runline 0.30.0 → 0.31.0

package/dist/plugins/gett/src/rides.js

@@ -0,0 +1,144 @@
+import { createHash, randomUUID } from "node:crypto";
+import { flat, resolve, stop } from "./places.js";
+import { createSession } from "./session.js";
+import { accepted, arr, authed, cfgOf, numOrNull, obj, pick, } from "./shared.js";
+function rideClassOf(raw) {
+    const entry = obj(raw);
+    const klass = obj(entry.class);
+    const option = obj(arr(obj(entry.price).pricing_options)[0]);
+    return {
+        class_uuid: pick(klass.uuid),
+        name: pick(klass.name),
+        category: pick(klass.category),
+        subcategory: pick(klass.subcategory) ?? "default",
+        estimation_id: pick(option.estimation_id),
+        display_price: pick(option.user_price, option.full_price),
+        currency: pick(option.currency_iso),
+        eta: numOrNull(klass.display_eta ?? klass.eta),
+    };
+}
+async function preorder(ctx, stops) {
+    const cfg = cfgOf(ctx);
+    const r = await authed(ctx, "/gl/api/v1/preorder/aggregated", {
+        method: "POST",
+        body: {
+            stops,
+            phone: cfg.phone,
+            country_code: "IL",
+            category: "transportation",
+            payment_type: "credit_card",
+            source: "mobile",
+        },
+    });
+    const classes = arr(r.classes_with_prices).map(rideClassOf);
+    return {
+        classes,
+        route_id: pick(obj(arr(r.routes)[0]).uuid),
+        default_class: pick(r.private_default_class_uuid) ?? classes[0]?.class_uuid ?? null,
+    };
+}
+/**
+ * Resolve both ends, price every class, and pick one. Every pricing read and
+ * every booking goes through here, so a preview and its confirmation are priced
+ * by identical code.
+ */
+export async function plan(ctx, from, to, lat, lon, classUuid) {
+    await createSession(ctx, lat, lon);
+    const [origin, destination] = await Promise.all([
+        resolve(ctx, from, lat, lon),
+        resolve(ctx, to, lat, lon),
+    ]);
+    const stops = [
+        stop(origin, "origin", ctx),
+        stop(destination, "destination", ctx),
+    ];
+    const pricing = await preorder(ctx, stops);
+    const chosen = classUuid
+        ? pricing.classes.find((c) => c.class_uuid === classUuid)
+        : (pricing.classes.find((c) => c.class_uuid === pricing.default_class) ??
+            pricing.classes[0]);
+    if (!chosen)
+        throw new Error(classUuid
+            ? `gett: ride class ${classUuid} is not available for this route`
+            : "gett: no ride class available for this route");
+    return {
+        from: origin,
+        to: destination,
+        stops,
+        route_id: pricing.route_id,
+        classes: pricing.classes,
+        chosen,
+    };
+}
+/**
+ * A fingerprint of everything a person agrees to when they say yes: both
+ * endpoints, the ride class, and the fare. Re-derived on the confirming call,
+ * so a fare that moved in between cannot be booked against the old consent.
