chore: bump Claude Code to 2.1.278 and Agent SDK to 0.3.278

* fix: encode branch names in GitHub links

* style: format branch URL helper

.claude/settings.json

@@ -5,7 +5,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "bun run format"
+            "command": "bunx prettier@3.5.3 --no-config --write ."
           }
         ],
         "matcher": "Edit|Write|MultiEdit"

.gitattributes

@@ -0,0 +1,3 @@
+# Keep the working tree LF on every platform: Prettier defaults to
+# endOfLine "lf" and several tests match LF-terminated content.
+* text=auto eol=lf

.github/workflows/claude-review.yml

@@ -6,6 +6,8 @@ on:
 
 jobs:
   review:
+    # Skip on fork PRs since they can't mint the OIDC token used for Claude API auth
+    if: github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     permissions:
       contents: read

.github/workflows/test-base-action.yml

@@ -19,6 +19,8 @@ permissions:
 
 jobs:
   test-inline-prompt:
+    # Skip on fork PRs since they can't mint the OIDC token used for Claude API auth
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -31,7 +33,7 @@ jobs:
           anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
           anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
           anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
-          allowed_tools: "LS,Read"
+          claude_args: '--allowedTools "LS,Read"'
 
       - name: Verify inline prompt output
         run: |
@@ -70,6 +72,8 @@ jobs:
           fi
 
   test-prompt-file:
+    # Skip on fork PRs since they can't mint the OIDC token used for Claude API auth
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -90,7 +94,7 @@ jobs:
           anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
           anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
           anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
-          allowed_tools: "LS,Read"
+          claude_args: '--allowedTools "LS,Read"'
 
       - name: Verify prompt file output
         run: |

.github/workflows/test-custom-executables.yml

@@ -14,6 +14,8 @@ permissions:
 
 jobs:
   test-custom-executables:
+    # Skip on fork PRs since they can't mint the OIDC token used for Claude API auth
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -59,7 +61,7 @@ jobs:
           anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }}
           path_to_claude_code_executable: /home/runner/.local/bin/claude
           path_to_bun_executable: /home/runner/.bun/bin/bun
-          allowed_tools: "LS,Read"
+          claude_args: '--allowedTools "LS,Read"'
 
       - name: Verify custom executables worked
         run: |

.github/workflows/test-mcp-servers.yml

@@ -14,6 +14,8 @@ permissions:
 
 jobs:
   test-mcp-integration:
+    # Skip on fork PRs since they can't mint the OIDC token used for Claude API auth
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
@@ -94,6 +96,8 @@ jobs:
           echo "✓ All MCP server checks passed!"
 
   test-mcp-config-flag:
+    # Skip on fork PRs since they can't mint the OIDC token used for Claude API auth
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository

.github/workflows/test-settings.yml

@@ -14,6 +14,8 @@ permissions:
 
 jobs:
   test-settings-inline-allow:
+    # Skip on fork PRs since they can't mint the OIDC token used for Claude API auth
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -65,6 +67,8 @@ jobs:
           fi
 
   test-settings-inline-deny:
+    # Skip on fork PRs since they can't mint the OIDC token used for Claude API auth
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -99,6 +103,8 @@ jobs:
           fi
 
   test-settings-file-allow:
+    # Skip on fork PRs since they can't mint the OIDC token used for Claude API auth
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -155,6 +161,8 @@ jobs:
           fi
 
   test-settings-file-deny:
+    # Skip on fork PRs since they can't mint the OIDC token used for Claude API auth
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

.github/workflows/test-structured-output.yml

@@ -15,6 +15,8 @@ permissions:
 jobs:
   test-basic-types:
     name: Test Basic Type Conversions
+    # Skip on fork PRs since they can't mint the OIDC token used for Claude API auth
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -76,6 +78,8 @@ jobs:
 
   test-complex-types:
     name: Test Arrays and Objects
+    # Skip on fork PRs since they can't mint the OIDC token used for Claude API auth
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -129,6 +133,8 @@ jobs:
 
   test-edge-cases:
     name: Test Edge Cases
+    # Skip on fork PRs since they can't mint the OIDC token used for Claude API auth
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -190,6 +196,8 @@ jobs:
 
   test-name-sanitization:
     name: Test Output Name Sanitization
+    # Skip on fork PRs since they can't mint the OIDC token used for Claude API auth
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -232,6 +240,8 @@ jobs:
 
   test-execution-file-structure:
     name: Test Execution File Format
+    # Skip on fork PRs since they can't mint the OIDC token used for Claude API auth
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -284,7 +294,7 @@ jobs:
       - test-edge-cases
       - test-name-sanitization
       - test-execution-file-structure
-    if: always()
+    if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
     steps:
       - name: Generate Summary
         run: |

.prettierignore

@@ -1,2 +1,4 @@
 # Test fixtures should not be formatted to preserve exact output matching
-test/fixtures/
+test/fixtures/
+# Snapshot of PR-authored config kept for review; do not reformat
+.claude-pr/

action.yml

@@ -134,7 +134,7 @@ inputs:
     required: false
     default: "claude[bot]"
   track_progress:
-    description: "Force tag mode with tracking comments for pull_request and issue events. Only applicable to pull_request (opened, synchronize, ready_for_review, reopened) and issue (opened, edited, labeled, assigned) events."
+    description: "Force tag mode with tracking comments for pull_request and issue events. Only applicable to pull_request (opened, synchronize, ready_for_review, reopened, labeled) and issue (opened, edited, labeled, assigned) events."
     required: false
     default: "false"
   include_fix_links:
@@ -167,6 +167,9 @@ inputs:
     default: ""
 
 outputs:
+  conclusion:
+    description: "Execution status of Claude Code ('success' or 'failure')"
+    value: ${{ steps.run.outputs.conclusion }}
   execution_file:
     description: "Path to the Claude Code execution output file"
     value: ${{ steps.run.outputs.execution_file }}
@@ -193,6 +196,14 @@ runs:
       with:
         bun-version: 1.3.14
         token: ${{ inputs.github_token || github.token }}
+        # Disable setup-bun's cache. The upstream save step uses a deterministic
+        # key (Bun version) and isn't ref-aware: on every second-and-subsequent
+        # run against the same PR ref the GitHub cache API rejects the duplicate
+        # key+ref with a 409 (HTML body), and @actions/cache treats the unparsable
+        # response as transient and burns ~20-30s on 5 retries before warning.
+        # The 35 MB Bun binary downloads in 2-3s, so disabling the cache is a net
+        # wallclock win and removes the noisy warning. See issue #1252.
+        no-cache: true
 
     - name: Setup Custom Bun Path
       if: inputs.path_to_bun_executable != ''

base-action/README.md

@@ -22,7 +22,7 @@ Add the following to your workflow file:
   uses: anthropics/claude-code-base-action@beta
   with:
     prompt: "Your prompt here"
-    allowed_tools: "Bash(git:*),View,GlobTool,GrepTool,BatchTool"
+    claude_args: '--allowedTools "Bash(git:*),Read,Glob,Grep"'
     anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
 
 # Or using a prompt from a file
@@ -30,7 +30,7 @@ Add the following to your workflow file:
   uses: anthropics/claude-code-base-action@beta
   with:
     prompt_file: "/path/to/prompt.txt"
-    allowed_tools: "Bash(git:*),View,GlobTool,GrepTool,BatchTool"
+    claude_args: '--allowedTools "Bash(git:*),Read,Glob,Grep"'
     anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
 
 # Or limiting the conversation turns
@@ -38,8 +38,9 @@ Add the following to your workflow file:
   uses: anthropics/claude-code-base-action@beta
   with:
     prompt: "Your prompt here"
-    allowed_tools: "Bash(git:*),View,GlobTool,GrepTool,BatchTool"
-    max_turns: "5" # Limit conversation to 5 turns
+    claude_args: |
+      --allowedTools "Bash(git:*),Read,Glob,Grep"
+      --max-turns 5
     anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
 
 # Using custom system prompts
@@ -47,8 +48,9 @@ Add the following to your workflow file:
   uses: anthropics/claude-code-base-action@beta
   with:
     prompt: "Build a REST API"
-    system_prompt: "You are a senior backend engineer. Focus on security, performance, and maintainability."
-    allowed_tools: "Bash(git:*),View,GlobTool,GrepTool,BatchTool"
+    claude_args: |
+      --system-prompt "You are a senior backend engineer. Focus on security, performance, and maintainability."
+      --allowedTools "Bash(git:*),Read,Glob,Grep"
     anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
 
 # Or appending to the default system prompt
@@ -56,8 +58,9 @@ Add the following to your workflow file:
   uses: anthropics/claude-code-base-action@beta
   with:
     prompt: "Create a database schema"
-    append_system_prompt: "After writing code, be sure to code review yourself."
-    allowed_tools: "Bash(git:*),View,GlobTool,GrepTool,BatchTool"
+    claude_args: |
+      --append-system-prompt "After writing code, be sure to code review yourself."
+      --allowedTools "Bash(git:*),Read,Glob,Grep"
     anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
 
 # Using custom environment variables
@@ -65,11 +68,15 @@ Add the following to your workflow file:
   uses: anthropics/claude-code-base-action@beta
   with:
     prompt: "Deploy to staging environment"
-    claude_env: |
-      ENVIRONMENT: staging
-      API_URL: https://api-staging.example.com
-      DEBUG: true
-    allowed_tools: "Bash(git:*),View,GlobTool,GrepTool,BatchTool"
+    settings: |
+      {
+        "env": {
+          "ENVIRONMENT": "staging",
+          "API_URL": "https://api-staging.example.com",
+          "DEBUG": "true"
+        }
+      }
+    claude_args: '--allowedTools "Bash(git:*),Read,Glob,Grep"'
     anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
 
