@vess-id/ai-identity 0.16.0 → 0.18.0

package/dist/index.js

@@ -4184,7 +4184,7 @@ function validateRegistryObject(registry) {
   for (const a of typed.actions) {
     if (a.input_schema) {
       try {
-        const local = new import_ajv.default({ strict: true, allErrors: true });
+        const local = new import_ajv.default({ strict: true, allErrors: true, allowUnionTypes: true });
         (0, import_ajv_formats.default)(local);
         const compiled = local.compile(a.input_schema);
         if (compiled.errors?.length) {
@@ -6531,6 +6531,33 @@ var ACTION_REGISTRY = {
       },
       version: "1.0.0"
     },
+    {
+      action: "calendar.freebusy",
+      resource_type: "calendar:calendar",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["https://www.googleapis.com/auth/calendar.readonly"],
+      capability: "calendar.read.basic",
+      // Availability probe used to check a calendar's busy/free intervals before
+      // proposing meeting slots. Returns only busy time ranges — never event
+      // details (title, attendees, description) — so it stays low-risk read.
+      input_schema: {
+        type: "object",
+        properties: {
+          calendarId: { type: "string", description: "Calendar ID (email address). Defaults to primary calendar." },
+          timeMin: { type: "string", description: 'Lower bound (inclusive) of the window to check, as ISO 8601 datetime, e.g. "2025-01-15T00:00:00Z"' },
+          timeMax: { type: "string", description: 'Upper bound (exclusive) of the window to check, as ISO 8601 datetime, e.g. "2025-01-16T00:00:00Z"' }
+        },
+        required: ["timeMin", "timeMax"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "calendar.read" },
+      effects: ["Read:FreeBusy"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "calendarId", required: false, default: "primary" }
+      },
+      version: "1.0.0"
+    },
     {
       action: "calendar.event.create",
       resource_type: "calendar:event",
@@ -7723,449 +7750,1478 @@ var ACTION_REGISTRY = {
       target_bindings: { resource_id: { source: "param", param: "portalId" } },
       version: "1.0.0"
     },
-    // ─── Agent Inbox Actions (internal) ───
-    // Inbox actions back the Agent Inbox MCP tools (task delegation between
-    // agents/people). They are internal (no external OAuth provider), so they
-    // carry a single nominal base scope `inbox` to satisfy the registry
-    // meta-schema's `minItems: 1` (same pattern as hubspot.account.link.get).
+    // ─── Linear Actions ───
     {
-      action: "inbox.send",
-      resource_type: "inbox:item",
-      required_relations: ["editor", "act_as"],
-      required_scopes: ["inbox"],
-      capability: "inbox.write",
+      action: "linear.issue.list",
+      resource_type: "linear:issue",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["read"],
+      capability: "linear.read.basic",
       input_schema: {
         type: "object",
         properties: {
-          to: { type: "string", minLength: 1, description: "Recipient (user id / handle) the task request is sent to" },
-          taskType: { type: "string", minLength: 1, description: "Type of task being requested" },
-          payload: { type: "object", description: "Task-specific payload data" },
-          message: { type: "string", description: "Optional human-readable message" }
+          teamId: { type: "string", description: "Filter by team ID" },
+          assigneeId: { type: "string", description: "Filter by assignee user ID" },
+          assigneeMe: { type: "boolean", description: "If true, filter issues assigned to the authenticated user" },
+          stateId: { type: "string", description: "Filter by workflow state ID" },
+          priority: { type: "number", minimum: 0, maximum: 4, description: "0=No priority, 1=Urgent, 2=High, 3=Medium, 4=Low" },
+          limit: { type: "number", minimum: 1, maximum: 250, description: "Max number of issues to return (default 50)" }
         },
-        required: ["to", "taskType", "payload"],
         additionalProperties: false
       },
-      constraints: { rate_bucket: "inbox.write" },
-      effects: ["Create:InboxItem"],
-      risk: "high",
+      constraints: { rate_bucket: "linear.read" },
+      effects: ["Read:IssueList"],
+      risk: "low",
       target_bindings: {
-        resource_id: { source: "param", param: "to" }
+        resource_id: { source: "param", param: "teamId", required: false }
       },
       version: "1.0.0"
     },
     {
-      action: "inbox.respond",
-      resource_type: "inbox:item",
-      required_relations: ["editor", "act_as"],
-      required_scopes: ["inbox"],
-      capability: "inbox.write",
+      action: "linear.issue.read",
+      resource_type: "linear:issue",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["read"],
+      capability: "linear.read.basic",
       input_schema: {
         type: "object",
         properties: {
-          id: { type: "string", minLength: 1, description: "Inbox item id being responded to" },
-          action: { type: "string", enum: ["accept", "decline", "counter"], description: "Response action" },
-          data: { type: "object", description: "Optional response data (e.g. counter-proposal)" }
+          issueId: { type: "string", minLength: 1, description: "Issue ID or identifier (e.g. ENG-123)" }
         },
-        required: ["id", "action"],
+        required: ["issueId"],
         additionalProperties: false
       },
-      constraints: { rate_bucket: "inbox.write" },
-      effects: ["Update:InboxItem"],
-      // high (not medium): an agent-mediated response (MCP invoke) must always
-      // go through human approval — the Phase 1 "always confirm" guarantee made
-      // enforceable. target_bindings below binds the concrete inbox item id so
-      // the high-risk approval has a specific resource constraint (the public
-      // /scheduling/:token link flow does NOT go through this gate — it calls
-      // InboxService.respond directly, system-key-signed).
-      risk: "high",
+      constraints: { rate_bucket: "linear.read" },
+      effects: ["Read:Issue"],
+      risk: "low",
       target_bindings: {
-        resource_id: { source: "param", param: "id" }
+        resource_id: { source: "param", param: "issueId" }
       },
       version: "1.0.0"
     },
     {
-      action: "inbox.check",
-      resource_type: "inbox:item",
+      action: "linear.issue.search",
+      resource_type: "linear:issue",
       required_relations: ["viewer", "editor", "admin", "owner"],
-      required_scopes: ["inbox"],
-      capability: "inbox.read",
+      required_scopes: ["read"],
+      capability: "linear.read.basic",
       input_schema: {
         type: "object",
         properties: {
-          types: { type: "array", items: { type: "string" }, description: "Filter by task types" },
-          status: { type: "string", description: "Filter by item status" }
+          query: { type: "string", minLength: 1, description: "Full-text search query" },
+          teamId: { type: "string", description: "Restrict search to a specific team" },
+          limit: { type: "number", minimum: 1, maximum: 250, description: "Max number of results (default 50)" }
         },
+        required: ["query"],
         additionalProperties: false
       },
-      constraints: { rate_bucket: "inbox.read" },
-      effects: ["Read:InboxItem"],
+      constraints: { rate_bucket: "linear.read" },
+      effects: ["Read:IssueList"],
       risk: "low",
       target_bindings: {
-        resource_id: { source: "param", param: "id", required: false }
+        resource_id: { source: "param", param: "teamId", required: false }
       },
       version: "1.0.0"
     },
     {
-      action: "inbox.checkByToken",
-      resource_type: "inbox:item",
-      required_relations: ["viewer", "editor", "admin", "owner"],
-      required_scopes: ["inbox"],
-      capability: "inbox.read",
+      action: "linear.issue.create",
+      resource_type: "linear:issue",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["issues:create"],
+      capability: "linear.write.basic",
       input_schema: {
         type: "object",
         properties: {
-          token: { type: "string", minLength: 1, description: "Opaque access token for a single inbox item" }
+          teamId: { type: "string", minLength: 1, description: "Team ID to create the issue in" },
+          title: { type: "string", minLength: 1, description: "Issue title" },
+          description: { type: "string", description: "Issue description (Markdown)" },
+          assigneeId: { type: "string", description: "Assignee user ID" },
+          stateId: { type: "string", description: "Workflow state ID" },
+          priority: { type: "number", minimum: 0, maximum: 4, description: "0=No priority, 1=Urgent, 2=High, 3=Medium, 4=Low" },
+          labelIds: { type: "array", items: { type: "string" }, description: "Label IDs to attach" }
         },
-        required: ["token"],
+        required: ["teamId", "title"],
         additionalProperties: false
       },
-      constraints: { rate_bucket: "inbox.read" },
-      effects: ["Read:InboxItem"],
-      risk: "low",
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Create:Issue"],
+      risk: "high",
       target_bindings: {
-        resource_id: { source: "param", param: "token" }
+        resource_id: { source: "param", param: "teamId" }
       },
       version: "1.0.0"
     },
     {
-      action: "inbox.complete",
-      resource_type: "inbox:item",
+      action: "linear.issue.update",
+      resource_type: "linear:issue",
       required_relations: ["editor", "act_as"],
-      required_scopes: ["inbox"],
-      capability: "inbox.write",
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
       input_schema: {
         type: "object",
         properties: {
-          id: { type: "string", minLength: 1, description: "Inbox item id being completed" },
-          result: { type: "object", description: "Result payload for the completed task" }
+          issueId: { type: "string", minLength: 1, description: "Issue ID or identifier (e.g. ENG-123)" },
+          title: { type: "string", description: "New title" },
+          description: { type: "string", description: "New description (Markdown)" },
+          assigneeId: { type: "string", description: "Assignee user ID (null to unassign)" },
+          stateId: { type: "string", description: "Workflow state ID" },
+          priority: { type: "number", minimum: 0, maximum: 4, description: "0=No priority, 1=Urgent, 2=High, 3=Medium, 4=Low" },
+          labelIds: { type: "array", items: { type: "string" }, description: "New set of label IDs" }
         },
-        required: ["id", "result"],
+        required: ["issueId"],
         additionalProperties: false
       },
-      constraints: { rate_bucket: "inbox.write" },
-      effects: ["Update:InboxItem"],
-      risk: "low",
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Update:Issue"],
+      risk: "high",
       target_bindings: {
-        resource_id: { source: "param", param: "id" }
+        resource_id: { source: "param", param: "issueId" }
       },
       version: "1.0.0"
     },
-    // ─── Scheduling Actions (internal) ───
-    // scheduling.request is a meeting-time negotiation façade over inbox.send.
-    // Candidate slots are computed LLM-side from the user calendar; the server
-    // only validates them. Like the inbox actions it is internal (no external
-    // OAuth provider), so it carries the single nominal base scope `inbox`.
