switchroom 0.15.5 → 0.15.7

package/dist/agent-scheduler/index.js

@@ -11082,6 +11082,25 @@ var SessionContinuitySchema = exports_external.object({
   resume_mode: exports_external.enum(["auto", "continue", "handoff", "none"]).optional().describe("How to resume the next session. 'handoff' (default as of #362) " + "never passes --continue; a fresh Claude starts each restart and " + "reads a briefing assembled from recent Telegram messages, Hindsight " + "recall, and today's daily memory file. 'auto' uses --continue when " + "the latest JSONL is smaller than resume_max_bytes, else falls back " + "to the handoff briefing. 'continue' always passes --continue. " + "'none' starts completely fresh every time."),
   resume_max_bytes: exports_external.number().int().positive().optional().describe("Byte threshold above which 'auto' mode falls back to handoff " + "instead of --continue. Default 2_000_000 (~2MB). Large transcripts " + "can blow out the context window even with prefix caching, and " + "--continue replay is known-fragile at scale.")
 }).optional();
+var webhookDispatchRule = exports_external.object({
+  description: exports_external.string().optional(),
+  match: exports_external.object({
+    event: exports_external.string(),
+    actions: exports_external.array(exports_external.string()).optional(),
+    labels_any: exports_external.array(exports_external.string()).optional(),
+    labels_all: exports_external.array(exports_external.string()).optional(),
+    exclude_authors: exports_external.array(exports_external.string()).optional(),
+    assignee_any: exports_external.array(exports_external.string()).optional(),
+    mentions_any: exports_external.array(exports_external.string()).optional()
+  }).passthrough(),
+  prompt: exports_external.string(),
+  cooldown: exports_external.string().optional(),
+  quiet_hours: exports_external.object({
+    start: exports_external.number().int().min(0).max(23),
+    end: exports_external.number().int().min(0).max(23),
+    tz: exports_external.string().optional()
+  }).optional()
+});
 var TelegramChannelSchema = exports_external.object({
   enabled: exports_external.boolean().default(true).describe("Master switch for the per-agent Telegram gateway sidecar. " + "When false, start.sh skips the gateway supervise loop and the " + "agent boots without bot-token requirements (smoke-test + " + "offline-dev use case)."),
   plugin: exports_external.enum(["switchroom", "official"]).optional().describe("Which Telegram MCP plugin to load. Default is 'switchroom' — the " + "enhanced fork with streaming edits, reactions, history, and " + "access control. Set to 'official' for the upstream marketplace " + "plugin (basic send/receive only)."),
@@ -11117,26 +11136,12 @@ var TelegramChannelSchema = exports_external.object({
     safe_boundary: exports_external.boolean().optional().describe("When true (the default), a `!`-prefix interrupt that arrives while " + "the agent is mid-tool-call is DEFERRED: the SIGINT and the " + "replacement turn wait until the in-flight tool call finishes (a " + "clean boundary) instead of C-c'ing the agent mid-write/mid-bash. If " + "no tool is in flight the interrupt still fires immediately. Bounded " + "by max_wait_ms so a long tool never strands the user. Set false to " + "fire synchronously the moment `!` is received (historical " + "behaviour). Rapid repeated `!` while one is pending coalesce into a " + "single deferred interrupt carrying the latest body."),
     max_wait_ms: exports_external.number().int().positive().optional().describe("Upper bound (ms) the gateway waits for a safe boundary before firing " + "a deferred `!` interrupt anyway. Only consulted when safe_boundary is " + "true. Default 8000. Keep it short — the user explicitly asked to " + "interrupt, so a long in-flight tool shouldn't ghost them; the cap " + "trades a tiny risk of a mid-tool C-c for a guaranteed response.")
   }).optional().describe("Interrupt timing — how a `!`-prefix interrupt behaves when it lands " + "mid-tool-call. Off by default (fire immediately). Cascades from " + "defaults.channels.telegram.interrupt."),
-  webhook_sources: exports_external.array(exports_external.enum(["github", "generic"])).optional().describe("External webhook sources allowed to ingest events into this agent's " + "log. POST /webhook/<agent>/<source> on the switchroom web server. " + "Each source has its own signature verification ('github' = " + "X-Hub-Signature-256 HMAC-SHA256, 'generic' = Bearer token). " + "Per-source secret read from ~/.switchroom/webhook-secrets.json " + "keyed by [agent][source]. Verified events append to " + "<agent>/telegram/webhook-events.jsonl for the agent to read on " + "demand. Off by default — webhook is the only untrusted-inbound " + "surface in the system, so opt-in is mandatory. " + "Cascades from defaults.channels.telegram.webhook_sources. " + "(Migrated from per-agent root in #596 — see #577.)"),
+  webhook_sources: exports_external.array(exports_external.enum(["github", "generic", "linear"])).optional().describe("External webhook sources allowed to ingest events into this agent's " + "log. POST /webhook/<agent>/<source> on the switchroom web server. " + "Each source has its own signature verification ('github' = " + "X-Hub-Signature-256 HMAC-SHA256, 'generic' = Bearer token, " + "'linear' = Linear-Signature bare-hex HMAC-SHA256 of the raw body). " + "Per-source secret read from ~/.switchroom/webhook-secrets.json " + "keyed by [agent][source]. Verified events append to " + "<agent>/telegram/webhook-events.jsonl for the agent to read on " + "demand. Off by default — webhook is the only untrusted-inbound " + "surface in the system, so opt-in is mandatory. " + "Cascades from defaults.channels.telegram.webhook_sources. " + "(Migrated from per-agent root in #596 — see #577.)"),
   webhook_dispatch: exports_external.object({
-    github: exports_external.array(exports_external.object({
-      description: exports_external.string().optional(),
-      match: exports_external.object({
-        event: exports_external.string(),
-        actions: exports_external.array(exports_external.string()).optional(),
-        labels_any: exports_external.array(exports_external.string()).optional(),
-        labels_all: exports_external.array(exports_external.string()).optional(),
-        exclude_authors: exports_external.array(exports_external.string()).optional()
-      }).passthrough(),
-      prompt: exports_external.string(),
-      cooldown: exports_external.string().optional(),
-      quiet_hours: exports_external.object({
-        start: exports_external.number().int().min(0).max(23),
-        end: exports_external.number().int().min(0).max(23),
-        tz: exports_external.string().optional()
-      }).optional()
-    })).optional()
-  }).optional().describe("Auto-dispatch rules: when a verified webhook event matches a rule, " + "inject the rendered prompt into the agent's live session (#1625). " + "Supports cooldowns, quiet hours, and label/action matchers. " + "Off by default — opt in per agent. See src/web/webhook-dispatch.ts."),
+    github: exports_external.array(webhookDispatchRule).optional(),
+    generic: exports_external.array(webhookDispatchRule).optional(),
+    linear: exports_external.array(webhookDispatchRule).optional()
+  }).optional().describe("Auto-dispatch rules: when a verified webhook event matches a rule, " + "inject the rendered prompt into the agent's live session (#1625). " + "Rules are keyed by source — 'github', 'generic', or 'linear' (#2272). " + "Supports cooldowns, quiet hours, label/action matchers, and (for " + "linear/generic) assignee_any / mentions_any matchers. " + "Off by default — opt in per agent. See src/web/webhook-dispatch.ts."),
   webhook_rate_limit: exports_external.object({
     rpm: exports_external.number().int().positive()
   }).optional().describe("Per-source rate limit for the webhook ingest path (#714). " + "Off by default — when this key is absent the handler skips " + "rate-limit checks entirely. Opt in by setting `rpm` to an " + "integer requests-per-minute (token bucket per (agent, source); " + "burst equal to rpm). When enabled, exceeding the limit returns " + "429 with Retry-After header; first throttle event per " + "(agent, source) per 60s window is written to " + "<agent>/telegram/issues.jsonl. " + "Cascades from defaults.channels.telegram.webhook_rate_limit."),
@@ -11313,7 +11318,7 @@ var AgentSchema = exports_external.object({
   purpose: exports_external.string().max(140).optional().describe("One-line description of what this agent does (≤140 chars). Shown to " + "peer agents when they call the agent-config MCP `peers_list` tool, so " + "every agent on the instance can answer 'is there an agent that does X' " + "without baking the fleet into prompts. Sourced live from " + "switchroom.yaml — never memorized into Hindsight. Falls back to " + "`topic_name` when absent."),
   role: exports_external.enum(["assistant", "foreman"]).optional().describe("Agent role. Default (omitted) is `assistant` — a fleet agent doing " + "user-facing tasks. `foreman` opts the agent in to switchroom's bundled " + "operator skills (switchroom-architecture / cli / health / install / manage " + "/ status), auto-symlinked into the agent's .claude/skills/ on scaffold and " + "reconcile. Fleet agents (assistant role) get no operator skills; reconcile " + "actively retracts them if the role flips back. See docs/skills.md for the model."),
   topic_id: exports_external.number().optional().describe("Telegram topic thread ID (auto-populated by switchroom topics sync)"),
-  webhook_sources: exports_external.array(exports_external.enum(["github", "generic"])).optional().describe("[DEPRECATED — moved to channels.telegram.webhook_sources in #596] " + "Old per-agent location. Still read but logs a deprecation warning. " + "See channels.telegram.webhook_sources for the canonical spot."),
+  webhook_sources: exports_external.array(exports_external.enum(["github", "generic", "linear"])).optional().describe("[DEPRECATED — moved to channels.telegram.webhook_sources in #596] " + "Old per-agent location. Still read but logs a deprecation warning. " + "See channels.telegram.webhook_sources for the canonical spot."),
   voice_in: exports_external.object({
     enabled: exports_external.boolean().optional(),
     provider: exports_external.enum(["openai"]).optional(),

