@enrichlayer/el-linear 1.10.0 → 1.15.0

package/dist/utils/linear-service.js

@@ -4,6 +4,7 @@ import { resolveUserDisplayName } from "../config/resolver.js";
 import { toISOStringOrNow, toISOStringOrUndefined } from "./date-format.js";
 import { multipleMatchesError, notFoundError } from "./error-messages.js";
 import { parseIssueIdentifier } from "./identifier-parser.js";
+import { parseProjectSlugId } from "./project-slug.js";
 import { isUuid } from "./uuid.js";
 const DEFAULT_CYCLE_PAGINATION_LIMIT = 250;
 // The Linear SDK types don't accept string orderBy values, but the API does.
@@ -22,9 +23,6 @@ function nonEmptyFilter(filter) {
     return Object.keys(filter).length > 0 ? filter : undefined;
 }
 function buildLinearClient(auth) {
-    if (typeof auth === "string") {
-        return new LinearClient({ apiKey: auth });
-    }
     if ("oauthToken" in auth) {
         // Linear's SDK natively supports OAuth via the `accessToken` option,
         // which causes the underlying transport to send
@@ -133,13 +131,28 @@ export class LinearService {
         else if (options.excludeStates && options.excludeStates.length > 0) {
             filter.state = { nin: options.excludeStates };
         }
-        const projects = await this.client.projects({
+        if (options.teamId) {
+            filter.teams = { some: { id: { eq: options.teamId } } };
+        }
+        // `limit === 0` means "no limit" — paginate the full result set.
+        // Otherwise a single page of `limit` projects. DEV-4175: `--all` /
+        // `--limit 0` must return every project so callers never make a false
+        // "does not exist" determination off a silently truncated page.
+        const unlimited = limit === 0;
+        let page = await this.client.projects({
             filter: nonEmptyFilter(filter),
-            first: limit,
+            first: unlimited ? 250 : limit,
             orderBy: sdkOrderBy("updatedAt"),
             includeArchived: false,
         });
-        const projectsWithData = await Promise.all(projects.nodes.map(async (project) => {
+        const projectNodes = [...page.nodes];
+        if (unlimited) {
+            while (page.pageInfo.hasNextPage) {
+                page = await page.fetchNext();
+                projectNodes.push(...page.nodes);
+            }
+        }
+        const projectsWithData = await Promise.all(projectNodes.map(async (project) => {
             const [teams, lead] = await Promise.all([
                 project.teams(),
                 project.lead,
@@ -373,6 +386,9 @@ export class LinearService {
                 url: issue.url,
                 title: issue.title,
                 description: issue.description || undefined,
+                // Linear SDK types `priority` as `number`; the GraphQL schema only
+                // emits 0-4, so the cast is safe and the runtime range is
+                // guaranteed by Linear's server-side schema.
                 priority: issue.priority,
                 estimate: issue.estimate || undefined,
                 state: state ? { id: state.id, name: state.name } : undefined,
@@ -455,20 +471,66 @@ export class LinearService {
         }
         return chosen.id;
     }
-    async resolveProjectId(projectNameOrId) {
-        if (isUuid(projectNameOrId)) {
-            return projectNameOrId;
+    async resolveProjectId(projectInput) {
+        if (isUuid(projectInput)) {
+            return projectInput;
+        }
+        const slugId = parseProjectSlugId(projectInput);
+        if (slugId) {
+            // `as Record<string, unknown>` — `@linear/sdk`'s typed ProjectFilter
+            // lags Linear's schema and doesn't yet expose `slugId`. The field is
+            // present on the server; the cast is here until the SDK ships the
+            // typing. Don't "clean up" without verifying the typed shape exists.
+            //
+            // `includeArchived: true` — URLs in the wild often point at archived
+            // projects (someone digs up an old link); silently 404-ing them is
+            // worse than resolving to an archived project, which the caller can
+            // inspect via the returned UUID. Name resolution stays active-only
+            // because names collide more readily than slug-ids do.
+            const bySlug = await this.client.projects({
+                filter: { slugId: { eq: slugId } },
+                first: 1,
+                includeArchived: true,
+            });
+            if (bySlug.nodes.length > 0) {
+                return bySlug.nodes[0].id;
+            }
+            // Slug-id form was syntactically valid but didn't match a project
+            // — fall through to name resolution would be misleading (the user
+            // clearly pasted a URL/slug, not a name). Throw the same shape of
+            // not-found error as the name path.
+            throw notFoundError("Project", projectInput);
         }
-        const filter = { name: { eqIgnoreCase: projectNameOrId } };
+        const filter = { name: { eqIgnoreCase: projectInput } };
         const projectsConnection = await this.client.projects({
             filter,
             first: 1,
         });
         if (projectsConnection.nodes.length === 0) {
-            throw notFoundError("Project", projectNameOrId);
+            throw notFoundError("Project", projectInput);
         }
         return projectsConnection.nodes[0].id;
     }
+    /**
+     * Normalize a user-supplied project input to a UUID when the input is
+     * a URL or slug-id form. Pass-through for UUIDs and plain names — the
+     * latter stays a name so downstream batch-resolve queries can fold the
+     * lookup into their single round-trip.
+     *
+     * Used by callers that route project resolution through a separate
+     * batch-resolve step (e.g. `GraphqlIssuesService.createIssue`) — they
+     * can pre-normalize URL/slug inputs to UUIDs so the batch query's
+     * `name eqIgnoreCase` filter doesn't have to learn the URL/slug shape.
+     */
+    async normalizeProjectInput(projectInput) {
+        if (isUuid(projectInput)) {
+            return projectInput;
+        }
+        if (parseProjectSlugId(projectInput)) {
+            return this.resolveProjectId(projectInput);
+        }
+        return projectInput;
+    }
 }
 export async function createLinearService(options) {
     const auth = await getActiveAuth(options);