-    // Spec: docs/specs/2026-06-10-inbox-intent-routing-design.md §2.1
     {
-      action: "scheduling.request",
-      resource_type: "inbox:item",
+      action: "linear.comment.create",
+      resource_type: "linear:comment",
       required_relations: ["editor", "act_as"],
-      required_scopes: ["inbox"],
-      capability: "inbox.write",
+      required_scopes: ["comments:create"],
+      capability: "linear.write.basic",
       input_schema: {
         type: "object",
         properties: {
-          to: { type: "string", minLength: 1, description: "Counterpart (user id / email) to negotiate a meeting time with" },
-          topic: { type: "string", minLength: 1, description: "Meeting topic shown to the counterpart" },
-          durationMinutes: { type: "integer", minimum: 5, maximum: 480, description: "Meeting length in minutes" },
-          candidates: {
-            type: "array",
-            minItems: 1,
-            maxItems: 10,
-            description: "Candidate slots computed by the agent from the user calendar (LLM-side computation; the server only validates)",
-            items: {
-              type: "object",
-              properties: {
-                start: { type: "string", description: "ISO 8601 start" },
-                end: { type: "string", description: "ISO 8601 end" }
-              },
-              required: ["start", "end"],
-              additionalProperties: false
-            }
-          },
-          message: { type: "string", description: "Optional human-readable message" }
+          issueId: { type: "string", minLength: 1, description: "Issue ID to comment on" },
+          body: { type: "string", minLength: 1, description: "Comment body (Markdown)" }
         },
-        required: ["to", "topic", "durationMinutes", "candidates"],
+        required: ["issueId", "body"],
         additionalProperties: false
       },
-      constraints: { rate_bucket: "inbox.write" },
-      effects: ["Create:InboxItem"],
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Create:Comment"],
       risk: "high",
       target_bindings: {
-        resource_id: { source: "param", param: "to" }
+        resource_id: { source: "param", param: "issueId" }
       },
       version: "1.0.0"
-    }
-  ],
-  capabilities: [
-    {
-      capability: "slack.messaging.basic",
-      description: "Post, update, and delete messages in channels",
-      includes: ["slack.message.post", "slack.message.update", "slack.message.delete"],
-      version: "1.0.0"
     },
     {
-      capability: "slack.read.basic",
-      description: "Read channels, messages, and user info",
-      includes: ["slack.channel.read", "slack.user.read", "slack.message.read", "slack.message.read_paginated", "slack.batch.read"],
+      action: "linear.comment.list",
+      resource_type: "linear:comment",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["read"],
+      capability: "linear.read.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          issueId: { type: "string", minLength: 1, description: "Issue ID to list comments for" },
+          limit: { type: "number", minimum: 1, maximum: 250, description: "Max number of comments (default 50)" }
+        },
+        required: ["issueId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.read" },
+      effects: ["Read:CommentList"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "issueId" }
+      },
       version: "1.0.0"
     },
     {
-      capability: "github.read.basic",
-      description: "Read issues, pull requests and repository contents from repositories",
-      includes: ["github.issue.list", "github.issue.read", "github.pr.list", "github.pr.read", "github.pr.files.list", "github.pr.review.list", "github.pr.search", "github.repo.search", "github.repo.collaborator.list", "github.content.get", "github.tree.get", "github.branch.list", "github.commit.get", "github.commit.list", "github.commit.search", "github.tag.list", "github.release.list", "github.release.getLatest", "github.release.getByTag", "github.code.search", "github.issue.search", "github.issue.types.list", "github.label.get", "github.label.list", "github.workflow.get", "github.workflow.list", "github.workflow.jobLogs.get", "github.repo.starred.list", "github.user.me.get", "github.org.teams.list", "github.team.members.list", "github.user.search", "github.notification.list", "github.notification.get", "github.gist.get", "github.gist.list"],
+      action: "linear.project.list",
+      resource_type: "linear:project",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["read"],
+      capability: "linear.read.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          teamId: { type: "string", description: "Filter by team ID" },
+          limit: { type: "number", minimum: 1, maximum: 250, description: "Max number of projects (default 50)" }
+        },
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.read" },
+      effects: ["Read:ProjectList"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "teamId", required: false }
+      },
       version: "1.0.0"
     },
     {
-      capability: "github.issues.triage",
-      description: "Create and update issues, post issue comments, manage sub-issues and labels",
-      includes: ["github.issue.create", "github.issue.update", "github.issue.comment.create", "github.issue.subissue.write", "github.label.write"],
+      action: "linear.project.read",
+      resource_type: "linear:project",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["read"],
+      capability: "linear.read.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          projectId: { type: "string", minLength: 1, description: "Project ID" }
+        },
+        required: ["projectId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.read" },
+      effects: ["Read:Project"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "projectId" }
+      },
       version: "1.0.0"
     },
     {
-      capability: "github.pulls.write",
-      description: "Create, update, merge, and review pull requests",
-      includes: ["github.pr.create", "github.pr.update", "github.pr.merge", "github.pr.review.create", "github.pr.comment.reply", "github.pr.branch.update"],
+      action: "linear.team.list",
+      resource_type: "linear:team",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["read"],
+      capability: "linear.read.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          limit: { type: "number", minimum: 1, maximum: 250, description: "Max number of teams (default 50)" }
+        },
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.read" },
+      effects: ["Read:TeamList"],
+      risk: "low",
+      // No teamId parameter: this action lists ALL accessible teams — intentionally
+      // not scoped to a single team. required:false signals that missing resource
+      // binding is expected (not an omission), consistent with slack.channel.read.
+      target_bindings: {
+        resource_id: { source: "param", param: "teamId", required: false }
+      },
       version: "1.0.0"
     },
     {
-      capability: "github.repos.write",
-      description: "\u30EA\u30DD\u30B8\u30C8\u30EA\u306E\u4F5C\u6210\u30FB\u30D5\u30A9\u30FC\u30AF\u30FB\u30D5\u30A1\u30A4\u30EB\u66F4\u65B0\u30FB\u30D6\u30E9\u30F3\u30C1\u4F5C\u6210\u30FB\u30EF\u30FC\u30AF\u30D5\u30ED\u30FC\u5B9F\u884C\u30FB\u30B9\u30BF\u30FC\u64CD\u4F5C",
-      includes: ["github.repo.create", "github.repo.fork", "github.content.createOrUpdate", "github.content.delete", "github.branch.create", "github.workflow.run", "github.repo.star", "github.repo.unstar"],
+      action: "linear.workflowState.list",
+      resource_type: "linear:workflowState",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["read"],
+      capability: "linear.read.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          teamId: { type: "string", description: "Filter by team ID" },
+          limit: { type: "number", minimum: 1, maximum: 250, description: "Max number of workflow states to return (default 50)" }
+        },
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.read" },
+      effects: ["Read:WorkflowStateList"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "teamId", required: false }
+      },
       version: "1.0.0"
     },
     {
-      capability: "github.notifications.write",
-      description: "\u901A\u77E5\u306E\u65E2\u8AAD\u5316\u30FB\u30B9\u30EC\u30C3\u30C9/\u30EA\u30DD\u30B8\u30C8\u30EA\u306E\u8CFC\u8AAD\u8A2D\u5B9A",
-      includes: ["github.notification.markRead", "github.notification.markAllRead", "github.notification.subscription.set", "github.notification.repoSubscription.set"],
+      action: "linear.viewer.read",
+      resource_type: "linear:viewer",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["read"],
+      capability: "linear.read.basic",
+      input_schema: {
+        type: "object",
+        properties: {},
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.read" },
+      effects: ["Read:Viewer"],
+      risk: "low",
+      // No parameters: this action reads the currently authenticated user — there is
+      // no resource to scope to. required:false signals intentional exemption, not
+      // omission, consistent with the slack.channel.read precedent.
+      target_bindings: {
+        resource_id: { source: "param", param: "viewerId", required: false }
+      },
       version: "1.0.0"
     },
     {
-      capability: "github.gists.write",
-      description: "Gist \u306E\u4F5C\u6210\u30FB\u66F4\u65B0",
-      includes: ["github.gist.create", "github.gist.update"],
+      action: "linear.label.list",
+      resource_type: "linear:label",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["read"],
+      capability: "linear.read.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          teamId: { type: "string", description: "Filter labels by team ID" },
+          limit: { type: "number", minimum: 1, maximum: 250, description: "Max number of labels to return (default 50)" }
+        },
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.read" },
+      effects: ["Read:LabelList"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "teamId", required: false }
+      },
       version: "1.0.0"
     },
     {
-      capability: "gmail.read.basic",
-      description: "Read and search Gmail messages and labels",
-      includes: ["gmail.message.search", "gmail.message.read", "gmail.label.read", "gmail.batch.read"],
+      action: "linear.user.list",
+      resource_type: "linear:team",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["read"],
+      capability: "linear.read.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          teamId: { type: "string", description: "Filter by team ID (lists team members only)" },
+          limit: { type: "number", minimum: 1, maximum: 250, description: "Max number of users to return (default 50)" }
+        },
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.read" },
+      effects: ["Read:UserList"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "teamId", required: false }
+      },
       version: "1.0.0"
     },
     {
-      capability: "gmail.compose",
-      description: "Send emails and create drafts via Gmail",
-      includes: ["gmail.message.send", "gmail.draft.create"],
+      action: "linear.issue.archive",
+      resource_type: "linear:issue",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          issueId: { type: "string", minLength: 1, description: "Issue ID or identifier to archive (e.g. ENG-123)" }
+        },
+        required: ["issueId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Archive:Issue"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "issueId" }
+      },
       version: "1.0.0"
     },
     {
-      capability: "gmail.manage",
-      description: "Trash and permanently delete Gmail messages",
-      includes: ["gmail.message.trash", "gmail.message.delete"],
+      action: "linear.project.create",
+      resource_type: "linear:project",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          name: { type: "string", minLength: 1, description: "Project name" },
+          teamIds: { type: "array", items: { type: "string" }, minItems: 1, description: "Team IDs to associate with the project (at least one required)" },
+          teamId: { type: "string", description: "Primary team ID (first element of teamIds; used for authorization scope)" },
+          description: { type: "string", description: "Project description (Markdown)" },
+          statusId: { type: "string", description: "Project status ID. Note: this is a ProjectStatus ID, not a WorkflowState ID. ProjectStatus can be retrieved via the Linear API projectStatuses query." },
+          startDate: { type: "string", description: "Start date (ISO 8601, e.g. 2024-01-01)" },
+          targetDate: { type: "string", description: "Target completion date (ISO 8601)" }
+        },
+        required: ["name", "teamIds"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Create:Project"],
+      risk: "high",
+      target_bindings: {
+        // teamId はスキーマの scalar フィールド (teamIds[0] の alias)。
+        // teamId が明示指定されている場合はそれを使い、未指定の場合は
+        // fallback_param: 'teamIds' で teamIds[0] にフォールバック（resolver は
+        // 配列の first element を自動的にスカラーに変換する）。
+        // extractResources も同じ優先順位 (teamId → teamIds[0]) で解決するため
+        // 両者のバインドが常に一致する。required:true で高リスク CREATE の
+        // resource binding 必須契約を明示 (teamIds は minItems:1 なので常に解決する)。
+        resource_id: { source: "param", param: "teamId", fallback_param: "teamIds", required: true }
+      },
       version: "1.0.0"
     },
     {
-      capability: "calendar.read.basic",
-      description: "Read and list Google Calendar events",
-      includes: ["calendar.event.list", "calendar.event.read"],
+      action: "linear.project.update",
+      resource_type: "linear:project",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          projectId: { type: "string", minLength: 1, description: "Project ID to update" },
+          name: { type: "string", description: "New project name" },
+          description: { type: "string", description: "New project description (Markdown)" },
+          statusId: { type: "string", description: "New project status ID. Note: this is a ProjectStatus ID, not a WorkflowState ID." },
