fix(linear): pass projectId for credential resolution to worker

[zbigniewsobiecki]

Summary

Linear webhook → trigger → job dispatch → worker spawn was completing, then immediately dying with Credential is encrypted but CREDENTIAL_MASTER_KEY is not set. Cannot decrypt. in the worker.

Root cause

src/router/worker-env.ts:22 extractProjectIdFromJob had branches for trello, jira, github, manual-run, retry-run, debug-analysis — but no case for linear. Linear jobs returned null, so the router skipped credential resolution and spawned the worker with no project credentials. The worker then fell back to reading credentials from the DB directly and died because workers intentionally don't get the master key (per worker-env.ts:121: "CREDENTIAL_MASTER_KEY is intentionally NOT passed to workers").

Linear jobs already carry projectId on the job payload (set by LinearRouterAdapter.buildJob at src/router/adapters/linear.ts:229).

Fix

One-line: add linear to the trello/jira branch in the projectId extractor.

Reproduction

Move a Linear issue to a configured agent-triggering state (e.g. Planning) on a project with encrypted credentials. Worker logs:

[Worker] No credentials passed from router - job will likely fail { jobType: 'linear' }
[Worker] Job failed { error: 'Error: Credential is encrypted but CREDENTIAL_MASTER_KEY is not set. Cannot decrypt.' }

Test plan

• New test: tests/unit/router/container-manager.test.ts > extractProjectIdFromJob > returns projectId for linear jobs
• All 48 container-manager tests pass; lint + typecheck clean
• After merge to dev: re-trigger a Linear status transition and confirm the worker receives credentials and the agent runs through

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!