@joe-broadhead/opencode-linear 0.0.0-stage → 0.0.1

package/dist/index.js

@@ -0,0 +1,826 @@
+// src/constants.ts
+var PLUGIN_ID = "linear.workspace";
+var SERVER_NAME = "linear";
+var DISPLAY_NAME = "Linear";
+var ENDPOINTS = {
+  read: "https://mcp.linear.app/mcp/readonly",
+  write: "https://mcp.linear.app/mcp"
+};
+var SUPPORTED_HOST = ">=2.2.3 <2.3.0";
+var errorText = (code, message, nextStep) => `${code}: ${message} Next step: ${nextStep}`;
+function linearError(code, message, nextStep) {
+  return Object.assign(new Error(errorText(code, message, nextStep)), { code, nextStep });
+}
+
+// src/plugin.ts
+import { Plugin } from "@opencode/plugin";
+
+// src/host-version.ts
+var RELEASE = /^(\d+)\.(\d+)\.(\d+)$/;
+var parse = (version) => RELEASE.exec(version)?.slice(1).map(Number);
+var [LOWEST, ABOVE] = SUPPORTED_HOST.split(" ").map((bound) => parse(bound.replace(/^[<>]=?/, "")));
+var compare = (a, b) => a[0] - b[0] || a[1] - b[1] || a[2] - b[2];
+function isTestedHost(version) {
+  const parts = parse(version);
+  return parts !== void 0 && compare(parts, LOWEST) >= 0 && compare(parts, ABOVE) < 0;
+}
+function checkHost(version, allowUntestedHost) {
+  if (isTestedHost(version)) return { version, tested: true };
+  if (!allowUntestedHost) {
+    throw linearError(
+      "HOST_UNTESTED",
+      `This plugin supports OpenCode ${SUPPORTED_HOST}, found ${version}.`,
+      "Install a plugin version made for your OpenCode, or set the plugin option allowUntestedHost: true to try anyway."
+    );
+  }
+  const warning = `OpenCode ${version} is outside the tested line ${SUPPORTED_HOST}. The plugin runs because allowUntestedHost is true; if Linear misbehaves, use a tested OpenCode release.`;
+  return { version, tested: false, warning };
+}
+
+// src/host/tools-rpc.ts
+import { randomUUID } from "node:crypto";
+import { Rpc } from "@opencode/plugin/rpc";
+
+// src/linear-tools.ts
+var READ_TOOLS = [
+  "extract_images",
+  "get_agent_skill",
+  "get_attachment",
+  "get_diff",
+  "get_diff_threads",
+  "get_document",
+  "get_initiative",
+  "get_issue",
+  "get_issue_status",
+  "get_milestone",
+  "get_notifications",
+  "get_project",
+  "get_release",
+  "get_release_note",
+  "get_status_updates",
+  "get_team",
+  "get_template",
+  "get_triage_responsibility",
+  "get_user",
+  "get_workspace",
+  "list_agent_skills",
+  "list_comments",
+  "list_custom_views",
+  "list_cycles",
+  "list_diffs",
+  "list_documents",
+  "list_initiative_labels",
+  "list_initiatives",
+  "list_issue_labels",
+  "list_issue_statuses",
+  "list_issues",
+  "list_milestones",
+  "list_project_labels",
+  "list_projects",
+  "list_release_notes",
+  "list_release_pipelines",
+  "list_releases",
+  "list_teams",
+  "list_templates",
+  "list_users",
+  "search_documentation",
+  "whoami"
+];
+var WRITE_TOOLS = [
+  "create_attachment",
+  "create_attachment_from_upload",
+  "create_initiative_label",
+  "create_issue_label",
+  "delete_attachment",
+  "delete_comment",
+  "delete_diff_comment",
+  "delete_status_update",
+  "mark_notification",
+  "merge_diff",
+  "prepare_attachment_upload",
+  "prepare_file_upload",
+  "resolve_diff_thread",
+  "restore_initiative_label",
+  "restore_issue_label",
+  "restore_project_label",
+  "retire_initiative_label",
+  "retire_issue_label",
+  "retire_project_label",
+  "save_comment",
+  "save_diff_comment",
+  "save_document",
+  "save_initiative",
+  "save_initiative_label",
+  "save_issue",
+  "save_issue_label",
+  "save_milestone",
+  "save_project",
+  "save_project_label",
+  "save_release",
+  "save_release_note",
+  "save_status_update",
+  "share_issue",
+  "submit_diff_review",
+  "unshare_issue",
+  "update_diff"
+];
+function classify(name) {
+  if (READ_TOOLS.includes(name)) return "read";
+  if (WRITE_TOOLS.includes(name)) return "write";
+  return "unknown";
+}
+
+// src/host/tools-rpc.ts
+var PLUGIN_ID2 = PLUGIN_ID;
+var KNOWN_READS = READ_TOOLS;
+function shapeResult(_method, result) {
+  return result;
+}
+var NEXT_STEPS = {
+  SESSION_UNKNOWN: `Create a session that names an agent, such as POST /api/session with {"agent":"build"}, and pass its id.`,
+  SESSION_AGENT_REQUIRED: `Create a session that names an agent, such as POST /api/session with {"agent":"build"}, and pass its id.`,
+  PERMISSION_DENIED: "Add an allow rule for the tool to the session's agent or to the session, or use a session whose agent allows it.",
+  SERVER_CONFLICT: `Run /linear-status, then point your own mcp.servers.${SERVER_NAME} in opencode.json at the URL it names or remove it, and restart OpenCode.`,
+  AUTH_REQUIRED: `Run /connect and choose Linear, then press o or Enter to open the link (in a terminal, opencode mcp auth ${SERVER_NAME} opens it automatically).`,
+  CONNECTING: "Wait a few seconds, then call the method again.",
+  CONNECTION_FAILED: "Check your network, then run /linear-status and follow its next step.",
+  DISABLED: `Enable the ${SERVER_NAME} server in /mcps, or remove "disabled": true from mcp.servers.${SERVER_NAME} in opencode.json.`,
+  NOT_REGISTERED: "Run /linear-status and follow its next step.",
+  TOOL_UNAVAILABLE: "Call describe to see which methods OpenCode lists now, and run /linear-status.",
+  UPSTREAM_ERROR: "Check the input against the method's schema from describe, and run /linear-status if it keeps failing.",
+  CANCELLED: "Call the method again if you still need the result."
