@joe-broadhead/opencode-linear 0.0.0 → 0.0.1

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 All notable changes to this project are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.0.1] - 2026-11-03
+
+### Added
+
+- The tools RPC, `linear.workspace.tools`: a script can call Linear's 42 known read tools with no model, through
+  `opencode api`, as a session and its agent, with either access. It gets exactly the access that agent's model has:
+  a tool its rules hide is refused, OpenCode checks each call against the agent's and the session's rules, and an ask
+  is refused at once because no one is there to answer it. `describe` lists the methods with each tool's live input
+  schema. Linear's write tools and tools Linear adds later are never methods. `docs/scripting.md` explains it.
+
 ## [0.0.0] - 2026-11-01
 
 ### Added

package/README.md

@@ -58,6 +58,18 @@ The plugin connects to Linear's **read-only** server by default (`https://mcp.li
 only tools that read, and Linear refuses changes through it. To let the model make changes, set the option
 `"access": "write"`; see [Configure](#configure).
 
+### Scripts
+
+A script or a cron job can call Linear's read tools with no model, through `opencode api`. It runs as a session and its
+agent, under that agent's permission rules and the session's own. Write tools are never available to scripts:
+
+```sh
+opencode api post /api/rpc/linear.workspace.tools/get_issue \
+  -d '{"input":{"sessionID":"ses_…","input":{"id":"ENG-123"}}}'
+```
+
+See [Scripting](https://github.com/joe-broadhead/opencode-linear/blob/HEAD/docs/scripting.md).
+
 ## Permissions
 
 The plugin adds these rules to every agent, directly after the agent's base rule that allows everything:
@@ -142,6 +154,9 @@ Run `/linear-status` first. Its last line is the next step.
 | `STATUS_UNAVAILABLE` | The status could not be read, or the plugin is not running. Follow the next step in the message. |
 | `SKILLS_INVALID` | A skill file in the package is missing or broken. Reinstall the plugin. |
 
+A script's errors from the tools RPC have their own codes, listed in
+[Scripting](https://github.com/joe-broadhead/opencode-linear/blob/HEAD/docs/scripting.md#errors).
+
 ## Uninstall
 
 ```sh

package/dist/index.js

@@ -37,6 +37,406 @@ function checkHost(version, allowUntestedHost) {
   return { version, tested: false, warning };
 }
 
+// src/host/tools-rpc.ts
+import { randomUUID } from "node:crypto";
+import { Rpc } from "@opencode/plugin/rpc";
+
+// src/linear-tools.ts
+var READ_TOOLS = [
+  "extract_images",
+  "get_agent_skill",
+  "get_attachment",
+  "get_diff",
+  "get_diff_threads",
+  "get_document",
+  "get_initiative",
+  "get_issue",
+  "get_issue_status",
+  "get_milestone",
+  "get_notifications",
+  "get_project",
+  "get_release",
+  "get_release_note",
+  "get_status_updates",
+  "get_team",
+  "get_template",
+  "get_triage_responsibility",
+  "get_user",
+  "get_workspace",
+  "list_agent_skills",
+  "list_comments",
+  "list_custom_views",
+  "list_cycles",
+  "list_diffs",
+  "list_documents",
+  "list_initiative_labels",
+  "list_initiatives",
+  "list_issue_labels",
+  "list_issue_statuses",
+  "list_issues",
+  "list_milestones",
+  "list_project_labels",
+  "list_projects",
+  "list_release_notes",
+  "list_release_pipelines",
+  "list_releases",
+  "list_teams",
+  "list_templates",
+  "list_users",
+  "search_documentation",
+  "whoami"
+];
+var WRITE_TOOLS = [
+  "create_attachment",
+  "create_attachment_from_upload",
+  "create_initiative_label",
+  "create_issue_label",
+  "delete_attachment",
+  "delete_comment",
+  "delete_diff_comment",
+  "delete_status_update",
+  "mark_notification",
+  "merge_diff",
+  "prepare_attachment_upload",
+  "prepare_file_upload",
+  "resolve_diff_thread",
+  "restore_initiative_label",
+  "restore_issue_label",
+  "restore_project_label",