 # Using fallback model for handling API errors
@@ -77,9 +84,10 @@ Add the following to your workflow file:
   uses: anthropics/claude-code-base-action@beta
   with:
     prompt: "Review and fix TypeScript errors"
-    model: "claude-opus-4-1-20250805"
-    fallback_model: "claude-sonnet-4-20250514"
-    allowed_tools: "Bash(git:*),View,GlobTool,GrepTool,BatchTool"
+    claude_args: |
+      --model "claude-opus-4-1-20250805"
+      --fallback-model "claude-sonnet-4-20250514"
+      --allowedTools "Bash(git:*),Read,Glob,Grep"
     anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
 
 # Using OAuth token instead of API key
@@ -87,7 +95,7 @@ Add the following to your workflow file:
   uses: anthropics/claude-code-base-action@beta
   with:
     prompt: "Update dependencies"
-    allowed_tools: "Bash(git:*),View,GlobTool,GrepTool,BatchTool"
+    claude_args: '--allowedTools "Bash(git:*),Read,Glob,Grep"'
     claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 ```
 
@@ -114,32 +122,28 @@ Do not set `anthropic_api_key` or `claude_code_oauth_token` alongside the federa
 
 ## Inputs
 
-| Input                          | Description                                                                                                             | Required | Default                      |
-| ------------------------------ | ----------------------------------------------------------------------------------------------------------------------- | -------- | ---------------------------- |
-| `prompt`                       | The prompt to send to Claude Code                                                                                       | No\*     | ''                           |
-| `prompt_file`                  | Path to a file containing the prompt to send to Claude Code                                                             | No\*     | ''                           |
-| `allowed_tools`                | Comma-separated list of allowed tools for Claude Code to use                                                            | No       | ''                           |
-| `disallowed_tools`             | Comma-separated list of disallowed tools that Claude Code cannot use                                                    | No       | ''                           |
-| `max_turns`                    | Maximum number of conversation turns (default: no limit)                                                                | No       | ''                           |
-| `mcp_config`                   | Path to the MCP configuration JSON file, or MCP configuration JSON string                                               | No       | ''                           |
-| `settings`                     | Path to Claude Code settings JSON file, or settings JSON string                                                         | No       | ''                           |
-| `system_prompt`                | Override system prompt                                                                                                  | No       | ''                           |
-| `append_system_prompt`         | Append to system prompt                                                                                                 | No       | ''                           |
-| `claude_env`                   | Custom environment variables to pass to Claude Code execution (YAML multiline format)                                   | No       | ''                           |
-| `model`                        | Model to use (provider-specific format required for Bedrock/Vertex)                                                     | No       | 'claude-4-0-sonnet-20250219' |
-| `anthropic_model`              | DEPRECATED: Use 'model' instead                                                                                         | No       | 'claude-4-0-sonnet-20250219' |
-| `fallback_model`               | Enable automatic fallback to specified model when default model is overloaded                                           | No       | ''                           |
-| `anthropic_api_key`            | Anthropic API key (required for direct Anthropic API)                                                                   | No       | ''                           |
-| `claude_code_oauth_token`      | Claude Code OAuth token (alternative to anthropic_api_key)                                                              | No       | ''                           |
-| `anthropic_federation_rule_id` | Workload identity federation rule ID (fdrl\_...). Requires `id-token: write` permission                                 | No       | ''                           |
-| `anthropic_organization_id`    | Anthropic organization UUID used for workload identity federation                                                       | No       | ''                           |
-| `anthropic_service_account_id` | Service account ID (svac\_...) the federated token acts as (optional)                                                   | No       | ''                           |
-| `anthropic_workspace_id`       | Workspace ID (wrkspc\_...) for federation. Optional when the rule targets a single workspace                            | No       | ''                           |
-| `anthropic_oidc_audience`      | Audience to request on the GitHub OIDC token. Defaults to https://api.anthropic.com                                     | No       | ''                           |
-| `use_bedrock`                  | Use Amazon Bedrock with OIDC authentication instead of direct Anthropic API                                             | No       | 'false'                      |
-| `use_vertex`                   | Use Google Vertex AI with OIDC authentication instead of direct Anthropic API                                           | No       | 'false'                      |
-| `use_node_cache`               | Whether to use Node.js dependency caching (set to true only for Node.js projects with lock files)                       | No       | 'false'                      |
-| `show_full_output`             | Show full JSON output (⚠️ May expose secrets - see [security docs](../docs/security.md#️-full-output-security-warning)) | No       | 'false'\*\*                  |
+| Input                            | Description                                                                                                             | Required | Default       |
+| -------------------------------- | ----------------------------------------------------------------------------------------------------------------------- | -------- | ------------- |
+| `prompt`                         | The prompt to send to Claude Code                                                                                       | No\*     | `''`          |
+| `prompt_file`                    | Path to a file containing the prompt to send to Claude Code                                                             | No\*     | `''`          |
+| `settings`                       | Claude Code settings as a JSON string or path to a settings JSON file                                                   | No       | `''`          |
+| `claude_args`                    | Additional arguments to pass directly to the Claude CLI                                                                 | No       | `''`          |
+| `anthropic_api_key`              | Anthropic API key for direct Anthropic API authentication                                                               | No       | `''`          |
+| `claude_code_oauth_token`        | Claude Code OAuth token as an alternative to an Anthropic API key                                                       | No       | `''`          |
+| `anthropic_federation_rule_id`   | Workload identity federation rule ID (fdrl\_...). Requires `id-token: write` permission                                 | No       | `''`          |
+| `anthropic_organization_id`      | Anthropic organization UUID used for workload identity federation                                                       | No       | `''`          |
+| `anthropic_service_account_id`   | Service account ID (svac\_...) the federated token acts as                                                              | No       | `''`          |
+| `anthropic_workspace_id`         | Workspace ID (wrkspc\_...) for federation                                                                               | No       | `''`          |
+| `anthropic_oidc_audience`        | Audience for the GitHub OIDC token request                                                                              | No       | `''`          |
+| `use_bedrock`                    | Use Amazon Bedrock with OIDC authentication                                                                             | No       | `'false'`     |
+| `use_vertex`                     | Use Google Vertex AI with OIDC authentication                                                                           | No       | `'false'`     |
+| `use_foundry`                    | Use Microsoft Foundry with OIDC authentication                                                                          | No       | `'false'`     |
+| `use_node_cache`                 | Enable Node.js dependency caching for projects with lock files                                                          | No       | `'false'`     |
+| `path_to_claude_code_executable` | Path to a custom Claude Code executable                                                                                 | No       | `''`          |
+| `path_to_bun_executable`         | Path to a custom Bun executable                                                                                         | No       | `''`          |
+| `show_full_output`               | Show full JSON output (⚠️ May expose secrets - see [security docs](../docs/security.md#️-full-output-security-warning)) | No       | `'false'`\*\* |
+| `plugins`                        | Newline-separated Claude Code plugin names to install                                                                   | No       | `''`          |
+| `plugin_marketplaces`            | Newline-separated plugin marketplace Git URLs to install                                                                | No       | `''`          |
 
 \*Either `prompt` or `prompt_file` must be provided, but not both.
 
@@ -176,55 +180,28 @@ Example usage:
 
 ## Custom Environment Variables
 
-You can pass custom environment variables to Claude Code execution using the `claude_env` input. This allows Claude to access environment-specific configuration during its execution.
-
-The `claude_env` input accepts YAML multiline format with key-value pairs:
+You can pass custom environment variables to Claude Code through the `env` object in `settings`:
 
 ```yaml
 - name: Deploy with custom environment
   uses: anthropics/claude-code-base-action@beta
   with:
     prompt: "Deploy the application to the staging environment"
-    claude_env: |
-      ENVIRONMENT: staging
-      API_BASE_URL: https://api-staging.example.com
-      DATABASE_URL: ${{ secrets.STAGING_DB_URL }}
-      DEBUG: true
-      LOG_LEVEL: debug
-    allowed_tools: "Bash(git:*),View,GlobTool,GrepTool,BatchTool"
+    settings: |
+      {
+        "env": {
+          "ENVIRONMENT": "staging",
+          "API_BASE_URL": "https://api-staging.example.com",
+          "DATABASE_URL": "${{ secrets.STAGING_DB_URL }}",
+          "DEBUG": "true",
+          "LOG_LEVEL": "debug"
+        }
+      }
+    claude_args: '--allowedTools "Bash(git:*),Read,Glob,Grep"'
     anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
 ```
 
-### Features:
-
-- **YAML Format**: Use standard YAML key-value syntax (`KEY: value`)
-- **Multiline Support**: Define multiple environment variables in a single input
-- **Comments**: Lines starting with `#` are ignored
-- **GitHub Secrets**: Can reference GitHub secrets using `${{ secrets.SECRET_NAME }}`
-- **Runtime Access**: Environment variables are available to Claude during execution
-
-### Example Use Cases:
-
-```yaml
-# Development configuration
-claude_env: |
-  NODE_ENV: development
-  API_URL: http://localhost:3000
-  DEBUG: true
-
-# Production deployment
-claude_env: |
-  NODE_ENV: production
-  API_URL: https://api.example.com
-  DATABASE_URL: ${{ secrets.PROD_DB_URL }}
-  REDIS_URL: ${{ secrets.REDIS_URL }}
-
-# Feature flags and configuration
-claude_env: |
-  FEATURE_NEW_UI: enabled
-  MAX_RETRIES: 3
-  TIMEOUT_MS: 5000
-```
+The `settings` input accepts either inline JSON or a path to a settings JSON file. Values in the `env` object are available during the Claude Code session and can reference GitHub secrets.
 
