@enrichlayer/el-linear 1.43.0 → 1.44.0

package/dist/config/repo-profile.js

@@ -0,0 +1,274 @@
+/**
+ * Repo-aware Linear-profile resolution (DEV-7277).
+ *
+ * el-linear supports multiple named profiles (one Linear workspace each). When
+ * a user works across several workspaces the machine-global `active-profile`
+ * marker is a foot-gun: whichever workspace was last `profile use`d becomes the
+ * default for EVERY repo, so a write lands in the wrong workspace.
+ *
+ * This module lets a repo PIN the profile it belongs to, read from two on-disk
+ * sources in precedence order:
+ *   1. Repo-root `.el-git.json`: `{ "linearProfile": "<name>" }`.
+ *   2. `${XDG_CONFIG_HOME:-~/.config}/el-git/linear-profiles.json`:
+ *      `{ "profiles": { "owner/repo": "<name>", "owner/*": "<name>" } }` — keys
+ *      are the origin remote's `owner/repo`; an exact key wins over the
+ *      `owner/*` wildcard.
+ *
+ * ── SHARED CROSS-TOOL CONTRACT — DO NOT DRIFT ────────────────────────────────
+ * The file names, shapes, and precedence here are the SAME contract el-git
+ * (DEV-6465) and el-session (DEV-7131) already read/write via the internal
+ * `@enrichlayer/cli-package-info` module (`resolveRepoLinearProfile`). el-linear
+ * is a standalone MIT package published to public npm; cli-package-info is
+ * published only to an internal GitLab registry, so depending on it would break
+ * public installs. Instead this file re-implements the EXACT same formats and
+ * precedence. The filename stays `.el-git.json` (NOT a new `.el-linear` file) on
+ * purpose — it is the established shared location el-session already reads. If
+ * you change anything here, change the canonical impl at
+ * `tools/cli/cli-package-info/src/index.cjs` in lock-step or the tools silently
+ * disagree about which workspace a repo belongs to.
+ * ─────────────────────────────────────────────────────────────────────────────
+ *
+ * Trust note (inherited from the shared contract): the repo-local file is read
+ * from whatever repo you `cd` into, including an untrusted clone. Blast radius
+ * is bounded to selecting a profile NAME — worst case is a wrong-workspace
+ * lookup or a rejected name, never code execution. Callers still validate the
+ * resolved name with `isSafeProfileName` before it reaches any path join.
+ */
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+/** Repo-local pin file, at the git repo root. Shared with el-git/el-session. */
+export const LINEAR_PROFILE_REPO_FILE = ".el-git.json";
+/** Global pin table filename, under `<config>/el-git/`. */
+export const LINEAR_PROFILE_USER_CONFIG = "linear-profiles.json";
+/** `${XDG_CONFIG_HOME:-~/.config}/el-git`. Env-injectable for tests. */
+export function linearProfileConfigDir(env = process.env) {
+    const xdg = (env.XDG_CONFIG_HOME ?? "").trim();
+    return xdg
+        ? path.join(xdg, "el-git")
+        : path.join(os.homedir(), ".config", "el-git");
+}
+export function globalPinTablePath(env = process.env) {
+    return path.join(linearProfileConfigDir(env), LINEAR_PROFILE_USER_CONFIG);
+}
+// `git@host:owner/repo.git` and `https://host/owner/repo(.git)` → `owner/repo`.
+// Byte-for-byte mirror of cli-package-info's `parseGitRemoteFullpath`.
+const GIT_SCP_REMOTE_RE = /^[^@/]+@[^:]+:(.+)$/;
+const GIT_REMOTE_LEADING_SLASHES_RE = /^\/+/;
+const GIT_REMOTE_DOT_GIT_RE = /\.git$/;
+const GIT_REMOTE_TRAILING_SLASHES_RE = /\/+$/;
+export function parseGitRemoteFullpath(url) {
+    if (typeof url !== "string" || !url.trim()) {
+        return null;
+    }
+    const trimmed = url.trim();
+    const scp = trimmed.match(GIT_SCP_REMOTE_RE);
+    let rawPath;
+    if (scp) {
+        rawPath = scp[1] ?? null;
+    }
+    else {
+        try {
+            rawPath = new URL(trimmed).pathname;
+        }
+        catch {
+            rawPath = null;
+        }
+    }
+    if (!rawPath) {
+        return null;
+    }
+    const cleaned = rawPath
+        .replace(GIT_REMOTE_LEADING_SLASHES_RE, "")
+        .replace(GIT_REMOTE_DOT_GIT_RE, "")
+        .replace(GIT_REMOTE_TRAILING_SLASHES_RE, "");
+    return cleaned || null;
+}
+/** Real git/fs implementations. Overridden per-field in tests. */
+export function defaultRepoProfileOps() {
+    return {
+        existsSync: (p) => fs.existsSync(p),
+        readFileSync: (p) => fs.readFileSync(p, "utf8"),
+        repoRoot: (cwd) => {
+            try {
+                return execFileSync("git", ["rev-parse", "--show-toplevel"], {
+                    cwd,
+                    encoding: "utf8",
+                    stdio: ["pipe", "pipe", "pipe"],
+                }).trim();
+            }
+            catch {
+                return null;
+            }
+        },
+        originFullpath: (cwd) => {
+            try {
+                const url = execFileSync("git", ["remote", "get-url", "origin"], {
+                    cwd,
+                    encoding: "utf8",
+                    stdio: ["pipe", "pipe", "pipe"],
+                }).trim();
+                return parseGitRemoteFullpath(url);
+            }
+            catch {
+                return null;
+            }
+        },
+    };
+}
+function readJsonObject(filePath, ops, onWarn) {
+    if (!ops.existsSync(filePath)) {
+        return null;
+    }
+    try {
+        const parsed = JSON.parse(ops.readFileSync(filePath));
+        if (typeof parsed !== "object" ||