+};
+function pluginError(_error) {
+  return void 0;
+}
+var TOOLS_RPC_ID = `${PLUGIN_ID2}.tools`;
+var UNATTENDED = "A script cannot answer an approval prompt; this needs an allow rule for the session's agent.";
+var MESSAGE_ID = "msg_script";
+var UPSTREAM_LIMIT = 300;
+var object = (properties, required) => ({
+  type: "object",
+  properties,
+  required,
+  additionalProperties: false
+});
+var STRING = { type: "string" };
+var ANY_OBJECT = { type: "object" };
+var NO_INPUT = object({}, []);
+var FAILED = object({ code: STRING, next: STRING }, ["code", "next"]);
+var mcpOutput = (output = {}) => object({ output, text: STRING }, ["text"]);
+var DESCRIBED = object(
+  {
+    name: STRING,
+    tool: STRING,
+    kind: { type: "string", enum: ["mcp", "plugin"] },
+    action: STRING,
+    description: STRING,
+    available: { type: "boolean" },
+    reason: STRING,
+    input: ANY_OBJECT,
+    output: ANY_OBJECT
+  },
+  ["name", "tool", "kind", "action", "description", "available", "input", "output"]
+);
+var DESCRIPTION = object({ id: STRING, call: STRING, location: STRING, methods: { type: "array", items: DESCRIBED } }, [
+  "id",
+  "call",
+  "location",
+  "methods"
+]);
+var plainObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function strict(schema, issues) {
+  const keys = Object.keys(schema["properties"]);
+  const validate = (value) => {
+    if (!plainObject(value)) return { issues: [{ message: "Expected an object" }] };
+    const found = [...Object.keys(value).filter((key) => !keys.includes(key)).map((key) => `"${key}" is not allowed`), ...issues(value)];
+    return found.length === 0 ? { value } : { issues: found.map((message) => ({ message })) };
+  };
+  return Object.defineProperty({ ...schema }, "~standard", { value: { version: 1, vendor: "tools-rpc", validate }, enumerable: false });
+}
+var ScriptError = class extends Error {
+  failure;
+  constructor(failure) {
+    super(`${failure.code}: ${failure.what.replace(/[.\s]+$/, "")}. Next step: ${failure.next}`);
+    this.failure = failure;
+  }
+};
+var fail = (code, what) => new ScriptError({ code, what, next: NEXT_STEPS[code] });
+var record = (value) => typeof value === "object" && value !== null;
+function notFound(error, tags) {
+  if (!record(error)) return false;
+  const tag = error["_tag"] ?? error["name"];
+  return typeof tag === "string" && tags.includes(tag) || error["status"] === 404 || error["statusCode"] === 404;
+}
+var toolError = (error) => record(error) && error["_tag"] === "Tool.Error";
+var wildcard = (pattern, value) => new RegExp(`^${pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".")}$`).test(value);
+var hidden = (rules, action) => rules.findLast((rule2) => wildcard(rule2.action, action) && wildcard(rule2.resource, "*"))?.effect === "deny";
+var SECRETS = [
+  [/\b(bearer|basic|token)\s+[\w.~+/=-]{8,}/gi, "$1 [redacted]"],
+  [/\b([\w-]*(?:api[_-]?key|access[_-]?key|private[_-]?key|token|secret|password|signature|credential)["']?\s*[:=]\s*)["']?[^\s"'&,;]+["']?/gi, "$1[redacted]"],
+  [/\beyJ[\w-]{4,}\.[\w-]{4,}\.[\w-]{4,}/g, "[redacted]"],
+  [/\b(?:tvly|sk|pk|rk|ghp|gho|ghu|ghs|ghr|github_pat|glpat|xox[abposr]|lin_api|lin_oauth)[-_][\w-]{8,}/gi, "[redacted]"],
+  [/[\w+=-]{40,}/g, "[redacted]"]
+];
+var withoutQuery = (text) => text.replace(/\bhttps?:\/\/[^\s"'<>()]+/gi, (url) => {
+  const cut = url.search(/[?#]/);
+  return cut === -1 ? url : `${url.slice(0, cut)}?[redacted]`;
+});
+function upstreamText(text) {
+  const line = text.split(/\r?\n/).find((part) => part.trim() !== "")?.trim() ?? "no message";
+  const redacted = SECRETS.reduce((value, [pattern, replacement]) => value.replace(pattern, replacement), withoutQuery(line));
+  return redacted.length <= UPSTREAM_LIMIT ? redacted : `${redacted.slice(0, UPSTREAM_LIMIT - 1)}\u2026`;
+}
+var jsonSchema = (schema) => record(schema) && !("ast" in schema) && !("~standard" in schema) ? schema : void 0;
+function normalise(result) {
+  const text = typeof result.content === "string" ? result.content : (result.content ?? []).flatMap((part) => part.type === "text" ? [part.text] : []).join("\n");
+  return result.output === void 0 ? { text } : { output: result.output, text };
+}
+function connection(status) {
+  switch (status) {
+    case "connected":
+      return void 0;
+    case "pending":
+      return "CONNECTING";
+    case "needs_auth":
+      return "AUTH_REQUIRED";
+    case "failed":
+      return "CONNECTION_FAILED";
+    case "disabled":
+      return "DISABLED";
+    default:
+      return "NOT_REGISTERED";
+  }
+}
