runline 0.8.1 → 0.10.0

package/dist/plugin/loader.js

@@ -1,6 +1,6 @@
 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, join, resolve } from "node:path";
+import { dirname, isAbsolute, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createJiti } from "jiti";
 import { findConfigDir } from "../config/loader.js";
@@ -81,6 +81,19 @@ async function loadFromDirectory(dir) {
                 join(fullPath, "src", "index.ts"),
                 join(fullPath, "src", "index.js"),
             ];
+            const pkgJson = join(fullPath, "package.json");
+            let packagePluginPaths = [];
+            if (existsSync(pkgJson)) {
+                try {
+                    const pkg = JSON.parse(readFileSync(pkgJson, "utf-8"));
+                    if (pkg.main)
+                        candidates.unshift(join(fullPath, pkg.main));
+                    packagePluginPaths = pkg.runline?.plugins ?? [];
+                }
+                catch (err) {
+                    console.error(`[runline] Failed to parse ${pkgJson}:`, err.message);
+                }
+            }
             const found = candidates.find((c) => existsSync(c));
             if (found) {
                 try {
@@ -90,22 +103,15 @@ async function loadFromDirectory(dir) {
                     console.error(`[runline] Failed to load plugin from ${found}:`, err.message);
                 }
             }
-            const pkgJson = join(fullPath, "package.json");
-            if (existsSync(pkgJson)) {
+            else if (packagePluginPaths.length === 0) {
+                console.error(`[runline] Failed to load plugin from ${fullPath}: No entry point found`);
+            }
+            for (const p of packagePluginPaths) {
                 try {
-                    const pkg = JSON.parse(readFileSync(pkgJson, "utf-8"));
-                    const pluginPaths = pkg.runline?.plugins ?? [];
-                    for (const p of pluginPaths) {
-                        try {
-                            plugins.push(await loadPluginFromPath(join(fullPath, p)));
-                        }
-                        catch (err) {
-                            console.error(`[runline] Failed to load plugin from ${join(fullPath, p)}:`, err.message);
-                        }
-                    }
+                    plugins.push(await loadPluginFromPath(join(fullPath, p)));
                 }
                 catch (err) {
-                    console.error(`[runline] Failed to parse ${pkgJson}:`, err.message);
+                    console.error(`[runline] Failed to load plugin from ${join(fullPath, p)}:`, err.message);
                 }
             }
         }
@@ -120,13 +126,21 @@ export async function loadPluginsFromConfig(configDir) {
     try {
         const data = JSON.parse(readFileSync(pluginsFile, "utf-8"));
         const entries = data.plugins ?? data;
+        if (!Array.isArray(entries)) {
+            throw new Error("Expected an array or { plugins: [...] }");
+        }
         for (const entry of entries) {
-            const p = typeof entry === "string" ? entry : entry.path;
+            const p = typeof entry === "string" ? entry : entry?.path;
+            if (typeof p !== "string" || p.length === 0) {
+                console.error(`[runline] Invalid plugin entry in ${pluginsFile}: expected string path or { path }`);
+                continue;
+            }
+            const pluginPath = isAbsolute(p) ? p : join(configDir, p);
             try {
-                plugins.push(await loadPluginFromPath(p));
+                plugins.push(await loadPluginFromPath(pluginPath));
             }
             catch (err) {
-                console.error(`[runline] Failed to load plugin from ${p}:`, err.message);
+                console.error(`[runline] Failed to load plugin from ${pluginPath}:`, err.message);
             }
         }
     }
@@ -146,32 +160,34 @@ export function defaultBuiltinDir() {
 export async function discoverPlugins(configDir, options = {}) {
     const loaded = new Set();
     const result = [];
-    function addIfNew(plugin) {
-        if (!loaded.has(plugin.name)) {
-            result.push(plugin);
-            loaded.add(plugin.name);
+    function addIfNew(plugin, source) {
+        if (loaded.has(plugin.name)) {
+            console.error(`[runline] Skipping duplicate plugin "${plugin.name}" from ${source}: a plugin with that name is already loaded`);
+            return;
         }
+        result.push(plugin);
+        loaded.add(plugin.name);
     }
     if (configDir) {
         const projectPluginsDir = join(configDir, "plugins");
         const projectPlugins = await loadFromDirectory(projectPluginsDir);
         for (const p of projectPlugins)
-            addIfNew(p);
+            addIfNew(p, projectPluginsDir);
         const configPlugins = await loadPluginsFromConfig(configDir);
         for (const p of configPlugins)
-            addIfNew(p);
+            addIfNew(p, join(configDir, "plugins.json"));
     }
     const globalDir = join(homedir(), ".runline", "plugins");
     const globalPlugins = await loadFromDirectory(globalDir);
     for (const p of globalPlugins)
-        addIfNew(p);
+        addIfNew(p, globalDir);
     const builtinDir = options.builtinDir ?? defaultBuiltinDir();
     const builtinPlugins = await loadFromDirectory(builtinDir);
     for (const p of builtinPlugins) {
         if (options.builtinAllowlist && !options.builtinAllowlist.has(p.name)) {
             continue;
         }
-        addIfNew(p);
+        addIfNew(p, builtinDir);
     }
     return result;
 }