package/dist/auth-broker/index.js

@@ -11082,6 +11082,25 @@ var SessionContinuitySchema = exports_external.object({
   resume_mode: exports_external.enum(["auto", "continue", "handoff", "none"]).optional().describe("How to resume the next session. 'handoff' (default as of #362) " + "never passes --continue; a fresh Claude starts each restart and " + "reads a briefing assembled from recent Telegram messages, Hindsight " + "recall, and today's daily memory file. 'auto' uses --continue when " + "the latest JSONL is smaller than resume_max_bytes, else falls back " + "to the handoff briefing. 'continue' always passes --continue. " + "'none' starts completely fresh every time."),
   resume_max_bytes: exports_external.number().int().positive().optional().describe("Byte threshold above which 'auto' mode falls back to handoff " + "instead of --continue. Default 2_000_000 (~2MB). Large transcripts " + "can blow out the context window even with prefix caching, and " + "--continue replay is known-fragile at scale.")
 }).optional();
+var webhookDispatchRule = exports_external.object({
+  description: exports_external.string().optional(),
+  match: exports_external.object({
+    event: exports_external.string(),
+    actions: exports_external.array(exports_external.string()).optional(),
+    labels_any: exports_external.array(exports_external.string()).optional(),
+    labels_all: exports_external.array(exports_external.string()).optional(),
+    exclude_authors: exports_external.array(exports_external.string()).optional(),
+    assignee_any: exports_external.array(exports_external.string()).optional(),
+    mentions_any: exports_external.array(exports_external.string()).optional()
+  }).passthrough(),
+  prompt: exports_external.string(),
+  cooldown: exports_external.string().optional(),
+  quiet_hours: exports_external.object({
+    start: exports_external.number().int().min(0).max(23),
+    end: exports_external.number().int().min(0).max(23),
+    tz: exports_external.string().optional()
+  }).optional()
+});
 var TelegramChannelSchema = exports_external.object({
   enabled: exports_external.boolean().default(true).describe("Master switch for the per-agent Telegram gateway sidecar. " + "When false, start.sh skips the gateway supervise loop and the " + "agent boots without bot-token requirements (smoke-test + " + "offline-dev use case)."),
   plugin: exports_external.enum(["switchroom", "official"]).optional().describe("Which Telegram MCP plugin to load. Default is 'switchroom' — the " + "enhanced fork with streaming edits, reactions, history, and " + "access control. Set to 'official' for the upstream marketplace " + "plugin (basic send/receive only)."),
@@ -11117,26 +11136,12 @@ var TelegramChannelSchema = exports_external.object({
     safe_boundary: exports_external.boolean().optional().describe("When true (the default), a `!`-prefix interrupt that arrives while " + "the agent is mid-tool-call is DEFERRED: the SIGINT and the " + "replacement turn wait until the in-flight tool call finishes (a " + "clean boundary) instead of C-c'ing the agent mid-write/mid-bash. If " + "no tool is in flight the interrupt still fires immediately. Bounded " + "by max_wait_ms so a long tool never strands the user. Set false to " + "fire synchronously the moment `!` is received (historical " + "behaviour). Rapid repeated `!` while one is pending coalesce into a " + "single deferred interrupt carrying the latest body."),
     max_wait_ms: exports_external.number().int().positive().optional().describe("Upper bound (ms) the gateway waits for a safe boundary before firing " + "a deferred `!` interrupt anyway. Only consulted when safe_boundary is " + "true. Default 8000. Keep it short — the user explicitly asked to " + "interrupt, so a long in-flight tool shouldn't ghost them; the cap " + "trades a tiny risk of a mid-tool C-c for a guaranteed response.")
   }).optional().describe("Interrupt timing — how a `!`-prefix interrupt behaves when it lands " + "mid-tool-call. Off by default (fire immediately). Cascades from " + "defaults.channels.telegram.interrupt."),
-  webhook_sources: exports_external.array(exports_external.enum(["github", "generic"])).optional().describe("External webhook sources allowed to ingest events into this agent's " + "log. POST /webhook/<agent>/<source> on the switchroom web server. " + "Each source has its own signature verification ('github' = " + "X-Hub-Signature-256 HMAC-SHA256, 'generic' = Bearer token). " + "Per-source secret read from ~/.switchroom/webhook-secrets.json " + "keyed by [agent][source]. Verified events append to " + "<agent>/telegram/webhook-events.jsonl for the agent to read on " + "demand. Off by default — webhook is the only untrusted-inbound " + "surface in the system, so opt-in is mandatory. " + "Cascades from defaults.channels.telegram.webhook_sources. " + "(Migrated from per-agent root in #596 — see #577.)"),
+  webhook_sources: exports_external.array(exports_external.enum(["github", "generic", "linear"])).optional().describe("External webhook sources allowed to ingest events into this agent's " + "log. POST /webhook/<agent>/<source> on the switchroom web server. " + "Each source has its own signature verification ('github' = " + "X-Hub-Signature-256 HMAC-SHA256, 'generic' = Bearer token, " + "'linear' = Linear-Signature bare-hex HMAC-SHA256 of the raw body). " + "Per-source secret read from ~/.switchroom/webhook-secrets.json " + "keyed by [agent][source]. Verified events append to " + "<agent>/telegram/webhook-events.jsonl for the agent to read on " + "demand. Off by default — webhook is the only untrusted-inbound " + "surface in the system, so opt-in is mandatory. " + "Cascades from defaults.channels.telegram.webhook_sources. " + "(Migrated from per-agent root in #596 — see #577.)"),
   webhook_dispatch: exports_external.object({
-    github: exports_external.array(exports_external.object({
-      description: exports_external.string().optional(),
-      match: exports_external.object({
-        event: exports_external.string(),
-        actions: exports_external.array(exports_external.string()).optional(),
-        labels_any: exports_external.array(exports_external.string()).optional(),
-        labels_all: exports_external.array(exports_external.string()).optional(),
-        exclude_authors: exports_external.array(exports_external.string()).optional()
-      }).passthrough(),
-      prompt: exports_external.string(),
-      cooldown: exports_external.string().optional(),
-      quiet_hours: exports_external.object({
-        start: exports_external.number().int().min(0).max(23),
-        end: exports_external.number().int().min(0).max(23),
-        tz: exports_external.string().optional()
-      }).optional()
-    })).optional()
-  }).optional().describe("Auto-dispatch rules: when a verified webhook event matches a rule, " + "inject the rendered prompt into the agent's live session (#1625). " + "Supports cooldowns, quiet hours, and label/action matchers. " + "Off by default — opt in per agent. See src/web/webhook-dispatch.ts."),
+    github: exports_external.array(webhookDispatchRule).optional(),
+    generic: exports_external.array(webhookDispatchRule).optional(),
+    linear: exports_external.array(webhookDispatchRule).optional()
+  }).optional().describe("Auto-dispatch rules: when a verified webhook event matches a rule, " + "inject the rendered prompt into the agent's live session (#1625). " + "Rules are keyed by source — 'github', 'generic', or 'linear' (#2272). " + "Supports cooldowns, quiet hours, label/action matchers, and (for " + "linear/generic) assignee_any / mentions_any matchers. " + "Off by default — opt in per agent. See src/web/webhook-dispatch.ts."),
   webhook_rate_limit: exports_external.object({
     rpm: exports_external.number().int().positive()
   }).optional().describe("Per-source rate limit for the webhook ingest path (#714). " + "Off by default — when this key is absent the handler skips " + "rate-limit checks entirely. Opt in by setting `rpm` to an " + "integer requests-per-minute (token bucket per (agent, source); " + "burst equal to rpm). When enabled, exceeding the limit returns " + "429 with Retry-After header; first throttle event per " + "(agent, source) per 60s window is written to " + "<agent>/telegram/issues.jsonl. " + "Cascades from defaults.channels.telegram.webhook_rate_limit."),
@@ -11313,7 +11318,7 @@ var AgentSchema = exports_external.object({
   purpose: exports_external.string().max(140).optional().describe("One-line description of what this agent does (≤140 chars). Shown to " + "peer agents when they call the agent-config MCP `peers_list` tool, so " + "every agent on the instance can answer 'is there an agent that does X' " + "without baking the fleet into prompts. Sourced live from " + "switchroom.yaml — never memorized into Hindsight. Falls back to " + "`topic_name` when absent."),
   role: exports_external.enum(["assistant", "foreman"]).optional().describe("Agent role. Default (omitted) is `assistant` — a fleet agent doing " + "user-facing tasks. `foreman` opts the agent in to switchroom's bundled " + "operator skills (switchroom-architecture / cli / health / install / manage " + "/ status), auto-symlinked into the agent's .claude/skills/ on scaffold and " + "reconcile. Fleet agents (assistant role) get no operator skills; reconcile " + "actively retracts them if the role flips back. See docs/skills.md for the model."),
   topic_id: exports_external.number().optional().describe("Telegram topic thread ID (auto-populated by switchroom topics sync)"),
-  webhook_sources: exports_external.array(exports_external.enum(["github", "generic"])).optional().describe("[DEPRECATED — moved to channels.telegram.webhook_sources in #596] " + "Old per-agent location. Still read but logs a deprecation warning. " + "See channels.telegram.webhook_sources for the canonical spot."),
+  webhook_sources: exports_external.array(exports_external.enum(["github", "generic", "linear"])).optional().describe("[DEPRECATED — moved to channels.telegram.webhook_sources in #596] " + "Old per-agent location. Still read but logs a deprecation warning. " + "See channels.telegram.webhook_sources for the canonical spot."),
   voice_in: exports_external.object({
     enabled: exports_external.boolean().optional(),
     provider: exports_external.enum(["openai"]).optional(),

package/dist/cli/notion-write-pretool.mjs

@@ -11830,6 +11830,25 @@ var SessionContinuitySchema = exports_external.object({
   resume_mode: exports_external.enum(["auto", "continue", "handoff", "none"]).optional().describe("How to resume the next session. 'handoff' (default as of #362) " + "never passes --continue; a fresh Claude starts each restart and " + "reads a briefing assembled from recent Telegram messages, Hindsight " + "recall, and today's daily memory file. 'auto' uses --continue when " + "the latest JSONL is smaller than resume_max_bytes, else falls back " + "to the handoff briefing. 'continue' always passes --continue. " + "'none' starts completely fresh every time."),
   resume_max_bytes: exports_external.number().int().positive().optional().describe("Byte threshold above which 'auto' mode falls back to handoff " + "instead of --continue. Default 2_000_000 (~2MB). Large transcripts " + "can blow out the context window even with prefix caching, and " + "--continue replay is known-fragile at scale.")
 }).optional();
+var webhookDispatchRule = exports_external.object({
+  description: exports_external.string().optional(),
+  match: exports_external.object({
+    event: exports_external.string(),
+    actions: exports_external.array(exports_external.string()).optional(),
+    labels_any: exports_external.array(exports_external.string()).optional(),
+    labels_all: exports_external.array(exports_external.string()).optional(),
+    exclude_authors: exports_external.array(exports_external.string()).optional(),
+    assignee_any: exports_external.array(exports_external.string()).optional(),
+    mentions_any: exports_external.array(exports_external.string()).optional()
+  }).passthrough(),
+  prompt: exports_external.string(),
+  cooldown: exports_external.string().optional(),
+  quiet_hours: exports_external.object({
+    start: exports_external.number().int().min(0).max(23),
+    end: exports_external.number().int().min(0).max(23),
+    tz: exports_external.string().optional()
+  }).optional()
+});
 var TelegramChannelSchema = exports_external.object({
   enabled: exports_external.boolean().default(true).describe("Master switch for the per-agent Telegram gateway sidecar. " + "When false, start.sh skips the gateway supervise loop and the " + "agent boots without bot-token requirements (smoke-test + " + "offline-dev use case)."),
   plugin: exports_external.enum(["switchroom", "official"]).optional().describe("Which Telegram MCP plugin to load. Default is 'switchroom' \u2014 the " + "enhanced fork with streaming edits, reactions, history, and " + "access control. Set to 'official' for the upstream marketplace " + "plugin (basic send/receive only)."),
@@ -11865,26 +11884,12 @@ var TelegramChannelSchema = exports_external.object({
     safe_boundary: exports_external.boolean().optional().describe("When true (the default), a `!`-prefix interrupt that arrives while " + "the agent is mid-tool-call is DEFERRED: the SIGINT and the " + "replacement turn wait until the in-flight tool call finishes (a " + "clean boundary) instead of C-c'ing the agent mid-write/mid-bash. If " + "no tool is in flight the interrupt still fires immediately. Bounded " + "by max_wait_ms so a long tool never strands the user. Set false to " + "fire synchronously the moment `!` is received (historical " + "behaviour). Rapid repeated `!` while one is pending coalesce into a " + "single deferred interrupt carrying the latest body."),
     max_wait_ms: exports_external.number().int().positive().optional().describe("Upper bound (ms) the gateway waits for a safe boundary before firing " + "a deferred `!` interrupt anyway. Only consulted when safe_boundary is " + "true. Default 8000. Keep it short \u2014 the user explicitly asked to " + "interrupt, so a long in-flight tool shouldn't ghost them; the cap " + "trades a tiny risk of a mid-tool C-c for a guaranteed response.")
   }).optional().describe("Interrupt timing \u2014 how a `!`-prefix interrupt behaves when it lands " + "mid-tool-call. Off by default (fire immediately). Cascades from " + "defaults.channels.telegram.interrupt."),
-  webhook_sources: exports_external.array(exports_external.enum(["github", "generic"])).optional().describe("External webhook sources allowed to ingest events into this agent's " + "log. POST /webhook/<agent>/<source> on the switchroom web server. " + "Each source has its own signature verification ('github' = " + "X-Hub-Signature-256 HMAC-SHA256, 'generic' = Bearer token). " + "Per-source secret read from ~/.switchroom/webhook-secrets.json " + "keyed by [agent][source]. Verified events append to " + "<agent>/telegram/webhook-events.jsonl for the agent to read on " + "demand. Off by default \u2014 webhook is the only untrusted-inbound " + "surface in the system, so opt-in is mandatory. " + "Cascades from defaults.channels.telegram.webhook_sources. " + "(Migrated from per-agent root in #596 \u2014 see #577.)"),
+  webhook_sources: exports_external.array(exports_external.enum(["github", "generic", "linear"])).optional().describe("External webhook sources allowed to ingest events into this agent's " + "log. POST /webhook/<agent>/<source> on the switchroom web server. " + "Each source has its own signature verification ('github' = " + "X-Hub-Signature-256 HMAC-SHA256, 'generic' = Bearer token, " + "'linear' = Linear-Signature bare-hex HMAC-SHA256 of the raw body). " + "Per-source secret read from ~/.switchroom/webhook-secrets.json " + "keyed by [agent][source]. Verified events append to " + "<agent>/telegram/webhook-events.jsonl for the agent to read on " + "demand. Off by default \u2014 webhook is the only untrusted-inbound " + "surface in the system, so opt-in is mandatory. " + "Cascades from defaults.channels.telegram.webhook_sources. " + "(Migrated from per-agent root in #596 \u2014 see #577.)"),
   webhook_dispatch: exports_external.object({
-    github: exports_external.array(exports_external.object({
-      description: exports_external.string().optional(),
-      match: exports_external.object({
-        event: exports_external.string(),
-        actions: exports_external.array(exports_external.string()).optional(),
-        labels_any: exports_external.array(exports_external.string()).optional(),
-        labels_all: exports_external.array(exports_external.string()).optional(),
-        exclude_authors: exports_external.array(exports_external.string()).optional()
-      }).passthrough(),
-      prompt: exports_external.string(),
-      cooldown: exports_external.string().optional(),
-      quiet_hours: exports_external.object({
-        start: exports_external.number().int().min(0).max(23),
-        end: exports_external.number().int().min(0).max(23),
-        tz: exports_external.string().optional()
-      }).optional()
-    })).optional()
-  }).optional().describe("Auto-dispatch rules: when a verified webhook event matches a rule, " + "inject the rendered prompt into the agent's live session (#1625). " + "Supports cooldowns, quiet hours, and label/action matchers. " + "Off by default \u2014 opt in per agent. See src/web/webhook-dispatch.ts."),
+    github: exports_external.array(webhookDispatchRule).optional(),
+    generic: exports_external.array(webhookDispatchRule).optional(),
+    linear: exports_external.array(webhookDispatchRule).optional()
+  }).optional().describe("Auto-dispatch rules: when a verified webhook event matches a rule, " + "inject the rendered prompt into the agent's live session (#1625). " + "Rules are keyed by source \u2014 'github', 'generic', or 'linear' (#2272). " + "Supports cooldowns, quiet hours, label/action matchers, and (for " + "linear/generic) assignee_any / mentions_any matchers. " + "Off by default \u2014 opt in per agent. See src/web/webhook-dispatch.ts."),
   webhook_rate_limit: exports_external.object({
     rpm: exports_external.number().int().positive()
   }).optional().describe("Per-source rate limit for the webhook ingest path (#714). " + "Off by default \u2014 when this key is absent the handler skips " + "rate-limit checks entirely. Opt in by setting `rpm` to an " + "integer requests-per-minute (token bucket per (agent, source); " + "burst equal to rpm). When enabled, exceeding the limit returns " + "429 with Retry-After header; first throttle event per " + "(agent, source) per 60s window is written to " + "<agent>/telegram/issues.jsonl. " + "Cascades from defaults.channels.telegram.webhook_rate_limit."),
@@ -12061,7 +12066,7 @@ var AgentSchema = exports_external.object({
   purpose: exports_external.string().max(140).optional().describe("One-line description of what this agent does (\u2264140 chars). Shown to " + "peer agents when they call the agent-config MCP `peers_list` tool, so " + "every agent on the instance can answer 'is there an agent that does X' " + "without baking the fleet into prompts. Sourced live from " + "switchroom.yaml \u2014 never memorized into Hindsight. Falls back to " + "`topic_name` when absent."),
   role: exports_external.enum(["assistant", "foreman"]).optional().describe("Agent role. Default (omitted) is `assistant` \u2014 a fleet agent doing " + "user-facing tasks. `foreman` opts the agent in to switchroom's bundled " + "operator skills (switchroom-architecture / cli / health / install / manage " + "/ status), auto-symlinked into the agent's .claude/skills/ on scaffold and " + "reconcile. Fleet agents (assistant role) get no operator skills; reconcile " + "actively retracts them if the role flips back. See docs/skills.md for the model."),
   topic_id: exports_external.number().optional().describe("Telegram topic thread ID (auto-populated by switchroom topics sync)"),
-  webhook_sources: exports_external.array(exports_external.enum(["github", "generic"])).optional().describe("[DEPRECATED \u2014 moved to channels.telegram.webhook_sources in #596] " + "Old per-agent location. Still read but logs a deprecation warning. " + "See channels.telegram.webhook_sources for the canonical spot."),
+  webhook_sources: exports_external.array(exports_external.enum(["github", "generic", "linear"])).optional().describe("[DEPRECATED \u2014 moved to channels.telegram.webhook_sources in #596] " + "Old per-agent location. Still read but logs a deprecation warning. " + "See channels.telegram.webhook_sources for the canonical spot."),
   voice_in: exports_external.object({
     enabled: exports_external.boolean().optional(),
     provider: exports_external.enum(["openai"]).optional(),