package/dist/utils/markdown-prosemirror.js

@@ -88,7 +88,7 @@ function parseFencedCodeBlock(state, line) {
         attrs.language = language;
     }
     state.content.push({
-        type: "codeBlock",
+        type: "code_block",
         ...(Object.keys(attrs).length > 0 ? { attrs } : {}),
         content: codeLines.length > 0
             ? [{ type: "text", text: codeLines.join("\n") }]
@@ -100,7 +100,7 @@ function parseHorizontalRule(state, line) {
     if (!HR_RE.test(line)) {
         return false;
     }
-    state.content.push({ type: "horizontalRule" });
+    state.content.push({ type: "horizontal_rule" });
     state.i++;
     return true;
 }
@@ -128,12 +128,12 @@ function parseBulletList(state, line) {
             break;
         }
         items.push({
-            type: "listItem",
+            type: "list_item",
             content: [{ type: "paragraph", content: parseInline(m[1]) }],
         });
         state.i++;
     }
-    state.content.push({ type: "bulletList", content: items });
+    state.content.push({ type: "bullet_list", content: items });
     return true;
 }
 function parseOrderedList(state, line) {
@@ -147,12 +147,12 @@ function parseOrderedList(state, line) {
             break;
         }
         items.push({
-            type: "listItem",
+            type: "list_item",
             content: [{ type: "paragraph", content: parseInline(m[1]) }],
         });
         state.i++;
     }
-    state.content.push({ type: "orderedList", content: items });
+    state.content.push({ type: "ordered_list", content: items });
     return true;
 }
 function parseBlockquote(state) {
@@ -217,9 +217,9 @@ function parseTable(state, line) {
     const headerCells = splitTableRow(rowMatch[1]);
     const cols = headerCells.length;
     rows.push({
-        type: "tableRow",
+        type: "table_row",
         content: headerCells.map((cell) => ({
-            type: "tableHeader",
+            type: "table_header",
             content: [{ type: "paragraph", content: cellContent(cell) }],
         })),
     });
@@ -238,9 +238,9 @@ function parseTable(state, line) {
         }
         cells.length = cols;
         rows.push({
-            type: "tableRow",
+            type: "table_row",
             content: cells.map((cell) => ({
-                type: "tableCell",
+                type: "table_cell",
                 content: [{ type: "paragraph", content: cellContent(cell) }],
             })),
         });
@@ -327,7 +327,7 @@ function findEarliestInlineMatch(text) {
             index: boldMatch.index ?? 0,
             length: boldMatch[0].length,
             innerText: boldMatch[1] ?? boldMatch[2],
-            marks: [{ type: "bold" }],
+            marks: [{ type: "strong" }],
         });
     }
     const italicMatch = text.match(INLINE_ITALIC_RE);
@@ -336,7 +336,7 @@ function findEarliestInlineMatch(text) {
             index: italicMatch.index ?? 0,
             length: italicMatch[0].length,
             innerText: italicMatch[1] ?? italicMatch[2],
-            marks: [{ type: "italic" }],
+            marks: [{ type: "em" }],
         });
     }
     if (candidates.length === 0) {

