@hauptsache.net/clickup-mcp 1.7.0 → 1.7.3

package/dist/tools/task-write-tools.js

@@ -10,6 +10,14 @@ const attachments_1 = require("../shared/attachments");
  * Shared wording for the image support of every markdown field in this file.
  * Kept in one place so the tools stay consistent about what a client may pass.
  */
+/**
+ * Shared wording for what markdown ClickUp comments can actually render.
+ * Kept in one place so addComment and editComment stay consistent.
+ */
+const COMMENT_FORMATTING_HINT = [
+    "FORMATTING: Headings, **bold**, *italic*, ~~strikethrough~~, `inline code`, code blocks, links, blockquotes, bullet/numbered/nested lists and checkboxes (- [ ] / - [x]) all render natively.",
+    "TABLES ARE NOT SUPPORTED by ClickUp comments - a markdown table is automatically converted to a monospace code block, which is readable but plain. Prefer bold labels or lists over tables when writing comments.",
+].join("\n");
 const IMAGE_SUPPORT_HINT = [
     "IMAGES: Reference images with normal markdown - `![caption](/absolute/path/to/screenshot.png)`.",
     "This server runs locally, so a local file path is read and uploaded automatically - never inline a screenshot as base64 when a path exists, it costs orders of magnitude more tokens.",
@@ -17,25 +25,57 @@ const IMAGE_SUPPORT_HINT = [
     "The caption becomes the attachment filename, which is what ClickUp displays beneath the image - so write a caption that reads well.",
 ].join("\n");
 /**
- * Upload every image referenced in a markdown field and report what failed.
- * Never throws: a broken image must not cost the user their comment or task.
+ * Phase 1 of image handling: parse the markdown and resolve every image source
+ * (read files, download URLs, decode data URIs) WITHOUT writing anything.
+ *
+ * Throws when any reference is unusable, listing every broken source at once.
+ * Nothing has been posted to ClickUp when this throws, so the caller's generic
+ * error path returns the report and the client can fix the markdown and retry.
  */
-async function prepareMarkdownImages(taskId, markdown) {
+async function resolveImagesOrAbort(markdown, abortNotice) {
     if (!markdown) {
-        return { results: [], failures: [], markdown: markdown ?? "" };
+        return { markdown: markdown ?? "", images: [] };
     }
     // Normalise first, then use the same string for collecting and converting - the
     // sources must line up with what the converter later looks up.
     const normalized = (0, clickup_text_1.normalizeImageDestinations)(markdown);
     const sources = (0, clickup_text_1.collectMarkdownImageSources)(normalized);
     if (sources.length === 0) {
-        return { results: [], failures: [], markdown: normalized };
+        return { markdown: normalized, images: [] };
+    }
+    const { resolved, failures } = await (0, attachments_1.resolveMarkdownImages)(sources);
+    if (failures.length > 0) {
+        throw new Error([
+            `${failures.length} image reference(s) could not be used, so ${abortNotice}:`,
+            ...failures.map((failure) => `  - ${failure.src}: ${failure.error}`),
+            `Fix or remove these image references and retry.`,
+        ].join("\n"));
+    }
+    return { markdown: normalized, images: resolved };
+}
+/**
+ * Phase 2: upload the resolved images to the task.
+ *
+ * Throws on the first upload failure. Everything uploaded before the failure is
+ * listed with its CDN URL so a retry can reference those URLs directly (existing
+ * ClickUp URLs are embedded without re-uploading).
+ */
+async function uploadImagesOrAbort(taskId, images, abortNotice) {
+    if (images.length === 0) {
+        return [];
+    }
+    const { uploaded, failure } = await (0, attachments_1.uploadResolvedImages)(taskId, images);
+    if (failure) {
+        const lines = [
+            `Uploading image "${failure.src}" failed, so ${abortNotice}:`,
+            `  ${failure.error}`,
+        ];
+        if (uploaded.length > 0) {
+            lines.push(`${uploaded.length} image(s) were already uploaded to task ${taskId} before the failure - on retry, reference these URLs directly to avoid duplicate uploads:`, ...uploaded.map((u) => `  - ${u.attachment.name}: ${u.attachment.url}`));
+        }
+        throw new Error(lines.join("\n"));
     }
-    const results = await (0, attachments_1.uploadMarkdownImages)(taskId, sources);
-    const failures = results
-        .filter((result) => !result.attachment)
-        .map((result) => `${result.src}: ${result.error || "unknown error"}`);
-    return { results, failures, markdown: normalized };
+    return uploaded;
 }
 /**
  * Echo a markdown field back without repeating inline base64 payloads.