package/dist/cli/switchroom.js

@@ -13520,7 +13520,7 @@ var init_zod = __esm(() => {
 });
 
 // src/config/schema.ts
-var CodeRepoEntrySchema, AgentBindMountSchema, HttpDiffPollSchema, TelegramReactionsPollSchema, PollSpecSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, TelegramChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleWorkspaceConfigSchema, MicrosoftWorkspaceConfigSchema, NotionWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, AgentMicrosoftWorkspaceConfigSchema, AgentNotionWorkspaceConfigSchema, ReactionsSchema, ReleaseBlock, NetworkIsolationSchema, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, DEFAULT_PROFILE = "default", AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, WebServiceConfigSchema, HostdConfigSchema, CronEgressSchema, CronConfigSchema, SwitchroomConfigSchema;
+var CodeRepoEntrySchema, AgentBindMountSchema, HttpDiffPollSchema, TelegramReactionsPollSchema, PollSpecSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, webhookDispatchRule, TelegramChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleWorkspaceConfigSchema, MicrosoftWorkspaceConfigSchema, NotionWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, AgentMicrosoftWorkspaceConfigSchema, AgentNotionWorkspaceConfigSchema, ReactionsSchema, ReleaseBlock, NetworkIsolationSchema, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, DEFAULT_PROFILE = "default", AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, WebServiceConfigSchema, HostdConfigSchema, CronEgressSchema, CronConfigSchema, SwitchroomConfigSchema;
 var init_schema = __esm(() => {
   init_zod();
   CodeRepoEntrySchema = exports_external.object({
@@ -13646,6 +13646,25 @@ var init_schema = __esm(() => {
     resume_mode: exports_external.enum(["auto", "continue", "handoff", "none"]).optional().describe("How to resume the next session. 'handoff' (default as of #362) " + "never passes --continue; a fresh Claude starts each restart and " + "reads a briefing assembled from recent Telegram messages, Hindsight " + "recall, and today's daily memory file. 'auto' uses --continue when " + "the latest JSONL is smaller than resume_max_bytes, else falls back " + "to the handoff briefing. 'continue' always passes --continue. " + "'none' starts completely fresh every time."),
     resume_max_bytes: exports_external.number().int().positive().optional().describe("Byte threshold above which 'auto' mode falls back to handoff " + "instead of --continue. Default 2_000_000 (~2MB). Large transcripts " + "can blow out the context window even with prefix caching, and " + "--continue replay is known-fragile at scale.")
   }).optional();
+  webhookDispatchRule = exports_external.object({
+    description: exports_external.string().optional(),
+    match: exports_external.object({
+      event: exports_external.string(),
+      actions: exports_external.array(exports_external.string()).optional(),
+      labels_any: exports_external.array(exports_external.string()).optional(),
+      labels_all: exports_external.array(exports_external.string()).optional(),
+      exclude_authors: exports_external.array(exports_external.string()).optional(),
+      assignee_any: exports_external.array(exports_external.string()).optional(),
+      mentions_any: exports_external.array(exports_external.string()).optional()
+    }).passthrough(),
+    prompt: exports_external.string(),
+    cooldown: exports_external.string().optional(),
+    quiet_hours: exports_external.object({
+      start: exports_external.number().int().min(0).max(23),
+      end: exports_external.number().int().min(0).max(23),
+      tz: exports_external.string().optional()
+    }).optional()
+  });
   TelegramChannelSchema = exports_external.object({
     enabled: exports_external.boolean().default(true).describe("Master switch for the per-agent Telegram gateway sidecar. " + "When false, start.sh skips the gateway supervise loop and the " + "agent boots without bot-token requirements (smoke-test + " + "offline-dev use case)."),
     plugin: exports_external.enum(["switchroom", "official"]).optional().describe("Which Telegram MCP plugin to load. Default is 'switchroom' \u2014 the " + "enhanced fork with streaming edits, reactions, history, and " + "access control. Set to 'official' for the upstream marketplace " + "plugin (basic send/receive only)."),
@@ -13681,26 +13700,12 @@ var init_schema = __esm(() => {
       safe_boundary: exports_external.boolean().optional().describe("When true (the default), a `!`-prefix interrupt that arrives while " + "the agent is mid-tool-call is DEFERRED: the SIGINT and the " + "replacement turn wait until the in-flight tool call finishes (a " + "clean boundary) instead of C-c'ing the agent mid-write/mid-bash. If " + "no tool is in flight the interrupt still fires immediately. Bounded " + "by max_wait_ms so a long tool never strands the user. Set false to " + "fire synchronously the moment `!` is received (historical " + "behaviour). Rapid repeated `!` while one is pending coalesce into a " + "single deferred interrupt carrying the latest body."),
       max_wait_ms: exports_external.number().int().positive().optional().describe("Upper bound (ms) the gateway waits for a safe boundary before firing " + "a deferred `!` interrupt anyway. Only consulted when safe_boundary is " + "true. Default 8000. Keep it short \u2014 the user explicitly asked to " + "interrupt, so a long in-flight tool shouldn't ghost them; the cap " + "trades a tiny risk of a mid-tool C-c for a guaranteed response.")
     }).optional().describe("Interrupt timing \u2014 how a `!`-prefix interrupt behaves when it lands " + "mid-tool-call. Off by default (fire immediately). Cascades from " + "defaults.channels.telegram.interrupt."),
-    webhook_sources: exports_external.array(exports_external.enum(["github", "generic"])).optional().describe("External webhook sources allowed to ingest events into this agent's " + "log. POST /webhook/<agent>/<source> on the switchroom web server. " + "Each source has its own signature verification ('github' = " + "X-Hub-Signature-256 HMAC-SHA256, 'generic' = Bearer token). " + "Per-source secret read from ~/.switchroom/webhook-secrets.json " + "keyed by [agent][source]. Verified events append to " + "<agent>/telegram/webhook-events.jsonl for the agent to read on " + "demand. Off by default \u2014 webhook is the only untrusted-inbound " + "surface in the system, so opt-in is mandatory. " + "Cascades from defaults.channels.telegram.webhook_sources. " + "(Migrated from per-agent root in #596 \u2014 see #577.)"),
+    webhook_sources: exports_external.array(exports_external.enum(["github", "generic", "linear"])).optional().describe("External webhook sources allowed to ingest events into this agent's " + "log. POST /webhook/<agent>/<source> on the switchroom web server. " + "Each source has its own signature verification ('github' = " + "X-Hub-Signature-256 HMAC-SHA256, 'generic' = Bearer token, " + "'linear' = Linear-Signature bare-hex HMAC-SHA256 of the raw body). " + "Per-source secret read from ~/.switchroom/webhook-secrets.json " + "keyed by [agent][source]. Verified events append to " + "<agent>/telegram/webhook-events.jsonl for the agent to read on " + "demand. Off by default \u2014 webhook is the only untrusted-inbound " + "surface in the system, so opt-in is mandatory. " + "Cascades from defaults.channels.telegram.webhook_sources. " + "(Migrated from per-agent root in #596 \u2014 see #577.)"),
     webhook_dispatch: exports_external.object({
-      github: exports_external.array(exports_external.object({
-        description: exports_external.string().optional(),
-        match: exports_external.object({
-          event: exports_external.string(),
-          actions: exports_external.array(exports_external.string()).optional(),
-          labels_any: exports_external.array(exports_external.string()).optional(),
-          labels_all: exports_external.array(exports_external.string()).optional(),
-          exclude_authors: exports_external.array(exports_external.string()).optional()
-        }).passthrough(),
-        prompt: exports_external.string(),
-        cooldown: exports_external.string().optional(),
-        quiet_hours: exports_external.object({
-          start: exports_external.number().int().min(0).max(23),
-          end: exports_external.number().int().min(0).max(23),
-          tz: exports_external.string().optional()
-        }).optional()
-      })).optional()
-    }).optional().describe("Auto-dispatch rules: when a verified webhook event matches a rule, " + "inject the rendered prompt into the agent's live session (#1625). " + "Supports cooldowns, quiet hours, and label/action matchers. " + "Off by default \u2014 opt in per agent. See src/web/webhook-dispatch.ts."),
+      github: exports_external.array(webhookDispatchRule).optional(),
+      generic: exports_external.array(webhookDispatchRule).optional(),
+      linear: exports_external.array(webhookDispatchRule).optional()
+    }).optional().describe("Auto-dispatch rules: when a verified webhook event matches a rule, " + "inject the rendered prompt into the agent's live session (#1625). " + "Rules are keyed by source \u2014 'github', 'generic', or 'linear' (#2272). " + "Supports cooldowns, quiet hours, label/action matchers, and (for " + "linear/generic) assignee_any / mentions_any matchers. " + "Off by default \u2014 opt in per agent. See src/web/webhook-dispatch.ts."),
     webhook_rate_limit: exports_external.object({
       rpm: exports_external.number().int().positive()
     }).optional().describe("Per-source rate limit for the webhook ingest path (#714). " + "Off by default \u2014 when this key is absent the handler skips " + "rate-limit checks entirely. Opt in by setting `rpm` to an " + "integer requests-per-minute (token bucket per (agent, source); " + "burst equal to rpm). When enabled, exceeding the limit returns " + "429 with Retry-After header; first throttle event per " + "(agent, source) per 60s window is written to " + "<agent>/telegram/issues.jsonl. " + "Cascades from defaults.channels.telegram.webhook_rate_limit."),
@@ -13877,7 +13882,7 @@ var init_schema = __esm(() => {
     purpose: exports_external.string().max(140).optional().describe("One-line description of what this agent does (\u2264140 chars). Shown to " + "peer agents when they call the agent-config MCP `peers_list` tool, so " + "every agent on the instance can answer 'is there an agent that does X' " + "without baking the fleet into prompts. Sourced live from " + "switchroom.yaml \u2014 never memorized into Hindsight. Falls back to " + "`topic_name` when absent."),
     role: exports_external.enum(["assistant", "foreman"]).optional().describe("Agent role. Default (omitted) is `assistant` \u2014 a fleet agent doing " + "user-facing tasks. `foreman` opts the agent in to switchroom's bundled " + "operator skills (switchroom-architecture / cli / health / install / manage " + "/ status), auto-symlinked into the agent's .claude/skills/ on scaffold and " + "reconcile. Fleet agents (assistant role) get no operator skills; reconcile " + "actively retracts them if the role flips back. See docs/skills.md for the model."),
     topic_id: exports_external.number().optional().describe("Telegram topic thread ID (auto-populated by switchroom topics sync)"),
-    webhook_sources: exports_external.array(exports_external.enum(["github", "generic"])).optional().describe("[DEPRECATED \u2014 moved to channels.telegram.webhook_sources in #596] " + "Old per-agent location. Still read but logs a deprecation warning. " + "See channels.telegram.webhook_sources for the canonical spot."),
+    webhook_sources: exports_external.array(exports_external.enum(["github", "generic", "linear"])).optional().describe("[DEPRECATED \u2014 moved to channels.telegram.webhook_sources in #596] " + "Old per-agent location. Still read but logs a deprecation warning. " + "See channels.telegram.webhook_sources for the canonical spot."),
     voice_in: exports_external.object({
       enabled: exports_external.boolean().optional(),
       provider: exports_external.enum(["openai"]).optional(),
@@ -50199,8 +50204,8 @@ var {
 } = import__.default;
 
 // src/build-info.ts
-var VERSION = "0.15.5";
-var COMMIT_SHA = "fcc9d7b7";
+var VERSION = "0.15.7";
+var COMMIT_SHA = "c0a8b988";
 
