aws-samples
diff --git a/‎cdk/src/constructs/linear-integration.ts‎
Lines changed: 32 additions & 1 deletion b/‎cdk/src/constructs/linear-integration.ts‎
Lines changed: 32 additions & 1 deletion
diff --git a/‎cdk/src/handlers/linear-link.ts‎
Lines changed: 32 additions & 4 deletions b/‎cdk/src/handlers/linear-link.ts‎
Lines changed: 32 additions & 4 deletions
diff --git a/‎cdk/src/handlers/linear-webhook-processor.ts‎
Lines changed: 15 additions & 7 deletions b/‎cdk/src/handlers/linear-webhook-processor.ts‎
Lines changed: 15 additions & 7 deletions
diff --git a/‎cdk/src/handlers/linear-webhook.ts‎
Lines changed: 65 additions & 6 deletions b/‎cdk/src/handlers/linear-webhook.ts‎
Lines changed: 65 additions & 6 deletions
@@ -183,6 +183,12 @@ export class LinearIntegration extends Construct {
       runtime: Runtime.NODEJS_24_X,
       architecture: Architecture.ARM_64,
       timeout: Duration.seconds(30),
+      // Default 128 MB OOMs at module init since the attachment-screening
+      // path (#176) bundles pdf-parse + URL-resolver libs alongside the
+      // existing AWS SDK + bedrock-agentcore deps. 512 MB gives ~4× headroom
+      // and lifts CPU enough that p99 startup stays under the API Gateway
+      // 30s deadline on cold starts.
+      memorySize: 512,
       environment: {
         ...createTaskEnv,
         LINEAR_PROJECT_MAPPING_TABLE_NAME: this.projectMappingTable.tableName,
@@ -245,11 +251,32 @@ export class LinearIntegration extends Construct {
         LINEAR_WEBHOOK_SECRET_ARN: this.webhookSecret.secretArn,
         LINEAR_WEBHOOK_DEDUP_TABLE_NAME: this.webhookDedupTable.tableName,
         LINEAR_WEBHOOK_PROCESSOR_FUNCTION_NAME: webhookProcessorFn.functionName,
+        // Per-workspace signing-secret lookup — selects the right
+        // workspace's `webhook_signing_secret` from the OAuth secret
+        // bundle so multi-workspace installs verify correctly. Receiver
+        // falls back to LINEAR_WEBHOOK_SECRET_ARN when this lookup
+        // misses (back-compat for single-workspace installs).
+        LINEAR_WORKSPACE_REGISTRY_TABLE_NAME: this.workspaceRegistryTable.tableName,
       },
       bundling: commonBundling,
     });
     this.webhookSecret.grantRead(webhookFn);
     this.webhookDedupTable.grantReadWriteData(webhookFn);
+    this.workspaceRegistryTable.grantReadData(webhookFn);
+    // Read-only on the per-workspace OAuth secret prefix — we extract
+    // `webhook_signing_secret` for verification but never mutate; the
+    // CLI owns the lifecycle of these secrets.
+    webhookFn.addToRolePolicy(new iam.PolicyStatement({
+      actions: ['secretsmanager:GetSecretValue'],
+      resources: [
+        Stack.of(this).formatArn({
+          service: 'secretsmanager',
+          resource: 'secret',
+          arnFormat: ArnFormat.COLON_RESOURCE_NAME,
+          resourceName: 'bgagent-linear-oauth-*',
+        }),
+      ],
+    }));
     webhookProcessorFn.grantInvoke(webhookFn);
 
     // --- Account linking (Cognito-authenticated) ---
@@ -319,7 +346,11 @@ export class LinearIntegration extends Construct {
         },
         {
           id: 'AwsSolutions-IAM5',
-          reason: 'Wildcard permissions are scoped by DynamoDB index ARN patterns',
+          reason:
+            'Wildcards cover (a) DynamoDB index ARN patterns from CDK grant helpers, '
+            + 'and (b) the Secrets Manager `bgagent-linear-oauth-*` prefix grant — '
+            + 'the per-workspace OAuth secret name is not known at synth time '
+            + '(operators add workspaces by slug at runtime via `bgagent linear add-workspace`).',
         },
       ], true);
     }
 
@@ -32,14 +32,19 @@ const USER_MAPPING_TABLE = process.env.LINEAR_USER_MAPPING_TABLE_NAME!;
 
 interface LinkRequest {
   readonly code: string;
+  /** Preview-only: return what would be linked without writing. */
+  readonly dry_run?: boolean;
 }
 