+            parsed === null ||
+            Array.isArray(parsed)) {
+            return null;
+        }
+        return parsed;
+    }
+    catch {
+        // Fail open — a malformed config must never take down unrelated
+        // commands — but surface it so a fat-fingered mapping doesn't hide as a
+        // confusing lookup miss two steps downstream.
+        onWarn?.(filePath);
+        return null;
+    }
+}
+/**
+ * Resolve the profile a repo is pinned to, or null when it has no pin.
+ * Repo-local `.el-git.json` wins over the global `owner/repo` table; within the
+ * table an exact key wins over the `owner/*` wildcard.
+ */
+export function resolveRepoLinearProfile(cwd = process.cwd(), opts = {}) {
+    const ops = {
+        ...defaultRepoProfileOps(),
+        ...(opts.ops ?? {}),
+    };
+    const env = opts.env ?? process.env;
+    const onWarn = opts.onMalformedConfig;
+    const root = ops.repoRoot(cwd);
+    if (root) {
+        const repoConfig = readJsonObject(path.join(root, LINEAR_PROFILE_REPO_FILE), ops, onWarn);
+        const fromRepo = repoConfig?.linearProfile;
+        if (typeof fromRepo === "string" && fromRepo.trim()) {
+            return { profile: fromRepo.trim(), source: "repo-file" };
+        }
+    }
+    const userConfig = readJsonObject(globalPinTablePath(env), ops, onWarn);
+    const table = userConfig?.profiles;
+    if (typeof table !== "object" || table === null) {
+        return null;
+    }
+    const fullpath = ops.originFullpath(cwd);
+    if (!fullpath) {
+        return null;
+    }
+    const lookup = table;
+    const exact = lookup[fullpath];
+    if (typeof exact === "string" && exact.trim()) {
+        return { profile: exact.trim(), source: "user-config" };
+    }
+    const wildcard = lookup[`${fullpath.split("/")[0]}/*`];
+    if (typeof wildcard === "string" && wildcard.trim()) {
+        return { profile: wildcard.trim(), source: "user-config" };
+    }
+    return null;
+}
+// ---- Write helpers (pure) ----------------------------------------------------
+//
+// The pin/unpin commands do the actual fs I/O; these pure string→string helpers
+// hold the merge logic so it is unit-testable and can't clobber sibling keys.
+function parseMutableJsonObject(existing, fileName) {
+    if (existing === null) {
+        return {};
+    }
+    try {
+        const parsed = JSON.parse(existing);
+        if (typeof parsed !== "object" ||
+            parsed === null ||
+            Array.isArray(parsed)) {
+            throw new Error("expected a JSON object");
+        }
+        return parsed;
+    }
+    catch {
+        throw new Error(`Refusing to edit malformed JSON in ${fileName}. Fix or remove it, then retry.`);
+    }
+}
+/**
+ * Merge `{ linearProfile: name }` into an existing `.el-git.json` body,
+ * preserving every other key. `existing` is the current file text (or null when
+ * the file is absent). Returns the new file text (2-space, trailing newline).
+ */
+export function applyRepoLocalPin(existing, name) {
+    const obj = parseMutableJsonObject(existing, LINEAR_PROFILE_REPO_FILE);
+    obj.linearProfile = name;
+    return `${JSON.stringify(obj, null, 2)}\n`;
+}
+/**
+ * Remove the `linearProfile` key from an existing `.el-git.json` body,
+ * preserving other keys. Returns the new file text, or null when the file
+ * should be deleted (it held only the pin / was absent / becomes empty).
+ */
+export function removeRepoLocalPin(existing) {
+    if (existing === null) {
+        return null;
+    }
+    const obj = parseMutableJsonObject(existing, LINEAR_PROFILE_REPO_FILE);
+    if (!("linearProfile" in obj)) {
+        // Nothing to remove; leave the file exactly as-is.
+        return existing;
+    }
+    delete obj.linearProfile;
+    if (Object.keys(obj).length === 0) {
+        return null;
+    }
+    return `${JSON.stringify(obj, null, 2)}\n`;
+}
+/**
+ * Merge `profiles[fullpath] = name` into the global pin table body, preserving
+ * every other entry. Returns the new file text (2-space, trailing newline).
+ */
+export function applyGlobalPin(existing, fullpath, name) {
+    const obj = parseMutableJsonObject(existing, LINEAR_PROFILE_USER_CONFIG);
+    const table = typeof obj.profiles === "object" &&
+        obj.profiles !== null &&
+        !Array.isArray(obj.profiles)
+        ? obj.profiles
+        : {};
+    table[fullpath] = name;
+    obj.profiles = table;
+    return `${JSON.stringify(obj, null, 2)}\n`;
+}
+/**
+ * Remove an exact `owner/repo` entry from the global pin table. Preserves
+ * wildcard entries and unrelated top-level keys. Returns null only when the
+ * file is absent or becomes empty after removal.
+ */
+export function removeGlobalPin(existing, fullpath) {
+    if (existing === null) {
+        return null;
+    }
+    const obj = parseMutableJsonObject(existing, LINEAR_PROFILE_USER_CONFIG);
+    if (typeof obj.profiles !== "object" ||
+        obj.profiles === null ||
+        Array.isArray(obj.profiles)) {
+        return existing;
+    }
+    const table = obj.profiles;
+    if (!(fullpath in table)) {
+        return existing;
+    }
+    delete table[fullpath];
+    if (Object.keys(table).length === 0) {
+        delete obj.profiles;
+    }
+    if (Object.keys(obj).length === 0) {
+        return null;
+    }
+    return `${JSON.stringify(obj, null, 2)}\n`;
+}