 ## Using Settings Configuration
 
@@ -240,7 +217,7 @@ Provide a path to a JSON file containing Claude Code settings:
   with:
     prompt: "Your prompt here"
     settings: "path/to/settings.json"
-    allowed_tools: "Bash(git:*),View,GlobTool,GrepTool,BatchTool"
+    claude_args: '--allowedTools "Bash(git:*),Read,Glob,Grep"'
     anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
 ```
 
@@ -274,7 +251,7 @@ Provide the settings configuration directly as a JSON string:
           }]
         }
       }
-    allowed_tools: "Bash(git:*),View,GlobTool,GrepTool,BatchTool"
+    claude_args: '--allowedTools "Bash(git:*),Read,Glob,Grep"'
     anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
 ```
 
@@ -302,8 +279,9 @@ Provide a path to a JSON file containing MCP configuration:
   uses: anthropics/claude-code-base-action@beta
   with:
     prompt: "Your prompt here"
-    mcp_config: "path/to/mcp-config.json"
-    allowed_tools: "Bash(git:*),View,GlobTool,GrepTool,BatchTool"
+    claude_args: |
+      --mcp-config "path/to/mcp-config.json"
+      --allowedTools "Bash(git:*),Read,Glob,Grep"
     anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
 ```
 
@@ -316,19 +294,9 @@ Provide the MCP configuration directly as a JSON string:
   uses: anthropics/claude-code-base-action@beta
   with:
     prompt: "Your prompt here"
-    mcp_config: |
-      {
-        "mcpServers": {
-          "server-name": {
-            "command": "node",
-            "args": ["./server.js"],
-            "env": {
-              "API_KEY": "your-api-key"
-            }
-          }
-        }
-      }
-    allowed_tools: "Bash(git:*),View,GlobTool,GrepTool,BatchTool"
+    claude_args: >-
+      --mcp-config '{"mcpServers":{"server-name":{"command":"node","args":["./server.js"],"env":{"API_KEY":"your-api-key"}}}}'
+      --allowedTools "Bash(git:*),Read,Glob,Grep"
     anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
 ```
 
@@ -356,8 +324,9 @@ You can combine MCP config with other inputs like allowed tools:
   uses: anthropics/claude-code-base-action@beta
   with:
     prompt: "Access the custom MCP server and use its tools"
-    mcp_config: "mcp-config.json"
-    allowed_tools: "Bash(git:*),View,mcp__server-name__custom_tool"
+    claude_args: |
+      --mcp-config "mcp-config.json"
+      --allowedTools "Bash(git:*),Read,mcp__server-name__custom_tool"
     anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
 ```
 
@@ -384,7 +353,7 @@ jobs:
         uses: anthropics/claude-code-base-action@beta
         with:
           prompt: "Review the PR changes. Focus on code quality, potential bugs, and performance issues. Suggest improvements where appropriate. Write your review as markdown text."
-          allowed_tools: "Bash(git diff --name-only HEAD~1),Bash(git diff HEAD~1),View,GlobTool,GrepTool,Write"
+          claude_args: '--allowedTools "Bash(git diff --name-only HEAD~1),Bash(git diff HEAD~1),Read,Glob,Grep,Write"'
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
 
       - name: Extract and Comment PR Review
@@ -472,7 +441,7 @@ Use provider-specific model names based on your chosen provider:
   uses: anthropics/claude-code-base-action@beta
   with:
     prompt: "Your prompt here"
-    model: "claude-3-7-sonnet-20250219"
+    claude_args: "--model claude-3-7-sonnet-20250219"
     anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
 
 # For Amazon Bedrock (requires OIDC authentication)
@@ -486,7 +455,7 @@ Use provider-specific model names based on your chosen provider:
   uses: anthropics/claude-code-base-action@beta
   with:
     prompt: "Your prompt here"
-    model: "anthropic.claude-3-7-sonnet-20250219-v1:0"
+    claude_args: "--model anthropic.claude-3-7-sonnet-20250219-v1:0"
     use_bedrock: "true"
 
 # For Google Vertex AI (requires OIDC authentication)
@@ -500,7 +469,7 @@ Use provider-specific model names based on your chosen provider:
   uses: anthropics/claude-code-base-action@beta
   with:
     prompt: "Your prompt here"
-    model: "claude-3-7-sonnet@20250219"
+    claude_args: "--model claude-3-7-sonnet@20250219"
     use_vertex: "true"
 ```
 
@@ -520,8 +489,9 @@ This example shows how to use OIDC authentication with AWS Bedrock:
   with:
     prompt: "Your prompt here"
     use_bedrock: "true"
-    model: "anthropic.claude-3-7-sonnet-20250219-v1:0"
-    allowed_tools: "Bash(git:*),View,GlobTool,GrepTool,BatchTool"
+    claude_args: |
+      --model "anthropic.claude-3-7-sonnet-20250219-v1:0"
+      --allowedTools "Bash(git:*),Read,Glob,Grep"
 ```
 
 ## Example: Using OIDC Authentication for GCP Vertex AI
@@ -540,8 +510,9 @@ This example shows how to use OIDC authentication with GCP Vertex AI:
   with:
     prompt: "Your prompt here"
     use_vertex: "true"
-    model: "claude-3-7-sonnet@20250219"
-    allowed_tools: "Bash(git:*),View,GlobTool,GrepTool,BatchTool"
+    claude_args: |
+      --model "claude-3-7-sonnet@20250219"
+      --allowedTools "Bash(git:*),Read,Glob,Grep"
 ```
 
 ## Security Best Practices

base-action/action.yml

@@ -121,6 +121,8 @@ runs:
       uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # https://github.com/oven-sh/setup-bun/releases/tag/v2.2.0
       with:
         bun-version: 1.3.14
+        # Disable setup-bun's cache. See action.yml for details and issue #1252.
+        no-cache: true
 
     - name: Setup Custom Bun Path
       if: inputs.path_to_bun_executable != ''
@@ -145,7 +147,7 @@ runs:
         PATH_TO_CLAUDE_CODE_EXECUTABLE: ${{ inputs.path_to_claude_code_executable }}
       run: |
         if [ -z "$PATH_TO_CLAUDE_CODE_EXECUTABLE" ]; then
-          CLAUDE_CODE_VERSION="2.1.222"
+          CLAUDE_CODE_VERSION="2.1.278"
           echo "Installing Claude Code v${CLAUDE_CODE_VERSION}..."
           for attempt in 1 2 3; do
             echo "Installation attempt $attempt..."
@@ -163,6 +165,8 @@ runs:
             sleep 5
           done
           echo "Claude Code installed successfully"
+          # Add ~/.local/bin to PATH so the claude executable is available in subsequent steps
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
         else
           echo "Using custom Claude Code executable: $PATH_TO_CLAUDE_CODE_EXECUTABLE"
           # Add the directory containing the custom executable to PATH

base-action/bun.lock

@@ -6,8 +6,8 @@
       "name": "@anthropic-ai/claude-code-base-action",
       "dependencies": {
         "@actions/core": "^1.10.1",
-        "@anthropic-ai/claude-agent-sdk": "^0.3.222",
-        "shell-quote": "^1.8.3",
+        "@anthropic-ai/claude-agent-sdk": "^0.3.278",
+        "shell-quote": "^1.8.4",
       },
       "devDependencies": {
         "@types/bun": "^1.2.12",
@@ -27,23 +27,23 @@
 
     "@actions/io": ["@actions/io@1.1.3", "", {}, "sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q=="],
 
-    "@anthropic-ai/claude-agent-sdk": ["@anthropic-ai/claude-agent-sdk@0.3.222", "", { "optionalDependencies": { "@anthropic-ai/claude-agent-sdk-darwin-arm64": "0.3.222", "@anthropic-ai/claude-agent-sdk-darwin-x64": "0.3.222", "@anthropic-ai/claude-agent-sdk-linux-arm64": "0.3.222", "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "0.3.222", "@anthropic-ai/claude-agent-sdk-linux-x64": "0.3.222", "@anthropic-ai/claude-agent-sdk-linux-x64-musl": "0.3.222", "@anthropic-ai/claude-agent-sdk-win32-arm64": "0.3.222", "@anthropic-ai/claude-agent-sdk-win32-x64": "0.3.222" }, "peerDependencies": { "@anthropic-ai/sdk": ">=0.93.0", "@modelcontextprotocol/sdk": "^1.29.0", "zod": "^4.0.0" } }, "sha512-muAyjIzXJjIpSrj91vSmnU76/z7rNlV8+lSuq48h4eUPSYVBSgOasgkfQAMUrIZJCfI15XF9/EYoRrx/eKD7Og=="],
+    "@anthropic-ai/claude-agent-sdk": ["@anthropic-ai/claude-agent-sdk@0.3.278", "", { "optionalDependencies": { "@anthropic-ai/claude-agent-sdk-darwin-arm64": "0.3.278", "@anthropic-ai/claude-agent-sdk-darwin-x64": "0.3.278", "@anthropic-ai/claude-agent-sdk-linux-arm64": "0.3.278", "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "0.3.278", "@anthropic-ai/claude-agent-sdk-linux-x64": "0.3.278", "@anthropic-ai/claude-agent-sdk-linux-x64-musl": "0.3.278", "@anthropic-ai/claude-agent-sdk-win32-arm64": "0.3.278", "@anthropic-ai/claude-agent-sdk-win32-x64": "0.3.278" }, "peerDependencies": { "@anthropic-ai/sdk": ">=0.93.0", "@modelcontextprotocol/sdk": "^1.29.0", "zod": "^4.0.0" } }, "sha512-hXfjyiGraqYul6gq7R7+WmktxJfy9S29Yrx1WK6jQpsYcipf1CYIoYSh22SpGOR3FGiEmeuzXg5U9ncOk19Fww=="],
 
