@enrichlayer/el-linear 1.10.0 → 1.15.0

package/dist/utils/sanitize-for-log.js

@@ -0,0 +1,38 @@
+/**
+ * Strip anything that looks like a Linear API/OAuth token from a string.
+ *
+ * Defense in depth: today the @linear/sdk error message embeds `{ query,
+ * variables }` but not the Authorization header. A future SDK upgrade that
+ * includes headers (which upstream graphql-request has done historically)
+ * would otherwise silently write `Bearer lin_api_…` into stdout, shell
+ * history, or CI logs. The regex also catches token shapes that may show
+ * up in custom error wrappers — e.g. a network proxy that echoes the
+ * Bearer header in its 502 body.
+ *
+ * Originally lived in `commands/init/token.ts` for the wizard's error
+ * formatting. Hoisted to `utils/` so the central error path
+ * (`output.ts`'s `outputError`) can use it too — that path runs on
+ * every non-wizard CLI invocation. `init/token.ts` re-exports the
+ * symbol so existing imports under `init/` keep working.
+ *
+ * The OAuth token-exchange / refresh / revoke paths also call this
+ * function at source (`auth/oauth-token.ts`'s `postForm` + `revokeToken`,
+ * `auth/token-resolver.ts`'s refresh-failure rewrap) so a future caller
+ * that catches+rethrows or logs mid-chain can't leak a token before the
+ * error reaches `outputError`. Defense in depth (DEV-4065).
+ */
+// Personal-API tokens (`lin_api_…`) and OAuth access/refresh tokens
+// (`lin_oauth_…`).
+const TOKEN_PREFIX_RE = /lin_(api|oauth)_[A-Za-z0-9_-]{16,}/g;
+// High-entropy bearer payload fallback: catches generic Bearer-style
+// strings adjacent to Authorization / Bearer keywords. Useful for
+// future SDK error wrappers that might leak headers without the
+// `lin_` prefix.
+const BEARER_PAYLOAD_RE = /(\b(?:Authorization|Bearer)\b[:\s]*)([A-Za-z0-9_\-/+=]{40,})/gi;
+export function sanitizeForLog(text) {
+    return text
+        .replace(TOKEN_PREFIX_RE, (m) => m.startsWith("lin_oauth_")
+        ? "lin_oauth_***REDACTED***"
+        : "lin_api_***REDACTED***")
+        .replace(BEARER_PAYLOAD_RE, "$1***REDACTED***");
+}

package/dist/utils/table-formatter.js

@@ -86,6 +86,19 @@ const ALL_COLUMNS = {
             return atIdx > 0 ? name.slice(0, atIdx) : name;
         },
     },
+    delegate: {
+        key: "delegate",
+        header: "Delegate",
+        width: 20,
+        extract: (i) => {
+            if (!i.delegate) {
+                return "—";
+            }
+            const name = i.delegate.name;
+            const atIdx = name.indexOf("@");
+            return atIdx > 0 ? name.slice(0, atIdx) : name;
+        },
+    },
     project: {
         key: "project",
         header: "Project",
@@ -229,6 +242,17 @@ const MD_COLUMNS = {
             return atIdx > 0 ? name.slice(0, atIdx) : name;
         },
     },
+    delegate: {
+        header: "Delegate",
+        extract: (i) => {
+            if (!i.delegate) {
+                return "—";
+            }
+            const name = i.delegate.name;
+            const atIdx = name.indexOf("@");
+            return atIdx > 0 ? name.slice(0, atIdx) : name;
+        },
+    },
     project: {
         header: "Project",
         extract: (i) => i.project?.name ?? "—",

package/dist/utils/validators.d.ts

@@ -1,3 +1,4 @@
+import type { LinearPriority } from "../types/linear.js";
 export declare function parsePositiveInt(value: string, flagName: string): number;
 /**
  * Parse a single priority value (for `issues create --priority`, `issues update --priority`).
@@ -5,8 +6,12 @@ export declare function parsePositiveInt(value: string, flagName: string): numbe
  * Accepts:
  *   - keywords:  none | urgent | high | medium | normal | low
  *   - numbers:   0 (no priority), 1 (urgent), 2 (high), 3 (medium), 4 (low)
+ *
+ * Narrows arbitrary string input to the `LinearPriority` literal union so
+ * downstream call sites get type-level guarantees that the value is in
+ * range — no `as 0 | 1 | 2 | 3 | 4` cast at the boundary.
  */
-export declare function validatePriority(value: string): number;
+export declare function validatePriority(value: string): LinearPriority;
 export declare function validateHexColor(value: string): string;
 export declare function validateIsoDate(value: string): string;
 /**
@@ -18,5 +23,5 @@ export declare function validateIsoDate(value: string): string;
  * resolve to `[]`.
  */
 export declare function splitList(value: string | undefined | null | false): string[];
-export declare function parsePriorityFilter(value: string): number[];
+export declare function parsePriorityFilter(value: string): LinearPriority[];
 export declare const PRIORITY_LABELS: Record<number, string>;

