@sebastienheyd/clickup-mcp 1.10.1 → 1.10.2

package/README.md

@@ -313,7 +313,7 @@ This keeps existing content and a clear audit trail. To correct or restructure a
 
 ## Writing Images Into Tickets
 
-`addComment`, `editComment`, `createTask` and `updateTask` accept images as ordinary markdown. Because
+`addComment`, `createTask` and `updateTask` accept images as ordinary markdown. Because
 this server runs locally, it reads the file itself - so a **local path is enough**:
 
 ```markdown
@@ -336,12 +336,16 @@ Notes:
 - **An image inside a numbered list breaks ClickUp's numbering.** Write walkthrough
   steps as bold lines with the image between them, as above.
 - Only real PNG/JPEG/GIF/WebP files are uploaded - the content is checked, not the
-  extension. A file that fails **aborts the write**: `addComment`, `editComment` and
+  extension. A file that fails **aborts the write**: `addComment` and
   `updateTask` report every broken reference and change nothing, so the markdown can be
   fixed and the call retried without creating duplicates. `createTask` validates its
   images before creating the task; only an upload failing afterwards is reported as a
   warning, since the task already exists at that point.
 - Attachments always belong to a task, so document pages cannot embed uploads this way.
+- **`editComment` can only keep the images already in the comment.** Pass the markdown
+  returned by `getTaskById` back and they stay; ClickUp refuses to add any other image to
+  an existing comment, so a new image reference is rejected before anything is uploaded.
+  Share a new image in a new comment with `addComment` instead.
 
 ## Performance & Limitations
 

package/dist/shared/attachments.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attachments.d.ts","sourceRoot":"","sources":["../../src/shared/attachments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAQhC;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED,uCAAuC;AACvC,UAAU,aAAa;IACrB,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,mFAAmF;AACnF,UAAU,gBAAgB;IACxB,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,MAAM,mBAAmB,GAAG,aAAa,GAAG,gBAAgB,CAAC;AAoCnE;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAM3D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,MAAsB,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CA2C9B;AAcD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAS/E;AAmCD;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,yBAAyB,CAAC,CAwBpC;AAED,2FAA2F;AAC3F,MAAM,WAAW,qBAAqB;IACpC,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,mBAAmB,CAAC;CAC/B;AAED,mEAAmE;AACnE,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAAE,EACtC,OAAO,GAAE,MAAsB,GAC9B,OAAO,CAAC;IAAE,QAAQ,EAAE,qBAAqB,EAAE,CAAC;IAAC,QAAQ,EAAE,YAAY,EAAE,CAAA;CAAE,CAAC,CAqB1E;AAED,6EAA6E;AAC7E,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,yBAAyB,CAAC;CACvC;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,qBAAqB,EAAE,GAC9B,OAAO,CAAC;IAAE,QAAQ,EAAE,qBAAqB,EAAE,CAAC;IAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAAA;CAAE,CAAC,CAwC9E;AAED,gFAAgF;AAChF,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,qBAAqB,EAAE,GAChC,GAAG,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAMxC"}
+{"version":3,"file":"attachments.d.ts","sourceRoot":"","sources":["../../src/shared/attachments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAQhC;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED,uCAAuC;AACvC,UAAU,aAAa;IACrB,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,mFAAmF;AACnF,UAAU,gBAAgB;IACxB,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,MAAM,mBAAmB,GAAG,aAAa,GAAG,gBAAgB,CAAC;AAoCnE;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAM3D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,MAAsB,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CA2C9B;AAcD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAS/E;AAmCD;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,yBAAyB,CAAC,CAwBpC;AAED,2FAA2F;AAC3F,MAAM,WAAW,qBAAqB;IACpC,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,mBAAmB,CAAC;CAC/B;AAED,mEAAmE;AACnE,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAAE,EACtC,OAAO,GAAE,MAAsB,GAC9B,OAAO,CAAC;IAAE,QAAQ,EAAE,qBAAqB,EAAE,CAAC;IAAC,QAAQ,EAAE,YAAY,EAAE,CAAA;CAAE,CAAC,CAqB1E;AAED,6EAA6E;AAC7E,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,yBAAyB,CAAC;CACvC;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,qBAAqB,EAAE,GAC9B,OAAO,CAAC;IAAE,QAAQ,EAAE,qBAAqB,EAAE,CAAC;IAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAAA;CAAE,CAAC,CA8C9E;AAED,gFAAgF;AAChF,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,qBAAqB,EAAE,GAChC,GAAG,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAMxC"}

package/dist/shared/attachments.js

@@ -228,12 +228,18 @@ async function uploadResolvedImages(taskId, images) {
         try {
             if (resolved.kind === "existing") {
                 // Already on ClickUp's CDN - synthesise the minimal attachment shape so
-                // the fragment builder has something to work with.
