toga-ai 1.0.1145 → 1.0.1146

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/knowledge/standalone/apps/claude/workflows/clickup-ticket-workflow.md +4 -0
  2. package/package.json +1 -1
  3. package/scripts/hooks/start-gate.js +3 -2
package/knowledge/standalone/apps/claude/workflows/clickup-ticket-workflow.md CHANGED
@@ -84,6 +84,9 @@ writes, and agents until the session has a ticket. These replaced `/kickoff`, `/
84
84
  other task id is blocked), and never to Has Code Changes (worker2 owns it). It also blocks task
85
85
  creation, deletion, moves, links, docs, chat, time tracking and `update_comment` (no task id
86
86
  to check).
87
+ - Reads are always open: `get_*`, `search*`, `filter_*`, `list_*`, `find_*`, and `download_*`
88
+ (task and doc-page attachments — ticket screenshots are often the whole spec; team rule
89
+ 2026-10-24, jcardinal). The download URL is short-lived and single-use: fetch it once, at once.
87
90
  - No permission prompt for `clickup_update_task` or `clickup_create_comment` (since 2026-10-09). Only `Bash(git push *)` stays in `permissions.ask`. `npx toga-ai`
88
91
  strips the old ClickUp rules from a dev's existing `permissions.ask` (see harness distribution).
89
92
  - Use only the `clickup` MCP server (`mcp__clickup__clickup_*`). The old read-only
@@ -208,6 +211,7 @@ All tested 2026-10-08:
208
211
 
209
212
  - 2026-10-13 — `/commit` now pushes the ticket branch; `/finish`'s "finished" yes covers commit,
210
213
  push, and PR with no extra asks; Claude may switch to the ticket branch in normal work. (jcardinal, TRUE-82715)
214
+ - 2026-10-24 — `start-gate` allows `clickup_download_*` (task / doc-page attachments) as reads. (jcardinal, TRUE-83181)
211
215
  ## Related
212
216
 
213
217
  - [Ticket-branch creation safety](./ticket-branch-creation-safety.md)
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "toga-ai",
3
- "version": "1.0.1145",
3
+ "version": "1.0.1146",
4
4
  "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
5
5
  "keywords": [
6
6
  "claude",
package/scripts/hooks/start-gate.js CHANGED
@@ -106,8 +106,9 @@ const CLICKUP_URL_PREFIX = 'https://app.clickup.com/';
106
106
  const INTERNAL_ID_RE = /^[A-Za-z0-9]+$/;
107
107
  const MAX_UNWRAP_DEPTH = 6;
108
108
  const OLD_CLICKUP_SERVER_RE = /^claude_ai_ClickUP_for_Dev$/i;
109
- /* get_* covers get_operators and get_schema. download_* is a read but is not needed — blocked. */
110
- const CLICKUP_READ_RE = /^(get_.+|search|search_.+|filter_.+|list_.+|find_.+|resolve_assignees)$/;
109
+ /* get_* covers get_operators and get_schema. download_* covers task and doc-page attachments
110
+ (ticket screenshots are often the whole spec — team rule 2026-10-24, jcardinal). */
111
+ const CLICKUP_READ_RE = /^(get_.+|search|search_.+|filter_.+|list_.+|find_.+|download_.+|resolve_assignees)$/;
111
112
  /* Any field of the session ticket (team rule 2026-10-15). Not `task_type`: Task Type is a custom field here. */
112
113
  const UPDATE_TASK_KEYS = new Set([
113
114
  'task_id', 'workspace_id', 'status', 'name', 'custom_fields', 'markdown_description', 'priority',