linmux 0.1.0

package/dist/core/resolvers/project-status.js

@@ -0,0 +1,42 @@
+import { LinearAgentError } from "../errors/error.js";
+import { withRateLimitRetry } from "../transport/rate-limit.js";
+import { UUID_RE } from "../../lib/filter-heuristics.js";
+//#region src/core/resolvers/project-status.ts
+const cache = /* @__PURE__ */ new Map();
+/**
+* Resolve a project-status name (or UUID) to a `ProjectStatus.id` for the
+* active workspace. Throws `PROJECT_NOT_FOUND` (re-used taxonomy) on miss.
+*/
+async function resolveProjectStatusId(client, workspaceName, nameOrId, retryOpts) {
+	if (UUID_RE.test(nameOrId)) return nameOrId;
+	let map = cache.get(workspaceName);
+	if (!map) {
+		map = (async () => {
+			const conn = await withRateLimitRetry(() => client.projectStatuses({ first: 50 }), retryOpts);
+			const m = /* @__PURE__ */ new Map();
+			for (const s of conn.nodes) m.set(s.name.toLowerCase(), s.id);
+			return m;
+		})();
+		cache.set(workspaceName, map);
+	}
+	let m;
+	try {
+		m = await map;
+	} catch (e) {
+		cache.delete(workspaceName);
+		throw e;
+	}
+	const id = m.get(nameOrId.toLowerCase());
+	if (!id) throw new LinearAgentError({
+		code: "PROJECT_NOT_FOUND",
+		message: `project status not found: ${nameOrId}`,
+		details: {
+			workspace: workspaceName,
+			requested: nameOrId,
+			available: [...m.keys()].sort()
+		}
+	});
+	return id;
+}
+//#endregion
+export { resolveProjectStatusId };

package/dist/core/resolvers/project.js

@@ -0,0 +1,43 @@
+import { LinearAgentError } from "../errors/error.js";
+import { withRateLimitRetry } from "../transport/rate-limit.js";
+import { UUID_RE } from "../../lib/filter-heuristics.js";
+//#region src/core/resolvers/project.ts
+const cache = /* @__PURE__ */ new Map();
+/**
+* Resolve a project name (or UUID) to a project UUID for the active
+* workspace. Throws `PROJECT_NOT_FOUND` on miss with the cached project name
+* list so the agent can self-correct.
+*/
+async function resolveProjectId(client, workspaceName, nameOrId, retryOpts) {
+	if (UUID_RE.test(nameOrId)) return nameOrId;
+	let map = cache.get(workspaceName);
+	if (!map) {
+		map = (async () => {
+			const conn = await withRateLimitRetry(() => client.projects({ first: 250 }), retryOpts);
+			const m = /* @__PURE__ */ new Map();
+			for (const p of conn.nodes) m.set(p.name.toLowerCase(), p.id);
+			return m;
+		})();
+		cache.set(workspaceName, map);
+	}
+	let m;
+	try {
+		m = await map;
+	} catch (e) {
+		cache.delete(workspaceName);
+		throw e;
+	}
+	const id = m.get(nameOrId.toLowerCase());
+	if (!id) throw new LinearAgentError({
+		code: "PROJECT_NOT_FOUND",
+		message: `project not found: ${nameOrId}`,
+		details: {
+			workspace: workspaceName,
+			requested: nameOrId,
+			available: [...m.keys()].sort()
+		}
+	});
+	return id;
+}
+//#endregion
+export { resolveProjectId };

package/dist/core/resolvers/state.js

@@ -0,0 +1,46 @@
+import { LinearAgentError } from "../errors/error.js";
+import { withRateLimitRetry } from "../transport/rate-limit.js";
+import { UUID_RE } from "../../lib/filter-heuristics.js";
+//#region src/core/resolvers/state.ts
+const cache = /* @__PURE__ */ new Map();
+/**
+* Resolve a state-name (or UUID) to a workflow-state UUID, scoped to one
+* `${workspace}:${teamId}` pair.
+*/
+async function resolveStateNameToId(client, workspaceName, teamId, nameOrId, retryOpts) {
+	if (UUID_RE.test(nameOrId)) return nameOrId;
+	const key = `${workspaceName}:${teamId}`;
+	let map = cache.get(key);
+	if (!map) {
+		map = (async () => {
+			const conn = await withRateLimitRetry(() => client.workflowStates({
+				filter: { team: { id: { eq: teamId } } },
+				first: 50
+			}), retryOpts);
+			const m = /* @__PURE__ */ new Map();
+			for (const s of conn.nodes) m.set(s.name.toLowerCase(), s.id);
+			return m;
+		})();
+		cache.set(key, map);
+	}
+	let m;
+	try {
+		m = await map;
+	} catch (e) {
+		cache.delete(key);
+		throw e;
+	}
+	const id = m.get(nameOrId.toLowerCase());
+	if (!id) throw new LinearAgentError({
+		code: "WORKFLOW_STATE_NOT_FOUND",
+		message: `workflow state not found: ${nameOrId}`,
+		details: {
+			teamId,
+			requested: nameOrId,
+			available: [...m.keys()].sort()
+		}
+	});
+	return id;
+}
+//#endregion
+export { resolveStateNameToId };

