chore: bump Claude Code to 2.0.72 and Agent SDK to 0.1.72

The gh CLI prefers GH_TOKEN over GITHUB_TOKEN. When a calling workflow
sets GH_TOKEN in env, the action's GITHUB_TOKEN was being ignored,
causing the gh CLI to use the wrong token (e.g., the default workflow
token instead of an App token).

This ensures Claude's gh CLI commands use the action's prepared token.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude <noreply@anthropic.com>

action.yml

@@ -198,7 +198,7 @@ runs:
 
         # Install Claude Code if no custom executable is provided
         if [ -z "$PATH_TO_CLAUDE_CODE_EXECUTABLE" ]; then
-          CLAUDE_CODE_VERSION="2.0.70"
+          CLAUDE_CODE_VERSION="2.0.72"
           echo "Installing Claude Code v${CLAUDE_CODE_VERSION}..."
           for attempt in 1 2 3; do
             echo "Installation attempt $attempt..."
@@ -247,6 +247,7 @@ runs:
 
         # Model configuration
         GITHUB_TOKEN: ${{ steps.prepare.outputs.GITHUB_TOKEN }}
+        GH_TOKEN: ${{ steps.prepare.outputs.GITHUB_TOKEN }}
         NODE_VERSION: ${{ env.NODE_VERSION }}
         DETAILED_PERMISSION_MESSAGES: "1"
 
@@ -296,6 +297,7 @@ runs:
         CLAUDE_COMMENT_ID: ${{ steps.prepare.outputs.claude_comment_id }}
         GITHUB_RUN_ID: ${{ github.run_id }}
         GITHUB_TOKEN: ${{ steps.prepare.outputs.GITHUB_TOKEN }}
+        GH_TOKEN: ${{ steps.prepare.outputs.GITHUB_TOKEN }}
         GITHUB_EVENT_NAME: ${{ github.event_name }}
         TRIGGER_COMMENT_ID: ${{ github.event.comment.id }}
         CLAUDE_BRANCH: ${{ steps.prepare.outputs.CLAUDE_BRANCH }}

base-action/action.yml

@@ -124,7 +124,7 @@ runs:
         PATH_TO_CLAUDE_CODE_EXECUTABLE: ${{ inputs.path_to_claude_code_executable }}
       run: |
         if [ -z "$PATH_TO_CLAUDE_CODE_EXECUTABLE" ]; then
-          CLAUDE_CODE_VERSION="2.0.70"
+          CLAUDE_CODE_VERSION="2.0.72"
           echo "Installing Claude Code v${CLAUDE_CODE_VERSION}..."
           for attempt in 1 2 3; do
             echo "Installation attempt $attempt..."

base-action/bun.lock

@@ -6,7 +6,7 @@
       "name": "@anthropic-ai/claude-code-base-action",
       "dependencies": {
         "@actions/core": "^1.10.1",
-        "@anthropic-ai/claude-agent-sdk": "^0.1.70",
+        "@anthropic-ai/claude-agent-sdk": "^0.1.72",
         "shell-quote": "^1.8.3",
       },
       "devDependencies": {
@@ -27,7 +27,7 @@
 
     "@actions/io": ["@actions/io@1.1.3", "", {}, "sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q=="],
 