+          startDate: { type: "string", description: "New start date (ISO 8601)" },
+          targetDate: { type: "string", description: "New target date (ISO 8601)" }
+        },
+        required: ["projectId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Update:Project"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "projectId" }
+      },
       version: "1.0.0"
     },
+    // ─── Linear Comment ops ───
     {
-      capability: "calendar.write",
-      description: "Create, update, and delete Google Calendar events",
-      includes: ["calendar.event.create", "calendar.event.update", "calendar.event.delete"],
+      action: "linear.comment.update",
+      resource_type: "linear:comment",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["comments:create"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          commentId: { type: "string", minLength: 1, description: "Comment ID to update" },
+          body: { type: "string", minLength: 1, description: "New comment body (Markdown)" }
+        },
+        required: ["commentId", "body"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Update:Comment"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "commentId" }
+      },
       version: "1.0.0"
     },
     {
-      capability: "jira.read.basic",
-      description: "Read Jira issues, projects, boards, sprints, issue link types, and users",
-      includes: ["jira.project.read", "jira.board.read", "jira.sprint.read", "jira.issue.list", "jira.issue.search", "jira.worklog.read", "jira.issue.read", "jira.batch.read", "jira.comment.read", "jira.transition.list", "jira.issuelinktype.list", "jira.user.search"],
+      action: "linear.comment.delete",
+      resource_type: "linear:comment",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          commentId: { type: "string", minLength: 1, description: "Comment ID to delete" }
+        },
+        required: ["commentId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Delete:Comment"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "commentId" }
+      },
       version: "1.0.0"
     },
     {
-      capability: "jira.write.basic",
-      description: "Create, update, delete Jira issues, manage issue links, and add/delete comments",
-      includes: ["jira.issue.create", "jira.issue.update", "jira.issue.delete", "jira.comment.create", "jira.comment.delete", "jira.issue.transition", "jira.issuelink.create", "jira.issuelink.delete"],
+      action: "linear.comment.resolve",
+      resource_type: "linear:comment",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          commentId: { type: "string", minLength: 1, description: "Comment ID to resolve" }
+        },
+        required: ["commentId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Update:Comment"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "commentId" }
+      },
       version: "1.0.0"
     },
     {
-      capability: "inbox.write",
-      description: "Send and respond to agent inbox tasks",
-      includes: ["inbox.send", "inbox.respond", "inbox.complete", "scheduling.request"],
+      action: "linear.comment.unresolve",
+      resource_type: "linear:comment",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          commentId: { type: "string", minLength: 1, description: "Comment ID to unresolve" }
+        },
+        required: ["commentId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Update:Comment"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "commentId" }
+      },
       version: "1.0.0"
     },
+    // ─── Linear Issue ops ───
     {
-      capability: "inbox.read",
-      description: "Read agent inbox tasks",
-      includes: ["inbox.check", "inbox.checkByToken"],
+      action: "linear.issue.unarchive",
+      resource_type: "linear:issue",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          issueId: { type: "string", minLength: 1, description: "Issue ID or identifier to unarchive (e.g. ENG-123)" }
+        },
+        required: ["issueId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Update:Issue"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "issueId" }
+      },
       version: "1.0.0"
-    }
-  ]
-};
-
-// src/registry/resource-type-labels.ts
-var RESOURCE_TYPE_LABELS = {
-  "github:repo": "\u5BFE\u8C61\u30EA\u30DD\u30B8\u30C8\u30EA",
-  "github:org": "\u5BFE\u8C61\u7D44\u7E54"
-};
-
-// src/registry/action-input-validator.ts
-var SCHEMA_INDEX = (() => {
-  const map = /* @__PURE__ */ new Map();
-  for (const a of ACTION_REGISTRY.actions) {
-    if (a && typeof a.action === "string" && a.input_schema) {
-      map.set(a.action, a.input_schema);
-    }
-  }
-  return map;
-})();
-function describeExpectedShape(schema) {
-  const props = schema.properties ?? {};
-  const required = Array.isArray(schema.required) ? schema.required : [];
-  const requiredSet = new Set(required);
-  const parts = [];
-  const orderedKeys = [
-    ...required.filter((k) => k in props),
-    ...Object.keys(props).filter((k) => !requiredSet.has(k))
-  ];
-  for (const key of orderedKeys) {
-    const prop = props[key] || {};
-    const optionalMark = requiredSet.has(key) ? "" : "?";
-    const enumVals = Array.isArray(prop.enum) ? prop.enum : void 0;
-    if (enumVals && enumVals.length > 0) {
-      const rendered = enumVals.map((v) => typeof v === "string" ? `'${v}'` : String(v)).join(" | ");
-      parts.push(`${key}${optionalMark}: ${rendered}`);
-    } else {
-      parts.push(`${key}${optionalMark}`);
-    }
-  }
-  return `{ ${parts.join(", ")} }`;
-}
-function matchesType(value, type) {
-  if (!type) return true;
-  switch (type) {
-    case "string":
-      return typeof value === "string";
-    case "integer":
-      return typeof value === "number" && Number.isInteger(value);
-    case "number":
-      return typeof value === "number";
-    case "boolean":
-      return typeof value === "boolean";
-    case "array":
-      return Array.isArray(value);
-    case "object":
-      return typeof value === "object" && value !== null && !Array.isArray(value);
-    default:
-      return true;
-  }
-}
-function validateActionInput(action, params) {
-  const schema = SCHEMA_INDEX.get(action);
-  if (!schema) {
-    return { valid: true };
-  }
-  const props = schema.properties ?? {};
-  const required = Array.isArray(schema.required) ? schema.required : [];
-  const additionalProps = schema.additionalProperties;
-  const safeParams = params && typeof params === "object" && !Array.isArray(params) ? params : {};
-  const missing = [];
-  const unknown = [];
-  const enumErrors = [];
-  const typeErrors = [];
-  for (const key of required) {
-    if (!(key in safeParams) || safeParams[key] === void 0 || safeParams[key] === null) {
-      missing.push(key);
-    }
-  }
-  if (additionalProps === false) {
-    for (const key of Object.keys(safeParams)) {
-      if (!(key in props)) {
-        unknown.push(key);
-      }
-    }
-  }
-  for (const key of Object.keys(props)) {
-    if (!(key in safeParams)) continue;
-    const value = safeParams[key];
-    if (value === void 0 || value === null) continue;
-    const prop = props[key] || {};
-    const enumVals = Array.isArray(prop.enum) ? prop.enum : void 0;
-    if (enumVals && enumVals.length > 0) {
-      if (!enumVals.includes(value)) {
-        enumErrors.push(key);
-        continue;
-      }
-    }
-    if (!matchesType(value, prop.type)) {
-      typeErrors.push(key);
-    }
-  }
-  if (missing.length === 0 && unknown.length === 0 && enumErrors.length === 0 && typeErrors.length === 0) {
-    return { valid: true };
-  }
-  const segments = [];
-  if (missing.length > 0) {
-    segments.push(`missing required parameter(s) [${missing.join(", ")}]`);
-  }
-  if (unknown.length > 0) {
-    segments.push(`unknown parameter(s) [${unknown.join(", ")}]`);
-  }
-  if (enumErrors.length > 0) {
-    const details = enumErrors.map((key) => {
-      const enumVals = props[key]?.enum || [];
-      const rendered = enumVals.map((v) => typeof v === "string" ? `'${v}'` : String(v)).join(" | ");
-      return `${key} (allowed: ${rendered})`;
-    }).join(", ");
-    segments.push(`invalid value for enum parameter(s) [${details}]`);
-  }
-  if (typeErrors.length > 0) {
-    const details = typeErrors.map((key) => `${key} (expected ${props[key]?.type})`).join(", ");
-    segments.push(`wrong type for parameter(s) [${details}]`);
-  }
-  const message = `${action}: ${segments.join("; ")}. Expected shape: ${describeExpectedShape(schema)}`;
-  return { valid: false, errors: [message] };
-}
-
-// src/registry/resource-types.ts
-var RESOURCE_TYPES = {
-  // Slack
-  SLACK_CHANNEL: "slack:channel",
-  SLACK_USER: "slack:user",
-  SLACK_WORKSPACE: "slack:workspace",
-  // GitHub
-  GITHUB_REPO: "github:repo",
-  GITHUB_ORG: "github:org",
-  GITHUB_ISSUE: "github:issue",
-  // Google Drive
-  GOOGLE_DRIVE_FILE: "google:drive:file",
-  GOOGLE_DRIVE_FOLDER: "google:drive:folder",
-  // Gmail
-  GMAIL_THREAD: "gmail:thread",
-  GMAIL_LABEL: "gmail:label",
-  // Jira
-  JIRA_PROJECT: "jira:project",
-  JIRA_BOARD: "jira:board",
-  JIRA_ISSUE: "jira:issue",
-  JIRA_SPRINT: "jira:sprint",
-  // HubSpot
-  HUBSPOT_OBJECT: "hubspot:object",
-  HUBSPOT_PROPERTY: "hubspot:property",
-  HUBSPOT_SCHEMA: "hubspot:schema",
-  HUBSPOT_ASSOCIATION: "hubspot:association",
-  HUBSPOT_ENGAGEMENT: "hubspot:engagement",
-  HUBSPOT_WORKFLOW: "hubspot:workflow",
-  HUBSPOT_ACCOUNT: "hubspot:account",
-  // OS (local)
-  OS_SECRET: "os:secret",
-  OS_PROCESS: "os:process",
-  // Wildcard
-  ANY: "*"
-};
-var LEGACY_RESOURCE_TYPE_MAP = {
-  // Action Registry CamelCase format
-  SlackChannel: RESOURCE_TYPES.SLACK_CHANNEL,
-  GitHubRepo: RESOURCE_TYPES.GITHUB_REPO,
+    },
+    {
+      action: "linear.issue.addLabel",
+      resource_type: "linear:issue",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          issueId: { type: "string", minLength: 1, description: "Issue ID or identifier" },
+          labelId: { type: "string", minLength: 1, description: "Label ID to add" }
+        },
+        required: ["issueId", "labelId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Update:Issue"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "issueId" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "linear.issue.removeLabel",
+      resource_type: "linear:issue",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          issueId: { type: "string", minLength: 1, description: "Issue ID or identifier" },
+          labelId: { type: "string", minLength: 1, description: "Label ID to remove" }
+        },
+        required: ["issueId", "labelId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Update:Issue"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "issueId" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "linear.issue.subscribe",
+      resource_type: "linear:issue",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          issueId: { type: "string", minLength: 1, description: "Issue ID or identifier to subscribe to" }
+        },
+        required: ["issueId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Update:Issue"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "issueId" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "linear.issue.delete",
+      resource_type: "linear:issue",
+      required_relations: ["admin", "owner", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          issueId: { type: "string", minLength: 1, description: "Issue ID or identifier to permanently delete" }
+        },
+        required: ["issueId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Delete:Issue"],
+      risk: "critical",
+      target_bindings: {
+        resource_id: { source: "param", param: "issueId" }
+      },
+      version: "1.0.0"
+    },
+    // ─── Linear Issue Relations ───
+    {
+      action: "linear.issueRelation.create",
+      resource_type: "linear:issueRelation",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          issueId: { type: "string", minLength: 1, description: "Issue ID to create a relation from" },
+          relatedIssueId: { type: "string", minLength: 1, description: "Related issue ID" },
+          type: { type: "string", enum: ["blocks", "duplicate", "related", "similar"], description: "Relation type" }
+        },
+        required: ["issueId", "relatedIssueId", "type"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Create:IssueRelation"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "issueId" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "linear.issueRelation.list",
+      resource_type: "linear:issueRelation",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["read"],
+      capability: "linear.read.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          issueId: { type: "string", minLength: 1, description: "Issue ID to list relations for" }
+        },
+        required: ["issueId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.read" },
+      effects: ["Read:IssueRelationList"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "issueId" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "linear.issueRelation.delete",
+      resource_type: "linear:issueRelation",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          relationId: { type: "string", minLength: 1, description: "Issue relation ID to delete" }
+        },
+        required: ["relationId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Delete:IssueRelation"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "relationId" }
+      },
+      version: "1.0.0"
+    },
+    // ─── Linear Cycles ───
+    {
+      action: "linear.cycle.list",
+      resource_type: "linear:cycle",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["read"],
+      capability: "linear.read.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          teamId: { type: "string", description: "Filter by team ID" },
+          limit: { type: "number", minimum: 1, maximum: 250, description: "Max number of cycles to return (default 50)" }
+        },
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.read" },
+      effects: ["Read:CycleList"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "teamId", required: false }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "linear.cycle.read",
+      resource_type: "linear:cycle",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["read"],