package/dist/core/resolvers/team.js

@@ -0,0 +1,50 @@
+import { LinearAgentError } from "../errors/error.js";
+import { withRateLimitRetry } from "../transport/rate-limit.js";
+import { TEAM_KEY_RE, UUID_RE } from "../../lib/filter-heuristics.js";
+//#region src/core/resolvers/team.ts
+const cache = /* @__PURE__ */ new Map();
+/**
+* Resolve a team key, name, or UUID to a team UUID for the active workspace.
+*/
+async function resolveTeamId(client, workspaceName, keyOrIdOrName, retryOpts) {
+	if (UUID_RE.test(keyOrIdOrName)) return keyOrIdOrName;
+	let entry = cache.get(workspaceName);
+	if (!entry) {
+		entry = (async () => {
+			const conn = await withRateLimitRetry(() => client.teams({ first: 250 }), retryOpts);
+			const byKey = /* @__PURE__ */ new Map();
+			const byName = /* @__PURE__ */ new Map();
+			for (const t of conn.nodes) {
+				byKey.set(t.key.toLowerCase(), t.id);
+				byName.set(t.name.toLowerCase(), t.id);
+			}
+			return {
+				byKey,
+				byName
+			};
+		})();
+		cache.set(workspaceName, entry);
+	}
+	let resolved;
+	try {
+		resolved = await entry;
+	} catch (e) {
+		cache.delete(workspaceName);
+		throw e;
+	}
+	const lower = keyOrIdOrName.toLowerCase();
+	const id = TEAM_KEY_RE.test(keyOrIdOrName) ? resolved.byKey.get(lower) ?? resolved.byName.get(lower) : resolved.byName.get(lower) ?? resolved.byKey.get(lower);
+	if (!id) throw new LinearAgentError({
+		code: "TEAM_NOT_FOUND",
+		message: `team not found: ${keyOrIdOrName}`,
+		details: {
+			workspace: workspaceName,
+			requested: keyOrIdOrName,
+			availableKeys: [...resolved.byKey.keys()].sort(),
+			availableNames: [...resolved.byName.keys()].sort()
+		}
+	});
+	return id;
+}
+//#endregion
+export { resolveTeamId };