-    "@anthropic-ai/claude-agent-sdk-darwin-arm64": ["@anthropic-ai/claude-agent-sdk-darwin-arm64@0.3.222", "", { "os": "darwin", "cpu": "arm64" }, "sha512-h3nCSwRbUsXDnRRYvMhzI1u1q5w6jClc9jTtOJBY6+mijjJEGk+Fa5Kuhw0Tb5ec+1iatiTyCIT46HrV0Skqcg=="],
+    "@anthropic-ai/claude-agent-sdk-darwin-arm64": ["@anthropic-ai/claude-agent-sdk-darwin-arm64@0.3.278", "", { "os": "darwin", "cpu": "arm64" }, "sha512-lwkbWfYucsgiFo6mWF3Dw7ImohlWXEkkh+4e93EpeVPCxwN4IJuLztFkl28qEwY17sZ9SYQw1mRksKauqKccqg=="],
 
-    "@anthropic-ai/claude-agent-sdk-darwin-x64": ["@anthropic-ai/claude-agent-sdk-darwin-x64@0.3.222", "", { "os": "darwin", "cpu": "x64" }, "sha512-kVzR6qBZv1ddbb+uJfDDEVdW6/cl1dtc2nAIa8prk4IcuyK1RwQE/BOO8dO6iRl5PnHuv9BFKS9AO1UErOkT5Q=="],
+    "@anthropic-ai/claude-agent-sdk-darwin-x64": ["@anthropic-ai/claude-agent-sdk-darwin-x64@0.3.278", "", { "os": "darwin", "cpu": "x64" }, "sha512-IYTWl9mVeXe1GnHPkpw04p+fZ23zgTBuxNXv06h7xgjSZ7zhudL05d6NpkY5T13m/zL5b+fyYkXxGciTXVhiUg=="],
 
-    "@anthropic-ai/claude-agent-sdk-linux-arm64": ["@anthropic-ai/claude-agent-sdk-linux-arm64@0.3.222", "", { "os": "linux", "cpu": "arm64" }, "sha512-wn4XYkaWbAXc8PoznZqjCqbqB/Qet8dNdpZuRtbNSA1yZR0vYg2u28C5zV0QqVTXGgQVBYFUZabouyoERL6PsA=="],
+    "@anthropic-ai/claude-agent-sdk-linux-arm64": ["@anthropic-ai/claude-agent-sdk-linux-arm64@0.3.278", "", { "os": "linux", "cpu": "arm64" }, "sha512-gt03vjRLsfnT3NyOaCVZFdM6V6p0NNGxhUr6e0Yfd9a28LlIeUtNB/kMtFJDibDtsjVi4Mp+Wj9R7dsXPLOFfw=="],
 
-    "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": ["@anthropic-ai/claude-agent-sdk-linux-arm64-musl@0.3.222", "", { "os": "linux", "cpu": "arm64" }, "sha512-sVvPAUzRq+Am3+wNrFJ7URaWORu8t5hOu4vJnMhOeey66ZFFfzNwP0uz/7sTWjg+cRse/wG/hek34lZ0Gdu2+w=="],
+    "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": ["@anthropic-ai/claude-agent-sdk-linux-arm64-musl@0.3.278", "", { "os": "linux", "cpu": "arm64" }, "sha512-xbNx5TXiAr9REDh7znPnkvR8GoBe8A653hYXaVq+fNNLjXidOIvOhICMyUUrBC+wgZV1FenC46oSPIMH4n+EOQ=="],
 
-    "@anthropic-ai/claude-agent-sdk-linux-x64": ["@anthropic-ai/claude-agent-sdk-linux-x64@0.3.222", "", { "os": "linux", "cpu": "x64" }, "sha512-deZh3tVoYy9ememF5oirZNx1une7IG79JbKrB3Cynggt2gnq3TFXvPfkVGWgNsocK035wAW9HhGZui832OFSqA=="],
+    "@anthropic-ai/claude-agent-sdk-linux-x64": ["@anthropic-ai/claude-agent-sdk-linux-x64@0.3.278", "", { "os": "linux", "cpu": "x64" }, "sha512-xbW4MkKyPMKdWzdA499WnAP9H7p8YlMsQCVEVyz6CemePZPSLwBP9GBeUTnSS57+MievEqj8knckJPVv5I3+yw=="],
 
-    "@anthropic-ai/claude-agent-sdk-linux-x64-musl": ["@anthropic-ai/claude-agent-sdk-linux-x64-musl@0.3.222", "", { "os": "linux", "cpu": "x64" }, "sha512-vM48p8GRM5N57+jPFdPj1ZS8Y770frJ1NTRecA06/GXtRANn7dOUVpvJbpu6fJBFF3BCacM1uVcBCMZh6wEMjw=="],
+    "@anthropic-ai/claude-agent-sdk-linux-x64-musl": ["@anthropic-ai/claude-agent-sdk-linux-x64-musl@0.3.278", "", { "os": "linux", "cpu": "x64" }, "sha512-OJ103bvIglKrp7LLS3Bpiy9ISnFIvUikcg5kJVqovA+uU/ElP96v3kCUli7nUL75TnguSL0PwdAb/rYujycLqQ=="],
 
-    "@anthropic-ai/claude-agent-sdk-win32-arm64": ["@anthropic-ai/claude-agent-sdk-win32-arm64@0.3.222", "", { "os": "win32", "cpu": "arm64" }, "sha512-VuJjTLP2jQ1j8yn44/YODFR8GhI60Tvzok6AaXUYpKgeZTbBndDOpqwxvdWAraJSSyDreSSMztYyI6lP6nVypg=="],
+    "@anthropic-ai/claude-agent-sdk-win32-arm64": ["@anthropic-ai/claude-agent-sdk-win32-arm64@0.3.278", "", { "os": "win32", "cpu": "arm64" }, "sha512-r75c3+Ymw4bn+If8LCoYLaYu5xXH8tWtP1xsd6KNtwda0KjFJA6/wmgicwCi3W+Vcdw6AfoFtYCQ0Sl1YwePwg=="],
 
-    "@anthropic-ai/claude-agent-sdk-win32-x64": ["@anthropic-ai/claude-agent-sdk-win32-x64@0.3.222", "", { "os": "win32", "cpu": "x64" }, "sha512-mr4eZ+bmZA0hPl2wN031qy3TJXZJZIpdE4khvCc0AJ7ljVpJUEG654wz9NJoPxfPo4cRg41niHqUU5rN9BfQVw=="],
+    "@anthropic-ai/claude-agent-sdk-win32-x64": ["@anthropic-ai/claude-agent-sdk-win32-x64@0.3.278", "", { "os": "win32", "cpu": "x64" }, "sha512-+7nMK4AYzeNFdqxYP80v2ialF6t29Z46rXeV6NF77xXc1+kqCm6hwOMFXhJkP8EEEclFatyjdU/Dij5vM5YSNA=="],
 
     "@anthropic-ai/sdk": ["@anthropic-ai/sdk@0.93.0", "", { "dependencies": { "json-schema-to-ts": "^3.1.1" }, "peerDependencies": { "zod": "^3.25.0 || ^4.0.0" }, "optionalPeers": ["zod"], "bin": { "anthropic-ai-sdk": "bin/cli" } }, "sha512-q9vaSZQVFx6B/gPxetGYfLXSJD5v0sOmh0OpZDq7yCrTSA+Rscvrtyol7JJTW40wEpQB4U1B4JXzxQitbQ3CAA=="],
 
@@ -223,7 +223,7 @@
 
     "shebang-regex": ["shebang-regex@3.0.0", "", {}, "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A=="],
 
-    "shell-quote": ["shell-quote@1.8.3", "", {}, "sha512-ObmnIF4hXNg1BqhnHmgbDETF8dLPCggZWBjkQfhZpbszZnYur5DUljTcCHii5LC3J5E0yeO/1LIMyH+UvHQgyw=="],
+    "shell-quote": ["shell-quote@1.8.4", "", {}, "sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ=="],
 
     "side-channel": ["side-channel@1.1.0", "", { "dependencies": { "es-errors": "^1.3.0", "object-inspect": "^1.13.3", "side-channel-list": "^1.0.0", "side-channel-map": "^1.0.1", "side-channel-weakmap": "^1.0.2" } }, "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw=="],
 

base-action/package-lock.json

@@ -9,7 +9,7 @@
       "version": "1.0.0",
       "dependencies": {
         "@actions/core": "^1.10.1",
-        "shell-quote": "^1.8.3"
+        "shell-quote": "^1.8.4"
       },
       "devDependencies": {
         "@types/bun": "^1.2.12",
@@ -139,9 +139,9 @@
       }
     },
     "node_modules/shell-quote": {
-      "version": "1.8.3",
-      "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.3.tgz",
-      "integrity": "sha512-ObmnIF4hXNg1BqhnHmgbDETF8dLPCggZWBjkQfhZpbszZnYur5DUljTcCHii5LC3J5E0yeO/1LIMyH+UvHQgyw==",
+      "version": "1.8.4",
+      "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.4.tgz",
+      "integrity": "sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"

base-action/package.json

@@ -11,8 +11,8 @@
   },
   "dependencies": {
     "@actions/core": "^1.10.1",
-    "@anthropic-ai/claude-agent-sdk": "^0.3.222",
-    "shell-quote": "^1.8.3"
+    "@anthropic-ai/claude-agent-sdk": "^0.3.278",
+    "shell-quote": "^1.8.4"
   },
   "devDependencies": {
     "@types/bun": "^1.2.12",

base-action/src/parse-sdk-options.ts

@@ -204,6 +204,9 @@ export function parseSdkOptions(options: ClaudeOptions): ParsedSdkOptions {
   const modelFromClaudeArgs = extraArgs["model"] || undefined;
   delete extraArgs["model"];
 