+      capability: "linear.read.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          cycleId: { type: "string", minLength: 1, description: "Cycle ID" }
+        },
+        required: ["cycleId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.read" },
+      effects: ["Read:Cycle"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "cycleId" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "linear.cycle.create",
+      resource_type: "linear:cycle",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          teamId: { type: "string", minLength: 1, description: "Team ID to create the cycle in" },
+          name: { type: "string", description: "Cycle name" },
+          startsAt: { type: "string", minLength: 1, description: "Cycle start date (ISO 8601)" },
+          endsAt: { type: "string", minLength: 1, description: "Cycle end date (ISO 8601)" },
+          description: { type: "string", description: "Cycle description" }
+        },
+        required: ["teamId", "startsAt", "endsAt"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Create:Cycle"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "teamId" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "linear.cycle.update",
+      resource_type: "linear:cycle",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          cycleId: { type: "string", minLength: 1, description: "Cycle ID to update" },
+          name: { type: "string", description: "New cycle name" },
+          startsAt: { type: "string", description: "New start date (ISO 8601)" },
+          endsAt: { type: "string", description: "New end date (ISO 8601)" },
+          description: { type: "string", description: "New description" },
+          completedAt: { type: "string", description: "Completion date (ISO 8601) or null to unset" }
+        },
+        required: ["cycleId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Update:Cycle"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "cycleId" }
+      },
+      version: "1.0.0"
+    },
+    // ─── Linear Labels ───
+    {
+      action: "linear.label.create",
+      resource_type: "linear:label",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          name: { type: "string", minLength: 1, description: "Label name" },
+          color: { type: "string", description: "Label color (hex, e.g. #FF0000)" },
+          description: { type: "string", description: "Label description" },
+          teamId: { type: "string", description: "Team ID to scope the label to (omit for workspace-level label)" }
+        },
+        required: ["name"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Create:Label"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "teamId", required: false }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "linear.label.update",
+      resource_type: "linear:label",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          labelId: { type: "string", minLength: 1, description: "Label ID to update" },
+          name: { type: "string", description: "New label name" },
+          color: { type: "string", description: "New label color (hex)" },
+          description: { type: "string", description: "New description" }
+        },
+        required: ["labelId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Update:Label"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "labelId" }
+      },
+      version: "1.0.0"
+    },
+    // ─── Linear Attachments ───
+    {
+      action: "linear.attachment.create",
+      resource_type: "linear:attachment",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          issueId: { type: "string", minLength: 1, description: "Issue ID to attach to" },
+          title: { type: "string", minLength: 1, description: "Attachment title" },
+          url: { type: "string", minLength: 1, description: "Attachment URL" },
+          subtitle: { type: "string", description: "Attachment subtitle" }
+        },
+        required: ["issueId", "title", "url"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Create:Attachment"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "issueId" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "linear.attachment.list",
+      resource_type: "linear:attachment",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["read"],
+      capability: "linear.read.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          issueId: { type: "string", minLength: 1, description: "Issue ID to list attachments for" }
+        },
+        required: ["issueId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.read" },
+      effects: ["Read:AttachmentList"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "issueId" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "linear.attachment.delete",
+      resource_type: "linear:attachment",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["write"],
+      capability: "linear.write.basic",
+      input_schema: {
+        type: "object",
+        properties: {
+          attachmentId: { type: "string", minLength: 1, description: "Attachment ID to delete" }
+        },
+        required: ["attachmentId"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "linear.write" },
+      effects: ["Delete:Attachment"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "attachmentId" }
+      },
+      version: "1.0.0"
+    },
+    // ─── Agent Inbox Actions (internal) ───
+    // Inbox actions back the Agent Inbox MCP tools (task delegation between
+    // agents/people). They are internal (no external OAuth provider), so they
+    // carry a single nominal base scope `inbox` to satisfy the registry
+    // meta-schema's `minItems: 1` (same pattern as hubspot.account.link.get).
+    {
+      action: "inbox.send",
+      resource_type: "inbox:item",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["inbox"],
+      capability: "inbox.write",
+      input_schema: {
+        type: "object",
+        properties: {
+          to: { type: "string", minLength: 1, description: "Recipient (user id / handle) the task request is sent to" },
+          taskType: { type: "string", minLength: 1, description: "Type of task being requested" },
+          payload: { type: "object", description: "Task-specific payload data" },
+          message: { type: "string", description: "Optional human-readable message" }
+        },
+        required: ["to", "taskType", "payload"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "inbox.write" },
+      effects: ["Create:InboxItem"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "to" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "inbox.respond",
+      resource_type: "inbox:item",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["inbox"],
+      capability: "inbox.write",
+      input_schema: {
+        type: "object",
+        properties: {
+          id: { type: "string", minLength: 1, description: "Inbox item id being responded to" },
+          action: { type: "string", enum: ["accept", "decline", "counter"], description: "Response action" },
+          data: { type: "object", description: "Optional response data (e.g. counter-proposal)" }
+        },
+        required: ["id", "action"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "inbox.write" },
+      effects: ["Update:InboxItem"],
+      // high (not medium): an agent-mediated response (MCP invoke) must always
+      // go through human approval — the Phase 1 "always confirm" guarantee made
+      // enforceable. target_bindings below binds the concrete inbox item id so
+      // the high-risk approval has a specific resource constraint (the public
+      // /scheduling/:token link flow does NOT go through this gate — it calls
+      // InboxService.respond directly, system-key-signed).
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "id" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "inbox.check",
+      resource_type: "inbox:item",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["inbox"],
+      capability: "inbox.read",
+      input_schema: {
+        type: "object",
+        properties: {
+          types: { type: "array", items: { type: "string" }, description: "Filter by task types" },
+          status: { type: "string", description: "Filter by item status" }
+        },
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "inbox.read" },
+      effects: ["Read:InboxItem"],
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "id", required: false }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "inbox.checkByToken",
+      resource_type: "inbox:item",
+      required_relations: ["viewer", "editor", "admin", "owner"],
+      required_scopes: ["inbox"],
+      capability: "inbox.read",
+      input_schema: {
+        type: "object",
+        properties: {
+          token: { type: "string", minLength: 1, description: "Opaque access token for a single inbox item" }
+        },
+        required: ["token"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "inbox.read" },
+      effects: ["Read:InboxItem"],
+      risk: "low",
+      target_bindings: {
+        // inbox.checkByToken authenticates via the opaque HMAC token itself —
+        // the token IS the authorization credential and must NOT appear in logs
+        // or API error responses (resolvedResourceId surfaces on resource mismatch).
+        // This action is dispatched before requireActor() so it bypasses the
+        // normal grant-mediated authz path entirely.  We deliberately bind to a
+        // context key that the runtime never populates so that resource_id always
+        // resolves to null and the secret token never reaches resolvedResourceId.
+        resource_id: { source: "context", key: "inbox_item_id" }
+      },
+      version: "1.0.0"
+    },
+    {
+      action: "inbox.complete",
+      resource_type: "inbox:item",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["inbox"],
+      capability: "inbox.write",
+      input_schema: {
+        type: "object",
+        properties: {
+          id: { type: "string", minLength: 1, description: "Inbox item id being completed" },
+          result: { type: "object", description: "Result payload for the completed task" }
+        },
+        required: ["id", "result"],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "inbox.write" },
+      effects: ["Update:InboxItem"],
+      // low: inbox.complete marks an inbox item as done by the owning agent —
+      // this is an internal state update on the agent's own task list, not an
+      // external-facing write that needs human approval. (inbox.send / inbox.respond
+      // are high because they create messages visible to other people.)
+      risk: "low",
+      target_bindings: {
+        resource_id: { source: "param", param: "id" }
+      },
+      version: "1.0.0"
+    },
+    // ─── Scheduling Actions (internal) ───
+    // scheduling.request is a meeting-time negotiation façade over inbox.send.
+    // Candidate slots may be supplied two ways (server-side EXCLUSIVE — exactly
+    // one): (a) `candidates` — the agent computes them LLM-side from the user
+    // calendar and the server validates + freebusy-filters them, or (b)
+    // `candidateWindow` — the agent hands the server a { start, end } window and
+    // the server generates busy-free candidates from the sender's Google
+    // Calendar. Like the inbox actions it is internal (no external OAuth
+    // provider), so it carries the single nominal base scope `inbox`.
+    //
+    // NOTE: the candidates/candidateWindow exclusivity is expressed here as
+    // `oneOf` for documentation + the deep JSON-Schema authorities, but the SDK's
+    // hand-written `validateActionInput` is a SHALLOW shape gate that does NOT
+    // interpret `oneOf` (neither key is in top-level `required`). The exclusivity
+    // (exactly one of candidates/candidateWindow) is ENFORCED server-side in
+    // SchedulingRequestService — see that service for the 400s on both-given /
+    // both-missing.
+    // Spec: docs/specs/2026-06-10-inbox-intent-routing-design.md §2.1
+    {
+      action: "scheduling.request",
+      resource_type: "inbox:item",
+      required_relations: ["editor", "act_as"],
+      required_scopes: ["inbox"],
+      capability: "inbox.write",
+      input_schema: {
+        type: "object",
+        properties: {
+          to: { type: "string", minLength: 1, description: "Counterpart (user id / email) to negotiate a meeting time with" },
+          topic: { type: "string", minLength: 1, description: "Meeting topic shown to the counterpart" },
+          durationMinutes: { type: "integer", minimum: 5, maximum: 480, description: "Meeting length in minutes" },
+          candidates: {
+            type: "array",
+            minItems: 1,
+            maxItems: 10,
+            description: "Explicit candidate slots computed by the agent from the user calendar. The server validates them AND (when Google Calendar is connected) filters out any that conflict with the sender's calendar. Mutually exclusive with candidateWindow \u2014 supply exactly one.",
+            items: {
+              type: "object",
+              properties: {
+                start: { type: "string", description: "ISO 8601 start" },
+                end: { type: "string", description: "ISO 8601 end" }
+              },
+              required: ["start", "end"],
+              additionalProperties: false
+            }
+          },
+          // candidateWindow is `{start,end}` OR an ARRAY of `{start,end}` ranges
+          // (multi-range). We declare `type: ['object', 'array']` — the SDK
+          // shallow validator (matchesType) does not handle an ARRAY of types
+          // (its switch is on a single string), so it hits `default: return true`
+          // and passes BOTH the single object and the array form (B-1 — an array
+          // must NOT be rejected before reaching the server). The union type also
+          // keeps the AJV strict-mode meta-schema happy (a `required`/`properties`
+          // subschema needs SOME type). The nested `properties`/`required` below
+          // describe the object form for the deep JSON-Schema authorities; the
+          // array element shape and the deep constraints (ISO, start<end, ≤5
+          // ranges, ≤62-day total span) are validated server-side in
+          // SchedulingRequestService.validateWindowRanges.
