@delorenj/pjangler 1.2.21 → 1.2.33

package/templates/hermes-agent/template/.scripts/80-registry.sh

@@ -4,6 +4,10 @@
 source "$(dirname "$0")/_lib.sh"
 load_role_env
 
+fleet_lock_acquire
+trap 'fleet_lock_release' EXIT
+
+[[ ! -L "$REGISTRY_FILE" ]] || die "refusing to update registry symlink: $REGISTRY_FILE"
 mkdir -p "$(dirname "$REGISTRY_FILE")"
 if [[ ! -f "$REGISTRY_FILE" ]]; then
   cat > "$REGISTRY_FILE" <<'YAML'
@@ -21,33 +25,109 @@ log "[80] appending to fleet registry: $REGISTRY_FILE"
 
 python3 - "$REGISTRY_FILE" "$AGENT_ID" "$REPO" "$ROLE" "$DISPLAY_NAME" \
   "$PROJECT_PATH" "$ROLE_DIR" "$PROFILE_NAME" \
-  "$BOT_HANDLE" \
+  "$(yaml_get telegram.provisioning_status)" "$BOT_HANDLE" "$(yaml_get telegram.bot_id)" \
+  "$(yaml_get slack.provisioning_status)" "$(yaml_get slack.team_id)" \
+  "$(yaml_get slack.team_name)" "$(yaml_get slack.bot_user_id)" \
+  "$(yaml_get slack.bot_id)" "$(yaml_get slack.bot_username)" \
+  "$(yaml_get bloodbank.gateway_scope)" "$(yaml_get bloodbank.target_agent_id)" \
   "$PLANE_WORKSPACE" "$PLANE_PROJECT_ID" "$(yaml_get plane.identifier)" \
-  "$RUNTIME_REPO" "$HERMES_BIN" "$HERMES_AGENT_REPO" "$FLEET_ENV" \
-  "hermes-${AGENT_ID}-gateway.service" "hermes-${AGENT_ID}-consumer.service" \
-  "hermes-${AGENT_ID}-heartbeat.timer" <<'PYEOF'
-import sys, pathlib, datetime
+  "$RUNTIME_REPO" "$HERMES_BIN" "$HERMES_AGENT_REPO" "$HERMES_RUNTIME_GIT_URL" \
+  "$HERMES_RUNTIME_GIT_REF" "$HERMES_RUNTIME_GIT_SHA" "$FLEET_ENV" \
+  "hermes-${AGENT_ID}-gateway.service" "hermes-${AGENT_ID}-heartbeat.timer" <<'PYEOF'
+import datetime
+import errno
+import os
+import pathlib
+import sys
+import tempfile
 try:
     import yaml  # type: ignore
 except ImportError:
     sys.exit("PyYAML required; pip install pyyaml")
-(path, agent_id, repo, role, display, project, role_dir, profile, bot,
- plane_ws, plane_id, plane_ident, runtime_repo, hermes_bin, hermes_repo,
- fleet_env, gw, csm, ckpt) = sys.argv[1:20]
+(path, agent_id, repo, role, display, project, role_dir, profile,
+ telegram_status, bot, telegram_bot_id,
+ slack_status, slack_team_id, slack_team_name, slack_user_id, slack_bot_id,
+ slack_username, bloodbank_scope, bloodbank_target, plane_ws, plane_id,
+ plane_ident, runtime_repo, hermes_bin, hermes_repo, hermes_git_url,
+ hermes_git_ref, hermes_git_sha, fleet_env, gw, heartbeat) = sys.argv[1:32]
 p = pathlib.Path(path)
+if p.is_symlink():
+    raise SystemExit(f"refusing to update registry symlink: {p}")
 data = yaml.safe_load(p.read_text()) or {"schema_version": 1, "agents": {}}