package/dist/utils/mention-resolver.js

@@ -146,7 +146,7 @@ function injectMentions(doc, explicit, bare) {
     return {
         ...doc,
         content: doc.content.map((node) => {
-            if (node.content && node.type !== "codeBlock") {
+            if (node.content && node.type !== "code_block") {
                 const processed = injectMentions(node, explicit, bare);
                 if (node.type === "paragraph" || node.type === "heading") {
                     return {

package/dist/utils/output.d.ts

@@ -1,13 +1,91 @@
-export type OutputFormat = "json" | "summary";
+type OutputFormat = "json" | "summary";
 export declare function setRawMode(enabled: boolean): void;
 export declare function setJqFilter(filter: string | null): void;
 export declare function setFieldsFilter(fields: string[] | null): void;
 export declare function setOutputFormat(format: OutputFormat): void;
 /** @internal Test seam — consumers should not depend on the format state. */
 export declare function getOutputFormat(): OutputFormat;
+/**
+ * Resource-specific extra metadata that may be added to a list response
+ * alongside the canonical `count` (e.g. `query` on search, `team` on
+ * filtered list). Excludes `count` at the type level — callers can't
+ * accidentally pass a string `count` and have it silently overridden;
+ * the only way to set `count` is via `data.length` inside `outputList`.
+ *
+ * Implementation note: `count?: never` together with `Record<string, unknown>`
+ * lets TypeScript accept any other key while disallowing the literal
+ * `count` key. The `never`-typed property is impossible to assign, which
+ * is what we want for the "no count here" contract.
+ */
+export type ListExtraMeta = Record<string, unknown> & {
+    count?: never;
+};
+/**
+ * Metadata envelope for list responses. Always includes `count`; resources
+ * may add their own keys (e.g. `query` on search, `team` on filtered list).
+ *
+ * `meta.count` is the cardinality of `data[]` — downstream `jq` pipelines
+ * read it both for emptiness checks (`.meta.count == 0`) and for the
+ * actual magnitude (e.g. logging "found N issues"). A boolean isEmpty
+ * would lose the magnitude signal, so `count: number` stays.
+ */
+export interface ListMeta extends Record<string, unknown> {
+    count: number;
+}
+/**
+ * Canonical JSON envelope for a list response. Pre-DEV-4068 T6, every
+ * call site built this object literal inline and `outputSuccess(data:
+ * unknown)` accepted it without type-checking. Use `outputList<T>` to
+ * route a list through the same emit path with a real per-element type
+ * (so e.g. `data: T[]` and `--fields` consumers stay in lock-step).
+ */
+export interface CliListEnvelope<T> {
+    data: T[];
+    meta: ListMeta;
+}
+/**
+ * Typed wrapper around `outputSuccess` for list responses — builds the
+ * `{ data, meta: { count, ...extraMeta } }` envelope and emits it. The
+ * 81 existing inline `outputSuccess({ data, meta: { count, ... } })`
+ * call sites can migrate to this incrementally; both go through the
+ * same `outputSuccess` emit path so JSON / summary / --raw / --fields /
+ * --jq behavior is identical.
+ *
+ * @param data    The array payload.
+ * @param extraMeta Optional resource-specific meta keys (e.g. `query`,
+ *                  `team`). The type excludes `count` — `count` is
+ *                  always computed from `data.length` to preserve the
+ *                  wire-contract invariant.
+ */
+export declare function outputList<T>(data: T[], extraMeta?: ListExtraMeta): void;
+/**
+ * Typed wrapper around `outputSuccess` for a single-resource response.
+ * Pure passthrough — the envelope contract for single resources is just
+ * the resource object itself (no `data`/`meta` wrapping). Same emit
+ * path as `outputSuccess` and `outputList`; this overload exists so
+ * call sites can document their intent at the type level.
+ *
+ * The conditional return type rejects array inputs at the type level —
+ * a caller that meant `outputList` and passed an array gets a compile
+ * error pointing them at the right helper. Runtime behavior on an array
+ * is unchanged (it'd still emit JSON), but the type catches the foot-gun.
+ */
+export declare function outputSingle<T>(data: T extends readonly unknown[] ? "outputSingle does not accept arrays — use outputList(data) instead" : T): void;
 export declare function outputSuccess(data: unknown): void;
+/**
+ * Emit a `results_truncated` warning when a list command's result count
+ * equals the requested `--limit`, signaling to the caller (typically an
+ * AI agent) that more results may exist beyond the page. Heuristic, not
+ * exact — `length === limit` has a false-positive when the workspace
+ * happens to hold exactly `limit` matching items. Accurate `hasNextPage`
+ * would require widening every list-service return type; deferred until
+ * a caller cares about the false-positive rate.
+ *
+ * Message includes a concrete next-step (suggested `--limit` is 2× the
+ * current limit) so the agent doesn't have to derive it.
+ */
+export declare function warnIfTruncated(count: number, limit: number): void;
 export declare function outputWarning(message: string | string[]): void;
 export declare function resetWarnings(): void;
-/** @internal Test seam — call between tests that toggle `setOutputFormat`. */
-export declare function resetOutputFormat(): void;
 export declare function handleAsyncCommand<TArgs extends unknown[]>(asyncFn: (...args: TArgs) => Promise<void>): (...args: TArgs) => Promise<void>;
+export {};

