Merge pull request #2236 from atomantic/jira-cloud-basic-auth

jira: support Jira Cloud (API token via Basic auth) alongside Server PAT

Author: atomantic

.changelog/NEXT.md

@@ -99,6 +99,10 @@
 
 - **Creative Director now evaluates rendered scenes on a local vision model instead of Opus.** Judging each freshly-rendered scene ("does it match the style spec and deliver the intent?") used to spawn a full Chief-of-Staff coding agent that landed on the active provider's *heavy* model — Opus for a Claude provider — purely to look at a couple of thumbnails and record a verdict. That decision now runs server-side through PortOS's vision-API path: it attaches the sampled frames to a **local, vision-capable model** (Ollama/LM Studio VLM) and parses a structured accept/retry/fail verdict, applying the exact same scene transitions (accept → add the clip to the collection; miss with retries left → re-render with a refined prompt; miss when exhausted → drop the scene). Pick the model under **Settings → AI Assignments → "Scene evaluation model"**; leave it blank to auto-select an installed local vision model. Installs with no local vision model configured transparently fall back to the original coding-agent path, so nothing breaks — but if you have a VLM installed, scene evaluation is now local and free. (`server/services/creativeDirector/sceneEvaluator.js`)
 
+## Integrations
+
+- **JIRA instances now support Jira Cloud (`*.atlassian.net`), not just Server / Data Center.** The JIRA client authenticated every instance with `Authorization: Bearer <token>` — correct for a Server/DC Personal Access Token, but Jira Cloud rejects that: a Cloud personal API token must be sent as HTTP Basic (`base64("email:token")`). PortOS now picks the scheme per instance by host — a `*.atlassian.net` base URL authenticates as Basic using the instance's email + API token (both already stored and required by the instance form), and any other host keeps the Bearer PAT — so Cloud and Server instances work side by side with no new fields or migration. Create a Cloud API token at id.atlassian.com → Security → API tokens and paste it into the instance's token field. (`server/services/jira.js`)
+
 ## Internal
 
 - **[issue-2183] Creative Tool Registry + gated dispatch (CDO Phase 1).** Foundation for the Creative Director orchestrator (epic #2182): a single registry (`server/services/creative/toolRegistry.js` + per-domain modules under `creative/tools/`) of creative-suite tools an orchestrating agent can call — universe, story builder, writers room, pipeline, media, catalog — each a thin conductor wrapper over an existing service entry point (`createUniverse`, `generateStep`, `startSeriesAutopilot`, `enqueueJob`, …), never a re-implementation. All orchestrator calls flow through one governed chokepoint, `dispatchCreativeTool(name, args, ctx)`, which validates args (Zod), enforces a new `creative` autonomy mode, charges the daily action budget for `llm`/`render` tools, and appends a `{tool, argsDigest, outcome, timing}` entry to the calling project's run ledger. The `creative` autonomy domain (`server/lib/domainAutonomy.js` `getCreativeAutonomyMode`) is kept separate from the four core domains and defaults to mirror the `cos` mode, so existing autopilot users get consistent behavior with no migration, while an explicit `domainAutonomy.creative` value can override it later. Direct user actions through the existing routes are unchanged — the gate lives only on the orchestrator path. No user-facing surface yet; the directive composer and plan board arrive in later CDO phases.

.changelog/v0.14.21.md

@@ -63,8 +63,8 @@ This release adds Ghostty terminal theme integration and a project update workfl
 - **`scripts/jira-create-ticket.js` CLI** — standalone script that imports JIRA services directly, reads app config, auto-resolves the active sprint, and creates tickets with all fields (project, assignee, sprint, epic, story points, labels) in one call; used by the `/ticket` Claude Code skill
 
 ### JIRA Epic Search & Token Expiry Detection
-- **`GET /api/jira/instances/:id/projects/:key/epics?q=`** — new endpoint to search epics by name in a project; the CLI ticket creator uses this to resolve fuzzy epic names (e.g., "grace support") to JIRA keys
-- **`--epic` accepts search terms** — the CLI script now accepts either a JIRA key (`CONTECH-1553`) or a name search (`"grace support"`) and auto-resolves to the best-matching epic
+- **`GET /api/jira/instances/:id/projects/:key/epics?q=`** — new endpoint to search epics by name in a project; the CLI ticket creator uses this to resolve fuzzy epic names (e.g., "payments platform") to JIRA keys
+- **`--epic` accepts search terms** — the CLI script now accepts either a JIRA key (`PROJ-1553`) or a name search (`"payments platform"`) and auto-resolves to the best-matching epic
 - **Token expiry detection** — JIRA client interceptor detects when the API returns an HTML login page instead of JSON and throws a clear "token expired" error instead of crashing
 
 ### JIRA Integration in Task & Agent UI

server/services/jira.js

@@ -7,6 +7,7 @@ import fs from 'fs/promises';
 import { createHttpClient } from '../lib/httpClient.js';
 import path from 'path';
 import { ensureDir, PATHS } from '../lib/fileUtils.js';
+import { hostFromOriginUrl } from '../lib/workTracker.js';
 
 const JIRA_CONFIG_FILE = path.join(PATHS.data, 'jira.json');
 
