Accept multiline input for allowed_tools and disallowed_tools

* feat: use GitHub display name in Co-authored-by trailers

- Add name field to GitHubAuthor type
- Update GraphQL queries to fetch user display names
- Add triggerDisplayName to CommonFields type
- Extract display name from fetched GitHub data in prepareContext
- Update Co-authored-by trailer generation to use display name when available

This ensures consistency with GitHub's web interface behavior where
Co-authored-by trailers use the user's display name rather than username.

Co-authored-by: ashwin-ant <ashwin-ant@users.noreply.github.com>

* fix: update GraphQL queries to handle Actor type correctly

The name field is only available on the User subtype of Actor in GitHub's
GraphQL API. This commit updates the queries to use inline fragments
(... on User) to conditionally access the name field when the actor is
a User type.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

* refactor: clarify Co-authored-by instructions in prompt

Replace interpolated values with clear references to XML tags and add
explicit formatting instructions. This makes it clearer how to use the
GitHub display name when available while maintaining the username for
the email portion.

Changes:
- Use explicit references to <trigger_display_name> and <trigger_username> tags
- Add clear formatting instructions and example
- Explain fallback behavior when display name is not available

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

* feat: fetch trigger user display name via dedicated GraphQL query

Instead of trying to extract the display name from existing data (which
was incomplete due to Actor type limitations), we now:

- Add a dedicated USER_QUERY to fetch user display names
- Pass the trigger username to fetchGitHubData
- Fetch the display name during data collection phase
- Simplify prepareContext to use the pre-fetched display name

This ensures we always get the correct display name for Co-authored-by
trailers, regardless of where the trigger came from.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: ashwin-ant <ashwin-ant@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>

README.md

@@ -347,8 +347,15 @@ Claude does **not** have access to execute arbitrary Bash commands by default. I
 ```yaml
 - uses: anthropics/claude-code-action@beta
   with:
-    allowed_tools: "Bash(npm install),Bash(npm run test),Edit,Replace,NotebookEditCell"
-    disallowed_tools: "TaskOutput,KillTask"
+    allowed_tools: |
+      Bash(npm install)
+      Bash(npm run test)
+      Edit
+      Replace
+      NotebookEditCell
+    disallowed_tools: |
+      TaskOutput
+      KillTask
     # ... other inputs
 ```
 

action.yml

@@ -110,7 +110,7 @@ runs:
     - name: Run Claude Code
       id: claude-code
       if: steps.prepare.outputs.contains_trigger == 'true'
-      uses: anthropics/claude-code-base-action@a0d79f9c1798b06292dbc80f8f95cf742ce7a213 # v0.0.14
+      uses: anthropics/claude-code-base-action@ebd8558e902b3db132e89863de49565fcb9aec46 # v0.0.19
       with:
         prompt_file: ${{ runner.temp }}/claude-prompts/claude-prompt.txt
         allowed_tools: ${{ env.ALLOWED_TOOLS }}

src/create-prompt/index.ts

@@ -24,6 +24,7 @@ export type { CommonFields, PreparedContext } from "./types";
 
 const BASE_ALLOWED_TOOLS = [
   "Edit",
+  "MultiEdit",
   "Glob",
   "Grep",
   "LS",
@@ -417,6 +418,7 @@ ${
 }
 <claude_comment_id>${context.claudeCommentId}</claude_comment_id>
 <trigger_username>${context.triggerUsername ?? "Unknown"}</trigger_username>
+<trigger_display_name>${githubData.triggerDisplayName ?? context.triggerUsername ?? "Unknown"}</trigger_display_name>
 <trigger_phrase>${context.triggerPhrase}</trigger_phrase>
 ${
   (eventData.eventName === "issue_comment" ||
@@ -502,12 +504,14 @@ ${context.directPrompt ? `   - DIRECT INSTRUCTION: A direct instruction was prov
           ? `
       - Push directly using mcp__github_file_ops__commit_files to the existing branch (works for both new and existing files).
       - Use mcp__github_file_ops__commit_files to commit files atomically in a single commit (supports single or multiple files).
-      - When pushing changes with this tool and TRIGGER_USERNAME is not "Unknown", include a "Co-authored-by: ${context.triggerUsername} <${context.triggerUsername}@users.noreply.github.com>" line in the commit message.`
+      - When pushing changes with this tool and the trigger user is not "Unknown", include a Co-authored-by trailer in the commit message.
+      - Use: "Co-authored-by: ${githubData.triggerDisplayName ?? context.triggerUsername} <${context.triggerUsername}@users.noreply.github.com>"`
           : `
       - You are already on the correct branch (${eventData.claudeBranch || "the PR branch"}). Do not create a new branch.
       - Push changes directly to the current branch using mcp__github_file_ops__commit_files (works for both new and existing files)
       - Use mcp__github_file_ops__commit_files to commit files atomically in a single commit (supports single or multiple files).
-      - When pushing changes and TRIGGER_USERNAME is not "Unknown", include a "Co-authored-by: ${context.triggerUsername} <${context.triggerUsername}@users.noreply.github.com>" line in the commit message.
+      - When pushing changes and the trigger user is not "Unknown", include a Co-authored-by trailer in the commit message.
+      - Use: "Co-authored-by: ${githubData.triggerDisplayName ?? context.triggerUsername} <${context.triggerUsername}@users.noreply.github.com>"
       ${
         eventData.claudeBranch
           ? `- Provide a URL to create a PR manually in this format:

src/entrypoints/prepare.ts

@@ -59,6 +59,7 @@ async function run() {
       repository: `${context.repository.owner}/${context.repository.repo}`,
       prNumber: context.entityNumber.toString(),
       isPR: context.isPR,
+      triggerUsername: context.actor,
     });
 
     // Step 8: Setup branch

src/github/api/queries/github.ts

@@ -104,3 +104,11 @@ export const ISSUE_QUERY = `
     }
   }
 `;
+
+export const USER_QUERY = `
+  query($login: String!) {
+    user(login: $login) {
+      name
+    }
+  }
+`;

src/github/context.ts

@@ -52,14 +52,8 @@ export function parseGitHubContext(): ParsedGitHubContext {
     inputs: {
       triggerPhrase: process.env.TRIGGER_PHRASE ?? "@claude",
       assigneeTrigger: process.env.ASSIGNEE_TRIGGER ?? "",
-      allowedTools: (process.env.ALLOWED_TOOLS ?? "")
-        .split(",")
-        .map((tool) => tool.trim())
-        .filter((tool) => tool.length > 0),
-      disallowedTools: (process.env.DISALLOWED_TOOLS ?? "")
-        .split(",")
-        .map((tool) => tool.trim())
-        .filter((tool) => tool.length > 0),
+      allowedTools: parseMultilineInput(process.env.ALLOWED_TOOLS ?? ""),
+      disallowedTools: parseMultilineInput(process.env.DISALLOWED_TOOLS ?? ""),
       customInstructions: process.env.CUSTOM_INSTRUCTIONS ?? "",
       directPrompt: process.env.DIRECT_PROMPT ?? "",
       baseBranch: process.env.BASE_BRANCH,
@@ -116,6 +110,14 @@ export function parseGitHubContext(): ParsedGitHubContext {
   }
 }
 
+export function parseMultilineInput(s: string): string[] {
+  return s
+    .split(/,|[\n\r]+/)
+    .map((tool) => tool.replace(/#.+$/, ""))
+    .map((tool) => tool.trim())
+    .filter((tool) => tool.length > 0);
+}
+
 export function isIssuesEvent(
   context: ParsedGitHubContext,
 ): context is ParsedGitHubContext & { payload: IssuesEvent } {

src/github/data/fetcher.ts

@@ -1,6 +1,6 @@
 import { execSync } from "child_process";
 import type { Octokits } from "../api/client";
-import { ISSUE_QUERY, PR_QUERY } from "../api/queries/github";
+import { ISSUE_QUERY, PR_QUERY, USER_QUERY } from "../api/queries/github";
 import type {
   GitHubComment,
   GitHubFile,
@@ -18,6 +18,7 @@ type FetchDataParams = {
   repository: string;
   prNumber: string;
   isPR: boolean;
+  triggerUsername?: string;
 };
 
 export type GitHubFileWithSHA = GitHubFile & {
@@ -31,6 +32,7 @@ export type FetchDataResult = {
   changedFilesWithSHA: GitHubFileWithSHA[];
   reviewData: { nodes: GitHubReview[] } | null;
   imageUrlMap: Map<string, string>;
+  triggerDisplayName?: string | null;
 };
 
 export async function fetchGitHubData({
@@ -38,6 +40,7 @@ export async function fetchGitHubData({
   repository,
   prNumber,
   isPR,
+  triggerUsername,
 }: FetchDataParams): Promise<FetchDataResult> {
   const [owner, repo] = repository.split("/");
   if (!owner || !repo) {
@@ -191,6 +194,12 @@ export async function fetchGitHubData({
     allComments,
   );
 