package/dist/core/transport/fetch-interceptor.js

@@ -0,0 +1,109 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+//#region src/core/transport/fetch-interceptor.ts
+/**
+* Fetch interceptor for capturing Linear's complexity-meter response headers
+* (Phase 2 PLAN 02-01, RAT-02).
+*
+* Linear surfaces rate-limit pressure on every successful response via:
+*   - `x-complexity` (cost of this query)
+*   - `x-ratelimit-complexity-remaining` (remaining budget in window)
+*
+* The SDK does not expose these headers via its public API, so the only
+* lever to surface them in our envelope is patching `globalThis.fetch` for
+* the lifetime of the SDK call. To stay safe under concurrent invocations
+* (parallel workspace add/replace-token, parallel agents), the patched
+* fetch's "last response" state lives in an `AsyncLocalStorage` context —
+* each `withFetchInterception(fn)` call gets its own ALS frame.
+*
+* Snapshot-drift safety (see RESEARCH § Pitfall 8):
+* `getLastComplexity()` returns `undefined` whenever no patched fetch has
+* observed a response — typically because tests mock at the SDK class
+* boundary (vi.mock('@linear/sdk')) and never go through `globalThis.fetch`.
+* Runtimes spread `meta.complexity` only when the value is present:
+*   `...(getLastComplexity() && { complexity: getLastComplexity() })`
+* This keeps Phase 1 snapshots byte-identical: the spread is a no-op in
+* mocked tests, so `meta.complexity` is absent from the serialized envelope.
+*
+* Restoration invariant: the original `globalThis.fetch` is restored in a
+* `finally` block. Even if `fn` throws, the global is restored to the
+* captured `original` reference (Test 17). The patch is also nested-safe:
+* each `withFetchInterception` saves the current fetch (which may itself be
+* a previous patch) and restores it on exit.
+*/
+const als = new AsyncLocalStorage();
+/**
+* Read the most-recent complexity headers captured inside the current
+* `withFetchInterception(fn)` ALS frame. Returns `undefined` when the
+* interceptor was never engaged (e.g. SDK-mocked unit tests) or no fetch
+* response carried the headers.
+*/
+function getLastComplexity() {
+	return als.getStore()?.last;
+}
+/**
+* Marker we attach to our patched fetch so nested `withFetchInterception`
+* calls can recognise an existing patch and reuse the *real* fetch
+* underneath rather than chaining writes into the wrong ALS frame.
+*
+* Without this, two parallel `withFetchInterception(fnA), withFetchInterception(fnB)`
+* would chain patches: B's patched fetch → A's patched fetch → real fetch.
+* A's closure-captured `ctx` would receive writes from B's responses,
+* breaking ALS isolation. The marker lets B's patch detect that the current
+* `globalThis.fetch` is already a patch and skip past it to whatever it
+* wraps — so each patch sits between the **real** fetch and exactly the
+* `fn` call tree it was created for.
+*/
+const PATCH_MARKER = Symbol.for("linmux.fetch-interceptor.patch");
+const RAW_FETCH_KEY = Symbol.for("linmux.fetch-interceptor.rawFetch");
+function unwrapToRealFetch(f) {
+	const cursor = f;
+	if (cursor[PATCH_MARKER] === true && cursor[RAW_FETCH_KEY] !== void 0) return cursor[RAW_FETCH_KEY];
+	return f;
+}
+/**
+* Run `fn` with `globalThis.fetch` patched so that every response within
+* `fn`'s call tree updates the ALS-scoped "last complexity" record for
+* THIS frame only. The original fetch is restored unconditionally (success
+* or throw).
+*
+* Concurrent invocations are isolated via `AsyncLocalStorage`. The patch
+* itself reads `als.getStore()` on each call — so even if two parallel
+* frames share the same global patch via interleaved scheduling, each
+* fetch's complexity write lands in the ALS frame whose `fn` is currently
+* on the stack (not the closure-captured ctx of whichever patch happens to
+* be the "outermost" wrapper).
+*/
+async function withFetchInterception(fn) {
+	return als.run({}, async () => {
+		const previous = globalThis.fetch;
+		const realFetch = unwrapToRealFetch(previous);
+		const patched = async (...args) => {
+			const res = await realFetch(...args);
+			const cost = parseHeaderInt(res.headers.get("x-complexity"));
+			const remaining = parseHeaderInt(res.headers.get("x-ratelimit-complexity-remaining"));
+			if (cost !== void 0 && remaining !== void 0) {
+				const store = als.getStore();
+				if (store) store.last = {
+					cost,
+					remaining
+				};
+			}
+			return res;
+		};
+		patched[PATCH_MARKER] = true;
+		patched[RAW_FETCH_KEY] = realFetch;
+		globalThis.fetch = patched;
+		try {
+			return await fn();
+		} finally {
+			globalThis.fetch = previous;
+		}
+	});
+}
+function parseHeaderInt(value) {
+	if (value === null) return void 0;
+	const n = Number(value);
+	return Number.isFinite(n) ? n : void 0;
+}
+//#endregion
+export { getLastComplexity, withFetchInterception };

package/dist/core/transport/index.js

@@ -0,0 +1,3 @@
+import "./fetch-interceptor.js";
+import "./rate-limit.js";
+export {};