+ */
+export function quoteFor(ride) {
+    const material = JSON.stringify([
+        ride.from.place_id ?? ride.from.name ?? "",
+        ride.to.place_id ?? ride.to.name ?? "",
+        ride.chosen.class_uuid ?? "",
+        ride.chosen.display_price ?? "",
+        ride.chosen.currency ?? "",
+    ]);
+    return `q_${createHash("sha256").update(material).digest("hex").slice(0, 16)}`;
+}
+export function previewOf(ride) {
+    return {
+        from: { name: ride.from.name, address: ride.from.full_address },
+        to: { name: ride.to.name, address: ride.to.full_address },
+        ride_class: ride.chosen.name,
+        price: ride.chosen.display_price,
+        currency: ride.chosen.currency,
+        eta_to_pickup: ride.chosen.eta,
+        class_uuid: ride.chosen.class_uuid,
+    };
+}
+export function optionsOf(ride) {
+    return ride.classes.map((c) => ({
+        ride_class: c.name,
+        price: c.display_price,
+        currency: c.currency,
+        eta: c.eta,
+        class_uuid: c.class_uuid,
+    }));
+}
+export async function book(ctx, ride, note) {
+    const cfg = cfgOf(ctx);
+    if (!cfg.creditCardId)
+        throw new Error("gett: no saved card (creditCardId) — re-run the owner login to discover it");
+    const body = {
+        stops: ride.stops,
+        division_name: ride.chosen.name || "Taxi",
+        route_id: ride.route_id,
+        route_provider: "google",
+        ofse_order_flow: false,
+        origin: flat(ride.from),
+        destination: flat(ride.to),
+        note_to_driver: note ?? "",
+        business: 0,
+        token: randomUUID(),
+        app_provider: "gettaxi",
+        user_current_time: Math.floor(Date.now() / 1000),
+        credit_card_id: cfg.creditCardId,
+        payment_type: "credit_card",
+        ordered_from: "Phone",
+        division_uuid: ride.chosen.class_uuid,
+        category: ride.chosen.category ?? "transportation",
+        subcategory: ride.chosen.subcategory,
+        fix_charge_opt_out: true,
+        estimation_id: ride.chosen.estimation_id,
+        show_class_pricing_info: false,
+        timezone_id: "Asia/Jerusalem",
+    };
+    const r = await authed(ctx, "/il/global-ride-request/api/v1/create", {
+        method: "POST",
+        body,
+    });
+    return {
+        ok: accepted(r),
+        order_id: pick(obj(r.order).id, r.order_id),
+    };
+}

package/dist/plugins/gett/src/session.js

@@ -0,0 +1,242 @@
+import { APP_VERSION, accepted, arr, authed, cfgOf, DEF_LAT, DEF_LON, ensureDevice, expiresAt, http, normPhone, num, numOrNull, obj, pick, seg, } from "./shared.js";
+export async function requestCode(ctx, phone) {
+    await ensureDevice(ctx);
+    let cfg = cfgOf(ctx);
+    if (phone) {
+        await ctx.updateConnection({ phone: normPhone(phone) });
+        cfg = cfgOf(ctx);
+    }
+    if (!cfg.phone)
+        throw new Error("gett: no phone — pass { phone } (e.g. 972500000000) or set GETT_PHONE");
+    const body = {
+        country_code: "IL",
+        country_phone_prefix: 972,
+        registration_origin: "organic",
+        method: "sms",
+        client_device_unique_id: cfg.clientDeviceUniqueId,
+        device_tag: "android_ww",
+        appsflyer_uid: `${Date.now()}-${Math.floor(Math.random() * 1e18)}`,
+        gaid: "",
+    };
+    const r = await http(ctx, `/gl/api/v2/phone/${seg(cfg.phone, "phone")}/auth/otp/challenge`, { method: "POST", body });
+    // Gett answers 200 even when it refuses to send, so a refusal is reported
+    // rather than an SMS claimed that will never arrive.
+    const status = pick(r.status);
+    if (!accepted(r)) {
+        const mins = numOrNull(r.blocked_until);
+        return {
+            sent: false,
+            blocked: status === "blocked",
+            phone: cfg.phone,
+            status,
+            retry_after_minutes: mins,
+            note: status === "blocked"
+                ? `Too many attempts — Gett blocked new codes${mins ? ` for ~${mins} min` : ""}. Wait, then call account.requestCode again.`
+                : "No SMS was sent. Check the phone digits, then call account.requestCode again.",
+        };
+    }
+    return {
+        sent: true,
+        phone: cfg.phone,
+        code_length: num(r.confirmation_code_length, 6),
+        next: "account.verifyCode({ code })",
+    };
+}
+/** Tokens arrive either at the top level or nested under `tokens`. */
+function tokensIn(r) {
+    const nested = obj(r.tokens);
+    if (pick(nested.refresh_token))
+        return nested;
+    if (pick(r.refresh_token))
+        return r;
+    return null;
+}
+export async function verifyCode(ctx, code) {
+    const cfg = cfgOf(ctx);
+    if (!cfg.phone)
+        throw new Error("gett: no phone — call account.requestCode first");
+    const r = await http(ctx, `/gl/api/v2/phone/${seg(cfg.phone, "phone")}/auth/otp/verify`, { method: "POST", body: { code } });
+    const toks = tokensIn(r);
+    if (toks) {
+        const warnings = await finishTokens(ctx, toks);
+        // `connected` is read back from what was persisted, not asserted here.
