ticketlens 0.9.8 → 0.9.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ticketlens",
-  "version": "0.9.8",
+  "version": "0.9.10",
   "description": "Jira CLI for developers — fetch ticket context, triage your queue, and stop tab-switching. Zero dependencies, all local.",
   "type": "module",
   "bin": {

package/skills/jtb/SKILL.md

@@ -1,4 +1,4 @@
-<!-- jtb-skill-version: 0.9.7 -->
+<!-- jtb-skill-version: 0.9.9 -->
 ---
 name: jtb
 description: Fetch a Jira ticket's full context (description, comments, linked issues, code references) and assemble a structured TicketBrief for implementation planning. Use when user types /jtb, mentions a Jira ticket key, or wants to plan work from a Jira ticket.

package/skills/jtb/scripts/lib/api-utils.mjs

@@ -3,7 +3,7 @@
  * Centralised here to avoid triplicating the regex and warning logic.
  */
 
-export const DEFAULT_API_BASE = 'http://api.ticketlens.test';
+export const DEFAULT_API_BASE = 'https://api.ticketlens.app';
 
 // Matches localhost, 127.0.0.1, and any hostname ending in .test or .local,
 // with an optional port — all treated as local-only addresses.

package/skills/jtb/scripts/lib/attachment-downloader.mjs

@@ -83,7 +83,8 @@ export async function downloadAttachments(ticket, opts = {}) {
       onProgress?.(`  download  ${a.filename}`);
       try {
         const headers = buildAuthHeader(env);
-        const response = await fetcher(a.content, { headers });
+        // redirect:'error' prevents a Jira redirect from leaking auth headers to a different origin.
+        const response = await fetcher(a.content, { headers, redirect: 'error' });
         if (!response.ok) throw new Error(`HTTP ${response.status} (${response.statusText})`);
         const buffer = await response.arrayBuffer();
         fs.writeFileSync(localPath, Buffer.from(buffer));

package/skills/jtb/scripts/lib/brief-assembler.mjs

@@ -12,6 +12,7 @@ export function assembleBrief(ticket, codeRefs = null, templateSections = null)
   sections.push(`# ${ticket.key}: ${ticket.summary}`);
 
   const meta = [`**Type:** ${ticket.type}`, `**Status:** ${ticket.status}`, `**Priority:** ${ticket.priority}`, `**Assignee:** ${ticket.assignee ?? 'Unassigned'}`, `**Reporter:** ${ticket.reporter ?? 'Unknown'}`];
+  if (ticket.sprint)  meta.push(`**Sprint:** ${ticket.sprint}`);
   if (ticket.created) meta.push(`**Created:** ${ticket.created.split('T')[0]}`);
   if (ticket.updated) meta.push(`**Updated:** ${ticket.updated.split('T')[0]}`);
   sections.push(meta.join(' | '));

package/skills/jtb/scripts/lib/brief-cache.mjs

@@ -19,7 +19,14 @@ export const DEFAULT_BRIEF_TTL = '4h'; // human-readable default for display/con
 export function briefCachePath(ticketKey, profileName, configDir = DEFAULT_CONFIG_DIR) {
   const safeProfile = (profileName || '_default').replace(/[^a-zA-Z0-9_\-]/g, '_');
   const safeKey = ticketKey.replace(/[^a-zA-Z0-9_\-]/g, '_');
-  return path.join(configDir, 'cache', safeProfile, safeKey, 'brief.json');
+  const resolvedDir = path.resolve(configDir);
+  const result = path.join(resolvedDir, 'cache', safeProfile, safeKey, 'brief.json');
+  // Defense-in-depth: ensure the final path cannot escape the config directory,
+  // even if configDir itself is manipulated or the sanitization above is weakened.
+  if (!result.startsWith(resolvedDir + path.sep)) {
+    throw new Error(`Cache path escapes config directory: ${result}`);
+  }
+  return result;
 }
 
