acli — Atlassian CLI for Jira

# 1. DNS reachability check — fail fast if Atlassian is blocked
if ! getent hosts "$ATLASSIAN_SITE" >/dev/null 2>&1; then
  echo "ERROR: $ATLASSIAN_SITE is DNS-blocked in this environment." >&2
  echo "Fix: allowlist $ATLASSIAN_SITE and api.atlassian.com in GitHub → Settings → Copilot → Policies." >&2
  exit 1
fi

# 2. Re-authenticate if no valid profile (Copilot agent sessions don't share ~/.config/acli from setup steps)
acli jira auth status 2>/dev/null || \
  echo "$ATLASSIAN_API_TOKEN" | acli jira auth login \
    --site "$ATLASSIAN_SITE" \
    --email "$ATLASSIAN_EMAIL" \
    --token

# 3. acli's active site is GLOBAL across every authenticated account (NA-77) — re-verify it
#    matches this repo's project-context before any call, not just that some account is logged in.
#    Skip (never hard-abort) when the script is unreachable — e.g. the Copilot agent runtime this
#    section's env-var contract targets does not load plugin skills, so CLAUDE_PLUGIN_ROOT is
#    unset there; that runtime already authenticates with an explicit --site above, so the guard
#    has nothing to add and must not turn a working runtime into a dead one.
[ -x "${CLAUDE_PLUGIN_ROOT:-}/scripts/jira-site-guard.sh" ] && { bash "${CLAUDE_PLUGIN_ROOT}/scripts/jira-site-guard.sh" || exit 1; }

acli jira project list --json 2>&1 | jq '.[].key'

acli jira workitem search \
  --jql "project = CER AND issuetype = Epic AND summary ~ \"feature keyword\"" \
  --fields "key,summary" --json 2>&1

[ -x "${CLAUDE_PLUGIN_ROOT:-}/scripts/jira-site-guard.sh" ] && { bash "${CLAUDE_PLUGIN_ROOT}/scripts/jira-site-guard.sh" || exit 1; }
acli jira workitem create \
  --project "CER" \
  --type "Story" \
  --summary "Short action-oriented title" \
  --description "As a fire safety engineer\nI want to...\nSo that..." \
  --label "feature-slug" \
  --parent "CER-123" \
  --json 2>&1

dir=$(bash ${CLAUDE_PLUGIN_ROOT}/scripts/tmp-dir.sh)   # session-scoped ./.tmp/<key>
bulk_file=$(mktemp "$dir/acli-bulk.XXXXXX")
trap 'rm -f "$bulk_file"' EXIT

# ... write JSON to $bulk_file, then:
[ -x "${CLAUDE_PLUGIN_ROOT:-}/scripts/jira-site-guard.sh" ] && { bash "${CLAUDE_PLUGIN_ROOT}/scripts/jira-site-guard.sh" || exit 1; }
acli jira workitem create-bulk --from-json "$bulk_file" 2>&1

[
  {
    "summary": "Story title",
    "projectKey": "CER",
    "issueType": "Story",
    "description": "As a...\nI want to...\nSo that...",
    "labels": ["feature-slug"],
    "parentKey": "CER-123"
  }
]

acli jira workitem create --generate-json

KEY="CER-456"

# Core fields (summary + description embedded in view)
issue=$(acli jira workitem view "$KEY" --json 2>&1)
summary=$(echo "$issue" | jq -r '.fields.summary')
description=$(echo "$issue" | jq -r '.fields.description // ""')

# All comments — use dedicated subcommand
comments=$(acli jira workitem comment list --key "$KEY" --json --paginate 2>&1 | \
  jq -r '[.[].body] | join("\n---\n")' 2>/dev/null || echo "")

# Jira-to-Jira linked tickets only. NOTE: acli only exposes outwardIssueKey (= issue this one
# BLOCKS). "is blocked by" links show outwardIssueKey=null and the blocker key is NOT returned.
jira_links=$(acli jira workitem link list --key "$KEY" --json 2>&1 | \
  jq -r '.issueLinks[]? | "\(.typeName): blocks \(.outwardIssueKey // "(blocked-by upstream — key not exposed)")"' 2>/dev/null || echo "")