package/dist/plugins/linear/src/attachments.js

@@ -1,10 +1,26 @@
 import * as t from "typebox";
-import { ATTACHMENT_FIELDS, bindGetAction, bindListAction, gql, key } from "./shared.js";
+import { ATTACHMENT_FIELDS, assertAttachmentInScope, assertIssueInScope, gql, key, requireUnscoped } from "./shared.js";
 export function registerAttachmentActions(rl) {
-    const listAction = bindListAction(rl);
-    const getAction = bindGetAction(rl);
-    listAction("attachment.list", "List issue attachments.", "attachments", "AttachmentFilter", ATTACHMENT_FIELDS);
-    getAction("attachment.get", "Get an attachment by ID.", "attachment", ATTACHMENT_FIELDS);
+    rl.registerAction("attachment.list", {
+        description: "List issue attachments. Disabled for scoped Linear connections.",
+        inputSchema: t.Object({ limit: t.Optional(t.Number()) }),
+        async execute(input, ctx) {
+            requireUnscoped(ctx, "attachment.list");
+            const limit = input?.limit ?? 50;
+            const data = await gql(key(ctx), `query($first: Int) { attachments(first: $first) { nodes { ${ATTACHMENT_FIELDS} } pageInfo { hasNextPage endCursor } } }`, { first: limit });
+            return data.attachments;
+        },
+    });
+    rl.registerAction("attachment.get", {
+        description: "Get an attachment by ID.",
+        inputSchema: t.Object({ id: t.String() }),
+        async execute(input, ctx) {
+            const id = input.id;
+            await assertAttachmentInScope(ctx, id);
+            const data = await gql(key(ctx), `query($id: String!) { attachment(id: $id) { ${ATTACHMENT_FIELDS} } }`, { id });
+            return data.attachment;
+        },
+    });
     rl.registerAction("attachment.create", {
         description: "Create an attachment on an issue.",
         inputSchema: t.Object({
@@ -19,7 +35,9 @@ export function registerAttachmentActions(rl) {
             id: t.Optional(t.String({ description: "The identifier in UUID v4 format. If none is provided, the backend will generate one" })),
         }),
         async execute(input, ctx) {
-            const data = await gql(key(ctx), `mutation($input: AttachmentCreateInput!) { attachmentCreate(input: $input) { success attachment { ${ATTACHMENT_FIELDS} } } }`, { input: input });
+            const fields = input;
+            await assertIssueInScope(ctx, String(fields.issueId));
+            const data = await gql(key(ctx), `mutation($input: AttachmentCreateInput!) { attachmentCreate(input: $input) { success attachment { ${ATTACHMENT_FIELDS} } } }`, { input: fields });
             return data.attachmentCreate?.attachment;
         },
     });
@@ -34,6 +52,7 @@ export function registerAttachmentActions(rl) {
         }),
         async execute(input, ctx) {
             const { id, ...fields } = input;
+            await assertAttachmentInScope(ctx, String(id));
             const data = await gql(key(ctx), `mutation($id: String!, $input: AttachmentUpdateInput!) { attachmentUpdate(id: $id, input: $input) { success attachment { ${ATTACHMENT_FIELDS} } } }`, { id, input: fields });
             return data.attachmentUpdate?.attachment;
         },
@@ -48,6 +67,7 @@ export function registerAttachmentActions(rl) {
         }),
         async execute(input, ctx) {
             const { issueId, url, title, id } = input;
+            await assertIssueInScope(ctx, String(issueId));
             const data = await gql(key(ctx), `mutation($issueId: String!, $url: String!, $title: String, $id: String) {
           attachmentLinkURL(issueId: $issueId, url: $url, title: $title, id: $id) { success attachment { ${ATTACHMENT_FIELDS} } }
         }`, { issueId, url, title: title ?? null, id: id ?? null });
@@ -58,7 +78,9 @@ export function registerAttachmentActions(rl) {
         description: "Delete an attachment.",
         inputSchema: t.Object({ id: t.String({ description: "The identifier of the attachment to delete" }) }),
         async execute(input, ctx) {
-            const data = await gql(key(ctx), `mutation($id: String!) { attachmentDelete(id: $id) { success } }`, { id: input.id });
+            const id = input.id;
+            await assertAttachmentInScope(ctx, id);
+            const data = await gql(key(ctx), `mutation($id: String!) { attachmentDelete(id: $id) { success } }`, { id });
             return data.attachmentDelete;
         },
     });