-                const name = decodeURIComponent((0, path_1.basename)(new URL(resolved.url).pathname));
+                // the fragment builder has something to work with. The real attachment id
+                // is `<uuid><ext>`, the uuid being the path segment before the filename
+                // (.../t123/<uuid>/<name>); ClickUp rejects a comment edit whose image
+                // fragment carries any other id (404 ACCESS_028, verified live).
+                const pathname = new URL(resolved.url).pathname;
+                const name = decodeURIComponent((0, path_1.basename)(pathname));
+                const segments = pathname.split("/").filter(Boolean);
+                const uuid = segments.length >= 2 ? segments[segments.length - 2] : undefined;
                 uploaded.push({
                     src,
                     attachment: {
-                        id: name,
+                        id: uuid ? `${uuid}${(0, path_1.extname)(name)}` : name,
                         name,
                         title: alt || name,
                         extension: (0, path_1.extname)(name).replace(/^\./, "") || undefined,

package/dist/shared/dates.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Date parameters as tools receive them: an ISO date with a time of day
+ * ("2026-10-02T18:00:00+02:00") or a bare date ("2026-10-02").
+ */
+export interface ParsedDateInput {
+    /** Milliseconds since the epoch */
+    timestamp: number;
+    /** false for a bare date (YYYY-MM-DD), which stands for a whole local day */
+    hasTime: boolean;
+}
+/**
+ * Parse a date parameter, or throw an error that names the field.
+ *
+ * Two silent failures are turned into errors on purpose:
+ * - an unparseable string gives NaN, which JSON.stringify sends as `null` - a
+ *   due date would be cleared while the tool reports success;
+ * - JavaScript rolls impossible days over instead of rejecting them, with or
+ *   without a time ("2026-02-31" and "2026-02-31T10:00" both become March 3rd).
+ *
+ * A bare date is a whole LOCAL day: `new Date("2026-10-02")` would be UTC
+ * midnight, i.e. the previous evening east of Greenwich. `bareDateAt` picks the
+ * start (00:00:00.000) or the end (23:59:59.999) of that day.
+ */
+export declare function parseDateInput(value: string, field: string, bareDateAt?: "start" | "end"): ParsedDateInput;
+//# sourceMappingURL=dates.d.ts.map

package/dist/shared/dates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dates.d.ts","sourceRoot":"","sources":["../../src/shared/dates.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,OAAO,EAAE,OAAO,CAAC;CAClB;AAID;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,UAAU,GAAE,OAAO,GAAG,KAAe,GACpC,eAAe,CA8BjB"}

package/dist/shared/dates.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseDateInput = parseDateInput;
+const LEADING_DATE = /^(\d{4})-(\d{2})-(\d{2})(.*)$/;
+/**
+ * Parse a date parameter, or throw an error that names the field.
+ *
+ * Two silent failures are turned into errors on purpose:
+ * - an unparseable string gives NaN, which JSON.stringify sends as `null` - a
+ *   due date would be cleared while the tool reports success;
+ * - JavaScript rolls impossible days over instead of rejecting them, with or
+ *   without a time ("2026-02-31" and "2026-02-31T10:00" both become March 3rd).
+ *
+ * A bare date is a whole LOCAL day: `new Date("2026-10-02")` would be UTC
+ * midnight, i.e. the previous evening east of Greenwich. `bareDateAt` picks the
+ * start (00:00:00.000) or the end (23:59:59.999) of that day.