+  "retire_initiative_label",
+  "retire_issue_label",
+  "retire_project_label",
+  "save_comment",
+  "save_diff_comment",
+  "save_document",
+  "save_initiative",
+  "save_initiative_label",
+  "save_issue",
+  "save_issue_label",
+  "save_milestone",
+  "save_project",
+  "save_project_label",
+  "save_release",
+  "save_release_note",
+  "save_status_update",
+  "share_issue",
+  "submit_diff_review",
+  "unshare_issue",
+  "update_diff"
+];
+function classify(name) {
+  if (READ_TOOLS.includes(name)) return "read";
+  if (WRITE_TOOLS.includes(name)) return "write";
+  return "unknown";
+}
+
+// src/host/tools-rpc.ts
+var PLUGIN_ID2 = PLUGIN_ID;
+var KNOWN_READS = READ_TOOLS;
+function shapeResult(_method, result) {
+  return result;
+}
+var NEXT_STEPS = {
+  SESSION_UNKNOWN: `Create a session that names an agent, such as POST /api/session with {"agent":"build"}, and pass its id.`,
+  SESSION_AGENT_REQUIRED: `Create a session that names an agent, such as POST /api/session with {"agent":"build"}, and pass its id.`,
+  PERMISSION_DENIED: "Add an allow rule for the tool to the session's agent or to the session, or use a session whose agent allows it.",
+  SERVER_CONFLICT: `Run /linear-status, then point your own mcp.servers.${SERVER_NAME} in opencode.json at the URL it names or remove it, and restart OpenCode.`,
+  AUTH_REQUIRED: `Run /connect and choose Linear, then press o or Enter to open the link (in a terminal, opencode mcp auth ${SERVER_NAME} opens it automatically).`,
+  CONNECTING: "Wait a few seconds, then call the method again.",
+  CONNECTION_FAILED: "Check your network, then run /linear-status and follow its next step.",
+  DISABLED: `Enable the ${SERVER_NAME} server in /mcps, or remove "disabled": true from mcp.servers.${SERVER_NAME} in opencode.json.`,
+  NOT_REGISTERED: "Run /linear-status and follow its next step.",
+  TOOL_UNAVAILABLE: "Call describe to see which methods OpenCode lists now, and run /linear-status.",
+  UPSTREAM_ERROR: "Check the input against the method's schema from describe, and run /linear-status if it keeps failing.",
+  CANCELLED: "Call the method again if you still need the result."
+};
+function pluginError(_error) {
+  return void 0;
+}
+var TOOLS_RPC_ID = `${PLUGIN_ID2}.tools`;
+var UNATTENDED = "A script cannot answer an approval prompt; this needs an allow rule for the session's agent.";
+var MESSAGE_ID = "msg_script";
+var UPSTREAM_LIMIT = 300;
+var object = (properties, required) => ({
+  type: "object",
+  properties,
+  required,
+  additionalProperties: false
+});
+var STRING = { type: "string" };
+var ANY_OBJECT = { type: "object" };
+var NO_INPUT = object({}, []);
+var FAILED = object({ code: STRING, next: STRING }, ["code", "next"]);
+var mcpOutput = (output = {}) => object({ output, text: STRING }, ["text"]);
+var DESCRIBED = object(
+  {
+    name: STRING,
+    tool: STRING,
+    kind: { type: "string", enum: ["mcp", "plugin"] },
+    action: STRING,
+    description: STRING,
+    available: { type: "boolean" },
+    reason: STRING,
+    input: ANY_OBJECT,
+    output: ANY_OBJECT
+  },
+  ["name", "tool", "kind", "action", "description", "available", "input", "output"]
+);
+var DESCRIPTION = object({ id: STRING, call: STRING, location: STRING, methods: { type: "array", items: DESCRIBED } }, [
+  "id",
+  "call",
+  "location",
+  "methods"
+]);
+var plainObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function strict(schema, issues) {
+  const keys = Object.keys(schema["properties"]);
+  const validate = (value) => {
+    if (!plainObject(value)) return { issues: [{ message: "Expected an object" }] };
+    const found = [...Object.keys(value).filter((key) => !keys.includes(key)).map((key) => `"${key}" is not allowed`), ...issues(value)];
+    return found.length === 0 ? { value } : { issues: found.map((message) => ({ message })) };
+  };
