Add ticktick Plugin: official TickTick (international) MCP + task-management Skill

[HopeYin]

Problem

TickTick (international, ticktick.com) users currently have no hosted Plugin connecting MiniMax Code to the official TickTick MCP server. This Plugin adds that connection plus a Skill that makes task management safe. China-version 滴答清单 (dida365.com) accounts are a separate system with no shared data — see the sibling dida365 Plugin (separate PR).

What this Plugin contains

• mcp.json — connects to the official TickTick MCP endpoint https://mcp.ticktick.com (streamable-http). No credentials are shipped.
• Skill ticktick — teaches the agent to operate the 40+ official tools safely: look up before mutating, require explicit confirmation before destructive actions, clarify ambiguous requests, split complex requests, and follow parameter conventions (priority scale 0/1/3/5, ISO 8601 datetimes with colon offsets, batch limits, delete_task requiring both task_id and project_id).

Example prompts

What are my tasks today? Group them by list and priority.

Split this week's exam prep into 5 daily tasks in my "Study" list, 2 PM every day.

Show me what I completed last week, then check in my "early rise" habit for today.

Expected result

The agent lists/creates/updates tasks, manages lists, checks in habits and reviews focus records through the official MCP, with confirmation gates before any destructive operation.

Dependencies and platforms

• An international TickTick (ticktick.com) account.
• Authorization: API Token (Bearer) from TickTick web app → avatar → Settings → Account → API Token, added by the user as an Authorization header in their client MCP config. The endpoint also supports OAuth discovery for clients that provide a native OAuth flow for remote MCP servers.
• No executables, no paid services beyond the user's own TickTick account, no extra platforms. Windows / macOS / Linux.

Network and data behavior

• Single network destination: https://mcp.ticktick.com (HTTPS), the official TickTick service.
• Reads/creates/updates/deletes only the user's own tasks, lists, habits, focus records and countdowns, only at the user's instruction.
• The Plugin itself collects and uploads nothing; no telemetry, no third-party endpoints.

Test evidence

Automated: npm run check passes (validator green; the 2 failing repo tests are Windows-environment issues unrelated to this Plugin — path separator expectation and symlink privilege).

Manual (MiniMax Code on Windows, Bearer Token, 2026-08-15 — performed against the dida365 sibling endpoint, which shares the same official MCP implementation):

• ✅ Plugin loads; MCP connects and stays stable over streamable-http.
• ✅ Task query, creation (title / dueDate / list) and deletion verified end-to-end.
• ✅ Direct JSON-RPC call to the official endpoint with a JSON-number priority succeeds, confirming the server contract.
• ⚠️ Known issue, documented in README: with the MiniMax-M3 model, integers in tool arguments get stringified ("priority": 5 → "priority": "5") and the server rejects create_task / update_task / batch_update_tasks with must be integer. MiniMax-M2.7 and Kimi-K2.7-Code produce correct types on identical input. The bundled Skill ships parameter rules plus a self-check (inspect Received arguments echo) to mitigate; worst case the user sets the priority flag in the app.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 65eb99a75b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Require confirmation for every destructive tool

Expand this confirmation rule to cover delete_comment and delete_focus, which are exposed later in the same Skill but are not protected by either the task-specific lookup rule or this deletion rule. For requests such as cleaning up incorrect focus records or comments, the agent can currently invoke those irreversible tools without the explicit confirmation that the README promises for destructive operations.

Useful? React with 👍 / 👎.

[hetaoBackend]

@HopeYin 官方 TickTick endpoint 和 Skill 基本合格，但当前仍不能直接收录：

1. mcp.json 只声明裸 URL，官方 endpoint 需要 OAuth/Bearer。MCode 当前 portable Plugin 没有 Plugin 级 secret/OAuth overlay，用户全局 MCP header 也不会覆盖插件私有连接池；安装后这条 MCP 连接无法鉴权。
2. 建议当前改成 Skill-only Plugin，要求用户在 MCode 全局 MCP 设置中配置官方 server 和 Bearer；或者等待 MCode 提供安全的 Plugin MCP credential overlay。
3. PR 的端到端手测实际只在 dida365 sibling endpoint 上完成；TickTick 国际与 Dida365 数据不互通，需要国际账号和国际 endpoint 的真实验证。
4. 最新 head 尚无 CI/CodeQL；首次贡献 workflow 仍待批准。

旧 review 提到的 delete_comment/delete_focus 确认门已在新 head 修复。完成上述修改后，这个 PR 可以优先复审。

[HopeYin]

@hetaoBackend 感谢 Review，已按建议完成 rework 并补齐国际端点实测：

1. Skill-only 改造（24d055b）：删除 mcp.json，不再内置无法鉴权的裸 URL 连接。README 改为引导用户在 MCode 全局 MCP 设置中自行添加官方 server（https://mcp.ticktick.com）+ Bearer Token，并解释「为什么不自带 MCP 连接」（可移植插件不支持凭据 overlay，等官方后续能力）。插件自身零网络请求、零凭据。
2. 国际端点真实验证（2026-08-16，新注册的国际版 ticktick.com 账号 + API Token，直接 JSON-RPC 调用 https://mcp.ticktick.com）：
   • ✅ initialize：返回 TickTick MCP Server
   • ✅ create_task（priority 为 JSON 数字 5）：成功创建，服务端返回 "priority": 5
   • ✅ delete_task（task_id + project_id）：成功清理，测试任务已删除
3. 测试证据措辞：PR 描述中的自动化测试仅指本地 npm run check，CI/CodeQL 状态以实际 workflow 为准，未声称已通过。本地 npm run validate 通过。

请批准 workflow 运行并复审，谢谢！

[hetaoBackend]

已复核当前 head 24d055b。已移除无法鉴权的插件内 mcp.json，明确改为用户在全局 MCP 设置中配置官方端点与凭据；国际版账号边界、破坏性操作确认和数据流说明完整。候选分支本地完整检查 12/12 通过，当前 CI 与 CodeQL 全绿。批准合入。