@@ -45,25 +85,14 @@ async function prepareMarkdownImages(taskId, markdown) {
 function summarizeMarkdownForEcho(markdown) {
     return markdown.replace(/(!\[[^\]]*\]\()data:([^;,)]+)[^)]*(\))/g, (_match, prefix, mimeType, suffix) => `${prefix}[inline ${mimeType} data]${suffix}`);
 }
-/** Report successfully attached images so the caller can link to them later */
-function formatAttachedImages(results) {
-    const attached = results.filter((result) => result.attachment);
-    if (attached.length === 0) {
+/** Report successfully attached images so the caller can verify and link to them */
+function formatAttachedImages(uploaded) {
+    if (uploaded.length === 0) {
         return [];
     }
     return [
-        `images_attached: ${attached.length}`,
-        ...attached.map((result) => `  - ${result.attachment.name} (${result.attachment.url})`),
-    ];
-}
-/** Render upload failures as response lines so they are never silently swallowed */
-function formatImageFailures(failures) {
-    if (failures.length === 0) {
-        return [];
-    }
-    return [
-        `WARNING: ${failures.length} image(s) could not be attached and were replaced by their caption:`,
-        ...failures.map((failure) => `  - ${failure}`),
+        `images_attached: ${uploaded.length}`,
+        ...uploaded.map((u) => `  - ${u.attachment.name} (${u.attachment.url})`),
     ];
 }
 // Shared schemas for task parameters
@@ -79,9 +108,11 @@ function registerTaskToolsWrite(server, userData) {
             "Adds a comment to a specific task.",
             "LINKING BEST PRACTICES:",
             "- Always reference related tasks using ClickUp URLs (https://app.clickup.com/t/TASK_ID)",
+            "- Task URLs become live task references (chip with task name and status), so write them bare - any custom link text on a task URL is replaced by the live task name",
             "- Include task links when mentioning dependencies, related work, or follow-ups",
             "- Link to relevant lists, spaces, or other ClickUp entities when applicable",
             "PROGRESS UPDATES: Include current status, progress information, and next steps.",
+            COMMENT_FORMATTING_HINT,
             IMAGE_SUPPORT_HINT,
             "IMAGE LAYOUT: An image inside a numbered list breaks ClickUp's numbering. Write walkthrough steps as bold lines with a blank line before and after the image instead (`**1. Open the login page**`).",
             "If external links are provided, verify they are publicly accessible and incorporate relevant information.",
@@ -92,7 +123,7 @@ function registerTaskToolsWrite(server, userData) {
         }
         return descriptionBase.join("\n");
     })(), {
-        task_id: zod_1.z.string().min(6).max(9).describe("The 6-9 character task ID to comment on"),
+        task_id: zod_1.z.string().min(6).max(16).describe("The 6-16 character task ID to comment on"),
         comment: zod_1.z.string().min(1).describe("The comment text to add to the task"),
     }, {
         readOnlyHint: false,
@@ -100,11 +131,15 @@ function registerTaskToolsWrite(server, userData) {
         idempotentHint: false,
     }, async ({ task_id, comment }) => {
         try {
-            // Upload referenced images first - the fragments need the attachment objects
-            // from the upload response, a bare URL renders as an empty tile.
-            const { results, failures, markdown } = await prepareMarkdownImages(task_id, comment);
+            // Resolve and upload referenced images first - the fragments need the
+            // attachment objects from the upload response, a bare URL renders as an
+            // empty tile. Any image problem aborts BEFORE the comment is posted, so
+            // the caller can fix the markdown and retry without creating duplicates.
