plugins/src/base/skills/lisa-linear-access/SKILL.md
Vendor-neutral access layer for Linear. Linear skills MUST delegate through this skill rather than calling Linear MCP tools or Linear GraphQL directly. Resolves Linear MCP first when authenticated, then falls back to LINEAR_API_KEY + Linear GraphQL in headless environments.
npx skillsauth add codyswanngt/lisa lisa-linear-accessInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Single chokepoint for Linear operations. Caller skills (linear-*) MUST go
through this skill. They MUST NOT call mcp__linear-server__* tools directly or
curl https://api.linear.app/graphql themselves.
operation: list-teams [query:<KEY>]
operation: get-team id:<ID>
operation: list-projects [team:<KEY>] [label:<NAME>] [state:<arr>]
operation: get-project id:<ID>
operation: save-project payload:{...}
operation: list-issues [team:<ID>] [project:<ID>] [label:<NAME>] [state_type:<arr>]
operation: get-issue id:<ID>
operation: save-issue payload:{...}
operation: list-comments issue_id:<ID>
operation: save-comment issue_id:<ID> body:"..."
operation: history id:<ID>
operation: list-issue-labels [team:<ID>]
operation: create-issue-label payload:{...}
operation: list-project-labels
operation: create-project-label payload:{...}
operation: list-documents project_id:<ID>
operation: get-document id:<ID>
Return parsed JSON in a <result> block. On failure, prefix the message with
Error: and include the failing operation name.
Read config:
WORKSPACE=$(jq -r '.linear.workspace // empty' .lisa.config.json 2>/dev/null)
TEAM_KEY=$(jq -r '.linear.teamKey // empty' .lisa.config.json 2>/dev/null)
Probe in order:
mcp__linear-server__list_teams is available and can list the
configured workspace/team.LINEAR_API_KEY with Linear GraphQL (https://api.linear.app/graphql).The Linear GraphQL docs support personal API keys for scripts and authenticate
with an Authorization: <API_KEY> header. Treat LINEAR_API_KEY as the
headless substrate. If neither tier works, fail with:
Error: no Linear access substrate available. Authenticate the Linear MCP or set LINEAR_API_KEY.
All GraphQL calls use:
linear_graphql() {
local query="$1"
local variables="${2:-{}}"
[ -n "$LINEAR_API_KEY" ] || {
echo "Error: LINEAR_API_KEY is not set." >&2
return 1
}
jq -n --arg query "$query" --argjson variables "$variables" \
'{query:$query, variables:$variables}' |
curl -sS -X POST "https://api.linear.app/graphql" \
-H "Content-Type: application/json" \
-H "Authorization: '"$LINEAR_API_KEY"'" \
--data-binary @-
}
Map operation names to Linear GraphQL queries/mutations in this access skill. Consumers pass business-shaped arguments only; they do not embed GraphQL.
history — transition history (read-only)history id:<ID> returns an Issue's ordered past state changes — the raw
material for rejection detection (an Issue that reached a review/done-ward
state and is now back in ready). IssueHistory is reachable today through the
existing linear_graphql adapter but was not in the documented contract; an
undocumented-but-reachable capability is not exposed, so it now appears in the
Invocation Contract above. Reuse the existing adapter — this is a
contract/surface change, not a new transport (the integration-access-layer
rule forbids consumers from reaching around the layer).
Query through linear_graphql (oldest→newest; page history(first:…, after:…)
via pageInfo for busy Issues so history never silently truncates):
query($id:String!){
issue(id:$id){
history(first:100){
pageInfo{hasNextPage endCursor}
nodes{
createdAt
fromState{name type}
toState{name type}
actor{name}
addedLabelIds
removedLabelIds
}
}
}
}
{ from, to, when, who } — fromState.name →
toState.name, createdAt (ISO timestamp), actor.name. Nodes with no
fromState/toState are non-state edits (label-only, assignee, etc.); keep
them for the label stream, skip them for workflow-state ordering.lisa-linear-build-intake keys the queue on status:* labels), so label
moves matter as much as workflow-state moves. IssueHistory carries label
changes as addedLabelIds / removedLabelIds — arrays of label IDs, not
names. It does not inline label names, and it does not carry the label's
full prior/next set — only the per-event deltas. Resolve IDs → names by
cross-referencing list-issue-labels. Do not overclaim: a caller that needs
status:* label transitions reconstructs them from the ID deltas plus the
label catalog, not from an inline name on the history node.Error: result. Callers MUST treat that as unknown history
and proceed — a history read failure never blocks the build. MCP cannot reach
IssueHistory, so the history operation resolves only through the
LINEAR_API_KEY GraphQL substrate; without it, the result is unknown.LINEAR_API_KEY is present.LINEAR_API_KEY.save_* style updates should not clobber unrelated fields.development
Prepare a machine — a fresh laptop or a throwaway container — to run coding agents, before any repository exists. Detects which of Lisa's supported agents (Claude Code, Codex, Cursor, OpenCode, Antigravity, Copilot) are already installed, asks which credential manager the machine uses (Bitwarden, 1Password, Doppler, Vault, AWS, or none), and installs only what is missing, each by its vendor's own preferred method. Idempotent, headless by default, and emits a Dockerfile for a spin-up/spin-down environment. Run it on a new machine, in a container, or before cloning anything.
tools
Provision and verify a remote execution environment for a host project — Codex Cloud today, other remote surfaces as they are added. Generates a repository-owned setup script that installs the declared toolchain, materializes secrets through lisa-secrets-access, and runs the project's own hook. Provisions by API where one exists, by driving the vendor console where one does not, and by emitting exact config otherwise — then proves the result with the same read-back regardless of which tier did the work. Use before dispatching any work with executionEnv.
tools
Bring a developer's machine in line with the toolchain the project declares. Reports every tool in remoteEnv.tools that is missing, outdated, or unpinned for this platform, and installs the missing ones into ~/.local/bin from the same pinned, checksummed entries the remote surfaces use — but only when asked. Same manifest, same pins, same installers as lisa-setup-remote-env; what differs is consent and that the pin is a floor rather than an equality. Run it on a fresh checkout, after a manifest change, or when a tool fails at the moment of use.
tools
Route one unit of work to a remote execution surface. Reads the executionEnv parameter (local by default, codex-cloud or claude-web today), verifies the environment is provisioned and bound to this repository, submits a thin skill invocation, records the task identifier to .lisa/remote-dispatch.json, and exits without polling. Routing only — the remote runs the identical skill from the identical repository. Composable and inline: other skills invoke it via the Skill tool rather than users calling it directly.