 // src/cli/agent.ts
 init_source();
@@ -66799,6 +66804,7 @@ import { existsSync as existsSync43, readFileSync as readFileSync38, writeFileSy
 import { join as join38 } from "node:path";
 
 // src/web/webhook-dispatch.ts
+var DISPATCH_SOURCES = ["github", "generic", "linear"];
 function renderTemplate2(template, ctx) {
   return template.replace(/\{\{(\w+)\}\}/g, (_, key) => ctx[key] ?? "");
 }
@@ -66815,12 +66821,86 @@ function buildGithubContext(eventType, payload) {
   const rawLabels = obj?.labels ?? [];
   const labels = rawLabels.map((l) => String(l.name ?? "")).join(", ");
   const action = String(payload.action ?? "");
-  return { repo, number, title, html_url, author, labels, action, event: eventType };
+  const assignee = String(obj?.assignee?.login ?? "");
+  return {
+    repo,
+    number,
+    title,
+    html_url,
+    author,
+    labels,
+    action,
+    event: eventType,
+    assignee,
+    body: title
+  };
+}
+function buildLinearContext(eventType, payload) {
+  const data = payload.data ?? {};
+  const issue = data.issue ?? {};
+  const number = String(data.identifier ?? issue.identifier ?? "");
+  const title = String(data.title ?? issue.title ?? "");
+  const html_url = String(payload.url ?? "");
+  const action = String(payload.action ?? "");
+  const assignee = String(data.assignee?.displayName ?? data.assignee?.name ?? "");
+  const author = String(data.user?.displayName ?? data.user?.name ?? "");
+  const rawLabels = data.labels ?? [];
+  const labels = rawLabels.map((l) => String(l.name ?? "")).join(", ");
+  const commentBody = String(data.body ?? "");
+  const body = [title, commentBody].filter(Boolean).join(`
+`);
+  return {
+    repo: "linear",
+    number,
+    title,
+    html_url,
+    author,
+    labels,
+    action,
+    event: eventType,
+    assignee,
+    body
+  };
+}
+function buildGenericContext(source, payload) {
+  const title = typeof payload.title === "string" ? payload.title : typeof payload.message === "string" ? payload.message : typeof payload.text === "string" ? payload.text : "";
+  const action = String(payload.action ?? "");
+  const html_url = typeof payload.url === "string" ? payload.url : "";
+  const number = String(payload.id ?? payload.number ?? "");
+  const author = String(payload.author ?? payload.user ?? "");
+  const assignee = String(payload.assignee ?? "");
+  const rawLabels = Array.isArray(payload.labels) ? payload.labels.map((l) => typeof l === "string" ? l : String(l?.name ?? "")) : [];
+  const labels = rawLabels.join(", ");
+  return {
+    repo: source,
+    number,
+    title,
+    html_url,
+    author,
+    labels,
+    action,
+    event: source,
+    assignee,
+    body: title
+  };
+}
+function buildContext(source, eventType, payload) {
+  switch (source) {
+    case "linear":
+      return buildLinearContext(eventType, payload);
+    case "generic":
+      return buildGenericContext(eventType, payload);
+    default:
+      return buildGithubContext(eventType, payload);
+  }
+}
+function labelSetFromContext(ctx) {
+  return new Set(ctx.labels.split(",").map((l) => l.trim()).filter(Boolean));
 }
-function matchesRule(eventType, payload, matcher) {
+function matchesRule(source, eventType, payload, matcher) {
   if (matcher.event !== eventType)
     return false;
-  const ctx = buildGithubContext(eventType, payload);
+  const ctx = buildContext(source, eventType, payload);
   if (matcher.actions && matcher.actions.length > 0) {
     if (!matcher.actions.includes(ctx.action))
       return false;
@@ -66829,22 +66909,24 @@ function matchesRule(eventType, payload, matcher) {
     if (matcher.exclude_authors.includes(ctx.author))
       return false;
   }
+  if (matcher.assignee_any && matcher.assignee_any.length > 0) {
+    if (!matcher.assignee_any.includes(ctx.assignee))
+      return false;
+  }
+  if (matcher.mentions_any && matcher.mentions_any.length > 0) {
+    const hay = ctx.body.toLowerCase();
+    const hasMention = matcher.mentions_any.some((m) => hay.includes(m.toLowerCase()));
+    if (!hasMention)
+      return false;
+  }
   if (matcher.labels_any && matcher.labels_any.length > 0) {
-    const pr = payload.pull_request;
-    const issue = payload.issue;
-    const rawLabels = (pr ?? issue)?.labels ?? [];
-    const labelNames = new Set(rawLabels.map((l) => String(l.name ?? "")));
-    const hasAny = matcher.labels_any.some((l) => labelNames.has(l));
-    if (!hasAny)
+    const labelNames = labelSetFromContext(ctx);
+    if (!matcher.labels_any.some((l) => labelNames.has(l)))
       return false;
   }
   if (matcher.labels_all && matcher.labels_all.length > 0) {
-    const pr = payload.pull_request;
-    const issue = payload.issue;
-    const rawLabels = (pr ?? issue)?.labels ?? [];
-    const labelNames = new Set(rawLabels.map((l) => String(l.name ?? "")));
-    const hasAll = matcher.labels_all.every((l) => labelNames.has(l));
-    if (!hasAll)
+    const labelNames = labelSetFromContext(ctx);
+    if (!matcher.labels_all.every((l) => labelNames.has(l)))
       return false;
   }
   return true;
@@ -67371,7 +67453,11 @@ function registerDispatchVerb(tg, _program) {
     } catch (err) {
       fail(`Could not read payload file '${opts.payload}': ${err.message}`);
     }
-    const rules = opts.source === "github" ? dispatchConfig.github ?? [] : [];
+    if (!DISPATCH_SOURCES.includes(opts.source)) {
+      console.log(source_default.yellow(`Source '${opts.source}' does not support dispatch (known: ${DISPATCH_SOURCES.join(", ")}).`));
+      return;
+    }
+    const rules = dispatchConfig[opts.source] ?? [];
     if (rules.length === 0) {
       console.log(source_default.yellow(`No dispatch rules for source '${opts.source}'.`));
       return;
@@ -67380,7 +67466,7 @@ function registerDispatchVerb(tg, _program) {
     const now = new Date;
     for (let i = 0;i < rules.length; i++) {
       const rule = rules[i];
-      const matched = matchesRule(opts.event, payload, rule.match);
+      const matched = matchesRule(opts.source, opts.event, payload, rule.match);
       const prefix = matched ? source_default.green("\u2713 MATCH") : source_default.dim("\u2717 no match");
       const desc = rule.description ? ` \u2014 ${rule.description}` : ` \u2014 rule ${i}`;
       console.log(`${prefix}  rule ${i}${desc}`);
@@ -67395,7 +67481,7 @@ function registerDispatchVerb(tg, _program) {
         const ms = parseDurationMs(rule.cooldown);
         console.log(`  cooldown: ${rule.cooldown} (${ms}ms) \u2014 state tracked in webhook-cooldown.json`);
       }
-      const ctx = buildGithubContext(opts.event, payload);
+      const ctx = buildContext(opts.source, opts.event, payload);
       const rendered = renderTemplate2(rule.prompt, ctx);
       console.log(source_default.bold("  rendered prompt:"));
       for (const line of rendered.split(`
@@ -73801,6 +73887,26 @@ function verifyGithubSignature(body, signatureHeader, secret) {
     return { ok: false, reason: "signature-mismatch" };
   return { ok: true };
 }
+function verifyLinearSignature(body, signatureHeader, secret) {
+  if (!secret || secret.length === 0) {
+    return { ok: false, reason: "no-secret-configured" };
+  }
+  if (!signatureHeader) {
+    return { ok: false, reason: "no-signature-header" };
+  }
+  const provided = signatureHeader.trim();
+  if (!/^[0-9a-f]{64}$/.test(provided)) {
+    return { ok: false, reason: "malformed-hex" };
+  }
+  const expected = createHmac2("sha256", secret).update(body).digest("hex");
+  const a = Buffer.from(provided, "utf-8");
+  const b = Buffer.from(expected, "utf-8");
+  if (a.length !== b.length)
+    return { ok: false, reason: "length-mismatch" };
+  if (!timingSafeEqual(a, b))
+    return { ok: false, reason: "signature-mismatch" };
+  return { ok: true };
+}
 function verifyBearerToken(authHeader, secret) {
   if (!secret || secret.length === 0) {
     return { ok: false, reason: "no-secret-configured" };
@@ -73866,6 +73972,41 @@ ${compare2}` : ""}`,
       };
   }
 }
+function renderLinearEvent(eventType, payload) {
+  const action = String(payload.action ?? "");
+  const url = typeof payload.url === "string" ? payload.url : "";
+  const data = payload.data ?? {};
+  switch (eventType) {
+    case "issue": {
+      const id = String(data.identifier ?? "?");
+      const title = String(data.title ?? "");
+      const assignee = data.assignee?.displayName ?? data.assignee?.name ?? "";
+      return {
+        text: `\uD83D\uDCD0 <b>Linear</b> issue ${escapeHtml3(id)} ${escapeHtml3(action)}` + `${assignee ? ` \u2192 @${escapeHtml3(assignee)}` : ""}
+` + `${escapeHtml3(title)}${url ? `
+${url}` : ""}`,
+        disableLinkPreview: true
+      };
+    }
+    case "comment": {
+      const issue = data.issue ?? {};
+      const id = String(issue.identifier ?? "?");
+      const body = String(data.body ?? "").slice(0, 200);
+      return {
+        text: `\uD83D\uDCD0 <b>Linear</b> comment ${escapeHtml3(action)} on ${escapeHtml3(id)}
+` + `${escapeHtml3(body)}${url ? `
+${url}` : ""}`,
+        disableLinkPreview: true
+      };
+    }
+    default:
+      return {
+        text: `\uD83D\uDCD0 <b>Linear</b> ${escapeHtml3(eventType)} ${escapeHtml3(action)}` + `${url ? `
+${url}` : ""}`,
+        disableLinkPreview: true
+      };
+  }
+}
 function renderGenericEvent(source, payload) {
   const title = typeof payload.title === "string" ? payload.title : typeof payload.message === "string" ? payload.message : typeof payload.text === "string" ? payload.text : null;
   const summary = title ?? JSON.stringify(payload).slice(0, 200);
@@ -73956,7 +74097,7 @@ function verifyEdgeHeader(headerValue, expectedSecret) {
 }
 
 // src/web/webhook-handler.ts
-var KNOWN_SOURCES = ["github", "generic"];
+var KNOWN_SOURCES = ["github", "generic", "linear"];
 function jsonReply(status, body, extraHeaders) {
   return {
     status,
@@ -74110,6 +74251,9 @@ async function handleWebhookIngest(args, deps = {}) {
   if (source === "github") {
     const sigHeader = args.headers.get("x-hub-signature-256");
     verifyResult = verifyGithubSignature(args.body, sigHeader, secret);
+  } else if (source === "linear") {
+    const sigHeader = args.headers.get("linear-signature");
+    verifyResult = verifyLinearSignature(args.body, sigHeader, secret);
   } else {
     const authHeader = args.headers.get("authorization");
     verifyResult = verifyBearerToken(authHeader, secret);
@@ -74152,8 +74296,8 @@ async function handleWebhookIngest(args, deps = {}) {
 `);
     return jsonReply(400, { ok: false, error: "malformed json" });
   }
-  const eventType = source === "github" ? args.headers.get("x-github-event") ?? "unknown" : args.source;
-  const rendered = source === "github" ? renderGithubEvent(eventType, payload) : renderGenericEvent(args.source, payload);
+  const eventType = source === "github" ? args.headers.get("x-github-event") ?? "unknown" : source === "linear" ? String(payload.type ?? "unknown").toLowerCase() : args.source;
+  const rendered = source === "github" ? renderGithubEvent(eventType, payload) : source === "linear" ? renderLinearEvent(eventType, payload) : renderGenericEvent(args.source, payload);
   if (args.viaGateway) {
     const socketPath = join45(resolveAgentDir(args.agent), "telegram", "webhook.sock");
     const forward = deps.forwardFn ?? forwardToGateway;
@@ -81747,7 +81891,7 @@ function registerApplyCommand(program3) {
         }
       }
       const buildLocal = !!opts.buildLocal;
-      const buildContext = typeof opts.buildLocal === "string" ? opts.buildLocal : process.cwd();
+      const buildContext2 = typeof opts.buildLocal === "string" ? opts.buildLocal : process.cwd();
       const releaseOverride = opts.channel ? { channel: opts.channel } : opts.pin ? { pin: opts.pin } : undefined;
       if (opts.pin && !/^(sha-[0-9a-f]{7,40}|v\d+\.\d+\.\d+)$/.test(opts.pin)) {
         console.error(source_default.red(`--pin "${opts.pin}" is invalid. Expected sha-<7-40 hex> or v<semver>.`));
@@ -81755,7 +81899,7 @@ function registerApplyCommand(program3) {
       }
       const result = await runApply(config, {
         buildLocal,
-        buildContext: buildLocal ? buildContext : undefined,
+        buildContext: buildLocal ? buildContext2 : undefined,
         outPath: opts.out,
         example: opts.example,
         nonInteractive: opts.nonInteractive ?? false,
@@ -85006,6 +85150,16 @@ networks:
 # operator surface; the daemon's stderr lands in \`docker logs switchroom-hostd\`.
 `;
 }
+function resolveHostdHostHome(env2 = process.env, home2 = homedir48()) {
+  const fromEnv = env2.SWITCHROOM_HOST_HOME?.trim();
+  const resolved = fromEnv && fromEnv.length > 0 ? fromEnv : home2;
+  if (resolved === "/host-home" || resolved.startsWith("/host-home/")) {
+    throw new Error(`switchroom hostd install: refusing to generate \u2014 the host home resolved to ` + `"${resolved}", the in-container mount point of the operator home (never a valid ` + `host bind source). Emitting it would make Docker create empty /host-home dirs on ` + `the host and crash-loop hostd on a missing config mount.
+
+` + `Recovery: run \`switchroom hostd install\` from the HOST shell (not inside the ` + `hostd container), or set SWITCHROOM_HOST_HOME to the real host home first.`);
+  }
+  return resolved;
+}
 function hostdDir() {
   return join82(homedir48(), ".switchroom", "hostd");
 }
@@ -85049,7 +85203,7 @@ async function doInstall(opts, program3) {
   const composePath = hostdComposePath();
   mkdirSync47(dir, { recursive: true });
   const yaml = renderHostdComposeFile({
-    hostHome: homedir48(),
+    hostHome: resolveHostdHostHome(),
     imageTag: opts.tag ?? DEFAULT_IMAGE_TAG,
     operatorUid: resolveOperatorUid()
   });