+var STATUS_TEXT = {
+  CONNECTING: "is still connecting",
+  AUTH_REQUIRED: "needs a sign-in",
+  CONNECTION_FAILED: "could not connect",
+  DISABLED: "is disabled",
+  NOT_REGISTERED: "is not registered"
+};
+async function registerToolsRpc(ctx, options) {
+  const { mcp, owned = [] } = options;
+  const accounts = typeof mcp?.server === "function";
+  if (KNOWN_READS.length > 0 && !mcp) throw new Error("registerToolsRpc: KNOWN_READS needs the mcp option");
+  if (accounts && NEXT_STEPS.ACCOUNT_UNKNOWN === void 0) throw new Error("registerToolsRpc: per-account servers need NEXT_STEPS.ACCOUNT_UNKNOWN");
+  const names = [...KNOWN_READS, ...owned.map((method) => method.name)];
+  const duplicate = names.find((name, index) => name === "describe" || names.indexOf(name) !== index);
+  if (duplicate) throw new Error(`registerToolsRpc: the method name "${duplicate}" is taken`);
+  const live = /* @__PURE__ */ new Set();
+  const serverOf = (account) => {
+    const server = typeof mcp.server === "function" ? mcp.server(account) : mcp.server;
+    if (server !== void 0) return server;
+    throw new ScriptError({ code: "ACCOUNT_UNKNOWN", what: `there is no account '${account}'`, next: NEXT_STEPS.ACCOUNT_UNKNOWN });
+  };
+  const session = async (sessionID) => {
+    let info;
+    try {
+      info = await ctx.session.get({ sessionID });
+    } catch (error) {
+      if (notFound(error, ["Session.NotFoundError", "SessionNotFoundError"])) throw fail("SESSION_UNKNOWN", `there is no session '${sessionID}'`);
+      throw error;
+    }
+    if (!info.agent) throw fail("SESSION_AGENT_REQUIRED", `session '${sessionID}' names no agent`);
+    let agent;
+    try {
+      agent = await ctx.agent.get({ agentID: info.agent, location: info.location });
+    } catch (error) {
+      if (notFound(error, ["Agent.NotFoundError", "AgentNotFoundError"])) throw fail("SESSION_AGENT_REQUIRED", `session '${sessionID}' names the agent '${info.agent}', which does not exist`);
+      throw error;
+    }
+    const rules = [...agent.data.permissions, ...info.permissions ?? []];
+    return { agent: info.agent, rules };
+  };
+  const unavailable = async (server, tool, connected) => {
+    const status = (await ctx.mcp.list()).data.find((entry) => entry.name === server)?.status.status;
+    const code = connection(status) ?? connected;
+    if (code === "TOOL_UNAVAILABLE") return fail(code, `OpenCode does not list ${tool} on the connected "${server}" server`);
+    return fail(code, `the "${server}" server ${STATUS_TEXT[code] ?? "is unavailable"}`);
+  };
+  const denied = (action, error) => {
+    const reason = record(error) && typeof error["message"] === "string" ? error["message"] : String(error);
+    return fail("PERMISSION_DENIED", `${action} was refused for this session's agent: ${upstreamText(reason)}`);
+  };
+  const mcpTarget = (name, envelope2) => {
+    const server = serverOf(envelope2.account);
+    const action = `${server}_${name}`;
+    return {
+      action,
+      mcp: true,
+      async run(call) {
+        if (!mcp.managed(server)) throw fail("SERVER_CONFLICT", `the "${server}" server in your config is not the one this plugin manages`);
+        const tool = (await ctx.tool.list()).find((entry) => entry.id === action);
+        if (!tool) throw await unavailable(server, action, "TOOL_UNAVAILABLE");
+        let result;
+        try {
+          result = await tool.execute(envelope2.input, call);
+        } catch (error) {
+          if (error instanceof Error && error.message.startsWith(`MCP server "${server}" `)) throw await unavailable(server, action, "CONNECTION_FAILED");
+          throw error;
+        }
+        return shapeResult(name, normalise(result));
+      }
+    };
+  };
+  const ownedTarget = (spec, envelope2) => ({
+    action: spec.action,
+    mcp: false,
+    run: async (call) => await spec.run(envelope2.input, call) ?? null
+  });
+  const invoke = async (target, raw, context) => {
+    const envelope2 = raw;
+    let method;
+    try {
+      if (context.signal.aborted) throw fail("CANCELLED", "the call was cancelled");
+      method = target(envelope2);
+      const { agent, rules } = await session(envelope2.sessionID);
+      if (hidden(rules, method.action)) throw fail("PERMISSION_DENIED", `${method.action} is hidden from this session's agent by a deny rule`);
+      const call = {
+        sessionID: envelope2.sessionID,
+        agent,
+        messageID: MESSAGE_ID,
+        id: `script:${randomUUID()}`,
+        signal: context.signal,
+        progress: async () => {
+        }
+      };
