@enrichlayer/el-linear 1.4.0 → 1.6.0

package/dist/auth/oauth-storage.js

@@ -0,0 +1,87 @@
+/**
+ * On-disk storage for OAuth tokens.
+ *
+ * Stored at `<active-profile-dir>/oauth.json` with mode 0600 — same security
+ * posture as the personal-token file. Schema is versioned (`v: 1`) so future
+ * changes can be migrated without silently corrupting older state.
+ *
+ * The personal-token file (`<profile-dir>/token`) and `oauth.json` are
+ * mutually-exclusive *by convention*, not by enforcement: if both exist the
+ * resolver prefers OAuth. We don't delete the personal token automatically
+ * during `init oauth` — operators sometimes keep both for fallback.
+ */
+import fs from "node:fs/promises";
+import path from "node:path";
+import { CONFIG_DIR, resolveActiveProfile } from "../config/paths.js";
+import { atomicWrite } from "./oauth-fs.js";
+export const OAUTH_STATE_VERSION = 1;
+export const OAUTH_STATE_FILENAME = "oauth.json";
+/**
+ * Resolve the path to the active profile's `oauth.json`. Mirrors
+ * `activePaths()` in `commands/init/shared.ts` so OAuth state lands in the
+ * same directory as the profile's `config.json` and `token`.
+ */
+export function oauthStatePath() {
+    const active = resolveActiveProfile();
+    return path.join(path.dirname(active.configPath), OAUTH_STATE_FILENAME);
+}
+/**
+ * Read the active profile's OAuth state, or `null` if none has been written.
+ * Returns `null` (not throw) on JSON parse errors so callers can fall back
+ * to personal-token auth without spamming users with repair instructions —
+ * the `init oauth` command is responsible for repair.
+ */
+export async function readOAuthState() {
+    try {
+        const raw = await fs.readFile(oauthStatePath(), "utf8");
+        const parsed = JSON.parse(raw);
+        if (parsed?.v !== OAUTH_STATE_VERSION)
+            return null;
+        if (typeof parsed.accessToken !== "string" || parsed.accessToken === "") {
+            return null;
+        }
+        return parsed;
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return null;
+        // Corrupt JSON or unreadable file — treat as "no state" so the
+        // resolver can fall through to personal-token auth.
+        return null;
+    }
+}
+/**
+ * Write the active profile's OAuth state atomically with mode 0600.
+ *
+ * IMPORTANT: uses the same write-tmp + rename pattern as `writeToken` so a
+ * pre-existing 0644 file gets its mode reset. Tokens leaking via group/other
+ * read is the failure mode we want to make impossible.
+ */
+export async function writeOAuthState(state) {
+    const target = oauthStatePath();
+    // Ensure both the legacy CONFIG_DIR (where active-profile + profiles/
+    // live) and the active profile's directory exist before writing.
+    await fs.mkdir(CONFIG_DIR, { recursive: true, mode: 0o700 });
+    await fs.mkdir(path.dirname(target), { recursive: true, mode: 0o700 });
+    await atomicWrite(target, `${JSON.stringify(state, null, 2)}\n`, 0o600);
+}
+/**
+ * Delete the active profile's OAuth state. No-op if the file is already gone.
+ */
+export async function clearOAuthState() {
+    try {
+        await fs.unlink(oauthStatePath());
+    }
+    catch (err) {
+        if (err.code !== "ENOENT")
+            throw err;
+    }
+}
+/**
+ * Return `true` when the access token is still valid for at least
+ * `skewMs` milliseconds. Default 60s skew protects against clock drift +
+ * network latency.
+ */
+export function isAccessTokenFresh(state, skewMs = 60_000) {
+    return Date.now() + skewMs < state.expiresAt;
+}