+ */
+function parseDateInput(value, field, bareDateAt = "start") {
+    const trimmed = value.trim();
+    const leading = LEADING_DATE.exec(trimmed);
+    if (leading) {
+        const [, yearText, monthText, dayText, rest] = leading;
+        const year = Number(yearText);
+        const month = Number(monthText);
+        const day = Number(dayText);
+        const daysInMonth = month >= 1 && month <= 12 ? new Date(year, month, 0).getDate() : 0;
+        if (day < 1 || day > daysInMonth) {
+            throw new Error(`Invalid ${field} "${value}": ${yearText}-${monthText}-${dayText} is not a calendar date.`);
+        }
+        if (rest === "") {
+            const timestamp = bareDateAt === "start"
+                ? new Date(year, month - 1, day, 0, 0, 0, 0).getTime()
+                : new Date(year, month - 1, day, 23, 59, 59, 999).getTime();
+            return { timestamp, hasTime: false };
+        }
+    }
+    const timestamp = Date.parse(trimmed);
+    if (Number.isNaN(timestamp)) {
+        throw new Error(`Invalid ${field} "${value}". Expected an ISO date with a time of day (e.g. 2026-10-02T18:00:00+02:00) or a bare date (YYYY-MM-DD).`);
+    }
+    return { timestamp, hasTime: true };
+}

package/dist/tools/task-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"task-tools.d.ts","sourceRoot":"","sources":["../../src/tools/task-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGpE,OAAO,EAAE,YAAY,EAAyC,MAAM,iBAAiB,CAAC;AAQtF,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,QAgErE;AAuPD;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,EAAE,YAAY,GAAE,OAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CAqJ/H"}
+{"version":3,"file":"task-tools.d.ts","sourceRoot":"","sources":["../../src/tools/task-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGpE,OAAO,EAAE,YAAY,EAAyC,MAAM,iBAAiB,CAAC;AAQtF,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,QAgErE;AAuPD;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,EAAE,YAAY,GAAE,OAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CAuJ/H"}

package/dist/tools/task-tools.js

@@ -280,6 +280,8 @@ async function generateTaskMetadata(task, timeEntries, isDetailView = false) {
     }
     const metadataLines = [
         `task_id: ${task.id}`,
+        // The custom ID (e.g. "PQPS-1234") is what people quote; every tool accepts it
+        ...(task.custom_id ? [`custom_id: ${task.custom_id}`] : []),
         `task_url: ${task.url}`,
         `name: ${task.name}`,
         `status: ${task.status.status}`,

package/dist/tools/task-write-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"task-write-tools.d.ts","sourceRoot":"","sources":["../../src/tools/task-write-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA4JpE,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,QA4vBtE"}
+{"version":3,"file":"task-write-tools.d.ts","sourceRoot":"","sources":["../../src/tools/task-write-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AA6JpE,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,QAyxBtE"}

package/dist/tools/task-write-tools.js

@@ -7,6 +7,7 @@ const utils_1 = require("../shared/utils");
 const clickup_text_1 = require("../clickup-text");
 const attachments_1 = require("../shared/attachments");
 const comments_1 = require("../shared/comments");
+const dates_1 = require("../shared/dates");
 /**
  * Shared wording for the image support of every markdown field in this file.
  * Kept in one place so the tools stay consistent about what a client may pass.
@@ -190,7 +191,7 @@ function registerTaskToolsWrite(server, userData) {
             });
             if (!response.ok) {
                 const errorData = await response.json().catch(() => ({}));
-                throw new Error(`Error adding comment: ${response.status} ${response.statusText} - ${JSON.stringify(errorData)}`);
+                throw new Error(`ClickUp API ${response.status} ${response.statusText} - ${JSON.stringify(errorData)}`);
             }
             const commentData = await response.json();
             return {
@@ -234,8 +235,8 @@ function registerTaskToolsWrite(server, userData) {
             "ClickUp shows no 'edited' marker, so people who already read the comment will not notice the change - for anything that changes meaning after a discussion has started, prefer a follow-up comment.",
             "Editing does not reset the creation date, so the edit window does not get extended by editing.",
             COMMENT_FORMATTING_HINT,
-            IMAGE_SUPPORT_HINT,
-            "IMAGES ON EDIT: reading a comment (getTaskById) returns its images as markdown, so passing that text back keeps them - an existing ClickUp attachment URL is re-embedded without uploading again. Only an image whose markdown you drop disappears.",
+            "IMAGES ON EDIT: an edit can only KEEP the images already in this comment. Reading the comment (getTaskById) returns them as markdown, and passing that markdown back keeps them; an image whose markdown you drop disappears.",
+            "ClickUp refuses to add any other image to an existing comment - a new file, a data URI, a web URL, or an image of another comment or of the task description - so such a reference is rejected before anything is uploaded. To share a new image, post a new comment with addComment.",
             "Task URLs (https://app.clickup.com/t/TASK_ID) become live task references, and existing references are read back as such URLs - passing the text back keeps them.",
         ];
         if (config_1.CONFIG.primaryLanguageHint && config_1.CONFIG.primaryLanguageHint.toLowerCase() !== 'en') {
@@ -259,14 +260,14 @@ function registerTaskToolsWrite(server, userData) {
                 (0, utils_1.getCurrentUser)(),
             ]);
             assertCommentIsEditable(existing, userData.user.id);
-            // Same pipeline as addComment - the undocumented rich `comment` array is
-            // accepted by PUT too, so formatting and images survive an edit. Images are
-            // resolved and uploaded before the PUT, so a broken reference leaves the
-            // existing comment untouched.