package/dist/main.js

@@ -29,7 +29,8 @@ import { setupSearchCommands } from "./commands/search.js";
 import { setupTeamsCommands } from "./commands/teams.js";
 import { setupTemplatesCommands } from "./commands/templates.js";
 import { setupUsersCommands } from "./commands/users.js";
-import { setActiveProfileForSession } from "./config/paths.js";
+import { isSafeProfileName, setActiveProfileForSession, } from "./config/paths.js";
+import { resolveRepoLinearProfile } from "./config/repo-profile.js";
 import { initCliSentry } from "./sentry.js";
 import { logger } from "./utils/logger.js";
 import { applyIpv4Preference } from "./utils/network-preference.js";
@@ -63,7 +64,7 @@ program
     .description("A pragmatic CLI for Linear.app — deterministic resolution, structured validation, GraphQL escape hatch.")
     .version(packageJson.version)
     .option("--api-token <token>", "Linear API token")
-    .option("--profile <name>", "named profile (under ~/.config/el-linear/profiles/<name>/) for this invocation. Overrides EL_LINEAR_PROFILE env + the on-disk active-profile marker.")
+    .option("--profile <name>", "named profile (under ~/.config/el-linear/profiles/<name>/) for this invocation. Overrides EL_LINEAR_PROFILE, repo pins, and the on-disk active-profile marker.")
     .option("--json", "output as JSON (default, accepted for compatibility)")
     .option("--format <kind>", "output format: json (default, structured envelope) or summary (human-readable)", "json")
     .option("--raw", "strip { data, meta } wrapper from list output — emit the array directly. " +
@@ -134,6 +135,27 @@ program.hook("preAction", (_thisCommand, actionCommand) => {
     if (rootOpts.profile) {
         setActiveProfileForSession(rootOpts.profile);
     }
+    else if (!process.env.EL_LINEAR_PROFILE?.trim()) {
+        // Repo pin (DEV-7277) slots BELOW --profile / $EL_LINEAR_PROFILE and
+        // ABOVE the machine-global active-profile marker. It is applied here,
+        // not inside the pure resolveActiveProfile, because reading it shells out
+        // to git. Setting the session override when a repo pin exists makes the
+        // rest of the run — token + config load — target the repo's workspace
+        // instead of whatever the global marker last selected.
+        //
+        // Fail-open: an unsafe/foreign name in an untrusted repo's `.el-git.json`
+        // is ignored rather than thrown, so a bad pin can never brick every
+        // command run inside that repo. Any resolution error is swallowed too.
+        try {
+            const pin = resolveRepoLinearProfile();
+            if (pin && isSafeProfileName(pin.profile)) {
+                setActiveProfileForSession(pin.profile);
+            }
+        }
+        catch {
+            // Repo-pin resolution must never break a command.
+        }
+    }
 });
 program.action(() => {
     program.help();