+        return { mfa_required: false, warnings, ...(await status(ctx)) };
+    }
+    const mfa = r.mfa_required === true || pick(r.status) === "mfa_required";
+    // An auth response can carry tokens; report its shape, never its contents.
+    if (!mfa)
+        throw new Error(`gett: otp/verify returned neither tokens nor an MFA challenge (fields: ${Object.keys(r).sort().join(", ") || "none"})`);
+    await ctx.updateConnection({
+        pendingTempCode: pick(r.temp_code) ?? undefined,
+    });
+    return {
+        connected: false,
+        mfa_required: true,
+        challenge: pick(r.mfa_challenge),
+        methods: arr(r.mfa_methods).filter((m) => typeof m === "string"),
+        masked_email: pick(r.mfa_masked_email),
+        next: "account.verifyCard({ card })",
+    };
+}
+export async function verifyCard(ctx, digits) {
+    const cfg = cfgOf(ctx);
+    if (!cfg.pendingTempCode)
+        throw new Error("gett: no pending MFA — call account.verifyCode first");
+    const r = await http(ctx, `/gl/api/v2/phone/${seg(cfg.phone, "phone")}/auth/mfa/verify`, {
+        method: "POST",
+        body: { temp_code: cfg.pendingTempCode, card_digits: digits },
+    });
+    const toks = tokensIn(r);
+    if (!toks) {
+        const reported = pick(r.status);
+        throw new Error(`gett: mfa/verify did not return tokens${reported ? ` (status: ${reported})` : ""} — check the card digits and retry`);
+    }
+    await ctx.updateConnection({ pendingTempCode: undefined });
+    const warnings = await finishTokens(ctx, toks);
+    return { warnings, ...(await status(ctx)) };
+}
+/**
+ * Store the IL-scoped tokens, convert to the GL family the app uses for ongoing
+ * refresh, then learn identity and the saved card.
+ *
+ * The conversion and the discovery are both optional: an IL token still serves
+ * reads, and a missing card only blocks booking. Neither failure is allowed to
+ * lose a login that otherwise succeeded, so both are reported as warnings rather
+ * than swallowed or thrown.
+ */
+async function finishTokens(ctx, toks) {
+    const warnings = [];
+    await ctx.updateConnection({
+        refreshToken: pick(toks.refresh_token),
+        accessToken: pick(toks.access_token),
+        accessTokenExpiresAt: expiresAt(toks.expires_in),
+    });
+    const cfg = cfgOf(ctx);
+    try {
+        // `?lc=en` is required here too: the conversion 400s without it even with a
+        // valid IL bearer.