+          candidateWindow: {
+            type: ["object", "array"],
+            description: 'A search window OR an ARRAY of search windows the server fills with busy-free candidate slots from the sender\'s Google Calendar. Each range is `{ start, end }` (ISO 8601) \u2014 an independent contiguous interval the server searches within, spreading candidates across ranges. "\u5E73\u65E5\u5348\u5F8C" = one range per business day (Mon 13-18 / Tue 13-18 / \u2026); "\u6708\u66DC\u5348\u524D or \u6728\u66DC\u5348\u5F8C" = two ranges. A single contiguous span = one range. Max 5 ranges, total span \u2264 62 days. Mutually exclusive with candidates \u2014 supply exactly one. Requires a connected Google Calendar.',
+            properties: {
+              start: { type: "string", description: "ISO 8601 range start" },
+              end: { type: "string", description: "ISO 8601 range end" }
+            },
+            required: ["start", "end"],
+            additionalProperties: false
+          },
+          hold: {
+            type: "boolean",
+            description: "When true (or omitted, when the sender's delegation policy has holds enabled), tentatively hold the offered slots on the sender's calendar as [\u4EEE] events until the counterpart responds or the request expires. Pass false to skip holds for this request. Only takes effect when the sender has an enabled scheduling delegation policy."
+          },
+          message: { type: "string", description: "Optional human-readable message" }
+        },
+        // candidates / candidateWindow are intentionally NOT in `required`: the
+        // exclusive-choice is documented via `oneOf` and enforced server-side.
+        // Each oneOf branch re-declares its property locally (empty `properties`
+        // entry) so AJV strict mode (`strictRequired`) sees the required key as
+        // defined within the branch scope — the value shape itself is validated
+        // by the top-level `properties` above.
+        required: ["to", "topic", "durationMinutes"],
+        oneOf: [
+          { required: ["candidates"], properties: { candidates: {} } },
+          { required: ["candidateWindow"], properties: { candidateWindow: {} } }
+        ],
+        additionalProperties: false
+      },
+      constraints: { rate_bucket: "inbox.write" },
+      effects: ["Create:InboxItem"],
+      risk: "high",
+      target_bindings: {
+        resource_id: { source: "param", param: "to" }
+      },
+      version: "1.0.0"
+    }
+  ],
+  capabilities: [
+    {
+      capability: "slack.messaging.basic",
+      description: "Post, update, and delete messages in channels",
+      includes: ["slack.message.post", "slack.message.update", "slack.message.delete"],
+      version: "1.0.0"
+    },
+    {
+      capability: "slack.read.basic",
+      description: "Read channels, messages, and user info",
+      includes: ["slack.channel.read", "slack.user.read", "slack.message.read", "slack.message.read_paginated", "slack.batch.read"],
+      version: "1.0.0"
+    },
+    {
+      capability: "github.read.basic",
+      description: "Read issues, pull requests and repository contents from repositories",
+      includes: ["github.issue.list", "github.issue.read", "github.pr.list", "github.pr.read", "github.pr.files.list", "github.pr.review.list", "github.pr.search", "github.repo.search", "github.repo.collaborator.list", "github.content.get", "github.tree.get", "github.branch.list", "github.commit.get", "github.commit.list", "github.commit.search", "github.tag.list", "github.release.list", "github.release.getLatest", "github.release.getByTag", "github.code.search", "github.issue.search", "github.issue.types.list", "github.label.get", "github.label.list", "github.workflow.get", "github.workflow.list", "github.workflow.jobLogs.get", "github.repo.starred.list", "github.user.me.get", "github.org.teams.list", "github.team.members.list", "github.user.search", "github.notification.list", "github.notification.get", "github.gist.get", "github.gist.list"],
+      version: "1.0.0"
+    },
+    {
+      capability: "github.issues.triage",
+      description: "Create and update issues, post issue comments, manage sub-issues and labels",
+      includes: ["github.issue.create", "github.issue.update", "github.issue.comment.create", "github.issue.subissue.write", "github.label.write"],
+      version: "1.0.0"
+    },
+    {
+      capability: "github.pulls.write",
+      description: "Create, update, merge, and review pull requests",
+      includes: ["github.pr.create", "github.pr.update", "github.pr.merge", "github.pr.review.create", "github.pr.comment.reply", "github.pr.branch.update"],
+      version: "1.0.0"
+    },
+    {
+      capability: "github.repos.write",
+      description: "\u30EA\u30DD\u30B8\u30C8\u30EA\u306E\u4F5C\u6210\u30FB\u30D5\u30A9\u30FC\u30AF\u30FB\u30D5\u30A1\u30A4\u30EB\u66F4\u65B0\u30FB\u30D6\u30E9\u30F3\u30C1\u4F5C\u6210\u30FB\u30EF\u30FC\u30AF\u30D5\u30ED\u30FC\u5B9F\u884C\u30FB\u30B9\u30BF\u30FC\u64CD\u4F5C",
+      includes: ["github.repo.create", "github.repo.fork", "github.content.createOrUpdate", "github.content.delete", "github.branch.create", "github.workflow.run", "github.repo.star", "github.repo.unstar"],
+      version: "1.0.0"
+    },
+    {
+      capability: "github.notifications.write",
+      description: "\u901A\u77E5\u306E\u65E2\u8AAD\u5316\u30FB\u30B9\u30EC\u30C3\u30C9/\u30EA\u30DD\u30B8\u30C8\u30EA\u306E\u8CFC\u8AAD\u8A2D\u5B9A",
+      includes: ["github.notification.markRead", "github.notification.markAllRead", "github.notification.subscription.set", "github.notification.repoSubscription.set"],
+      version: "1.0.0"
+    },
+    {
+      capability: "github.gists.write",
+      description: "Gist \u306E\u4F5C\u6210\u30FB\u66F4\u65B0",
+      includes: ["github.gist.create", "github.gist.update"],
+      version: "1.0.0"
+    },
+    {
+      capability: "gmail.read.basic",
+      description: "Read and search Gmail messages and labels",
+      includes: ["gmail.message.search", "gmail.message.read", "gmail.label.read", "gmail.batch.read"],
+      version: "1.0.0"
+    },
+    {
+      capability: "gmail.compose",
+      description: "Send emails and create drafts via Gmail",
+      includes: ["gmail.message.send", "gmail.draft.create"],
+      version: "1.0.0"
+    },
+    {
+      capability: "gmail.manage",
+      description: "Trash and permanently delete Gmail messages",
+      includes: ["gmail.message.trash", "gmail.message.delete"],
+      version: "1.0.0"
+    },
+    {
+      capability: "calendar.read.basic",
+      description: "Read and list Google Calendar events, and check free/busy availability",
+      includes: ["calendar.event.list", "calendar.event.read", "calendar.freebusy"],
+      version: "1.0.0"
+    },
+    {
+      capability: "calendar.write",
+      description: "Create, update, and delete Google Calendar events",
+      includes: ["calendar.event.create", "calendar.event.update", "calendar.event.delete"],
+      version: "1.0.0"
+    },
+    {
+      capability: "jira.read.basic",
+      description: "Read Jira issues, projects, boards, sprints, issue link types, and users",
+      includes: ["jira.project.read", "jira.board.read", "jira.sprint.read", "jira.issue.list", "jira.issue.search", "jira.worklog.read", "jira.issue.read", "jira.batch.read", "jira.comment.read", "jira.transition.list", "jira.issuelinktype.list", "jira.user.search"],
+      version: "1.0.0"
+    },
+    {
+      capability: "jira.write.basic",
+      description: "Create, update, delete Jira issues, manage issue links, and add/delete comments",
+      includes: ["jira.issue.create", "jira.issue.update", "jira.issue.delete", "jira.comment.create", "jira.comment.delete", "jira.issue.transition", "jira.issuelink.create", "jira.issuelink.delete"],
+      version: "1.0.0"
+    },
+    {
+      capability: "inbox.write",
+      description: "Send and respond to agent inbox tasks",
+      includes: ["inbox.send", "inbox.respond", "inbox.complete", "scheduling.request"],
+      version: "1.0.0"
+    },
+    {
+      capability: "inbox.read",
+      description: "Read agent inbox tasks",
+      includes: ["inbox.check", "inbox.checkByToken"],
+      version: "1.0.0"
+    },
+    {
+      capability: "linear.read.basic",
+      description: "Read Linear issues, comments, projects, teams, workflow states, labels, users, viewer info, issue relations, cycles, and attachments",
+      includes: [
+        "linear.issue.list",
+        "linear.issue.read",
+        "linear.issue.search",
+        "linear.comment.list",
+        "linear.project.list",
+        "linear.project.read",
+        "linear.team.list",
+        "linear.workflowState.list",
+        "linear.viewer.read",
+        "linear.label.list",
+        "linear.user.list",
+        "linear.issueRelation.list",
+        "linear.cycle.list",
+        "linear.cycle.read",
+        "linear.attachment.list"
+      ],
+      version: "1.0.0"
+    },
+    {
+      capability: "linear.write.basic",
+      description: "Create, update, archive, delete Linear issues, comments, projects, labels, cycles, attachments, and issue relations",
+      includes: [
+        "linear.issue.create",
+        "linear.issue.update",
+        "linear.comment.create",
+        "linear.issue.archive",
+        "linear.project.create",
+        "linear.project.update",
+        "linear.comment.update",
+        "linear.comment.delete",
+        "linear.comment.resolve",
+        "linear.comment.unresolve",
+        "linear.issue.unarchive",
+        "linear.issue.addLabel",
+        "linear.issue.removeLabel",
+        "linear.issue.subscribe",
+        "linear.issue.delete",
+        "linear.issueRelation.create",
+        "linear.issueRelation.delete",
+        "linear.cycle.create",
+        "linear.cycle.update",
+        "linear.label.create",
+        "linear.label.update",
+        "linear.attachment.create",
+        "linear.attachment.delete"
+      ],
+      version: "1.0.0"
+    },
+    {
+      capability: "inbox.write",
+      description: "Send and respond to agent inbox tasks",
+      includes: ["inbox.send", "inbox.respond", "inbox.complete", "scheduling.request"],
+      version: "1.0.0"
+    },
+    {
+      capability: "inbox.read",
+      description: "Read agent inbox tasks",
+      includes: ["inbox.check", "inbox.checkByToken"],
+      version: "1.0.0"
+    }
+  ]
+};
+
+// src/registry/resource-type-labels.ts
+var RESOURCE_TYPE_LABELS = {
+  "github:repo": "\u5BFE\u8C61\u30EA\u30DD\u30B8\u30C8\u30EA",
+  "github:org": "\u5BFE\u8C61\u7D44\u7E54"
+};
+
+// src/registry/action-input-validator.ts
+var SCHEMA_INDEX = (() => {
+  const map = /* @__PURE__ */ new Map();
+  for (const a of ACTION_REGISTRY.actions) {
+    if (a && typeof a.action === "string" && a.input_schema) {
+      map.set(a.action, a.input_schema);
+    }
+  }
+  return map;
+})();
+function describeExpectedShape(schema) {
+  const props = schema.properties ?? {};
+  const required = Array.isArray(schema.required) ? schema.required : [];
+  const requiredSet = new Set(required);
+  const parts = [];
+  const orderedKeys = [
+    ...required.filter((k) => k in props),