+            // Same converter as addComment - the undocumented rich `comment` array is
+            // accepted by PUT too, so formatting survives an edit. Images are different:
+            // ClickUp only lets an edit keep the comment's OWN images, so they are
+            // matched against the stored fragments and nothing is ever uploaded here.
             const abortNotice = "the comment was NOT changed";
-            const { markdown, images } = await resolveImagesOrAbort(comment, abortNotice);
-            const uploaded = await uploadImagesOrAbort(task_id, images, abortNotice);
-            const commentBlocks = (0, clickup_text_1.convertMarkdownToClickUpBlocks)(markdown, (0, attachments_1.toAttachmentMap)(uploaded));
+            const markdown = (0, clickup_text_1.normalizeImageDestinations)(comment);
+            const keptImages = keepOwnCommentImages(existing, markdown, abortNotice);
+            const commentBlocks = (0, clickup_text_1.convertMarkdownToClickUpBlocks)(markdown, (0, attachments_1.toAttachmentMap)(keptImages));
             // Only `comment` is sent: sending `comment_text` alongside it appends that
             // string to the blocks instead of being ignored.
             const response = await fetch(`https://api.clickup.com/api/v2/comment/${comment_id}`, {
@@ -279,7 +280,7 @@ function registerTaskToolsWrite(server, userData) {
             });
             if (!response.ok) {
                 const errorData = await response.json().catch(() => ({}));
-                throw new Error(`Error editing comment: ${response.status} ${response.statusText} - ${JSON.stringify(errorData)}`);
+                throw new Error(`ClickUp API ${response.status} ${response.statusText} - ${JSON.stringify(errorData)}`);
             }
             return {
                 content: [
@@ -293,7 +294,10 @@ function registerTaskToolsWrite(server, userData) {
                             `created: ${timestampToIso(existing.date)} (unchanged by the edit)`,
                             `previous_text: ${existing.comment_text || '(no plain text available)'}`,
                             `new_comment: ${summarizeMarkdownForEcho(comment)}`,
-                            ...formatAttachedImages(uploaded),
+                            ...(keptImages.length > 0 ? [
+                                `images_kept: ${keptImages.length}`,
+                                ...keptImages.map((k) => `  - ${k.attachment.name} (${k.attachment.url})`),
+                            ] : []),
                         ].join('\n')
                     }
                 ],
@@ -335,7 +339,7 @@ function registerTaskToolsWrite(server, userData) {
             });
             if (!response.ok) {
                 const errorData = await response.json().catch(() => ({}));
-                throw new Error(`Error deleting comment: ${response.status} ${response.statusText} - ${JSON.stringify(errorData)}`);
+                throw new Error(`ClickUp API ${response.status} ${response.statusText} - ${JSON.stringify(errorData)}`);
             }
             return {
                 content: [
@@ -395,7 +399,7 @@ function registerTaskToolsWrite(server, userData) {
         time_estimate: taskTimeEstimateSchema.nullable().describe(taskTimeEstimateSchema.description + CLEAR_HINT),
         points: taskPointsSchema.nullable().describe(taskPointsSchema.description + CLEAR_HINT),
         tags: taskTagsSchema.describe("Optional array of tag names (will replace existing tags)"),
-        parent_task_id: zod_1.z.string().optional().describe("Optional parent task ID to change parent/child relationships"),
+        parent_task_id: taskIdSchema.optional().describe("Optional parent task ID to move this task under, as a subtask: internal ID (e.g. \"869c4za0g\") or custom ID (e.g. \"SOI-4422\")"),
         assignees: zod_1.z.array(zod_1.z.string()).optional().describe("Optional array of user IDs to add as assignees - existing assignees are kept"),
         remove_assignees: zod_1.z.array(zod_1.z.string()).optional().describe("Optional array of user IDs to unassign from the task. Combine with assignees to replace one assignee by another."),
         waiting_on: zod_1.z.array(zod_1.z.string()).optional().describe("Optional array of task IDs that this task should wait on (will replace existing waiting_on relationships)"),
@@ -418,8 +422,22 @@ function registerTaskToolsWrite(server, userData) {
                         }],
                 };
             }
+            // A malformed date must be refused before anything is written: it would
+            // otherwise be sent as null and clear the date (see parseDateInput).