+        const gl = await http(ctx, `/gl/api/v2/phone/${seg(cfg.phone, "phone")}/auth/token?lc=en`, {
+            method: "POST",
+            token: cfg.accessToken,
+            body: { grant_type: "refresh_token", refresh_token: cfg.refreshToken },
+        });
+        const patch = {};
+        const rotated = pick(gl.refresh_token);
+        const issued = pick(gl.access_token);
+        if (rotated)
+            patch.refreshToken = rotated;
+        if (issued) {
+            patch.accessToken = issued;
+            patch.accessTokenExpiresAt = expiresAt(gl.expires_in);
+        }
+        if (Object.keys(patch).length)
+            await ctx.updateConnection(patch);
+    }
+    catch (e) {
+        warnings.push(`IL->GL token conversion failed (${e.message}); reads work, but the session may need an earlier re-login.`);
+    }
+    try {
+        await createSession(ctx, DEF_LAT, DEF_LON);
+    }
+    catch (e) {
+        warnings.push(`identity and saved-card discovery failed (${e.message}); booking needs creditCardId, so re-run account.get.`);
+    }
+    return warnings;
+}
+/** The default saved card, out of a create_session response. */
+function discoverCard(session) {
+    for (const entry of arr(obj(obj(session.payment_methods).data).list)) {
+        for (const pm of arr(obj(entry).payment_methods)) {
+            const cards = arr(obj(obj(obj(pm).additional_data).credit_card).cards);
+            const preferred = cards.find((c) => obj(c).is_default === true) ?? cards[0];
+            const id = pick(obj(preferred).card_id);
+            if (id)
+                return id;
+        }
+    }
+    return null;
+}
+/** Local view of the connection. No network, so it works on a broken session. */
+export async function status(ctx) {
+    const cfg = cfgOf(ctx);
+    const missing = [];
+    if (!cfg.phone)
+        missing.push("phone");
+    if (!cfg.refreshToken)
+        missing.push("refreshToken (owner login)");
+    if (!cfg.creditCardId)
+        missing.push("creditCardId (auto-discovered on login)");
+    return {
+        connected: !!cfg.refreshToken,
+        phone: cfg.phone ?? null,
+        name: cfg.name ?? null,
+        globalUserId: cfg.globalUserId ?? null,
+        creditCard: cfg.creditCardId ?? null,
+        pendingMfa: !!cfg.pendingTempCode,
+        orderingEnabled: cfg.allowOrdering === true,
+        missing,
+        // The GL refresh token is long-lived (~90d) and its grant does not need a live
+        // access token, so a stored session survives unattended: no keepalive schedule.
+        keepalive: null,
+    };
+}
+/**
+ * The app's session bootstrap. Also the only place identity and the saved card
+ * are learned, so pricing and booking call it before they need either.
+ */
+export async function createSession(ctx, lat, lon) {
+    const cfg = cfgOf(ctx);
+    const body = {
+        dt: "Android, runline",
+        av: APP_VERSION,
+        os: "16",
+        device_generated_token: cfg.deviceGeneratedToken,
+        client_device_unique_id: cfg.clientDeviceUniqueId,
+        gcm: 1,
+        np: 0,
+        lc: "en",
+        cc: "IL",
+        ai: "com.gettaxi.android",
+        lat: num(lat, DEF_LAT),
+        lon: num(lon, DEF_LON),
+        app_provider: "gettaxi",
+        platform: "android",
+        gaid: cfg.gaid,
+    };
+    const r = await authed(ctx, `/gl/rider-facade/phone/${seg(cfg.phone, "phone")}/create_session`, { method: "POST", body });
+    const profile = obj(r.user_profile);
+    const patch = {};
+    const globalUserId = pick(profile.global_user_id);
+    const name = pick(profile.first_name);
+    if (globalUserId && !cfg.globalUserId)
+        patch.globalUserId = globalUserId;
+    if (name && !cfg.name)
+        patch.name = name;
+    if (!cfg.creditCardId) {
+        const card = discoverCard(r);
+        if (card)
+            patch.creditCardId = card;
+    }
+    if (Object.keys(patch).length)
+        await ctx.updateConnection(patch);
+    return r;
+}
+export function identityOf(ctx, session) {
+    const cfg = cfgOf(ctx);
+    const profile = obj(session.user_profile);
+    return {
+        global_user_id: pick(profile.global_user_id, cfg.globalUserId),
+        name: pick(profile.first_name, cfg.name),
+        phone: cfg.phone ?? null,
+    };
+}
+/** The rider block Gett expects inside every stop. */
+export function rider(ctx) {
+    const cfg = cfgOf(ctx);
+    return {
+        global_id: num(cfg.globalUserId, 0),
+        name: cfg.name || "",
+        phone: cfg.phone,
+        vip: { is_vip: false, level: 0 },
+    };
+}

package/dist/plugins/gett/src/shared.js

@@ -0,0 +1,180 @@
+import { randomUUID } from "node:crypto";
+import { authedFetch } from "../../_shared/authedFetch.js";
+import { arr, num, numOrNull, obj, pick, readBounded, seg as segment, } from "../../_shared/provider.js";
+import { coordinatedAccessToken } from "../../_shared/tokenRefresh.js";
+export { arr, num, numOrNull, obj, pick };
+/**
+ * Transport and credentials for the Gett consumer surface.