-    "@anthropic-ai/claude-agent-sdk": ["@anthropic-ai/claude-agent-sdk@0.1.70", "", { "optionalDependencies": { "@img/sharp-darwin-arm64": "^0.33.5", "@img/sharp-darwin-x64": "^0.33.5", "@img/sharp-linux-arm": "^0.33.5", "@img/sharp-linux-arm64": "^0.33.5", "@img/sharp-linux-x64": "^0.33.5", "@img/sharp-linuxmusl-arm64": "^0.33.5", "@img/sharp-linuxmusl-x64": "^0.33.5", "@img/sharp-win32-x64": "^0.33.5" }, "peerDependencies": { "zod": "^3.24.1" } }, "sha512-4jpFPDX8asys6skO1r3Pzh0Fe9nbND2ASYTWuyFB5iN9bWEL6WScTFyGokjql3M2TkEp9ZGuB2YYpTCdaqT9Sw=="],
+    "@anthropic-ai/claude-agent-sdk": ["@anthropic-ai/claude-agent-sdk@0.1.72", "", { "optionalDependencies": { "@img/sharp-darwin-arm64": "^0.33.5", "@img/sharp-darwin-x64": "^0.33.5", "@img/sharp-linux-arm": "^0.33.5", "@img/sharp-linux-arm64": "^0.33.5", "@img/sharp-linux-x64": "^0.33.5", "@img/sharp-linuxmusl-arm64": "^0.33.5", "@img/sharp-linuxmusl-x64": "^0.33.5", "@img/sharp-win32-x64": "^0.33.5" }, "peerDependencies": { "zod": "^3.24.1 || ^4.0.0" } }, "sha512-fS/aTDfpafNA49K3Kn2QCQYpFiz6RckIxDFeBO0xw9ciudkao2M3uqjaa7K4eHMOhrXePfypCij4uTt8D4tyHQ=="],
 
     "@fastify/busboy": ["@fastify/busboy@2.1.1", "", {}, "sha512-vBZP4NlzfOlerQTnba4aqZoMhE/a9HY7HRqoOPaETQcSQuWEIyZMHGfVu6w9wGtGK5fED5qRs2DteVCjOH60sA=="],
 

base-action/package.json

@@ -11,7 +11,7 @@
   },
   "dependencies": {
     "@actions/core": "^1.10.1",
-    "@anthropic-ai/claude-agent-sdk": "^0.1.70",
+    "@anthropic-ai/claude-agent-sdk": "^0.1.72",
     "shell-quote": "^1.8.3"
   },
   "devDependencies": {

base-action/src/parse-sdk-options.ts

@@ -12,12 +12,79 @@ export type ParsedSdkOptions = {
 };
 
 // Flags that should accumulate multiple values instead of overwriting
-const ACCUMULATING_FLAGS = new Set(["allowedTools", "disallowedTools"]);
+// Include both camelCase and hyphenated variants for CLI compatibility
+const ACCUMULATING_FLAGS = new Set([
+  "allowedTools",
+  "allowed-tools",
+  "disallowedTools",
+  "disallowed-tools",
+  "mcp-config",
+]);
+
+// Delimiter used to join accumulated flag values
+const ACCUMULATE_DELIMITER = "\x00";
+
+type McpConfig = {
+  mcpServers?: Record<string, unknown>;
+};
+
+/**
+ * Merge multiple MCP config values into a single config.
+ * Each config can be a JSON string or a file path.
+ * For JSON strings, mcpServers objects are merged.
+ * For file paths, they are kept as-is (user's file takes precedence and is used last).
+ */
+function mergeMcpConfigs(configValues: string[]): string {
+  const merged: McpConfig = { mcpServers: {} };
+  let lastFilePath: string | null = null;
+
+  for (const config of configValues) {
+    const trimmed = config.trim();
+    if (!trimmed) continue;
+
+    // Check if it's a JSON string (starts with {) or a file path
+    if (trimmed.startsWith("{")) {
+      try {
+        const parsed = JSON.parse(trimmed) as McpConfig;
+        if (parsed.mcpServers) {
+          Object.assign(merged.mcpServers!, parsed.mcpServers);
+        }
+      } catch {
+        // If JSON parsing fails, treat as file path
+        lastFilePath = trimmed;
+      }
+    } else {
+      // It's a file path - store it to handle separately
+      lastFilePath = trimmed;
+    }
+  }
+
+  // If we have file paths, we need to keep the merged JSON and let the file
+  // be handled separately. Since we can only return one value, merge what we can.
+  // If there's a file path, we need a different approach - read the file at runtime.
+  // For now, if there's a file path, we'll stringify the merged config.
+  // The action prepends its config as JSON, so we can safely merge inline JSON configs.
+
+  // If no inline configs were found (all file paths), return the last file path
+  if (Object.keys(merged.mcpServers!).length === 0 && lastFilePath) {
+    return lastFilePath;
+  }
+
+  // Note: If user passes a file path, we cannot merge it at parse time since
+  // we don't have access to the file system here. The action's built-in MCP
+  // servers are always passed as inline JSON, so they will be merged.
+  // If user also passes inline JSON, it will be merged.
+  // If user passes a file path, they should ensure it includes all needed servers.
+
+  return JSON.stringify(merged);
+}
 