package/dist/queries/projects-types.d.ts

@@ -80,6 +80,12 @@ export interface UpdateProjectResponse {
 interface ProjectUpdateFieldsNode extends ProjectBaseNode {
     description: string | null;
     content: string | null;
+    status?: {
+        id: string;
+        name: string;
+    };
+    progress: number;
+    url: string;
 }
 export interface UpdateProjectFieldsResponse {
     projectUpdate: {

package/dist/queries/projects.d.ts

@@ -14,6 +14,6 @@ export declare const GET_PROJECT_TEAM_ISSUES_QUERY = "\n  query GetProjectTeamIs
 export declare const SEARCH_PROJECTS_BY_NAME_QUERY = "\n  query SearchProjectsByName($name: String!) {\n    projects(filter: { name: { containsIgnoreCase: $name } }, first: 10) {\n      nodes {\n        id\n        name\n        state\n        teams {\n          nodes { id key name }\n        }\n      }\n    }\n  }\n";
 export declare const CREATE_PROJECT_MUTATION = "\n  mutation CreateProject($input: ProjectCreateInput!) {\n    projectCreate(input: $input) {\n      success\n      project {\n        id\n        name\n        state\n        teams {\n          nodes { id key name }\n        }\n      }\n    }\n  }\n";
 export declare const UPDATE_PROJECT_MUTATION = "\n  mutation UpdateProject($id: String!, $input: ProjectUpdateInput!) {\n    projectUpdate(id: $id, input: $input) {\n      success\n      project {\n        id\n        name\n        teams {\n          nodes {\n            id\n            key\n            name\n          }\n        }\n      }\n    }\n  }\n";
-export declare const UPDATE_PROJECT_FIELDS_MUTATION = "\n  mutation UpdateProjectFields($id: String!, $input: ProjectUpdateInput!) {\n    projectUpdate(id: $id, input: $input) {\n      success\n      project {\n        id\n        name\n        description\n        content\n        teams {\n          nodes {\n            id\n            key\n            name\n          }\n        }\n      }\n    }\n  }\n";
+export declare const UPDATE_PROJECT_FIELDS_MUTATION = "\n  mutation UpdateProjectFields($id: String!, $input: ProjectUpdateInput!) {\n    projectUpdate(id: $id, input: $input) {\n      success\n      project {\n        id\n        name\n        description\n        content\n        status {\n          id\n          name\n        }\n        progress\n        url\n        teams {\n          nodes {\n            id\n            key\n            name\n          }\n        }\n      }\n    }\n  }\n";
 export declare const ARCHIVE_PROJECT_MUTATION = "\n  mutation ArchiveProject($id: String!) {\n    projectArchive(id: $id) {\n      success\n      lastSyncId\n      entity {\n        id\n      }\n    }\n  }\n";
 export declare const DELETE_PROJECT_MUTATION = "\n  mutation DeleteProject($id: String!) {\n    projectDelete(id: $id) {\n      success\n      lastSyncId\n      entity {\n        id\n      }\n    }\n  }\n";