+    ...Object.keys(props).filter((k) => !requiredSet.has(k))
+  ];
+  for (const key of orderedKeys) {
+    const prop = props[key] || {};
+    const optionalMark = requiredSet.has(key) ? "" : "?";
+    const enumVals = Array.isArray(prop.enum) ? prop.enum : void 0;
+    if (enumVals && enumVals.length > 0) {
+      const rendered = enumVals.map((v) => typeof v === "string" ? `'${v}'` : String(v)).join(" | ");
+      parts.push(`${key}${optionalMark}: ${rendered}`);
+    } else {
+      parts.push(`${key}${optionalMark}`);
+    }
+  }
+  return `{ ${parts.join(", ")} }`;
+}
+function matchesType(value, type) {
+  if (!type) return true;
+  switch (type) {
+    case "string":
+      return typeof value === "string";
+    case "integer":
+      return typeof value === "number" && Number.isInteger(value);
+    case "number":
+      return typeof value === "number";
+    case "boolean":
+      return typeof value === "boolean";
+    case "array":
+      return Array.isArray(value);
+    case "object":
+      return typeof value === "object" && value !== null && !Array.isArray(value);
+    default:
+      return true;
+  }
+}
+function validateActionInput(action, params) {
+  const schema = SCHEMA_INDEX.get(action);
+  if (!schema) {
+    return { valid: true };
+  }
+  const props = schema.properties ?? {};
+  const required = Array.isArray(schema.required) ? schema.required : [];
+  const additionalProps = schema.additionalProperties;
+  const safeParams = params && typeof params === "object" && !Array.isArray(params) ? params : {};
+  const missing = [];
+  const unknown = [];
+  const enumErrors = [];
+  const typeErrors = [];
+  for (const key of required) {
+    if (!(key in safeParams) || safeParams[key] === void 0 || safeParams[key] === null) {
+      missing.push(key);
+    }
+  }
+  if (additionalProps === false) {
+    for (const key of Object.keys(safeParams)) {
+      if (!(key in props)) {
+        unknown.push(key);
+      }
+    }
+  }
+  for (const key of Object.keys(props)) {
+    if (!(key in safeParams)) continue;
+    const value = safeParams[key];
+    if (value === void 0 || value === null) continue;
+    const prop = props[key] || {};
+    const enumVals = Array.isArray(prop.enum) ? prop.enum : void 0;
+    if (enumVals && enumVals.length > 0) {
+      if (!enumVals.includes(value)) {
+        enumErrors.push(key);
+        continue;
+      }
+    }
+    if (!matchesType(value, prop.type)) {
+      typeErrors.push(key);
+    }
+  }
+  if (missing.length === 0 && unknown.length === 0 && enumErrors.length === 0 && typeErrors.length === 0) {
+    return { valid: true };
+  }
+  const segments = [];
+  if (missing.length > 0) {
+    segments.push(`missing required parameter(s) [${missing.join(", ")}]`);
+  }
+  if (unknown.length > 0) {
+    segments.push(`unknown parameter(s) [${unknown.join(", ")}]`);
+  }
+  if (enumErrors.length > 0) {
+    const details = enumErrors.map((key) => {
+      const enumVals = props[key]?.enum || [];
+      const rendered = enumVals.map((v) => typeof v === "string" ? `'${v}'` : String(v)).join(" | ");
+      return `${key} (allowed: ${rendered})`;
+    }).join(", ");
+    segments.push(`invalid value for enum parameter(s) [${details}]`);
+  }
+  if (typeErrors.length > 0) {
+    const details = typeErrors.map((key) => `${key} (expected ${props[key]?.type})`).join(", ");
+    segments.push(`wrong type for parameter(s) [${details}]`);
+  }
+  const message = `${action}: ${segments.join("; ")}. Expected shape: ${describeExpectedShape(schema)}`;
+  return { valid: false, errors: [message] };
+}
+
+// src/registry/resource-types.ts
+var RESOURCE_TYPES = {
+  // Slack
+  SLACK_CHANNEL: "slack:channel",
+  SLACK_USER: "slack:user",
+  SLACK_WORKSPACE: "slack:workspace",
+  // GitHub
+  GITHUB_REPO: "github:repo",
+  GITHUB_ORG: "github:org",
+  GITHUB_ISSUE: "github:issue",
+  // Google Drive
+  GOOGLE_DRIVE_FILE: "google:drive:file",
+  GOOGLE_DRIVE_FOLDER: "google:drive:folder",
+  // Gmail
+  GMAIL_THREAD: "gmail:thread",
+  GMAIL_LABEL: "gmail:label",
+  // Jira
+  JIRA_PROJECT: "jira:project",
+  JIRA_BOARD: "jira:board",
+  JIRA_ISSUE: "jira:issue",
+  JIRA_SPRINT: "jira:sprint",
+  // HubSpot
+  HUBSPOT_OBJECT: "hubspot:object",
+  HUBSPOT_PROPERTY: "hubspot:property",
+  HUBSPOT_SCHEMA: "hubspot:schema",
+  HUBSPOT_ASSOCIATION: "hubspot:association",
+  HUBSPOT_ENGAGEMENT: "hubspot:engagement",
+  HUBSPOT_WORKFLOW: "hubspot:workflow",
+  HUBSPOT_ACCOUNT: "hubspot:account",
+  // OS (local)
+  OS_SECRET: "os:secret",
+  OS_PROCESS: "os:process",
+  // Wildcard
+  ANY: "*"
+};
+var LEGACY_RESOURCE_TYPE_MAP = {
+  // Action Registry CamelCase format
+  SlackChannel: RESOURCE_TYPES.SLACK_CHANNEL,
+  GitHubRepo: RESOURCE_TYPES.GITHUB_REPO,
   DriveFile: RESOURCE_TYPES.GOOGLE_DRIVE_FILE,
   JiraIssue: RESOURCE_TYPES.JIRA_ISSUE,
   JiraProject: RESOURCE_TYPES.JIRA_PROJECT,
@@ -8373,188 +9429,773 @@ var ACTION_DISPLAY_CONFIGS = {
   "slack.message.post": {
     summaryTemplate: (p) => {
       const parts = [];
-      if (p.channel) parts.push(p.channel + ":");
-      if (p.text) parts.push(String(p.text));
+      if (p.channel) parts.push(p.channel + ":");
+      if (p.text) parts.push(String(p.text));
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "channel", label: "Channel" },
+      { key: "text", label: "Message" }
+    ]
+  },
+  "gmail.message.send": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.to) parts.push(`To: ${p.to}`);
+      if (p.subject) parts.push(`Subject: ${p.subject}`);
+      return parts.join(", ");
+    },
+    displayFields: [
+      { key: "to", label: "To" },
+      { key: "subject", label: "Subject" },
+      { key: "body", label: "Body" }
+    ]
+  },
+  "gmail.draft.create": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.to) parts.push(`To: ${p.to}`);
+      if (p.subject) parts.push(`Subject: ${p.subject}`);
+      return parts.join(", ");
+    },
+    displayFields: [
+      { key: "to", label: "To" },
+      { key: "subject", label: "Subject" },
+      { key: "body", label: "Body" }
+    ]
+  },
+  "calendar.event.create": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.summary) parts.push(p.summary);
+      if (p.start) parts.push(`(${formatCalendarTime(p.start)})`);
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "summary", label: "Event" },
+      { key: "start", label: "Start" },
+      { key: "end", label: "End" },
+      { key: "attendees", label: "Attendees" }
+    ]
+  },
+  "calendar.event.update": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.summary) parts.push(p.summary);
+      if (p.start) parts.push(`(${formatCalendarTime(p.start)})`);
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "summary", label: "Event" },
+      { key: "start", label: "Start" },
+      { key: "end", label: "End" },
+      { key: "attendees", label: "Attendees" }
+    ]
+  },
+  "jira.issue.create": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      const projectKey = jiraField(
+        p,
+        ["projectKey", "project"],
+        "project",
+        (v) => typeof v === "string" ? v : v?.key
+      );
+      const summary = jiraField(p, ["summary"], "summary");
+      if (projectKey) parts.push(`${projectKey}:`);
+      if (summary) parts.push(summary);
+      return parts.join(" ");
+    },
+    // AIDENTITY-54: nested `fields.X` 形式と top-level canonical の両方を
+    // 拾えるよう extract を使う。assignee は null (unassign) も表示。
+    // legacy alias (project / issuetype 等) も top-level 候補に含めて後方互換を保つ。
+    displayFields: [
+      {
+        label: "Project",
+        extract: (p) => jiraField(
+          p,
+          ["projectKey", "project"],
+          "project",
+          (v) => typeof v === "string" ? v : v?.key
+        )
+      },
+      {
+        label: "Type",
+        extract: (p) => jiraField(
+          p,
+          ["issueTypeName", "issueType", "issuetype"],
+          "issuetype",
+          (v) => typeof v === "string" ? v : v?.name
+        )
+      },
+      { label: "Summary", extract: (p) => jiraField(p, ["summary"], "summary") },
+      { label: "Description", extract: (p) => jiraField(p, ["description"], "description") },
+      {
+        label: "Priority",
+        extract: (p) => jiraField(
+          p,
+          ["priority"],
+          "priority",
+          (v) => typeof v === "string" ? v : v?.name
+        )
+      },
+      { label: "Assignee", extract: extractJiraAssigneeDisplay },
+      { label: "Labels", extract: (p) => jiraField(p, ["labels"], "labels") }
+    ]
+  },
+  "jira.issue.update": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      const key = p.issueIdOrKey ?? p.issueKey;
+      const summary = jiraField(p, ["summary"], "summary");
+      if (key) parts.push(`${key}:`);
+      if (summary) parts.push(summary);
+      return parts.join(" ");
+    },
+    displayFields: [
+      // canonical は issueIdOrKey、agent が issueKey で送ってくる旧仕様も拾う。
+      { label: "Issue", extract: (p) => p.issueIdOrKey ?? p.issueKey },
+      { label: "Summary", extract: (p) => jiraField(p, ["summary"], "summary") },
+      { label: "Description", extract: (p) => jiraField(p, ["description"], "description") },
+      {
+        label: "Priority",
+        extract: (p) => jiraField(
+          p,
+          ["priority"],
+          "priority",
+          (v) => typeof v === "string" ? v : v?.name
+        )
+      },
+      // AIDENTITY-54: top-level alias (string / object) と null (unassign) も解決。
+      { label: "Assignee", extract: extractJiraAssigneeDisplay },
+      { label: "Labels", extract: (p) => jiraField(p, ["labels"], "labels") }
+    ]
+  },
+  // AIDENTITY-65: comment 本体は string と ADF document の両方を受けるため、
+  // detail 表示の ADF 描画は formatValueFull 側に任せて key 指定で OK。
+  "jira.comment.create": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.issueIdOrKey) parts.push(`${p.issueIdOrKey}:`);
+      if (p.body) parts.push(typeof p.body === "string" ? p.body : "[ADF]");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "issueIdOrKey", label: "Issue" },
+      { key: "body", label: "Comment" }
+    ]
+  },
+  // AIDENTITY-66: 破壊的操作なので「どの issue のどの comment を消すか」を明示する
+  // (jira.issue.delete / jira.issuelink.delete と同じ destructive 表現の方針)。
+  "jira.comment.delete": {
+    summaryTemplate: (p) => {
+      const issue = p.issueIdOrKey ?? p.issueKey;
+      const commentId = p.commentId ?? p.id;
+      if (issue && commentId) return `Delete comment ${commentId} on ${issue}`;
+      if (commentId) return `Delete comment ${commentId}`;
+      return "";
+    },
+    displayFields: [
+      { label: "Issue", extract: (p) => p.issueIdOrKey ?? p.issueKey },
+      { label: "Comment", extract: (p) => p.commentId ?? p.id }
+    ]
+  },
+  // AIDENTITY-65: API enricher が 'Link' label を upsert で書き換える。
+  "jira.issuelink.delete": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.linkId) parts.push(`Delete link ${p.linkId}`);
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "linkId", label: "Link" }
+    ]
+  },
+  // ─── HubSpot ───
+  "hubspot.crm.objects.list": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.objectType) parts.push(String(p.objectType));
+      parts.push("list");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "objectType", label: "Object Type" },