 /**
  * Parse claudeArgs string into extraArgs record for SDK pass-through
  * The SDK/CLI will handle --mcp-config, --json-schema, etc.
- * For allowedTools and disallowedTools, multiple occurrences are accumulated (comma-joined).
+ * For allowedTools and disallowedTools, multiple occurrences are accumulated (null-char joined).
+ * Accumulating flags also consume all consecutive non-flag values
+ * (e.g., --allowed-tools "Tool1" "Tool2" "Tool3" captures all three).
  */
 function parseClaudeArgsToExtraArgs(
   claudeArgs?: string,
@@ -37,13 +104,25 @@ function parseClaudeArgsToExtraArgs(
 
       // Check if next arg is a value (not another flag)
       if (nextArg && !nextArg.startsWith("--")) {
-        // For accumulating flags, join multiple values with commas
-        if (ACCUMULATING_FLAGS.has(flag) && result[flag]) {
-          result[flag] = `${result[flag]},${nextArg}`;
+        // For accumulating flags, consume all consecutive non-flag values
+        // This handles: --allowed-tools "Tool1" "Tool2" "Tool3"
+        if (ACCUMULATING_FLAGS.has(flag)) {
+          const values: string[] = [];
+          while (i + 1 < args.length && !args[i + 1]?.startsWith("--")) {
+            i++;
+            values.push(args[i]!);
+          }
+          const joinedValues = values.join(ACCUMULATE_DELIMITER);
+          if (result[flag]) {
+            result[flag] =
+              `${result[flag]}${ACCUMULATE_DELIMITER}${joinedValues}`;
+          } else {
+            result[flag] = joinedValues;
+          }
         } else {
           result[flag] = nextArg;
+          i++; // Skip the value
         }
-        i++; // Skip the value
       } else {
         result[flag] = null; // Boolean flag
       }
@@ -68,12 +147,23 @@ export function parseSdkOptions(options: ClaudeOptions): ParsedSdkOptions {
   // Detect if --json-schema is present (for hasJsonSchema flag)
   const hasJsonSchema = "json-schema" in extraArgs;
 
-  // Extract and merge allowedTools from both sources:
+  // Extract and merge allowedTools from all sources:
   // 1. From extraArgs (parsed from claudeArgs - contains tag mode's tools)
+  //    - Check both camelCase (--allowedTools) and hyphenated (--allowed-tools) variants
   // 2. From options.allowedTools (direct input - may be undefined)
   // This prevents duplicate flags being overwritten when claudeArgs contains --allowedTools
-  const extraArgsAllowedTools = extraArgs["allowedTools"]
-    ? extraArgs["allowedTools"].split(",").map((t) => t.trim())
+  const allowedToolsValues = [
+    extraArgs["allowedTools"],
+    extraArgs["allowed-tools"],
+  ]
+    .filter(Boolean)
+    .join(ACCUMULATE_DELIMITER);
+  const extraArgsAllowedTools = allowedToolsValues
+    ? allowedToolsValues
+        .split(ACCUMULATE_DELIMITER)
+        .flatMap((v) => v.split(","))
+        .map((t) => t.trim())
+        .filter(Boolean)
     : [];
   const directAllowedTools = options.allowedTools
     ? options.allowedTools.split(",").map((t) => t.trim())
@@ -82,10 +172,21 @@ export function parseSdkOptions(options: ClaudeOptions): ParsedSdkOptions {
     ...new Set([...extraArgsAllowedTools, ...directAllowedTools]),
   ];
   delete extraArgs["allowedTools"];
+  delete extraArgs["allowed-tools"];
 
