linear-grab-bridge 0.12.1 → 0.15.1

package/linear-grab-bridge.mjs

@@ -28,7 +28,7 @@ const flag = (name, fallback) => {
 const PORT = Number(flag('--port', '4577'));
 const DIR = flag('--dir', process.cwd());
 const CLAUDE_BIN = flag('--claude', 'claude');
-const VERSION = '0.12.1';
+const VERSION = '0.15.1';
 
 /** Best-effort command runner (git/gh introspection). Never throws. */
 function run(cmd, args, cwd = DIR) {
@@ -65,6 +65,12 @@ const IDLE_KILL_MS = 30 * 60_000; // free an idle interactive session after 30mi
 /** @type {Map<string, any>} */
 const tasks = new Map();
 
+/** Linear Authorization header supplied by the panel (for the media proxy). */
+let linearAuth = null;
+
+/** PR state cache (gh pr view) — 60s TTL. */
+const prStatusCache = new Map();
+
 // ---- persistence -----------------------------------------------------------
 
 const HISTORY_DIR = join(homedir(), '.linear-grab');
@@ -546,6 +552,79 @@ createServer(async (req, res) => {
       const task = await startTask(body);
       return json(res, 201, summary(task));
     }
+    // Panel hands us its Linear auth so /fetch can display Linear-hosted media.
+    if (req.method === 'POST' && url.pathname === '/config') {
+      const body = await readBody(req);
+      if (typeof body.linearAuth === 'string') linearAuth = body.linearAuth;
+      return json(res, 200, { ok: true });
+    }
+    // Media proxy: uploads.linear.app requires Linear auth on every GET — an
+    // <img>/<video> tag can't send headers, this local process can.
+    if (req.method === 'GET' && url.pathname === '/fetch') {
+      const target = url.searchParams.get('url') ?? '';
+      let host = '';
+      try {
+        host = new URL(target).hostname;
+      } catch {
+        /* invalid */
+      }
+      if (!/(^|\.)uploads\.linear\.app$/.test(host)) {
+        return json(res, 400, { error: 'host not allowed' });
+      }
+      const upstream = await fetch(target, {
+        headers: linearAuth ? { Authorization: linearAuth } : {},
+      });
+      if (!upstream.ok) return json(res, upstream.status, { error: `upstream ${upstream.status}` });
+      res.writeHead(200, {
+        'Content-Type': upstream.headers.get('content-type') ?? 'application/octet-stream',
+        'Cache-Control': 'private, max-age=300',
+        ...CORS,
+      });
+      return res.end(Buffer.from(await upstream.arrayBuffer()));
+    }
+    // Real PR states (OPEN/MERGED/CLOSED) via gh — the panel can't know
+    // merge status from Linear attachments alone.
+    if (req.method === 'POST' && url.pathname === '/pr/status') {
+      const body = await readBody(req);
+      const urls = (Array.isArray(body.urls) ? body.urls : []).slice(0, 20);
+      const statuses = {};
+      await Promise.all(
+        urls.map(async (u) => {
+          const prUrl = String(u);
+          if (!/^https:\/\/github\.com\/[\w.-]+\/[\w.-]+\/pull\/\d+$/.test(prUrl)) return;
+          const cached = prStatusCache.get(prUrl);
+          if (cached && Date.now() - cached.at < 60_000) {
+            statuses[prUrl] = cached.state;
+            return;
+          }
+          const out = await run('gh', ['pr', 'view', prUrl, '--json', 'state']);
+          try {
+            const state = JSON.parse(out ?? '').state;
+            if (state) {
+              prStatusCache.set(prUrl, { state, at: Date.now() });
+              statuses[prUrl] = state;
+            }
+          } catch {
+            /* gh missing / not accessible */
+          }
+        }),
+      );
+      return json(res, 200, { statuses });
+    }
+    // Fast-merge: after reviewing the demo, one click merges the PR via gh.
+    if (req.method === 'POST' && url.pathname === '/pr/merge') {
+      const body = await readBody(req);
+      const prUrl = String(body.url ?? '');
+      if (!/^https:\/\/github\.com\/[\w.-]+\/[\w.-]+\/pull\/\d+$/.test(prUrl)) {
+        return json(res, 400, { error: 'invalid PR url' });
+      }
+      const out = await run('gh', ['pr', 'merge', prUrl, '--squash']);
+      prStatusCache.delete(prUrl);
+      if (out === null) {
+        return json(res, 502, { error: 'gh pr merge failed — check gh auth / merge conflicts / required checks' });
+      }
+      return json(res, 200, { ok: true, output: out.slice(0, 500) });
+    }
     // Upload proxy: browsers can't PUT to Linear's storage (no CORS there) —
     // this local process can. SSRF-guarded to Linear storage hosts.
     if (req.method === 'POST' && url.pathname === '/put') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "linear-grab-bridge",
-  "version": "0.12.1",
+  "version": "0.15.1",
   "description": "Local bridge for Linear Grab — delegate issues from the browser panel to headless Claude Code sessions running in your repo, with live status and an upload relay.",
   "type": "module",
   "bin": {