package/dist/auth/oauth-token.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Linear OAuth token endpoint calls: code exchange, refresh, and revoke.
+ *
+ * Linear's token endpoint accepts both `application/x-www-form-urlencoded`
+ * and JSON; we use form-encoded because that's what the docs show and what
+ * spec-compliant servers all support.
+ *
+ * We keep the dependency surface tiny — just `globalThis.fetch` (Node 22+
+ * has it native) plus our own tiny error envelope. The only thing the
+ * caller injects is the URL fetcher, so tests can mock without touching the
+ * network.
+ */
+import { type OAuthScope } from "./oauth-client.js";
+/**
+ * Minimal subset of `globalThis.fetch` we use. Typing as the structural
+ * shape (instead of `typeof fetch`) avoids dragging in DOM lib types.
+ */
+export type FetchLike = (url: string, init: {
+    method: string;
+    headers: Record<string, string>;
+    body: string;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+    statusText: string;
+    text(): Promise<string>;
+}>;
+export interface ExchangeCodeInput {
+    clientId: string;
+    clientSecret?: string;
+    code: string;
+    redirectUri: string;
+    codeVerifier: string;
+}
+export interface RefreshTokensInput {
+    clientId: string;
+    clientSecret?: string;
+    refreshToken: string;
+}
+export interface RevokeTokenInput {
+    accessToken: string;
+}
+export interface ExchangeResult {
+    accessToken: string;
+    refreshToken?: string;
+    tokenType: string;
+    scopes: OAuthScope[];
+    /** Unix epoch milliseconds; computed from `expires_in`. */
+    expiresAt: number;
+}
+/**
+ * Exchange an authorization code for tokens. PKCE-aware: send the verifier;
+ * `client_secret` is optional (some Linear apps configured as native/public
+ * don't have one).
+ */
+export declare function exchangeCodeForTokens(input: ExchangeCodeInput, fetchImpl?: FetchLike, now?: () => number): Promise<ExchangeResult>;
+/**
+ * Use a refresh token to get a new access token. Linear may rotate the
+ * refresh token, so we plumb both fields through.
+ */
+export declare function refreshTokens(input: RefreshTokensInput, fetchImpl?: FetchLike, now?: () => number): Promise<ExchangeResult>;
+/**
+ * Revoke an access token. Best-effort — we don't throw on transport
+ * errors so callers can still clear local state.
+ */
+export declare function revokeToken(input: RevokeTokenInput, fetchImpl?: FetchLike): Promise<{
+    ok: boolean;
+    status: number;
+    message?: string;
+}>;