-  // Same for disallowedTools
-  const extraArgsDisallowedTools = extraArgs["disallowedTools"]
-    ? extraArgs["disallowedTools"].split(",").map((t) => t.trim())
+  // Same for disallowedTools - check both camelCase and hyphenated variants
+  const disallowedToolsValues = [
+    extraArgs["disallowedTools"],
+    extraArgs["disallowed-tools"],
+  ]
+    .filter(Boolean)
+    .join(ACCUMULATE_DELIMITER);
+  const extraArgsDisallowedTools = disallowedToolsValues
+    ? disallowedToolsValues
+        .split(ACCUMULATE_DELIMITER)
+        .flatMap((v) => v.split(","))
+        .map((t) => t.trim())
+        .filter(Boolean)
     : [];
   const directDisallowedTools = options.disallowedTools
     ? options.disallowedTools.split(",").map((t) => t.trim())
@@ -94,6 +195,17 @@ export function parseSdkOptions(options: ClaudeOptions): ParsedSdkOptions {
     ...new Set([...extraArgsDisallowedTools, ...directDisallowedTools]),
   ];
   delete extraArgs["disallowedTools"];
+  delete extraArgs["disallowed-tools"];
+
+  // Merge multiple --mcp-config values by combining their mcpServers objects
+  // The action prepends its config (github_comment, github_ci, etc.) as inline JSON,
+  // and users may provide their own config as inline JSON or file path
+  if (extraArgs["mcp-config"]) {
+    const mcpConfigValues = extraArgs["mcp-config"].split(ACCUMULATE_DELIMITER);
+    if (mcpConfigValues.length > 1) {
+      extraArgs["mcp-config"] = mergeMcpConfigs(mcpConfigValues);
+    }
+  }
 
   // Build custom environment
   const env: Record<string, string | undefined> = { ...process.env };
@@ -137,10 +249,18 @@ export function parseSdkOptions(options: ClaudeOptions): ParsedSdkOptions {
     extraArgs,
     env,
 
-    // Load settings from all sources to pick up CLI-installed plugins, CLAUDE.md, etc.
-    settingSources: ["user", "project", "local"],
+    // Load settings from sources - prefer user's --setting-sources if provided, otherwise use all sources
+    // This ensures users can override the default behavior (e.g., --setting-sources user to avoid in-repo configs)
+    settingSources: extraArgs["setting-sources"]
+      ? (extraArgs["setting-sources"].split(
+          ",",
+        ) as SdkOptions["settingSources"])
+      : ["user", "project", "local"],
   };
 
+  // Remove setting-sources from extraArgs to avoid passing it twice
+  delete extraArgs["setting-sources"];
+
   return {
     sdkOptions,
     showFullOutput,

