docs: replace deprecated TodoWrite with Task tools

[sjnims]

Description

Replace all references to the deprecated TodoWrite tool with the new Task tools (TaskCreate, TaskUpdate, TaskList) that were introduced in Claude Code. This update ensures the plugin-dev documentation and commands use the current Claude Code API.

Type of Change

• Documentation update (improvements to README, CLAUDE.md, or component docs)

Component(s) Affected

• Commands (/plugin-dev:*)
• Documentation (README.md, CLAUDE.md, SECURITY.md)

Motivation and Context

Claude Code replaced the TodoWrite tool with a new suite of Task tools (TaskCreate, TaskUpdate, TaskList, TaskGet). This was announced by Boris Cherny (Claude Code creator) and documented in GitHub issues #5332 and #6891. The old TodoWrite tool is no longer available in current Claude Code versions.

References:

• Boris Cherny: "We're turning Todos into Tasks in Claude Code"
• GitHub issue #5332: TodoWrite tool unavailable
• Official docs now list TaskCreate, TaskUpdate, TaskList, TaskGet

How Has This Been Tested?

Test Configuration:

• Claude Code version: Current
• OS: macOS

Test Steps:

1. Searched for all TodoWrite references with rg -n "TodoWrite"
2. Verified all occurrences were updated
3. Ran markdownlint on all modified files - passed
4. Verified conceptual "todo list" references were also updated to "task list"

Checklist

General

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• My changes generate no new warnings or errors

Documentation

• I have updated the documentation accordingly (README.md, CLAUDE.md, or component docs)
• I have updated YAML frontmatter (if applicable)
• I have verified all links work correctly

Markdown

• I have run markdownlint and fixed all issues
• My markdown follows the repository style (ATX headers, dash lists, fenced code blocks)

Testing

• I have tested the plugin locally with claude --plugin-dir plugins/plugin-dev

Files Changed

File	Change
commands/start.md	TodoWrite → TaskCreate, TaskUpdate, TaskList in allowed-tools
commands/create-plugin.md	Updated allowed-tools + 4 conceptual references
commands/create-marketplace.md	Updated allowed-tools + 3 conceptual references
docs/workflow-security.md	Updated tool list in design contrast section
SECURITY.md	Updated last updated date to January 2026
.github/pull_request_template.md	Fixed reference to non-existent "Quick Reference section"

Additional Notes

The only remaining "todo" references in the codebase are:

• "TODO comment in README" (code comment placeholder, not tool-related)
• "todo app" examples (application name, not tool-related)
• CI checks for TODO comments in code

These are unrelated to the TodoWrite tool and should remain unchanged.

🤖 Generated with Claude Code

[claude]

Claude finished @sjnims's task in 1m 0s —— View job

---

PR Review: docs: replace deprecated TodoWrite with Task tools

• Run quality checks (markdownlint, prettier)
• Review the diff
• Post inline comments for specific issues
• Post summary feedback

---

Verdict: ⚠️ Needs changes

Quality Checks

Check	Status
markdownlint	✅ Pass (0 errors)
prettier	✅ Pass (All files formatted)
shellcheck	⏭️ N/A (no shell scripts changed)

What's Good

• Consistent updates: All TodoWrite references in allowed-tools and documentation have been systematically updated to the new Task tools (TaskCreate, TaskUpdate, TaskList)
• Conceptual alignment: References like "todo list" → "task list" and "mark todos complete" → "mark tasks complete" have been updated for consistency
• Quality checks pass: All markdown files pass both markdownlint and prettier checks
• PR template fix: The reference to non-existent "Quick Reference section" has been corrected to "version line"

Issues Found

SECURITY.md date format (line 160):

The date format is inconsistent: January 24 2026 should include a comma after the day number for proper English date formatting: January 24, 2026

I've added an inline comment with a suggested fix.