+      { key: "limit", label: "Limit" },
+      { key: "properties", label: "Properties" }
+    ]
+  },
+  "hubspot.crm.objects.search": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.objectType) parts.push(String(p.objectType));
+      if (p.query) parts.push(`"${String(p.query)}"`);
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "objectType", label: "Object Type" },
+      { key: "query", label: "Query" },
+      { key: "limit", label: "Limit" }
+    ]
+  },
+  "hubspot.crm.objects.batchRead": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.objectType) parts.push(String(p.objectType));
+      if (Array.isArray(p.inputs)) parts.push(`(${p.inputs.length} items)`);
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "objectType", label: "Object Type" },
+      { key: "inputs", label: "Records" }
+    ]
+  },
+  "hubspot.crm.objects.batchCreate": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.objectType) parts.push(String(p.objectType));
+      if (Array.isArray(p.inputs)) parts.push(`create ${p.inputs.length}`);
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "objectType", label: "Object Type" },
+      { key: "inputs", label: "Records" }
+    ]
+  },
+  "hubspot.crm.objects.batchUpdate": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.objectType) parts.push(String(p.objectType));
+      if (Array.isArray(p.inputs)) parts.push(`update ${p.inputs.length}`);
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "objectType", label: "Object Type" },
+      { key: "inputs", label: "Records" }
+    ]
+  },
+  "hubspot.crm.properties.list": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.objectType) parts.push(String(p.objectType));
+      parts.push("properties list");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "objectType", label: "Object Type" }
+    ]
+  },
+  "hubspot.crm.properties.create": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.objectType) parts.push(String(p.objectType));
+      if (p.name) parts.push(String(p.name));
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "objectType", label: "Object Type" },
+      { key: "name", label: "Property Name" },
+      { key: "label", label: "Label" },
+      { key: "type", label: "Type" }
+    ]
+  },
+  "hubspot.crm.engagements.create": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.type) parts.push(String(p.type));
+      parts.push("engagement");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "type", label: "Type" },
+      { key: "metadata", label: "Metadata" }
+    ]
+  },
+  "hubspot.automation.workflows.list": {
+    summaryTemplate: (_p) => "List workflows",
+    displayFields: [
+      { key: "limit", label: "Limit" }
+    ]
+  },
+  "hubspot.account.userDetails.get": {
+    summaryTemplate: (_p) => "Get HubSpot account details",
+    displayFields: []
+  },
+  "hubspot.account.link.get": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.portalId) parts.push(`portal:${p.portalId}`);
+      if (Array.isArray(p.pageRequests)) parts.push(`(${p.pageRequests.length} links)`);
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "portalId", label: "Portal ID" },
+      { key: "pageRequests", label: "Page Requests" }
+    ]
+  },
+  // ─── Linear ───
+  "linear.issue.create": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.teamId) parts.push(`${p.teamId}:`);
+      if (p.title) parts.push(String(p.title));
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "teamId", label: "Team" },
+      { key: "title", label: "Title" },
+      { key: "description", label: "Description" },
+      { key: "stateId", label: "State" },
+      { key: "assigneeId", label: "Assignee" },
+      { key: "priority", label: "Priority" },
+      { key: "labelIds", label: "Labels" }
+    ]
+  },
+  "linear.issue.update": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.issueId) parts.push(`${p.issueId}:`);
+      if (p.title) parts.push(String(p.title));
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "issueId", label: "Issue" },
+      { key: "title", label: "Title" },
+      { key: "description", label: "Description" },
+      { key: "stateId", label: "State" },
+      { key: "assigneeId", label: "Assignee" },
+      { key: "priority", label: "Priority" },
+      { key: "labelIds", label: "Labels" }
+    ]
+  },
+  "linear.comment.create": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.issueId) parts.push(`${p.issueId}:`);
+      if (p.body) parts.push(String(p.body));
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "issueId", label: "Issue" },
+      { key: "body", label: "Comment" }
+    ]
+  },
+  "linear.issue.archive": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.issueId) parts.push(`${p.issueId}:`);
+      parts.push("Archive");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "issueId", label: "Issue" }
+    ]
+  },
+  "linear.label.list": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.teamId) parts.push(`${p.teamId}:`);
+      parts.push("List labels");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "teamId", label: "Team" },
+      { key: "limit", label: "Limit" }
+    ]
+  },
+  "linear.user.list": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.teamId) parts.push(`${p.teamId}:`);
+      parts.push("List users");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "teamId", label: "Team" },
+      { key: "limit", label: "Limit" }
+    ]
+  },
+  "linear.project.create": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.teamIds) parts.push(`${Array.isArray(p.teamIds) ? p.teamIds.join(",") : String(p.teamIds)}:`);
+      if (p.name) parts.push(String(p.name));
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "teamIds", label: "Teams" },
+      { key: "name", label: "Name" },
+      { key: "description", label: "Description" },
+      { key: "statusId", label: "Status ID" },
+      { key: "startDate", label: "Start Date" },
+      { key: "targetDate", label: "Target Date" }
+    ]
+  },
+  "linear.project.update": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.projectId) parts.push(`${p.projectId}:`);
+      if (p.name) parts.push(String(p.name));
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "projectId", label: "Project" },
+      { key: "name", label: "Name" },
+      { key: "description", label: "Description" },
+      { key: "statusId", label: "Status ID" },
+      { key: "startDate", label: "Start Date" },
+      { key: "targetDate", label: "Target Date" }
+    ]
+  },
+  // ─── Linear Comment ops ───
+  "linear.comment.update": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.commentId) parts.push(`${p.commentId}:`);
+      parts.push("Update comment");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "commentId", label: "Comment" },
+      { key: "body", label: "Body" }
+    ]
+  },
+  "linear.comment.delete": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.commentId) parts.push(`Delete comment ${p.commentId}`);
       return parts.join(" ");
     },
     displayFields: [
-      { key: "channel", label: "Channel" },
-      { key: "text", label: "Message" }
+      { key: "commentId", label: "Comment" }
     ]
   },
-  "gmail.message.send": {
+  "linear.comment.resolve": {
     summaryTemplate: (p) => {
       const parts = [];
-      if (p.to) parts.push(`To: ${p.to}`);
-      if (p.subject) parts.push(`Subject: ${p.subject}`);
-      return parts.join(", ");
+      if (p.commentId) parts.push(`${p.commentId}:`);
+      parts.push("Resolve comment");
+      return parts.join(" ");
     },
     displayFields: [
-      { key: "to", label: "To" },
-      { key: "subject", label: "Subject" },
-      { key: "body", label: "Body" }
+      { key: "commentId", label: "Comment" }
     ]
   },
-  "gmail.draft.create": {
+  "linear.comment.unresolve": {
     summaryTemplate: (p) => {
       const parts = [];
-      if (p.to) parts.push(`To: ${p.to}`);
-      if (p.subject) parts.push(`Subject: ${p.subject}`);
-      return parts.join(", ");
+      if (p.commentId) parts.push(`${p.commentId}:`);
+      parts.push("Unresolve comment");
+      return parts.join(" ");
     },
     displayFields: [
-      { key: "to", label: "To" },
-      { key: "subject", label: "Subject" },
-      { key: "body", label: "Body" }
+      { key: "commentId", label: "Comment" }
     ]
   },
-  "calendar.event.create": {
+  // ─── Linear Issue ops ───
+  "linear.issue.unarchive": {
     summaryTemplate: (p) => {
       const parts = [];
-      if (p.summary) parts.push(p.summary);
-      if (p.start) parts.push(`(${formatCalendarTime(p.start)})`);
+      if (p.issueId) parts.push(`${p.issueId}:`);
+      parts.push("Unarchive");
       return parts.join(" ");
     },
     displayFields: [
-      { key: "summary", label: "Event" },
-      { key: "start", label: "Start" },
-      { key: "end", label: "End" },
-      { key: "attendees", label: "Attendees" }
+      { key: "issueId", label: "Issue" }
     ]
   },
-  "calendar.event.update": {
+  "linear.issue.addLabel": {
     summaryTemplate: (p) => {
       const parts = [];
-      if (p.summary) parts.push(p.summary);
-      if (p.start) parts.push(`(${formatCalendarTime(p.start)})`);
+      if (p.issueId) parts.push(`${p.issueId}:`);
+      if (p.labelId) parts.push(`Add label ${p.labelId}`);
       return parts.join(" ");
     },
     displayFields: [
-      { key: "summary", label: "Event" },
-      { key: "start", label: "Start" },
-      { key: "end", label: "End" },
-      { key: "attendees", label: "Attendees" }
+      { key: "issueId", label: "Issue" },
+      { key: "labelId", label: "Label" }
     ]
   },
-  "jira.issue.create": {
+  "linear.issue.removeLabel": {
     summaryTemplate: (p) => {
       const parts = [];
-      const projectKey = jiraField(
-        p,
-        ["projectKey", "project"],
-        "project",
-        (v) => typeof v === "string" ? v : v?.key
-      );
-      const summary = jiraField(p, ["summary"], "summary");
-      if (projectKey) parts.push(`${projectKey}:`);
-      if (summary) parts.push(summary);
+      if (p.issueId) parts.push(`${p.issueId}:`);
+      if (p.labelId) parts.push(`Remove label ${p.labelId}`);
       return parts.join(" ");
     },
-    // AIDENTITY-54: nested `fields.X` 形式と top-level canonical の両方を
-    // 拾えるよう extract を使う。assignee は null (unassign) も表示。
-    // legacy alias (project / issuetype 等) も top-level 候補に含めて後方互換を保つ。
     displayFields: [
-      {
-        label: "Project",
-        extract: (p) => jiraField(
-          p,
-          ["projectKey", "project"],
-          "project",
-          (v) => typeof v === "string" ? v : v?.key
-        )
-      },
-      {
-        label: "Type",
-        extract: (p) => jiraField(
-          p,
-          ["issueTypeName", "issueType", "issuetype"],
-          "issuetype",
-          (v) => typeof v === "string" ? v : v?.name
-        )
-      },
-      { label: "Summary", extract: (p) => jiraField(p, ["summary"], "summary") },
-      { label: "Description", extract: (p) => jiraField(p, ["description"], "description") },
-      {
-        label: "Priority",
-        extract: (p) => jiraField(
-          p,
-          ["priority"],
-          "priority",
-          (v) => typeof v === "string" ? v : v?.name