+ *
+ * One host, one bearer, one refresh grant. Everything above this file works in
+ * terms of `http`/`authed` and never reaches the network itself.
+ */
+const HOST = "b2cgateway.gett.com";
+const UA = "Gett/android/10.48.187";
+export const APP_VERSION = "10.48.187";
+/** Dizengoff Sq, TLV — a location that always has supply, used when none is given. */
+export const DEF_LAT = 32.0779;
+export const DEF_LON = 34.7743;
+const MAX_RESPONSE_BYTES = 4 * 1024 * 1024;
+const DEFAULT_TOKEN_TTL_MS = 3_600_000;
+export const cfgOf = (ctx) => (ctx.connection.config || {});
+/**
+ * Whether a 2xx body reports success.
+ *
+ * Gett signals refusal inside the body on some endpoints (`rc`) and in a status
+ * string on others, and answers 200 either way. An explicit `rc` decides; failing
+ * that an explicit status decides; a body carrying neither is an acceptance,
+ * because `http` has already rejected every non-2xx. Erring the other way would
+ * report a booked ride as unbooked, and the caller would order a second car.
+ */
+export function accepted(body) {
+    const rc = numOrNull(body.rc);
+    if (rc !== null)
+        return rc === 0;
+    const status = pick(body.status);
+    if (status !== null)
+        return status === "success";
+    return true;
+}
+/**
+ * Normalize a phone to Gett's expected international digits (E.164 without '+'),
+ * so a number typed the local Israeli way still routes the SMS. Gett pairs the
+ * path number with country_phone_prefix:972, so a national "0500000000" (or
+ * "050-000-0000") must become "972500000000" — otherwise the challenge returns
+ * success but the SMS is silently dropped. Idempotent.
+ */
+export function normPhone(input) {
+    let digits = String(input).replace(/[^\d]/g, "");
+    if (digits.startsWith("00"))
+        digits = digits.slice(2); // intl exit code
+    if (digits.startsWith("972"))
+        return digits;
+    if (digits.startsWith("0"))
+        return `972${digits.slice(1)}`;
+    return `972${digits}`;
+}
+export const seg = (value, what) => segment(value, what, "gett");
+// ---------- HTTP ----------
+/** Carries the status for control flow without putting a provider body in the message. */
+class GettError extends Error {
+    status;
+    constructor(status, endpoint) {
+        super(`gett: request failed (HTTP ${status}) on ${endpoint}`);
+        this.name = "GettError";
+        this.status = status;
+    }
+}
+/** The account's phone is in nearly every path; it never belongs in an error. */
+function endpointOf(path) {
+    return path.split("?")[0].replace(/\/phone\/[^/]+/, "/phone/{phone}");
+}
+export async function http(ctx, path, opts = {}) {
+    const cfg = cfgOf(ctx);
+    const { method = "GET", body = null, token = null } = opts;
+    const payload = body == null ? null : JSON.stringify(body);
+    const headers = {
+        accept: "application/json",
+        "user-agent": UA,
+        "app-platform": "android",
+        "app-version": APP_VERSION,
+        "x-device-id": cfg.deviceId || "",
+        "x-client-device-unique-id": cfg.clientDeviceUniqueId || "",
+        "x-country-code": "IL",
+    };
+    if (token)
+        headers.authorization = `Bearer ${token}`;
+    if (payload)
+        headers["content-type"] = "application/json; charset=UTF-8";
+    const endpoint = endpointOf(path);
+    const res = await authedFetch(`https://${HOST}${path}`, {
+        method,
+        headers,
+        body: payload,
+    });
+    const text = await readBounded(res, MAX_RESPONSE_BYTES, `gett: response exceeded the size limit on ${endpoint}`);
+    let parsed = null;
+    try {
+        parsed = text ? JSON.parse(text) : null;
+    }
+    catch {
+        /* non-JSON body */
+    }
+    // The body can hold tokens, the OTP, or the account holder's details; the
+    // status and the redacted endpoint are what a caller can act on.