package/dist/auth/oauth-token.js

@@ -0,0 +1,141 @@
+/**
+ * Linear OAuth token endpoint calls: code exchange, refresh, and revoke.
+ *
+ * Linear's token endpoint accepts both `application/x-www-form-urlencoded`
+ * and JSON; we use form-encoded because that's what the docs show and what
+ * spec-compliant servers all support.
+ *
+ * We keep the dependency surface tiny — just `globalThis.fetch` (Node 22+
+ * has it native) plus our own tiny error envelope. The only thing the
+ * caller injects is the URL fetcher, so tests can mock without touching the
+ * network.
+ */
+import { LINEAR_REVOKE_URL, LINEAR_TOKEN_URL, } from "./oauth-client.js";
+const defaultFetch = async (url, init) => {
+    const res = await globalThis.fetch(url, init);
+    return {
+        ok: res.ok,
+        status: res.status,
+        statusText: res.statusText,
+        text: () => res.text(),
+    };
+};
+/** Common form-encoded POST helper. Throws an error with sanitized body on non-2xx. */
+async function postForm(url, params, fetchImpl) {
+    const body = new URLSearchParams(params).toString();
+    let res;
+    try {
+        res = await fetchImpl(url, {
+            method: "POST",
+            headers: {
+                "content-type": "application/x-www-form-urlencoded",
+                accept: "application/json",
+            },
+            body,
+        });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`Network error talking to ${url}: ${message}`);
+    }
+    const text = await res.text();
+    if (!res.ok) {
+        // Don't dump the request body — it contains client_secret /
+        // refresh_token / authorization code, all of which are secrets.
+        throw new Error(`OAuth endpoint ${url} responded ${res.status} ${res.statusText}: ${text || "(empty body)"}`);
+    }
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new Error(`OAuth endpoint ${url} returned non-JSON response: ${text.slice(0, 200)}`);
+    }
+}
+function parseScopes(raw) {
+    if (!raw)
+        return [];
+    // Linear docs show scopes are returned comma-separated; some OAuth
+    // servers return space-separated. Accept either.
+    return raw
+        .split(/[,\s]+/)
+        .map((s) => s.trim())
+        .filter(Boolean);
+}
+function tokenResponseToResult(response, now) {
+    const expiresInMs = typeof response.expires_in === "number" && response.expires_in > 0
+        ? response.expires_in * 1000
+        : // Linear docs say tokens last 24h. If the field is missing, fall
+            // back to 23h to leave a safety margin before forcing a refresh.
+            23 * 60 * 60 * 1000;
+    return {
+        accessToken: response.access_token,
+        refreshToken: response.refresh_token,
+        tokenType: response.token_type ?? "Bearer",
+        scopes: parseScopes(response.scope),
+        expiresAt: now + expiresInMs,
+    };
+}
+/**
+ * Exchange an authorization code for tokens. PKCE-aware: send the verifier;
+ * `client_secret` is optional (some Linear apps configured as native/public
+ * don't have one).
+ */
+export async function exchangeCodeForTokens(input, fetchImpl = defaultFetch, now = Date.now) {
+    const params = {
+        grant_type: "authorization_code",
+        code: input.code,
+        redirect_uri: input.redirectUri,
+        client_id: input.clientId,
+        code_verifier: input.codeVerifier,
+    };
+    if (input.clientSecret)
+        params.client_secret = input.clientSecret;
+    const res = await postForm(LINEAR_TOKEN_URL, params, fetchImpl);
+    if (typeof res.access_token !== "string" || res.access_token === "") {
+        throw new Error("OAuth response missing `access_token`.");
+    }
+    return tokenResponseToResult(res, now());
+}
+/**
+ * Use a refresh token to get a new access token. Linear may rotate the
+ * refresh token, so we plumb both fields through.
+ */
+export async function refreshTokens(input, fetchImpl = defaultFetch, now = Date.now) {
+    const params = {
+        grant_type: "refresh_token",
+        refresh_token: input.refreshToken,
+        client_id: input.clientId,
+    };
+    if (input.clientSecret)
+        params.client_secret = input.clientSecret;
+    const res = await postForm(LINEAR_TOKEN_URL, params, fetchImpl);
+    if (typeof res.access_token !== "string" || res.access_token === "") {
+        throw new Error("OAuth refresh response missing `access_token`.");
+    }
+    return tokenResponseToResult(res, now());
+}
+/**
+ * Revoke an access token. Best-effort — we don't throw on transport
+ * errors so callers can still clear local state.
+ */
+export async function revokeToken(input, fetchImpl = defaultFetch) {
+    try {
+        const res = await fetchImpl(LINEAR_REVOKE_URL, {
+            method: "POST",
+            headers: {
+                authorization: `Bearer ${input.accessToken}`,
+                "content-type": "application/x-www-form-urlencoded",
+            },
+            body: "",
+        });
+        return {
+            ok: res.ok,
+            status: res.status,
+            message: res.ok ? undefined : await res.text(),
+        };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return { ok: false, status: 0, message };
+    }
+}

package/dist/auth/token-resolver.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Unified resolver: returns the right credential for a CLI invocation,
+ * preferring OAuth state when present and auto-refreshing expired tokens.
+ *
+ * Resolution order (highest priority first):
+ *   1. `--api-token <token>` flag (always personal-style — sent without
+ *      `Bearer `).
+ *   2. `LINEAR_API_TOKEN` env var (personal-style).
+ *   3. Profile OAuth state (`<profile-dir>/oauth.json`) — auto-refreshes
+ *      when the access token has < 60s of validity left.
+ *   4. Profile personal token (`<profile-dir>/token`) and legacy fallbacks.
+ *
+ * The kind discriminant (`personal` vs `oauth`) tells `GraphQLService` which
+ * `Authorization` header shape to use:
+ *   - personal:  `Authorization: <token>`        (no Bearer prefix)
+ *   - oauth:     `Authorization: Bearer <token>`
+ */
+import { type OAuthState } from "./oauth-storage.js";
+import { type FetchLike } from "./oauth-token.js";
+export interface ActiveAuth {
+    kind: "personal" | "oauth";
+    token: string;
+    /** Original OAuth state, when `kind === "oauth"`. */
+    oauth?: OAuthState;
+}
+export interface GetActiveAuthOptions {
+    apiToken?: string;
+    /** Test seam: override the network fetcher used by refresh. */
+    fetchImpl?: FetchLike;
+    /** Test seam: override the wall-clock for refresh expiry checks. */
+    now?: () => number;
+}
+/**
+ * Resolve the credential for this invocation.
+ *
+ * Synchronous personal-token paths still work via `getApiToken` for
+ * backwards compatibility — code that hasn't been migrated to OAuth-aware
+ * call sites keeps using `getApiToken` directly.
+ */
+export declare function getActiveAuth(options?: GetActiveAuthOptions): Promise<ActiveAuth>;
+/**
+ * If the token is fresh, return state unchanged. Otherwise call
+ * `refreshTokens`, write the new state to disk, and return it.
+ *
+ * On refresh failure, throws an actionable error pointing at
+ * `el-linear init oauth`.
+ */
+export declare function ensureFreshAccessToken(state: OAuthState, options?: GetActiveAuthOptions): Promise<OAuthState>;