+  const maxTurnsFromClaudeArgs = extraArgs["max-turns"] || undefined;
+  delete extraArgs["max-turns"];
+
   const additionalDirectories = extraArgs["add-dir"]
     ? extraArgs["add-dir"]
         .split(ACCUMULATE_DELIMITER)
@@ -286,6 +289,10 @@ export function parseSdkOptions(options: ClaudeOptions): ParsedSdkOptions {
   delete env.ACTIONS_ID_TOKEN_REQUEST_URL;
   delete env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
 
+  // Remove ALL_INPUTS as it is only needed during initial setup to determine
+  // input presence (collectActionInputsPresence) and contains serialized workflow inputs.
+  delete env.ALL_INPUTS;
+
   // Build system prompt option - default to claude_code preset
   let systemPrompt: SdkOptions["systemPrompt"];
   if (options.systemPrompt) {
@@ -308,7 +315,11 @@ export function parseSdkOptions(options: ClaudeOptions): ParsedSdkOptions {
   const sdkOptions: SdkOptions = {
     // Direct options from ClaudeOptions inputs
     model: options.model || modelFromClaudeArgs,
-    maxTurns: options.maxTurns ? parseInt(options.maxTurns, 10) : undefined,
+    maxTurns: options.maxTurns
+      ? parseInt(options.maxTurns, 10)
+      : maxTurnsFromClaudeArgs
+        ? parseInt(maxTurnsFromClaudeArgs, 10)
+        : undefined,
     allowedTools:
       mergedAllowedTools.length > 0 ? mergedAllowedTools : undefined,
     disallowedTools:

base-action/src/run-claude-sdk.ts

@@ -82,6 +82,35 @@ async function createPromptConfig(
   return createMultiBlockMessage();
 }
 
+type ModelUsageSummary = Record<
+  string,
+  {
+    contextWindow: number;
+    maxOutputTokens: number;
+  }
+>;
+
+/**
+ * Keep resolved model limits visible without exposing token usage or cost details.
+ */
+function sanitizeModelUsage(
+  modelUsage: SDKResultMessage["modelUsage"] | undefined,
+): ModelUsageSummary | undefined {
+  if (!modelUsage) {
+    return undefined;
+  }
+
+  return Object.fromEntries(
+    Object.entries(modelUsage).map(([model, usage]) => [
+      model,
+      {
+        contextWindow: usage.contextWindow,
+        maxOutputTokens: usage.maxOutputTokens,
+      },
+    ]),
+  );
+}
+
 /**
  * Sanitizes SDK output to match CLI sanitization behavior
  */
@@ -119,6 +148,7 @@ function sanitizeSdkOutput(
         num_turns: resultMsg.num_turns,
         total_cost_usd: resultMsg.total_cost_usd,
         permission_denials_count: resultMsg.permission_denials?.length ?? 0,
+        modelUsage: sanitizeModelUsage(resultMsg.modelUsage),
       },
       null,
       2,
@@ -208,6 +238,17 @@ export async function runClaudeWithSdk(
     throw new Error("No result message received from Claude");
   }
 
+  if (
+    resultMessage.subtype === "success" &&
+    !resultMessage.is_error &&
+    sdkOptions.maxTurns !== undefined &&
+    resultMessage.num_turns > sdkOptions.maxTurns
+  ) {
+    const message = `Claude reported a successful result after ${resultMessage.num_turns} turns, exceeding the configured maximum of ${sdkOptions.maxTurns}`;
+    core.error(message);
+    throw new Error(message);
+  }
+
   // subtype "success" with is_error:true means the run errored without producing
   // a real result — treat it as failure so CI does not show a misleading green check.
   const isSuccess =

base-action/test/parse-sdk-options.test.ts

@@ -521,6 +521,31 @@ describe("parseSdkOptions", () => {
     });
   });
 
+  describe("max turns handling", () => {
+    test("should map --max-turns from claudeArgs to sdkOptions.maxTurns", () => {
+      const options: ClaudeOptions = {
+        claudeArgs: "--max-turns 60",
+      };
+
+      const result = parseSdkOptions(options);
+
+      expect(result.sdkOptions.maxTurns).toBe(60);
+      expect(result.sdkOptions.extraArgs?.["max-turns"]).toBeUndefined();
+    });
+
+    test("should prefer the direct maxTurns option", () => {
+      const options: ClaudeOptions = {
+        maxTurns: "25",
+        claudeArgs: "--max-turns 60",
+      };
+
+      const result = parseSdkOptions(options);
+
+      expect(result.sdkOptions.maxTurns).toBe(25);
+      expect(result.sdkOptions.extraArgs?.["max-turns"]).toBeUndefined();
+    });
+  });
+
   describe("environment variables passthrough", () => {
     test("should include OTEL environment variables in sdkOptions.env", () => {
       // Set up test environment variables
@@ -595,5 +620,22 @@ describe("parseSdkOptions", () => {
         process.env = originalEnv;
       }
     });
+
+    test("should strip ALL_INPUTS from env", () => {
+      const originalEnv = { ...process.env };
+      process.env.ALL_INPUTS = JSON.stringify({
+        anthropic_api_key: "sk-ant-test-key",
+        github_token: "ghp_test_token",
+      });
+
+      try {
+        const options: ClaudeOptions = {};
+        const result = parseSdkOptions(options);
+
+        expect(result.sdkOptions.env?.ALL_INPUTS).toBeUndefined();
+      } finally {
+        process.env = originalEnv;
+      }
+    });
   });
 });

base-action/test/readme.test.ts

@@ -0,0 +1,50 @@
+import { readFileSync } from "node:fs";
+import { describe, expect, test } from "bun:test";
+
+const actionMetadata = readFileSync(
+  new URL("../action.yml", import.meta.url),
+  "utf8",
+);
+const readme = readFileSync(new URL("../README.md", import.meta.url), "utf8");
+
+describe("base action README", () => {
+  test("should document every input declared in the action metadata", () => {
+    const inputMetadata = actionMetadata.match(
+      /^inputs:\n([\s\S]*?)^outputs:/m,
+    )?.[1];
+    const inputReference = readme.match(
+      /^## Inputs\n([\s\S]*?)^## Outputs/m,
+    )?.[1];
+
+    expect(inputMetadata).toBeDefined();
+    expect(inputReference).toBeDefined();
+
+    const declaredInputs = [
+      ...(inputMetadata?.matchAll(/^  ([a-z0-9_]+):$/gm) ?? []),
+    ].map((match) => match[1]);
+    const documentedInputs = [
+      ...(inputReference?.matchAll(/^\| `([^`]+)`/gm) ?? []),
+    ].map((match) => match[1]);
+
+    expect(documentedInputs).toEqual(declaredInputs);
+  });
+
+  test("should not use removed legacy inputs in workflow examples", () => {
+    const removedInputs = [
+      "allowed_tools",
+      "disallowed_tools",
+      "max_turns",
+      "mcp_config",
+      "system_prompt",
+      "append_system_prompt",
+      "claude_env",
+      "model",
+      "anthropic_model",
+      "fallback_model",
+    ];
+
+    for (const input of removedInputs) {
+      expect(readme).not.toMatch(new RegExp(`^\\s+${input}:`, "m"));
+    }
+  });
+});

base-action/test/run-claude-sdk.test.ts

@@ -64,6 +64,95 @@ describe("runClaudeWithSdk", () => {
     }
   });
 