+    if (!res.ok)
+        throw new GettError(res.status, endpoint);
+    return obj(parsed);
+}
+/**
+ * Device identity, generated once and then persisted. Gett ties a trusted device
+ * to these, so regenerating them would re-trigger the card factor on every login.
+ */
+export async function ensureDevice(ctx) {
+    const cfg = cfgOf(ctx);
+    const patch = {};
+    if (!cfg.deviceId)
+        patch.deviceId = randomUUID();
+    if (!cfg.clientDeviceUniqueId)
+        patch.clientDeviceUniqueId = randomUUID();
+    if (!cfg.deviceGeneratedToken)
+        patch.deviceGeneratedToken = randomUUID();
+    if (!cfg.gaid)
+        patch.gaid = randomUUID();
+    if (Object.keys(patch).length)
+        await ctx.updateConnection(patch);
+}
+// ---------- credentials ----------
+export function expiresAt(expiresIn) {
+    const seconds = numOrNull(expiresIn);
+    return Date.now() + (seconds ? seconds * 1000 : DEFAULT_TOKEN_TTL_MS);
+}
+/**
+ * The refresh grant itself.
+ *
+ * `?lc=en` is REQUIRED on every /auth/token call: the app sends it and the server
+ * 400s with an empty body without it. Access-token TTL is irrelevant to the grant
+ * (a bearer expired by days still refreshes), so a genuine 400 here means the
+ * refresh token itself is dead and a fresh owner login is required.
+ *
+ * Called only from inside an update owner, and always with an explicit token, so
+ * it can never re-enter the connection store.
+ */
+async function refreshGrant(ctx, cfg) {
+    try {
+        return await http(ctx, `/gl/api/v2/phone/${seg(cfg.phone, "phone")}/auth/token?lc=en`, {
+            method: "POST",
+            token: cfg.accessToken || cfg.refreshToken,
+            body: { grant_type: "refresh_token", refresh_token: cfg.refreshToken },
+        });
+    }
+    catch (e) {
+        if (e instanceof GettError && e.status === 400) {
+            throw new Error("gett: session expired (refresh rejected) — re-run the owner login: account.requestCode -> account.verifyCode -> account.verifyCard");
+        }
+        throw e;
+    }
+}
+export async function accessToken(ctx, force = false) {
+    const cfg = cfgOf(ctx);
+    if (!cfg.refreshToken)
+        throw new Error("gett: not connected — run account.requestCode({ phone }) -> account.verifyCode({ code }) -> account.verifyCard({ card })");
+    if (!cfg.phone)
+        throw new Error("gett: no phone configured");
+    // Renewal runs under the store's update ownership, so parallel actions
+    // coalesce onto one grant instead of clobbering each other's rotated token.
+    return coordinatedAccessToken(ctx, async (current) => {
+        const resp = await refreshGrant(ctx, current);
+        const issued = pick(resp.access_token);
+        if (!issued)
+            throw new Error("gett: token refresh returned no access_token");
+        const rotated = pick(resp.refresh_token);
+        return {
+            accessToken: issued,
+            accessTokenExpiresAt: expiresAt(resp.expires_in),
+            ...(rotated ? { refreshToken: rotated } : {}),
+        };
+    }, force);
+}
+export async function authed(ctx, path, opts = {}) {
+    return http(ctx, path, { ...opts, token: await accessToken(ctx) });
+}

package/dist/plugins/linear/src/attachments.js

@@ -1,9 +1,9 @@
 import * as t from "typebox";
-import { ATTACHMENT_FIELDS, assertAttachmentInScope, assertIssueInScope, gql, key, requireUnscoped, } from "./shared.js";
+import { ATTACHMENT_FIELDS, assertAttachmentInScope, assertIssueInScope, gql, key, requireUnscoped, withScopedNote, } from "./shared.js";
 export function registerAttachmentActions(rl) {
     rl.registerAction("attachment.list", {
         access: "read",
-        description: "List issue attachments. Disabled for scoped Linear connections.",
+        description: withScopedNote("List issue attachments."),
         inputSchema: t.Object({ limit: t.Optional(t.Number()) }),
         async execute(input, ctx) {
             requireUnscoped(ctx, "attachment.list");

package/dist/plugins/linear/src/cycles.js

@@ -1,13 +1,13 @@
 import * as t from "typebox";