 /**

package/skills/jtb/scripts/lib/jira-client.mjs

@@ -12,6 +12,24 @@ function toText(value) {
   return adfToText(value);
 }
 
+/**
+ * Extracts the active sprint name from customfield_10020.
+ * Cloud v3: array of sprint objects — prefers active, falls back to last.
+ * Server v2: serialized Java string — extracts via name= regex.
+ */
+function parseSprint(value) {
+  if (!value) return null;
+  if (Array.isArray(value)) {
+    const sprint = value.find(s => s.state === 'active') ?? value[value.length - 1];
+    return sprint?.name ?? null;
+  }
+  if (typeof value === 'string') {
+    const m = value.match(/name=([^,\]]+)/);
+    return m ? m[1].trim() : null;
+  }
+  return null;
+}
+
 /**
  * Returns the ISO date string when the ticket entered its current status,
  * derived from Jira's changelog history. Walks backwards (most recent first)
@@ -50,6 +68,7 @@ export function normalizeTicket(raw) {
     created: f.created ?? null,
     updated: f.updated ?? null,
     statusChangedAt,
+    sprint: parseSprint(f.customfield_10020),
     labels: f.labels ?? [],
     components: (f.components ?? []).map(c => c.name),
     comments: (f.comment?.comments ?? []).map(c => ({
@@ -81,6 +100,35 @@ export function normalizeTicket(raw) {
   };
 }
 
+// RFC-1918 + link-local + loopback + localhost blocked to prevent SSRF.
+const BLOCKED_PATTERNS = [
+  /^127\./,
+  /^10\./,
+  /^172\.(1[6-9]|2\d|3[01])\./,
+  /^192\.168\./,
+  /^169\.254\./,
+  /^0\.0\.0\.0$/,
+  /^::1$/,
+  /^::ffff:/i,
+  /^fc00:/i,
+  /^fe80:/i,
+  /^localhost$/i,
+];
+
+export function validateBaseUrl(url) {
+  let parsed;
+  try { parsed = new URL(url); } catch {
+    throw new Error(`JIRA_BASE_URL is not a valid URL: ${url}`);
+  }
+  if (parsed.protocol !== 'https:') {
+    throw new Error(`JIRA_BASE_URL must use HTTPS (got ${parsed.protocol})`);
+  }
+  const hostname = parsed.hostname.replace(/^\[|\]$/g, '');
+  if (BLOCKED_PATTERNS.some(re => re.test(hostname))) {
+    throw new Error(`JIRA_BASE_URL hostname is blocked (${hostname})`);
+  }
+}
+
 export function buildAuthHeader(env) {
   if (env.JIRA_PAT) {
     return { Authorization: `Bearer ${env.JIRA_PAT}` };
@@ -91,6 +139,7 @@ export function buildAuthHeader(env) {
 
 export async function fetchCurrentUser(opts = {}) {
   const { env = process.env, fetcher = globalThis.fetch, apiVersion = 2, timeoutMs = 10_000 } = opts;
+  validateBaseUrl(env.JIRA_BASE_URL);
   const baseUrl = env.JIRA_BASE_URL.replace(/\/$/, '');
   const headers = { ...buildAuthHeader(env), 'Content-Type': 'application/json' };
 
@@ -116,6 +165,7 @@ export async function fetchCurrentUser(opts = {}) {
 
 export async function fetchStatuses(opts = {}) {
   const { env = process.env, fetcher = globalThis.fetch, apiVersion = 2, timeoutMs = 10_000 } = opts;
+  validateBaseUrl(env.JIRA_BASE_URL);
   const baseUrl = env.JIRA_BASE_URL.replace(/\/$/, '');
   const headers = { ...buildAuthHeader(env), 'Content-Type': 'application/json' };
 