 data.setdefault("agents", {})[agent_id] = {
   "repo": repo, "role": role, "display_name": display,
   "project_path": project, "role_dir": role_dir,
   "profile_name": profile,
-  "telegram": {"bot_username": bot},
+  "telegram": {
+    "provisioning_status": telegram_status,
+    "bot_username": bot,
+    "bot_id": telegram_bot_id,
+  },
+  "slack": {
+    "provisioning_status": slack_status,
+    "team_id": slack_team_id,
+    "team_name": slack_team_name,
+    "bot_user_id": slack_user_id,
+    "bot_id": slack_bot_id,
+    "bot_username": slack_username,
+  },
+  "bloodbank": {
+    "gateway_scope": bloodbank_scope,
+    "target_agent_id": bloodbank_target,
+  },
   "plane": {"workspace": plane_ws, "project_id": plane_id, "identifier": plane_ident},
   "runtime_repo": runtime_repo,
-  "hermes": {"bin": hermes_bin, "repo": hermes_repo, "fleet_env": fleet_env},
-  "systemd": {"gateway_unit": gw, "consumer_unit": csm, "heartbeat_timer": ckpt},
-  "provisioned_at": datetime.datetime.utcnow().isoformat() + "Z",
+  "hermes": {
+    "bin": hermes_bin,
+    "repo": hermes_repo,
+    "git_url": hermes_git_url,
+    "git_ref": hermes_git_ref,
+    "git_sha": hermes_git_sha,
+    "fleet_env": fleet_env,
+  },
+  "systemd": {"gateway_unit": gw, "heartbeat_timer": heartbeat},
+  "provisioned_at": datetime.datetime.now(datetime.timezone.utc).isoformat().replace("+00:00", "Z"),
 }
-p.write_text(yaml.safe_dump(data, sort_keys=False))
+rendered = yaml.safe_dump(data, sort_keys=False)
+p.parent.mkdir(parents=True, exist_ok=True)
+
+def fsync_parent(target):
+    unsupported = {errno.EINVAL, getattr(errno, "ENOTSUP", errno.EINVAL), errno.ENOSYS}
+    flags = os.O_RDONLY | getattr(os, "O_DIRECTORY", 0)
+    try:
+        directory_fd = os.open(target.parent, flags)
+    except OSError as exc:
+        if exc.errno in unsupported:
+            return
+        raise
+    try:
+        try:
+            os.fsync(directory_fd)
+        except OSError as exc:
+            if exc.errno not in unsupported:
+                raise
+    finally:
+        os.close(directory_fd)
+
+fd, temporary = tempfile.mkstemp(prefix=f".{p.name}.registry-", dir=p.parent)
+try:
+    os.fchmod(fd, 0o600)
+    with os.fdopen(fd, "w", encoding="utf-8") as handle:
+        handle.write(rendered)
+        handle.flush()
+        os.fsync(handle.fileno())
+    os.replace(temporary, p)
+    os.chmod(p, 0o600)
+    fsync_parent(p)
+except BaseException:
+    try:
+        os.unlink(temporary)
+    except FileNotFoundError:
+        pass
+    raise
 PYEOF
 