 /**
- * POST /v1/linear/link — Complete Linear account linking.
+ * POST /v1/linear/link — Complete Linear account linking, or preview it.
  *
  * Called from the CLI (`bgagent linear link <code>`) with a Cognito JWT.
- * Looks up the pending link record, maps the Linear identity to the
- * authenticated platform user, and cleans up the pending record.
+ * Looks up the pending link record. With `dry_run: true`, returns the
+ * Linear identity attached to the code without writing — the CLI uses
+ * this to render a "you're about to link X (email: Y)" preview before
+ * the teammate confirms. Without `dry_run`, writes the mapping and
+ * deletes the pending record.
  */
 export async function handler(event: APIGatewayProxyEvent): Promise<APIGatewayProxyResult> {
   const requestId = ulid();
@@ -55,7 +60,11 @@ export async function handler(event: APIGatewayProxyEvent): Promise<APIGatewayPr
       return errorResponse(400, ErrorCode.VALIDATION_ERROR, 'Request body must include a "code" field.', requestId);
     }
 
-    const code = body.code.trim().toUpperCase();
+    // Codes from `bgagent linear invite-user` are case-sensitive
+    // (see generateInviteCode in the CLI — `link-<8-char-hex>` shape,
+    // hex is lowercase). Don't uppercase the incoming value — that
+    // would break codes generated post-2.0b.
+    const code = body.code.trim();
 
     const pending = await ddb.send(new GetCommand({
       TableName: USER_MAPPING_TABLE,
@@ -67,7 +76,23 @@ export async function handler(event: APIGatewayProxyEvent): Promise<APIGatewayPr
     }
 
     const workspaceId = pending.Item.linear_workspace_id as string;
+    const workspaceSlug = (pending.Item.linear_workspace_slug as string | undefined) ?? '';
     const linearUserId = pending.Item.linear_user_id as string;
+    const linearUserName = (pending.Item.linear_user_name as string | undefined) ?? '';
+    const linearUserEmail = (pending.Item.linear_user_email as string | undefined) ?? '';
+
+    // Dry-run preview: return identity without writing.
+    if (body.dry_run === true) {
+      return successResponse(200, {
+        dry_run: true,
+        linear_workspace_id: workspaceId,
+        linear_workspace_slug: workspaceSlug,
+        linear_user_id: linearUserId,
+        linear_user_name: linearUserName,
+        linear_user_email: linearUserEmail,
+      }, requestId);
+    }
+
     const now = new Date().toISOString();
 
     await ddb.send(new PutCommand({
@@ -97,7 +122,10 @@ export async function handler(event: APIGatewayProxyEvent): Promise<APIGatewayPr
     return successResponse(200, {
       message: 'Linear account linked successfully.',
       linear_workspace_id: workspaceId,
+      linear_workspace_slug: workspaceSlug,
       linear_user_id: linearUserId,
+      linear_user_name: linearUserName,
+      linear_user_email: linearUserEmail,
       linked_at: now,
     }, requestId);
   } catch (err) {
 
@@ -248,19 +248,27 @@ export async function handler(event: ProcessorEvent): Promise<void> {
 
   // Phase 2.0b-O2: resolve the workspace's OAuth secret ARN ONCE here
   // and stash it on the task record. The agent runtime reads it directly
-  // (no registry lookup at task-execution time). If the workspace isn't
-  // onboarded the agent's outbound Linear MCP simply skips.
+  // (no registry lookup at task-execution time).
+  //
+  // When the registry table IS configured but resolution returns null —
+  // workspace not in registry, status not active, or token unreadable —
+  // the receiver only let this through because the stack-wide fallback
+  // verified. Creating a task against a workspace ABCA doesn't recognize
+  // is the wrong behaviour: outbound Linear comments would silently
+  // skip, the user mapping lookup would fail, and we'd burn agent
+  // quota for no observable result. Drop the event explicitly here
+  // rather than rely on downstream lookups to incidentally block it.
   if (WORKSPACE_REGISTRY_TABLE) {
     const resolved = await resolveLinearOauthToken(workspaceId, WORKSPACE_REGISTRY_TABLE);
-    if (resolved) {
-      channelMetadata.linear_oauth_secret_arn = resolved.oauthSecretArn;
-      channelMetadata.linear_workspace_slug = resolved.workspaceSlug;
-    } else {
-      logger.warn('Linear workspace not in registry — agent will run without Linear MCP', {
+    if (!resolved) {
+      logger.warn('Linear workspace not resolvable from registry — dropping event', {
         linear_workspace_id: workspaceId,
         issue_id: issue.id,
       });
+      return;
     }
+    channelMetadata.linear_oauth_secret_arn = resolved.oauthSecretArn;
+    channelMetadata.linear_workspace_slug = resolved.workspaceSlug;
   }
 
   // Extract embedded image URLs from the issue description markdown.
 