package/dist/queries/projects.js

@@ -138,6 +138,12 @@ export const UPDATE_PROJECT_FIELDS_MUTATION = `
         name
         description
         content
+        status {
+          id
+          name
+        }
+        progress
+        url
         teams {
           nodes {
             id

package/dist/utils/formatters/summary.js

@@ -1278,6 +1278,13 @@ export function formatLine(payload) {
     if (kind === "comment" && obj) {
         return `comment ${s(obj.id)}`;
     }
+    if (kind === "project" && obj) {
+        // `projects update` (DEV-7021) is the current producer of a "project"
+        // quiet line; it carries the resolved `status` name. Other project
+        // payloads (read/list) carry the deprecated `state` scalar instead —
+        // fall back to that so this line degrades gracefully if reused.
+        return `${s(obj.name)}  ${s(obj.status ?? obj.state)}  ${s(obj.url)}`;
+    }
     if (kind === "project-update" && obj) {
         // create doesn't carry an identifier/title — health + url are the
         // stable handles a caller needs (matches the summary header style).

package/dist/utils/graphql-issues-service.js

@@ -436,7 +436,7 @@ export class GraphQLIssuesService {
             updateResult = await this.graphQLService.rawRequest(UPDATE_ISSUE_MUTATION, {
                 id: resolvedIssueId,
                 input: updateInput,
-            });
+            }, { retrySafeMutation: true });
         }
         catch (error) {
             const msg = error instanceof Error ? error.message : String(error);

package/dist/utils/graphql-service.d.ts

@@ -1,6 +1,21 @@
 import type { LinearCredential } from "../auth/linear-credential.js";
 import type { GraphQLResponseData, GraphQLVariables } from "../types/linear.js";
 import type { AuthOptions } from "./auth.js";
+export interface GraphQLRequestOptions {
+    /**
+     * Retry only an operation whose mutation is safe to repeat. Callers must
+     * opt in; creates and comment writes intentionally retain one-shot
+     * semantics because a transport failure can leave their server-side result
+     * unknown.
+     */
+    retrySafeMutation?: boolean;
+}
+interface GraphQLServiceRuntimeOptions {
+    retryDelaysMs?: readonly number[];
+    sleep?: (ms: number) => Promise<void>;
+}
+/** True only for failures where retrying a known-idempotent request is useful. */
+export declare function isTransientGraphQLError(error: unknown): boolean;
 /**
  * Constructor arg for `GraphQLService`. Re-exported alias of the shared
  * `LinearCredential` union (`{ apiKey } | { oauthToken }`). Kept as a
@@ -15,7 +30,10 @@ import type { AuthOptions } from "./auth.js";
 export type GraphQLServiceAuth = LinearCredential;
 export declare class GraphQLService {
     private readonly graphQLClient;
-    constructor(auth: GraphQLServiceAuth);
-    rawRequest<T = GraphQLResponseData>(query: string, variables?: GraphQLVariables): Promise<T>;
+    private readonly retryDelaysMs;
+    private readonly sleep;
+    constructor(auth: GraphQLServiceAuth, options?: GraphQLServiceRuntimeOptions);
+    rawRequest<T = GraphQLResponseData>(query: string, variables?: GraphQLVariables, options?: GraphQLRequestOptions): Promise<T>;
 }
 export declare function createGraphQLService(options: AuthOptions): Promise<GraphQLService>;
+export {};