package/dist/utils/output.js

@@ -1,6 +1,7 @@
 import { execFileSync } from "node:child_process";
 import { dispatch as dispatchSummary, inferKindFromPayload, } from "./formatters/summary.js";
 import { logger } from "./logger.js";
+import { sanitizeForLog } from "./sanitize-for-log.js";
 const warningBuffer = [];
 let rawMode = false;
 let jqFilter = null;
@@ -50,6 +51,40 @@ function filterFields(obj, fields) {
 function emitSummary(payload, kind) {
     logger.info(dispatchSummary(kind, payload));
 }
+/**
+ * Typed wrapper around `outputSuccess` for list responses — builds the
+ * `{ data, meta: { count, ...extraMeta } }` envelope and emits it. The
+ * 81 existing inline `outputSuccess({ data, meta: { count, ... } })`
+ * call sites can migrate to this incrementally; both go through the
+ * same `outputSuccess` emit path so JSON / summary / --raw / --fields /
+ * --jq behavior is identical.
+ *
+ * @param data    The array payload.
+ * @param extraMeta Optional resource-specific meta keys (e.g. `query`,
+ *                  `team`). The type excludes `count` — `count` is
+ *                  always computed from `data.length` to preserve the
+ *                  wire-contract invariant.
+ */
+export function outputList(data, extraMeta) {
+    const meta = { ...extraMeta, count: data.length };
+    const envelope = { data, meta };
+    outputSuccess(envelope);
+}
+/**
+ * Typed wrapper around `outputSuccess` for a single-resource response.
+ * Pure passthrough — the envelope contract for single resources is just
+ * the resource object itself (no `data`/`meta` wrapping). Same emit
+ * path as `outputSuccess` and `outputList`; this overload exists so
+ * call sites can document their intent at the type level.
+ *
+ * The conditional return type rejects array inputs at the type level —
+ * a caller that meant `outputList` and passed an array gets a compile
+ * error pointing them at the right helper. Runtime behavior on an array
+ * is unchanged (it'd still emit JSON), but the type catches the foot-gun.
+ */
+export function outputSingle(data) {
+    outputSuccess(data);
+}
 export function outputSuccess(data) {
     const warnings = drainWarnings();
     let output;
@@ -120,6 +155,25 @@ export function outputSuccess(data) {
         logger.info(JSON.stringify(output, null, 2));
     }
 }
+/**
+ * Emit a `results_truncated` warning when a list command's result count
+ * equals the requested `--limit`, signaling to the caller (typically an
+ * AI agent) that more results may exist beyond the page. Heuristic, not
+ * exact — `length === limit` has a false-positive when the workspace
+ * happens to hold exactly `limit` matching items. Accurate `hasNextPage`
+ * would require widening every list-service return type; deferred until
+ * a caller cares about the false-positive rate.
+ *
+ * Message includes a concrete next-step (suggested `--limit` is 2× the
+ * current limit) so the agent doesn't have to derive it.
+ */
+export function warnIfTruncated(count, limit) {
+    if (count !== limit) {
+        return;
+    }
+    outputWarning(`results_truncated: returned ${count} matching --limit ${limit}; more results may exist. ` +
+        `Re-run with --limit ${limit * 2} (or narrow via filters like --name, --state, --team) to verify.`);
+}
 export function outputWarning(message) {
     const messages = Array.isArray(message) ? message : [message];
     for (const msg of messages) {
@@ -136,17 +190,18 @@ function drainWarnings() {
 export function resetWarnings() {
     warningBuffer.length = 0;
 }
-/** @internal Test seam — call between tests that toggle `setOutputFormat`. */
-export function resetOutputFormat() {
-    outputFormat = "json";
-}
 function outputError(error) {
-    const payload = JSON.stringify({ error: error.message }, null, 2);
+    // Run the message and stack through sanitizeForLog so a future SDK
+    // upgrade (or proxy/MITM error body) that embeds `lin_api_…` /
+    // `lin_oauth_…` / `Bearer <payload>` in error text can't leak a token
+    // into stdout, shell history, or CI logs. The wizard already sanitizes
+    // its own log paths; this is the central error path on every command.
+    const payload = JSON.stringify({ error: sanitizeForLog(error.message) }, null, 2);
     // Write to stdout (same channel as success) so machine callers always
     // receive exactly one parseable JSON object regardless of stream capture.
     logger.info(payload);
     if (process.env.EL_LINEAR_DEBUG ?? process.env.LINCTL_DEBUG) {
-        logger.error(error.stack ?? "");
+        logger.error(sanitizeForLog(error.stack ?? ""));
     }
     process.exit(1);
 }