package/dist/plugins/linear/src/comments.js

@@ -1,28 +1,39 @@
 import * as t from "typebox";
-import { COMMENT_FIELDS, bindListAction, gql, key } from "./shared.js";
+import { COMMENT_FIELDS, assertCommentInScope, assertIssueInScope, gql, key, requireUnscoped } from "./shared.js";
 export function registerCommentActions(rl) {
-    const listAction = bindListAction(rl);
     rl.registerAction("issue.addComment", {
         description: "Add a comment to an issue. Pass parentId to nest as a reply.",
         inputSchema: t.Object({
             issueId: t.String({ description: "The issue to associate the comment with. UUID or issue identifier (e.g., 'LIN-123')" }),
             body: t.String({ description: "The comment content in markdown format" }),
-            parentId: t.Optional(t.String({ description: "The parent comment under which to nest this comment" })),
+            parentId: t.Optional(t.String({ description: "The parent comment under which to nest as a reply" })),
             doNotSubscribeToIssue: t.Optional(t.Boolean({ description: "Prevent auto-subscription to the issue the comment is created on" })),
             quotedText: t.Optional(t.String({ description: "The text that this comment references (inline comments)" })),
         }),
         async execute(input, ctx) {
             const fields = input;
+            await assertIssueInScope(ctx, String(fields.issueId));
             const data = await gql(key(ctx), `mutation($input: CommentCreateInput!) { commentCreate(input: $input) { success comment { ${COMMENT_FIELDS} } } }`, { input: fields });
             return data.commentCreate?.comment;
         },
     });
-    listAction("comment.list", "List comments across the workspace.", "comments", "CommentFilter", COMMENT_FIELDS);
+    rl.registerAction("comment.list", {
+        description: "List comments across the workspace. Disabled for scoped Linear connections; use issue.listComments instead.",
+        inputSchema: t.Object({ limit: t.Optional(t.Number()) }),
+        async execute(input, ctx) {
+            requireUnscoped(ctx, "comment.list");
+            const limit = input?.limit ?? 50;
+            const data = await gql(key(ctx), `query($first: Int) { comments(first: $first) { nodes { ${COMMENT_FIELDS} } pageInfo { hasNextPage endCursor } } }`, { first: limit });
+            return data.comments;
+        },
+    });
     rl.registerAction("comment.get", {
         description: "Get a comment by ID.",
         inputSchema: t.Object({ id: t.String() }),
         async execute(input, ctx) {
-            const data = await gql(key(ctx), `query($id: String!) { comment(id: $id) { ${COMMENT_FIELDS} } }`, { id: input.id });
+            const id = input.id;
+            await assertCommentInScope(ctx, id);
+            const data = await gql(key(ctx), `query($id: String!) { comment(id: $id) { ${COMMENT_FIELDS} } }`, { id });
             return data.comment;
         },
     });
@@ -35,6 +46,7 @@ export function registerCommentActions(rl) {
         }),
         async execute(input, ctx) {
             const { id, ...fields } = input;
+            await assertCommentInScope(ctx, String(id));
             const data = await gql(key(ctx), `mutation($id: String!, $input: CommentUpdateInput!) { commentUpdate(id: $id, input: $input) { success comment { ${COMMENT_FIELDS} } } }`, { id, input: fields });
             return data.commentUpdate?.comment;
         },
@@ -43,7 +55,9 @@ export function registerCommentActions(rl) {
         description: "Delete a comment.",
         inputSchema: t.Object({ id: t.String() }),
         async execute(input, ctx) {
-            const data = await gql(key(ctx), `mutation($id: String!) { commentDelete(id: $id) { success } }`, { id: input.id });
+            const id = input.id;
+            await assertCommentInScope(ctx, id);
+            const data = await gql(key(ctx), `mutation($id: String!) { commentDelete(id: $id) { success } }`, { id });
             return data.commentDelete;
         },
     });

package/dist/plugins/linear/src/cycles.js

@@ -1,5 +1,5 @@
 import * as t from "typebox";
-import { CYCLE_FIELDS, bindGetAction, bindListAction, gql, key } from "./shared.js";
+import { CYCLE_FIELDS, bindGetAction, bindListAction, gql, key, requireUnscoped } from "./shared.js";
 export function registerCycleActions(rl) {
     const listAction = bindListAction(rl);
     const getAction = bindGetAction(rl);
@@ -17,6 +17,7 @@ export function registerCycleActions(rl) {
             id: t.Optional(t.String({ description: "The identifier in UUID v4 format. If none is provided, the backend will generate one" })),
         }),
         async execute(input, ctx) {
+            requireUnscoped(ctx, "cycles.*");
             const data = await gql(key(ctx), `mutation($input: CycleCreateInput!) { cycleCreate(input: $input) { success cycle { ${CYCLE_FIELDS} } } }`, { input: input });
             return data.cycleCreate?.cycle;
         },
@@ -32,6 +33,7 @@ export function registerCycleActions(rl) {
             completedAt: t.Optional(t.String({ description: "The completion time of the cycle (DateTime). If null, the cycle hasn't been completed" })),
         }),
         async execute(input, ctx) {
+            requireUnscoped(ctx, "cycles.*");
             const { id, ...fields } = input;
             const data = await gql(key(ctx), `mutation($id: String!, $input: CycleUpdateInput!) { cycleUpdate(id: $id, input: $input) { success cycle { ${CYCLE_FIELDS} } } }`, { id, input: fields });
             return data.cycleUpdate?.cycle;