+fleet_lock_release
+trap - EXIT
+
 mark_done 80-registry

package/templates/hermes-agent/template/.scripts/99-summary.sh

@@ -5,7 +5,6 @@ source "$(dirname "$0")/_lib.sh"
 load_role_env
 
 GW_UNIT="hermes-${AGENT_ID}-gateway.service"
-CSM_UNIT="hermes-${AGENT_ID}-consumer.service"
 HB_TIMER="hermes-${AGENT_ID}-heartbeat.timer"
 
 cat >&2 <<EOF
@@ -15,18 +14,16 @@ cat >&2 <<EOF
 │  Talk:        @$BOT_HANDLE  (Telegram DM)
 │  Shell:       $ROLE_DIR/hermes chat "status"
 │  Board:       $PLANE_BASE/$PLANE_WORKSPACE/projects/$(cat "$ROLE_DIR/.scripts/.plane-project-id" 2>/dev/null || echo "(skipped)")
-│  Runtime:     gh:$RUNTIME_REPO   (reconcile + checkpoint heartbeat)
+│  Runtime:     $ROLE_DIR/runtime   (pure-local, ignored)
 │  Hermes bin:  $HERMES_BIN
 │  Fleet env:   $FLEET_ENV
 │
 │  Start fleet daemons:
 │    systemctl --user start $GW_UNIT
-│    systemctl --user start $CSM_UNIT
 │    systemctl --user start $HB_TIMER
 │
 │  Tail logs:
 │    journalctl --user -fu $GW_UNIT
-│    journalctl --user -fu $CSM_UNIT
 │
 │  Fleet status:
 │    python3 -c "import yaml,pathlib; print(yaml.safe_dump(yaml.safe_load(pathlib.Path('$REGISTRY_FILE').read_text())['agents']))"

package/templates/hermes-agent/template/.scripts/_lib.sh

@@ -145,10 +145,17 @@ if [[ -f "$FLEET_ENV" ]]; then
   # shellcheck disable=SC1090
   source "$FLEET_ENV"
 fi
+# Identity-bearing chat credentials are never fleet-scoped. Platform wiring
+# steps capture explicit invocation values before sourcing this library and
+# restore only those values afterward; all other provisioning steps stay clean.
+unset TELEGRAM_BOT_TOKEN SLACK_BOT_TOKEN SLACK_APP_TOKEN
 
 # Tools we expect on the host
 HERMES_BIN="${HERMES_BIN:-${HERMES_FLEET_BIN:-$(config_get fleet.hermes_bin "$HOME/.hermes/hermes-agent/.venv/bin/hermes")}}"
 HERMES_AGENT_REPO="${HERMES_AGENT_REPO:-${HERMES_FLEET_REPO:-$(config_get fleet.hermes_repo "$HOME/.hermes/hermes-agent")}}"
+HERMES_RUNTIME_GIT_URL="${HERMES_RUNTIME_GIT_URL:-$(config_get fleet.hermes_git_url 'https://github.com/delorenj/hermes-agent.git')}"
+HERMES_RUNTIME_GIT_REF="${HERMES_RUNTIME_GIT_REF:-$(config_get fleet.hermes_git_ref 'feature/PJAN-19-routing-publication')}"
+HERMES_RUNTIME_GIT_SHA="${HERMES_RUNTIME_GIT_SHA:-$(config_get fleet.hermes_git_sha '113e1b182b6d72a7dd02a191f134a41668ceaf0e')}"
 HERMES_OAUTH_FILE="${HERMES_OAUTH_FILE:-${HERMES_FLEET_OAUTH_FILE:-$(config_get fleet.oauth_file "$HOME/.hermes/auth.json")}}"
 CODEX_HOME="${CODEX_HOME:-${HERMES_FLEET_CODEX_HOME:-$(config_get fleet.codex_home "$HOME/.codex")}}"
 # Prefer a scaffold vendored into this agent directory; fall back to the configured template path.
@@ -158,6 +165,29 @@ if [[ ! -d "$RUNTIME_SCAFFOLD_DIR" ]]; then
 fi
 REGISTRY_FILE="${REGISTRY_FILE:-${HERMES_FLEET_REGISTRY_FILE:-$(config_get fleet.registry_file "$HOME/.hermes/agents-registry.yaml")}}"
 