package/dist/utils/graphql-service.js

@@ -1,5 +1,20 @@
 import { LinearClient } from "@linear/sdk";
 import { getActiveAuth } from "../auth/token-resolver.js";
+const DEFAULT_SAFE_MUTATION_RETRY_DELAYS_MS = [150, 400];
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/** True only for failures where retrying a known-idempotent request is useful. */
+export function isTransientGraphQLError(error) {
+    const detail = error;
+    const status = detail.response?.status ?? detail.response?.statusCode;
+    if (status === 408 ||
+        status === 429 ||
+        (status !== undefined && status >= 500)) {
+        return true;
+    }
+    return /\b(?:408|429|500|502|503|504)\b|(?:ECONNRESET|ECONNREFUSED|ETIMEDOUT|fetch failed|network error|connection termination)/i.test(errorMessage(error));
+}
 function buildLinearClient(auth) {
     const baseHeaders = { "public-file-urls-expire-in": "3600" };
     if ("oauthToken" in auth) {
@@ -16,17 +31,38 @@ function buildLinearClient(auth) {
 }
 export class GraphQLService {
     graphQLClient;
-    constructor(auth) {
+    retryDelaysMs;
+    sleep;
+    constructor(auth, options = {}) {
         const client = buildLinearClient(auth);
         // LinearClient stores a private graphql-request client — access via escape hatch
         this.graphQLClient = client.client;
+        this.retryDelaysMs =
+            options.retryDelaysMs ?? DEFAULT_SAFE_MUTATION_RETRY_DELAYS_MS;
+        this.sleep =
+            options.sleep ??
+                ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
     }
     // Default type allows property access on raw GraphQL responses.
     // Callers can narrow with explicit type parameter: rawRequest<{ issues: { nodes: T[] } }>(...)
-    async rawRequest(query, variables) {
+    async rawRequest(query, variables, options = {}) {
+        let attempt = 0;
         try {
-            const response = await this.graphQLClient.rawRequest(query, variables);
-            return response.data;
+            while (true) {
+                try {
+                    const response = await this.graphQLClient.rawRequest(query, variables);
+                    return response.data;
+                }
+                catch (error) {
+                    if (!options.retrySafeMutation ||
+                        attempt >= this.retryDelaysMs.length ||
+                        !isTransientGraphQLError(error)) {
+                        throw error;
+                    }
+                    await this.sleep(this.retryDelaysMs[attempt]);
+                    attempt += 1;
+                }
+            }
         }
         catch (error) {
             const err = error;

package/dist/utils/linear-service.d.ts

@@ -58,6 +58,23 @@ export declare class LinearService {
      * have to double-resolve.
      */
     resolveProjectId(projectInput: string, teamInput?: string): Promise<string>;
+    /**
+     * Resolve a `--status` value on `projects update` to a `ProjectStatus` id
+     * (DEV-7021). Project statuses are a workspace-configurable set (Linear
+     * Settings → Workflow → Projects) — there is no fixed enum to validate
+     * against client-side, unlike `VALID_PROJECT_STATES` in `commands/projects.ts`
+     * (which enumerates the *type* group, not the individual named statuses).
+     * `client.projectStatuses()` has no server-side name filter, so we fetch the
+     * workspace's full set (small in practice — a handful of statuses) and match
+     * case-insensitively. On a miss, list the workspace's actual status names
+     * rather than surfacing Linear's raw `statusId` mutation error, which names
+     * the *type* (e.g. "paused") instead of a status a caller could have typed.
+     *
+     * Mirrors `resolveTeamId`'s not-found shape (`Available teams: ...`) rather
+     * than `resolveStatusId`'s (which omits the list) — this is the "workspace-
+     * configurable set with candidates on a miss" precedent to follow.
+     */
+    resolveProjectStatusId(statusName: string): Promise<string>;
     /**
      * Normalize a user-supplied project input to a UUID when the input is
      * a URL or slug-id form. Pass-through for UUIDs and plain names — the

package/dist/utils/linear-service.js

@@ -582,6 +582,34 @@ export class LinearService {
         const descriptions = candidates.map((c) => `${c.id} (teams: ${c.teamKeys.join(", ") || "none"})`);
         throw multipleMatchesError("project", projectInput, descriptions, "scope with --team, or pass the project URL/slug-id");
     }
+    /**
+     * Resolve a `--status` value on `projects update` to a `ProjectStatus` id
+     * (DEV-7021). Project statuses are a workspace-configurable set (Linear
+     * Settings → Workflow → Projects) — there is no fixed enum to validate
+     * against client-side, unlike `VALID_PROJECT_STATES` in `commands/projects.ts`
+     * (which enumerates the *type* group, not the individual named statuses).
+     * `client.projectStatuses()` has no server-side name filter, so we fetch the
+     * workspace's full set (small in practice — a handful of statuses) and match
+     * case-insensitively. On a miss, list the workspace's actual status names
+     * rather than surfacing Linear's raw `statusId` mutation error, which names
+     * the *type* (e.g. "paused") instead of a status a caller could have typed.
+     *
+     * Mirrors `resolveTeamId`'s not-found shape (`Available teams: ...`) rather
+     * than `resolveStatusId`'s (which omits the list) — this is the "workspace-
+     * configurable set with candidates on a miss" precedent to follow.
+     */
+    async resolveProjectStatusId(statusName) {
+        if (isUuid(statusName)) {
+            return statusName;
+        }
+        const statuses = await this.client.projectStatuses({ first: 250 });
+        const match = statuses.nodes.find((s) => s.name.toLowerCase() === statusName.toLowerCase());
+        if (!match) {
+            const available = statuses.nodes.map((s) => s.name);
+            throw notFoundError("Project status", statusName, undefined, `\n  Available statuses: ${available.join(", ")}`);
+        }
+        return match.id;
+    }
     /**
      * Normalize a user-supplied project input to a UUID when the input is
      * a URL or slug-id form. Pass-through for UUIDs and plain names — the