package/dist/plugins/linear/src/index.js

@@ -20,6 +20,10 @@ export default function linear(rl) {
             description: "Linear API key (https://linear.app/settings/account/security)",
             env: "LINEAR_API_KEY",
         }),
+        scopeLabelIds: t.Optional(t.String({
+            description: "Comma-separated Linear issue label IDs. When set, issue/comment/attachment access is restricted to issues with one of these labels.",
+            env: "LINEAR_SCOPE_LABEL_IDS",
+        })),
     }));
     registerIssueActions(rl);
     registerCommentActions(rl);

package/dist/plugins/linear/src/initiatives.js

@@ -1,5 +1,5 @@
 import * as t from "typebox";
-import { INITIATIVE_FIELDS, bindGetAction, bindListAction, gql, key } from "./shared.js";
+import { INITIATIVE_FIELDS, bindGetAction, bindListAction, gql, key, requireUnscoped } from "./shared.js";
 export function registerInitiativeActions(rl) {
     const listAction = bindListAction(rl);
     const getAction = bindGetAction(rl);
@@ -21,6 +21,7 @@ export function registerInitiativeActions(rl) {
             id: t.Optional(t.String({ description: "The identifier in UUID v4 format. If none is provided, the backend will generate one" })),
         }),
         async execute(input, ctx) {
+            requireUnscoped(ctx, "initiatives.*");
             const data = await gql(key(ctx), `mutation($input: InitiativeCreateInput!) { initiativeCreate(input: $input) { success initiative { ${INITIATIVE_FIELDS} } } }`, { input: input });
             return data.initiativeCreate?.initiative;
         },
@@ -42,6 +43,7 @@ export function registerInitiativeActions(rl) {
             trashed: t.Optional(t.Boolean({ description: "Whether the initiative has been trashed. Set to true to trash, or null to restore" })),
         }),
         async execute(input, ctx) {
+            requireUnscoped(ctx, "initiatives.*");
             const { id, ...fields } = input;
             const data = await gql(key(ctx), `mutation($id: String!, $input: InitiativeUpdateInput!) { initiativeUpdate(id: $id, input: $input) { success initiative { ${INITIATIVE_FIELDS} } } }`, { id, input: fields });
             return data.initiativeUpdate?.initiative;
@@ -51,12 +53,13 @@ export function registerInitiativeActions(rl) {
         description: "Trash an initiative.",
         inputSchema: t.Object({ id: t.String({ description: "The identifier of the initiative to delete" }) }),
         async execute(input, ctx) {
+            requireUnscoped(ctx, "initiatives.*");
             const data = await gql(key(ctx), `mutation($id: String!) { initiativeDelete(id: $id) { success } }`, { id: input.id });
             return data.initiativeDelete;
         },
     });
     rl.registerAction("initiative.addProject", {
-        description: "Associate a project with an initiative. A project can only appear once in an initiative hierarchy.",
+        description: "Associate a project with an initiative. Use this action for project-to-initiative linking; project.update does not accept initiativeId. Verify with initiative.get or the returned initiative.projects list.",
         inputSchema: t.Object({
             initiativeId: t.String({ description: "The identifier of the initiative" }),
             projectId: t.String({ description: "The identifier of the project" }),
@@ -64,14 +67,16 @@ export function registerInitiativeActions(rl) {
             id: t.Optional(t.String({ description: "The identifier in UUID v4 format. If none is provided, the backend will generate one" })),
         }),
         async execute(input, ctx) {
-            const data = await gql(key(ctx), `mutation($input: InitiativeToProjectCreateInput!) { initiativeToProjectCreate(input: $input) { success initiativeToProject { id } } }`, { input: input });
+            requireUnscoped(ctx, "initiatives.*");
+            const data = await gql(key(ctx), `mutation($input: InitiativeToProjectCreateInput!) { initiativeToProjectCreate(input: $input) { success initiativeToProject { id initiative { id name projects { nodes { id name } } } project { id name } } } }`, { input: input });
             return data.initiativeToProjectCreate;
         },
     });
     rl.registerAction("initiative.removeProject", {
-        description: "Remove a project from an initiative. Pass the link id returned by initiative.addProject.",
+        description: "Remove a project from an initiative. Pass the link id returned by initiative.addProject, then verify with initiative.get.",
         inputSchema: t.Object({ id: t.String({ description: "The identifier of the initiativeToProject to delete" }) }),
         async execute(input, ctx) {
+            requireUnscoped(ctx, "initiatives.*");
             const data = await gql(key(ctx), `mutation($id: String!) { initiativeToProjectDelete(id: $id) { success } }`, { id: input.id });
             return data.initiativeToProjectDelete;
         },

