v1.3.0 - Security & Agent Safety

What's New in v1.3.0

This release adds significant security improvements and agent safety features, inspired by steipete/gogcli.

🔐 Secure Credential Storage

Store API tokens securely using OS-native keyring integration:

• macOS: Keychain
• Windows: Credential Manager
• Linux: Secret Service (GNOME Keyring, KWallet)
• Fallback: Encrypted file for CI/headless environments

# Automatic during setup
jira-cli configure
# → "Store API token securely in system keyring? [Y/n]"

# Or configure via environment
export JIRA_KEYRING_BACKEND=keychain  # or "file"
export JIRA_KEYRING_PASSWORD='...'    # required for file backend

🛡️ Command Allowlist (Agent Safety)

Restrict commands for sandboxed or AI-assisted execution:

# Read-only mode - blocks all write operations
export JIRA_READONLY=1

# Custom allowlist - only specific commands allowed
export JIRA_COMMAND_ALLOWLIST="get,search,list,fields"

New allowlist command for runtime management:

jira-cli allowlist status    # View current configuration
jira-cli allowlist commands  # List commands by category
jira-cli allowlist check X   # Test if command X is allowed
jira-cli allowlist enable    # Show enable instructions

📖 AGENTS.md

New comprehensive guide for AI agents and contributors covering:

• Project structure documentation
• Coding conventions
• Security guidelines
• Environment variables reference

---

Full Changelog

Added

• Secure credential storage (pkg/secrets/)
• Command allowlist system (pkg/allowlist/)
• allowlist CLI command with subcommands
• AGENTS.md documentation

Changed

• configure command now offers keyring storage
• Root command validates against allowlist before execution

Technical

• 844 lines of allowlist tests
• 261 lines of secrets tests
• Comprehensive documentation updates

---

Full Changelog: v1.2.0...v1.3.0