+  return Object.defineProperty({ ...schema }, "~standard", { value: { version: 1, vendor: "tools-rpc", validate }, enumerable: false });
+}
+var ScriptError = class extends Error {
+  failure;
+  constructor(failure) {
+    super(`${failure.code}: ${failure.what.replace(/[.\s]+$/, "")}. Next step: ${failure.next}`);
+    this.failure = failure;
+  }
+};
+var fail = (code, what) => new ScriptError({ code, what, next: NEXT_STEPS[code] });
+var record = (value) => typeof value === "object" && value !== null;
+function notFound(error, tags) {
+  if (!record(error)) return false;
+  const tag = error["_tag"] ?? error["name"];
+  return typeof tag === "string" && tags.includes(tag) || error["status"] === 404 || error["statusCode"] === 404;
+}
+var toolError = (error) => record(error) && error["_tag"] === "Tool.Error";
+var wildcard = (pattern, value) => new RegExp(`^${pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".")}$`).test(value);
+var hidden = (rules, action) => rules.findLast((rule2) => wildcard(rule2.action, action) && wildcard(rule2.resource, "*"))?.effect === "deny";
+var SECRETS = [
+  [/\b(bearer|basic|token)\s+[\w.~+/=-]{8,}/gi, "$1 [redacted]"],
+  [/\b([\w-]*(?:api[_-]?key|access[_-]?key|private[_-]?key|token|secret|password|signature|credential)["']?\s*[:=]\s*)["']?[^\s"'&,;]+["']?/gi, "$1[redacted]"],
+  [/\beyJ[\w-]{4,}\.[\w-]{4,}\.[\w-]{4,}/g, "[redacted]"],
+  [/\b(?:tvly|sk|pk|rk|ghp|gho|ghu|ghs|ghr|github_pat|glpat|xox[abposr]|lin_api|lin_oauth)[-_][\w-]{8,}/gi, "[redacted]"],
+  [/[\w+=-]{40,}/g, "[redacted]"]
+];
+var withoutQuery = (text) => text.replace(/\bhttps?:\/\/[^\s"'<>()]+/gi, (url) => {
+  const cut = url.search(/[?#]/);
+  return cut === -1 ? url : `${url.slice(0, cut)}?[redacted]`;
+});
+function upstreamText(text) {
+  const line = text.split(/\r?\n/).find((part) => part.trim() !== "")?.trim() ?? "no message";
+  const redacted = SECRETS.reduce((value, [pattern, replacement]) => value.replace(pattern, replacement), withoutQuery(line));
+  return redacted.length <= UPSTREAM_LIMIT ? redacted : `${redacted.slice(0, UPSTREAM_LIMIT - 1)}\u2026`;
+}
+var jsonSchema = (schema) => record(schema) && !("ast" in schema) && !("~standard" in schema) ? schema : void 0;
+function normalise(result) {
+  const text = typeof result.content === "string" ? result.content : (result.content ?? []).flatMap((part) => part.type === "text" ? [part.text] : []).join("\n");
+  return result.output === void 0 ? { text } : { output: result.output, text };
+}
+function connection(status) {
+  switch (status) {
+    case "connected":
+      return void 0;
+    case "pending":
+      return "CONNECTING";
+    case "needs_auth":
+      return "AUTH_REQUIRED";
+    case "failed":
+      return "CONNECTION_FAILED";
+    case "disabled":
+      return "DISABLED";
+    default:
+      return "NOT_REGISTERED";
+  }
+}
+var STATUS_TEXT = {
+  CONNECTING: "is still connecting",
+  AUTH_REQUIRED: "needs a sign-in",
+  CONNECTION_FAILED: "could not connect",
+  DISABLED: "is disabled",
+  NOT_REGISTERED: "is not registered"
+};
+async function registerToolsRpc(ctx, options) {
+  const { mcp, owned = [] } = options;
+  const accounts = typeof mcp?.server === "function";
+  if (KNOWN_READS.length > 0 && !mcp) throw new Error("registerToolsRpc: KNOWN_READS needs the mcp option");
+  if (accounts && NEXT_STEPS.ACCOUNT_UNKNOWN === void 0) throw new Error("registerToolsRpc: per-account servers need NEXT_STEPS.ACCOUNT_UNKNOWN");
+  const names = [...KNOWN_READS, ...owned.map((method) => method.name)];
+  const duplicate = names.find((name, index) => name === "describe" || names.indexOf(name) !== index);
+  if (duplicate) throw new Error(`registerToolsRpc: the method name "${duplicate}" is taken`);
+  const live = /* @__PURE__ */ new Set();
+  const serverOf = (account) => {
+    const server = typeof mcp.server === "function" ? mcp.server(account) : mcp.server;