package/dist/plugins/linear/src/issues.js

@@ -1,5 +1,5 @@
 import * as t from "typebox";
-import { COMMENT_FIELDS, ISSUE_FIELDS, ISSUE_LITE, LIST_INPUT_SCHEMA, buildConnArgs, gql, key, } from "./shared.js";
+import { COMMENT_FIELDS, ISSUE_FIELDS, ISSUE_LITE, LIST_INPUT_SCHEMA, assertIssueInScope, buildConnArgs, ensureScopeLabelsOnCreateOrReplace, forbidScopeLabelRemoval, gql, issueHasScope, key, mergeIssueScopeFilter, } from "./shared.js";
 export function registerIssueActions(rl) {
     rl.registerAction("issue.create", {
         description: "Create an issue. teamId is required; title is required unless a template is applied.",
@@ -26,7 +26,8 @@ export function registerIssueActions(rl) {
             id: t.Optional(t.String({ description: "The identifier in UUID v4 format. If none is provided, the backend will generate one" })),
         }),
         async execute(input, ctx) {
-            const fields = input;
+            const fields = { ...input };
+            fields.labelIds = ensureScopeLabelsOnCreateOrReplace(ctx, fields.labelIds);
             const data = await gql(key(ctx), `mutation($input: IssueCreateInput!) { issueCreate(input: $input) { success issue { ${ISSUE_FIELDS} } } }`, { input: fields });
             return data.issueCreate?.issue;
         },
@@ -36,7 +37,10 @@ export function registerIssueActions(rl) {
         inputSchema: t.Object({ issueId: t.String() }),
         async execute(input, ctx) {
             const data = await gql(key(ctx), `query($id: String!) { issue(id: $id) { ${ISSUE_FIELDS} } }`, { id: input.issueId });
-            return data.issue;
+            const issue = data.issue;
+            if (!issueHasScope(ctx, issue))
+                throw new Error("Linear issue is not available to this scoped connection");
+            return issue;
         },
     });
     rl.registerAction("issue.list", {
@@ -54,7 +58,7 @@ export function registerIssueActions(rl) {
                 merged.team = { id: { eq: opts.teamId } };
             if (opts.assigneeId)
                 merged.assignee = { id: { eq: opts.assigneeId } };
-            const filter = Object.keys(merged).length > 0 ? merged : undefined;
+            const filter = mergeIssueScopeFilter(ctx, Object.keys(merged).length > 0 ? merged : undefined);
             const { argsDecl, argsCall, vars } = buildConnArgs({ ...opts, filter }, "IssueFilter");
             const data = await gql(key(ctx), `query${argsDecl} { issues${argsCall} { nodes { ${ISSUE_LITE} } pageInfo { hasNextPage endCursor } } }`, vars);
             const conn = data.issues;
@@ -91,6 +95,11 @@ export function registerIssueActions(rl) {
         }),
         async execute(input, ctx) {
             const { issueId, ...fields } = input;
+            await assertIssueInScope(ctx, String(issueId));
+            if (fields.removedLabelIds)
+                forbidScopeLabelRemoval(ctx, fields.removedLabelIds);
+            if (fields.labelIds)
+                fields.labelIds = ensureScopeLabelsOnCreateOrReplace(ctx, fields.labelIds);
             const data = await gql(key(ctx), `mutation($id: String!, $input: IssueUpdateInput!) { issueUpdate(id: $id, input: $input) { success issue { ${ISSUE_FIELDS} } } }`, { id: issueId, input: fields });
             return data.issueUpdate?.issue;
         },
@@ -103,6 +112,7 @@ export function registerIssueActions(rl) {
         }),
         async execute(input, ctx) {
             const { issueId, permanentlyDelete } = input;
+            await assertIssueInScope(ctx, issueId);
             const data = await gql(key(ctx), `mutation($id: String!, $perm: Boolean) { issueDelete(id: $id, permanentlyDelete: $perm) { success } }`, { id: issueId, perm: permanentlyDelete ?? null });
             return data.issueDelete;
         },
@@ -115,6 +125,7 @@ export function registerIssueActions(rl) {
         }),
         async execute(input, ctx) {
             const { issueId, trash } = input;
+            await assertIssueInScope(ctx, issueId);
             const data = await gql(key(ctx), `mutation($id: String!, $trash: Boolean) { issueArchive(id: $id, trash: $trash) { success } }`, { id: issueId, trash: trash ?? null });
             return data.issueArchive;
         },
@@ -123,7 +134,9 @@ export function registerIssueActions(rl) {