+            assertValidTaskDates({ due_date, start_date });
             // Resolve custom task IDs (e.g. "SOI-4422") to internal IDs
             task_id = await (0, utils_1.resolveTaskId)(task_id);
+            // Current dependencies and links come back from ClickUp with internal IDs,
+            // so the requested lists must use them too: an unresolved "SOI-4422" would
+            // not match its own internal ID, and the existing relation would be removed
+            // as "no longer requested" while a duplicate is added. Resolved up front, so
+            // an unknown custom ID aborts the update before anything is written.
+            [blocking, waiting_on, linked_tasks] = await Promise.all([blocking, waiting_on, linked_tasks].map(resolveTaskIdList));
+            // ClickUp's `parent` field only takes an internal ID: a custom ID gets a bare
+            // 500 Internal Server Error (verified live), with nothing to tell what is wrong.
+            if (parent_task_id !== undefined) {
+                parent_task_id = await (0, utils_1.resolveTaskId)(parent_task_id);
+            }
             const userData = await (0, utils_1.getCurrentUser)();
             // Get task details including current markdown description
             const taskResponse = await fetch(`https://api.clickup.com/api/v2/task/${task_id}?include_markdown_description=true`, {
@@ -543,7 +561,7 @@ function registerTaskToolsWrite(server, userData) {
                 });
                 if (!updateResponse.ok) {
                     const errorData = await updateResponse.json().catch(() => ({}));
-                    throw new Error(`Error updating task: ${updateResponse.status} ${updateResponse.statusText} - ${JSON.stringify(errorData)}`);
+                    throw new Error(`ClickUp API ${updateResponse.status} ${updateResponse.statusText} - ${JSON.stringify(errorData)}`);
                 }
                 updatedTask = await updateResponse.json();
             }
@@ -626,7 +644,7 @@ function registerTaskToolsWrite(server, userData) {
         time_estimate: taskTimeEstimateSchema,
         points: taskPointsSchema,
         tags: taskTagsSchema,
-        parent_task_id: zod_1.z.string().optional().describe("Optional parent task ID to create this as a subtask"),
+        parent_task_id: taskIdSchema.optional().describe("Optional parent task ID to create this as a subtask: internal ID (e.g. \"869c4za0g\") or custom ID (e.g. \"SOI-4422\")"),
         assignees: zod_1.z.array(zod_1.z.string()).optional().describe(createAssigneeDescription(userData))
     }, {
         readOnlyHint: false,
@@ -640,6 +658,12 @@ function registerTaskToolsWrite(server, userData) {
             // behind. Uploading has to wait until the task exists, though - ClickUp
             // attachments always belong to a task.
             const { markdown: normalizedDescription, images } = await resolveImagesOrAbort(description, "the task was NOT created");
+            // ClickUp's `parent` field only takes an internal ID: a custom ID gets a bare
+            // 500 Internal Server Error (verified live). Resolved before the task exists,
+            // so an unknown parent leaves nothing behind.