package/dist/auth/token-resolver.js

@@ -0,0 +1,95 @@
+/**
+ * Unified resolver: returns the right credential for a CLI invocation,
+ * preferring OAuth state when present and auto-refreshing expired tokens.
+ *
+ * Resolution order (highest priority first):
+ *   1. `--api-token <token>` flag (always personal-style — sent without
+ *      `Bearer `).
+ *   2. `LINEAR_API_TOKEN` env var (personal-style).
+ *   3. Profile OAuth state (`<profile-dir>/oauth.json`) — auto-refreshes
+ *      when the access token has < 60s of validity left.
+ *   4. Profile personal token (`<profile-dir>/token`) and legacy fallbacks.
+ *
+ * The kind discriminant (`personal` vs `oauth`) tells `GraphQLService` which
+ * `Authorization` header shape to use:
+ *   - personal:  `Authorization: <token>`        (no Bearer prefix)
+ *   - oauth:     `Authorization: Bearer <token>`
+ */
+import { getApiToken } from "../utils/auth.js";
+import { isAccessTokenFresh, readOAuthState, writeOAuthState, } from "./oauth-storage.js";
+import { refreshTokens, } from "./oauth-token.js";
+/**
+ * Resolve the credential for this invocation.
+ *
+ * Synchronous personal-token paths still work via `getApiToken` for
+ * backwards compatibility — code that hasn't been migrated to OAuth-aware
+ * call sites keeps using `getApiToken` directly.
+ */
+export async function getActiveAuth(options = {}) {
+    // 1) Explicit override: `--api-token` always wins. Personal-style.
+    if (options.apiToken) {
+        return { kind: "personal", token: options.apiToken };
+    }
+    // 2) Env var: same precedence as the legacy resolver. Personal-style.
+    if (process.env.LINEAR_API_TOKEN) {
+        return { kind: "personal", token: process.env.LINEAR_API_TOKEN };
+    }
+    // 3) OAuth state for the active profile, auto-refreshed if needed.
+    const oauth = await readOAuthState();
+    if (oauth) {
+        const fresh = await ensureFreshAccessToken(oauth, options);
+        return { kind: "oauth", token: fresh.accessToken, oauth: fresh };
+    }
+    // 4) Fall back to the existing personal-token resolver (handles
+    //    profile-aware token files, legacy paths, etc.). If no token can
+    //    be found, this throws — and the message already mentions the
+    //    profile, so we don't have to re-wrap.
+    return { kind: "personal", token: getApiToken({}) };
+}
+/**
+ * If the token is fresh, return state unchanged. Otherwise call
+ * `refreshTokens`, write the new state to disk, and return it.
+ *
+ * On refresh failure, throws an actionable error pointing at
+ * `el-linear init oauth`.
+ */
+export async function ensureFreshAccessToken(state, options = {}) {
+    const now = options.now ?? Date.now;
+    if (isAccessTokenFresh(state, /* skewMs */ 60_000)) {
+        // `isAccessTokenFresh` reads `Date.now()` internally; for the
+        // purpose of the test seam we re-check against the injected clock.
+        if (now() + 60_000 < state.expiresAt) {
+            return state;
+        }
+    }
+    if (!state.refreshToken) {
+        throw new Error("OAuth access token expired and no refresh token is stored. Re-run `el-linear init oauth`.");
+    }
+    let refreshed;
+    try {
+        refreshed = await refreshTokens({
+            clientId: state.clientId,
+            clientSecret: state.clientSecret,
+            refreshToken: state.refreshToken,
+        }, options.fetchImpl, now);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`OAuth refresh failed: ${message}. Re-run \`el-linear init oauth\` to re-authorize.`);
+    }
+    const next = {
+        ...state,
+        accessToken: refreshed.accessToken,
+        // Preserve the previous refresh token if the server didn't rotate
+        // (some OAuth servers only return a new refresh_token periodically).
+        refreshToken: refreshed.refreshToken ?? state.refreshToken,
+        tokenType: refreshed.tokenType,
+        // Use the freshly-returned scopes only if non-empty; otherwise keep
+        // what we had, since some token endpoints omit `scope` on refresh.
+        scopes: refreshed.scopes.length > 0 ? refreshed.scopes : state.scopes,
+        expiresAt: refreshed.expiresAt,
+        obtainedAt: now(),
+    };
+    await writeOAuthState(next);
+    return next;
+}