         description: "Unarchive an issue.",
         inputSchema: t.Object({ issueId: t.String() }),
         async execute(input, ctx) {
-            const data = await gql(key(ctx), `mutation($id: String!) { issueUnarchive(id: $id) { success } }`, { id: input.issueId });
+            const issueId = input.issueId;
+            await assertIssueInScope(ctx, issueId);
+            const data = await gql(key(ctx), `mutation($id: String!) { issueUnarchive(id: $id) { success } }`, { id: issueId });
             return data.issueUnarchive;
         },
     });
@@ -151,7 +164,7 @@ export function registerIssueActions(rl) {
         }`, {
                 term: opts.term,
                 first: opts.limit ?? 50,
-                filter: opts.filter ?? null,
+                filter: mergeIssueScopeFilter(ctx, opts.filter) ?? null,
                 includeComments: opts.includeComments ?? null,
                 includeArchived: opts.includeArchived ?? null,
                 teamId: opts.teamId ?? null,
@@ -170,6 +183,7 @@ export function registerIssueActions(rl) {
         }),
         async execute(input, ctx) {
             const { issueId, labelId } = input;
+            await assertIssueInScope(ctx, issueId);
             const data = await gql(key(ctx), `mutation($id: String!, $labelId: String!) { issueAddLabel(id: $id, labelId: $labelId) { success } }`, { id: issueId, labelId });
             return data.issueAddLabel;
         },
@@ -182,6 +196,8 @@ export function registerIssueActions(rl) {
         }),
         async execute(input, ctx) {
             const { issueId, labelId } = input;
+            await assertIssueInScope(ctx, issueId);
+            forbidScopeLabelRemoval(ctx, labelId);
             const data = await gql(key(ctx), `mutation($id: String!, $labelId: String!) { issueRemoveLabel(id: $id, labelId: $labelId) { success } }`, { id: issueId, labelId });
             return data.issueRemoveLabel;
         },
@@ -195,6 +211,7 @@ export function registerIssueActions(rl) {
         }),
         async execute(input, ctx) {
             const { issueId, userId, userEmail } = input;
+            await assertIssueInScope(ctx, String(issueId));
             const data = await gql(key(ctx), `mutation($id: String!, $userId: String, $userEmail: String) {
           issueSubscribe(id: $id, userId: $userId, userEmail: $userEmail) { success }
         }`, { id: issueId, userId: userId ?? null, userEmail: userEmail ?? null });
@@ -210,6 +227,7 @@ export function registerIssueActions(rl) {
         }),
         async execute(input, ctx) {
             const { issueId, userId, userEmail } = input;
+            await assertIssueInScope(ctx, String(issueId));
             const data = await gql(key(ctx), `mutation($id: String!, $userId: String, $userEmail: String) {
           issueUnsubscribe(id: $id, userId: $userId, userEmail: $userEmail) { success }
         }`, { id: issueId, userId: userId ?? null, userEmail: userEmail ?? null });
@@ -224,7 +242,10 @@ export function registerIssueActions(rl) {
             type: t.String({ description: "IssueRelationType: blocks | duplicate | related | similar" }),
         }),
         async execute(input, ctx) {
-            const data = await gql(key(ctx), `mutation($input: IssueRelationCreateInput!) { issueRelationCreate(input: $input) { success issueRelation { id type } } }`, { input: input });
+            const fields = input;
+            await assertIssueInScope(ctx, String(fields.issueId));
+            await assertIssueInScope(ctx, String(fields.relatedIssueId));
+            const data = await gql(key(ctx), `mutation($input: IssueRelationCreateInput!) { issueRelationCreate(input: $input) { success issueRelation { id type } } }`, { input: fields });
             return data.issueRelationCreate;
         },
     });
@@ -236,6 +257,7 @@ export function registerIssueActions(rl) {
         }),
         async execute(input, ctx) {
             const { issueId, limit } = input;
+            await assertIssueInScope(ctx, issueId);
             const data = await gql(key(ctx), `query($id: String!, $first: Int) {
           issue(id: $id) { comments(first: $first) { nodes { ${COMMENT_FIELDS} } } }
         }`, { id: issueId, first: limit ?? 50 });