+            if (parent_task_id !== undefined) {
+                parent_task_id = await (0, utils_1.resolveTaskId)(parent_task_id);
+            }
             const userData = await (0, utils_1.getCurrentUser)();
             const currentUserId = userData.user.id;
             const requestBody = buildTaskRequestBody({
@@ -659,7 +683,7 @@ function registerTaskToolsWrite(server, userData) {
             });
             if (!response.ok) {
                 const errorData = await response.json().catch(() => ({}));
-                throw new Error(`Error creating task: ${response.status} ${response.statusText} - ${JSON.stringify(errorData)}`);
+                throw new Error(`ClickUp API ${response.status} ${response.statusText} - ${JSON.stringify(errorData)}`);
             }
             const createdTask = await response.json();
             // Tags are omitted from the create body by buildTaskRequestBody because they
@@ -758,15 +782,85 @@ function convertPriorityToNumber(priority) {
         default: return 3;
     }
 }
+/**
+ * The task payload carries the priority NAME (`priority: { id: "4", priority: "low" }`),
+ * so a numeric-only lookup turned every real priority into "unknown". Accept both.
+ */
 function convertPriorityToString(priority) {
+    if (typeof priority === 'string' && ['urgent', 'high', 'normal', 'low'].includes(priority.toLowerCase())) {
+        return priority.toLowerCase();
+    }
     const priorityMap = { 1: 'urgent', 2: 'high', 3: 'normal', 4: 'low' };
-    return priorityMap[priority] || 'unknown';
+    return priorityMap[Number(priority)] || 'unknown';
 }
 function formatTimeEstimate(hours) {
     const displayHours = Math.floor(hours);
     const displayMinutes = Math.round((hours - displayHours) * 60);
     return displayHours > 0 ? `${displayHours}h ${displayMinutes}m` : `${displayMinutes}m`;
 }
+/**
+ * Match the image references of an edited comment against the images the comment
+ * already contains, and return the stored attachment object for each of them.
+ *
+ * Verified live on `PUT /comment/{id}`: an image fragment is only accepted when it
+ * carries the real attachment of an image that is ALREADY in that comment. Any
+ * other attachment - a fresh upload, the task description's image, an image of
+ * another comment - is refused with 401 ACCESS_610, and a fragment whose id is not
+ * a real attachment id fails with 404 ACCESS_028. Reusing the stored object (real
+ * id, dimensions included) is therefore the only working way to keep an image, and
+ * anything else is rejected here, before a request is made - uploading first would
+ * only leave an orphan attachment on the task behind the failed edit.
+ */
+function keepOwnCommentImages(existing, markdown, abortNotice) {
+    const sources = (0, clickup_text_1.collectMarkdownImageSources)(markdown);
+    if (sources.length === 0) {
+        return [];
+    }
+    const ownImages = new Map();
+    for (const fragment of existing.comment ?? []) {
+        if (fragment?.type === "image" && fragment.image?.url) {
+            ownImages.set(normalizeUrl(fragment.image.url), fragment.image);
+        }
+    }
+    const kept = [];
+    const refused = [];
+    const seen = new Set();
+    for (const { src } of sources) {
+        if (seen.has(src)) {
+            continue;
+        }
+        seen.add(src);
+        const stored = ownImages.get(normalizeUrl(src));
+        if (stored) {
+            kept.push({ src, attachment: stored });
+        }
+        else {
+            refused.push(src);
+        }
+    }
+    if (refused.length > 0) {
+        throw new Error([
+            `${refused.length} image reference(s) are not images of this comment, so ${abortNotice}:`,
+            ...refused.map((src) => `  - ${summarizeImageSource(src)}`),
+            `ClickUp only lets an edit keep the images already in the comment - it refuses to add any other image.`,
+            `Remove these references, or post the new image in a new comment with addComment.`,
+        ].join("\n"));
+    }
+    return kept;
+}
+/** Compare attachment URLs regardless of percent-encoding of the filename */
+function normalizeUrl(url) {
+    try {
+        return decodeURI(url.trim());
+    }
+    catch {
+        return url.trim();
+    }
+}
+/** Shorten a data URI so an error message never repeats a base64 payload */
+function summarizeImageSource(src) {
+    return src.startsWith("data:") ? `${src.slice(0, 40)}... (data URI)` : src;
+}
 /**
  * Load a single comment of a task.
  *
@@ -800,6 +894,10 @@ async function findTaskComment(taskId, commentId) {
         }
         checked += page.length;
         sawThreadedReplies || (sawThreadedReplies = page.some((entry) => (entry.reply_count ?? 0) > 0));
+        // A short page is the last one - requesting the next would only return [].