+            const abortNotice = "the comment was NOT posted";
+            const { markdown, images } = await resolveImagesOrAbort(comment, abortNotice);
+            const uploaded = await uploadImagesOrAbort(task_id, images, abortNotice);
             // Convert markdown to ClickUp formatted blocks
-            const commentBlocks = (0, clickup_text_1.convertMarkdownToClickUpBlocks)(markdown, (0, attachments_1.toAttachmentMap)(results));
+            const commentBlocks = (0, clickup_text_1.convertMarkdownToClickUpBlocks)(markdown, (0, attachments_1.toAttachmentMap)(uploaded));
             const requestBody = {
                 comment: commentBlocks,
                 notify_all: true
@@ -133,8 +168,7 @@ function registerTaskToolsWrite(server, userData) {
                             `comment: ${summarizeMarkdownForEcho(comment)}`,
                             `date: ${timestampToIso(commentData.date || Date.now())}`,
                             `user: ${commentData.user?.username || 'Current user'}`,
-                            ...formatAttachedImages(results),
-                            ...formatImageFailures(failures),
+                            ...formatAttachedImages(uploaded),
                         ].join('\n')
                     }
                 ],
@@ -152,6 +186,89 @@ function registerTaskToolsWrite(server, userData) {
             };
         }
     });
+    server.tool("editComment", (() => {
+        const descriptionBase = [
+            "Replaces the full text of an existing task comment - use this to correct a comment you just posted instead of adding a follow-up comment.",
+            "The new text REPLACES the old one completely, it is not appended. Anything worth keeping must be repeated in `comment`.",
+            `GUARDRAILS: only comments written by the API token's own user can be edited, and only within ${config_1.CONFIG.commentEditWindowHours} hours of their creation. Older comments and other people's comments must be answered with a new comment via addComment.`,
+            "ClickUp shows no 'edited' marker, so people who already read the comment will not notice the change - for anything that changes meaning after a discussion has started, prefer a follow-up comment.",
+            "Editing does not reset the creation date, so the edit window does not get extended by editing.",
+            COMMENT_FORMATTING_HINT,
+            IMAGE_SUPPORT_HINT,
+            "IMAGES ON EDIT: reading a comment (getTaskById) returns its images as markdown, so passing that text back keeps them - an existing ClickUp attachment URL is re-embedded without uploading again. Only an image whose markdown you drop disappears.",
+            "Task URLs (https://app.clickup.com/t/TASK_ID) become live task references, and existing references are read back as such URLs - passing the text back keeps them.",
+        ];
+        if (config_1.CONFIG.primaryLanguageHint && config_1.CONFIG.primaryLanguageHint.toLowerCase() !== 'en') {
+            descriptionBase.splice(1, 0, `For optimal results, consider writing comments in '${config_1.CONFIG.primaryLanguageHint}' unless the task is already in another language.`);
+        }
+        return descriptionBase.join("\n");
+    })(), {
+        task_id: zod_1.z.string().min(6).max(16).describe("The 6-16 character ID of the task the comment belongs to - needed to locate the comment and to upload images"),
+        comment_id: zod_1.z.string().min(1).describe("The ID of the comment to edit, as returned by addComment or getTaskById"),
+        comment: zod_1.z.string().min(1).describe("The new comment text, replacing the previous text completely"),
+    }, {
+        readOnlyHint: false,
+        destructiveHint: true,
+        idempotentHint: true,
+    }, async ({ task_id, comment_id, comment }) => {
+        try {
+            const [existing, userData] = await Promise.all([
+                findTaskComment(task_id, comment_id),
+                (0, utils_1.getCurrentUser)(),
+            ]);
+            assertCommentIsEditable(existing, userData.user.id);
+            // Same pipeline as addComment - the undocumented rich `comment` array is
+            // accepted by PUT too, so formatting and images survive an edit. Images are
+            // resolved and uploaded before the PUT, so a broken reference leaves the
+            // existing comment untouched.
+            const abortNotice = "the comment was NOT changed";
+            const { markdown, images } = await resolveImagesOrAbort(comment, abortNotice);
+            const uploaded = await uploadImagesOrAbort(task_id, images, abortNotice);
+            const commentBlocks = (0, clickup_text_1.convertMarkdownToClickUpBlocks)(markdown, (0, attachments_1.toAttachmentMap)(uploaded));
+            // Only `comment` is sent: sending `comment_text` alongside it appends that
+            // string to the blocks instead of being ignored.