package/dist/plugins/linear/src/labels.js

@@ -1,5 +1,5 @@
 import * as t from "typebox";
-import { LABEL_FIELDS, bindGetAction, bindListAction, gql, key } from "./shared.js";
+import { LABEL_FIELDS, bindGetAction, bindListAction, gql, key, requireUnscoped } from "./shared.js";
 export function registerLabelActions(rl) {
     const listAction = bindListAction(rl);
     const getAction = bindGetAction(rl);
@@ -19,6 +19,7 @@ export function registerLabelActions(rl) {
             replaceTeamLabels: t.Optional(t.Boolean({ description: "Replace all team-specific labels with the same name with this newly created workspace label (default false)" })),
         }),
         async execute(input, ctx) {
+            requireUnscoped(ctx, "label.create");
             const { replaceTeamLabels, ...fields } = input;
             const data = await gql(key(ctx), `mutation($input: IssueLabelCreateInput!, $replaceTeamLabels: Boolean) { issueLabelCreate(input: $input, replaceTeamLabels: $replaceTeamLabels) { success issueLabel { ${LABEL_FIELDS} } } }`, { input: fields, replaceTeamLabels: replaceTeamLabels ?? null });
             return data.issueLabelCreate?.issueLabel;
@@ -37,6 +38,7 @@ export function registerLabelActions(rl) {
             replaceTeamLabels: t.Optional(t.Boolean({ description: "Replace all team-specific labels with the same name with this updated workspace label (default false)" })),
         }),
         async execute(input, ctx) {
+            requireUnscoped(ctx, "label.update");
             const { id, replaceTeamLabels, ...fields } = input;
             const data = await gql(key(ctx), `mutation($id: String!, $input: IssueLabelUpdateInput!, $replaceTeamLabels: Boolean) { issueLabelUpdate(id: $id, input: $input, replaceTeamLabels: $replaceTeamLabels) { success issueLabel { ${LABEL_FIELDS} } } }`, { id, input: fields, replaceTeamLabels: replaceTeamLabels ?? null });
             return data.issueLabelUpdate?.issueLabel;
@@ -46,6 +48,7 @@ export function registerLabelActions(rl) {
         description: "Delete a label.",
         inputSchema: t.Object({ id: t.String({ description: "The identifier of the label to delete" }) }),
         async execute(input, ctx) {
+            requireUnscoped(ctx, "label.delete");
             const data = await gql(key(ctx), `mutation($id: String!) { issueLabelDelete(id: $id) { success } }`, { id: input.id });
             return data.issueLabelDelete;
         },
@@ -54,6 +57,7 @@ export function registerLabelActions(rl) {
         description: "Retire a label. Retired labels remain visible but cannot be applied to new issues.",
         inputSchema: t.Object({ id: t.String({ description: "The identifier of the label to retire" }) }),
         async execute(input, ctx) {
+            requireUnscoped(ctx, "label.retire");
             const data = await gql(key(ctx), `mutation($id: String!) { issueLabelRetire(id: $id) { success issueLabel { ${LABEL_FIELDS} } } }`, { id: input.id });
             return data.issueLabelRetire?.issueLabel;
         },
@@ -62,6 +66,7 @@ export function registerLabelActions(rl) {
         description: "Restore a previously retired label.",
         inputSchema: t.Object({ id: t.String({ description: "The identifier of the label to restore" }) }),
         async execute(input, ctx) {
+            requireUnscoped(ctx, "label.restore");
             const data = await gql(key(ctx), `mutation($id: String!) { issueLabelRestore(id: $id) { success issueLabel { ${LABEL_FIELDS} } } }`, { id: input.id });
             return data.issueLabelRestore?.issueLabel;
         },

package/dist/plugins/linear/src/organization.js

@@ -1,10 +1,11 @@
 import * as t from "typebox";
-import { ORG_FIELDS, gql, key } from "./shared.js";
+import { ORG_FIELDS, gql, key, requireUnscoped } from "./shared.js";
 export function registerOrganizationActions(rl) {
     rl.registerAction("org.get", {
         description: "Get the authenticated workspace.",
         inputSchema: t.Object({}),
         async execute(_input, ctx) {
+            requireUnscoped(ctx, "org.get");
             const data = await gql(key(ctx), `query { organization { ${ORG_FIELDS} } }`);
             return data.organization;
         },