package/dist/utils/project-slug.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Parse a Linear project URL or bare slug-id into the `slugId` form that
+ * Linear's GraphQL `ProjectFilter.slugId` accepts.
+ *
+ * Linear project URLs look like:
+ *   https://linear.app/<workspace>/project/<slug>-<12-hex>/<view>
+ *
+ * The slug-id is the `<slug>-<12-hex>` segment (kebab-case name followed
+ * by a 12-character hex suffix). Linear uses this exact string as the
+ * unique `slugId` field on the Project type.
+ *
+ * Accepts:
+ *   - Full URL form: extracts the slug-id from the path
+ *   - Bare slug-id: `tools-and-standardization-40815d9beb16`
+ *   - Trailing path / query string is tolerated (`/overview`, `?foo=bar`)
+ *
+ * Returns `null` when the input is neither — caller can then fall through
+ * to name-based or UUID-based resolution. Canonical UUIDs are rejected
+ * here so that `isUuid()` callers stay the authoritative UUID path.
+ */
+export declare function parseProjectSlugId(input: string): string | null;

package/dist/utils/project-slug.js

@@ -0,0 +1,45 @@
+import { isUuid } from "./uuid.js";
+/**
+ * Parse a Linear project URL or bare slug-id into the `slugId` form that
+ * Linear's GraphQL `ProjectFilter.slugId` accepts.
+ *
+ * Linear project URLs look like:
+ *   https://linear.app/<workspace>/project/<slug>-<12-hex>/<view>
+ *
+ * The slug-id is the `<slug>-<12-hex>` segment (kebab-case name followed
+ * by a 12-character hex suffix). Linear uses this exact string as the
+ * unique `slugId` field on the Project type.
+ *
+ * Accepts:
+ *   - Full URL form: extracts the slug-id from the path
+ *   - Bare slug-id: `tools-and-standardization-40815d9beb16`
+ *   - Trailing path / query string is tolerated (`/overview`, `?foo=bar`)
+ *
+ * Returns `null` when the input is neither — caller can then fall through
+ * to name-based or UUID-based resolution. Canonical UUIDs are rejected
+ * here so that `isUuid()` callers stay the authoritative UUID path.
+ */
+export function parseProjectSlugId(input) {
+    const trimmed = input.trim();
+    if (!trimmed || isUuid(trimmed)) {
+        return null;
+    }
+    const urlMatch = trimmed.match(/\blinear\.app\/[^/\s]+\/project\/([^/?#\s]+)/i);
+    if (urlMatch) {
+        const candidate = urlMatch[1];
+        return looksLikeSlugId(candidate) ? candidate : null;
+    }
+    if (looksLikeSlugId(trimmed)) {
+        return trimmed;
+    }
+    return null;
+}
+/**
+ * A Linear project slug-id is a kebab-case name segment followed by a
+ * 12-character hex suffix. The minimum form is just the 12 hex chars
+ * (when the project name slugifies to empty), but in practice there's
+ * always at least one name segment.
+ */
+function looksLikeSlugId(value) {
+    return /^[a-z0-9]+(?:-[a-z0-9]+)*-[a-f0-9]{12}$/i.test(value);
+}

package/dist/utils/protected-ranges.d.ts

@@ -17,6 +17,20 @@
  */
 /** Linear identifier shape: ABC-123, EMW-1, DEV-3592. */
 export declare const IDENTIFIER_REGEX: RegExp;
+/**
+ * Find the first position in `s` where a close-bracket character
+ * appears without a matching opener earlier in the string. Returns
+ * `s.length` if all close-brackets are balanced. Used to truncate
+ * a bare-URL match at the first unbalanced `)`, `]`, or `}` —
+ * exactly the position CommonMark treats as the URL terminator.
+ *
+ * Exported for direct unit testing. Depth counters per bracket type
+ * are independent — pathological interleavings like `[(a]b)` don't
+ * trigger an unbalance, which errs toward keeping a URL whole rather
+ * than over-truncating (no real-world URL nests bracket types this
+ * way).
+ */
+export declare function firstUnbalancedClose(s: string): number;
 export interface ProtectedRange {
     end: number;
     start: number;