+            const response = await fetch(`https://api.clickup.com/api/v2/comment/${comment_id}`, {
+                method: 'PUT',
+                headers: {
+                    Authorization: config_1.CONFIG.apiKey,
+                    'Content-Type': 'application/json'
+                },
+                body: JSON.stringify({ comment: commentBlocks })
+            });
+            if (!response.ok) {
+                const errorData = await response.json().catch(() => ({}));
+                throw new Error(`Error editing comment: ${response.status} ${response.statusText} - ${JSON.stringify(errorData)}`);
+            }
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: [
+                            `Comment edited successfully!`,
+                            `comment_id: ${comment_id}`,
+                            `task_id: ${task_id}`,
+                            `task_url: https://app.clickup.com/t/${task_id}`,
+                            `created: ${timestampToIso(existing.date)} (unchanged by the edit)`,
+                            `previous_text: ${existing.comment_text || '(no plain text available)'}`,
+                            `new_comment: ${summarizeMarkdownForEcho(comment)}`,
+                            ...formatAttachedImages(uploaded),
+                        ].join('\n')
+                    }
+                ],
+            };
+        }
+        catch (error) {
+            console.error('Error editing comment:', error);
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: `Error editing comment: ${error instanceof Error ? error.message : 'Unknown error'}`,
+                    },
+                ],
+            };
+        }
+    });
     server.tool("updateTask", (() => {
         const descriptionBase = [
             "Updates various aspects of an existing task including dependencies and relationships.",
@@ -170,7 +287,7 @@ function registerTaskToolsWrite(server, userData) {
         }
         return descriptionBase.join("\n");
     })(), {
-        task_id: zod_1.z.string().min(6).max(9).describe("The 6-9 character task ID to update"),
+        task_id: zod_1.z.string().min(6).max(16).describe("The 6-16 character task ID to update"),
         name: taskNameSchema.optional(),
         append_description: zod_1.z.string().optional().describe("Optional markdown content to APPEND to existing task description (preserves existing content for safety)"),
         status: zod_1.z.string().optional().describe("Optional new status name - use getListInfo to see valid options"),
@@ -200,6 +317,19 @@ function registerTaskToolsWrite(server, userData) {
                 throw new Error(`Error fetching task: ${taskResponse.status} ${taskResponse.statusText}`);
             }
             const taskData = await taskResponse.json();
+            // Resolve and upload description images FIRST - an image problem must
+            // abort before dependencies, tags or the task itself are touched, so the
+            // caller can fix the markdown and retry the whole call cleanly.
+            let appendedDescription;
+            let uploadedImages = [];
+            if (append_description) {
+                const abortNotice = "the task was NOT updated";
+                const prepared = await resolveImagesOrAbort(append_description, abortNotice);
+                uploadedImages = await uploadImagesOrAbort(task_id, prepared.images, abortNotice);
+                // Descriptions render plain markdown, so no image fragments are involved
+                // here - the local paths are simply swapped for the CDN URLs.
+                appendedDescription = (0, clickup_text_1.rewriteMarkdownImageUrls)(prepared.markdown, (0, attachments_1.toAttachmentMap)(uploadedImages));
+            }
             // Handle dependencies separately since they need individual API calls
             let dependencyUpdateResults = [];
             if (blocking !== undefined || waiting_on !== undefined || linked_tasks !== undefined) {
@@ -250,19 +380,11 @@ function registerTaskToolsWrite(server, userData) {
             }
             // Handle append-only description update with markdown support
             let finalDescription;
-            let imageResults = [];
-            let imageFailures = [];
-            if (append_description) {
-                // Upload first, then swap the local paths for CDN URLs. Descriptions render
-                // plain markdown, so no image fragments are involved here.