package/dist/core/transport/rate-limit.js

@@ -0,0 +1,167 @@
+import { LinearAgentError } from "../errors/error.js";
+import { AuthenticationLinearError, InvalidInputLinearError, LinearError, NetworkLinearError, RatelimitedLinearError } from "@linear/sdk";
+//#region src/core/transport/rate-limit.ts
+/**
+* Rate-limit-aware transport wrapper (Phase 2 PLAN 02-01, RAT-01 / RAT-03).
+*
+* Every Phase 2 SDK call routes through `withRateLimitRetry`. The wrapper
+*   1. retries on `RatelimitedLinearError` and `NetworkLinearError` with
+*      exponential backoff + full jitter (RAT-01 default policy);
+*   2. classifies all other thrown SDK errors into `LinearAgentError`
+*      instances via `classifySdkError` (RAT-03) so the kernel envelope
+*      shape stays canonical.
+*
+* The classifier discriminates on `@linear/sdk` typed error classes
+* (`RatelimitedLinearError`, `AuthenticationLinearError`, `NetworkLinearError`,
+* `InvalidInputLinearError`, `LinearError`) — NOT regex on `err.message` and
+* NOT `errors[].extensions.code`. Phase 1's two regex-based message-substring
+* classifiers (formerly in issue-list-runtime + workspace-runtime) are
+* retired in Plan 02-01 Task 3; this module is the canonical replacement.
+*
+* Default backoff policy (RAT-01):
+*   - Rate-limit: base 250ms doubling (250 → 500 → 1000) with full jitter,
+*     OR `err.retryAfter * 1000` capped at `4 × base`. 3 attempts.
+*   - Network:    base 100ms doubling (100 → 200 → 400) with full jitter.
+*                 3 attempts.
+*   - Auth/Validation/Other: NO retry — surfaced immediately.
+*
+* Test seams: callers may inject `opts.sleep` and `opts.random` to make
+* timing deterministic in unit tests. The `retryOptsOverride?: RetryOpts`
+* field on per-runtime input interfaces (issue-list-runtime, etc.) is the
+* test-only entry point — production call sites pass nothing.
+*/
+const DEFAULTS = {
+	maxAttempts: 3,
+	rateLimitBaseMs: 250,
+	networkBaseMs: 100,
+	sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+	random: () => Math.random()
+};
+const RATELIMIT_DEFAULT_RETRY_MS = 3e4;
+function resolveOpts(opts) {
+	const resolved = {
+		maxAttempts: (opts?.maxAttempts ?? DEFAULTS.maxAttempts) + Math.max(0, opts?.extraAttempts ?? 0),
+		rateLimitBaseMs: opts?.rateLimitBaseMs ?? DEFAULTS.rateLimitBaseMs,
+		networkBaseMs: opts?.networkBaseMs ?? DEFAULTS.networkBaseMs,
+		sleep: opts?.sleep ?? DEFAULTS.sleep,
+		random: opts?.random ?? DEFAULTS.random
+	};
+	if (opts?.onRetry !== void 0) resolved.onRetry = opts.onRetry;
+	return resolved;
+}
+/**
+* Wrap a thunk that performs an SDK call so it transparently retries on
+* rate-limit and network errors and classifies any thrown error into a
+* `LinearAgentError` before re-throwing.
+*
+* Successful inner calls return their value unchanged.
+*
+* Errors thrown by the inner call are funneled through `classifySdkError`
+* after the retry loop exhausts (or immediately for non-retryable cases).
+* If the inner call throws a `LinearAgentError` directly, it passes through
+* unchanged (idempotent — no double-wrapping).
+*/
+async function withRateLimitRetry(call, opts) {
+	const o = resolveOpts(opts);
+	if (o.maxAttempts < 1) throw LinearAgentError.usage(`withRateLimitRetry: maxAttempts must be >= 1 (got ${o.maxAttempts})`);
+	let attempt = 0;
+	let lastErr;
+	while (attempt < o.maxAttempts) try {
+		return await call();
+	} catch (err) {
+		lastErr = err;
+		if (err instanceof RatelimitedLinearError) {
+			if (attempt === o.maxAttempts - 1) break;
+			const base = o.rateLimitBaseMs * 2 ** attempt;