+  // Fetch trigger user display name if username is provided
+  let triggerDisplayName: string | null | undefined;
+  if (triggerUsername) {
+    triggerDisplayName = await fetchUserDisplayName(octokits, triggerUsername);
+  }
+
   return {
     contextData,
     comments,
@@ -198,5 +207,27 @@ export async function fetchGitHubData({
     changedFilesWithSHA,
     reviewData,
     imageUrlMap,
+    triggerDisplayName,
   };
 }
+
+export type UserQueryResponse = {
+  user: {
+    name: string | null;
+  };
+};
+
+export async function fetchUserDisplayName(
+  octokits: Octokits,
+  login: string,
+): Promise<string | null> {
+  try {
+    const result = await octokits.graphql<UserQueryResponse>(USER_QUERY, {
+      login,
+    });
+    return result.user.name;
+  } catch (error) {
+    console.warn(`Failed to fetch user display name for ${login}:`, error);
+    return null;
+  }
+}

src/github/types.ts

@@ -1,6 +1,7 @@
 // Types for GitHub GraphQL query responses
 export type GitHubAuthor = {
   login: string;
+  name?: string;
 };
 
 export type GitHubComment = {

src/mcp/github-file-ops-server.ts

@@ -466,6 +466,7 @@ server.tool(
 
       const octokit = new Octokit({
         auth: githubToken,
+        baseUrl: GITHUB_API_URL,
       });
 
       const isPullRequestReviewComment =

src/mcp/install-mcp-server.ts

@@ -1,4 +1,5 @@
 import * as core from "@actions/core";
+import { GITHUB_API_URL } from "../github/api/config";
 
 type PrepareConfigParams = {
   githubToken: string;
@@ -46,6 +47,7 @@ export async function prepareMcpConfig(
             ...(claudeCommentId && { CLAUDE_COMMENT_ID: claudeCommentId }),
             GITHUB_EVENT_NAME: process.env.GITHUB_EVENT_NAME || "",
             IS_PR: process.env.IS_PR || "false",
+            GITHUB_API_URL: GITHUB_API_URL,
           },
         },
       },

test/create-prompt.test.ts

@@ -316,7 +316,7 @@ describe("generatePrompt", () => {
 
     expect(prompt).toContain("<trigger_username>johndoe</trigger_username>");
     expect(prompt).toContain(
-      "Co-authored-by: johndoe <johndoe@users.noreply.github.com>",
+      'Use: "Co-authored-by: johndoe <johndoe@users.noreply.github.com>"',
     );
   });
 

test/github/context.test.ts

@@ -0,0 +1,57 @@
+import { describe, it, expect } from "bun:test";
+import { parseMultilineInput } from "../../src/github/context";
+
+describe("parseMultilineInput", () => {
+  it("should parse a comma-separated string", () => {
+    const input = `Bash(bun install),Bash(bun test:*),Bash(bun typecheck)`;
+    const result = parseMultilineInput(input);
+    expect(result).toEqual([
+      "Bash(bun install)",
+      "Bash(bun test:*)",
+      "Bash(bun typecheck)",
+    ]);
+  });
+
+  it("should parse multiline string", () => {
+    const input = `Bash(bun install)
+Bash(bun test:*)
+Bash(bun typecheck)`;
+    const result = parseMultilineInput(input);
+    expect(result).toEqual([
+      "Bash(bun install)",
+      "Bash(bun test:*)",
+      "Bash(bun typecheck)",
+    ]);
+  });
+
+  it("should parse comma-separated multiline line", () => {
+    const input = `Bash(bun install),Bash(bun test:*)
+Bash(bun typecheck)`;
+    const result = parseMultilineInput(input);
+    expect(result).toEqual([
+      "Bash(bun install)",
+      "Bash(bun test:*)",
+      "Bash(bun typecheck)",
+    ]);
+  });
+
+  it("should ignore comments", () => {
+    const input = `Bash(bun install),
+Bash(bun test:*) # For testing
+# For type checking
+Bash(bun typecheck)
+`;
+    const result = parseMultilineInput(input);
+    expect(result).toEqual([
+      "Bash(bun install)",
+      "Bash(bun test:*)",
+      "Bash(bun typecheck)",
+    ]);
+  });
+
+  it("should parse an empty string", () => {
+    const input = "";
+    const result = parseMultilineInput(input);
+    expect(result).toEqual([]);
+  });
+});