+      live.add(call.id);
+      try {
+        return JSON.parse(JSON.stringify(await method.run(call)));
+      } finally {
+        live.delete(call.id);
+      }
+    } catch (error) {
+      const failure = refusal(error, method, context.signal);
+      if (!failure) throw error;
+      return context.error("failed", new ScriptError(failure).message, { code: failure.code, next: failure.next });
+    }
+  };
+  const refusal = (error, method, signal) => {
+    if (signal.aborted) return fail("CANCELLED", "the call was cancelled").failure;
+    if (error instanceof ScriptError) return error.failure;
+    const own = pluginError(error);
+    if (own || !method || !toolError(error)) return own;
+    if (error.error !== void 0) return denied(method.action, error).failure;
+    if (method.mcp) return fail("UPSTREAM_ERROR", `${method.action} failed: ${upstreamText(error.message)}`).failure;
+    return void 0;
+  };
+  const describe2 = async () => {
+    const tools = mcp ? await ctx.tool.list() : [];
+    const methods = [];
+    if (mcp) {
+      const server = serverOf(void 0);
+      const managed = mcp.managed(server);
+      const status = managed ? (await ctx.mcp.list()).data.find((entry) => entry.name === server)?.status.status : void 0;
+      for (const name of KNOWN_READS) {
+        const id = `${server}_${name}`;
+        const tool = managed ? tools.find((entry) => entry.id === id) : void 0;
+        const reason = !managed ? "SERVER_CONFLICT" : tool ? void 0 : connection(status) ?? "TOOL_UNAVAILABLE";
+        const input = jsonSchema(tool?.input) ?? ANY_OBJECT;
+        const output = jsonSchema(tool?.output);
+        methods.push({
+          name,
+          tool: id,
+          kind: "mcp",
+          action: id,
+          description: tool?.description ?? "",
+          available: reason === void 0,
+          ...reason ? { reason } : {},
+          input,
+          output: mcpOutput(output)
+        });
+      }
+    }
+    for (const spec of owned)
+      methods.push({ name: spec.name, tool: spec.name, kind: "plugin", action: spec.action, description: spec.description, available: true, input: spec.input, output: spec.output });
+    return JSON.parse(
+      JSON.stringify({
+        id: TOOLS_RPC_ID,
+        call: `POST /api/rpc/${TOOLS_RPC_ID}/<method> with {"input":{"sessionID":"<session>",${accounts ? `"account":"<account>",` : ""}"input":<the tool's input>}}`,
+        location: ctx.location.directory,
+        methods
+      })
+    );
+  };
+  const envelope = (input, objectInput) => strict(
+    object({ sessionID: { type: "string", minLength: 1 }, ...accounts ? { account: { type: "string", minLength: 1 } } : {}, input }, ["sessionID", "input"]),
+    (value) => [
+      ...typeof value["sessionID"] === "string" && value["sessionID"] !== "" ? [] : [`"sessionID" must be a non-empty string`],
+      ...value["account"] === void 0 || typeof value["account"] === "string" && value["account"] !== "" ? [] : [`"account" must be a non-empty string`],
+      ...!("input" in value) ? [`"input" is missing`] : objectInput && !plainObject(value["input"]) ? [`"input" must be an object`] : []
+    ]
+  );
+  const contract = Rpc.define({
+    id: TOOLS_RPC_ID,
+    methods: {
+      describe: { input: NO_INPUT, output: DESCRIPTION },
+      ...Object.fromEntries(KNOWN_READS.map((name) => [name, { input: envelope(ANY_OBJECT, true), output: mcpOutput(), errors: { failed: FAILED } }])),
+      ...Object.fromEntries(owned.map((spec) => [spec.name, { input: envelope(spec.input, false), output: spec.output, errors: { failed: FAILED } }]))
+    },
+    events: {}
+  });
+  const handlers = {
+    describe: () => describe2(),
+    ...Object.fromEntries(KNOWN_READS.map((name) => [name, (raw, context) => invoke((envelope2) => mcpTarget(name, envelope2), raw, context)])),
+    ...Object.fromEntries(owned.map((spec) => [spec.name, (raw, context) => invoke((envelope2) => ownedTarget(spec, envelope2), raw, context)]))
+  };
+  const registration = await ctx.rpc.register(contract, handlers);
+  const hook = await ctx.permission.hook("evaluate", (evaluation) => {
+    if (evaluation.effect !== "ask" || evaluation.source === void 0 || !live.has(evaluation.source.id)) return;
+    evaluation.effect = "deny";
+    evaluation.message = UNATTENDED;
+  });
+  return async () => {
+    await hook.dispose().catch(() => void 0);
+    await registration.dispose().catch(() => void 0);
+  };
+}
+
+// src/integration.ts
+var SIGN_IN_AGAIN = "Linear needs a new sign-in. Choose this account to sign in again.";
