[frenchie4111]

Summary

Data-side half of the first-party ticketing-system work. Sibling PR (UI workstream) builds the picker + Settings page against this surface. Both PRs target feat/tickets, not main.

The shared contract in src/shared/tickets.ts is already on feat/tickets; this PR fills in the slices, persistence, providers, and IPC surface the UI consumes.

What's in here

• ticketProviders slice — configured provider instances keyed by uuid. Events: loaded, added, updated, removed.
• tickets slice — per-provider cache of last list() result (tickets[], loading, lastFetched, error). Dumb timestamp-based invalidation; events: fetchStarted, fetchSucceeded, fetchFailed.
• M2M repo↔provider link — RepoConfig.ticketProviderIds[] persisted in .harness.json, with effectiveTicketProviderIds() helper.
• Worktree-ticket link — Worktree.linkedTicket + PendingWorktree.linkedTicket carry the (providerId, externalId) tuple. Side-table for the worktree map lives in config.json under worktreeTicketLinks; WorktreesFSM merges it into the dispatched list on every refresh and prunes entries on worktree removal.
• Providers — src/main/tickets/{provider-registry,github-issues,notion}.ts. GitHub uses the existing token resolution + filters PRs out of the issues endpoint. Notion tokens resolve from secrets.enc keyed ticket-provider-token:<id>.
• IPC surface — tickets:{listProviders, addProvider, updateProvider, removeProvider, list, get, linkRepoProvider, unlinkRepoProvider} plus linkedTicket? threaded through worktrees:runPending(PR).
• Tests — one reducer test per event variant in both new slices; also covers effectiveTicketProviderIds.

Out of scope (UI workstream's PR)

• Settings page for providers.
• Ticket-picker modal.
• "Spawn worktree from ticket" UI flow (this PR provides the hook: addWorktree accepts linkedTicket).
• Worktree-row badge showing the linked ticket title.

Test plan

• npm run typecheck
• npx electron-vite build
• npx vitest run src/shared (696 passed)
• Smoke: configure a GitHub provider in config.json manually, hit tickets:list via devtools, confirm tickets show up
• Smoke: configure a Notion provider + token, hit tickets:list, confirm a real database returns
• Smoke: spawn a worktree with linkedTicket set, restart Harness, confirm the link survives the boot

🤖 Generated with Claude Code

[frenchie4111]

Review

Data-half of the ticketing work, targeting feat/tickets. Adds two slices (ticketProviders, tickets), threads linkedTicket through Worktree / PendingWorktree with a side-table on disk to survive the git re-read, ships GitHub Issues + Notion provider implementations, and exposes the IPC surface the UI workstream is building against. +1117/-10 across 18 files; reducer tests pass.

✅ What's solid

• Slice pattern is followed faithfully — both reducers preserve reference identity on no-op cases (if (!existing) return state, if (!(id in byId)) return state), with tests asserting next === start. That's the cascade anti-pattern guidance from CLAUDE.md done right.
• Side-table for linkedTicket is the right call — worktrees are reconstructed from git worktree list on every refresh, so a Harness-only field can't live on the git record. Persisting in config.json and merging in WorktreesFSM.refreshList is well-documented in code.
• Reverse-cleanup on removeProvider strips the id from every linked repo's ticketProviderIds so no dangling references survive (src/main/index.ts:3625).
• Provider registry uses _exhaustive: never so a future TicketProviderType literal that lands without an implementation fails the build.
• Tokens are write-only over IPC — no read path returns them.

🐛 Bugs to fix before merge

1. Notion search filter is dead unless titleProperty is explicitly set.
src/main/tickets/notion.ts:141:

if (query && config.titleProperty !== undefined) {
  body.filter = { property: config.titleProperty || 'Name', ... }
}

The default for titleProperty is 'Name' (used in toTicket), but the filter is gated on config.titleProperty !== undefined, so a brand-new provider configured without titleProperty will never narrow on search. Should be:

if (query) {
  body.filter = { property: config.titleProperty || 'Name', title: { contains: query } }
}

2. tickets:updateProvider accepts a type-mismatched config payload.
src/main/index.ts around line 3577 — {...existing, ...patch} with no runtime check that patch.config is shape-compatible with patch.type ?? existing.type. A Notion config payload on a github-issues provider would persist to disk and only crash on the next tickets:list inside parseRepo. Easiest fix: if patch.config is set, validate against the discriminated type before saving (or refuse type changes outright since addProvider is the supported way to switch).

3. tickets:addProvider casts the config without validating.
src/main/index.ts:3559 does input.config as GithubIssuesConfig with no runtime check. A malformed payload from a renderer bug (or future external caller) lands on disk and crashes on first list(). Add a minimal validateConfig(type, config) helper that checks the required fields (repo non-empty for github, databaseId non-empty for notion) and returns null on failure.

