feat(issues): add multi-provider issue tracking

apps/server/src/auth/RpcAuthorization.test.ts

@@ -98,6 +98,22 @@ describe("RPC authorization scopes", () => {
     );
   });
 
+  it("allows read access for the side-effect-free Linear status", () => {
+    expect(requiredScopeForRpcMethod(WS_METHODS.issueTrackersStatus)).toBe(
+      AuthOrchestrationReadScope,
+    );
+  });
+
+  it("separates saved work item link reads from writes", () => {
+    expect(requiredScopeForRpcMethod(WS_METHODS.workItemsListLinks)).toBe(
+      AuthOrchestrationReadScope,
+    );
+    expect(requiredScopeForRpcMethod(WS_METHODS.workItemsLink)).toBe(AuthOrchestrationOperateScope);
+    expect(requiredScopeForRpcMethod(WS_METHODS.workItemsUnlink)).toBe(
+      AuthOrchestrationOperateScope,
+    );
+  });
+
   it("rejects unknown RPC method names", () => {
     for (const method of ["server.notRegistered", "toString", "constructor"]) {
       expect(() => requiredScopeForRpcMethod(method)).toThrow(

apps/server/src/auth/RpcAuthorization.ts

@@ -128,6 +128,30 @@ export const RPC_REQUIRED_SCOPES = {
   // write like every other one.
   [WS_METHODS.pullRequestsReviewerCandidates]: AuthOrchestrationReadScope,
   [WS_METHODS.pullRequestsRequestReviewers]: AuthOrchestrationOperateScope,
+  [WS_METHODS.issuesList]: AuthOrchestrationReadScope,
+  [WS_METHODS.issuesDetail]: AuthOrchestrationReadScope,
+  [WS_METHODS.issuesActivity]: AuthOrchestrationReadScope,
+  [WS_METHODS.issuesCommentsPage]: AuthOrchestrationReadScope,
+  [WS_METHODS.issuesRunAction]: AuthOrchestrationOperateScope,
+  [WS_METHODS.issuesComment]: AuthOrchestrationOperateScope,
+  [WS_METHODS.issuesUpdateComment]: AuthOrchestrationOperateScope,
+  [WS_METHODS.issuesSetReaction]: AuthOrchestrationOperateScope,
+  [WS_METHODS.issuesCreate]: AuthOrchestrationOperateScope,
+  [WS_METHODS.issuesUpdate]: AuthOrchestrationOperateScope,
+  [WS_METHODS.issuesSetLabels]: AuthOrchestrationOperateScope,
+  [WS_METHODS.issuesSetAssignees]: AuthOrchestrationOperateScope,
+  [WS_METHODS.issuesLabelCandidates]: AuthOrchestrationReadScope,
+  [WS_METHODS.issuesAssigneeCandidates]: AuthOrchestrationReadScope,
+  [WS_METHODS.issuesTemplates]: AuthOrchestrationReadScope,
+  [WS_METHODS.issuesInvalidate]: AuthOrchestrationReadScope,
+  [WS_METHODS.issueTrackersStatus]: AuthOrchestrationReadScope,
+  [WS_METHODS.issueTrackersConnect]: AuthOrchestrationOperateScope,
+  [WS_METHODS.issueTrackersDisconnect]: AuthOrchestrationOperateScope,
+  [WS_METHODS.issueTrackersBind]: AuthOrchestrationOperateScope,
+  [WS_METHODS.workItemsFindMatches]: AuthOrchestrationOperateScope,
+  [WS_METHODS.workItemsListLinks]: AuthOrchestrationReadScope,
+  [WS_METHODS.workItemsLink]: AuthOrchestrationOperateScope,
+  [WS_METHODS.workItemsUnlink]: AuthOrchestrationOperateScope,
   [WS_METHODS.pullRequestsLabelCandidates]: AuthOrchestrationReadScope,
   [WS_METHODS.pullRequestsSetLabels]: AuthOrchestrationOperateScope,
   [WS_METHODS.sourceControlLookupRepository]: AuthOrchestrationReadScope,

apps/server/src/environment/ServerEnvironment.test.ts

@@ -220,6 +220,7 @@ it.layer(NodeServices.layer)("ServerEnvironmentLive", (it) => {
       expect(second.capabilities.attachmentUploads).toBe(true);
       expect(second.capabilities.fileAttachments).toEqual({ maxUploadBytes: 50 * 1024 * 1024 });
       expect(second.capabilities.pullRequests).toBe(true);
+      expect(second.capabilities.workItemLinks).toBe(true);
       expect(second.capabilities.requiredWorktreeBootstrap).toBe(true);
       expect(second.capabilities.usagePriceOverrides).toBe(true);
       expect(second.capabilities.threadActiveReorder).toBe(true);

apps/server/src/environment/ServerEnvironment.ts

@@ -222,6 +222,8 @@ export const make = Effect.gen(function* () {
       questionAttachments: true,
       fileAttachments: { maxUploadBytes: PROVIDER_SEND_TURN_MAX_FILE_BYTES },
       pullRequests: true,
+      issues: true,
+      workItemLinks: true,
       pullRequestChecks: true,
       inlineMessageContext: true,
       requiredWorktreeBootstrap: true,

apps/server/src/git/GitManager.test.ts

@@ -319,6 +319,7 @@ function createTextGeneration(
       Effect.succeed({
         title: "Update workflow",
       }),
+    findWorkItemMatches: () => Effect.succeed({ matches: [] }),
     ...overrides,
   };
 
@@ -367,6 +368,17 @@ function createTextGeneration(
             }),
         ),
       ),
+    findWorkItemMatches: (input) =>
+      implementation.findWorkItemMatches(input).pipe(
+        Effect.mapError(
+          (cause) =>
+            new TextGenerationError({
+              operation: "findWorkItemMatches",
+              detail: "fake text generation failed",
+              ...(cause !== undefined ? { cause } : {}),
+            }),
+        ),
+      ),
   };
 }