-import { bindGetAction, bindListAction, CYCLE_FIELDS, gql, key, requireUnscoped, } from "./shared.js";
+import { bindGetAction, bindListAction, CYCLE_FIELDS, gql, key, requireUnscoped, withScopedNote, } from "./shared.js";
 export function registerCycleActions(rl) {
     const listAction = bindListAction(rl);
     const getAction = bindGetAction(rl);
-    listAction("cycle.list", "List cycles. Use filter for isActive/isNext/isPrevious.", "cycles", "CycleFilter", CYCLE_FIELDS);
+    listAction("cycle.list", "List cycles. The current cycle is filter { isActive: { eq: true } }; isNext and isPrevious work the same way. Combine with issue.list to report on a cycle's work.", "cycles", "CycleFilter", CYCLE_FIELDS);
     getAction("cycle.get", "Get a cycle by ID.", "cycle", CYCLE_FIELDS);
     rl.registerAction("cycle.create", {
         access: "write",
-        description: "Create a cycle for a team.",
+        description: withScopedNote("Create a cycle for a team."),
         inputSchema: t.Object({
             teamId: t.String({ description: "The team to associate the cycle with" }),
             startsAt: t.String({
@@ -33,7 +33,7 @@ export function registerCycleActions(rl) {
     });
     rl.registerAction("cycle.update", {
         access: "write",
-        description: "Update a cycle.",
+        description: withScopedNote("Update a cycle."),
         inputSchema: t.Object({
             id: t.String({ description: "The identifier of the cycle to update" }),
             name: t.Optional(t.String({ description: "The custom name of the cycle" })),
@@ -60,7 +60,7 @@ export function registerCycleActions(rl) {
     // they are not archived with it.
     rl.registerAction("cycle.archive", {
         access: "write",
-        description: "Archive one cycle. Issues assigned to it are unlinked from the cycle first, not archived. This is the per-cycle removal; Linear has no single-cycle delete.",
+        description: withScopedNote("Archive one cycle. Issues assigned to it are unlinked from the cycle first, not archived. This is the per-cycle removal; Linear has no single-cycle delete."),
         inputSchema: t.Object({
             id: t.String({ description: "The identifier of the cycle to archive" }),
         }),
@@ -81,7 +81,7 @@ export function registerCycleActions(rl) {
     // team, and the description leads with the blast radius.
     rl.registerAction("team.cyclesDeleteAll", {
         access: "write",
-        description: "DESTRUCTIVE: delete ALL cycle data for a team and disable the cycles feature. Removes every cycle and its issue associations, not just one. To remove a single cycle use cycle.archive.",
+        description: withScopedNote("DESTRUCTIVE: delete ALL cycle data for a team and disable the cycles feature. Removes every cycle and its issue associations, not just one. To remove a single cycle use cycle.archive."),
         inputSchema: t.Object({
             teamId: t.String({
                 description: "The identifier of the TEAM whose cycles will all be deleted",

package/dist/plugins/linear/src/index.js

@@ -14,14 +14,14 @@ import { registerViewActions } from "./views.js";
 import { registerWebhookActions } from "./webhooks.js";
 export default function linear(rl) {
     rl.setName("linear");
-    rl.setVersion("0.5.0");
+    rl.setVersion("0.6.0");
     rl.setConnectionSchema(t.Object({
         apiKey: t.String({
             description: "Linear API key (https://linear.app/settings/account/security)",
             env: "LINEAR_API_KEY",
         }),
         scopeLabelIds: t.Optional(t.String({
-            description: "Comma-separated Linear issue label IDs. When set, issue/comment/attachment access is restricted to issues with one of these labels.",
+            description: "Comma-separated Linear issue label UUIDs (label names also accepted and resolved). When set, issue/comment/attachment access is restricted to issues with one of these labels; workspace metadata such as teams, states, labels, cycles and users stays readable.",
             env: "LINEAR_SCOPE_LABEL_IDS",
         })),
     }));