@@ -21,7 +21,11 @@ import { ConditionalCheckFailedException, DynamoDBClient } from '@aws-sdk/client
 import { InvokeCommand, LambdaClient } from '@aws-sdk/client-lambda';
 import { DeleteCommand, DynamoDBDocumentClient, PutCommand } from '@aws-sdk/lib-dynamodb';
 import type { APIGatewayProxyEvent, APIGatewayProxyResult } from 'aws-lambda';
-import { isWebhookTimestampFresh, verifyLinearRequest } from './shared/linear-verify';
+import {
+  isWebhookTimestampFresh,
+  verifyLinearRequest,
+  verifyLinearRequestForWorkspace,
+} from './shared/linear-verify';
 import { logger } from './shared/logger';
 
 const ddb = DynamoDBDocumentClient.from(new DynamoDBClient({}));
@@ -30,6 +34,10 @@ const lambdaClient = new LambdaClient({});
 const WEBHOOK_SECRET_ARN = process.env.LINEAR_WEBHOOK_SECRET_ARN!;
 const DEDUP_TABLE_NAME = process.env.LINEAR_WEBHOOK_DEDUP_TABLE_NAME!;
 const PROCESSOR_FUNCTION_NAME = process.env.LINEAR_WEBHOOK_PROCESSOR_FUNCTION_NAME!;
+/** Optional. When unset, the per-workspace signing-secret path is skipped
+ *  and only the stack-wide secret is consulted (back-compat for installs
+ *  predating per-workspace secrets). */
+const WORKSPACE_REGISTRY_TABLE = process.env.LINEAR_WORKSPACE_REGISTRY_TABLE_NAME;
 
 /**
  * Dedup window (seconds). Must exceed Linear's full retry horizon: first
@@ -79,11 +87,11 @@ export async function handler(event: APIGatewayProxyEvent): Promise<APIGatewayPr
       return jsonResponse(401, { error: 'Missing signature' });
     }
 
-    if (!await verifyLinearRequest(WEBHOOK_SECRET_ARN, signature, event.body)) {
-      logger.warn('Invalid Linear webhook signature');
-      return jsonResponse(401, { error: 'Invalid signature' });
-    }
-
+    // Parse body ONCE — we peek at the orgId before signature verification
+    // so we can pick the right per-workspace signing secret. The orgId is
+    // untrusted at this point; it only selects WHICH secret to verify
+    // against. An attacker can claim any orgId but still needs the
+    // matching signing secret to forge a valid signature.
     let payload: LinearWebhookEnvelope;
     try {
       payload = JSON.parse(event.body) as LinearWebhookEnvelope;
@@ -94,6 +102,57 @@ export async function handler(event: APIGatewayProxyEvent): Promise<APIGatewayPr
       return jsonResponse(400, { error: 'Invalid JSON' });
     }
 
+    // Try the per-workspace secret first. Falls through to the stack-wide
+    // path if (a) registry table not configured, (b) no orgId in body,
+    // (c) workspace not in registry, or (d) workspace's stored secret
+    // lacks `webhook_signing_secret`. Per-workspace MISMATCH is fatal —
+    // do NOT fall back, that would let an attacker bypass per-workspace
+    // signatures by also matching the stack-wide one. REVOKED is also
+    // fatal: a workspace that has been deactivated must not be able to
+    // ride the stack-wide fallback (which `setup` mirrored from the
+    // first workspace's signing secret) back into a verified state.
+    let verified = false;
+    if (WORKSPACE_REGISTRY_TABLE && payload.organizationId) {
+      const result = await verifyLinearRequestForWorkspace(
+        WORKSPACE_REGISTRY_TABLE,
+        payload.organizationId,
+        signature,
+        event.body,
+      );
+      if (result === 'verified') {
+        verified = true;
+      } else if (result === 'mismatch') {
+        logger.warn('Linear webhook signature mismatch against per-workspace secret', {
+          linear_workspace_id: payload.organizationId,
+        });
+        return jsonResponse(401, { error: 'Invalid signature' });
+      } else if (result === 'revoked') {
+        logger.warn('Linear webhook from revoked workspace — rejecting without stack-wide fallback', {
+          linear_workspace_id: payload.organizationId,
+        });
+        return jsonResponse(401, { error: 'Workspace not active' });
+      }
+      // 'no-per-workspace-secret' falls through to the stack-wide path
+      // below — back-compat for installs predating per-workspace secrets.
+    }
+
+    if (!verified) {
+      if (!await verifyLinearRequest(WEBHOOK_SECRET_ARN, signature, event.body)) {
+        logger.warn('Invalid Linear webhook signature', {
+          linear_workspace_id: payload.organizationId,
+        });
+        return jsonResponse(401, { error: 'Invalid signature' });
+      }
+      // Stack-wide fallback succeeded. Log positively so operators
+      // diagnosing a per-workspace verification regression have a
+      // breadcrumb that says "this workspace is verifying via the
+      // back-compat path" rather than its own per-workspace secret.
+      logger.info('Linear webhook verified via stack-wide fallback secret', {
+        linear_workspace_id: payload.organizationId,
+        per_workspace_registry_configured: Boolean(WORKSPACE_REGISTRY_TABLE),
+      });
+    }
+
     if (!isWebhookTimestampFresh(payload.webhookTimestamp)) {
       logger.warn('Linear webhook timestamp outside replay window', {
         webhook_timestamp: payload.webhookTimestamp,