package/dist/utils/protected-ranges.js

@@ -33,7 +33,87 @@ const ANGLE_AUTOLINK_REGEX = /<[^>\s]+>/g;
 // Bare URLs in prose. We protect these so identifiers inside path
 // components (e.g. "https://github.com/foo/DEV-100") don't get
 // processed.
-const BARE_URL_REGEX = /https?:\/\/\S+/g;
+//
+// Match strategy follows CommonMark's "extended autolink" rule:
+//
+// 1. Greedy match up to whitespace or angle/quote terminators
+//    (`<`, `>`, `"`). Parens and brackets stay IN the match — they
+//    appear inside legitimate URLs (Wikipedia article paths, Next.js
+//    route groups like `/docs/app/(group)/page`, CDN signing-key
+//    query strings, etc.).
+// 2. Post-process via `trimBareUrlTrailingPunct` to strip UNBALANCED
+//    trailing brackets and stand-alone punctuation. So
+//    `https://example.com/foo)DEV-100` correctly terminates at
+//    `…foo` (the closing paren is unbalanced — no opener inside the
+//    match), while `https://en.wikipedia.org/wiki/Foo_(bar)` keeps
+//    its balanced parens intact.
+//
+// Pre-fix `https?:\/\/\S+` greedily consumed everything to the next
+// whitespace and silently hid identifiers in position-dependent
+// prose. A char-class exclusion of `)`, `]`, `}` over-corrected and
+// broke Wikipedia / route-group URLs (cycle 2 finding on PR #75).
+// The balanced-paren trim is the CommonMark-faithful middle ground.
+const BARE_URL_REGEX = /https?:\/\/[^\s<>"]+/g;
+/**
+ * Find the first position in `s` where a close-bracket character
+ * appears without a matching opener earlier in the string. Returns
+ * `s.length` if all close-brackets are balanced. Used to truncate
+ * a bare-URL match at the first unbalanced `)`, `]`, or `}` —
+ * exactly the position CommonMark treats as the URL terminator.
+ *
+ * Exported for direct unit testing. Depth counters per bracket type
+ * are independent — pathological interleavings like `[(a]b)` don't
+ * trigger an unbalance, which errs toward keeping a URL whole rather
+ * than over-truncating (no real-world URL nests bracket types this
+ * way).
+ */
+export function firstUnbalancedClose(s) {
+    let parenDepth = 0;
+    let brackDepth = 0;
+    let braceDepth = 0;
+    for (let i = 0; i < s.length; i++) {
+        const ch = s[i];
+        if (ch === "(")
+            parenDepth++;
+        else if (ch === ")") {
+            if (parenDepth === 0)
+                return i;
+            parenDepth--;
+        }
+        else if (ch === "[")
+            brackDepth++;
+        else if (ch === "]") {
+            if (brackDepth === 0)
+                return i;
+            brackDepth--;
+        }
+        else if (ch === "{")
+            braceDepth++;
+        else if (ch === "}") {
+            if (braceDepth === 0)
+                return i;
+            braceDepth--;
+        }
+    }
+    return s.length;
+}
+function trimBareUrlTrailingPunct(url) {
+    // First: truncate at the first unbalanced bracket. So
+    // `https://example.com/foo)DEV-100` (no `(` opener inside) terminates