@@ -136,10 +186,11 @@ export async function fetchStatuses(opts = {}) {
 
 export async function searchTickets(jql, opts = {}) {
   const { env = process.env, fetcher = globalThis.fetch, maxResults = 50, apiVersion = 2, timeoutMs = 10_000, expandChangelog = false } = opts;
+  validateBaseUrl(env.JIRA_BASE_URL);
   const baseUrl = env.JIRA_BASE_URL.replace(/\/$/, '');
   const headers = { ...buildAuthHeader(env), 'Content-Type': 'application/json' };
 
-  const fields = 'summary,status,assignee,priority,issuetype,comment,updated,statuscategorychangedate,created';
+  const fields = 'summary,status,assignee,priority,issuetype,comment,updated,statuscategorychangedate,created,customfield_10020';
   const params = new URLSearchParams({ jql, fields, maxResults: String(maxResults) });
   if (expandChangelog) params.set('expand', 'changelog');
   const endpoint = apiVersion >= 3 ? `/rest/api/3/search/jql` : `/rest/api/2/search`;
@@ -163,6 +214,7 @@ export async function searchTickets(jql, opts = {}) {
 
 export async function fetchRemoteLinks(ticketKey, opts = {}) {
   const { env = process.env, fetcher = globalThis.fetch, apiVersion = 2, timeoutMs = 10_000 } = opts;
+  validateBaseUrl(env.JIRA_BASE_URL);
   const baseUrl = env.JIRA_BASE_URL.replace(/\/$/, '');
   const url = `${baseUrl}/rest/api/${apiVersion}/issue/${encodeURIComponent(ticketKey)}/remotelink`;
 
@@ -180,6 +232,7 @@ export async function fetchRemoteLinks(ticketKey, opts = {}) {
 
 export async function fetchTicket(ticketKey, opts = {}) {
   const { env = process.env, fetcher = globalThis.fetch, depth = 1, apiVersion = 2, timeoutMs = 10_000, expandChangelog = false, _visited = new Set(), _currentDepth = 0 } = opts;
+  validateBaseUrl(env.JIRA_BASE_URL);
   const baseUrl = env.JIRA_BASE_URL.replace(/\/$/, '');
   const headers = { ...buildAuthHeader(env), 'Content-Type': 'application/json' };
 

package/skills/jtb/scripts/lib/requirement-extractor.mjs

@@ -7,7 +7,7 @@
 const RE_GWT        = /^\s*(given|when|then)\s+(.+)/i;
 const RE_MUST_ITEM  = /^\s*[-*•]\s+((?:must|should|shall|ensure|verify)\b.+|.+(?:must|should|shall|ensure|verify).+)/i;
 const RE_NUM_MUST   = /^\s*\d+\.\s+((?:must|should|shall|ensure|verify)\b.+|.+(?:must|should|shall|ensure|verify).+)/i;
-const RE_AC_HEADER  = /^\s*#+\s*acceptance criteria\s*$/i;
+const RE_AC_HEADER  = /^\s*(?:#+\s*|h[1-6]\.\s*)?acceptance criteria\s*:?\s*$/i;
 const RE_BULLET     = /^\s*[-*•]\s+(.+)/;
 const RE_NUM_ITEM   = /^\s*\d+\.\s+(.+)/;
 

package/skills/jtb/scripts/lib/styled-assembler.mjs

@@ -114,6 +114,7 @@ export function styleBrief(ticket, codeRefs = null, opts = {}) {
     `${s.dim('Priority:')} ${ticket.priority}`,
     `${s.dim('Assignee:')} ${ticket.assignee ?? 'Unassigned'}`,
   ];
+  if (ticket.sprint)  meta.push(`${s.dim('Sprint:')} ${ticket.sprint}`);
   if (ticket.created) meta.push(`${s.dim('Created:')} ${ticket.created.split('T')[0]}`);
   if (ticket.updated) meta.push(`${s.dim('Updated:')} ${ticket.updated.split('T')[0]}`);
   sections.push(meta.join(s.dim('  ·  ')));