package/dist/host-control/main.js

@@ -13817,6 +13817,25 @@ var SessionContinuitySchema = exports_external.object({
   resume_mode: exports_external.enum(["auto", "continue", "handoff", "none"]).optional().describe("How to resume the next session. 'handoff' (default as of #362) " + "never passes --continue; a fresh Claude starts each restart and " + "reads a briefing assembled from recent Telegram messages, Hindsight " + "recall, and today's daily memory file. 'auto' uses --continue when " + "the latest JSONL is smaller than resume_max_bytes, else falls back " + "to the handoff briefing. 'continue' always passes --continue. " + "'none' starts completely fresh every time."),
   resume_max_bytes: exports_external.number().int().positive().optional().describe("Byte threshold above which 'auto' mode falls back to handoff " + "instead of --continue. Default 2_000_000 (~2MB). Large transcripts " + "can blow out the context window even with prefix caching, and " + "--continue replay is known-fragile at scale.")
 }).optional();
+var webhookDispatchRule = exports_external.object({
+  description: exports_external.string().optional(),
+  match: exports_external.object({
+    event: exports_external.string(),
+    actions: exports_external.array(exports_external.string()).optional(),
+    labels_any: exports_external.array(exports_external.string()).optional(),
+    labels_all: exports_external.array(exports_external.string()).optional(),
+    exclude_authors: exports_external.array(exports_external.string()).optional(),
+    assignee_any: exports_external.array(exports_external.string()).optional(),
+    mentions_any: exports_external.array(exports_external.string()).optional()
+  }).passthrough(),
+  prompt: exports_external.string(),
+  cooldown: exports_external.string().optional(),
+  quiet_hours: exports_external.object({
+    start: exports_external.number().int().min(0).max(23),
+    end: exports_external.number().int().min(0).max(23),
+    tz: exports_external.string().optional()
+  }).optional()
+});
 var TelegramChannelSchema = exports_external.object({
   enabled: exports_external.boolean().default(true).describe("Master switch for the per-agent Telegram gateway sidecar. " + "When false, start.sh skips the gateway supervise loop and the " + "agent boots without bot-token requirements (smoke-test + " + "offline-dev use case)."),
   plugin: exports_external.enum(["switchroom", "official"]).optional().describe("Which Telegram MCP plugin to load. Default is 'switchroom' — the " + "enhanced fork with streaming edits, reactions, history, and " + "access control. Set to 'official' for the upstream marketplace " + "plugin (basic send/receive only)."),
@@ -13852,26 +13871,12 @@ var TelegramChannelSchema = exports_external.object({
     safe_boundary: exports_external.boolean().optional().describe("When true (the default), a `!`-prefix interrupt that arrives while " + "the agent is mid-tool-call is DEFERRED: the SIGINT and the " + "replacement turn wait until the in-flight tool call finishes (a " + "clean boundary) instead of C-c'ing the agent mid-write/mid-bash. If " + "no tool is in flight the interrupt still fires immediately. Bounded " + "by max_wait_ms so a long tool never strands the user. Set false to " + "fire synchronously the moment `!` is received (historical " + "behaviour). Rapid repeated `!` while one is pending coalesce into a " + "single deferred interrupt carrying the latest body."),
     max_wait_ms: exports_external.number().int().positive().optional().describe("Upper bound (ms) the gateway waits for a safe boundary before firing " + "a deferred `!` interrupt anyway. Only consulted when safe_boundary is " + "true. Default 8000. Keep it short — the user explicitly asked to " + "interrupt, so a long in-flight tool shouldn't ghost them; the cap " + "trades a tiny risk of a mid-tool C-c for a guaranteed response.")
   }).optional().describe("Interrupt timing — how a `!`-prefix interrupt behaves when it lands " + "mid-tool-call. Off by default (fire immediately). Cascades from " + "defaults.channels.telegram.interrupt."),
-  webhook_sources: exports_external.array(exports_external.enum(["github", "generic"])).optional().describe("External webhook sources allowed to ingest events into this agent's " + "log. POST /webhook/<agent>/<source> on the switchroom web server. " + "Each source has its own signature verification ('github' = " + "X-Hub-Signature-256 HMAC-SHA256, 'generic' = Bearer token). " + "Per-source secret read from ~/.switchroom/webhook-secrets.json " + "keyed by [agent][source]. Verified events append to " + "<agent>/telegram/webhook-events.jsonl for the agent to read on " + "demand. Off by default — webhook is the only untrusted-inbound " + "surface in the system, so opt-in is mandatory. " + "Cascades from defaults.channels.telegram.webhook_sources. " + "(Migrated from per-agent root in #596 — see #577.)"),
+  webhook_sources: exports_external.array(exports_external.enum(["github", "generic", "linear"])).optional().describe("External webhook sources allowed to ingest events into this agent's " + "log. POST /webhook/<agent>/<source> on the switchroom web server. " + "Each source has its own signature verification ('github' = " + "X-Hub-Signature-256 HMAC-SHA256, 'generic' = Bearer token, " + "'linear' = Linear-Signature bare-hex HMAC-SHA256 of the raw body). " + "Per-source secret read from ~/.switchroom/webhook-secrets.json " + "keyed by [agent][source]. Verified events append to " + "<agent>/telegram/webhook-events.jsonl for the agent to read on " + "demand. Off by default — webhook is the only untrusted-inbound " + "surface in the system, so opt-in is mandatory. " + "Cascades from defaults.channels.telegram.webhook_sources. " + "(Migrated from per-agent root in #596 — see #577.)"),
   webhook_dispatch: exports_external.object({
-    github: exports_external.array(exports_external.object({
-      description: exports_external.string().optional(),
-      match: exports_external.object({
-        event: exports_external.string(),
-        actions: exports_external.array(exports_external.string()).optional(),
-        labels_any: exports_external.array(exports_external.string()).optional(),
-        labels_all: exports_external.array(exports_external.string()).optional(),
-        exclude_authors: exports_external.array(exports_external.string()).optional()
-      }).passthrough(),
-      prompt: exports_external.string(),
-      cooldown: exports_external.string().optional(),
-      quiet_hours: exports_external.object({
-        start: exports_external.number().int().min(0).max(23),
-        end: exports_external.number().int().min(0).max(23),
-        tz: exports_external.string().optional()
-      }).optional()
-    })).optional()
-  }).optional().describe("Auto-dispatch rules: when a verified webhook event matches a rule, " + "inject the rendered prompt into the agent's live session (#1625). " + "Supports cooldowns, quiet hours, and label/action matchers. " + "Off by default — opt in per agent. See src/web/webhook-dispatch.ts."),
+    github: exports_external.array(webhookDispatchRule).optional(),
+    generic: exports_external.array(webhookDispatchRule).optional(),
+    linear: exports_external.array(webhookDispatchRule).optional()
+  }).optional().describe("Auto-dispatch rules: when a verified webhook event matches a rule, " + "inject the rendered prompt into the agent's live session (#1625). " + "Rules are keyed by source — 'github', 'generic', or 'linear' (#2272). " + "Supports cooldowns, quiet hours, label/action matchers, and (for " + "linear/generic) assignee_any / mentions_any matchers. " + "Off by default — opt in per agent. See src/web/webhook-dispatch.ts."),
   webhook_rate_limit: exports_external.object({
     rpm: exports_external.number().int().positive()
   }).optional().describe("Per-source rate limit for the webhook ingest path (#714). " + "Off by default — when this key is absent the handler skips " + "rate-limit checks entirely. Opt in by setting `rpm` to an " + "integer requests-per-minute (token bucket per (agent, source); " + "burst equal to rpm). When enabled, exceeding the limit returns " + "429 with Retry-After header; first throttle event per " + "(agent, source) per 60s window is written to " + "<agent>/telegram/issues.jsonl. " + "Cascades from defaults.channels.telegram.webhook_rate_limit."),
@@ -14048,7 +14053,7 @@ var AgentSchema = exports_external.object({
   purpose: exports_external.string().max(140).optional().describe("One-line description of what this agent does (≤140 chars). Shown to " + "peer agents when they call the agent-config MCP `peers_list` tool, so " + "every agent on the instance can answer 'is there an agent that does X' " + "without baking the fleet into prompts. Sourced live from " + "switchroom.yaml — never memorized into Hindsight. Falls back to " + "`topic_name` when absent."),
   role: exports_external.enum(["assistant", "foreman"]).optional().describe("Agent role. Default (omitted) is `assistant` — a fleet agent doing " + "user-facing tasks. `foreman` opts the agent in to switchroom's bundled " + "operator skills (switchroom-architecture / cli / health / install / manage " + "/ status), auto-symlinked into the agent's .claude/skills/ on scaffold and " + "reconcile. Fleet agents (assistant role) get no operator skills; reconcile " + "actively retracts them if the role flips back. See docs/skills.md for the model."),
   topic_id: exports_external.number().optional().describe("Telegram topic thread ID (auto-populated by switchroom topics sync)"),
-  webhook_sources: exports_external.array(exports_external.enum(["github", "generic"])).optional().describe("[DEPRECATED — moved to channels.telegram.webhook_sources in #596] " + "Old per-agent location. Still read but logs a deprecation warning. " + "See channels.telegram.webhook_sources for the canonical spot."),
+  webhook_sources: exports_external.array(exports_external.enum(["github", "generic", "linear"])).optional().describe("[DEPRECATED — moved to channels.telegram.webhook_sources in #596] " + "Old per-agent location. Still read but logs a deprecation warning. " + "See channels.telegram.webhook_sources for the canonical spot."),
   voice_in: exports_external.object({
     enabled: exports_external.boolean().optional(),
     provider: exports_external.enum(["openai"]).optional(),

package/dist/vault/approvals/kernel-server.js

@@ -11277,7 +11277,7 @@ var init_dist = __esm(() => {
 });
 