-                const prepared = await prepareMarkdownImages(task_id, append_description);
-                imageResults = prepared.results;
-                imageFailures = prepared.failures;
-                const appended = (0, clickup_text_1.rewriteMarkdownImageUrls)(prepared.markdown, (0, attachments_1.toAttachmentMap)(imageResults));
+            if (appendedDescription !== undefined) {
                 const currentDescription = taskData.markdown_description || "";
                 const timestamp = new Date().toISOString().split('T')[0]; // YYYY-MM-DD format
                 const separator = currentDescription.trim() ? "\n\n---\n" : "";
-                finalDescription = currentDescription + separator + `**Edit (${timestamp}):** ${appended}`;
+                finalDescription = currentDescription + separator + `**Edit (${timestamp}):** ${appendedDescription}`;
             }
             // Build update body without tags (they're handled separately)
             const updateBody = buildTaskRequestBody({
@@ -324,8 +446,7 @@ function registerTaskToolsWrite(server, userData) {
             if (tagUpdateResults.length > 0) {
                 responseLines.push('tag_warnings: ' + tagUpdateResults.join('; '));
             }
-            responseLines.push(...formatAttachedImages(imageResults));
-            responseLines.push(...formatImageFailures(imageFailures));
+            responseLines.push(...formatAttachedImages(uploadedImages));
             return {
                 content: [
                     {
@@ -383,6 +504,11 @@ function registerTaskToolsWrite(server, userData) {
         openWorldHint: true
     }, async ({ list_id, name, description, status, priority, due_date, start_date, time_estimate, tags, parent_task_id, assignees }) => {
         try {
+            // Resolve description images BEFORE creating the task: a broken reference
+            // (missing file, dead URL, non-image) must not leave a half-finished task
+            // behind. Uploading has to wait until the task exists, though - ClickUp
+            // attachments always belong to a task.
+            const { markdown: normalizedDescription, images } = await resolveImagesOrAbort(description, "the task was NOT created");
             const userData = await (0, utils_1.getCurrentUser)();
             const currentUserId = userData.user.id;
             const requestBody = buildTaskRequestBody({
@@ -405,10 +531,40 @@ function registerTaskToolsWrite(server, userData) {
                 throw new Error(`Error creating task: ${response.status} ${response.statusText} - ${JSON.stringify(errorData)}`);
             }
             const createdTask = await response.json();
+            // Tags are omitted from the create body by buildTaskRequestBody because they
+            // need the dedicated tag endpoints, so apply them here - the same way
+            // updateTask does - otherwise the requested tags are silently dropped.
+            const tagCreateResults = [];
+            if (tags !== undefined && tags.length > 0) {
+                for (const tagName of tags) {
+                    try {
+                        const addTagResponse = await fetch(`https://api.clickup.com/api/v2/task/${createdTask.id}/tag/${encodeURIComponent(tagName)}`, {
+                            method: 'POST',
+                            headers: { Authorization: config_1.CONFIG.apiKey }
+                        });
+                        if (!addTagResponse.ok) {
+                            console.error(`Failed to add tag "${tagName}": ${addTagResponse.status}`);
+                            tagCreateResults.push(`Failed to add tag: ${tagName}`);
+                        }
+                    }
+                    catch (error) {
+                        console.error(`Error adding tag "${tagName}":`, error);
+                        tagCreateResults.push(`Error adding tag: ${tagName}`);
+                    }
+                }
+            }
             // Images can only be attached once the task exists, so the description is
             // written first with its original sources and then rewritten to the CDN URLs.
-            const { results: imageResults, failures: imageFailures, markdown: normalizedDescription, } = await prepareMarkdownImages(createdTask.id, description);
-            const attachmentMap = (0, attachments_1.toAttachmentMap)(imageResults);
+            // At this point every source resolved successfully - only the upload API
+            // itself can still fail, and then the task already exists, so that is
+            // reported as a warning instead of pretending the task was not created.
+            const imageWarnings = [];
+            const { uploaded, failure: uploadFailure } = await (0, attachments_1.uploadResolvedImages)(createdTask.id, images);
+            if (uploadFailure) {
+                console.error(`Failed to attach image "${uploadFailure.src}": ${uploadFailure.error}`);
+                imageWarnings.push(`WARNING: the task was created, but uploading image "${uploadFailure.src}" failed: ${uploadFailure.error}`, `The description still references the original image source. Fix the problem and add the image via updateTask.`);
+            }
+            const attachmentMap = (0, attachments_1.toAttachmentMap)(uploaded);
             if (description && attachmentMap.size > 0) {
                 const rewritten = (0, clickup_text_1.rewriteMarkdownImageUrls)(normalizedDescription, attachmentMap);
                 if (rewritten !== description) {
@@ -423,15 +579,18 @@ function registerTaskToolsWrite(server, userData) {
                     if (!descriptionResponse.ok) {
                         // The task itself exists - report the problem instead of failing the call.
