fix: sign Linear file URLs for source API reads

[siisee11]

One-Line Summary

Linear issues read through the Source API now expose temporarily accessible image and file URLs instead of unusable private storage URLs.

User-Facing Changes

• get_issue responses containing uploads.linear.app images now return URLs that can be fetched for five minutes.
• CLI and agent consumers can inspect images embedded in issue descriptions and comments without receiving Linear storage authorization errors.

Why This Changed

Linear stores uploaded files in private cloud storage. The Source API authenticated the GraphQL request but did not ask Linear to sign file URLs in the response, so downstream CLI consumers received private URLs they could not open.

How It Changed

• Send Linear's public-file-urls-expire-in: 300 header on GraphQL requests.
• Allow the Linear GraphQL transport helper to receive an injected fetch implementation for deterministic request-header coverage.

Bug Fixes

• When a Linear issue description or comment embedded an uploaded image, Source API readers previously received a URL that returned an authorization failure; the returned URL is now temporarily signed.

Verification

• bunx oxlint --format json packages/server/src/source-api/adapters/linear.ts packages/server/src/source-api/adapters/linear.test.ts
• bun run --cwd packages/server typecheck
• bun run --cwd packages/server test (49 files, 182 tests)
• Added linear.test.ts coverage asserting the signed-file header on Linear GraphQL requests.

Video / Screenshot (Optional)

• N/A

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	onequery-landing	bff4adf	Commit Preview URL Branch Preview URL	Jul 13 2026, 09:56 AM