# Attachments — list only (filename + MIME type + URL), no download via acli
attachments=$(acli jira workitem attachment list --key "$KEY" --json 2>&1 | \
  jq -r '[.[] | "\(.filename) [\(.mimeType)]: \(.content)"] | join("\n")' 2>/dev/null || echo "")

echo "=== SUMMARY ===" && echo "$summary"
echo "=== DESCRIPTION ===" && echo "$description"
echo "=== COMMENTS ===" && echo "$comments"
echo "=== LINKED JIRA TICKETS ===" && echo "$jira_links"
echo "=== ATTACHMENTS ===" && echo "$attachments"

acli jira workitem search --jql "parent = <EPIC-KEY>" --count            # confirm the story is parented
acli jira workitem search --jql "key = <KEY>" --fields labels --json     # labels DO render here

acli jira workitem view CER-456 --json 2>&1

[ -x "${CLAUDE_PLUGIN_ROOT:-}/scripts/jira-site-guard.sh" ] && { bash "${CLAUDE_PLUGIN_ROOT}/scripts/jira-site-guard.sh" || exit 1; }
acli jira workitem edit CER-456 \
  --summary "Updated title" \
  --description "Updated description" 2>&1

bash ${CLAUDE_PLUGIN_ROOT}/scripts/jira-set-field.sh <ISSUE-KEY> "<Field Display Name>[,<Alt Name>...]" <value> [number|string|option] [--if-empty]

acli jira workitem link type 2>&1   # available link type names (e.g. Blocks, Relates, Cloners)

# A blocks B   →   --out <B, blocked/downstream>   --in <A, blocker/prerequisite>
[ -x "${CLAUDE_PLUGIN_ROOT:-}/scripts/jira-site-guard.sh" ] && { bash "${CLAUDE_PLUGIN_ROOT}/scripts/jira-site-guard.sh" || exit 1; }
acli jira workitem link create --out CER-102 --in CER-101 --type Blocks --yes 2>&1

# Delete a link by its id (from link list)
[ -x "${CLAUDE_PLUGIN_ROOT:-}/scripts/jira-site-guard.sh" ] && { bash "${CLAUDE_PLUGIN_ROOT}/scripts/jira-site-guard.sh" || exit 1; }
acli jira workitem link delete --id <LINK-ID> --yes 2>&1

# Stories in a project
acli jira workitem search \
  --jql "project = CER AND issuetype = Story AND labels = \"feature-slug\"" \
  --fields "key,summary,status" \
  --json 2>&1

# Count only
acli jira workitem search \
  --jql "project = CER AND issuetype = Story" \
  --count 2>&1

[ -x "${CLAUDE_PLUGIN_ROOT:-}/scripts/jira-site-guard.sh" ] && { bash "${CLAUDE_PLUGIN_ROOT}/scripts/jira-site-guard.sh" || exit 1; }
acli jira workitem comment create --key CER-456 --body "Spec ready: docs/superpowers/specs/..." 2>&1

1. Search for existing Epic matching feature area
2. Write all story descriptions to mktemp files (avoids shell escaping issues AND collisions)
3. Use create-bulk with --from-json for efficiency
4. Capture returned issue keys
5. Link blocking dependencies between stories
6. Comment on each story with the feature doc path
7. Temp files are auto-cleaned by the EXIT trap

# Create a unique temp file in the session temp dir; clean it up automatically on exit
dir=$(bash ${CLAUDE_PLUGIN_ROOT}/scripts/tmp-dir.sh)   # session-scoped ./.tmp/<key>
desc_file=$(mktemp "$dir/acli-desc.XXXXXX")   # X's at end (macOS), no .txt suffix
trap 'rm -f "$desc_file"' EXIT

cat > "$desc_file" << 'EOF'
As a fire safety engineer
I want to view a list of penetrations by room
So that I can track certification status without opening each record

**Acceptance Criteria**
- [ ] List shows penetration ID, type, status, and last inspection date
- [ ] List filters by status (certified / pending / failed)
- [ ] Empty state shown when no penetrations exist

**Out of Scope**
- Editing penetrations from this view
EOF

[ -x "${CLAUDE_PLUGIN_ROOT:-}/scripts/jira-site-guard.sh" ] && { bash "${CLAUDE_PLUGIN_ROOT}/scripts/jira-site-guard.sh" || exit 1; }
acli jira workitem create \
  --project "CER" \
  --type "Story" \
  --summary "View penetrations list by room" \
  --description-file "$desc_file" \
  --parent "CER-123" \
  --json 2>&1

[ -x "${CLAUDE_PLUGIN_ROOT:-}/scripts/jira-site-guard.sh" ] && { bash "${CLAUDE_PLUGIN_ROOT}/scripts/jira-site-guard.sh" || exit 1; }
result=$(acli jira workitem create --project CER --type Story --summary "Title" --json 2>&1)
key=$(echo "$result" | jq -r '.key')
echo "Created: $key"

acli jira workitem search --jql "parent = <EPIC-KEY>" --count            # confirm the story is parented
acli jira workitem search --jql "key = <KEY>" --fields labels --json     # labels DO render here