+# Cross-process serialization for fleet identity claims and registry updates.
+# The lock file may remain on disk; flock ownership is kernel-scoped, so a
+# crashed provisioner cannot leave a permanently stale lock.
+FLEET_LOCK_FD=""
+fleet_lock_acquire() {
+  command -v flock >/dev/null 2>&1 || die "flock is required for safe fleet registry updates"
+  local lock_file="${REGISTRY_FILE}.lock"
+  mkdir -p "$(dirname "$lock_file")"
+  [[ ! -L "$lock_file" ]] || die "refusing fleet lock symlink: $lock_file"
+  exec {FLEET_LOCK_FD}>"$lock_file"
+  chmod 600 "$lock_file"
+  flock -w "${FLEET_LOCK_TIMEOUT_SECONDS:-30}" "$FLEET_LOCK_FD" \
+    || die "timed out waiting for fleet registry lock: $lock_file"
+}
+
+fleet_lock_release() {
+  if [[ "${FLEET_LOCK_FD:-}" =~ ^[0-9]+$ ]]; then
+    flock -u "$FLEET_LOCK_FD" 2>/dev/null || true
+    eval "exec ${FLEET_LOCK_FD}>&-"
+  fi
+  FLEET_LOCK_FD=""
+}
+
 # Bloodbank / NATS
 BLOODBANK_NATS_HOST="${BLOODBANK_NATS_HOST:-$(config_get bloodbank.nats_host '127.0.0.1')}"
 BLOODBANK_NATS_PORT="${BLOODBANK_NATS_PORT:-$(config_get bloodbank.nats_port '4222')}"
@@ -167,7 +197,8 @@ BLOODBANK_COMPOSE_DIR="${BLOODBANK_COMPOSE_DIR:-$(config_get bloodbank.compose_d
 PLANE_BASE="${PLANE_BASE:-$(config_get plane.base 'https://plane.delo.sh')}"
 PLANE_API_KEY="${PLANE_API_KEY:-${PLANE_33GOD_API_KEY:-}}"
 
-export FLEET_ENV HERMES_BIN HERMES_AGENT_REPO HERMES_OAUTH_FILE CODEX_HOME \
+export FLEET_ENV HERMES_BIN HERMES_AGENT_REPO HERMES_RUNTIME_GIT_URL \
+       HERMES_RUNTIME_GIT_REF HERMES_RUNTIME_GIT_SHA HERMES_OAUTH_FILE CODEX_HOME \
        RUNTIME_SCAFFOLD_DIR REGISTRY_FILE \
        BLOODBANK_NATS_HOST BLOODBANK_NATS_PORT BLOODBANK_COMPOSE_DIR \
        PLANE_BASE PLANE_API_KEY
@@ -180,6 +211,40 @@ systemd_user_available() {
   [[ "$state" =~ ^(running|degraded|starting|maintenance)$ ]]
 }
 
+# Query one systemd user-unit state without conflating every non-zero exit with
+# an inactive/disabled unit. Output is `ok|<state>` only for documented
+# state/exit-code pairs; D-Bus, manager, and arbitrary query failures become
+# `error|<safe summary>` so retirement callers can fail closed.
+systemctl_user_unit_state() {
+  local query="$1" unit="$2" output rc first_line
+  command -v systemctl >/dev/null 2>&1 \
+    || { printf 'error|systemctl unavailable'; return 0; }
+  set +e
+  output="$(LC_ALL=C systemctl --user "$query" "$unit" 2>&1)"
+  rc=$?
+  set -e
+  first_line="${output%%$'\n'*}"
+  first_line="${first_line//$'\t'/ }"
+  first_line="${first_line//|/}"
+  case "$query:$rc:$first_line" in
+    is-active:0:active|is-active:0:reloading|is-active:0:activating|is-active:0:deactivating)
+      printf 'ok|%s' "$first_line" ;;
+    is-active:3:inactive|is-active:3:failed)
+      printf 'ok|%s' "$first_line" ;;
+    is-active:4:inactive)
+      printf 'ok|not-found' ;;
+    is-enabled:0:enabled|is-enabled:0:enabled-runtime|is-enabled:0:linked|is-enabled:0:linked-runtime|is-enabled:0:alias|is-enabled:0:static|is-enabled:0:indirect|is-enabled:0:generated|is-enabled:0:transient)
+      printf 'ok|%s' "$first_line" ;;
+    is-enabled:1:disabled|is-enabled:1:masked|is-enabled:1:masked-runtime)
+      printf 'ok|%s' "$first_line" ;;
+    is-enabled:4:not-found)
+      printf 'ok|not-found' ;;
+    *)
+      [[ -n "$first_line" ]] || first_line="exit $rc with no state"
+      printf 'error|%s' "$first_line" ;;
+  esac
+}
+
 # Resolve project repo path (the repo that holds agents/hermes/<role>/).
 # Walk up from $ROLE_DIR until we find a git root that isn't us.
 project_repo_path() {