package/dist/commands/attachments.js

@@ -1,8 +1,8 @@
-import { getApiToken } from "../utils/auth.js";
-import { FileService } from "../utils/file-service.js";
+import { createFileService } from "../utils/file-service.js";
 import { createGraphQLAttachmentsService } from "../utils/graphql-attachments-service.js";
 import { createLinearService } from "../utils/linear-service.js";
 import { handleAsyncCommand, outputSuccess } from "../utils/output.js";
+import { getRootOpts } from "../utils/root-opts.js";
 export function setupAttachmentsCommands(program) {
     const attachments = program
         .command("attachments")
@@ -14,16 +14,15 @@ export function setupAttachmentsCommands(program) {
         .requiredOption("--file <path>", "path to file to upload")
         .option("--title <title>", "attachment title (defaults to filename)")
         .action(handleAsyncCommand(async (issueId, options, command) => {
-        const rootOpts = command.parent.parent.opts();
-        const apiToken = getApiToken(rootOpts);
-        const linearService = createLinearService(rootOpts);
+        const rootOpts = getRootOpts(command);
+        const linearService = await createLinearService(rootOpts);
         const resolvedIssueId = await linearService.resolveIssueId(issueId);
-        const fileService = new FileService(apiToken);
+        const fileService = await createFileService(rootOpts);
         const uploadResult = await fileService.uploadFile(options.file);
         if (!uploadResult.success) {
             throw new Error(uploadResult.error);
         }
-        const attachmentsService = createGraphQLAttachmentsService(rootOpts);
+        const attachmentsService = await createGraphQLAttachmentsService(rootOpts);
         const attachment = await attachmentsService.createAttachment({
             issueId: resolvedIssueId,
             url: uploadResult.assetUrl,
@@ -36,10 +35,10 @@ export function setupAttachmentsCommands(program) {
         .description("List attachments on an issue.")
         .option("-l, --limit <number>", "maximum number of attachments", "50")
         .action(handleAsyncCommand(async (issueId, options, command) => {
-        const rootOpts = command.parent.parent.opts();
-        const linearService = createLinearService(rootOpts);
+        const rootOpts = getRootOpts(command);
+        const linearService = await createLinearService(rootOpts);
         const resolvedIssueId = await linearService.resolveIssueId(issueId);
-        const attachmentsService = createGraphQLAttachmentsService(rootOpts);
+        const attachmentsService = await createGraphQLAttachmentsService(rootOpts);
         const allAttachments = await attachmentsService.listAttachments(resolvedIssueId);
         const limit = Number.parseInt(options.limit, 10);
         const data = allAttachments.slice(0, limit);
@@ -49,8 +48,8 @@ export function setupAttachmentsCommands(program) {
         .command("delete <attachmentId>")
         .description("Delete an attachment.")
         .action(handleAsyncCommand(async (attachmentId, _options, command) => {
-        const rootOpts = command.parent.parent.opts();
-        const attachmentsService = createGraphQLAttachmentsService(rootOpts);
+        const rootOpts = getRootOpts(command);
+        const attachmentsService = await createGraphQLAttachmentsService(rootOpts);
         await attachmentsService.deleteAttachment(attachmentId);
         outputSuccess({ success: true, message: "Attachment deleted" });
     }));