4. Stored token for a github-issues provider is dead weight.
The GH provider uses getCachedToken / resolveGitHubToken (shared GitHub auth), so a token passed to tickets:addProvider({type: 'github-issues', ...}, token) lands in secrets.enc under ticket-provider-token:<id> and is never read. Either branch on type and skip the setSecret call, or document that per-provider tokens are notion-only. The UI workstream also needs to know — its add-provider form shouldn't ask for a token when type is github-issues (unless we want per-repo GH PATs later, in which case land the read path now).

⚠️ Smaller concerns

• worktreeTicketLinks orphan on creation failure. setWorktreeTicketLink is called after addWorktree succeeds but before finishCreate. If setup fails badly enough that the worktree is removed, the link entry stays on disk — refreshList ignores absent paths but doesn't prune the side-table. Add a sweep in the post-failure cleanup, or prune inside refreshList for paths not in the flat list.
• worktreeTicketLinks orphan on provider removal. The removeProvider handler strips ids from RepoConfig.ticketProviderIds but leaves worktreeTicketLinks entries pointing at the removed providerId. The UI chip will resolve to an unknown provider. Sweep worktreeTicketLinks for the removed id too.
• tickets:listProviders reads config.ticketProviders directly instead of store.getSnapshot().state.ticketProviders.byId. They're kept in sync by the handlers but the store is canonical — minor preference for consistency.
• trackedFetch from github-recorder used for Notion calls (src/main/tickets/notion.ts:8). The module name lies. Either alias the import (trackedFetch as recordedFetch) or extract to a neutral name in a follow-up — not blocking, but Notion latency will show up in something called "github-recorder" which confuses future debugging.
• setWorktreeTicketLink accepts undefined to drop, but no caller exercises it. The IPC remove handler in index.ts:1296 pokes at config.worktreeTicketLinks directly instead of routing through the setter. Either route through the setter (cleaner) or drop the undefined branch.

🧪 Tests

• Reducer tests are thorough — one per event variant, plus reference-identity checks for no-op cases. ✓
• Untested: WorktreesFSM.refreshList's link-decoration step. Worth a unit test that constructs an FSM with a fake getWorktreeTicketLinks returning {[path]: link} and asserts the dispatched list carries linkedTicket — this is the load-bearing trick of the whole approach.
• Untested: the IPC handlers' validation paths (Add GitHub setup banner on app launch #2, Persist terminal tabs and scrollback across restarts #3 above). If those become unit-testable after extracting validateConfig, add quick coverage.

🔐 Security

• Tokens correctly never travel over IPC outbound. ✓
• Notion bearer is in the Authorization header, not URL. ✓
• 401 handling on GitHub re-resolves the token cache. ✓
• No PII / log leakage in the error paths — formatErr strips the noise. ✓

Verdict

Approve with changes. The architecture is clean and the side-table trick is the right answer for the worktree-metadata persistence problem. Bugs #1–#4 should land before merge — #1 is user-visible (search broken in the common case), #2 and #3 are correctness, #4 is a UI-workstream coordination point. The orphan-cleanup smells are not blocking but worth a follow-up commit.

Comment left on behalf of @frenchie4111 by Claude via Harness.

[frenchie4111]

Fixed in e09da15:

Bugs

1. ✅ Notion search filter now triggers on `query` alone (was dead unless `titleProperty` was explicitly set).
2. ✅ `tickets:updateProvider` refuses type changes outright (remove + add to switch), and validates the `config` payload via the new `validateProviderConfig(type, raw)` helper.
3. ✅ `tickets:addProvider` also goes through `validateProviderConfig` — malformed payloads return `null` instead of landing on disk and crashing later.
4. ✅ Token slot is now only used for Notion. A token passed to `addProvider({type: 'github-issues', ...}, token)` is dropped silently. UI workstream: hide the token input when type is `github-issues`.

Smaller concerns

• ✅ `worktreeTicketLinks` orphan on creation failure → `WorktreesFSM.refreshList` now calls a `pruneWorktreeTicketLinks(livePaths)` callback so anything not in the current git-derived list gets GCed.
• ✅ `worktreeTicketLinks` orphan on provider removal → `tickets:removeProvider` sweeps links pointing at the removed id and kicks a `refreshList` so the sidebar decoration disappears in one render.
• ✅ `tickets:listProviders` reads from the store snapshot now.
• ✅ `trackedFetch` aliased to `recordedFetch` in notion.ts.
• ✅ `worktree:remove` IPC handler routes the link drop through the named `setWorktreeTicketLink` helper.

Tests

• ✅ `WorktreesFSM.refreshList` link-decoration + prune-callback contract.
• ✅ `validateProviderConfig` across both provider types (good / malformed / cross-shape / unknown fields / non-object inputs).

714 tests pass on the branch.

Comment left on behalf of @frenchie4111 by Claude via Harness.