+    if (server !== void 0) return server;
+    throw new ScriptError({ code: "ACCOUNT_UNKNOWN", what: `there is no account '${account}'`, next: NEXT_STEPS.ACCOUNT_UNKNOWN });
+  };
+  const session = async (sessionID) => {
+    let info;
+    try {
+      info = await ctx.session.get({ sessionID });
+    } catch (error) {
+      if (notFound(error, ["Session.NotFoundError", "SessionNotFoundError"])) throw fail("SESSION_UNKNOWN", `there is no session '${sessionID}'`);
+      throw error;
+    }
+    if (!info.agent) throw fail("SESSION_AGENT_REQUIRED", `session '${sessionID}' names no agent`);
+    let agent;
+    try {
+      agent = await ctx.agent.get({ agentID: info.agent, location: info.location });
+    } catch (error) {
+      if (notFound(error, ["Agent.NotFoundError", "AgentNotFoundError"])) throw fail("SESSION_AGENT_REQUIRED", `session '${sessionID}' names the agent '${info.agent}', which does not exist`);
+      throw error;
+    }
+    const rules = [...agent.data.permissions, ...info.permissions ?? []];
+    return { agent: info.agent, rules };
+  };
+  const unavailable = async (server, tool, connected) => {
+    const status = (await ctx.mcp.list()).data.find((entry) => entry.name === server)?.status.status;
+    const code = connection(status) ?? connected;
+    if (code === "TOOL_UNAVAILABLE") return fail(code, `OpenCode does not list ${tool} on the connected "${server}" server`);
+    return fail(code, `the "${server}" server ${STATUS_TEXT[code] ?? "is unavailable"}`);
+  };
+  const denied = (action, error) => {
+    const reason = record(error) && typeof error["message"] === "string" ? error["message"] : String(error);
+    return fail("PERMISSION_DENIED", `${action} was refused for this session's agent: ${upstreamText(reason)}`);
+  };
+  const mcpTarget = (name, envelope2) => {
+    const server = serverOf(envelope2.account);
+    const action = `${server}_${name}`;
+    return {
+      action,
+      mcp: true,
+      async run(call) {
+        if (!mcp.managed(server)) throw fail("SERVER_CONFLICT", `the "${server}" server in your config is not the one this plugin manages`);
+        const tool = (await ctx.tool.list()).find((entry) => entry.id === action);
+        if (!tool) throw await unavailable(server, action, "TOOL_UNAVAILABLE");
+        let result;
+        try {
+          result = await tool.execute(envelope2.input, call);
+        } catch (error) {
+          if (error instanceof Error && error.message.startsWith(`MCP server "${server}" `)) throw await unavailable(server, action, "CONNECTION_FAILED");
+          throw error;
+        }
+        return shapeResult(name, normalise(result));
+      }
+    };
+  };
+  const ownedTarget = (spec, envelope2) => ({
+    action: spec.action,
+    mcp: false,
+    run: async (call) => await spec.run(envelope2.input, call) ?? null
+  });
+  const invoke = async (target, raw, context) => {
+    const envelope2 = raw;
+    let method;
+    try {
+      if (context.signal.aborted) throw fail("CANCELLED", "the call was cancelled");
+      method = target(envelope2);
+      const { agent, rules } = await session(envelope2.sessionID);
+      if (hidden(rules, method.action)) throw fail("PERMISSION_DENIED", `${method.action} is hidden from this session's agent by a deny rule`);
+      const call = {
+        sessionID: envelope2.sessionID,
+        agent,
+        messageID: MESSAGE_ID,
+        id: `script:${randomUUID()}`,
+        signal: context.signal,
+        progress: async () => {
+        }
+      };
+      live.add(call.id);
+      try {
+        return JSON.parse(JSON.stringify(await method.run(call)));
+      } finally {
+        live.delete(call.id);
+      }
+    } catch (error) {
+      const failure = refusal(error, method, context.signal);
+      if (!failure) throw error;