+var STARTUP_POLL_MS = 250;
+var STARTUP_WINDOW_MS = 1e4;
+var RESUBSCRIBE_MS = 5e3;
+function watchIntegration(ctx, owned) {
+  const stopped = new AbortController();
+  let registration;
+  const sync = async () => {
+    const server = owned() ? (await ctx.mcp.list()).data.find((item) => item.name === SERVER_NAME) : void 0;
+    const id = server?.integrationID;
+    if (!server || !id) return;
+    const { data } = await ctx.integration.get({ integrationID: id });
+    if (data.name !== DISPLAY_NAME && !stopped.signal.aborted) {
+      const previous = registration;
+      registration = await ctx.integration.transform((editor) => {
+        if (editor.get(id)) editor.update(id, (integration) => void (integration.name = DISPLAY_NAME));
+      });
+      await previous?.dispose();
+    }
+    const connection2 = await ctx.integration.connection.active(id);
+    if (connection2?.type !== "credential") return;
+    const reported = connection2.status?.message === SIGN_IN_AGAIN;
+    if (server.status.status === "needs_auth" && !connection2.status) {
+      await ctx.integration.connection.status({ integrationID: id, connection: connection2, status: { status: "needs_auth", message: SIGN_IN_AGAIN } });
+    } else if (server.status.status === "connected" && reported) {
+      await ctx.integration.connection.status({ integrationID: id, connection: connection2, status: void 0 });
+    }
+  };
+  let running;
+  let again = false;
+  const schedule = () => {
+    if (running) return void (again = true);
+    running = (async () => {
+      do {
+        again = false;
+        if (!stopped.signal.aborted) await sync().catch(() => void 0);
+      } while (again);
+    })().finally(() => running = void 0);
+  };
+  void (async () => {
+    while (!stopped.signal.aborted) {
+      try {
+        const events = ctx.event.subscribe({ types: ["integration.updated", "mcp.status.changed", "credential.updated", "credential.switched"], signal: stopped.signal });
+        for await (const event of events) if (event.type !== "mcp.status.changed" || event.data.server === SERVER_NAME) schedule();
+      } catch {
+      }
+      if (!stopped.signal.aborted) schedule();
+      await delay(RESUBSCRIBE_MS, stopped.signal);
+    }
+  })();
+  const startup = (async () => {
+    for (const until = Date.now() + STARTUP_WINDOW_MS; Date.now() < until && !stopped.signal.aborted; ) {
+      schedule();
+      await delay(STARTUP_POLL_MS, stopped.signal);
+    }
+  })();
+  return async () => {
+    stopped.abort();
+    await startup;
+    await running;
+    await registration?.dispose();
+    registration = void 0;
+  };
+}
+var delay = (ms, signal) => new Promise((resolve) => {
+  if (signal.aborted) return resolve();
+  const done = () => {
+    clearTimeout(timer);
+    signal.removeEventListener("abort", done);
+    resolve();
+  };
+  const timer = setTimeout(done, ms);
+  signal.addEventListener("abort", done, { once: true });
+});
+
+// src/options.ts
+var EXAMPLE = `"plugins": [{ "package": "@joe-broadhead/opencode-linear", "options": { "access": "write" } }]`;
+var ACCEPTED = {
+  access: `"read" (the default) or "write"`,
+  allowUntestedHost: "true or false (the default)"
+};
+var invalid = (problem) => linearError("OPTIONS_INVALID", `${problem}.`, `Fix the plugin options in opencode.json, for example ${EXAMPLE}.`);
+function parseOptions(raw) {
+  if (raw === void 0 || raw === null) return { access: "read", allowUntestedHost: false };
+  if (typeof raw !== "object" || Array.isArray(raw)) throw invalid(`The plugin options must be an object, found ${describe(raw)}`);
+  const input = raw;
+  for (const key of Object.keys(input)) {
+    if (!Object.hasOwn(ACCEPTED, key)) {
+      throw invalid(`Unknown option "${key}". Accepted options: ${Object.keys(ACCEPTED).map((name) => `"${name}"`).join(", ")}`);
+    }
+  }
+  const { access = "read", allowUntestedHost = false } = input;
+  if (access !== "read" && access !== "write") throw invalid(`The option "access" must be ${ACCEPTED.access}, found ${describe(access)}`);
+  if (typeof allowUntestedHost !== "boolean") {
+    throw invalid(`The option "allowUntestedHost" must be ${ACCEPTED.allowUntestedHost}, found ${describe(allowUntestedHost)}`);
+  }
+  return { access, allowUntestedHost };
+}
+var describe = (value) => value === null ? "null" : Array.isArray(value) ? "an array" : typeof value === "string" ? JSON.stringify(value) : typeof value === "object" ? "an object" : String(value);
+
+// src/permissions.ts
+var actionOf = (tool) => `${SERVER_NAME}_${tool}`;