+        if (page.length < comments_1.COMMENTS_PER_PAGE) {
+            break;
+        }
         // Comments come back newest first, so once a page runs past the edit window
         // there is nothing editable further back.
         const oldest = page[page.length - 1];
@@ -853,6 +951,35 @@ function timestampToIso(timestamp) {
     const timezoneOffset = sign + String(offsetHours).padStart(2, '0') + ':' + String(offsetMinutes).padStart(2, '0');
     return `${year}-${month}-${day}T${hours}:${minutes}${timezoneOffset}`;
 }
+/**
+ * Convert a due/start date parameter for the task API.
+ *
+ * ClickUp drops the time of day unless `due_date_time`/`start_date_time` is true
+ * (verified live: 18:00 came back as 04:00, its all-day placeholder), so report
+ * whether the caller gave a time. A bare date (YYYY-MM-DD) is an all-day value at
+ * local midnight. Invalid or impossible dates throw instead of being sent as null.
+ */
+function parseTaskDate(value, field) {
+    return (0, dates_1.parseDateInput)(value, field, "start");
+}
+/** Validate due/start dates up front so a bad value never reaches a write */
+function assertValidTaskDates(dates) {
+    for (const field of ["due_date", "start_date"]) {
+        const value = dates[field];
+        if (typeof value === "string") {
+            parseTaskDate(value, field);
+        }
+    }
+}
+/** Resolve every ID of a relation list to an internal ID, without duplicates */
+async function resolveTaskIdList(ids) {
+    if (ids === undefined) {
+        return undefined;
+    }
+    // Deduplicate before resolving too: each custom ID costs one API call
+    const resolved = await Promise.all([...new Set(ids)].map((id) => (0, utils_1.resolveTaskId)(id)));
+    return [...new Set(resolved)];
+}
 function buildTaskRequestBody(params, currentUserId) {
     const requestBody = {};
     if (params.name !== undefined) {
@@ -867,10 +994,24 @@ function buildTaskRequestBody(params, currentUserId) {
     // null clears the value - it must be sent as is, new Date(null) would set 1970-01-01.
     // time_estimate is the exception: ClickUp accepts null but silently keeps the estimate, only 0 clears it.
     if (params.due_date !== undefined) {
-        requestBody.due_date = params.due_date === null ? null : new Date(params.due_date).getTime();
+        if (params.due_date === null) {
+            requestBody.due_date = null;
+        }
+        else {
+            const due = parseTaskDate(params.due_date, 'due_date');
+            requestBody.due_date = due.timestamp;
+            requestBody.due_date_time = due.hasTime;
+        }
     }
     if (params.start_date !== undefined) {
-        requestBody.start_date = params.start_date === null ? null : new Date(params.start_date).getTime();
+        if (params.start_date === null) {
+            requestBody.start_date = null;
+        }
+        else {
+            const start = parseTaskDate(params.start_date, 'start_date');
+            requestBody.start_date = start.timestamp;
+            requestBody.start_date_time = start.hasTime;
+        }
     }
     if (params.time_estimate !== undefined) {
         requestBody.time_estimate = params.time_estimate === null ? 0 : Math.round(params.time_estimate * 60 * 60 * 1000);
@@ -894,9 +1035,18 @@ function buildTaskRequestBody(params, currentUserId) {
 // Helper function to manage task dependencies
 async function updateTaskDependencies(taskId, taskData, dependencies) {
     const errors = [];
-    // Get current dependencies
-    const currentBlocking = taskData.blocking?.map((dep) => dep.id) || [];
-    const currentWaitingOn = taskData.waiting_on?.map((dep) => dep.id) || [];
+    // Get current dependencies. The task payload has no `blocking`/`waiting_on`
+    // arrays (verified live): both directions live in one flat `dependencies` array
+    // of `{ task_id, depends_on }` records, and this task can sit on either side.
+    // Reading the missing fields made every current dependency look absent, so
+    // `waiting_on: []`/`blocking: []` never removed anything and reported no error.