                         console.error(`Failed to write image URLs into description: ${descriptionResponse.status}`);
-                        imageFailures.push(`description update failed (${descriptionResponse.status} ${descriptionResponse.statusText}) - images are attached but not embedded`);
+                        imageWarnings.push(`WARNING: description update failed (${descriptionResponse.status} ${descriptionResponse.statusText}) - the images are attached to the task but not embedded in the description`);
                     }
                 }
             }
             const responseLines = formatTaskResponse(createdTask, 'created', {
                 list_id, name, description, status, priority, due_date, start_date, time_estimate, tags, parent_task_id, assignees
             }, userData);
-            responseLines.push(...formatAttachedImages(imageResults));
-            responseLines.push(...formatImageFailures(imageFailures));
+            responseLines.push(...formatAttachedImages(uploaded));
+            responseLines.push(...imageWarnings);
+            if (tagCreateResults.length > 0) {
+                responseLines.push('tag_warnings: ' + tagCreateResults.join('; '));
+            }
             return {
                 content: [
                     {
@@ -477,6 +636,93 @@ function formatTimeEstimate(hours) {
     const displayMinutes = Math.round((hours - displayHours) * 60);
     return displayHours > 0 ? `${displayHours}h ${displayMinutes}m` : `${displayMinutes}m`;
 }
+/**
+ * Never page further back than this. A generous edit window would otherwise walk
+ * the entire comment history of a busy ticket and eat the 100 calls/minute budget.
+ */
+const MAX_COMMENT_PAGES = 10;
+/** One page of task comments, newest first, 25 per page */
+async function fetchCommentPage(taskId, cursor) {
+    // Note there is no `start_date` parameter - passing one is silently ignored.
+    // Older pages are reached with `start` + `start_id` of the previous page's last entry.
+    const query = cursor
+        ? `?${new URLSearchParams({ start: cursor.start, start_id: cursor.startId })}`
+        : "";
+    const response = await fetch(`https://api.clickup.com/api/v2/task/${taskId}/comment${query}`, { headers: { Authorization: config_1.CONFIG.apiKey } });
+    if (!response.ok) {
+        const errorData = await response.json().catch(() => ({}));
+        throw new Error(`Error loading comments of task ${taskId}: ${response.status} ${response.statusText} - ${JSON.stringify(errorData)}`);
+    }
+    const data = await response.json();
+    return Array.isArray(data.comments) ? data.comments : [];
+}
+/**
+ * Load a single comment of a task.
+ *
+ * ClickUp has no `GET /comment/{id}`, so the task's comment list is the only way
+ * to learn a comment's author and age - both of which editComment has to check
+ * before touching anything.
+ *
+ * The list returns the 25 newest comments per page, so a busy ticket needs paging
+ * to reach the wanted comment. Paging stops as soon as a page ends outside the edit
+ * window: everything older would be refused anyway, which keeps this to a single
+ * request in the normal case.
+ *
+ * Note the list only contains top-level comments; replies inside a thread live
+ * behind `/comment/{parent_id}/reply` and are therefore not editable here.
+ */
+async function findTaskComment(taskId, commentId) {
+    const oldestEditableDate = Date.now() - config_1.CONFIG.commentEditWindowHours * 60 * 60 * 1000;
+    let cursor;
+    let checked = 0;
+    let pages = 0;
+    let sawThreadedReplies = false;
+    while (pages < MAX_COMMENT_PAGES) {
+        const page = await fetchCommentPage(taskId, cursor);
+        pages++;
+        if (page.length === 0) {
+            break;
+        }
+        const match = page.find((entry) => String(entry.id) === String(commentId));
+        if (match) {
+            return match;
+        }
+        checked += page.length;
+        sawThreadedReplies || (sawThreadedReplies = page.some((entry) => (entry.reply_count ?? 0) > 0));
+        // Comments come back newest first, so once a page runs past the edit window
+        // there is nothing editable further back.