 // src/config/schema.ts
-var CodeRepoEntrySchema, AgentBindMountSchema, HttpDiffPollSchema, TelegramReactionsPollSchema, PollSpecSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, TelegramChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleWorkspaceConfigSchema, MicrosoftWorkspaceConfigSchema, NotionWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, AgentMicrosoftWorkspaceConfigSchema, AgentNotionWorkspaceConfigSchema, ReactionsSchema, ReleaseBlock, NetworkIsolationSchema, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, WebServiceConfigSchema, HostdConfigSchema, CronEgressSchema, CronConfigSchema, SwitchroomConfigSchema;
+var CodeRepoEntrySchema, AgentBindMountSchema, HttpDiffPollSchema, TelegramReactionsPollSchema, PollSpecSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, webhookDispatchRule, TelegramChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleWorkspaceConfigSchema, MicrosoftWorkspaceConfigSchema, NotionWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, AgentMicrosoftWorkspaceConfigSchema, AgentNotionWorkspaceConfigSchema, ReactionsSchema, ReleaseBlock, NetworkIsolationSchema, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, WebServiceConfigSchema, HostdConfigSchema, CronEgressSchema, CronConfigSchema, SwitchroomConfigSchema;
 var init_schema = __esm(() => {
   init_zod();
   CodeRepoEntrySchema = exports_external.object({
@@ -11403,6 +11403,25 @@ var init_schema = __esm(() => {
     resume_mode: exports_external.enum(["auto", "continue", "handoff", "none"]).optional().describe("How to resume the next session. 'handoff' (default as of #362) " + "never passes --continue; a fresh Claude starts each restart and " + "reads a briefing assembled from recent Telegram messages, Hindsight " + "recall, and today's daily memory file. 'auto' uses --continue when " + "the latest JSONL is smaller than resume_max_bytes, else falls back " + "to the handoff briefing. 'continue' always passes --continue. " + "'none' starts completely fresh every time."),
     resume_max_bytes: exports_external.number().int().positive().optional().describe("Byte threshold above which 'auto' mode falls back to handoff " + "instead of --continue. Default 2_000_000 (~2MB). Large transcripts " + "can blow out the context window even with prefix caching, and " + "--continue replay is known-fragile at scale.")
   }).optional();
+  webhookDispatchRule = exports_external.object({
+    description: exports_external.string().optional(),
+    match: exports_external.object({
+      event: exports_external.string(),
+      actions: exports_external.array(exports_external.string()).optional(),
+      labels_any: exports_external.array(exports_external.string()).optional(),
+      labels_all: exports_external.array(exports_external.string()).optional(),
+      exclude_authors: exports_external.array(exports_external.string()).optional(),
+      assignee_any: exports_external.array(exports_external.string()).optional(),
+      mentions_any: exports_external.array(exports_external.string()).optional()
+    }).passthrough(),
+    prompt: exports_external.string(),
+    cooldown: exports_external.string().optional(),
+    quiet_hours: exports_external.object({
+      start: exports_external.number().int().min(0).max(23),
+      end: exports_external.number().int().min(0).max(23),
+      tz: exports_external.string().optional()
+    }).optional()
+  });
   TelegramChannelSchema = exports_external.object({
     enabled: exports_external.boolean().default(true).describe("Master switch for the per-agent Telegram gateway sidecar. " + "When false, start.sh skips the gateway supervise loop and the " + "agent boots without bot-token requirements (smoke-test + " + "offline-dev use case)."),
     plugin: exports_external.enum(["switchroom", "official"]).optional().describe("Which Telegram MCP plugin to load. Default is 'switchroom' — the " + "enhanced fork with streaming edits, reactions, history, and " + "access control. Set to 'official' for the upstream marketplace " + "plugin (basic send/receive only)."),
@@ -11438,26 +11457,12 @@ var init_schema = __esm(() => {
       safe_boundary: exports_external.boolean().optional().describe("When true (the default), a `!`-prefix interrupt that arrives while " + "the agent is mid-tool-call is DEFERRED: the SIGINT and the " + "replacement turn wait until the in-flight tool call finishes (a " + "clean boundary) instead of C-c'ing the agent mid-write/mid-bash. If " + "no tool is in flight the interrupt still fires immediately. Bounded " + "by max_wait_ms so a long tool never strands the user. Set false to " + "fire synchronously the moment `!` is received (historical " + "behaviour). Rapid repeated `!` while one is pending coalesce into a " + "single deferred interrupt carrying the latest body."),
       max_wait_ms: exports_external.number().int().positive().optional().describe("Upper bound (ms) the gateway waits for a safe boundary before firing " + "a deferred `!` interrupt anyway. Only consulted when safe_boundary is " + "true. Default 8000. Keep it short — the user explicitly asked to " + "interrupt, so a long in-flight tool shouldn't ghost them; the cap " + "trades a tiny risk of a mid-tool C-c for a guaranteed response.")
     }).optional().describe("Interrupt timing — how a `!`-prefix interrupt behaves when it lands " + "mid-tool-call. Off by default (fire immediately). Cascades from " + "defaults.channels.telegram.interrupt."),
-    webhook_sources: exports_external.array(exports_external.enum(["github", "generic"])).optional().describe("External webhook sources allowed to ingest events into this agent's " + "log. POST /webhook/<agent>/<source> on the switchroom web server. " + "Each source has its own signature verification ('github' = " + "X-Hub-Signature-256 HMAC-SHA256, 'generic' = Bearer token). " + "Per-source secret read from ~/.switchroom/webhook-secrets.json " + "keyed by [agent][source]. Verified events append to " + "<agent>/telegram/webhook-events.jsonl for the agent to read on " + "demand. Off by default — webhook is the only untrusted-inbound " + "surface in the system, so opt-in is mandatory. " + "Cascades from defaults.channels.telegram.webhook_sources. " + "(Migrated from per-agent root in #596 — see #577.)"),
+    webhook_sources: exports_external.array(exports_external.enum(["github", "generic", "linear"])).optional().describe("External webhook sources allowed to ingest events into this agent's " + "log. POST /webhook/<agent>/<source> on the switchroom web server. " + "Each source has its own signature verification ('github' = " + "X-Hub-Signature-256 HMAC-SHA256, 'generic' = Bearer token, " + "'linear' = Linear-Signature bare-hex HMAC-SHA256 of the raw body). " + "Per-source secret read from ~/.switchroom/webhook-secrets.json " + "keyed by [agent][source]. Verified events append to " + "<agent>/telegram/webhook-events.jsonl for the agent to read on " + "demand. Off by default — webhook is the only untrusted-inbound " + "surface in the system, so opt-in is mandatory. " + "Cascades from defaults.channels.telegram.webhook_sources. " + "(Migrated from per-agent root in #596 — see #577.)"),
     webhook_dispatch: exports_external.object({
-      github: exports_external.array(exports_external.object({
-        description: exports_external.string().optional(),
-        match: exports_external.object({
-          event: exports_external.string(),
-          actions: exports_external.array(exports_external.string()).optional(),
-          labels_any: exports_external.array(exports_external.string()).optional(),
-          labels_all: exports_external.array(exports_external.string()).optional(),
-          exclude_authors: exports_external.array(exports_external.string()).optional()
-        }).passthrough(),
-        prompt: exports_external.string(),
-        cooldown: exports_external.string().optional(),
-        quiet_hours: exports_external.object({
-          start: exports_external.number().int().min(0).max(23),
-          end: exports_external.number().int().min(0).max(23),
-          tz: exports_external.string().optional()
-        }).optional()
-      })).optional()
-    }).optional().describe("Auto-dispatch rules: when a verified webhook event matches a rule, " + "inject the rendered prompt into the agent's live session (#1625). " + "Supports cooldowns, quiet hours, and label/action matchers. " + "Off by default — opt in per agent. See src/web/webhook-dispatch.ts."),
+      github: exports_external.array(webhookDispatchRule).optional(),
+      generic: exports_external.array(webhookDispatchRule).optional(),
+      linear: exports_external.array(webhookDispatchRule).optional()
+    }).optional().describe("Auto-dispatch rules: when a verified webhook event matches a rule, " + "inject the rendered prompt into the agent's live session (#1625). " + "Rules are keyed by source — 'github', 'generic', or 'linear' (#2272). " + "Supports cooldowns, quiet hours, label/action matchers, and (for " + "linear/generic) assignee_any / mentions_any matchers. " + "Off by default — opt in per agent. See src/web/webhook-dispatch.ts."),
     webhook_rate_limit: exports_external.object({
       rpm: exports_external.number().int().positive()
     }).optional().describe("Per-source rate limit for the webhook ingest path (#714). " + "Off by default — when this key is absent the handler skips " + "rate-limit checks entirely. Opt in by setting `rpm` to an " + "integer requests-per-minute (token bucket per (agent, source); " + "burst equal to rpm). When enabled, exceeding the limit returns " + "429 with Retry-After header; first throttle event per " + "(agent, source) per 60s window is written to " + "<agent>/telegram/issues.jsonl. " + "Cascades from defaults.channels.telegram.webhook_rate_limit."),
@@ -11634,7 +11639,7 @@ var init_schema = __esm(() => {
     purpose: exports_external.string().max(140).optional().describe("One-line description of what this agent does (≤140 chars). Shown to " + "peer agents when they call the agent-config MCP `peers_list` tool, so " + "every agent on the instance can answer 'is there an agent that does X' " + "without baking the fleet into prompts. Sourced live from " + "switchroom.yaml — never memorized into Hindsight. Falls back to " + "`topic_name` when absent."),
     role: exports_external.enum(["assistant", "foreman"]).optional().describe("Agent role. Default (omitted) is `assistant` — a fleet agent doing " + "user-facing tasks. `foreman` opts the agent in to switchroom's bundled " + "operator skills (switchroom-architecture / cli / health / install / manage " + "/ status), auto-symlinked into the agent's .claude/skills/ on scaffold and " + "reconcile. Fleet agents (assistant role) get no operator skills; reconcile " + "actively retracts them if the role flips back. See docs/skills.md for the model."),
     topic_id: exports_external.number().optional().describe("Telegram topic thread ID (auto-populated by switchroom topics sync)"),
-    webhook_sources: exports_external.array(exports_external.enum(["github", "generic"])).optional().describe("[DEPRECATED — moved to channels.telegram.webhook_sources in #596] " + "Old per-agent location. Still read but logs a deprecation warning. " + "See channels.telegram.webhook_sources for the canonical spot."),
+    webhook_sources: exports_external.array(exports_external.enum(["github", "generic", "linear"])).optional().describe("[DEPRECATED — moved to channels.telegram.webhook_sources in #596] " + "Old per-agent location. Still read but logs a deprecation warning. " + "See channels.telegram.webhook_sources for the canonical spot."),
     voice_in: exports_external.object({
       enabled: exports_external.boolean().optional(),
       provider: exports_external.enum(["openai"]).optional(),

package/dist/vault/broker/server.js

@@ -11277,7 +11277,7 @@ var init_zod = __esm(() => {
 });
 