+var ASK_ALL = { action: actionOf("*"), resource: "*", effect: "ask" };
+var rule = (tool, effect) => ({ action: actionOf(tool), resource: "*", effect });
+var defaultRules = () => [{ ...ASK_ALL }, ...READ_TOOLS.map((tool) => rule(tool, "allow"))];
+var same = (a, b) => a.action === b.action && a.resource === b.resource && a.effect === b.effect;
+var BASE_ALLOW = { action: "*", resource: "*", effect: "allow" };
+function hasDefaultRules(permissions) {
+  const base = permissions.findIndex((item) => same(item, BASE_ALLOW));
+  return permissions.some((item, index) => index > base && same(item, ASK_ALL));
+}
+function insertRules(permissions, rules) {
+  if (hasDefaultRules(permissions)) return false;
+  const base = permissions.findIndex((item) => same(item, BASE_ALLOW));
+  if (base === -1) return false;
+  permissions.splice(base + 1, 0, ...rules.map((item) => ({ ...item })));
+  return true;
+}
+function registerDefaultRules(agent, rules, report) {
+  return agent.transform((editor) => {
+    try {
+      for (const { id } of editor.list()) editor.update(id, (info) => void insertRules(info.permissions, rules));
+      report(void 0);
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : String(error);
+      report(errorText("RULES_NOT_ADDED", `Linear's default permission rules could not be added (${reason}), so Linear tools may run without asking.`, "Restart OpenCode."));
+    }
+  });
+}
+var wildcard2 = (pattern) => new RegExp(`^${pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".")}$`);
+function evaluate(permissions, action) {
+  return permissions.findLast((item) => wildcard2(item.action).test(action) && wildcard2(item.resource).test("*"))?.effect ?? "ask";
+}
+var unguardedAgents = (agents) => agents.filter((agent) => !hasDefaultRules(agent.permissions) && evaluate(agent.permissions, actionOf("new_tool")) === "allow").map((agent) => agent.id);
+
+// src/skills.ts
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { Skill } from "@opencode/plugin";
+var SKILLS_DIR = fileURLToPath(new URL("../skills/", import.meta.url));
+var skillNames = (access) => access === "write" ? ["linear", "linear-write"] : ["linear"];
+var notLoaded = (name, problem) => `The "${name}" skill was not loaded: skills/${name}/SKILL.md ${problem}.`;
+var REINSTALL = "Reinstall the plugin.";
+function parseSkill(name, path, text) {
+  const fail2 = (problem) => linearError("SKILLS_INVALID", notLoaded(name, problem), REINSTALL);
+  const match = /^---\n([\s\S]*?)\n---\n?([\s\S]*)$/.exec(text.replace(/\r\n/g, "\n"));
+  if (!match) throw fail2("has no frontmatter");
+  const fields = new Map(
+    match[1].split("\n").map((line) => [line.slice(0, line.indexOf(":")).trim(), line.slice(line.indexOf(":") + 1).trim().replace(/^(["'])(.*)\1$/, "$2")])
+  );
+  if (fields.get("name") !== name) throw fail2(`must be named "${name}" in its frontmatter`);
+  const description = fields.get("description");
+  if (!description) throw fail2("has no description");
+  return { id: Skill.ID.make(name), name: Skill.Name.make(name), description, path: Skill.Info.fields.path.make(path), content: match[2].trim() };
+}
+async function loadSkills(access, directory = SKILLS_DIR) {
+  const skills = [];
+  const problems = [];
+  for (const name of skillNames(access)) {
+    const path = join(directory, name, "SKILL.md");
+    try {
+      skills.push(parseSkill(name, path, await readFile(path, "utf8")));
+    } catch (error) {
+      const code = error.code;
+      problems.push(code === "SKILLS_INVALID" ? error.message : errorText("SKILLS_INVALID", notLoaded(name, code === "ENOENT" ? "is missing" : `cannot be read (${String(code)})`), REINSTALL));
+    }
+  }
+  return { skills, problems };
+}
+function registerSkills(skill, skills) {
+  return skill.transform((editor) => {
+    for (const info of skills) editor.add(info);
+  });
+}
+
+// src/status.ts
+var SIGN_IN = `Run /connect and choose Linear, then press o or Enter to open the link (in a terminal, opencode mcp auth ${SERVER_NAME} opens it automatically).`;
+var AGENTS_FIX = [
+  `Put this block first in each listed agent's own "permissions" (agents.<id>.permissions in opencode.json, or the agent file's frontmatter), followed by your top-level "permissions" rules for linear_* tools:`,
+  ...defaultRules().map((rule2, index, rules) => `  ${JSON.stringify(rule2)}${index < rules.length - 1 ? "," : ""}`)
+].join("\n");
+var NOTHING_TO_DO = "Nothing to do.";
+function buildStatus(facts) {
+  const connection2 = !facts.server ? "not_configured" : facts.server.status === "needs_auth" ? "needs_sign_in" : facts.server.status;