+			const hint = err.retryAfter !== void 0 ? err.retryAfter * 1e3 : void 0;
+			const sleepMs = hint !== void 0 ? Math.max(Math.min(hint, base * 4), base) : base + o.random() * base;
+			o.onRetry?.({
+				attempt: attempt + 1,
+				total: o.maxAttempts,
+				code: "RATELIMITED",
+				backoffMs: Math.round(sleepMs)
+			});
+			await o.sleep(sleepMs);
+			attempt++;
+			continue;
+		}
+		if (err instanceof NetworkLinearError) {
+			if (attempt === o.maxAttempts - 1) break;
+			const base = o.networkBaseMs * 2 ** attempt;
+			const sleepMs = base + o.random() * base;
+			o.onRetry?.({
+				attempt: attempt + 1,
+				total: o.maxAttempts,
+				code: "NETWORK_ERROR",
+				backoffMs: Math.round(sleepMs)
+			});
+			await o.sleep(sleepMs);
+			attempt++;
+			continue;
+		}
+		break;
+	}
+	const classified = classifySdkError(lastErr);
+	if (lastErr instanceof LinearAgentError && classified === lastErr) throw classified;
+	if (!(opts?.extraAttempts !== void 0 && opts.extraAttempts > 0 || opts?.onRetry !== void 0)) throw classified;
+	throw withAttempts(classified, attempt + 1);
+}
+/**
+* Return a `LinearAgentError` byte-identical to `err` except for an added
+* `details.attempts: count` key. Used to tag final-exhaustion attempt
+* counts without mutating `LinearAgentError`'s readonly `details`.
+*/
+function withAttempts(err, count) {
+	const mergedDetails = {
+		...err.details ?? {},
+		attempts: count
+	};
+	const init = {
+		code: err.code,
+		message: err.message,
+		transient: err.transient,
+		details: mergedDetails
+	};
+	if (err.retryAfterMs !== void 0) init.retryAfterMs = err.retryAfterMs;
+	return new LinearAgentError(init);
+}
+/**
+* Classify any thrown SDK error into the canonical `LinearAgentError`
+* taxonomy. Idempotent: a `LinearAgentError` argument passes through
+* unchanged.
+*
+* Discrimination uses `instanceof` on `@linear/sdk` typed error classes —
+* NOT message regex, NOT `errors[].extensions.code`. The SDK already does
+* that work for us in `parseLinearError`.
+*/
+function classifySdkError(err) {
+	if (err instanceof LinearAgentError) return err;
+	if (err instanceof RatelimitedLinearError) {
+		const retryAfterMs = err.retryAfter !== void 0 ? err.retryAfter * 1e3 : RATELIMIT_DEFAULT_RETRY_MS;
+		const details = {};
+		if (err.complexityRemaining !== void 0) details.complexityRemaining = err.complexityRemaining;
+		if (err.complexityLimit !== void 0) details.complexityLimit = err.complexityLimit;
+		if (err.complexityResetAt !== void 0) details.complexityResetAt = err.complexityResetAt;
+		return LinearAgentError.rateLimited(retryAfterMs, Object.keys(details).length > 0 ? details : void 0);
+	}
+	if (err instanceof NetworkLinearError) return LinearAgentError.network("network error during Linear API call");
+	if (err instanceof AuthenticationLinearError) return LinearAgentError.auth.invalid("token rejected by Linear");
+	if (err instanceof InvalidInputLinearError) {
+		const msg = err instanceof Error ? err.message : String(err);
+		return LinearAgentError.validation.failed("Linear rejected the request payload", { cause: msg });
+	}
+	if (err instanceof LinearError) {
+		const msg = err instanceof Error ? err.message : String(err);
+		return LinearAgentError.linear.apiError({
+			message: "Linear API call failed",
+			details: { cause: msg }
+		});
+	}
+	const msg = err instanceof Error ? err.message : String(err);
+	return LinearAgentError.linear.apiError({
+		message: "Linear API call failed",
+		details: { cause: msg }
+	});
+}
+//#endregion
+export { classifySdkError, withRateLimitRetry };