+      return context.error("failed", new ScriptError(failure).message, { code: failure.code, next: failure.next });
+    }
+  };
+  const refusal = (error, method, signal) => {
+    if (signal.aborted) return fail("CANCELLED", "the call was cancelled").failure;
+    if (error instanceof ScriptError) return error.failure;
+    const own = pluginError(error);
+    if (own || !method || !toolError(error)) return own;
+    if (error.error !== void 0) return denied(method.action, error).failure;
+    if (method.mcp) return fail("UPSTREAM_ERROR", `${method.action} failed: ${upstreamText(error.message)}`).failure;
+    return void 0;
+  };
+  const describe2 = async () => {
+    const tools = mcp ? await ctx.tool.list() : [];
+    const methods = [];
+    if (mcp) {
+      const server = serverOf(void 0);
+      const managed = mcp.managed(server);
+      const status = managed ? (await ctx.mcp.list()).data.find((entry) => entry.name === server)?.status.status : void 0;
+      for (const name of KNOWN_READS) {
+        const id = `${server}_${name}`;
+        const tool = managed ? tools.find((entry) => entry.id === id) : void 0;
+        const reason = !managed ? "SERVER_CONFLICT" : tool ? void 0 : connection(status) ?? "TOOL_UNAVAILABLE";
+        const input = jsonSchema(tool?.input) ?? ANY_OBJECT;
+        const output = jsonSchema(tool?.output);
+        methods.push({
+          name,
+          tool: id,
+          kind: "mcp",
+          action: id,
+          description: tool?.description ?? "",
+          available: reason === void 0,
+          ...reason ? { reason } : {},
+          input,
+          output: mcpOutput(output)
+        });
+      }
+    }
+    for (const spec of owned)
+      methods.push({ name: spec.name, tool: spec.name, kind: "plugin", action: spec.action, description: spec.description, available: true, input: spec.input, output: spec.output });
+    return JSON.parse(
+      JSON.stringify({
+        id: TOOLS_RPC_ID,
+        call: `POST /api/rpc/${TOOLS_RPC_ID}/<method> with {"input":{"sessionID":"<session>",${accounts ? `"account":"<account>",` : ""}"input":<the tool's input>}}`,
+        location: ctx.location.directory,
+        methods
+      })
+    );
+  };
+  const envelope = (input, objectInput) => strict(
+    object({ sessionID: { type: "string", minLength: 1 }, ...accounts ? { account: { type: "string", minLength: 1 } } : {}, input }, ["sessionID", "input"]),
+    (value) => [
+      ...typeof value["sessionID"] === "string" && value["sessionID"] !== "" ? [] : [`"sessionID" must be a non-empty string`],
+      ...value["account"] === void 0 || typeof value["account"] === "string" && value["account"] !== "" ? [] : [`"account" must be a non-empty string`],
+      ...!("input" in value) ? [`"input" is missing`] : objectInput && !plainObject(value["input"]) ? [`"input" must be an object`] : []
+    ]
+  );
+  const contract = Rpc.define({
+    id: TOOLS_RPC_ID,
+    methods: {
+      describe: { input: NO_INPUT, output: DESCRIPTION },
+      ...Object.fromEntries(KNOWN_READS.map((name) => [name, { input: envelope(ANY_OBJECT, true), output: mcpOutput(), errors: { failed: FAILED } }])),
+      ...Object.fromEntries(owned.map((spec) => [spec.name, { input: envelope(spec.input, false), output: spec.output, errors: { failed: FAILED } }]))
+    },
+    events: {}
+  });
+  const handlers = {
+    describe: () => describe2(),
+    ...Object.fromEntries(KNOWN_READS.map((name) => [name, (raw, context) => invoke((envelope2) => mcpTarget(name, envelope2), raw, context)])),
+    ...Object.fromEntries(owned.map((spec) => [spec.name, (raw, context) => invoke((envelope2) => ownedTarget(spec, envelope2), raw, context)]))
+  };
+  const registration = await ctx.rpc.register(contract, handlers);
+  const hook = await ctx.permission.hook("evaluate", (evaluation) => {
+    if (evaluation.effect !== "ask" || evaluation.source === void 0 || !live.has(evaluation.source.id)) return;