+  test("logs resolved model limits without exposing token usage", async () => {
+    const consoleLogSpy = spyOn(console, "log").mockImplementation(() => {});
+
+    tempDir = await mkdtemp(join(tmpdir(), "claude-sdk-"));
+    process.env.RUNNER_TEMP = tempDir;
+
+    const promptPath = join(tempDir, "prompt.txt");
+    await writeFile(promptPath, "test prompt");
+
+    const initMessage = {
+      type: "system",
+      subtype: "init",
+      session_id: "session-123",
+      model: "claude-opus-5",
+    };
+
+    const resultMessage = {
+      type: "result",
+      subtype: "success",
+      is_error: false,
+      duration_ms: 434,
+      num_turns: 1,
+      total_cost_usd: 1.23,
+      permission_denials: [],
+      modelUsage: {
+        "claude-opus-5": {
+          inputTokens: 96209,
+          outputTokens: 55324,
+          cacheReadInputTokens: 1135701,
+          cacheCreationInputTokens: 149043,
+          webSearchRequests: 0,
+          costUSD: 1.23,
+          contextWindow: 200000,
+          maxOutputTokens: 64000,
+        },
+      },
+    };
+
+    mock.module("@anthropic-ai/claude-agent-sdk", () => ({
+      query: async function* () {
+        yield initMessage;
+        yield resultMessage;
+      },
+    }));
+
+    try {
+      const { runClaudeWithSdk } = await import("../src/run-claude-sdk");
+
+      await expect(
+        runClaudeWithSdk(promptPath, {
+          sdkOptions: {},
+          showFullOutput: false,
+          hasJsonSchema: false,
+        }),
+      ).resolves.toMatchObject({ conclusion: "success" });
+
+      const sanitizedResult = consoleLogSpy.mock.calls
+        .map(([message]) => message)
+        .find(
+          (message) =>
+            typeof message === "string" && message.includes('"type": "result"'),
+        );
+
+      expect(sanitizedResult).toBeDefined();
+      if (typeof sanitizedResult !== "string") {
+        throw new Error("Sanitized result output was not logged");
+      }
+      expect(JSON.parse(sanitizedResult)).toEqual({
+        type: "result",
+        subtype: "success",
+        is_error: false,
+        duration_ms: 434,
+        num_turns: 1,
+        total_cost_usd: 1.23,
+        permission_denials_count: 0,
+        modelUsage: {
+          "claude-opus-5": {
+            contextWindow: 200000,
+            maxOutputTokens: 64000,
+          },
+        },
+      });
+      expect(sanitizedResult).not.toContain("inputTokens");
+      expect(sanitizedResult).not.toContain("costUSD");
+    } finally {
+      consoleLogSpy.mockRestore();
+    }
+  });
+
   test("fails when result subtype is success but is_error is true", async () => {
     const consoleErrorSpy = spyOn(console, "error").mockImplementation(
       () => {},
@@ -128,4 +217,71 @@ describe("runClaudeWithSdk", () => {
       coreErrorSpy.mockRestore();
     }
   });
+
+  test("fails closed when a successful result exceeds maxTurns", async () => {
+    const consoleErrorSpy = spyOn(console, "error").mockImplementation(
+      () => {},
+    );
+    const consoleLogSpy = spyOn(console, "log").mockImplementation(() => {});
+    const coreErrorSpy = spyOn(
+      await import("@actions/core"),
+      "error",
+    ).mockImplementation(() => {});
+
+    tempDir = await mkdtemp(join(tmpdir(), "claude-sdk-"));
+    process.env.RUNNER_TEMP = tempDir;
+
+    const promptPath = join(tempDir, "prompt.txt");
+    await writeFile(promptPath, "test prompt");
+
+    const initMessage = {
+      type: "system",
+      subtype: "init",
+      session_id: "session-123",
+      model: "claude-opus-4-7",
+    };
+
+    const successResultMessage = {
+      type: "result",
+      subtype: "success",
+      is_error: false,
+      duration_ms: 960000,
+      num_turns: 73,
+      total_cost_usd: 0,
+      permission_denials: [],
+    };
+
+    mock.module("@anthropic-ai/claude-agent-sdk", () => ({
+      query: async function* () {
+        yield initMessage;
+        yield successResultMessage;
+      },
+    }));
+
+    try {
+      const { runClaudeWithSdk } = await import("../src/run-claude-sdk");
+
+      await expect(
+        runClaudeWithSdk(promptPath, {
+          sdkOptions: { maxTurns: 60 },
+          showFullOutput: false,
+          hasJsonSchema: false,
+        }),
+      ).rejects.toThrow(
+        "Claude reported a successful result after 73 turns, exceeding the configured maximum of 60",
+      );
+
+      const executionFile = join(tempDir, "claude-execution-output.json");
+      await expect(readFile(executionFile, "utf-8")).resolves.toBe(
+        JSON.stringify([initMessage, successResultMessage], null, 2),
+      );
+      expect(coreErrorSpy).toHaveBeenCalledWith(
+        "Claude reported a successful result after 73 turns, exceeding the configured maximum of 60",
+      );
+    } finally {
+      consoleErrorSpy.mockRestore();
+      consoleLogSpy.mockRestore();
+      coreErrorSpy.mockRestore();
+    }
+  });
 });

bun.lock

@@ -7,13 +7,13 @@
       "dependencies": {
         "@actions/core": "^1.10.1",
         "@actions/github": "^6.0.1",
-        "@anthropic-ai/claude-agent-sdk": "^0.3.222",
+        "@anthropic-ai/claude-agent-sdk": "^0.3.278",
         "@modelcontextprotocol/sdk": "^1.11.0",
         "@octokit/graphql": "^8.2.2",
         "@octokit/rest": "^21.1.1",
         "@octokit/webhooks-types": "^7.6.1",
         "node-fetch": "^3.3.2",
-        "shell-quote": "^1.8.3",
+        "shell-quote": "^1.8.4",
         "zod": "^3.24.4",
       },
       "devDependencies": {
@@ -37,23 +37,23 @@
 
     "@actions/io": ["@actions/io@1.1.3", "", {}, "sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q=="],
 
-    "@anthropic-ai/claude-agent-sdk": ["@anthropic-ai/claude-agent-sdk@0.3.222", "", { "optionalDependencies": { "@anthropic-ai/claude-agent-sdk-darwin-arm64": "0.3.222", "@anthropic-ai/claude-agent-sdk-darwin-x64": "0.3.222", "@anthropic-ai/claude-agent-sdk-linux-arm64": "0.3.222", "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "0.3.222", "@anthropic-ai/claude-agent-sdk-linux-x64": "0.3.222", "@anthropic-ai/claude-agent-sdk-linux-x64-musl": "0.3.222", "@anthropic-ai/claude-agent-sdk-win32-arm64": "0.3.222", "@anthropic-ai/claude-agent-sdk-win32-x64": "0.3.222" }, "peerDependencies": { "@anthropic-ai/sdk": ">=0.93.0", "@modelcontextprotocol/sdk": "^1.29.0", "zod": "^4.0.0" } }, "sha512-muAyjIzXJjIpSrj91vSmnU76/z7rNlV8+lSuq48h4eUPSYVBSgOasgkfQAMUrIZJCfI15XF9/EYoRrx/eKD7Og=="],
+    "@anthropic-ai/claude-agent-sdk": ["@anthropic-ai/claude-agent-sdk@0.3.278", "", { "optionalDependencies": { "@anthropic-ai/claude-agent-sdk-darwin-arm64": "0.3.278", "@anthropic-ai/claude-agent-sdk-darwin-x64": "0.3.278", "@anthropic-ai/claude-agent-sdk-linux-arm64": "0.3.278", "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": "0.3.278", "@anthropic-ai/claude-agent-sdk-linux-x64": "0.3.278", "@anthropic-ai/claude-agent-sdk-linux-x64-musl": "0.3.278", "@anthropic-ai/claude-agent-sdk-win32-arm64": "0.3.278", "@anthropic-ai/claude-agent-sdk-win32-x64": "0.3.278" }, "peerDependencies": { "@anthropic-ai/sdk": ">=0.93.0", "@modelcontextprotocol/sdk": "^1.29.0", "zod": "^4.0.0" } }, "sha512-hXfjyiGraqYul6gq7R7+WmktxJfy9S29Yrx1WK6jQpsYcipf1CYIoYSh22SpGOR3FGiEmeuzXg5U9ncOk19Fww=="],
 
-    "@anthropic-ai/claude-agent-sdk-darwin-arm64": ["@anthropic-ai/claude-agent-sdk-darwin-arm64@0.3.222", "", { "os": "darwin", "cpu": "arm64" }, "sha512-h3nCSwRbUsXDnRRYvMhzI1u1q5w6jClc9jTtOJBY6+mijjJEGk+Fa5Kuhw0Tb5ec+1iatiTyCIT46HrV0Skqcg=="],
+    "@anthropic-ai/claude-agent-sdk-darwin-arm64": ["@anthropic-ai/claude-agent-sdk-darwin-arm64@0.3.278", "", { "os": "darwin", "cpu": "arm64" }, "sha512-lwkbWfYucsgiFo6mWF3Dw7ImohlWXEkkh+4e93EpeVPCxwN4IJuLztFkl28qEwY17sZ9SYQw1mRksKauqKccqg=="],
 
-    "@anthropic-ai/claude-agent-sdk-darwin-x64": ["@anthropic-ai/claude-agent-sdk-darwin-x64@0.3.222", "", { "os": "darwin", "cpu": "x64" }, "sha512-kVzR6qBZv1ddbb+uJfDDEVdW6/cl1dtc2nAIa8prk4IcuyK1RwQE/BOO8dO6iRl5PnHuv9BFKS9AO1UErOkT5Q=="],
+    "@anthropic-ai/claude-agent-sdk-darwin-x64": ["@anthropic-ai/claude-agent-sdk-darwin-x64@0.3.278", "", { "os": "darwin", "cpu": "x64" }, "sha512-IYTWl9mVeXe1GnHPkpw04p+fZ23zgTBuxNXv06h7xgjSZ7zhudL05d6NpkY5T13m/zL5b+fyYkXxGciTXVhiUg=="],
 
-    "@anthropic-ai/claude-agent-sdk-linux-arm64": ["@anthropic-ai/claude-agent-sdk-linux-arm64@0.3.222", "", { "os": "linux", "cpu": "arm64" }, "sha512-wn4XYkaWbAXc8PoznZqjCqbqB/Qet8dNdpZuRtbNSA1yZR0vYg2u28C5zV0QqVTXGgQVBYFUZabouyoERL6PsA=="],
+    "@anthropic-ai/claude-agent-sdk-linux-arm64": ["@anthropic-ai/claude-agent-sdk-linux-arm64@0.3.278", "", { "os": "linux", "cpu": "arm64" }, "sha512-gt03vjRLsfnT3NyOaCVZFdM6V6p0NNGxhUr6e0Yfd9a28LlIeUtNB/kMtFJDibDtsjVi4Mp+Wj9R7dsXPLOFfw=="],
 
