@hauptsache.net/clickup-mcp 1.7.0 → 1.7.3

package/dist/shared/attachments.js

@@ -4,7 +4,8 @@ exports.isClickUpAttachmentUrl = isClickUpAttachmentUrl;
 exports.resolveImageSource = resolveImageSource;
 exports.captionToFilename = captionToFilename;
 exports.uploadTaskAttachment = uploadTaskAttachment;
-exports.uploadMarkdownImages = uploadMarkdownImages;
+exports.resolveMarkdownImages = resolveMarkdownImages;
+exports.uploadResolvedImages = uploadResolvedImages;
 exports.toAttachmentMap = toAttachmentMap;
 const buffer_1 = require("buffer");
 const crypto_1 = require("crypto");
@@ -185,31 +186,51 @@ async function uploadTaskAttachment(taskId, filename, bytes, mimeType) {
     return attachment;
 }
 /**
- * Upload every image referenced in the markdown to the given task.
+ * Phase 1 of attaching images: resolve every source without writing anything.
  *
- * Uploads run sequentially: a typical comment has a handful of screenshots, and
- * N uploads plus one write call stays well inside ClickUp's 100 calls/minute.
- * A failing image never fails the whole batch - the caller writes the comment
- * anyway and reports which images did not make it.
+ * Reads local files, downloads http(s) URLs, decodes data URIs and validates
+ * magic bytes and size. Failures are collected instead of thrown so the caller
+ * can report every broken reference at once - and abort before anything is
+ * posted to ClickUp. Identical sources are resolved once.
  */
-async function uploadMarkdownImages(taskId, images, baseDir = process.cwd()) {
-    const results = [];
-    // Identical sources are uploaded once and reused.
-    const seen = new Map();
+async function resolveMarkdownImages(images, baseDir = process.cwd()) {
+    const resolved = [];
+    const failures = [];
+    const seen = new Set();
     for (const { src, alt } of images) {
-        const cached = seen.get(src);
-        if (cached) {
-            results.push(cached);
+        if (seen.has(src)) {
             continue;
         }
-        let result;
+        seen.add(src);
+        try {
+            resolved.push({ src, alt, resolved: await resolveImageSource(src, baseDir) });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : "unknown error";
+            console.error(`Cannot use image "${src}": ${message}`);
+            failures.push({ src, error: message });
+        }
+    }
+    return { resolved, failures };
+}
+/**
+ * Phase 2: upload the resolved images to the task.
+ *
+ * Uploads run sequentially: a typical comment has a handful of screenshots, and
+ * N uploads plus one write call stays well inside ClickUp's 100 calls/minute.
+ * Stops at the first upload error - an API failure is unlikely to heal mid-batch,
+ * and everything uploaded so far is returned so the caller can tell a retry to
+ * reference those CDN URLs directly instead of uploading again.
+ */
+async function uploadResolvedImages(taskId, images) {
+    const uploaded = [];
+    for (const { src, alt, resolved } of images) {
         try {
-            const resolved = await resolveImageSource(src, baseDir);
             if (resolved.kind === "existing") {
                 // Already on ClickUp's CDN - synthesise the minimal attachment shape so
                 // the fragment builder has something to work with.
                 const name = decodeURIComponent((0, path_1.basename)(new URL(resolved.url).pathname));
-                result = {
+                uploaded.push({
                     src,
                     attachment: {
                         id: name,
@@ -221,34 +242,27 @@ async function uploadMarkdownImages(taskId, images, baseDir = process.cwd()) {
                         thumbnail_medium: resolved.url,
                         thumbnail_large: resolved.url,
                     },
-                };
+                });
             }
             else {
                 const filename = captionToFilename(alt, resolved.suggestedName);
                 const attachment = await uploadTaskAttachment(taskId, filename, resolved.bytes, resolved.mimeType);
-                result = { src, attachment };
+                uploaded.push({ src, attachment });
             }
         }
         catch (error) {
             const message = error instanceof Error ? error.message : "unknown error";
             console.error(`Failed to attach image "${src}": ${message}`);
-            result = { src, attachment: null, error: message };
+            return { uploaded, failure: { src, error: message } };
         }
-        seen.set(src, result);
-        results.push(result);
     }
-    return results;
+    return { uploaded, failure: null };
 }
-/**
- * Map from markdown `src` to the attachment that should be embedded for it.
- * Sources whose upload failed are absent, so the converters fall back to text.
- */
-function toAttachmentMap(results) {
+/** Map from markdown `src` to the attachment that should be embedded for it. */
+function toAttachmentMap(uploaded) {
     const map = new Map();
-    for (const result of results) {
-        if (result.attachment) {
-            map.set(result.src, result.attachment);
-        }
+    for (const { src, attachment } of uploaded) {
+        map.set(src, attachment);
     }
     return map;
 }

package/dist/shared/config.d.ts

@@ -6,6 +6,7 @@ export declare const CONFIG: {
     maxImages: number;
     maxResponseSizeMB: number;
     maxUploadSizeMB: number;
+    commentEditWindowHours: number;
     primaryLanguageHint: string | undefined;
     mode: McpMode;
 };

package/dist/shared/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/shared/config.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,cAAc,oBAA2D,CAAC;AAkDvF,MAAM,MAAM,OAAO,GAAG,cAAc,GAAG,MAAM,GAAG,OAAO,CAAC;AAUxD,eAAO,MAAM,MAAM;;;;;;;;CAWlB,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/shared/config.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,cAAc,oBAA2D,CAAC;AAkDvF,MAAM,MAAM,OAAO,GAAG,cAAc,GAAG,MAAM,GAAG,OAAO,CAAC;AA8CxD,eAAO,MAAM,MAAM;;;;;;;;;CAqBlB,CAAC"}