+    const dependencyRecords = Array.isArray(taskData.dependencies) ? taskData.dependencies : [];
+    const currentWaitingOn = dependencyRecords
+        .filter((dep) => dep.task_id === taskId && dep.depends_on)
+        .map((dep) => dep.depends_on);
+    const currentBlocking = dependencyRecords
+        .filter((dep) => dep.depends_on === taskId && dep.task_id)
+        .map((dep) => dep.task_id);
     // `linked_tasks` entries are link records, not tasks: each has `task_id` and
     // `link_id` (the two ends of the link) and no `id` at all. Mapping `.id` here
     // produced `[undefined, ...]`, so every existing link looked like it was no

package/dist/tools/time-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"time-tools.d.ts","sourceRoot":"","sources":["../../src/tools/time-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAyDpE,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,QAqFtD;AA6OD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,QAmPvD"}
+{"version":3,"file":"time-tools.d.ts","sourceRoot":"","sources":["../../src/tools/time-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAoEpE,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,QAqFtD;AA6OD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,SAAS,QAmPvD"}

package/dist/tools/time-tools.js

@@ -5,12 +5,22 @@ exports.registerTimeToolsWrite = registerTimeToolsWrite;
 const zod_1 = require("zod");
 const config_1 = require("../shared/config");
 const utils_1 = require("../shared/utils");
+const dates_1 = require("../shared/dates");
 /**
  * Converts ISO date string to Unix timestamp in milliseconds
  */
 function isoToTimestamp(isoString) {
     return new Date(isoString).getTime();
 }
+/**
+ * Convert a date range filter bound. A bare date (YYYY-MM-DD) means the whole
+ * local day: `new Date("2026-10-01")` is UTC midnight, so as an end bound it used
+ * to exclude the very day the summary header announced ("2026-10-01 to 2026-10-01").
+ * Invalid or impossible dates throw instead of sending `NaN` to the API.
+ */
+function dateFilterToTimestamp(value, bound) {
+    return (0, dates_1.parseDateInput)(value, bound === "start" ? "start_date" : "end_date", bound).timestamp;
+}
 /**
  * Formats timestamp to ISO string with local timezone (not UTC)
  */
@@ -57,8 +67,8 @@ function registerTimeToolsRead(server) {
         task_id: zod_1.z.string().min(1).refine(val => (0, utils_1.isTaskId)(val) || (0, utils_1.isCustomTaskId)(val), {
             message: "Must be an internal task ID (6-16 alphanumeric characters) or a custom task ID (e.g. SOI-4422)"
         }).optional().describe("Optional task ID to filter entries: internal ID (e.g. \"869c4za0g\") or custom ID (e.g. \"SOI-4422\"). If not provided, returns all user's time entries."),
-        start_date: zod_1.z.string().optional().describe("Optional start date filter as ISO date string (e.g., '2024-10-06T00:00:00+02:00'). Defaults to 30 days ago."),
-        end_date: zod_1.z.string().optional().describe("Optional end date filter as ISO date string (e.g., '2024-10-06T23:59:59+02:00'). Defaults to current date."),
+        start_date: zod_1.z.string().optional().describe("Optional start date filter as ISO date string (e.g., '2024-10-06T00:00:00+02:00') or a bare date (e.g., '2024-10-06', from the start of that local day). Defaults to 30 days ago."),
+        end_date: zod_1.z.string().optional().describe("Optional end date filter as ISO date string (e.g., '2024-10-06T23:59:59+02:00') or a bare date (e.g., '2024-10-06', up to the end of that local day). Defaults to current date."),
         list_id: zod_1.z.string().optional().describe("Optional single list ID to filter time entries by a specific list"),
         space_id: zod_1.z.string().optional().describe("Optional single space ID to filter time entries by a specific space"),
         include_all_users: zod_1.z.boolean().optional().describe("Optional flag to include time entries from all team members (default: false, only current user)")
@@ -72,10 +82,10 @@ function registerTimeToolsRead(server) {
                 params.append('task_id', await (0, utils_1.resolveTaskId)(task_id));
             }
             if (start_date) {
-                params.append('start_date', isoToTimestamp(start_date).toString());
+                params.append('start_date', dateFilterToTimestamp(start_date, "start").toString());
             }
             if (end_date) {
-                params.append('end_date', isoToTimestamp(end_date).toString());
+                params.append('end_date', dateFilterToTimestamp(end_date, "end").toString());
             }
             // Add single list_id or space_id filter (not both)
             if (list_id) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sebastienheyd/clickup-mcp",
-  "version": "1.10.1",
+  "version": "1.10.2",
   "description": "Search, create, and retrieve tasks, add comments, and track time through natural language commands.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",