package/templates/hermes-agent/template/.scripts/checkpoint.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Auto-checkpoint commit for the agent's runtime submodule.
+# Legacy checkpoint compatibility for installations whose runtime is still a
+# nested Git repository. Pure-local runtimes intentionally skip this script.
 # Idempotent — exits 0 with no commit if there are no changes.
 #
 # Secret-scan gate (PJAN): before committing, the staged diff is scanned for
@@ -11,7 +12,7 @@ set -euo pipefail
 RUNTIME_DIR="$(cd "$(dirname "$0")/../runtime" && pwd)"
 cd "$RUNTIME_DIR"
 
-# Skip if not a git repo (e.g. submodule not initialized)
+# Skip when the pure-local runtime has no Git metadata.
 [[ -d .git || -f .git ]] || exit 0
 
 # Returns 0 when the staged diff looks clean, 1 when a likely secret is present.

package/templates/hermes-agent/template/.scripts/config.example.toml

@@ -13,8 +13,13 @@
 [fleet]
 # Absolute path to the shared Hermes executable every agent launcher execs.
 hermes_bin = "~/.hermes/hermes-agent/.venv/bin/hermes"
-# Checkout of the hermes-agent repo. Its .venv is used to install nats-py, etc.
+# Checkout of the shared hermes-agent repo.
 hermes_repo = "~/.hermes/hermes-agent"
+# Reviewed fleet runtime publication. Provisioning metadata and clean installs
+# must agree on this fork/ref/SHA; do not substitute upstream main.
+hermes_git_url = "https://github.com/delorenj/hermes-agent.git"
+hermes_git_ref = "feature/PJAN-19-routing-publication"
+hermes_git_sha = "113e1b182b6d72a7dd02a191f134a41668ceaf0e"
 # Fallback runtime scaffold dir — used only when an agent's vendored
 # ./.runtime-scaffold is missing.
 runtime_scaffold_dir = "~/code/hermes-agent-template/runtime-scaffold"
@@ -45,17 +50,12 @@ symlinked_runtime_skills = [
 ]
 
 [github]
-# Owner of the per-agent runtime repos (creates <owner>/agent-hm-<repo>-<role>).
-runtime_repo_owner = "delorenj"
+# LEGACY INERT COMPATIBILITY METADATA ONLY. Older role manifests may still
+# carry this owner field. Current provisioning does not create, attach,
+# synchronize, restore, archive, or remove runtime storage from this value.
+runtime_repo_owner = ""
 
 [plane]
 # Plane instance base URL and workspace slug (one project per agent).
 base = "https://plane.delo.sh"
 workspace = "33god"
-
-[bloodbank]
-# NATS endpoint the consumer connects to.
-nats_host = "127.0.0.1"
-nats_port = 4222
-# Where the bloodbank docker compose lives (used only for a hint message). ~ ok.
-compose_dir = "~/code/33GOD/bloodbank"

package/templates/hermes-agent/template/.scripts/heartbeat.sh

@@ -8,7 +8,7 @@
 # full pass executes the role's sentinel.prompt.md, which reasons about tickets
 # through the ticket-provider adapter (Linear | Plane | Trello) — never a
 # hardcoded backend. After the sentinel decision (skip OR full), it
-# opportunistically checkpoints the runtime submodule (commit+push) at most once
+# opportunistically checkpoints only legacy nested-Git runtimes at most once
 # per HEARTBEAT_CHECKPOINT_MIN_INTERVAL_SECONDS, so memory/session state stays
 # durable without pushing every minute.
 set -euo pipefail