-    "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": ["@anthropic-ai/claude-agent-sdk-linux-arm64-musl@0.3.222", "", { "os": "linux", "cpu": "arm64" }, "sha512-sVvPAUzRq+Am3+wNrFJ7URaWORu8t5hOu4vJnMhOeey66ZFFfzNwP0uz/7sTWjg+cRse/wG/hek34lZ0Gdu2+w=="],
+    "@anthropic-ai/claude-agent-sdk-linux-arm64-musl": ["@anthropic-ai/claude-agent-sdk-linux-arm64-musl@0.3.278", "", { "os": "linux", "cpu": "arm64" }, "sha512-xbNx5TXiAr9REDh7znPnkvR8GoBe8A653hYXaVq+fNNLjXidOIvOhICMyUUrBC+wgZV1FenC46oSPIMH4n+EOQ=="],
 
-    "@anthropic-ai/claude-agent-sdk-linux-x64": ["@anthropic-ai/claude-agent-sdk-linux-x64@0.3.222", "", { "os": "linux", "cpu": "x64" }, "sha512-deZh3tVoYy9ememF5oirZNx1une7IG79JbKrB3Cynggt2gnq3TFXvPfkVGWgNsocK035wAW9HhGZui832OFSqA=="],
+    "@anthropic-ai/claude-agent-sdk-linux-x64": ["@anthropic-ai/claude-agent-sdk-linux-x64@0.3.278", "", { "os": "linux", "cpu": "x64" }, "sha512-xbW4MkKyPMKdWzdA499WnAP9H7p8YlMsQCVEVyz6CemePZPSLwBP9GBeUTnSS57+MievEqj8knckJPVv5I3+yw=="],
 
-    "@anthropic-ai/claude-agent-sdk-linux-x64-musl": ["@anthropic-ai/claude-agent-sdk-linux-x64-musl@0.3.222", "", { "os": "linux", "cpu": "x64" }, "sha512-vM48p8GRM5N57+jPFdPj1ZS8Y770frJ1NTRecA06/GXtRANn7dOUVpvJbpu6fJBFF3BCacM1uVcBCMZh6wEMjw=="],
+    "@anthropic-ai/claude-agent-sdk-linux-x64-musl": ["@anthropic-ai/claude-agent-sdk-linux-x64-musl@0.3.278", "", { "os": "linux", "cpu": "x64" }, "sha512-OJ103bvIglKrp7LLS3Bpiy9ISnFIvUikcg5kJVqovA+uU/ElP96v3kCUli7nUL75TnguSL0PwdAb/rYujycLqQ=="],
 
-    "@anthropic-ai/claude-agent-sdk-win32-arm64": ["@anthropic-ai/claude-agent-sdk-win32-arm64@0.3.222", "", { "os": "win32", "cpu": "arm64" }, "sha512-VuJjTLP2jQ1j8yn44/YODFR8GhI60Tvzok6AaXUYpKgeZTbBndDOpqwxvdWAraJSSyDreSSMztYyI6lP6nVypg=="],
+    "@anthropic-ai/claude-agent-sdk-win32-arm64": ["@anthropic-ai/claude-agent-sdk-win32-arm64@0.3.278", "", { "os": "win32", "cpu": "arm64" }, "sha512-r75c3+Ymw4bn+If8LCoYLaYu5xXH8tWtP1xsd6KNtwda0KjFJA6/wmgicwCi3W+Vcdw6AfoFtYCQ0Sl1YwePwg=="],
 
-    "@anthropic-ai/claude-agent-sdk-win32-x64": ["@anthropic-ai/claude-agent-sdk-win32-x64@0.3.222", "", { "os": "win32", "cpu": "x64" }, "sha512-mr4eZ+bmZA0hPl2wN031qy3TJXZJZIpdE4khvCc0AJ7ljVpJUEG654wz9NJoPxfPo4cRg41niHqUU5rN9BfQVw=="],
+    "@anthropic-ai/claude-agent-sdk-win32-x64": ["@anthropic-ai/claude-agent-sdk-win32-x64@0.3.278", "", { "os": "win32", "cpu": "x64" }, "sha512-+7nMK4AYzeNFdqxYP80v2ialF6t29Z46rXeV6NF77xXc1+kqCm6hwOMFXhJkP8EEEclFatyjdU/Dij5vM5YSNA=="],
 
     "@anthropic-ai/sdk": ["@anthropic-ai/sdk@0.93.0", "", { "dependencies": { "json-schema-to-ts": "^3.1.1" }, "peerDependencies": { "zod": "^3.25.0 || ^4.0.0" }, "optionalPeers": ["zod"], "bin": { "anthropic-ai-sdk": "bin/cli" } }, "sha512-q9vaSZQVFx6B/gPxetGYfLXSJD5v0sOmh0OpZDq7yCrTSA+Rscvrtyol7JJTW40wEpQB4U1B4JXzxQitbQ3CAA=="],
 
@@ -275,7 +275,7 @@
 
     "shebang-regex": ["shebang-regex@3.0.0", "", {}, "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A=="],
 
-    "shell-quote": ["shell-quote@1.8.3", "", {}, "sha512-ObmnIF4hXNg1BqhnHmgbDETF8dLPCggZWBjkQfhZpbszZnYur5DUljTcCHii5LC3J5E0yeO/1LIMyH+UvHQgyw=="],
+    "shell-quote": ["shell-quote@1.8.4", "", {}, "sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ=="],
 
     "side-channel": ["side-channel@1.1.0", "", { "dependencies": { "es-errors": "^1.3.0", "object-inspect": "^1.13.3", "side-channel-list": "^1.0.0", "side-channel-map": "^1.0.1", "side-channel-weakmap": "^1.0.2" } }, "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw=="],
 

docs/cloud-providers.md

@@ -7,7 +7,7 @@ You can authenticate with Claude using any of these four methods:
 3. Google Vertex AI with OIDC authentication
 4. Microsoft Foundry with OIDC authentication
 
-For detailed setup instructions for AWS Bedrock and Google Vertex AI, see the [official documentation](https://code.claude.com/docs/en/github-actions#for-aws-bedrock:).
+For detailed setup instructions for AWS Bedrock and Google Vertex AI, see the [official documentation](https://code.claude.com/docs/en/github-actions#using-with-amazon-bedrock-and-google-cloud).
 