package/dist/utils/protected-ranges.d.ts

@@ -37,8 +37,8 @@ export interface ProtectedRange {
 }
 /**
  * Find ranges of `text` that should NOT have identifiers processed.
- * Covered: fenced code, inline backticks, existing markdown links,
- * Slack links, angle-bracket autolinks, bare URLs.
+ * Covered: fenced code, inline backticks, HTML comments, existing markdown
+ * links, Slack links, angle-bracket autolinks, bare URLs.
  *
  * The returned ranges may overlap; callers only test "is this position
  * inside any protected range" so overlap is harmless.

package/dist/utils/protected-ranges.js

@@ -22,6 +22,12 @@ const FENCED_CODE_BLOCK_REGEX = /(?:^|\n)([ \t]*)(?:```|~~~)[^\n]*\n[\s\S]*?\n\1
 // for spans containing backticks; we keep it simple and match
 // single-backtick spans, which covers the common case.
 const INLINE_CODE_REGEX = /`[^`\n]+?`/g;
+// HTML comments carry machine-readable metadata in Markdown documents (for
+// example, el-git's signed review and nit-disposition markers). They are not
+// rendered prose, so identifiers inside them must remain byte-for-byte stable.
+// Treat an unterminated comment as extending to EOF: preserving a malformed
+// marker is safer than inserting Markdown into its payload.
+const HTML_COMMENT_REGEX = /<!--[\s\S]*?(?:-->|$)/g;
 // Existing markdown links: [text](url). Both halves protected so
 // identifiers inside the URL or the text aren't reprocessed.
 const MARKDOWN_LINK_REGEX = /\[([^\]]*)\]\(([^)]*)\)/g;
@@ -116,8 +122,8 @@ function trimBareUrlTrailingPunct(url) {
 }
 /**
  * Find ranges of `text` that should NOT have identifiers processed.
- * Covered: fenced code, inline backticks, existing markdown links,
- * Slack links, angle-bracket autolinks, bare URLs.
+ * Covered: fenced code, inline backticks, HTML comments, existing markdown
+ * links, Slack links, angle-bracket autolinks, bare URLs.
  *
  * The returned ranges may overlap; callers only test "is this position
  * inside any protected range" so overlap is harmless.
@@ -127,6 +133,7 @@ export function findProtectedRanges(text) {
     for (const re of [
         FENCED_CODE_BLOCK_REGEX,
         INLINE_CODE_REGEX,
+        HTML_COMMENT_REGEX,
         MARKDOWN_LINK_REGEX,
         // Slack links must be considered before generic angle-bracket
         // autolinks — the autolink regex doesn't know about the `|label`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@enrichlayer/el-linear",
-  "version": "1.43.0",
+  "version": "1.44.0",
   "description": "A pragmatic CLI for Linear.app — deterministic team/label/member resolution, structured issue validation, configurable term enforcement, and a GraphQL escape hatch.",
   "main": "dist/main.js",
   "types": "dist/main.d.ts",
@@ -52,14 +52,14 @@
   },
   "dependencies": {
     "@inquirer/prompts": "^8.4.2",
-    "@linear/sdk": "^86.0.0",
+    "@linear/sdk": "^87.0.0",
     "commander": "^15.0.0",
     "picocolors": "^1.1.1"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.4.14",
-    "@types/node": "^25.0.0",
-    "graphql": "^16.0.0",
+    "@types/node": "^26.0.0",
+    "graphql": "^17.0.1",
     "tsx": "^4.21.0",
     "typescript": "^6.0.3",
     "vitest": "^4.0.18"