package/dist/commands/batch.js

@@ -4,6 +4,7 @@ import { createGraphQLService } from "../utils/graphql-service.js";
 import { createLinearService } from "../utils/linear-service.js";
 import { logger } from "../utils/logger.js";
 import { handleAsyncCommand, outputSuccess, outputWarning, } from "../utils/output.js";
+import { getRootOpts } from "../utils/root-opts.js";
 import { splitList } from "../utils/validators.js";
 /**
  * Parse the --filter string into structured search arguments.
@@ -29,8 +30,8 @@ function parseFilterString(filter) {
  * Returns LinearIssue[] so we can show a preview.
  */
 async function resolveTargetIssues(options, rootOpts) {
-    const graphQLService = createGraphQLService(rootOpts);
-    const linearService = createLinearService(rootOpts);
+    const graphQLService = await createGraphQLService(rootOpts);
+    const linearService = await createLinearService(rootOpts);
     const issuesService = new GraphQLIssuesService(graphQLService, linearService);
     if (options.issues) {
         const ids = splitList(options.issues);
@@ -95,7 +96,7 @@ async function executeBatch(issues, operation) {
     return { results };
 }
 async function handleBatchAssign(options, command) {
-    const rootOpts = command.parent.parent.opts();
+    const rootOpts = getRootOpts(command);
     if (!options.assignee) {
         throw new Error("--assignee is required.");
     }
@@ -116,8 +117,8 @@ async function handleBatchAssign(options, command) {
         });
         return;
     }
-    const graphQLService = createGraphQLService(rootOpts);
-    const linearService = createLinearService(rootOpts);
+    const graphQLService = await createGraphQLService(rootOpts);
+    const linearService = await createLinearService(rootOpts);
     const issuesService = new GraphQLIssuesService(graphQLService, linearService);
     const { results } = await executeBatch(issues, (issue) => issuesService.updateIssue({ id: issue.identifier, assigneeId }, "adding"));
     outputSuccess({
@@ -132,7 +133,7 @@ async function handleBatchAssign(options, command) {
     });
 }
 async function handleBatchLabel(options, command) {
-    const rootOpts = command.parent.parent.opts();
+    const rootOpts = getRootOpts(command);
     if (!(options.add || options.remove)) {
         throw new Error("Specify --add and/or --remove for labels.");
     }
@@ -163,8 +164,8 @@ async function handleBatchLabel(options, command) {
         });
         return;
     }
-    const graphQLService = createGraphQLService(rootOpts);
-    const linearService = createLinearService(rootOpts);
+    const graphQLService = await createGraphQLService(rootOpts);
+    const linearService = await createLinearService(rootOpts);
     const issuesService = new GraphQLIssuesService(graphQLService, linearService);
     const removeLower = removeLabels.map((l) => l.toLowerCase());
     const { results } = await executeBatch(issues, (issue) => {
@@ -197,7 +198,7 @@ async function handleBatchLabel(options, command) {
     });
 }
 async function handleBatchMove(options, command) {
-    const rootOpts = command.parent.parent.opts();
+    const rootOpts = getRootOpts(command);
     if (!options.project) {
         throw new Error("--project is required.");
     }
@@ -217,8 +218,8 @@ async function handleBatchMove(options, command) {
         });
         return;
     }
-    const graphQLService = createGraphQLService(rootOpts);
-    const linearService = createLinearService(rootOpts);
+    const graphQLService = await createGraphQLService(rootOpts);
+    const linearService = await createLinearService(rootOpts);
     const issuesService = new GraphQLIssuesService(graphQLService, linearService);
     const { results } = await executeBatch(issues, (issue) => issuesService.updateIssue({ id: issue.identifier, projectId: options.project }, "adding"));
     outputSuccess({
@@ -233,7 +234,7 @@ async function handleBatchMove(options, command) {
     });
 }
 async function handleBatchStatus(options, command) {
-    const rootOpts = command.parent.parent.opts();
+    const rootOpts = getRootOpts(command);
     if (!options.status) {
         throw new Error("--status is required.");
     }
@@ -253,8 +254,8 @@ async function handleBatchStatus(options, command) {
         });
         return;
     }
-    const graphQLService = createGraphQLService(rootOpts);
-    const linearService = createLinearService(rootOpts);
+    const graphQLService = await createGraphQLService(rootOpts);
+    const linearService = await createLinearService(rootOpts);
     const issuesService = new GraphQLIssuesService(graphQLService, linearService);
     const { results } = await executeBatch(issues, (issue) => issuesService.updateIssue({ id: issue.identifier, statusId: options.status }, "adding"));
     outputSuccess({