base-action/test/parse-sdk-options.test.ts

@@ -108,6 +108,48 @@ describe("parseSdkOptions", () => {
       expect(result.sdkOptions.extraArgs?.["allowedTools"]).toBeUndefined();
       expect(result.sdkOptions.extraArgs?.["model"]).toBe("claude-3-5-sonnet");
     });
+
+    test("should handle hyphenated --allowed-tools flag", () => {
+      const options: ClaudeOptions = {
+        claudeArgs: '--allowed-tools "Edit,Read,Write"',
+      };
+
+      const result = parseSdkOptions(options);
+
+      expect(result.sdkOptions.allowedTools).toEqual(["Edit", "Read", "Write"]);
+      expect(result.sdkOptions.extraArgs?.["allowed-tools"]).toBeUndefined();
+    });
+
+    test("should accumulate multiple --allowed-tools flags (hyphenated)", () => {
+      // This is the exact scenario from issue #746
+      const options: ClaudeOptions = {
+        claudeArgs:
+          '--allowed-tools "Bash(git log:*)" "Bash(git diff:*)" "Bash(git fetch:*)" "Bash(gh pr:*)"',
+      };
+
+      const result = parseSdkOptions(options);
+
+      expect(result.sdkOptions.allowedTools).toEqual([
+        "Bash(git log:*)",
+        "Bash(git diff:*)",
+        "Bash(git fetch:*)",
+        "Bash(gh pr:*)",
+      ]);
+    });
+
+    test("should handle mixed camelCase and hyphenated allowedTools flags", () => {
+      const options: ClaudeOptions = {
+        claudeArgs: '--allowedTools "Edit,Read" --allowed-tools "Write,Glob"',
+      };
+
+      const result = parseSdkOptions(options);
+
+      // Both should be merged - note: order depends on which key is found first
+      expect(result.sdkOptions.allowedTools).toContain("Edit");
+      expect(result.sdkOptions.allowedTools).toContain("Read");
+      expect(result.sdkOptions.allowedTools).toContain("Write");
+      expect(result.sdkOptions.allowedTools).toContain("Glob");
+    });
   });
 
   describe("disallowedTools merging", () => {
@@ -134,19 +176,129 @@ describe("parseSdkOptions", () => {
     });
   });
 
-  describe("other extraArgs passthrough", () => {
-    test("should pass through mcp-config in extraArgs", () => {
+  describe("mcp-config merging", () => {
+    test("should pass through single mcp-config in extraArgs", () => {
       const options: ClaudeOptions = {
-        claudeArgs: `--mcp-config '{"mcpServers":{}}' --allowedTools "Edit"`,
+        claudeArgs: `--mcp-config '{"mcpServers":{"server1":{"command":"cmd1"}}}'`,
       };
 
       const result = parseSdkOptions(options);
 
       expect(result.sdkOptions.extraArgs?.["mcp-config"]).toBe(
-        '{"mcpServers":{}}',
+        '{"mcpServers":{"server1":{"command":"cmd1"}}}',
       );
     });
 
