feat: add tool-request pipeline for automated tool creation

- Add pipeline spec at .claude/pipelines/tool-request.md
- Add workflow to trigger Claude on 'tool-request' label
- Add auto-close workflow for published issues (24h)
- Update claude.yml with write permissions and NPM_TOKEN
- Create labels: tool-request, claude-working, validation-failed, published, escalated

Pipeline flow:
1. Maintainer applies 'tool-request' label to issue
2. Claude analyzes, designs, implements, validates, publishes
3. Issue auto-closes 24h after successful publish

.github/workflows/auto-close-published.yml

@@ -0,0 +1,66 @@
+name: Auto-Close Published Issues
+
+on:
+  schedule:
+    # Run every hour to check for issues to close
+    - cron: '0 * * * *'
+  workflow_dispatch: # Allow manual trigger
+
+jobs:
+  auto-close:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+
+    steps:
+      - name: Close published issues older than 24h
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const { data: issues } = await github.rest.issues.listForRepo({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              labels: 'published',
+              state: 'open',
+              per_page: 100
+            });
+
+            const now = new Date();
+            const twentyFourHoursAgo = new Date(now.getTime() - 24 * 60 * 60 * 1000);
+
+            for (const issue of issues) {
+              // Find when 'published' label was added
+              const { data: events } = await github.rest.issues.listEvents({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: issue.number,
+                per_page: 100
+              });
+
+              const publishedEvent = events
+                .filter(e => e.event === 'labeled' && e.label?.name === 'published')
+                .sort((a, b) => new Date(b.created_at) - new Date(a.created_at))[0];
+
+              if (publishedEvent) {
+                const labeledAt = new Date(publishedEvent.created_at);
+
+                if (labeledAt < twentyFourHoursAgo) {
+                  console.log(`Closing issue #${issue.number} - published ${labeledAt.toISOString()}`);
+
+                  await github.rest.issues.createComment({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: issue.number,
+                    body: 'Auto-closing after 24 hours. The tool has been published successfully. Reopen if you encounter any issues.'
+                  });
+
+                  await github.rest.issues.update({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: issue.number,
+                    state: 'closed',
+                    state_reason: 'completed'
+                  });
+                }
+              }
+            }

.github/workflows/claude.yml

@@ -19,11 +19,11 @@ jobs:
       (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
     runs-on: ubuntu-latest
     permissions:
-      contents: read
-      pull-requests: read
-      issues: read
+      contents: write      # Push branches, create commits
+      pull-requests: write # Create and manage PRs
+      issues: write        # Manage labels, close issues
       id-token: write
-      actions: read # Required for Claude to read CI results on PRs
+      actions: read        # Read CI results on PRs
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -33,10 +33,13 @@ jobs:
       - name: Run Claude Code
         id: claude
         uses: anthropics/claude-code-action@v1
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          CRON_SECRET: ${{ secrets.CRON_SECRET }}
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 
-          # This is an optional setting that allows Claude to read CI results on PRs
+          # Allow Claude to read CI results and manage issues/PRs
           additional_permissions: |
             actions: read
 

.github/workflows/tool-request.yml

@@ -0,0 +1,75 @@
+name: Tool Request Pipeline
+
+on:
+  issues:
+    types: [labeled]
+
+jobs:
+  trigger-claude:
+    # Only run when 'tool-request' label is added
+    if: github.event.label.name == 'tool-request'
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+
+    steps:
+      - name: Add working label
+        uses: actions/github-script@v7
+        with:
+          script: |
+            // Add 'claude-working' label to indicate processing has started
+            await github.rest.issues.addLabels({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              labels: ['claude-working']
+            });
+
+      - name: Comment to trigger Claude
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const body = `@claude Please implement this tool request.
+
+**Instructions:**
+1. Read the pipeline specification at \`.claude/pipelines/tool-request.md\`
+2. Follow all steps: analyze, design, implement, validate, test, publish
+3. Update labels as you progress (remove \`claude-working\`, add \`published\` or \`validation-failed\`)
+4. Post full changelog when complete
+5. This issue will auto-close 24h after successful publish
+
+**Issue Context:**
+- Issue #${context.issue.number}
+- Author: @${context.payload.issue.user.login}
+- Created: ${context.payload.issue.created_at}
+
+Begin implementation.`;
+
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              body: body
+            });
+
+  # Auto-close published issues after 24 hours
+  auto-close:
+    runs-on: ubuntu-latest
+    if: github.event.label.name == 'published'
+    permissions:
+      issues: write
+    steps:
+      - name: Schedule auto-close
+        uses: actions/github-script@v7
+        with:
+          script: |
+            // Add a comment about auto-close
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              body: '**Note:** This issue will auto-close in 24 hours. Reply if you have feedback or issues with the published tool.'
+            });
+
+  # Separate workflow handles the actual auto-close via scheduled job
+  # See: .github/workflows/auto-close-published.yml