package/dist/commands/comments.js

@@ -2,12 +2,14 @@ import { readFileSync } from "node:fs";
 import { resolveUserDisplayName } from "../config/resolver.js";
 import { CREATE_COMMENT_MUTATION, LIST_COMMENTS_QUERY, UPDATE_COMMENT_MUTATION, } from "../queries/comments.js";
 import { autoLinkReferences, } from "../utils/auto-link-references.js";
+import { applyFooter } from "../utils/footer.js";
 import { createGraphQLService, } from "../utils/graphql-service.js";
 import { extractIssueReferences } from "../utils/issue-reference-extractor.js";
 import { wrapIssueReferencesAsLinks } from "../utils/issue-reference-wrapper.js";
 import { createLinearService, } from "../utils/linear-service.js";
 import { resolveMentions } from "../utils/mention-resolver.js";
 import { handleAsyncCommand, outputSuccess } from "../utils/output.js";
+import { getRootOpts } from "../utils/root-opts.js";
 import { validateReferences } from "../utils/validate-references.js";
 import { getWorkspaceUrlKey } from "../utils/workspace-url.js";
 // Match Linear's bodyData validation error in multiple phrasings so a wording
@@ -98,10 +100,18 @@ async function autoLinkCommentReferences(args) {
     return result;
 }
 async function handleCreateComment(issueId, options, command) {
-    const rootOpts = command.parent.parent.opts();
-    const graphQLService = createGraphQLService(rootOpts);
-    const linearService = createLinearService(rootOpts);
-    const rawBody = readBody(options);
+    const rootOpts = getRootOpts(command);
+    const graphQLService = await createGraphQLService(rootOpts);
+    const linearService = await createLinearService(rootOpts);
+    // Apply messageFooter (config or --footer flag) before any further
+    // processing, so auto-link / mention-resolution see it as part of the body.
+    // Commander parses --no-footer as `options.footer === false`.
+    const noFooter = options.footer === false;
+    const explicitFooter = typeof options.footer === "string" ? options.footer : undefined;
+    const rawBody = applyFooter(readBody(options), {
+        footer: explicitFooter,
+        noFooter,
+    }) ?? "";
     const resolvedIssueId = await linearService.resolveIssueId(issueId);
     // Wrap valid refs as markdown links before mention resolution. Idempotent against
     // already-wrapped refs.
@@ -171,9 +181,9 @@ async function handleCreateComment(issueId, options, command) {
     outputSuccess(autoLinked ? { ...output, autoLinked } : output);
 }
 async function handleUpdateComment(commentId, options, command) {
-    const rootOpts = command.parent.parent.opts();
-    const graphQLService = createGraphQLService(rootOpts);
-    const linearService = createLinearService(rootOpts);
+    const rootOpts = getRootOpts(command);
+    const graphQLService = await createGraphQLService(rootOpts);
+    const linearService = await createLinearService(rootOpts);
     const rawBody = readBody(options);
     const { body, preResolved } = await prepareCommentBodyWithLinks(rawBody, options, linearService, graphQLService);
     const autoMention = options.autoMention !== false;
@@ -218,9 +228,9 @@ async function handleUpdateComment(commentId, options, command) {
     outputSuccess(autoLinked ? { ...output, autoLinked } : output);
 }
 async function handleListComments(issueId, options, command) {
-    const rootOpts = command.parent.parent.opts();
-    const graphQLService = createGraphQLService(rootOpts);
-    const linearService = createLinearService(rootOpts);
+    const rootOpts = getRootOpts(command);
+    const graphQLService = await createGraphQLService(rootOpts);
+    const linearService = await createLinearService(rootOpts);
     const resolvedId = await linearService.resolveIssueId(issueId);
     const result = await graphQLService.rawRequest(LIST_COMMENTS_QUERY, {
         issueId: resolvedId,
@@ -254,6 +264,8 @@ export function setupCommentsCommands(program) {
         .option("--file <path>", "read comment body from file")
         .option("--no-auto-mention", "do not auto-convert bare team-member names to @mentions")
         .option("--no-auto-link", "skip wrapping issue refs as markdown links and creating sidebar relations")
+        .option("--footer <text>", "text appended to the comment body (overrides config.messageFooter)")
+        .option("--no-footer", "skip the configured messageFooter for this comment")
         .action(handleAsyncCommand(handleCreateComment));
     comments
         .command("update <commentId>")