+  const unknownTools = (facts.tools ?? []).filter((tool) => classify(tool) === "unknown");
+  const agentsWithoutRules = unguardedAgents(facts.agents ?? []);
+  const problems = facts.problems ?? [];
+  const status = {
+    connection: connection2,
+    ...facts.server?.error ? { error: facts.server.error } : {},
+    ...facts.account ? { account: facts.account } : {},
+    access: facts.access,
+    ...facts.source ? { source: facts.source } : {},
+    tools: facts.tools?.length ?? 0,
+    unknownTools,
+    agentsWithoutRules,
+    host: facts.host,
+    problems
+  };
+  return { ...status, nextStep: nextStepOf(status) };
+}
+function nextStepOf(status) {
+  if (status.source?.type === "conflict") {
+    const { url, expected } = status.source;
+    return `Your OpenCode config defines mcp.servers.${SERVER_NAME} with ${url}, but access "${status.access}" uses ${expected}. Point it at ${expected} or remove it, then restart OpenCode.`;
+  }
+  switch (status.connection) {
+    case "not_configured":
+      return `OpenCode has no ${SERVER_NAME} MCP server. Check that no organisation policy (mcp.use) or other plugin removes it, then restart OpenCode.`;
+    case "disabled":
+      return `The ${SERVER_NAME} MCP server is disabled. Enable it in /mcps, or remove "disabled": true from mcp.servers.${SERVER_NAME} in opencode.json.`;
+    case "pending":
+      return "Linear is still connecting. Run /linear-status again in a few seconds.";
+    case "needs_sign_in":
+      return SIGN_IN;
+    case "failed":
+      return "Check your network, then run /linear-status again.";
+  }
+  if (status.agentsWithoutRules.length) return `Add the block above to each listed agent's own "permissions".`;
+  const problem = status.problems[0]?.split(" Next step: ")[1];
+  if (problem) return problem;
+  if (!status.host.tested) return `If Linear misbehaves, use OpenCode ${SUPPORTED_HOST}.`;
+  return NOTHING_TO_DO;
+}
+var CONNECTION_TEXT = {
+  connected: "connected",
+  pending: "connecting",
+  needs_sign_in: "sign-in required",
+  failed: "failed",
+  disabled: "disabled",
+  not_configured: "not configured"
+};
+var ACCESS_TEXT = {
+  read: "read-only (Linear's read-only server; changes are not available)",
+  write: "read and write (each change asks before it runs)"
+};
+function serverText(source) {
+  if (source.type === "plugin") return `${source.url}, registered by this plugin`;
+  if (source.type === "adopted") return `${source.url}, your own mcp.servers.${SERVER_NAME}, used unchanged`;
+  return `your mcp.servers.${SERVER_NAME} points at ${source.url}`;
+}
+function formatStatus(status) {
+  const { source, host, unknownTools, agentsWithoutRules } = status;
+  const state = source?.type === "conflict" ? "conflict" : CONNECTION_TEXT[status.connection];
+  const details = [status.error, source && serverText(source)].filter(Boolean).join("; ");
+  const notes = [host.warning, ...status.problems].filter(Boolean);
+  return [
+    "Linear status",
+    `- Connection: ${state}${details ? ` (${details})` : ""}`,
+    `- Account: ${status.account ?? "account name not reported by Linear's MCP"}`,
+    `- Access: ${ACCESS_TEXT[status.access]}`,
+    `- Tools: ${status.tools} available, ${unknownTools.length}${unknownTools.length ? ` unknown: ${unknownTools.join(", ")} (unknown tools ask before running)` : " unknown"}`,
+    `- Agents without default rules: ${agentsWithoutRules.length ? `${agentsWithoutRules.join(", ")}. Linear tools run there without asking. ${AGENTS_FIX}` : "none"}`,
+    `- OpenCode: ${host.version} (${host.tested ? "tested" : "host untested"})${notes.length ? `. ${notes.join(" ")}` : ""}`,
+    `- Next step: ${status.nextStep}`
+  ].join("\n");
+}
+async function readStatus(ctx, facts) {
+  const [servers, agents, tools] = await Promise.all([ctx.mcp.list(), ctx.agent.list(), ctx.tool.list()]);
+  const server = servers.data.find((entry) => entry.name === SERVER_NAME);
+  const connection2 = server?.integrationID ? await ctx.integration.connection.active(server.integrationID).catch(() => void 0) : void 0;
+  return buildStatus({
+    ...facts,
+    ...server ? { server: server.status } : {},
+    ...connection2?.type === "credential" ? { account: connection2.label } : {},
+    tools: tools.filter((tool) => tool.options?.namespace === SERVER_NAME).map((tool) => tool.name),
+    agents: agents.data
+  });
+}
+var strings = { type: "array", items: { type: "string" } };
+var StatusRpc = {
+  id: PLUGIN_ID,
+  methods: {
+    status: {
+      input: { type: "object" },