package/dist/shared/config.js

@@ -48,6 +48,36 @@ if (rawMode === 'read-minimal' || rawMode === 'read') {
 else if (rawMode && rawMode !== 'write') {
     console.error(`Invalid CLICKUP_MCP_MODE "${rawMode}". Using default "write". Valid options: read-minimal, read, write`);
 }
+/**
+ * Numeric settings are exposed as optional MCPB user_config fields, so their env
+ * values can arrive blank or - if the host does not substitute an unset optional
+ * field - as the literal `${user_config.x}` placeholder. Both mean "not configured"
+ * and must fall back to the default rather than fail or turn into NaN.
+ */
+function readOptionalEnv(name) {
+    const raw = process.env[name]?.trim();
+    if (!raw || /^\$\{.*}$/.test(raw)) {
+        return undefined;
+    }
+    return raw;
+}
+/**
+ * A typo must not silently change a limit: `parseFloat("Infinity")` would disable
+ * the comment age check altogether and `parseFloat("abc")` would yield NaN, which
+ * compares false against every size and so lifts the upload limit instead of
+ * enforcing it. Fail at startup instead.
+ */
+function parseNumericEnv(name, fallback, { min, expectation }) {
+    const raw = readOptionalEnv(name);
+    if (raw === undefined) {
+        return fallback;
+    }
+    const value = Number(raw);
+    if (!Number.isFinite(value) || value < min) {
+        throw new Error(`Invalid ${name} "${raw}". ${expectation}`);
+    }
+    return value;
+}
 exports.CONFIG = {
     apiKey: process.env.CLICKUP_API_KEY,
     teamId: process.env.CLICKUP_TEAM_ID,
@@ -56,7 +86,17 @@ exports.CONFIG = {
     // Upper bound for a single image uploaded to ClickUp. Unlike maxResponseSizeMB this is
     // not about context window budget - it only guards against accidentally pushing huge
     // files into a ticket.
-    maxUploadSizeMB: process.env.MAX_UPLOAD_SIZE_MB ? parseFloat(process.env.MAX_UPLOAD_SIZE_MB) : 10,
+    maxUploadSizeMB: parseNumericEnv("MAX_UPLOAD_SIZE_MB", 10, {
+        min: 1,
+        expectation: "Expected a positive number of megabytes.",
+    }),
+    // How long after creation a comment may still be edited. ClickUp has no way to tell
+    // "written by this MCP" apart from "written by the token owner in the UI", so this
+    // window is the actual guard against rewriting history. 0 disables editing entirely.
+    commentEditWindowHours: parseNumericEnv("CLICKUP_COMMENT_EDIT_WINDOW_HOURS", 24, {
+        min: 0,
+        expectation: "Expected a non-negative number of hours (0 disables editComment).",
+    }),
     primaryLanguageHint: detectedLanguageHint, // Store the cleaned code directly
     mode: mcpMode,
 };

package/dist/shared/utils.d.ts

@@ -1,7 +1,7 @@
 import Fuse from 'fuse.js';
 /**
  * Checks if a string looks like a valid ClickUp task ID
- * Valid task IDs are 6-9 characters long and contain only alphanumeric characters
+ * Valid task IDs are 6-16 characters long and contain only alphanumeric characters
  */
 export declare function isTaskId(str: string): boolean;
 /**

package/dist/shared/utils.js

@@ -23,11 +23,11 @@ const fuse_js_1 = __importDefault(require("fuse.js"));
 const GLOBAL_REFRESH_INTERVAL = 60000; // 60 seconds - that is the rate limit time frame
 /**
  * Checks if a string looks like a valid ClickUp task ID
- * Valid task IDs are 6-9 characters long and contain only alphanumeric characters
+ * Valid task IDs are 6-16 characters long and contain only alphanumeric characters
  */
 function isTaskId(str) {
-    // Task IDs are 6-9 characters long and contain only alphanumeric characters
-    return /^[a-z0-9]{6,9}$/i.test(str);
+    // Task IDs are 6-16 characters long and contain only alphanumeric characters
+    return /^[a-z0-9]{6,16}$/i.test(str);
 }
 // Cache for current user info to avoid repeated API calls and race conditions
 let cachedUserPromise = null;

package/dist/tools/task-tools.js

@@ -17,11 +17,11 @@ function registerTaskToolsRead(server, userData) {
         id: zod_1.z
             .string()
             .min(6)
-            .max(9)
+            .max(16)
             .refine(val => (0, utils_1.isTaskId)(val), {
-            message: "Task ID must be 6-9 alphanumeric characters only"
+            message: "Task ID must be 6-16 alphanumeric characters only"
         })
-            .describe(`The 6-9 character ID of the task to get without a prefix like "#", "CU-" or "https://app.clickup.com/t/"`),
+            .describe(`The 6-16 character ID of the task to get without a prefix like "#", "CU-" or "https://app.clickup.com/t/"`),
     }, {
         readOnlyHint: true
     }, async ({ id }) => {

package/dist/tools/task-write-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"task-write-tools.d.ts","sourceRoot":"","sources":["../../src/tools/task-write-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAgGpE,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,QA+ctE"}
+{"version":3,"file":"task-write-tools.d.ts","sourceRoot":"","sources":["../../src/tools/task-write-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA+IpE,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,QAumBtE"}