@@ -55,7 +56,7 @@ export async function upsertInstance(instanceId, instanceData) {
     name: instanceData.name,
     baseUrl: instanceData.baseUrl,
     email: instanceData.email,
-    apiToken: instanceData.apiToken, // PAT (Personal Access Token)
+    apiToken: instanceData.apiToken, // Server/DC PAT (sent as Bearer) or Cloud API token (sent as Basic email:token)
     tokenUpdatedAt: (instanceData.apiToken !== existing?.apiToken) ? new Date().toISOString() : (existing?.tokenUpdatedAt || new Date().toISOString()),
     createdAt: existing?.createdAt || new Date().toISOString(),
     updatedAt: new Date().toISOString()
@@ -74,6 +75,29 @@ export async function deleteInstance(instanceId) {
   await saveInstances(config);
 }
 
+/**
+ * Whether a JIRA instance is Jira Cloud (*.atlassian.net) vs Server / Data Center.
+ * Uses the shared no-throw host extractor (returns null on unparseable input) so a
+ * hand-edited jira.json can't throw here.
+ */
+export function isCloudInstance(baseUrl) {
+  const host = hostFromOriginUrl(baseUrl);
+  return !!host && /(^|\.)atlassian\.net$/i.test(host);
+}
+
+/**
+ * Build the Authorization header for a JIRA instance.
+ * - Jira Cloud authenticates a personal API token via HTTP Basic (base64 "email:token").
+ * - Jira Server / Data Center authenticates a Personal Access Token (PAT) via Bearer.
+ * Detected by host so Server and Cloud instances can coexist during a migration.
+ */
+export function jiraAuthHeader(instance) {
+  if (isCloudInstance(instance.baseUrl)) {
+    return `Basic ${Buffer.from(`${instance.email}:${instance.apiToken}`).toString('base64')}`;
+  }
+  return `Bearer ${instance.apiToken}`;
+}
+
 /**
  * Create HTTP client for JIRA instance
  */
@@ -85,7 +109,7 @@ export function createJiraClient(instance) {
   const base = createHttpClient({
     baseURL: instance.baseUrl,
     headers: {
-      'Authorization': `Bearer ${instance.apiToken}`,
+      'Authorization': jiraAuthHeader(instance),
       'Content-Type': 'application/json',
       'Accept': 'application/json'
     },
@@ -96,7 +120,7 @@ export function createJiraClient(instance) {
   // Detect expired token (JIRA returns HTML login page instead of JSON)
   const checkToken = res => {
     if (typeof res.data === 'string' && res.data.includes('<!DOCTYPE')) {
-      const err = new Error('JIRA token expired — received login page instead of JSON. Regenerate your PAT.');
+      const err = new Error('JIRA token expired — received login page instead of JSON. Regenerate your token (Server: PAT; Cloud: API token).');
       err.status = 401;
       throw err;
     }

server/services/jira.test.js

@@ -1,5 +1,37 @@
 import { describe, it, expect } from 'vitest';
-import { buildColumnsFromBoardConfig, buildColumnsFromStatuses } from './jira.js';
+import { buildColumnsFromBoardConfig, buildColumnsFromStatuses, isCloudInstance, jiraAuthHeader } from './jira.js';
+
+describe('isCloudInstance', () => {
+  it('treats *.atlassian.net hosts as Cloud', () => {
+    expect(isCloudInstance('https://example.atlassian.net')).toBe(true);
+    expect(isCloudInstance('https://example.atlassian.net/jira/software/c/projects/PROJ')).toBe(true);
+    expect(isCloudInstance('https://ATLASSIAN.NET')).toBe(true);
+  });
+
+  it('treats Server / Data Center hosts as not Cloud', () => {
+    expect(isCloudInstance('https://jira.example.com')).toBe(false);
+    expect(isCloudInstance('https://jira.example.com:8443')).toBe(false);
+    // Guard against a lookalike host that merely contains the string.
+    expect(isCloudInstance('https://atlassian.net.evil.com')).toBe(false);
+  });
+
+  it('does not throw on a malformed baseUrl', () => {
+    expect(isCloudInstance('not a url')).toBe(false);
+    expect(isCloudInstance(undefined)).toBe(false);
+  });
+});
+
+describe('jiraAuthHeader', () => {
+  it('uses Basic base64(email:token) for Cloud instances', () => {
+    const header = jiraAuthHeader({ baseUrl: 'https://example.atlassian.net', email: 'me@x.com', apiToken: 'tok' });
+    expect(header).toBe(`Basic ${Buffer.from('me@x.com:tok').toString('base64')}`);
+  });
+
+  it('uses Bearer PAT for Server / Data Center instances', () => {
+    const header = jiraAuthHeader({ baseUrl: 'https://jira.example.com', email: 'me@x.com', apiToken: 'pat' });
+    expect(header).toBe('Bearer pat');
+  });
+});
 
 describe('buildColumnsFromBoardConfig', () => {
   const statusById = new Map([