+      output: {
+        type: "object",
+        required: ["connection", "access", "tools", "unknownTools", "agentsWithoutRules", "host", "problems", "nextStep"],
+        properties: {
+          connection: { enum: ["connected", "pending", "needs_sign_in", "failed", "disabled", "not_configured"] },
+          error: { type: "string" },
+          account: { type: "string" },
+          access: { enum: ["read", "write"] },
+          source: {
+            type: "object",
+            required: ["type", "url"],
+            properties: { type: { enum: ["plugin", "adopted", "conflict"] }, url: { type: "string" }, expected: { type: "string" } }
+          },
+          tools: { type: "integer", minimum: 0 },
+          unknownTools: strings,
+          agentsWithoutRules: strings,
+          host: { type: "object", required: ["version", "tested"], properties: { version: { type: "string" }, tested: { type: "boolean" }, warning: { type: "string" } } },
+          problems: strings,
+          nextStep: { type: "string" }
+        }
+      }
+    }
+  },
+  events: {}
+};
+function registerStatusRpc(rpc, read) {
+  return rpc.register(StatusRpc, { status: () => read() });
+}
+function registerStatusCommand(ctx, read) {
+  return ctx.command.transform(
+    (editor) => editor.add({
+      name: "linear-status",
+      description: "Show Linear's connection, sign-in, access mode and the next step",
+      execute: async ({ sessionID }) => {
+        const text = await read().then(
+          formatStatus,
+          (error) => errorText("STATUS_UNAVAILABLE", `Could not read Linear's status (${error instanceof Error ? error.message : String(error)}).`, "Restart OpenCode, then run /linear-status again.")
+        );
+        await ctx.session.synthetic({ sessionID, text, description: "Linear status", resume: false });
+      }
+    })
+  );
+}
+
+// src/plugin.ts
+var serverConfig = (seam, access) => ({
+  type: "remote",
+  url: seam.endpoints[access],
+  oauth: seam.oauth ?? { scope: access === "write" ? "read write" : "read" }
+});
+function displayUrl(url) {
+  try {
+    const parsed = new URL(url);
+    return `${parsed.origin}${parsed.pathname.replace(/\/+$/, "")}`;
+  } catch {
+    return "an invalid URL";
+  }
+}
+function registerServer(mcp, config, record2) {
+  return mcp.transform((editor) => {
+    try {
+      const existing = editor.get(SERVER_NAME);
+      const expected = displayUrl(config.url);
+      if (!existing) {
+        editor.set(SERVER_NAME, config);
+        return record2({ type: "plugin", url: expected });
+      }
+      const url = existing.type === "remote" ? displayUrl(existing.url) : "a local command";
+      record2(url === expected ? { type: "adopted", url } : { type: "conflict", url, expected });
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : String(error);
+      record2(void 0, errorText("SERVER_NOT_REGISTERED", `The ${SERVER_NAME} MCP server could not be registered (${reason}).`, "Restart OpenCode."));
+    }
+  });
+}
+function createLinearPlugin(seam) {
+  return Plugin.define({
+    id: PLUGIN_ID,
+    async setup(ctx) {
+      const options = parseOptions(ctx.options);
+      const host = checkHost(ctx.app.version, options.allowUntestedHost);
+      const { skills, problems: skillProblems } = await loadSkills(options.access, seam.skillsDir);
+      const problems = new Map(skillProblems.map((problem, index) => [`skill:${index}`, problem]));
+      const report = (area) => (problem) => void (problem ? problems.set(area, problem) : problems.delete(area));
+      let source;
+      await registerServer(ctx.mcp, serverConfig(seam, options.access), (next, problem) => {
+        source = next;
+        report("server")(problem);
+      });
+      await registerDefaultRules(ctx.agent, defaultRules(), report("rules"));
+      await registerSkills(ctx.skill, skills);
+      const read = () => readStatus(ctx, { ...source ? { source } : {}, access: options.access, host, problems: [...problems.values()] });
+      await registerStatusCommand(ctx, read);
+      await registerStatusRpc(ctx.rpc, read);
+      const owned = () => source?.type === "plugin" || source?.type === "adopted";
+      const stopTools = await registerToolsRpc(ctx, { mcp: { server: SERVER_NAME, managed: owned } });
+      const stopWatch = watchIntegration(ctx, owned);
+      return async () => {
+        await stopWatch();
+        await stopTools();
+      };
+    }
+  });
+}
+
+// src/index.ts
+var src_default = createLinearPlugin({ endpoints: ENDPOINTS });
+export {
+  src_default as default
+};