package/templates/hermes-agent/template/.scripts/lib/ticket-provider.sh

@@ -1,10 +1,10 @@
 # shellcheck shell=bash
-# Ticket-provider adapter dispatcher — the single seam between the heartbeat
+# Ticket-provider adapter dispatcher — the single seam between the Scrum Master
 # sentinel engine and a concrete ticket system (Linear | Plane | Trello).
 #
 # The engine NEVER calls a provider directly. It calls `tp <op> [args...]`,
-# which dispatches to providers/<provider>.sh. Swapping providers is a one-line
-# config change in role.yaml (ticket_provider.name) — no engine edits.
+# which dispatches to providers/<provider>.sh. Repo-root .project.json owns the
+# provider/board binding; role.yaml is only a legacy provider-name fallback.
 #
 # Contract (operations every provider must implement):
 #   resolve                       -> JSON {provider, board_id, board_url}
@@ -12,14 +12,22 @@
 #   list_issues                   -> JSON [ {id,key,title,state,state_type,
 #                                            updated_at,assignee,url}, ... ]
 #   get_issue <id>                -> JSON {id,key,title,description,acceptance,
-#                                          state,state_type,comments:[...]}
+#                                          state,state_type,comments:[...],
+#                                          attachments:[...]}
 #   comment <id> <body>           -> prints comment id
 #   transition <id> <normalized>  -> moves issue; normalized in
-#                                     backlog|unstarted|started|in_review|completed
+#                                     backlog|unstarted|started|in_review|completed|
+#                                     cancelled
 #   create_board <name> <id> <d>  -> JSON {board_id, board_url}
+#   create_issue [--if-absent] <title> [desc]
+#                                 -> JSON {issue_id, key, issue_url, created}
+#                                    Files a new ticket on the bound board.
+#                                    NOT idempotent by default (two issues may
+#                                    share a title); --if-absent reuses an exact
+#                                    title match and reports created:false.
 #
 # Each provider reads its credentials from the environment (see providers/*.sh
-# headers) and the board binding from role.yaml under `ticket_provider:`.
+# headers) and the board binding from repo-root .project.json.
 
 # Resolve the provider name: explicit env wins, then repo-root .project.json
 # (the SOT), then role.yaml (self-parsed so this works even when _lib.sh /
@@ -92,7 +100,7 @@ tp() {
 }
 
 # Normalized states the engine reasons in. Adapters map these to provider terms.
-TP_STATES="backlog unstarted started in_review completed"
+TP_STATES="backlog unstarted started in_review completed cancelled"
 
 tp_is_valid_state() {
   case " $TP_STATES " in

package/templates/hermes-agent/template/.scripts/providers/linear.sh

@@ -6,7 +6,8 @@
 #   name: linear
 #   team:    <TEAM_KEY>          e.g. DEL
 #   project: "<Project name>"    optional; scopes milestone/issue queries
-#   state_map: { in_review: "In Review", completed: "Done" }   optional overrides
+#   state_map: { in_review: "In Review", completed: "Done",
+#                cancelled: "Canceled" }   optional overrides
 #
 # Implements the contract in lib/ticket-provider.sh. All Linear access goes
 # through GraphQL so the same envelope works in unattended runs.
@@ -79,6 +80,7 @@ TEAM="$(pj_cfg team)"; [ -n "$TEAM" ] || TEAM="$(tp_cfg team)"
 PROJECT="$(pj_cfg project)"; [ -n "$PROJECT" ] || PROJECT="$(tp_cfg project)"
 SM_IN_REVIEW="$(tp_cfg in_review)"; SM_IN_REVIEW="${SM_IN_REVIEW:-In Review}"
 SM_DONE="$(tp_cfg completed)"; SM_DONE="${SM_DONE:-Done}"
+SM_CANCELLED="$(tp_cfg cancelled)"; SM_CANCELLED="${SM_CANCELLED:-Canceled}"
 