-        )
-      },
-      { label: "Assignee", extract: extractJiraAssigneeDisplay },
-      { label: "Labels", extract: (p) => jiraField(p, ["labels"], "labels") }
+      { key: "issueId", label: "Issue" },
+      { key: "labelId", label: "Label" }
     ]
   },
-  "jira.issue.update": {
+  "linear.issue.subscribe": {
     summaryTemplate: (p) => {
       const parts = [];
-      const key = p.issueIdOrKey ?? p.issueKey;
-      const summary = jiraField(p, ["summary"], "summary");
-      if (key) parts.push(`${key}:`);
-      if (summary) parts.push(summary);
+      if (p.issueId) parts.push(`${p.issueId}:`);
+      parts.push("Subscribe");
       return parts.join(" ");
     },
     displayFields: [
-      // canonical は issueIdOrKey、agent が issueKey で送ってくる旧仕様も拾う。
-      { label: "Issue", extract: (p) => p.issueIdOrKey ?? p.issueKey },
-      { label: "Summary", extract: (p) => jiraField(p, ["summary"], "summary") },
-      { label: "Description", extract: (p) => jiraField(p, ["description"], "description") },
-      {
-        label: "Priority",
-        extract: (p) => jiraField(
-          p,
-          ["priority"],
-          "priority",
-          (v) => typeof v === "string" ? v : v?.name
-        )
-      },
-      // AIDENTITY-54: top-level alias (string / object) と null (unassign) も解決。
-      { label: "Assignee", extract: extractJiraAssigneeDisplay },
-      { label: "Labels", extract: (p) => jiraField(p, ["labels"], "labels") }
+      { key: "issueId", label: "Issue" }
     ]
   },
-  // AIDENTITY-65: comment 本体は string と ADF document の両方を受けるため、
-  // detail 表示の ADF 描画は formatValueFull 側に任せて key 指定で OK。
-  "jira.comment.create": {
+  "linear.issue.delete": {
     summaryTemplate: (p) => {
       const parts = [];
-      if (p.issueIdOrKey) parts.push(`${p.issueIdOrKey}:`);
-      if (p.body) parts.push(typeof p.body === "string" ? p.body : "[ADF]");
+      if (p.issueId) parts.push(`Delete issue ${p.issueId}`);
       return parts.join(" ");
     },
     displayFields: [
-      { key: "issueIdOrKey", label: "Issue" },
-      { key: "body", label: "Comment" }
+      { key: "issueId", label: "Issue" }
     ]
   },
-  // AIDENTITY-66: 破壊的操作なので「どの issue のどの comment を消すか」を明示する
-  // (jira.issue.delete / jira.issuelink.delete と同じ destructive 表現の方針)。
-  "jira.comment.delete": {
+  // ─── Linear Issue Relations ───
+  "linear.issueRelation.create": {
     summaryTemplate: (p) => {
-      const issue = p.issueIdOrKey ?? p.issueKey;
-      const commentId = p.commentId ?? p.id;
-      if (issue && commentId) return `Delete comment ${commentId} on ${issue}`;
-      if (commentId) return `Delete comment ${commentId}`;
-      return "";
+      const parts = [];
+      if (p.issueId) parts.push(`${p.issueId}`);
+      if (p.type) parts.push(String(p.type));
+      if (p.relatedIssueId) parts.push(String(p.relatedIssueId));
+      return parts.join(" ");
     },
     displayFields: [
-      { label: "Issue", extract: (p) => p.issueIdOrKey ?? p.issueKey },
-      { label: "Comment", extract: (p) => p.commentId ?? p.id }
+      { key: "issueId", label: "Issue" },
+      { key: "type", label: "Relation Type" },
+      { key: "relatedIssueId", label: "Related Issue" }
     ]
   },
-  // AIDENTITY-65: API enricher が 'Link' label を upsert で書き換える。
-  "jira.issuelink.delete": {
+  "linear.issueRelation.list": {
     summaryTemplate: (p) => {
       const parts = [];
-      if (p.linkId) parts.push(`Delete link ${p.linkId}`);
+      if (p.issueId) parts.push(`${p.issueId}:`);
+      parts.push("List relations");
       return parts.join(" ");
     },
     displayFields: [
-      { key: "linkId", label: "Link" }
+      { key: "issueId", label: "Issue" }
+    ]
+  },
+  "linear.issueRelation.delete": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.relationId) parts.push(`Delete relation ${p.relationId}`);
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "relationId", label: "Relation" }
+    ]
+  },
+  // ─── Linear Cycles ───
+  "linear.cycle.list": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.teamId) parts.push(`${p.teamId}:`);
+      parts.push("List cycles");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "teamId", label: "Team" },
+      { key: "limit", label: "Limit" }
+    ]
+  },
+  "linear.cycle.read": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.cycleId) parts.push(`${p.cycleId}:`);
+      parts.push("Read cycle");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "cycleId", label: "Cycle" }
+    ]
+  },
+  "linear.cycle.create": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.teamId) parts.push(`${p.teamId}:`);
+      if (p.name) parts.push(String(p.name));
+      else if (p.startsAt) parts.push(`Cycle ${p.startsAt}`);
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "teamId", label: "Team" },
+      { key: "name", label: "Name" },
+      { key: "startsAt", label: "Starts At" },
+      { key: "endsAt", label: "Ends At" }
+    ]
+  },
+  "linear.cycle.update": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.cycleId) parts.push(`${p.cycleId}:`);
+      if (p.name) parts.push(String(p.name));
+      else parts.push("Update cycle");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "cycleId", label: "Cycle" },
+      { key: "name", label: "Name" },
+      { key: "startsAt", label: "Starts At" },
+      { key: "endsAt", label: "Ends At" }
+    ]
+  },
+  // ─── Linear Labels ───
+  "linear.label.create": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.name) parts.push(String(p.name));
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "name", label: "Name" },
+      { key: "color", label: "Color" },
+      { key: "teamId", label: "Team" }
+    ]
+  },
+  "linear.label.update": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.labelId) parts.push(`${p.labelId}:`);
+      if (p.name) parts.push(String(p.name));
+      else parts.push("Update label");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "labelId", label: "Label" },
+      { key: "name", label: "Name" },
+      { key: "color", label: "Color" }
+    ]
+  },
+  // ─── Linear Attachments ───
+  "linear.attachment.create": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.issueId) parts.push(`${p.issueId}:`);
+      if (p.title) parts.push(String(p.title));
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "issueId", label: "Issue" },
+      { key: "title", label: "Title" },
+      { key: "url", label: "URL" }
+    ]
+  },
+  "linear.attachment.list": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.issueId) parts.push(`${p.issueId}:`);
+      parts.push("List attachments");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "issueId", label: "Issue" }
+    ]
+  },
+  "linear.attachment.delete": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.attachmentId) parts.push(`Delete attachment ${p.attachmentId}`);
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "attachmentId", label: "Attachment" }
+    ]
+  },
+  // ─── Linear read actions (登録漏れ補完) ───
+  "linear.issue.list": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.teamId) parts.push(`${p.teamId}:`);
+      parts.push("List issues");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "teamId", label: "Team" },
+      { key: "assigneeId", label: "Assignee" },
+      { key: "stateId", label: "State" },
+      { key: "limit", label: "Limit" }
+    ]
+  },
+  "linear.issue.read": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.issueId) parts.push(`${p.issueId}:`);
+      parts.push("Read issue");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "issueId", label: "Issue" }
+    ]
+  },
+  "linear.issue.search": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.teamId) parts.push(`${p.teamId}:`);
+      if (p.query) parts.push(String(p.query));
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "query", label: "Query" },
+      { key: "teamId", label: "Team" },
+      { key: "limit", label: "Limit" }
+    ]
+  },
+  "linear.comment.list": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.issueId) parts.push(`${p.issueId}:`);
+      parts.push("List comments");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "issueId", label: "Issue" }
+    ]
+  },
+  "linear.project.list": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.teamId) parts.push(`${p.teamId}:`);
+      parts.push("List projects");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "teamId", label: "Team" },
+      { key: "limit", label: "Limit" }
+    ]
+  },
+  "linear.project.read": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.projectId) parts.push(`${p.projectId}:`);
+      parts.push("Read project");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "projectId", label: "Project" }
+    ]
+  },
+  "linear.team.list": {
+    summaryTemplate: (_p) => "List teams",
+    displayFields: [
+      { key: "limit", label: "Limit" }
+    ]
+  },
+  "linear.workflowState.list": {
+    summaryTemplate: (p) => {
+      const parts = [];
+      if (p.teamId) parts.push(`${p.teamId}:`);
+      parts.push("List workflow states");
+      return parts.join(" ");
+    },
+    displayFields: [
+      { key: "teamId", label: "Team" },
+      { key: "limit", label: "Limit" }
     ]
   },
+  "linear.viewer.read": {
+    summaryTemplate: (_p) => "Read viewer (current user)",
+    displayFields: []
+  },
   // AIDENTITY-83: email / displayName から accountId を解決する read action。
   "jira.user.search": {
     summaryTemplate: (p) => {
@@ -8577,7 +10218,8 @@ var ACTION_DISPLAY_CONFIGS = {
     displayFields: [
       { key: "to", label: "To" },
       { key: "taskType", label: "Task" },
-      { key: "message", label: "Message" }
+      { key: "message", label: "Message" },
+      { key: "payload", label: "Payload" }
     ]
   },
   "inbox.respond": {
@@ -8605,15 +10247,25 @@ var ACTION_DISPLAY_CONFIGS = {
     ]
   },
   "inbox.checkByToken": {
-    summaryTemplate: (p) => p.token ? `Token: ${p.token}` : "",
-    displayFields: [
-      { key: "token", label: "Token" }
-    ]
+    // token is an opaque access credential — never render it in summaries or display fields.
+    summaryTemplate: (_p) => "Check inbox by token",
+    displayFields: []
   },
   "inbox.complete": {
     summaryTemplate: (p) => p.id ? `Complete #${p.id}` : "",
     displayFields: [
-      { key: "id", label: "Item" }
+      { key: "id", label: "Item" },
+      { key: "result", label: "Result" }
+    ]
+  },
+  "scheduling.request": {
+    summaryTemplate: (p) => p.topic ? `Request scheduling: ${p.topic}` : "Request scheduling",
+    displayFields: [
+      { key: "to", label: "To" },
+      { key: "topic", label: "Topic" },
+      { key: "durationMinutes", label: "Duration (min)" },
+      { key: "candidates", label: "Candidates" },
+      { key: "message", label: "Message" }
     ]
   }
 };
@@ -8921,7 +10573,7 @@ function isWriteAction(action) {
   if (!meta) {
     return true;
   }
-  const writeEffectPrefixes = ["Create:", "Update:", "Delete:", "Write:", "Execute:", "Merge:", "Run:"];
+  const writeEffectPrefixes = ["Create:", "Update:", "Delete:", "Write:", "Execute:", "Merge:", "Run:", "Archive:"];
   if (meta.effects?.some((e) => writeEffectPrefixes.some((p) => e.startsWith(p)))) {
     return true;
   }