package/dist/plugins/linear/src/projects.js

@@ -1,5 +1,5 @@
 import * as t from "typebox";
-import { MILESTONE_FIELDS, PROJECT_FIELDS, PROJECT_UPDATE_FIELDS, bindGetAction, bindListAction, gql, key, } from "./shared.js";
+import { MILESTONE_FIELDS, PROJECT_FIELDS, PROJECT_UPDATE_FIELDS, bindGetAction, bindListAction, gql, key, requireUnscoped, } from "./shared.js";
 export function registerProjectActions(rl) {
     const listAction = bindListAction(rl);
     const getAction = bindGetAction(rl);
@@ -31,6 +31,7 @@ export function registerProjectActions(rl) {
             slackChannelName: t.Optional(t.String({ description: "The full name for the Slack channel to create (including prefix). Creates and connects a Slack channel if provided" })),
         }),
         async execute(input, ctx) {
+            requireUnscoped(ctx, "projects.*");
             const { slackChannelName, ...fields } = input;
             const data = await gql(key(ctx), `mutation($input: ProjectCreateInput!, $slackChannelName: String) { projectCreate(input: $input, slackChannelName: $slackChannelName) { success project { ${PROJECT_FIELDS} } } }`, { input: fields, slackChannelName: slackChannelName ?? null });
             return data.projectCreate?.project;
@@ -61,6 +62,7 @@ export function registerProjectActions(rl) {
             trashed: t.Optional(t.Boolean({ description: "Whether the project has been trashed. Set to true to trash, or null to restore" })),
         }),
         async execute(input, ctx) {
+            requireUnscoped(ctx, "projects.*");
             const { id, ...fields } = input;
             const data = await gql(key(ctx), `mutation($id: String!, $input: ProjectUpdateInput!) { projectUpdate(id: $id, input: $input) { success project { ${PROJECT_FIELDS} } } }`, { id, input: fields });
             return data.projectUpdate?.project;
@@ -70,6 +72,7 @@ export function registerProjectActions(rl) {
         description: "Trash (soft-delete) a project. Restorable via project.unarchive.",
         inputSchema: t.Object({ id: t.String({ description: "The identifier of the project to delete" }), }),
         async execute(input, ctx) {
+            requireUnscoped(ctx, "projects.*");
             const data = await gql(key(ctx), `mutation($id: String!) { projectDelete(id: $id) { success } }`, { id: input.id });
             return data.projectDelete;
         },
@@ -78,6 +81,7 @@ export function registerProjectActions(rl) {
         description: "Restore a previously trashed or archived project.",
         inputSchema: t.Object({ id: t.String({ description: "The identifier of the project to restore (UUID or slug)" }), }),
         async execute(input, ctx) {
+            requireUnscoped(ctx, "projects.*");
             const data = await gql(key(ctx), `mutation($id: String!) { projectUnarchive(id: $id) { success } }`, { id: input.id });
             return data.projectUnarchive;
         },
@@ -91,6 +95,7 @@ export function registerProjectActions(rl) {
             teamId: t.Optional(t.String({ description: "UUID of a team to boost in search results" })),
         }),
         async execute(input, ctx) {
+            requireUnscoped(ctx, "projects.*");
             const opts = input;
             const data = await gql(key(ctx), `query($term: String!, $first: Int, $includeComments: Boolean, $teamId: String) {
           searchProjects(term: $term, first: $first, includeComments: $includeComments, teamId: $teamId) {
@@ -120,6 +125,7 @@ export function registerProjectActions(rl) {
             id: t.Optional(t.String({ description: "The identifier in UUID v4 format. If none is provided, the backend will generate one" })),
         }),
         async execute(input, ctx) {
+            requireUnscoped(ctx, "projects.*");
             const data = await gql(key(ctx), `mutation($input: ProjectMilestoneCreateInput!) { projectMilestoneCreate(input: $input) { success projectMilestone { ${MILESTONE_FIELDS} } } }`, { input: input });
             return data.projectMilestoneCreate?.projectMilestone;
         },
@@ -135,6 +141,7 @@ export function registerProjectActions(rl) {
             sortOrder: t.Optional(t.Number({ description: "The sort order for the project milestone within a project (Float)" })),
         }),
         async execute(input, ctx) {
+            requireUnscoped(ctx, "projects.*");
             const { id, ...fields } = input;
             const data = await gql(key(ctx), `mutation($id: String!, $input: ProjectMilestoneUpdateInput!) { projectMilestoneUpdate(id: $id, input: $input) { success projectMilestone { ${MILESTONE_FIELDS} } } }`, { id, input: fields });
             return data.projectMilestoneUpdate?.projectMilestone;
@@ -144,6 +151,7 @@ export function registerProjectActions(rl) {
         description: "Delete a project milestone.",
         inputSchema: t.Object({ id: t.String({ description: "The identifier of the project milestone to delete" }), }),
         async execute(input, ctx) {
+            requireUnscoped(ctx, "projects.*");
             const data = await gql(key(ctx), `mutation($id: String!) { projectMilestoneDelete(id: $id) { success } }`, { id: input.id });
             return data.projectMilestoneDelete;
         },
@@ -160,6 +168,7 @@ export function registerProjectActions(rl) {
             id: t.Optional(t.String({ description: "The identifier in UUID v4 format. If none is provided, the backend will generate one" })),
         }),
         async execute(input, ctx) {
+            requireUnscoped(ctx, "projects.*");
             const data = await gql(key(ctx), `mutation($input: ProjectUpdateCreateInput!) { projectUpdateCreate(input: $input) { success projectUpdate { ${PROJECT_UPDATE_FIELDS} } } }`, { input: input });
             return data.projectUpdateCreate?.projectUpdate;
         },
@@ -173,6 +182,7 @@ export function registerProjectActions(rl) {
             isDiffHidden: t.Optional(t.Boolean({ description: "Whether the diff between the current update and the previous one should be hidden" })),
         }),
         async execute(input, ctx) {
+            requireUnscoped(ctx, "projects.*");
             const { id, ...fields } = input;
             const data = await gql(key(ctx), `mutation($id: String!, $input: ProjectUpdateUpdateInput!) { projectUpdateUpdate(id: $id, input: $input) { success projectUpdate { ${PROJECT_UPDATE_FIELDS} } } }`, { id, input: fields });
             return data.projectUpdateUpdate?.projectUpdate;
@@ -182,6 +192,7 @@ export function registerProjectActions(rl) {
         description: "Archive a project status update.",
         inputSchema: t.Object({ id: t.String({ description: "The identifier of the project update to archive" }), }),
         async execute(input, ctx) {
+            requireUnscoped(ctx, "projects.*");
             const data = await gql(key(ctx), `mutation($id: String!) { projectUpdateArchive(id: $id) { success } }`, { id: input.id });
             return data.projectUpdateArchive;
         },