 // src/config/schema.ts
-var CodeRepoEntrySchema, AgentBindMountSchema, HttpDiffPollSchema, TelegramReactionsPollSchema, PollSpecSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, TelegramChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleWorkspaceConfigSchema, MicrosoftWorkspaceConfigSchema, NotionWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, AgentMicrosoftWorkspaceConfigSchema, AgentNotionWorkspaceConfigSchema, ReactionsSchema, ReleaseBlock, NetworkIsolationSchema, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, WebServiceConfigSchema, HostdConfigSchema, CronEgressSchema, CronConfigSchema, SwitchroomConfigSchema;
+var CodeRepoEntrySchema, AgentBindMountSchema, HttpDiffPollSchema, TelegramReactionsPollSchema, PollSpecSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, webhookDispatchRule, TelegramChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleWorkspaceConfigSchema, MicrosoftWorkspaceConfigSchema, NotionWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, AgentMicrosoftWorkspaceConfigSchema, AgentNotionWorkspaceConfigSchema, ReactionsSchema, ReleaseBlock, NetworkIsolationSchema, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, WebServiceConfigSchema, HostdConfigSchema, CronEgressSchema, CronConfigSchema, SwitchroomConfigSchema;
 var init_schema = __esm(() => {
   init_zod();
   CodeRepoEntrySchema = exports_external.object({
@@ -11403,6 +11403,25 @@ var init_schema = __esm(() => {
     resume_mode: exports_external.enum(["auto", "continue", "handoff", "none"]).optional().describe("How to resume the next session. 'handoff' (default as of #362) " + "never passes --continue; a fresh Claude starts each restart and " + "reads a briefing assembled from recent Telegram messages, Hindsight " + "recall, and today's daily memory file. 'auto' uses --continue when " + "the latest JSONL is smaller than resume_max_bytes, else falls back " + "to the handoff briefing. 'continue' always passes --continue. " + "'none' starts completely fresh every time."),
     resume_max_bytes: exports_external.number().int().positive().optional().describe("Byte threshold above which 'auto' mode falls back to handoff " + "instead of --continue. Default 2_000_000 (~2MB). Large transcripts " + "can blow out the context window even with prefix caching, and " + "--continue replay is known-fragile at scale.")
   }).optional();
+  webhookDispatchRule = exports_external.object({
+    description: exports_external.string().optional(),
+    match: exports_external.object({
+      event: exports_external.string(),
+      actions: exports_external.array(exports_external.string()).optional(),
+      labels_any: exports_external.array(exports_external.string()).optional(),
+      labels_all: exports_external.array(exports_external.string()).optional(),
+      exclude_authors: exports_external.array(exports_external.string()).optional(),
+      assignee_any: exports_external.array(exports_external.string()).optional(),
+      mentions_any: exports_external.array(exports_external.string()).optional()
+    }).passthrough(),
+    prompt: exports_external.string(),
+    cooldown: exports_external.string().optional(),
+    quiet_hours: exports_external.object({
+      start: exports_external.number().int().min(0).max(23),
+      end: exports_external.number().int().min(0).max(23),
+      tz: exports_external.string().optional()
+    }).optional()
+  });
   TelegramChannelSchema = exports_external.object({
     enabled: exports_external.boolean().default(true).describe("Master switch for the per-agent Telegram gateway sidecar. " + "When false, start.sh skips the gateway supervise loop and the " + "agent boots without bot-token requirements (smoke-test + " + "offline-dev use case)."),
     plugin: exports_external.enum(["switchroom", "official"]).optional().describe("Which Telegram MCP plugin to load. Default is 'switchroom' — the " + "enhanced fork with streaming edits, reactions, history, and " + "access control. Set to 'official' for the upstream marketplace " + "plugin (basic send/receive only)."),
@@ -11438,26 +11457,12 @@ var init_schema = __esm(() => {
       safe_boundary: exports_external.boolean().optional().describe("When true (the default), a `!`-prefix interrupt that arrives while " + "the agent is mid-tool-call is DEFERRED: the SIGINT and the " + "replacement turn wait until the in-flight tool call finishes (a " + "clean boundary) instead of C-c'ing the agent mid-write/mid-bash. If " + "no tool is in flight the interrupt still fires immediately. Bounded " + "by max_wait_ms so a long tool never strands the user. Set false to " + "fire synchronously the moment `!` is received (historical " + "behaviour). Rapid repeated `!` while one is pending coalesce into a " + "single deferred interrupt carrying the latest body."),
       max_wait_ms: exports_external.number().int().positive().optional().describe("Upper bound (ms) the gateway waits for a safe boundary before firing " + "a deferred `!` interrupt anyway. Only consulted when safe_boundary is " + "true. Default 8000. Keep it short — the user explicitly asked to " + "interrupt, so a long in-flight tool shouldn't ghost them; the cap " + "trades a tiny risk of a mid-tool C-c for a guaranteed response.")
     }).optional().describe("Interrupt timing — how a `!`-prefix interrupt behaves when it lands " + "mid-tool-call. Off by default (fire immediately). Cascades from " + "defaults.channels.telegram.interrupt."),
-    webhook_sources: exports_external.array(exports_external.enum(["github", "generic"])).optional().describe("External webhook sources allowed to ingest events into this agent's " + "log. POST /webhook/<agent>/<source> on the switchroom web server. " + "Each source has its own signature verification ('github' = " + "X-Hub-Signature-256 HMAC-SHA256, 'generic' = Bearer token). " + "Per-source secret read from ~/.switchroom/webhook-secrets.json " + "keyed by [agent][source]. Verified events append to " + "<agent>/telegram/webhook-events.jsonl for the agent to read on " + "demand. Off by default — webhook is the only untrusted-inbound " + "surface in the system, so opt-in is mandatory. " + "Cascades from defaults.channels.telegram.webhook_sources. " + "(Migrated from per-agent root in #596 — see #577.)"),
+    webhook_sources: exports_external.array(exports_external.enum(["github", "generic", "linear"])).optional().describe("External webhook sources allowed to ingest events into this agent's " + "log. POST /webhook/<agent>/<source> on the switchroom web server. " + "Each source has its own signature verification ('github' = " + "X-Hub-Signature-256 HMAC-SHA256, 'generic' = Bearer token, " + "'linear' = Linear-Signature bare-hex HMAC-SHA256 of the raw body). " + "Per-source secret read from ~/.switchroom/webhook-secrets.json " + "keyed by [agent][source]. Verified events append to " + "<agent>/telegram/webhook-events.jsonl for the agent to read on " + "demand. Off by default — webhook is the only untrusted-inbound " + "surface in the system, so opt-in is mandatory. " + "Cascades from defaults.channels.telegram.webhook_sources. " + "(Migrated from per-agent root in #596 — see #577.)"),
     webhook_dispatch: exports_external.object({
-      github: exports_external.array(exports_external.object({
-        description: exports_external.string().optional(),
-        match: exports_external.object({
-          event: exports_external.string(),
-          actions: exports_external.array(exports_external.string()).optional(),
-          labels_any: exports_external.array(exports_external.string()).optional(),
-          labels_all: exports_external.array(exports_external.string()).optional(),
-          exclude_authors: exports_external.array(exports_external.string()).optional()
-        }).passthrough(),
-        prompt: exports_external.string(),
-        cooldown: exports_external.string().optional(),
-        quiet_hours: exports_external.object({
-          start: exports_external.number().int().min(0).max(23),
-          end: exports_external.number().int().min(0).max(23),
-          tz: exports_external.string().optional()
-        }).optional()
-      })).optional()
-    }).optional().describe("Auto-dispatch rules: when a verified webhook event matches a rule, " + "inject the rendered prompt into the agent's live session (#1625). " + "Supports cooldowns, quiet hours, and label/action matchers. " + "Off by default — opt in per agent. See src/web/webhook-dispatch.ts."),
+      github: exports_external.array(webhookDispatchRule).optional(),
+      generic: exports_external.array(webhookDispatchRule).optional(),
+      linear: exports_external.array(webhookDispatchRule).optional()
+    }).optional().describe("Auto-dispatch rules: when a verified webhook event matches a rule, " + "inject the rendered prompt into the agent's live session (#1625). " + "Rules are keyed by source — 'github', 'generic', or 'linear' (#2272). " + "Supports cooldowns, quiet hours, label/action matchers, and (for " + "linear/generic) assignee_any / mentions_any matchers. " + "Off by default — opt in per agent. See src/web/webhook-dispatch.ts."),
     webhook_rate_limit: exports_external.object({
       rpm: exports_external.number().int().positive()
     }).optional().describe("Per-source rate limit for the webhook ingest path (#714). " + "Off by default — when this key is absent the handler skips " + "rate-limit checks entirely. Opt in by setting `rpm` to an " + "integer requests-per-minute (token bucket per (agent, source); " + "burst equal to rpm). When enabled, exceeding the limit returns " + "429 with Retry-After header; first throttle event per " + "(agent, source) per 60s window is written to " + "<agent>/telegram/issues.jsonl. " + "Cascades from defaults.channels.telegram.webhook_rate_limit."),
@@ -11634,7 +11639,7 @@ var init_schema = __esm(() => {
     purpose: exports_external.string().max(140).optional().describe("One-line description of what this agent does (≤140 chars). Shown to " + "peer agents when they call the agent-config MCP `peers_list` tool, so " + "every agent on the instance can answer 'is there an agent that does X' " + "without baking the fleet into prompts. Sourced live from " + "switchroom.yaml — never memorized into Hindsight. Falls back to " + "`topic_name` when absent."),
     role: exports_external.enum(["assistant", "foreman"]).optional().describe("Agent role. Default (omitted) is `assistant` — a fleet agent doing " + "user-facing tasks. `foreman` opts the agent in to switchroom's bundled " + "operator skills (switchroom-architecture / cli / health / install / manage " + "/ status), auto-symlinked into the agent's .claude/skills/ on scaffold and " + "reconcile. Fleet agents (assistant role) get no operator skills; reconcile " + "actively retracts them if the role flips back. See docs/skills.md for the model."),
     topic_id: exports_external.number().optional().describe("Telegram topic thread ID (auto-populated by switchroom topics sync)"),
-    webhook_sources: exports_external.array(exports_external.enum(["github", "generic"])).optional().describe("[DEPRECATED — moved to channels.telegram.webhook_sources in #596] " + "Old per-agent location. Still read but logs a deprecation warning. " + "See channels.telegram.webhook_sources for the canonical spot."),
+    webhook_sources: exports_external.array(exports_external.enum(["github", "generic", "linear"])).optional().describe("[DEPRECATED — moved to channels.telegram.webhook_sources in #596] " + "Old per-agent location. Still read but logs a deprecation warning. " + "See channels.telegram.webhook_sources for the canonical spot."),
     voice_in: exports_external.object({
       enabled: exports_external.boolean().optional(),
       provider: exports_external.enum(["openai"]).optional(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchroom",
-  "version": "0.15.5",
+  "version": "0.15.7",
   "description": "Run Claude Code 24/7 on your Claude Pro/Max subscription over Telegram. Open-source alternative to OpenClaw and NanoClaw — no API keys.",
   "type": "module",
   "bin": {

package/telegram-plugin/dist/gateway/gateway.js

@@ -23802,7 +23802,7 @@ var init_dist = __esm(() => {
 });
 
 // ../src/config/schema.ts
-var CodeRepoEntrySchema, AgentBindMountSchema, HttpDiffPollSchema, TelegramReactionsPollSchema, PollSpecSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, TelegramChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleWorkspaceConfigSchema, MicrosoftWorkspaceConfigSchema, NotionWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, AgentMicrosoftWorkspaceConfigSchema, AgentNotionWorkspaceConfigSchema, ReactionsSchema, ReleaseBlock, NetworkIsolationSchema, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, WebServiceConfigSchema, HostdConfigSchema, CronEgressSchema, CronConfigSchema, SwitchroomConfigSchema;
+var CodeRepoEntrySchema, AgentBindMountSchema, HttpDiffPollSchema, TelegramReactionsPollSchema, PollSpecSchema, ScheduleEntrySchema, AgentSoulSchema, AgentToolsSchema, AgentMemorySchema, HookEntrySchema, AgentHooksSchema, SubagentSchema, SessionSchema, SessionContinuitySchema, webhookDispatchRule, TelegramChannelSchema, ChannelsSchema, TIMEZONE_REGEX, ApproverIdSchema, GoogleWorkspaceTierSchema, GoogleWorkspaceConfigSchema, MicrosoftWorkspaceConfigSchema, NotionWorkspaceConfigSchema, AgentGoogleWorkspaceConfigSchema, AgentMicrosoftWorkspaceConfigSchema, AgentNotionWorkspaceConfigSchema, ReactionsSchema, ReleaseBlock, NetworkIsolationSchema, profileFields, ProfileSchema, _omitExtends, defaultsFields, AgentDefaultsSchema, AgentSchema, TelegramConfigSchema, MemoryBackendConfigSchema, VaultConfigSchema, QuotaConfigSchema, AutoReleaseCheckSchema, HostControlConfigSchema, WebServiceConfigSchema, HostdConfigSchema, CronEgressSchema, CronConfigSchema, SwitchroomConfigSchema;
 var init_schema = __esm(() => {
   init_zod();
   CodeRepoEntrySchema = exports_external.object({
@@ -23928,6 +23928,25 @@ var init_schema = __esm(() => {
     resume_mode: exports_external.enum(["auto", "continue", "handoff", "none"]).optional().describe("How to resume the next session. 'handoff' (default as of #362) " + "never passes --continue; a fresh Claude starts each restart and " + "reads a briefing assembled from recent Telegram messages, Hindsight " + "recall, and today's daily memory file. 'auto' uses --continue when " + "the latest JSONL is smaller than resume_max_bytes, else falls back " + "to the handoff briefing. 'continue' always passes --continue. " + "'none' starts completely fresh every time."),
     resume_max_bytes: exports_external.number().int().positive().optional().describe("Byte threshold above which 'auto' mode falls back to handoff " + "instead of --continue. Default 2_000_000 (~2MB). Large transcripts " + "can blow out the context window even with prefix caching, and " + "--continue replay is known-fragile at scale.")
   }).optional();
+  webhookDispatchRule = exports_external.object({
+    description: exports_external.string().optional(),
+    match: exports_external.object({
+      event: exports_external.string(),
+      actions: exports_external.array(exports_external.string()).optional(),
+      labels_any: exports_external.array(exports_external.string()).optional(),
+      labels_all: exports_external.array(exports_external.string()).optional(),
+      exclude_authors: exports_external.array(exports_external.string()).optional(),
+      assignee_any: exports_external.array(exports_external.string()).optional(),
+      mentions_any: exports_external.array(exports_external.string()).optional()
+    }).passthrough(),
+    prompt: exports_external.string(),
+    cooldown: exports_external.string().optional(),
+    quiet_hours: exports_external.object({
+      start: exports_external.number().int().min(0).max(23),
+      end: exports_external.number().int().min(0).max(23),
+      tz: exports_external.string().optional()
+    }).optional()
+  });
   TelegramChannelSchema = exports_external.object({
     enabled: exports_external.boolean().default(true).describe("Master switch for the per-agent Telegram gateway sidecar. " + "When false, start.sh skips the gateway supervise loop and the " + "agent boots without bot-token requirements (smoke-test + " + "offline-dev use case)."),
     plugin: exports_external.enum(["switchroom", "official"]).optional().describe("Which Telegram MCP plugin to load. Default is 'switchroom' \u2014 the " + "enhanced fork with streaming edits, reactions, history, and " + "access control. Set to 'official' for the upstream marketplace " + "plugin (basic send/receive only)."),
@@ -23963,26 +23982,12 @@ var init_schema = __esm(() => {
       safe_boundary: exports_external.boolean().optional().describe("When true (the default), a `!`-prefix interrupt that arrives while " + "the agent is mid-tool-call is DEFERRED: the SIGINT and the " + "replacement turn wait until the in-flight tool call finishes (a " + "clean boundary) instead of C-c'ing the agent mid-write/mid-bash. If " + "no tool is in flight the interrupt still fires immediately. Bounded " + "by max_wait_ms so a long tool never strands the user. Set false to " + "fire synchronously the moment `!` is received (historical " + "behaviour). Rapid repeated `!` while one is pending coalesce into a " + "single deferred interrupt carrying the latest body."),
       max_wait_ms: exports_external.number().int().positive().optional().describe("Upper bound (ms) the gateway waits for a safe boundary before firing " + "a deferred `!` interrupt anyway. Only consulted when safe_boundary is " + "true. Default 8000. Keep it short \u2014 the user explicitly asked to " + "interrupt, so a long in-flight tool shouldn't ghost them; the cap " + "trades a tiny risk of a mid-tool C-c for a guaranteed response.")
     }).optional().describe("Interrupt timing \u2014 how a `!`-prefix interrupt behaves when it lands " + "mid-tool-call. Off by default (fire immediately). Cascades from " + "defaults.channels.telegram.interrupt."),
-    webhook_sources: exports_external.array(exports_external.enum(["github", "generic"])).optional().describe("External webhook sources allowed to ingest events into this agent's " + "log. POST /webhook/<agent>/<source> on the switchroom web server. " + "Each source has its own signature verification ('github' = " + "X-Hub-Signature-256 HMAC-SHA256, 'generic' = Bearer token). " + "Per-source secret read from ~/.switchroom/webhook-secrets.json " + "keyed by [agent][source]. Verified events append to " + "<agent>/telegram/webhook-events.jsonl for the agent to read on " + "demand. Off by default \u2014 webhook is the only untrusted-inbound " + "surface in the system, so opt-in is mandatory. " + "Cascades from defaults.channels.telegram.webhook_sources. " + "(Migrated from per-agent root in #596 \u2014 see #577.)"),
+    webhook_sources: exports_external.array(exports_external.enum(["github", "generic", "linear"])).optional().describe("External webhook sources allowed to ingest events into this agent's " + "log. POST /webhook/<agent>/<source> on the switchroom web server. " + "Each source has its own signature verification ('github' = " + "X-Hub-Signature-256 HMAC-SHA256, 'generic' = Bearer token, " + "'linear' = Linear-Signature bare-hex HMAC-SHA256 of the raw body). " + "Per-source secret read from ~/.switchroom/webhook-secrets.json " + "keyed by [agent][source]. Verified events append to " + "<agent>/telegram/webhook-events.jsonl for the agent to read on " + "demand. Off by default \u2014 webhook is the only untrusted-inbound " + "surface in the system, so opt-in is mandatory. " + "Cascades from defaults.channels.telegram.webhook_sources. " + "(Migrated from per-agent root in #596 \u2014 see #577.)"),
     webhook_dispatch: exports_external.object({
-      github: exports_external.array(exports_external.object({
-        description: exports_external.string().optional(),
-        match: exports_external.object({
-          event: exports_external.string(),
-          actions: exports_external.array(exports_external.string()).optional(),
-          labels_any: exports_external.array(exports_external.string()).optional(),
-          labels_all: exports_external.array(exports_external.string()).optional(),
-          exclude_authors: exports_external.array(exports_external.string()).optional()
-        }).passthrough(),
-        prompt: exports_external.string(),
-        cooldown: exports_external.string().optional(),
-        quiet_hours: exports_external.object({
-          start: exports_external.number().int().min(0).max(23),
-          end: exports_external.number().int().min(0).max(23),
-          tz: exports_external.string().optional()
-        }).optional()
-      })).optional()
-    }).optional().describe("Auto-dispatch rules: when a verified webhook event matches a rule, " + "inject the rendered prompt into the agent's live session (#1625). " + "Supports cooldowns, quiet hours, and label/action matchers. " + "Off by default \u2014 opt in per agent. See src/web/webhook-dispatch.ts."),
+      github: exports_external.array(webhookDispatchRule).optional(),
+      generic: exports_external.array(webhookDispatchRule).optional(),
+      linear: exports_external.array(webhookDispatchRule).optional()
+    }).optional().describe("Auto-dispatch rules: when a verified webhook event matches a rule, " + "inject the rendered prompt into the agent's live session (#1625). " + "Rules are keyed by source \u2014 'github', 'generic', or 'linear' (#2272). " + "Supports cooldowns, quiet hours, label/action matchers, and (for " + "linear/generic) assignee_any / mentions_any matchers. " + "Off by default \u2014 opt in per agent. See src/web/webhook-dispatch.ts."),
     webhook_rate_limit: exports_external.object({
       rpm: exports_external.number().int().positive()
     }).optional().describe("Per-source rate limit for the webhook ingest path (#714). " + "Off by default \u2014 when this key is absent the handler skips " + "rate-limit checks entirely. Opt in by setting `rpm` to an " + "integer requests-per-minute (token bucket per (agent, source); " + "burst equal to rpm). When enabled, exceeding the limit returns " + "429 with Retry-After header; first throttle event per " + "(agent, source) per 60s window is written to " + "<agent>/telegram/issues.jsonl. " + "Cascades from defaults.channels.telegram.webhook_rate_limit."),
@@ -24159,7 +24164,7 @@ var init_schema = __esm(() => {
     purpose: exports_external.string().max(140).optional().describe("One-line description of what this agent does (\u2264140 chars). Shown to " + "peer agents when they call the agent-config MCP `peers_list` tool, so " + "every agent on the instance can answer 'is there an agent that does X' " + "without baking the fleet into prompts. Sourced live from " + "switchroom.yaml \u2014 never memorized into Hindsight. Falls back to " + "`topic_name` when absent."),
     role: exports_external.enum(["assistant", "foreman"]).optional().describe("Agent role. Default (omitted) is `assistant` \u2014 a fleet agent doing " + "user-facing tasks. `foreman` opts the agent in to switchroom's bundled " + "operator skills (switchroom-architecture / cli / health / install / manage " + "/ status), auto-symlinked into the agent's .claude/skills/ on scaffold and " + "reconcile. Fleet agents (assistant role) get no operator skills; reconcile " + "actively retracts them if the role flips back. See docs/skills.md for the model."),
     topic_id: exports_external.number().optional().describe("Telegram topic thread ID (auto-populated by switchroom topics sync)"),
-    webhook_sources: exports_external.array(exports_external.enum(["github", "generic"])).optional().describe("[DEPRECATED \u2014 moved to channels.telegram.webhook_sources in #596] " + "Old per-agent location. Still read but logs a deprecation warning. " + "See channels.telegram.webhook_sources for the canonical spot."),
+    webhook_sources: exports_external.array(exports_external.enum(["github", "generic", "linear"])).optional().describe("[DEPRECATED \u2014 moved to channels.telegram.webhook_sources in #596] " + "Old per-agent location. Still read but logs a deprecation warning. " + "See channels.telegram.webhook_sources for the canonical spot."),
     voice_in: exports_external.object({
       enabled: exports_external.boolean().optional(),
       provider: exports_external.enum(["openai"]).optional(),
@@ -46718,6 +46723,7 @@ function createInjectIpcClient(options) {
 }
 
