fix(linear): send personal API keys without Bearer prefix

[zbigniewsobiecki]

Summary

After #1117 and #1118, Linear webhooks reach the router and trigger workers correctly, but every dispatch logs:

[PlatformClient] Failed to post Linear comment: Error: Linear API HTTP error 400

The CASCADE acknowledgment comment never appears on the Linear issue.

Root cause

The router's two Linear API call sites diverged from the canonical client and used the OAuth Bearer pattern with personal API keys (lin_api_*), which Linear rejects with HTTP 400.

File	Header	Correct?
src/linear/client.ts:65 (canonical)	Authorization: apiKey	✅
src/router/platformClients/linear.ts:23	Authorization: 'Bearer ' + apiKey	❌
src/router/bot-identity-resolvers.ts:98	Authorization: 'Bearer ' + creds.apiKey	❌

The bot-identity bug is more insidious: if (!response.ok) return null silently disabled Linear self-loop prevention. No incident yet because comment-mention triggering on Linear isn't fully wired here, but it's a latent loop hazard.

A misleading docblock at src/linear/client.ts:8 claimed Bearer <api_key> — wrong, would have caused the next maintainer to reintroduce the bug.

Fix

• Drop the Bearer prefix in both router-side call sites (one-line change each, with a comment explaining why).
• Correct the misleading docblock.
• Improve linearGraphQL error messages in both the canonical and the router-side helpers to include the response body. Without that, this very bug was invisible from logs alone — observability, not rug-sweeping.
• Update makeHttpErrorResponse test factory in tests/unit/pm/linear/client.test.ts to mock text() (required by the new error path).

Tests

New LinearPlatformClient describe block in tests/unit/router/platformClients.test.ts:

• postComment / deleteComment / updateComment send bare API key, no Bearer prefix
• postComment sends the correct GraphQL mutation + variables ({ issueId, body })
• On HTTP failure, the warning includes the response body (so future diagnostics aren't lost)
• Returns null without calling fetch when credentials are missing

All 7676 tests pass; lint and typecheck clean.

Verification post-merge

After deploy-dev, trigger any Linear status transition that fires an agent. Router log should show:

[PlatformClient] Linear comment posted for issue: <uuid>

instead of Failed to post Linear comment ... HTTP error 400. The Linear issue itself should display the CASCADE bot's ack comment.

Out of scope (separate follow-up — flagged for the next PR)

linearLabels is filled by free-text input in the wizard (pm-wizard-linear-steps.tsx:207-220) and stored as label names. The adapter (src/pm/linear/adapter.ts:154-165) passes those values to linearClient.addLabel → updateIssue({ labelIds: [...] }), but Linear's issueUpdate.labelIds requires UUIDs. So the cascade-processing label is silently never applied. Same shape as #1117 (status-mapping bug); needs a wizard UX change to fetch labels and present a dropdown of `{ label: name, value: id }`. Will be the next PR.

Test plan

• Local: npm run lint, npm run typecheck, full npm test clean
• New tests cover all three Linear platform-client methods + error-body inclusion
• Post-deploy: trigger Linear transition; confirm Linear comment posted log + visible ack comment on the Linear issue

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 83.33333% with 1 line in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/router/bot-identity-resolvers.ts	0.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!