package/dist/core/workspace/resolver.js

@@ -0,0 +1,70 @@
+import { LinearAgentError } from "../errors/error.js";
+//#region src/core/workspace/resolver.ts
+/**
+* Pure resolver that translates `(flags, env, config)` into a single
+* `ResolvedWorkspace`. Implements the 6-step precedence chain from
+* `01-CONTEXT.md § Workspace Resolution Precedence`:
+*
+*   1. `flags.workspace`          (--workspace flag)
+*   2. `env.LINEAR_WORKSPACE`     (LINEAR_WORKSPACE env var)
+*   3. `config.active`            (active default in config)
+*   4. single-workspace short-circuit (only one entry in config.workspaces)
+*   5. `env.LINEAR_API_KEY`       (env-key bypass — no config consulted)
+*   6. throw `WORKSPACE_NOT_RESOLVED` (no input matched)
+*
+* Steps 1–3 also throw `WORKSPACE_NOT_FOUND` when the requested name is not
+* registered. This is critical for tenancy isolation (PITFALLS § Pitfall 2):
+* `--workspace ghost` MUST fail loudly rather than silently fall through to
+* the active default.
+*
+* Purity guarantees:
+*   - No `process.env` reads (caller passes `env`)
+*   - No filesystem I/O (caller passes `config`)
+*   - No mutation of any input field (read-only walk)
+*   - Same input -> deeply-equal output, every time
+*/
+function resolveWorkspace(input) {
+	const { flags, env, config } = input;
+	if (flags.workspace) return loadOrThrow(config, flags.workspace, "flag");
+	if (env.LINEAR_WORKSPACE) return loadOrThrow(config, env.LINEAR_WORKSPACE, "env");
+	if (config.active) return loadOrThrow(config, config.active, "active");
+	const names = Object.keys(config.workspaces);
+	if (names.length === 1) {
+		const sole = names[0];
+		if (sole !== void 0) return loadOrThrow(config, sole, "single");
+	}
+	if (env.LINEAR_API_KEY) return {
+		name: null,
+		token: env.LINEAR_API_KEY,
+		organizationId: null,
+		source: "api-key-env"
+	};
+	throw new LinearAgentError({
+		code: "WORKSPACE_NOT_RESOLVED",
+		message: "no workspace selected: pass --workspace <name>, set LINEAR_WORKSPACE, or run `linmux workspace use <name>`",
+		details: {
+			configuredWorkspaces: names,
+			remediation: names.length === 0 ? "run `linmux workspace add <name> --token <api-key>` to register a workspace" : "run `linmux workspace use <name>` to set an active default, or pass --workspace <name>"
+		}
+	});
+}
+function loadOrThrow(config, name, source) {
+	const entry = config.workspaces[name];
+	if (!entry) throw new LinearAgentError({
+		code: "WORKSPACE_NOT_FOUND",
+		message: `workspace not found: ${name}`,
+		details: {
+			requested: name,
+			configured: Object.keys(config.workspaces),
+			source
+		}
+	});
+	return {
+		name: entry.name,
+		token: entry.token,
+		organizationId: entry.organizationId,
+		source
+	};
+}
+//#endregion
+export { resolveWorkspace };

package/dist/core/workspace/write-guard.js

@@ -0,0 +1,43 @@
+import { LinearAgentError } from "../errors/error.js";
+//#region src/core/workspace/write-guard.ts
+/**
+* WSP-06 enforcement for write commands (mutations).
+*
+* A write command requires an *explicit* workspace selector to prevent
+* cross-workspace data leakage (PITFALLS § Pitfall 2 — the #1 tenancy risk).
+* Of the five `WorkspaceSource` values, three are considered explicit:
+*
+*   - `flag`        — caller passed `--workspace <name>` for THIS invocation
+*   - `env`         — caller set `LINEAR_WORKSPACE` in the env for THIS invocation
+*   - `api-key-env` — `LINEAR_API_KEY` is the selector itself; there is no
+*                     ambiguity about which workspace the token targets, and
+*                     setting it is an explicit per-invocation act
+*
+* The other two are NOT explicit:
+*
+*   - `active` — silently inherits the user's persisted active default
+*   - `single` — auto-picks the only registered workspace (still implicit)
+*
+* For `active` and `single`, this guard throws `WORKSPACE_REQUIRED_FOR_WRITE`
+* BEFORE any SDK call is made — unless the caller passes
+* `allowActiveOptIn=true` (mapped from the per-invocation
+* `--allow-active-workspace-write` flag).
+*
+* The opt-in is per-invocation only. There is no persisted config flag that
+* relaxes this rule globally.
+*/
+function requireExplicitWorkspaceForWrite(resolved, allowActiveOptIn) {
+	if (allowActiveOptIn) return;
+	if (resolved.source === "flag" || resolved.source === "env" || resolved.source === "api-key-env") return;
+	throw new LinearAgentError({
+		code: "WORKSPACE_REQUIRED_FOR_WRITE",
+		message: "write commands require an explicit workspace selector: pass --workspace <name>, set LINEAR_WORKSPACE, or pass --allow-active-workspace-write to opt in to using the active default for this invocation",
+		details: {
+			resolvedWorkspace: resolved.name,
+			resolvedFrom: resolved.source,
+			remediation: "pass --workspace <name>, set LINEAR_WORKSPACE=<name>, or pass --allow-active-workspace-write"
+		}
+	});
+}
+//#endregion
+export { requireExplicitWorkspaceForWrite };