+        const oldest = page[page.length - 1];
+        if (Number(oldest.date) < oldestEditableDate) {
+            break;
+        }
+        cursor = { start: String(oldest.date), startId: String(oldest.id) };
+    }
+    const threadedHint = sawThreadedReplies
+        ? " This task has threaded replies, and replies inside a thread cannot be edited - answer them with a new comment instead."
+        : "";
+    throw new Error(`Comment ${commentId} was not found on task ${taskId} (${checked} top-level comment(s) checked across ${pages} page(s), newest first).${threadedHint}`);
+}
+/**
+ * The whole safety model of editComment.
+ *
+ * ClickUp cannot tell "written through this MCP" from "written by the token owner
+ * in the web UI" - both carry the same user id - so the author check only keeps
+ * other people's comments safe, and the time window is what keeps the tool from
+ * rewriting history.
+ */
+function assertCommentIsEditable(comment, currentUserId) {
+    const windowHours = config_1.CONFIG.commentEditWindowHours;
+    if (!(windowHours > 0)) {
+        throw new Error(`Editing comments is disabled (CLICKUP_COMMENT_EDIT_WINDOW_HOURS=${windowHours}). Add a new comment instead.`);
+    }
+    if (String(comment.user?.id ?? '') !== String(currentUserId)) {
+        throw new Error(`Comment ${comment.id} was written by ${comment.user?.username || 'someone else'} (user_id: ${comment.user?.id ?? 'unknown'}), not by the current user (user_id: ${currentUserId}). Only your own comments can be edited - reply with a new comment instead.`);
+    }
+    const ageHours = (Date.now() - Number(comment.date)) / (1000 * 60 * 60);
+    if (ageHours > windowHours) {
+        throw new Error(`Comment ${comment.id} was created ${ageHours.toFixed(1)} hours ago (${timestampToIso(comment.date)}), which is outside the ${windowHours} hour edit window. Add a new comment instead of rewriting an old one.`);
+    }
+}
 /**
  * Formats timestamp to ISO string with local timezone (not UTC)
  */

package/dist/tools/time-tools.js

@@ -52,7 +52,7 @@ function formatEntryTime(timestamp) {
 }
 function registerTimeToolsRead(server) {
     server.tool("getTimeEntries", "Gets time entries for a specific task or all user's time entries. Returns last 30 days by default if no dates specified.", {
-        task_id: zod_1.z.string().min(6).max(9).optional().describe("Optional 6-9 character task ID to filter entries. If not provided, returns all user's time entries."),
+        task_id: zod_1.z.string().min(6).max(16).optional().describe("Optional 6-16 character task ID to filter entries. If not provided, returns all user's time entries."),
         start_date: zod_1.z.string().optional().describe("Optional start date filter as ISO date string (e.g., '2024-10-06T00:00:00+02:00'). Defaults to 30 days ago."),
         end_date: zod_1.z.string().optional().describe("Optional end date filter as ISO date string (e.g., '2024-10-06T23:59:59+02:00'). Defaults to current date."),
         list_id: zod_1.z.string().optional().describe("Optional single list ID to filter time entries by a specific list"),
@@ -267,7 +267,7 @@ function registerTimeToolsWrite(server) {
         "IMPORTANT: Before booking time, check the task's status - booking time on tasks in 'backlog', 'closed', or similar inactive states usually doesn't make sense.",
         "Suggest moving the task to an active status like 'in progress' first."
     ].join("\n"), {
-        task_id: zod_1.z.string().min(6).max(9).describe("The 6-9 character task ID to book time against"),
+        task_id: zod_1.z.string().min(6).max(16).describe("The 6-16 character task ID to book time against"),
         hours: zod_1.z.number().min(0.01).max(24).describe("Hours to book (decimal format, e.g., 0.25 = 15min, 1.5 = 1h 30min)"),
         description: zod_1.z.string().optional().describe("Optional description for the time entry"),
         start_time: zod_1.z.string().optional().describe("Optional start time as ISO date string (e.g., '2024-10-06T09:00:00+02:00', defaults to current time)")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hauptsache.net/clickup-mcp",
-  "version": "1.7.0",
+  "version": "1.7.3",
   "description": "Search, create, and retrieve tasks, add comments, and track time through natural language commands.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",