+    evaluation.effect = "deny";
+    evaluation.message = UNATTENDED;
+  });
+  return async () => {
+    await hook.dispose().catch(() => void 0);
+    await registration.dispose().catch(() => void 0);
+  };
+}
+
 // src/integration.ts
 var SIGN_IN_AGAIN = "Linear needs a new sign-in. Choose this account to sign in again.";
 var STARTUP_POLL_MS = 250;
@@ -57,13 +457,13 @@ function watchIntegration(ctx, owned) {
       });
       await previous?.dispose();
     }
-    const connection = await ctx.integration.connection.active(id);
-    if (connection?.type !== "credential") return;
-    const reported = connection.status?.message === SIGN_IN_AGAIN;
-    if (server.status.status === "needs_auth" && !connection.status) {
-      await ctx.integration.connection.status({ integrationID: id, connection, status: { status: "needs_auth", message: SIGN_IN_AGAIN } });
+    const connection2 = await ctx.integration.connection.active(id);
+    if (connection2?.type !== "credential") return;
+    const reported = connection2.status?.message === SIGN_IN_AGAIN;
+    if (server.status.status === "needs_auth" && !connection2.status) {
+      await ctx.integration.connection.status({ integrationID: id, connection: connection2, status: { status: "needs_auth", message: SIGN_IN_AGAIN } });
     } else if (server.status.status === "connected" && reported) {
-      await ctx.integration.connection.status({ integrationID: id, connection, status: void 0 });
+      await ctx.integration.connection.status({ integrationID: id, connection: connection2, status: void 0 });
     }
   };
   let running;
@@ -138,95 +538,6 @@ function parseOptions(raw) {
 }
 var describe = (value) => value === null ? "null" : Array.isArray(value) ? "an array" : typeof value === "string" ? JSON.stringify(value) : typeof value === "object" ? "an object" : String(value);
 
-// src/linear-tools.ts
-var READ_TOOLS = [
-  "extract_images",
-  "get_agent_skill",
-  "get_attachment",
-  "get_diff",
-  "get_diff_threads",
-  "get_document",
-  "get_initiative",
-  "get_issue",
-  "get_issue_status",
-  "get_milestone",
-  "get_notifications",
-  "get_project",
-  "get_release",
-  "get_release_note",
-  "get_status_updates",
-  "get_team",
-  "get_template",
-  "get_triage_responsibility",
-  "get_user",
-  "get_workspace",
-  "list_agent_skills",
-  "list_comments",
-  "list_custom_views",
-  "list_cycles",
-  "list_diffs",
-  "list_documents",
-  "list_initiative_labels",
-  "list_initiatives",
-  "list_issue_labels",
-  "list_issue_statuses",
-  "list_issues",
-  "list_milestones",
-  "list_project_labels",
-  "list_projects",
-  "list_release_notes",
-  "list_release_pipelines",
-  "list_releases",
-  "list_teams",
-  "list_templates",
-  "list_users",
-  "search_documentation",
-  "whoami"
-];
-var WRITE_TOOLS = [
-  "create_attachment",
-  "create_attachment_from_upload",
-  "create_initiative_label",
-  "create_issue_label",
-  "delete_attachment",
-  "delete_comment",
-  "delete_diff_comment",
-  "delete_status_update",
-  "mark_notification",
-  "merge_diff",
-  "prepare_attachment_upload",
-  "prepare_file_upload",
-  "resolve_diff_thread",
-  "restore_initiative_label",
-  "restore_issue_label",
-  "restore_project_label",
-  "retire_initiative_label",
-  "retire_issue_label",
-  "retire_project_label",
-  "save_comment",
-  "save_diff_comment",
-  "save_document",
-  "save_initiative",
-  "save_initiative_label",
-  "save_issue",
-  "save_issue_label",
-  "save_milestone",
-  "save_project",
-  "save_project_label",
-  "save_release",
-  "save_release_note",
-  "save_status_update",
-  "share_issue",
-  "submit_diff_review",
-  "unshare_issue",
-  "update_diff"
-];
-function classify(name) {
-  if (READ_TOOLS.includes(name)) return "read";
-  if (WRITE_TOOLS.includes(name)) return "write";
-  return "unknown";