+    test("should merge multiple mcp-config flags with inline JSON", () => {
+      // Simulates action prepending its config, then user providing their own
+      const options: ClaudeOptions = {
+        claudeArgs: `--mcp-config '{"mcpServers":{"github_comment":{"command":"node","args":["server.js"]}}}' --mcp-config '{"mcpServers":{"user_server":{"command":"custom","args":["run"]}}}'`,
+      };
+
+      const result = parseSdkOptions(options);
+
+      const mcpConfig = JSON.parse(
+        result.sdkOptions.extraArgs?.["mcp-config"] as string,
+      );
+      expect(mcpConfig.mcpServers).toHaveProperty("github_comment");
+      expect(mcpConfig.mcpServers).toHaveProperty("user_server");
+      expect(mcpConfig.mcpServers.github_comment.command).toBe("node");
+      expect(mcpConfig.mcpServers.user_server.command).toBe("custom");
+    });
+
+    test("should merge three mcp-config flags", () => {
+      const options: ClaudeOptions = {
+        claudeArgs: `--mcp-config '{"mcpServers":{"server1":{"command":"cmd1"}}}' --mcp-config '{"mcpServers":{"server2":{"command":"cmd2"}}}' --mcp-config '{"mcpServers":{"server3":{"command":"cmd3"}}}'`,
+      };
+
+      const result = parseSdkOptions(options);
+
+      const mcpConfig = JSON.parse(
+        result.sdkOptions.extraArgs?.["mcp-config"] as string,
+      );
+      expect(mcpConfig.mcpServers).toHaveProperty("server1");
+      expect(mcpConfig.mcpServers).toHaveProperty("server2");
+      expect(mcpConfig.mcpServers).toHaveProperty("server3");
+    });
+
+    test("should handle mcp-config file path when no inline JSON exists", () => {
+      const options: ClaudeOptions = {
+        claudeArgs: `--mcp-config /tmp/user-mcp-config.json`,
+      };
+
+      const result = parseSdkOptions(options);
+
+      expect(result.sdkOptions.extraArgs?.["mcp-config"]).toBe(
+        "/tmp/user-mcp-config.json",
+      );
+    });
+
+    test("should merge inline JSON configs when file path is also present", () => {
+      // When action provides inline JSON and user provides a file path,
+      // the inline JSON configs should be merged (file paths cannot be merged at parse time)
+      const options: ClaudeOptions = {
+        claudeArgs: `--mcp-config '{"mcpServers":{"github_comment":{"command":"node"}}}' --mcp-config '{"mcpServers":{"github_ci":{"command":"node"}}}' --mcp-config /tmp/user-config.json`,
+      };
+
+      const result = parseSdkOptions(options);
+
+      // The inline JSON configs should be merged
+      const mcpConfig = JSON.parse(
+        result.sdkOptions.extraArgs?.["mcp-config"] as string,
+      );
+      expect(mcpConfig.mcpServers).toHaveProperty("github_comment");
+      expect(mcpConfig.mcpServers).toHaveProperty("github_ci");
+    });
+
+    test("should handle mcp-config with other flags", () => {
+      const options: ClaudeOptions = {
+        claudeArgs: `--mcp-config '{"mcpServers":{"server1":{}}}' --model claude-3-5-sonnet --mcp-config '{"mcpServers":{"server2":{}}}'`,
+      };
+
+      const result = parseSdkOptions(options);
+
+      const mcpConfig = JSON.parse(
+        result.sdkOptions.extraArgs?.["mcp-config"] as string,
+      );
+      expect(mcpConfig.mcpServers).toHaveProperty("server1");
+      expect(mcpConfig.mcpServers).toHaveProperty("server2");
+      expect(result.sdkOptions.extraArgs?.["model"]).toBe("claude-3-5-sonnet");
+    });
+
+    test("should handle real-world scenario: action config + user config", () => {
+      // This is the exact scenario from the bug report
+      const actionConfig = JSON.stringify({
+        mcpServers: {
+          github_comment: {
+            command: "node",
+            args: ["github-comment-server.js"],
+          },
+          github_ci: { command: "node", args: ["github-ci-server.js"] },
+        },
+      });
+      const userConfig = JSON.stringify({
+        mcpServers: {
+          my_custom_server: { command: "python", args: ["server.py"] },
+        },
+      });
+
+      const options: ClaudeOptions = {
+        claudeArgs: `--mcp-config '${actionConfig}' --mcp-config '${userConfig}'`,
+      };
+
+      const result = parseSdkOptions(options);
+
+      const mcpConfig = JSON.parse(
+        result.sdkOptions.extraArgs?.["mcp-config"] as string,
+      );
+      // All servers should be present
+      expect(mcpConfig.mcpServers).toHaveProperty("github_comment");
+      expect(mcpConfig.mcpServers).toHaveProperty("github_ci");
+      expect(mcpConfig.mcpServers).toHaveProperty("my_custom_server");
+    });
+  });
+
+  describe("other extraArgs passthrough", () => {
     test("should pass through json-schema in extraArgs", () => {
       const options: ClaudeOptions = {
         claudeArgs: `--json-schema '{"type":"object"}'`,

bun.lock

@@ -7,7 +7,7 @@
       "dependencies": {
         "@actions/core": "^1.10.1",
         "@actions/github": "^6.0.1",
-        "@anthropic-ai/claude-agent-sdk": "^0.1.70",
+        "@anthropic-ai/claude-agent-sdk": "^0.1.72",
         "@modelcontextprotocol/sdk": "^1.11.0",
         "@octokit/graphql": "^8.2.2",
         "@octokit/rest": "^21.1.1",
@@ -37,7 +37,7 @@
 
     "@actions/io": ["@actions/io@1.1.3", "", {}, "sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q=="],
 