 # All Linear ops require the API key; fail fast and clean before any pipe.
 need_key
@@ -143,6 +145,7 @@ print(json.dumps({"id":i.get("id",""),"key":i.get("identifier",""),"title":i.get
     # Map normalized -> a concrete Linear state name, then resolve its id on the team.
     case "$TARGET" in
       completed)  WANT_TYPE=completed; WANT_NAME="$SM_DONE" ;;
+      cancelled)  WANT_TYPE=canceled;  WANT_NAME="$SM_CANCELLED" ;;
       in_review)  WANT_TYPE=started;   WANT_NAME="$SM_IN_REVIEW" ;;
       started)    WANT_TYPE=started;   WANT_NAME="" ;;
       unstarted)  WANT_TYPE=unstarted; WANT_NAME="" ;;
@@ -172,5 +175,42 @@ print(("ok " + (u.get("issue") or {}).get("identifier","")) if u.get("success")
     exec sh "$0" resolve
     ;;
 
+  create_issue)
+    # File a new issue on the bound team. Team comes from resolved config, never
+    # from an argument. Deliberately NOT idempotent by default: two issues may
+    # legitimately share a title. Pass --if-absent to reuse an issue whose title
+    # already matches instead.
+    IF_ABSENT=0
+    case "${1:-}" in --if-absent) IF_ABSENT=1; shift ;; esac
+    TITLE="${1:?usage: create_issue [--if-absent] <title> [description]}"; DESC="${2:-}"
+    [ -n "$TEAM" ] || die "ticket_provider.team (Linear team key) not set"
+    ISSUE=""; CREATED=true
+    if [ "$IF_ABSENT" = 1 ]; then
+      ISSUE="$(gql 'query($k:String!,$t:String!){ issues(first:1, filter:{team:{key:{eq:$k}}, title:{eq:$t}}){nodes{id identifier url}} }' \
+          "$(python3 -c 'import json,sys; print(json.dumps({"k":sys.argv[1],"t":sys.argv[2]}))' "$TEAM" "$TITLE")" \
+        | python3 -c 'import sys,json
+ns=((json.load(sys.stdin).get("issues") or {}).get("nodes")) or []
+print(json.dumps(ns[0]) if ns else "")')"
+      [ -z "$ISSUE" ] || CREATED=false
+    fi
+    if [ -z "$ISSUE" ]; then
+      TEAM_ID="$(gql 'query($k:String!){ teams(filter:{key:{eq:$k}}){nodes{id}} }' "$(printf '{"k":"%s"}' "$TEAM")" \
+        | python3 -c 'import sys,json
+ns=((json.load(sys.stdin).get("teams") or {}).get("nodes")) or []
+print(ns[0].get("id","") if ns else "")')"
+      [ -n "$TEAM_ID" ] || die "no Linear team with key '$TEAM'"
+      ISSUE="$(gql 'mutation($team:String!,$t:String!,$d:String){ issueCreate(input:{teamId:$team,title:$t,description:$d}){ success issue{id identifier url} } }' \
+          "$(python3 -c 'import json,sys; print(json.dumps({"team":sys.argv[1],"t":sys.argv[2],"d":sys.argv[3] or None}))' "$TEAM_ID" "$TITLE" "$DESC")" \
+        | python3 -c 'import sys,json
+r=json.load(sys.stdin).get("issueCreate") or {}
+print(json.dumps(r["issue"]) if r.get("success") and r.get("issue") else "")')"
+    fi
+    [ -n "$ISSUE" ] || die "create_issue failed"
+    printf '%s' "$ISSUE" | CREATED="$CREATED" python3 -c 'import sys,json,os
+i=json.load(sys.stdin)
+print(json.dumps({"issue_id":i.get("id",""),"key":i.get("identifier",""),
+                  "issue_url":i.get("url",""),"created":os.environ["CREATED"]=="true"}))'
+    ;;
+
   *) die "unknown op: $OP" ;;
 esac