-}
-
 // src/permissions.ts
 var actionOf = (tool) => `${SERVER_NAME}_${tool}`;
 var ASK_ALL = { action: actionOf("*"), resource: "*", effect: "ask" };
@@ -256,9 +567,9 @@ function registerDefaultRules(agent, rules, report) {
     }
   });
 }
-var wildcard = (pattern) => new RegExp(`^${pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".")}$`);
+var wildcard2 = (pattern) => new RegExp(`^${pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".")}$`);
 function evaluate(permissions, action) {
-  return permissions.findLast((item) => wildcard(item.action).test(action) && wildcard(item.resource).test("*"))?.effect ?? "ask";
+  return permissions.findLast((item) => wildcard2(item.action).test(action) && wildcard2(item.resource).test("*"))?.effect ?? "ask";
 }
 var unguardedAgents = (agents) => agents.filter((agent) => !hasDefaultRules(agent.permissions) && evaluate(agent.permissions, actionOf("new_tool")) === "allow").map((agent) => agent.id);
 
@@ -272,15 +583,15 @@ var skillNames = (access) => access === "write" ? ["linear", "linear-write"] : [
 var notLoaded = (name, problem) => `The "${name}" skill was not loaded: skills/${name}/SKILL.md ${problem}.`;
 var REINSTALL = "Reinstall the plugin.";
 function parseSkill(name, path, text) {
-  const fail = (problem) => linearError("SKILLS_INVALID", notLoaded(name, problem), REINSTALL);
+  const fail2 = (problem) => linearError("SKILLS_INVALID", notLoaded(name, problem), REINSTALL);
   const match = /^---\n([\s\S]*?)\n---\n?([\s\S]*)$/.exec(text.replace(/\r\n/g, "\n"));
-  if (!match) throw fail("has no frontmatter");
+  if (!match) throw fail2("has no frontmatter");
   const fields = new Map(
     match[1].split("\n").map((line) => [line.slice(0, line.indexOf(":")).trim(), line.slice(line.indexOf(":") + 1).trim().replace(/^(["'])(.*)\1$/, "$2")])
   );
-  if (fields.get("name") !== name) throw fail(`must be named "${name}" in its frontmatter`);
+  if (fields.get("name") !== name) throw fail2(`must be named "${name}" in its frontmatter`);
   const description = fields.get("description");
-  if (!description) throw fail("has no description");
+  if (!description) throw fail2("has no description");
   return { id: Skill.ID.make(name), name: Skill.Name.make(name), description, path: Skill.Info.fields.path.make(path), content: match[2].trim() };
 }
 async function loadSkills(access, directory = SKILLS_DIR) {
@@ -311,12 +622,12 @@ var AGENTS_FIX = [
 ].join("\n");
 var NOTHING_TO_DO = "Nothing to do.";
 function buildStatus(facts) {
-  const connection = !facts.server ? "not_configured" : facts.server.status === "needs_auth" ? "needs_sign_in" : facts.server.status;
+  const connection2 = !facts.server ? "not_configured" : facts.server.status === "needs_auth" ? "needs_sign_in" : facts.server.status;
   const unknownTools = (facts.tools ?? []).filter((tool) => classify(tool) === "unknown");
   const agentsWithoutRules = unguardedAgents(facts.agents ?? []);
   const problems = facts.problems ?? [];
   const status = {
-    connection,
+    connection: connection2,
     ...facts.server?.error ? { error: facts.server.error } : {},
     ...facts.account ? { account: facts.account } : {},
     access: facts.access,
@@ -388,11 +699,11 @@ function formatStatus(status) {
 async function readStatus(ctx, facts) {
   const [servers, agents, tools] = await Promise.all([ctx.mcp.list(), ctx.agent.list(), ctx.tool.list()]);
   const server = servers.data.find((entry) => entry.name === SERVER_NAME);
-  const connection = server?.integrationID ? await ctx.integration.connection.active(server.integrationID).catch(() => void 0) : void 0;
+  const connection2 = server?.integrationID ? await ctx.integration.connection.active(server.integrationID).catch(() => void 0) : void 0;
   return buildStatus({
     ...facts,
     ...server ? { server: server.status } : {},
