@stylusnexus/work-plan 2026.7.3 → 2026.7.10

package/README.md

@@ -503,6 +503,7 @@ The bundled `notes/` folder stays empty until you run `/work-plan init-repo <key
 - **AI subcommands (`group`, `suggest-priorities`) send issue titles to Claude** via Claude Code's existing integration. Body content, code, and PR contents are NOT sent. If your repo is private and you're cautious about what reaches the model, skip these subcommands.
 - **`init-repo` writes to your config via `yq -i`.** Inputs are JSON-encoded before being passed to `yq`, so a maliciously crafted `--github=` value can't break out of the YAML edit.
 - **`install.sh` / `install.ps1` only touch user-owned dirs.** No `sudo`, no system-wide changes, no privilege escalation.
+- **Least-privilege tool access.** The `work-plan` and `repo-activity-summary` skills declare `allowed-tools` frontmatter, so Claude Code grants them a scoped allowlist — `work-plan` gets `Bash(work-plan:*)`, `Bash(python3:*)`, and `Write` (the two-step AI subcommands' JSON cache); `repo-activity-summary` gets `Bash(gh:*)` — rather than unrestricted shell.
 
 For vulnerability reporting, threat model, and past advisories, see [SECURITY.md](./SECURITY.md).
 

package/VERSION

@@ -1 +1 @@
-2026.07.03+7d98e1e
+2026.07.10+92f8eef

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stylusnexus/work-plan",
-  "version": "2026.7.3",
+  "version": "2026.7.10",
   "description": "Track-aware daily work planning over GitHub issues. Shared tracks (git-synced .work-plan/ in each repo), AI clustering (group/auto-triage), VS Code viewer, Claude Code + Codex plugins. Pure Python stdlib.",
   "bin": {
     "work-plan": "bin/work-plan"

package/skills/work-plan/SKILL.md

@@ -2,6 +2,7 @@
 name: work-plan
 description: Use when starting or ending a work session across many GitHub issues, switching between parallel agent sessions on different workstreams, re-orienting on what to do next, sweeping for stale tracking state, or bootstrapping a new repo into a daily-planning system.
 argument-hint: "[brief|handoff|orient|reconcile|hygiene|--help]"
+allowed-tools: Bash(work-plan:*), Bash(python3:*), Write
 ---
 
 # Work Plan

package/skills/work-plan/commands/brief.py

@@ -24,6 +24,20 @@ from lib.drift import detect_drift
 from lib.render import time_aware_framing, render_track_row, render_archived_reopen
 
 
+def _numeric_refs(*ref_lists) -> list:
+    """Union of the given ref lists, keeping only int issue numbers, sorted.
+
+    `next_up` legitimately holds non-issue string tokens (epic/track names like
+    `golden-path-v2`) alongside issue numbers. Those aren't fetchable GitHub
+    issues, and `sorted()` can't order a set that mixes str and int (#417), so
+    string tokens are dropped from the fetch set.
+    """
+    refs: set = set()
+    for lst in ref_lists:
+        refs |= set(lst or [])
+    return sorted(n for n in refs if isinstance(n, int))
+
+
 def run(args: list[str]) -> int:
     flags, _ = parse_flags(args, {"--repo"})
     repo_arg = flags.get("--repo")
@@ -137,7 +151,8 @@ def _build_track_block(track, cfg, now: datetime) -> dict:
     stored_next_up = meta.get("next_up") or []
     # Fetch state for stored next_up issues even if they're not in github.issues,
     # so stale closed entries surface as a clear signal rather than vanishing.
-    fetch_nums = sorted(set(issue_nums) | set(stored_next_up))
+    # Only numeric refs are fetchable; string tokens in next_up are dropped (#417).
+    fetch_nums = _numeric_refs(issue_nums, stored_next_up)
     issues = fetch_issues(repo, fetch_nums) if (repo and fetch_nums) else []
     issues_by_num = {i["number"]: i for i in issues}
 

package/skills/work-plan/tests/test_brief_numeric_refs.py

@@ -0,0 +1,36 @@
+"""#417 — brief must not crash when next_up mixes issue numbers and string tokens.
+
+`sorted(set(issue_nums) | set(stored_next_up))` raised
+`TypeError: '<' not supported between instances of 'str' and 'int'` for any track
+whose `next_up` held a non-issue token (e.g. an epic name like `golden-path-v2`)
+next to issue numbers. `_numeric_refs` unions the ref lists, drops non-int tokens
+(they aren't fetchable issues), and sorts what remains.
+"""
+import sys
+import unittest
+from pathlib import Path
+
+SKILL_ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(SKILL_ROOT))
+
+from commands.brief import _numeric_refs
+
+
+class NumericRefsTest(unittest.TestCase):
+    def test_mixed_str_and_int_does_not_crash_and_drops_tokens(self):
+        # The exact shape that crashed live: a string epic token beside numbers.
+        result = _numeric_refs([6012, 6015], ["golden-path-v2", 5996, 5979])
+        self.assertEqual(result, [5979, 5996, 6012, 6015])
+
+    def test_dedupes_across_lists(self):
+        self.assertEqual(_numeric_refs([100, 200], [200, 300]), [100, 200, 300])
+
+    def test_handles_none_and_empty(self):
+        self.assertEqual(_numeric_refs(None, []), [])
+
+    def test_all_string_tokens_yield_empty(self):
+        self.assertEqual(_numeric_refs(["golden-path-v2", "epic-x"]), [])
+
+
+if __name__ == "__main__":
+    unittest.main()