package/dist/utils/validators.js

@@ -14,6 +14,10 @@ export function parsePositiveInt(value, flagName) {
  * Accepts:
  *   - keywords:  none | urgent | high | medium | normal | low
  *   - numbers:   0 (no priority), 1 (urgent), 2 (high), 3 (medium), 4 (low)
+ *
+ * Narrows arbitrary string input to the `LinearPriority` literal union so
+ * downstream call sites get type-level guarantees that the value is in
+ * range — no `as 0 | 1 | 2 | 3 | 4` cast at the boundary.
  */
 export function validatePriority(value) {
     const asName = PRIORITY_NAMES[value.toLowerCase()];
@@ -24,6 +28,8 @@ export function validatePriority(value) {
     if (Number.isNaN(n) || n < 0 || n > 4) {
         throw invalidParameterError("--priority", `"${value}" is not valid. Use names (none, urgent, high, medium/normal, low) or numbers (0-4).`);
     }
+    // The 0-4 range check above is what narrows `n` to LinearPriority;
+    // TypeScript can't infer that automatically.
     return n;
 }
 export function validateHexColor(value) {

package/dist/utils/workspace-url.js

@@ -29,18 +29,33 @@ const VIEWER_ORG_URL_KEY_QUERY = /* GraphQL */ `
   }
 `;
 const WORKSPACE_URL_KEY_ENV = "EL_LINEAR_WORKSPACE_URL_KEY";
+// Linear workspace URL keys are URL-safe slugs. The Linear API itself
+// validates this shape (`viewerIsValid` in init/token.ts uses the same
+// regex). Applying the check on env + config reads closes the gap where
+// a malformed key (`EL_LINEAR_WORKSPACE_URL_KEY=" javascript:alert(1)#"`)
+// would otherwise flow into markdown link URLs verbatim. Live-API path
+// is already trusted because the value comes from `viewer.organization`.
+// DEV-4067.
+const VALID_URL_KEY_RE = /^[a-z0-9-]+$/i;
+function validateUrlKey(value, source) {
+    if (!VALID_URL_KEY_RE.test(value)) {
+        throw new Error(`Invalid Linear workspace URL key from ${source}: ${JSON.stringify(value)}. ` +
+            "Must match /^[a-z0-9-]+$/i (e.g. 'verticalint').");
+    }
+    return value;
+}
 let cachedUrlKey;
 export async function getWorkspaceUrlKey(graphQLService, options = {}) {
     // 1. Per-invocation override — highest priority.
     if (options.override) {
-        return options.override;
+        return validateUrlKey(options.override, "--workspace-url-key flag");
     }
     // 2. Env var. Read on every call (cheap; lets tests/CI flip the value
     //    mid-process without restarting). Not cached, so a test that sets
     //    EL_LINEAR_WORKSPACE_URL_KEY then unsets it sees the unset state.
     const envKey = process.env[WORKSPACE_URL_KEY_ENV];
     if (envKey) {
-        return envKey;
+        return validateUrlKey(envKey, `${WORKSPACE_URL_KEY_ENV} env var`);
     }
     // Layers 3-4 are cached in-process — config and the live lookup are
     // both stable for the CLI invocation's lifetime.
@@ -50,8 +65,9 @@ export async function getWorkspaceUrlKey(graphQLService, options = {}) {
     // 3. Config override.
     const { workspaceUrlKey } = loadConfig();
     if (workspaceUrlKey) {
-        cachedUrlKey = workspaceUrlKey;
-        return workspaceUrlKey;
+        const validated = validateUrlKey(workspaceUrlKey, "config.workspaceUrlKey");
+        cachedUrlKey = validated;
+        return validated;
     }
     // 4. Live API lookup — requires a GraphQL service.
     if (!graphQLService) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@enrichlayer/el-linear",
-  "version": "1.10.0",
+  "version": "1.15.0",
   "description": "A pragmatic CLI for Linear.app — deterministic team/label/member resolution, structured issue validation, configurable term enforcement, and a GraphQL escape hatch.",
   "main": "dist/main.js",
   "types": "dist/main.d.ts",
@@ -47,7 +47,7 @@
   },
   "dependencies": {
     "@inquirer/prompts": "^8.4.2",
-    "@linear/sdk": "^83.0.0",
+    "@linear/sdk": "^84.0.0",
     "commander": "^14.0.0",
     "picocolors": "^1.1.1"
   },