-    ...connection?.type === "credential" ? { account: connection.label } : {},
+    ...connection2?.type === "credential" ? { account: connection2.label } : {},
     tools: tools.filter((tool) => tool.options?.namespace === SERVER_NAME).map((tool) => tool.name),
     agents: agents.data
   });
@@ -461,20 +772,20 @@ function displayUrl(url) {
     return "an invalid URL";
   }
 }
-function registerServer(mcp, config, record) {
+function registerServer(mcp, config, record2) {
   return mcp.transform((editor) => {
     try {
       const existing = editor.get(SERVER_NAME);
       const expected = displayUrl(config.url);
       if (!existing) {
         editor.set(SERVER_NAME, config);
-        return record({ type: "plugin", url: expected });
+        return record2({ type: "plugin", url: expected });
       }
       const url = existing.type === "remote" ? displayUrl(existing.url) : "a local command";
-      record(url === expected ? { type: "adopted", url } : { type: "conflict", url, expected });
+      record2(url === expected ? { type: "adopted", url } : { type: "conflict", url, expected });
     } catch (error) {
       const reason = error instanceof Error ? error.message : String(error);
-      record(void 0, errorText("SERVER_NOT_REGISTERED", `The ${SERVER_NAME} MCP server could not be registered (${reason}).`, "Restart OpenCode."));
+      record2(void 0, errorText("SERVER_NOT_REGISTERED", `The ${SERVER_NAME} MCP server could not be registered (${reason}).`, "Restart OpenCode."));
     }
   });
 }
@@ -497,7 +808,13 @@ function createLinearPlugin(seam) {
       const read = () => readStatus(ctx, { ...source ? { source } : {}, access: options.access, host, problems: [...problems.values()] });
       await registerStatusCommand(ctx, read);
       await registerStatusRpc(ctx.rpc, read);
-      return watchIntegration(ctx, () => source?.type === "plugin" || source?.type === "adopted");
+      const owned = () => source?.type === "plugin" || source?.type === "adopted";
+      const stopTools = await registerToolsRpc(ctx, { mcp: { server: SERVER_NAME, managed: owned } });
+      const stopWatch = watchIntegration(ctx, owned);
+      return async () => {
+        await stopWatch();
+        await stopTools();
+      };
     }
   });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@joe-broadhead/opencode-linear",
-  "version": "0.0.0",
+  "version": "0.0.1",
   "description": "Unofficial OpenCode plugin for Linear: find, read and cite issues, projects and documents through Linear's official MCP server",
   "keywords": [
     "opencode",

package/skills/linear/SKILL.md

@@ -61,6 +61,17 @@ build links yourself.
 - By default the plugin connects to Linear's read-only server, which offers no tools that change anything. To allow
   changes, the user sets the plugin option `"access": "write"` and signs in again.
 
+## Scripts
+
+When the user wants a job that runs without you, such as a cron job or a shell script, it can call Linear's read tools
+through the OpenCode server, with no model. The RPC `linear.workspace.tools` has one method per read tool, named
+without the `linear_` prefix, such as `list_issues` or `get_issue`, with the tool's own input, and `describe`, which
+lists them with their input schemas. Each call is `opencode api post /api/rpc/linear.workspace.tools/<method>` with
+the body `{"input":{"sessionID":"<session>","input":<the tool's input>}}`. The script runs as that session's agent,
+under its permission rules, so have the script create its session once with `opencode api post /api/session` and a
+body such as `{"title":"triage digest","agent":"build"}`. An ask is refused, and write tools are never available to
+scripts. The details are in the plugin's `docs/scripting.md`.
+
 ## When Linear is not available
 
 If no Linear tools appear, or a call says that Linear needs sign-in, ask the user to run `/linear-status`. It shows