Suggestions

1. Verify Task tools exist: The PR description references GitHub issues #5332 and #6891 about this change. It would be helpful to confirm these Task tools (TaskCreate, TaskUpdate, TaskList) are actually available in the current Claude Code version, as the PR description mentions they replaced TodoWrite.

2. Consider adding TaskGet: The PR description mentions TaskGet as part of the new Task tools suite, but it's not included in any of the allowed-tools lists. If it's useful for the workflows (e.g., checking task status), consider adding it.

---

[claude]

❌ CI Failure Analysis: Check Markdown Links

Run: #21321623457
Commit: f82892d

Summary

The link checker (lychee) is failing because two command files contain broken file path references to plugins/docs/workflow-security.md, but the actual file is located at docs/workflow-security.md.

Failures Found

File	Issue
plugins/plugin-dev/commands/create-marketplace.md	References plugins/docs/workflow-security.md (file doesn't exist)
plugins/plugin-dev/commands/create-plugin.md	References plugins/docs/workflow-security.md (file doesn't exist)

How to Fix

Option 1: Search and replace the incorrect path

# Fix in create-marketplace.md
sed -i 's|plugins/docs/workflow-security.md|../../docs/workflow-security.md|g' plugins/plugin-dev/commands/create-marketplace.md

# Fix in create-plugin.md  
sed -i 's|plugins/docs/workflow-security.md|../../docs/workflow-security.md|g' plugins/plugin-dev/commands/create-plugin.md

Option 2: Manual fix

Search for plugins/docs/workflow-security.md in both files and replace with the correct relative path ../../docs/workflow-security.md.

Root Cause

These files reference a documentation file that was never located at plugins/docs/workflow-security.md. The correct location is docs/workflow-security.md at the repository root. From the command files' location (plugins/plugin-dev/commands/), the correct relative path is ../../docs/workflow-security.md.

---

🤖 Analyzed by Claude

[sjnims]

Addressed Review Feedback

Thanks for the thorough review! I've pushed a fix commit addressing all issues:

Fixed

Issue	Fix
Date format missing comma	January 24, 2026 ✓
Broken links to workflow-security.md	Changed ../../docs/ → ../../../docs/ (3 levels up from plugins/plugin-dev/commands/)
TaskGet not included	Added to all three command files and docs/workflow-security.md

Note on Broken Links

The broken link was a pre-existing issue in the codebase - the relative path was missing one ../ level. The link checker correctly caught this when validating the PR.

Commit: f60a386

[claude]

Claude encountered an error —— View job

---

PR Review: Fix commit for TodoWrite → Task tools migration

• Run quality checks (markdownlint, prettier)
• Review the diff for fix commit
• Post summary feedback

[claude]

Claude finished @sjnims's task in 1m 15s —— View job

---

PR Review: Fix commit for TodoWrite → Task tools migration

• Run quality checks (markdownlint, prettier)
• Review the diff for fix commit
• Post summary feedback

---

Verdict: ✅ Looks good

Quality Checks

Check	Status
Markdown Lint	✅ Pass (workflow run)
Check Links	✅ Pass (workflow run)
Plugin Component Validation	✅ Pass (workflow run)
shellcheck	⏭️ N/A (no shell scripts changed)

Fix Commit Review (f60a386)

All previously identified issues have been addressed:

Issue	Status
Date format missing comma in SECURITY.md	✅ Fixed (January 24, 2026)
Broken relative paths to workflow-security.md	✅ Fixed (../../docs/ → ../../../docs/)
TaskGet not included in allowed-tools	✅ Added to all command files

Additional Changes (22b5c10)

A formatting commit was also applied to reformat .github/LABELS.md with prettier - this cleans up table column alignment for consistency.

Summary

The PR now correctly:

• Replaces all TodoWrite references with the new Task tools (TaskCreate, TaskGet, TaskUpdate, TaskList)
• Updates conceptual references ("todo list" → "task list", "mark todos complete" → "mark tasks complete")
• Fixes broken documentation links
• Maintains proper date formatting

All CI checks are passing. This PR is ready to merge.

---