-    "@anthropic-ai/claude-agent-sdk": ["@anthropic-ai/claude-agent-sdk@0.1.70", "", { "optionalDependencies": { "@img/sharp-darwin-arm64": "^0.33.5", "@img/sharp-darwin-x64": "^0.33.5", "@img/sharp-linux-arm": "^0.33.5", "@img/sharp-linux-arm64": "^0.33.5", "@img/sharp-linux-x64": "^0.33.5", "@img/sharp-linuxmusl-arm64": "^0.33.5", "@img/sharp-linuxmusl-x64": "^0.33.5", "@img/sharp-win32-x64": "^0.33.5" }, "peerDependencies": { "zod": "^3.24.1" } }, "sha512-4jpFPDX8asys6skO1r3Pzh0Fe9nbND2ASYTWuyFB5iN9bWEL6WScTFyGokjql3M2TkEp9ZGuB2YYpTCdaqT9Sw=="],
+    "@anthropic-ai/claude-agent-sdk": ["@anthropic-ai/claude-agent-sdk@0.1.72", "", { "optionalDependencies": { "@img/sharp-darwin-arm64": "^0.33.5", "@img/sharp-darwin-x64": "^0.33.5", "@img/sharp-linux-arm": "^0.33.5", "@img/sharp-linux-arm64": "^0.33.5", "@img/sharp-linux-x64": "^0.33.5", "@img/sharp-linuxmusl-arm64": "^0.33.5", "@img/sharp-linuxmusl-x64": "^0.33.5", "@img/sharp-win32-x64": "^0.33.5" }, "peerDependencies": { "zod": "^3.24.1 || ^4.0.0" } }, "sha512-fS/aTDfpafNA49K3Kn2QCQYpFiz6RckIxDFeBO0xw9ciudkao2M3uqjaa7K4eHMOhrXePfypCij4uTt8D4tyHQ=="],
 
     "@fastify/busboy": ["@fastify/busboy@2.1.1", "", {}, "sha512-vBZP4NlzfOlerQTnba4aqZoMhE/a9HY7HRqoOPaETQcSQuWEIyZMHGfVu6w9wGtGK5fED5qRs2DteVCjOH60sA=="],
 

package.json

@@ -12,7 +12,7 @@
   "dependencies": {
     "@actions/core": "^1.10.1",
     "@actions/github": "^6.0.1",
-    "@anthropic-ai/claude-agent-sdk": "^0.1.70",
+    "@anthropic-ai/claude-agent-sdk": "^0.1.72",
     "@modelcontextprotocol/sdk": "^1.11.0",
     "@octokit/graphql": "^8.2.2",
     "@octokit/rest": "^21.1.1",

src/modes/agent/parse-tools.ts

@@ -1,55 +1,22 @@
-import { parse as parseShellArgs, type ParseEntry } from "shell-quote";
-
-/**
- * Extract the string value from a shell-quote ParseEntry.
- * Handles both plain strings and glob patterns (which are returned as objects).
- */
-function entryToString(entry: ParseEntry): string | null {
-  if (typeof entry === "string") {
-    return entry;
-  }
-  // Handle glob patterns - shell-quote returns { op: "glob", pattern: "..." }
-  if (typeof entry === "object" && "op" in entry && entry.op === "glob") {
-    return (entry as { op: "glob"; pattern: string }).pattern;
-  }
-  return null;
-}
-
 export function parseAllowedTools(claudeArgs: string): string[] {
-  if (!claudeArgs?.trim()) return [];
+  // Match --allowedTools or --allowed-tools followed by the value
+  // Handle both quoted and unquoted values
+  const patterns = [
+    /--(?:allowedTools|allowed-tools)\s+"([^"]+)"/, // Double quoted
+    /--(?:allowedTools|allowed-tools)\s+'([^']+)'/, // Single quoted
+    /--(?:allowedTools|allowed-tools)\s+([^\s]+)/, // Unquoted
+  ];
 
