toga-ai 1.0.986 → 1.0.987
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -16,6 +16,8 @@ files:
|
|
|
16
16
|
- claude/agents/ticket-reader.md
|
|
17
17
|
- claude/scripts/hooks/start-gate.js
|
|
18
18
|
- claude/skills/start/scripts/start-helper.js
|
|
19
|
+
- claude/.claude/settings.json
|
|
20
|
+
- claude/scripts/install.js
|
|
19
21
|
related:
|
|
20
22
|
- ./ticket-branch-creation-safety.md
|
|
21
23
|
- ./harness-distribution.md
|
|
@@ -73,9 +75,13 @@ writes, and agents until the session has a ticket. These replaced `/kickoff`, `/
|
|
|
73
75
|
|
|
74
76
|
- Writes go only to the session's own ticket — the `start-gate` hook blocks any other task id,
|
|
75
77
|
and blocks task creation, deletion, moves, tags, links, docs, chat, and time tracking.
|
|
76
|
-
- `
|
|
77
|
-
|
|
78
|
-
|
|
78
|
+
- The `start-gate` hook is the hard limit: session ticket only; fields Application,
|
|
79
|
+
Stakeholders, Task Type, Pseudocode, Has UI Changes, and the name; statuses `in progress` and
|
|
80
|
+
`development finished` only.
|
|
81
|
+
- No permission prompt for `clickup_update_task` or `clickup_create_comment` (since 2026-10-09).
|
|
82
|
+
Field changes are written only after the developer's yes in chat; status changes and the PM
|
|
83
|
+
comment need no question. Only `Bash(git push *)` stays in `permissions.ask`. `npx toga-ai`
|
|
84
|
+
strips the old ClickUp rules from a dev's existing `permissions.ask` (see harness distribution).
|
|
79
85
|
- Use only the `clickup` MCP server (`mcp__clickup__clickup_*`). The old read-only
|
|
80
86
|
"claude.ai ClickUP for Dev" server (`mcp__claude_ai_ClickUP_for_Dev__*`) is blocked.
|
|
81
87
|
|
|
@@ -156,6 +162,8 @@ All tested 2026-10-08:
|
|
|
156
162
|
those, and `create-branch` creates/switches the ticket branch after the dev's yes. (jcardinal)
|
|
157
163
|
- 2026-10-09 — `/start` sets status `to do` -> `in progress`; the gate allows `in progress` and
|
|
158
164
|
`development finished` only. (jcardinal)
|
|
165
|
+
- 2026-10-09 — TRUE-82605: `clickup_update_task` and `clickup_create_comment` no longer ask;
|
|
166
|
+
the gate is the limit, field changes need the dev's yes in chat. (jcardinal)
|
|
159
167
|
|
|
160
168
|
## Related
|
|
161
169
|
|
|
@@ -6,11 +6,12 @@ project: Claude Harness
|
|
|
6
6
|
client: shared
|
|
7
7
|
type: workflow
|
|
8
8
|
status: active
|
|
9
|
-
updated: 2026-10-
|
|
9
|
+
updated: 2026-10-09
|
|
10
10
|
owners: ["jcardinal"]
|
|
11
11
|
files:
|
|
12
12
|
- claude/scripts/install.js
|
|
13
13
|
- claude/knowledge.js
|
|
14
|
+
- claude/.claude/settings.json
|
|
14
15
|
related:
|
|
15
16
|
- standalone/apps/claude/workflows/knowledge-publish-pipeline.md
|
|
16
17
|
---
|
|
@@ -45,6 +46,12 @@ There are **two copies** of `knowledge.js` on a developer's machine, and the ski
|
|
|
45
46
|
- **Publish Action (`.github/workflows/publish.yml`, on push to `_main`: bump patch, `npm publish`).** Devs get a change only after a version bump (`/start` runs `npx toga-ai@latest` when installed != latest).
|
|
46
47
|
- `npm publish` **E404** ("could not be found or you do not have permission") = auth failure, not a missing package: the `NPM_TOKEN` secret in the repo's **Actions environment** expired. Fix: new npm Automation token, update the secret, re-run only the latest failed run.
|
|
47
48
|
- A publish ships the whole tip of `_main`, so earlier failed runs are not lost. Do not retry old runs (they hit "version already published").
|
|
49
|
+
- **Removing a permission rule from the shipped `.claude/settings.json` does not remove it from devs.** `mergeSettings()` only adds template rules. To retire one, also list it in `RETIRED_TOGA_PERMISSIONS` (`scripts/install.js`); `npx toga-ai` then filters it out of the dev's existing lists.
|
|
50
|
+
- **Auto mode blocks Claude from editing permission rules in `.claude/settings.json`** ("Self-Modification" safety classifier) — subagents too, even when the lead asked, and no approval prompt is shown. A person makes that one edit by hand; Claude can then do the rest (`install.js`, skill text).
|
|
51
|
+
|
|
52
|
+
## Change history
|
|
53
|
+
|
|
54
|
+
- 2026-10-09 — Added permission-retire (`RETIRED_TOGA_PERMISSIONS`) and auto-mode settings-edit gotchas. (jcardinal)
|
|
48
55
|
|
|
49
56
|
## Related
|
|
50
57
|
|
package/package.json
CHANGED