_000 } = opts;
+  validateBaseUrl(env.JIRA_BASE_URL);
   const baseUrl = env.JIRA_BASE_URL.replace(/\/$/, '');
   const url = `${baseUrl}/rest/api/${apiVersion}/issue/${encodeURIComponent(ticketKey)}/remotelink`;
 
@@ -180,6 +213,7 @@ export async function fetchRemoteLinks(ticketKey, opts = {}) {
 
 export async function fetchTicket(ticketKey, opts = {}) {
   const { env = process.env, fetcher = globalThis.fetch, depth = 1, apiVersion = 2, timeoutMs = 10_000, expandChangelog = false, _visited = new Set(), _currentDepth = 0 } = opts;
+  validateBaseUrl(env.JIRA_BASE_URL);
   const baseUrl = env.JIRA_BASE_URL.replace(/\/$/, '');
   const headers = { ...buildAuthHeader(env), 'Content-Type': 'application/json' };