 // ../src/web/webhook-dispatch.ts
+var DISPATCH_SOURCES = ["github", "generic", "linear"];
 function renderTemplate(template, ctx) {
   return template.replace(/\{\{(\w+)\}\}/g, (_, key) => ctx[key] ?? "");
 }
@@ -46734,12 +46740,86 @@ function buildGithubContext(eventType, payload) {
   const rawLabels = obj?.labels ?? [];
   const labels = rawLabels.map((l) => String(l.name ?? "")).join(", ");
   const action = String(payload.action ?? "");
-  return { repo, number, title, html_url, author, labels, action, event: eventType };
+  const assignee = String(obj?.assignee?.login ?? "");
+  return {
+    repo,
+    number,
+    title,
+    html_url,
+    author,
+    labels,
+    action,
+    event: eventType,
+    assignee,
+    body: title
+  };
+}
+function buildLinearContext(eventType, payload) {
+  const data = payload.data ?? {};
+  const issue = data.issue ?? {};
+  const number = String(data.identifier ?? issue.identifier ?? "");
+  const title = String(data.title ?? issue.title ?? "");
+  const html_url = String(payload.url ?? "");
+  const action = String(payload.action ?? "");
+  const assignee = String(data.assignee?.displayName ?? data.assignee?.name ?? "");
+  const author = String(data.user?.displayName ?? data.user?.name ?? "");
+  const rawLabels = data.labels ?? [];
+  const labels = rawLabels.map((l) => String(l.name ?? "")).join(", ");
+  const commentBody = String(data.body ?? "");
+  const body = [title, commentBody].filter(Boolean).join(`
+`);
+  return {
+    repo: "linear",
+    number,
+    title,
+    html_url,
+    author,
+    labels,
+    action,
+    event: eventType,
+    assignee,
+    body
+  };
 }
-function matchesRule(eventType, payload, matcher) {
+function buildGenericContext(source, payload) {
+  const title = typeof payload.title === "string" ? payload.title : typeof payload.message === "string" ? payload.message : typeof payload.text === "string" ? payload.text : "";
+  const action = String(payload.action ?? "");
+  const html_url = typeof payload.url === "string" ? payload.url : "";
+  const number = String(payload.id ?? payload.number ?? "");
+  const author = String(payload.author ?? payload.user ?? "");
+  const assignee = String(payload.assignee ?? "");
+  const rawLabels = Array.isArray(payload.labels) ? payload.labels.map((l) => typeof l === "string" ? l : String(l?.name ?? "")) : [];
+  const labels = rawLabels.join(", ");
+  return {
+    repo: source,
+    number,
+    title,
+    html_url,
+    author,
+    labels,
+    action,
+    event: source,
+    assignee,
+    body: title
+  };
+}
+function buildContext(source, eventType, payload) {
+  switch (source) {
+    case "linear":
+      return buildLinearContext(eventType, payload);
+    case "generic":
+      return buildGenericContext(eventType, payload);
+    default:
+      return buildGithubContext(eventType, payload);
+  }
+}
+function labelSetFromContext(ctx) {
+  return new Set(ctx.labels.split(",").map((l) => l.trim()).filter(Boolean));
+}
+function matchesRule(source, eventType, payload, matcher) {
   if (matcher.event !== eventType)
     return false;
-  const ctx = buildGithubContext(eventType, payload);
+  const ctx = buildContext(source, eventType, payload);
   if (matcher.actions && matcher.actions.length > 0) {
     if (!matcher.actions.includes(ctx.action))
       return false;
@@ -46748,22 +46828,24 @@ function matchesRule(eventType, payload, matcher) {
     if (matcher.exclude_authors.includes(ctx.author))
       return false;
   }
+  if (matcher.assignee_any && matcher.assignee_any.length > 0) {
+    if (!matcher.assignee_any.includes(ctx.assignee))
+      return false;
+  }
+  if (matcher.mentions_any && matcher.mentions_any.length > 0) {
+    const hay = ctx.body.toLowerCase();
+    const hasMention = matcher.mentions_any.some((m) => hay.includes(m.toLowerCase()));
+    if (!hasMention)
+      return false;
+  }
   if (matcher.labels_any && matcher.labels_any.length > 0) {
-    const pr = payload.pull_request;
-    const issue = payload.issue;
-    const rawLabels = (pr ?? issue)?.labels ?? [];
-    const labelNames = new Set(rawLabels.map((l) => String(l.name ?? "")));
-    const hasAny = matcher.labels_any.some((l) => labelNames.has(l));
-    if (!hasAny)
+    const labelNames = labelSetFromContext(ctx);
+    if (!matcher.labels_any.some((l) => labelNames.has(l)))
       return false;
   }
   if (matcher.labels_all && matcher.labels_all.length > 0) {
-    const pr = payload.pull_request;
-    const issue = payload.issue;
-    const rawLabels = (pr ?? issue)?.labels ?? [];
-    const labelNames = new Set(rawLabels.map((l) => String(l.name ?? "")));
-    const hasAll = matcher.labels_all.every((l) => labelNames.has(l));
-    if (!hasAll)
+    const labelNames = labelSetFromContext(ctx);
+    if (!matcher.labels_all.every((l) => labelNames.has(l)))
       return false;
   }
   return true;
@@ -46786,8 +46868,8 @@ function parseDurationMs(d) {
       return n;
   }
 }
-function cooldownKey(eventType, repo, number, ruleIndex) {
-  return `${eventType}:${repo}:${number}:${ruleIndex}`;
+function cooldownKey(source, eventType, repo, number, ruleIndex) {
+  return `${source}:${eventType}:${repo}:${number}:${ruleIndex}`;
 }
 function loadCooldownFile(path) {
   try {
@@ -46899,16 +46981,16 @@ function evaluateDispatch(args, deps = {}) {
   const nowDate = deps.nowDate ?? (() => new Date(now));
   const resolveAgentDir = deps.resolveAgentDir ?? ((a) => join19(homedir9(), ".switchroom", "agents", a));
   const cooldownStore = deps.cooldownStore ?? createFileCooldownStore(resolveAgentDir);
-  if (args.source !== "github")
+  if (!DISPATCH_SOURCES.includes(args.source))
     return 0;
-  const rules = args.dispatchConfig.github;
+  const rules = args.dispatchConfig[args.source];
   if (!rules || rules.length === 0)
     return 0;
-  const ctx = buildGithubContext(args.eventType, args.payload);
+  const ctx = buildContext(args.source, args.eventType, args.payload);
   let fired = 0;
   for (let i = 0;i < rules.length; i++) {
     const rule = rules[i];
-    if (!matchesRule(args.eventType, args.payload, rule.match))
+    if (!matchesRule(args.source, args.eventType, args.payload, rule.match))
       continue;
     if (rule.quiet_hours && isQuietHour(rule.quiet_hours, nowDate())) {
       log(`webhook-dispatch: agent='${args.agent}' rule=${i} skipped (quiet hours)
@@ -46917,7 +46999,7 @@ function evaluateDispatch(args, deps = {}) {
     }
     const cooldownMs = rule.cooldown ? parseDurationMs(rule.cooldown) : 0;
     if (cooldownMs > 0) {
-      const ck = cooldownKey(args.eventType, ctx.repo, ctx.number, i);
+      const ck = cooldownKey(args.source, args.eventType, ctx.repo, ctx.number, i);
       if (cooldownStore.isCoolingDown(args.agent, ck, cooldownMs, now)) {
         log(`webhook-dispatch: agent='${args.agent}' rule=${i} skipped (cooldown)
 `);
@@ -47009,7 +47091,7 @@ function recordWebhookEvent(rec, deps = {}) {
     const config = (deps.loadConfig ?? loadConfig)();
     const rawAgent = config.agents?.[agent];
     const dispatchConfig = rawAgent ? resolveAgentConfig(config.defaults, config.profiles, rawAgent).channels?.telegram?.webhook_dispatch : undefined;
-    if (dispatchConfig && rec.source === "github") {
+    if (dispatchConfig && DISPATCH_SOURCES.includes(rec.source)) {
       const target = resolveChannelTarget(config, agent);
       if (!target) {
         log(`webhook-gateway: agent='${agent}' dispatch skipped \u2014 no chat target (forum_chat_id / chat_id unset)
@@ -53601,10 +53683,10 @@ function readTurnActiveMarkerAgeMs(stateDir, now) {
 }
 
 // ../src/build-info.ts
-var VERSION = "0.15.5";
-var COMMIT_SHA = "fcc9d7b7";
-var COMMIT_DATE = "2026-06-11T21:49:30Z";
-var LATEST_PR = 2282;
+var VERSION = "0.15.7";
+var COMMIT_SHA = "c0a8b988";
+var COMMIT_DATE = "2026-06-12T04:28:04Z";
+var LATEST_PR = 2286;
 var COMMITS_AHEAD_OF_TAG = 0;
 
 // gateway/boot-version.ts