-  const result: string[] = [];
-
-  // Use shell-quote to properly tokenize the arguments
-  // This handles quoted strings, escaped characters, etc.
-  const rawArgs = parseShellArgs(claudeArgs);
-
-  for (let i = 0; i < rawArgs.length; i++) {
-    const entry = rawArgs[i];
-    if (!entry) continue;
-    const arg = entryToString(entry);
-    if (!arg) continue;
-
-    // Match both --allowedTools and --allowed-tools
-    if (arg === "--allowedTools" || arg === "--allowed-tools") {
-      // Collect all subsequent non-flag values as tools
-      while (i + 1 < rawArgs.length) {
-        const nextEntry = rawArgs[i + 1];
-        if (!nextEntry) break;
-        const toolArg = entryToString(nextEntry);
-
-        // Stop if we hit another flag or a non-parseable entry
-        if (!toolArg || toolArg.startsWith("--")) {
-          break;
-        }
-
-        // Split by comma in case tools are comma-separated within a single value
-        const tools = toolArg.split(",").map((t) => t.trim());
-        result.push(...tools.filter((t) => t.length > 0));
-        i++;
+  for (const pattern of patterns) {
+    const match = claudeArgs.match(pattern);
+    if (match && match[1]) {
+      // Don't return if the value starts with -- (another flag)
+      if (match[1].startsWith("--")) {
+        return [];
       }
+      return match[1].split(",").map((t) => t.trim());
     }
   }
 
-  return result;
+  return [];
 }

test/modes/parse-tools.test.ts

@@ -37,9 +37,8 @@ describe("parseAllowedTools", () => {
 
   test("handles duplicate --allowedTools flags", () => {
     const args = "--allowedTools --allowedTools mcp__github__*";
-    // Should skip the first one since the value is another flag
-    // and parse the second one correctly
-    expect(parseAllowedTools(args)).toEqual(["mcp__github__*"]);
+    // Should not match the first one since the value is another flag
+    expect(parseAllowedTools(args)).toEqual([]);
   });
 
   test("handles typo --alloedTools", () => {
@@ -85,50 +84,4 @@ describe("parseAllowedTools", () => {
       "mcp__github_comment__*",
     ]);
   });
-
-  test("parses multiple space-separated quoted tools (issue #746)", () => {
-    // This is the exact format from the bug report
-    const args =
-      '--allowed-tools "Bash(git log:*)" "Bash(git diff:*)" "Bash(git fetch:*)" "Bash(gh pr:*)"';
-    expect(parseAllowedTools(args)).toEqual([
-      "Bash(git log:*)",
-      "Bash(git diff:*)",
-      "Bash(git fetch:*)",
-      "Bash(gh pr:*)",
-    ]);
-  });
-
-  test("parses multiple --allowedTools flags with different tools", () => {
-    const args =
-      '--allowedTools "Edit,Read" --model "claude-3" --allowedTools "Bash(npm install)"';
-    expect(parseAllowedTools(args)).toEqual([
-      "Edit",
-      "Read",
-      "Bash(npm install)",
-    ]);
-  });
-
-  test("parses mix of comma-separated and space-separated tools", () => {
-    const args =
-      '--allowed-tools "Bash(git log:*),Bash(git diff:*)" "Bash(git fetch:*)"';
-    expect(parseAllowedTools(args)).toEqual([
-      "Bash(git log:*)",
-      "Bash(git diff:*)",
-      "Bash(git fetch:*)",
-    ]);
-  });
-
-  test("handles complex workflow example from issue #746", () => {
-    const args =
-      '--allowed-tools "Bash(git log:*)" "Bash(git diff:*)" "Bash(git fetch:*)" "Bash(git reflog:*)" "Bash(git merge-tree:*)" "Bash(gh pr:*)" "Bash(gh api:*)"';
-    expect(parseAllowedTools(args)).toEqual([
-      "Bash(git log:*)",
-      "Bash(git diff:*)",
-      "Bash(git fetch:*)",
-      "Bash(git reflog:*)",
-      "Bash(git merge-tree:*)",
-      "Bash(gh pr:*)",
-      "Bash(gh api:*)",
-    ]);
-  });
 });