[bgoewert-seiler]

Description

The Jira integration only signs in to Atlassian Cloud, so self-hosted Jira cannot connect. Data Center serves REST API v2 only, has no accountId, and uses personal access tokens (8.14+) instead of Cloud API tokens. This adds that sign-in, with two smaller changes for large sites. The commits can be reviewed one at a time:

• PAT sign-in. A "Personal access token (Data Center)" method taking a site URL and token, sent as Authorization: Bearer. It verifies against /rest/api/2/myself, lists and searches through /rest/api/2/search, and keys the account by user key with the username as login.
• http:// refusal. A token is never sent to an http:// site.
• Account JQL filter. An optional "Issue filter (JQL)" on each Jira sign-in method, such as project = WEB. When set, the issue list shows what it matches instead of the last 90 days of activity, and searches are ANDed with it.
• Project JQL filter. An optional "JQL filter" in project settings, such as "Epic Link" = WEB-123, ANDed with the account's. Plugins opt in with issueFilter in their issues descriptor, filters live in a new optional issueFilters key in the project's durable settings (no migration), and a filter containing ORDER BY is rejected.
• Done exclusion. Every query adds statusCategory != Done. This is one clause in the shared query builder, so it also applies to Jira Cloud and changes what existing Cloud users see. It is its own commit and easy to drop or limit to Data Center.
• Filter field test. A browser test for the project filter field.
• Filter validation. Filters whose parentheses don't balance are rejected, since each filter is wrapped in parentheses and one that closes early would escape its clause. This is a fix(unreleased) commit and can be squashed into the filter commits.

If you would rather review this in pieces, the filters and the Done exclusion split off cleanly from the sign-in.

Related issues

#1744 proposed the same sign-in and was closed unmerged during the v1 launch freeze, with a note that it would be welcome afterward. #1156 asks for bearer tokens on Cloud, which is separate.

Testing

• pnpm run format, pnpm run lint and pnpm run typecheck pass.
• App node and main-db Vitest projects pass, plus the @emdash/plugins suite, with new tests for PAT verification, v2 search, filter composition, ORDER BY and unbalanced-parenthesis rejection, the durable issue-filter patch, the form patch, and the filter reaching the plugin.
• The integration-accounts-section browser test passes, including new cases for the filter field. The other browser projects were not run in full.
• Not tested against a live Jira Data Center or Cloud site.

Screenshot/Recording (if applicable)

Checklist

• I kept this PR small and focused
• I ran a self-review before opening this PR
• I ran the relevant local checks or explained why not
• I updated docs when behavior or setup changed
• I added or updated tests when behavior changed, or explained why not
• I only added comments where the logic is not obvious
• I used Conventional Commits for commit messages and, when possible, the PR title

🤖 Generated with Claude Code

[greptile-apps]

Confidence Score: 3/5

[Medium impact] The changes affect Jira connections and issue lists, including existing Cloud users.

Fix the failing test types and the Jira account collision before merging.

Findings

1.  New tests fail typechecking ▶
2.  Jira connections replace each other ▶
3.  Saved filters appear ignored ▶
4.  Quoted filter text gets rejected ▶

Fix with agent prompt

### Issue 1
apps/emdash-desktop/src/core/features/projects/browser/components/settings-view/sections/integration-accounts-section.browser.test.tsx:126
Both new browser tests pass `projectId` to `IntegrationAccountsSection`, but the component has no such prop. These tests are included in the browser TypeScript program, so they fail typechecking. Remove the extra prop here and in the second case at line 161.

### Issue 2
packages/plugins/src/integrations/impl/jira/client.ts:90-94
If two Data Center instances share a host but use different paths and the same `user.key`, this code gives them the same account identity. For example, `https://jira.example.com/jira-a` and `https://jira.example.com/jira-b` both produce the same `host`, with no separate `scope`. Connecting the second instance replaces the first account's saved credentials, so projects pinned to that account switch sites. For PAT accounts, use the normalized full site URL as `scope`.

### Issue 3
apps/emdash-desktop/src/core/features/projects/browser/components/settings-view/use-project-settings-form.ts:162-165
Saving the new project filter does not refresh cached issue results. `useIssues` keys lists and searches by project and account, but not by `issueFilters`, and saving settings does not refresh those queries. Open the picker, save a narrower filter, then reopen it: the old list can remain for 60 seconds, and repeated searches can reuse old results for 30 seconds. Include the saved filter in the query keys and search context, or refresh the affected queries after saving.

### Issue 4
packages/plugins/src/integrations/impl/jira/types.ts:74-75
`jqlHasOrderBy` also matches text inside quoted values. A valid filter such as `summary ~ "order by"` is rejected even though it contains no sorting clause. This blocks account sign-in with that filter and prevents project issue queries from running. Ignore quoted strings and escaped quotes when checking for `ORDER BY`, and add a test for a quoted value.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Adds Jira Data Center PAT sign-in and account/project JQL filters.

• Jira sign-in now supports personal access tokens for Data Center.
• Jira lists and searches now follow account and project JQL filters.

Acknowledgment: bgoewert-seiler explicitly described excluding Done issues from all Jira queries, including Cloud queries. That intended behavior is not reported as a defect.

Checks were based on source and configuration; no runtime or visual verification was performed.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Account JQL filter] --> Q[Shared Jira query builder]
  P[Project settings] --> D[Stored provider filter]
  D --> I[Issue provider adapter]
  I --> Q
  S[Search text or recent activity] --> Q
  Q --> N[Exclude Done and sort]
  N --> M{Sign-in method}
  M -->|PAT| V2[Jira REST v2]
  M -->|Cloud| V3[Jira enhanced search]

Loading

_{Reviews (1) · Last reviewed commit: "fix(unreleased): reject Jira issue filte..." · Reviewed by Greptile}

[bgoewert-seiler]

excluding Done issues from all Jira queries, including Cloud queries. That intended behavior is not reported as a defect.

I don't know know others preference, but I just thought to include a setting to optionally exclude those instead of forcing it. Let me know if that is preferred and increases the change to merge. Would like to see this on main since I use this daily.