+    // at the `)` regardless of what follows it; `Foo_(bar)/DEV` keeps
+    // the balanced `(bar)` intact.
+    let trimmed = url.slice(0, firstUnbalancedClose(url));
+    // Then: strip standard trailing sentence-terminators (`.`, `,`, `;`,
+    // `:`, `!`, `?`). These never appear in legitimate URL paths at the
+    // very end, but they're commonly adjacent to URLs in prose. The
+    // char class deliberately excludes `)`, `]`, `}` — those are
+    // already handled by firstUnbalancedClose above, where the
+    // balanced/unbalanced check lives.
+    while (trimmed.length > 0 && /[.,;:!?]$/.test(trimmed)) {
+        trimmed = trimmed.slice(0, -1);
+    }
+    return trimmed;
+}
 /**
  * Find ranges of `text` that should NOT have identifiers processed.
  * Covered: fenced code, inline backticks, existing markdown links,
@@ -54,13 +134,19 @@ export function findProtectedRanges(text) {
         // clarity here.
         SLACK_LINK_REGEX,
         ANGLE_AUTOLINK_REGEX,
-        BARE_URL_REGEX,
     ]) {
         for (const m of text.matchAll(re)) {
             const start = m.index ?? 0;
             ranges.push({ start, end: start + m[0].length });
         }
     }
+    // Bare URLs need the trailing-punctuation trim that's hard to express
+    // in pure regex (depends on bracket-balance inside the match).
+    for (const m of text.matchAll(BARE_URL_REGEX)) {
+        const start = m.index ?? 0;
+        const trimmed = trimBareUrlTrailingPunct(m[0]);
+        ranges.push({ start, end: start + trimmed.length });
+    }
     return ranges;
 }
 export function isProtected(pos, ranges) {

package/dist/utils/sanitize-for-log.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Strip anything that looks like a Linear API/OAuth token from a string.
+ *
+ * Defense in depth: today the @linear/sdk error message embeds `{ query,
+ * variables }` but not the Authorization header. A future SDK upgrade that
+ * includes headers (which upstream graphql-request has done historically)
+ * would otherwise silently write `Bearer lin_api_…` into stdout, shell
+ * history, or CI logs. The regex also catches token shapes that may show
+ * up in custom error wrappers — e.g. a network proxy that echoes the
+ * Bearer header in its 502 body.
+ *
+ * Originally lived in `commands/init/token.ts` for the wizard's error
+ * formatting. Hoisted to `utils/` so the central error path
+ * (`output.ts`'s `outputError`) can use it too — that path runs on
+ * every non-wizard CLI invocation. `init/token.ts` re-exports the
+ * symbol so existing imports under `init/` keep working.
+ *
+ * The OAuth token-exchange / refresh / revoke paths also call this
+ * function at source (`auth/oauth-token.ts`'s `postForm` + `revokeToken`,
+ * `auth/token-resolver.ts`'s refresh-failure rewrap) so a future caller
+ * that catches+rethrows or logs mid-chain can't leak a token before the
+ * error reaches `outputError`. Defense in depth (DEV-4065).
+ */
+export declare function sanitizeForLog(text: string): string;