 **Note**:
 

docs/configuration.md

@@ -275,6 +275,29 @@ For provider-specific models:
     # ... other inputs
 ```
 
+### 1M context models through an API gateway
+
+When `ANTHROPIC_BASE_URL` points to an Anthropic-compatible API gateway,
+Claude Code may not be able to verify that the gateway supports a model's native
+1M context window and can budget the session at 200K instead. Append the
+`[1m]` selector to explicitly use the 1M context window for supported models,
+including Claude Opus 5 and Claude Sonnet 5:
+
+```yaml
+- uses: anthropics/claude-code-action@v1
+  with:
+    claude_args: |
+      --model "claude-opus-5[1m]"
+    # ... other inputs
+```
+
+Use the same selector when setting a model through `ANTHROPIC_MODEL` or another
+Claude Code model environment variable. The selector is resolved by Claude Code
+before requests are sent to the provider. The action's sanitized result output
+includes each model's resolved
+`contextWindow` and `maxOutputTokens` under `modelUsage`, so these limits are
+visible without enabling `show_full_output`.
+
 ## Claude Code Settings
 
 You can provide Claude Code settings to customize behavior such as model selection, environment variables, permissions, and hooks. Settings can be provided either as a JSON string or a path to a settings file.

docs/security.md

@@ -51,6 +51,14 @@ For `workflow_run` events, the action checks the repository access of the actor
 
 This is general guidance for these event types — see [GitHub's documentation](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/).
 
+### Which files come from the base branch on pull requests
+
+When the action runs against a pull request, it restores a fixed list of Claude configuration paths from the PR base branch before starting Claude: `.claude/`, `.mcp.json`, `.claude.json`, `.gitmodules`, `.ripgreprc`, `CLAUDE.md`, `CLAUDE.local.md`, and `.husky/`. Paths in that list that do not exist on the base branch are removed, and the PR-authored versions are kept under `.claude-pr/` for reference only.
+
+Everything else in the working tree — including `package.json`, lockfiles, `Makefile`, `node_modules/`, and formatter/linter config files — stays at the PR head. If a hook, `apiKeyHelper`, or `statusLine` command in your base-branch `.claude/settings.json` runs a package-manager script (`bun run …`, `npm run …`, `yarn …`, `pnpm run …`), a `make` target, a repo-relative script, or a tool that loads executable project config, that command resolves through files the pull request supplies. Keep such commands self-contained: invoke the tool directly with a pinned version and pass its configuration on the command line (for example `bunx prettier@3.5.3 --no-config --write .` rather than `bun run format`).
+
+Note that the runtime executing the tool also reads project config. `bunx <tool>` runs the tool's script under `node` when `node` is on `PATH` (as it is on GitHub-hosted runners); when only Bun is available, Bun executes the script itself and reads `bunfig.toml` from the checkout — including `preload` entries — which comes from the PR head. On such runners, make sure `node` is on `PATH` for the hook, and treat `bunfig.toml` and `.npmrc` in the checkout as PR-controlled runtime config.
+
 ### `claude-code-action` vs `claude-code-base-action`
 
 `claude-code-base-action` is a lower-level building block that installs and runs Claude Code with the inputs you provide. It does not perform actor permission checks or restore project configuration from the base ref. If you need those behaviors, use this action (`claude-code-action`). See the [base-action README](../base-action/README.md#trust-model) for details.

package.json

@@ -12,13 +12,13 @@
   "dependencies": {
     "@actions/core": "^1.10.1",
     "@actions/github": "^6.0.1",
-    "@anthropic-ai/claude-agent-sdk": "^0.3.222",
+    "@anthropic-ai/claude-agent-sdk": "^0.3.278",
     "@modelcontextprotocol/sdk": "^1.11.0",
     "@octokit/graphql": "^8.2.2",
     "@octokit/rest": "^21.1.1",
     "@octokit/webhooks-types": "^7.6.1",
     "node-fetch": "^3.3.2",
-    "shell-quote": "^1.8.3",
+    "shell-quote": "^1.8.4",
     "zod": "^3.24.4"
   },
   "devDependencies": {

src/create-prompt/index.ts

@@ -824,7 +824,7 @@ ${
     ? `- Use mcp__github_file_ops__commit_files for making commits (works for both new and existing files, single or multiple). Use mcp__github_file_ops__delete_files for deleting files (supports deleting single or multiple files atomically), or mcp__github__delete_file for deleting a single file. Edit files locally, and the tool will read the content from the same path on disk.
   Tool usage examples:
   - mcp__github_file_ops__commit_files: {"files": ["path/to/file1.js", "path/to/file2.py"], "message": "feat: add new feature"}
-  - mcp__github_file_ops__delete_files: {"files": ["path/to/old.js"], "message": "chore: remove deprecated file"}`
+  - mcp__github_file_ops__delete_files: {"paths": ["path/to/old.js"], "message": "chore: remove deprecated file"}`
     : `- Use git commands via the Bash tool for version control (remember that you have access to these git commands):
   - Stage files: Bash(git add <files>)
   - Commit changes: Bash(git commit -m "<message>")
@@ -856,7 +856,7 @@ What You CANNOT Do:
 - Submit formal GitHub PR reviews
 - Approve pull requests (for security reasons)
 - Post multiple comments (you only update your initial comment)
-- Execute commands outside the repository context${useCommitSigning ? "\n- Run arbitrary Bash commands (unless explicitly allowed via allowed_tools configuration)" : ""}
+- Execute commands outside the repository context${useCommitSigning ? "\n- Run arbitrary Bash commands (unless explicitly allowed via claude_args with --allowedTools)" : ""}
 - Perform branch operations (cannot merge branches, rebase, or perform other git operations beyond creating and pushing commits)
 - Modify files in the .github/workflows directory (GitHub App permissions do not allow workflow modifications)
 

src/entrypoints/format-turns.ts

@@ -2,6 +2,7 @@
 
 import { readFileSync, existsSync } from "fs";
 import { exit } from "process";
+import { redactSecrets } from "../github/utils/sanitizer";
 
 export type ToolUse = {
   type: string;
@@ -163,8 +164,15 @@ export function formatResultContent(content: any): string {
       typeof parsedContent[0] === "object" &&
       parsedContent[0]?.type === "text"
     ) {
-      // Extract the text field from the first item
-      contentStr = parsedContent[0]?.text || "";
+      // Keep every text block, not just the first: a tool result may split its
+      // output across several, and dropping the rest silently loses findings,
+      // file paths and follow-up instructions from the rendered summary. Blocks
+      // of other types (for example images) are skipped. Tool output is
+      // arbitrary, so `text` is not guaranteed to be a string.
+      contentStr = parsedContent
+        .filter((block: any) => block?.type === "text")
+        .map((block: any) => String(block?.text || ""))
+        .join("\n");
     } else {
       contentStr = String(content).trim();
     }
@@ -172,6 +180,10 @@ export function formatResultContent(content: any): string {
     contentStr = String(content).trim();
   }
 
+  // Redact before truncating so a credential cannot be split at the cut and
+  // slip past the final redaction pass.
+  contentStr = redactSecrets(contentStr);
+
   // Truncate very long results
   if (contentStr.length > 3000) {
     contentStr = contentStr.substring(0, 2997) + "...";
@@ -420,7 +432,9 @@ export function formatTurnsFromData(data: Turn[]): string {
   // Generate markdown
   const markdown = formatGroupedContent(groupedContent);
 
-  return markdown;
+  // Runtime output may contain credentials that are not registered as
+  // workflow secrets, so redact known formats before this gets published.
+  return redactSecrets(markdown);
 }
 
 function main(): void {
@@ -447,14 +461,8 @@ function main(): void {
     const fileContent = readFileSync(jsonFile, "utf-8");
     const data: Turn[] = JSON.parse(fileContent);
 
-    // Group turns naturally
-    const groupedContent = groupTurnsNaturally(data);
-
-    // Generate markdown
-    const markdown = formatGroupedContent(groupedContent);
-
     // Print to stdout (so it can be captured by shell)
-    console.log(markdown);
+    console.log(formatTurnsFromData(data));
   } catch (error) {
     console.error(`Error processing file: ${error}`);
     exit(1);

src/entrypoints/post-buffered-inline-comments.ts

@@ -11,6 +11,7 @@
  */
 import { readFileSync } from "fs";
 import { createOctokit } from "../github/api/client";
+import { redactSecrets } from "../github/utils/sanitizer";
 
 const BUFFER_PATH = "/tmp/inline-comments-buffer.jsonl";
 
@@ -120,7 +121,7 @@ async function postComment(
     owner,
     repo,
     pull_number,
-    body: c.body,
+    body: redactSecrets(c.body),
     path: c.path,
     side: c.side || "RIGHT",
     commit_id: c.commit_id || headSha,

src/entrypoints/run.ts

@@ -34,6 +34,7 @@ import { collectActionInputsPresence } from "./collect-inputs";
 import { updateCommentLink } from "./update-comment-link";
 import { formatTurnsFromData } from "./format-turns";
 import type { Turn } from "./format-turns";
+import { redactSecrets } from "../github/utils/sanitizer";
 // Base-action imports (used directly instead of subprocess)
 import { setupWorkloadIdentity } from "../../base-action/src/workload-identity";
 import type { WorkloadIdentityHandle } from "../../base-action/src/workload-identity";
@@ -76,7 +77,7 @@ async function installClaudeCode(): Promise<string> {
     return customExecutable;
   }
 
-  const claudeCodeVersion = "2.1.222";
+  const claudeCodeVersion = "2.1.278";
   console.log(`Installing Claude Code v${claudeCodeVersion}...`);
 
   for (let attempt = 1; attempt <= 3; attempt++) {
@@ -137,7 +138,7 @@ async function writeStepSummary(executionFile: string): Promise<void> {
       fallback +=
         "Failed to format output (please report). Here's the raw JSON:\n\n";
       fallback += "```json\n";
-      fallback += readFileSync(executionFile, "utf-8");
+      fallback += redactSecrets(readFileSync(executionFile, "utf-8"));
       fallback += "\n```\n";
       await appendFile(summaryFile, fallback);
     } catch {
@@ -158,6 +159,9 @@ async function run() {
   let context: GitHubContext | undefined;
   let octokit: Octokits | undefined;
   let workloadIdentity: WorkloadIdentityHandle | undefined;
+  // Paths reverted to the PR base branch, which cleanup must not commit back
+  // onto the PR author's branch. Empty unless restoreConfigFromBase ran.
+  let restoredConfigPaths: string[] = [];
   // Track whether we've completed prepare phase, so we can attribute errors correctly
   let prepareCompleted = false;
   try {
@@ -267,7 +271,7 @@ async function run() {
         validateBranchName(restoreBase);
       }
       if (restoreBase) {
-        restoreConfigFromBase(restoreBase);
+        restoredConfigPaths = restoreConfigFromBase(restoreBase);
       }
     }
 
@@ -317,7 +321,7 @@ async function run() {
       prepareSuccess = false;
       prepareError = errorMessage;
     }
-    core.setFailed(`Action failed with error: ${errorMessage}`);
+    core.setFailed(`Action failed with error: ${redactSecrets(errorMessage)}`);
   } finally {
     // Phase 4: Cleanup (always runs)
 
@@ -347,6 +351,7 @@ async function run() {
           prepareSuccess,
           prepareError,
           useCommitSigning: context.inputs.useCommitSigning,
+          restoredConfigPaths,
         });
       } catch (error) {
         console.error("Error updating comment with job link:", error);

src/entrypoints/update-comment-link.ts

@@ -16,6 +16,7 @@ import type { ParsedGitHubContext } from "../github/context";
 import { GITHUB_SERVER_URL } from "../github/api/config";
 import { checkAndCommitOrDeleteBranch } from "../github/operations/branch-cleanup";
 import { updateClaudeComment } from "../github/operations/comments/update-claude-comment";
+import { encodeBranchNameForUrl } from "../github/operations/comments/common";
 
 export type UpdateCommentLinkParams = {
   commentId: number;
@@ -30,6 +31,12 @@ export type UpdateCommentLinkParams = {
   prepareSuccess: boolean;
   prepareError?: string;
   useCommitSigning: boolean;
+  /**
+   * Paths restored from the PR base branch by restoreConfigFromBase. The
+   * auto-commit in checkAndCommitOrDeleteBranch must leave these alone, or it
+   * commits the revert onto the PR author's branch.
+   */
+  restoredConfigPaths?: string[];
 };
 
 export async function updateCommentLink(
@@ -43,6 +50,7 @@ export async function updateCommentLink(
     context,
     octokit,
     useCommitSigning,
+    restoredConfigPaths = [],
   } = params;
 
   const { owner, repo } = context.repository;
@@ -116,6 +124,7 @@ export async function updateCommentLink(
     claudeBranch,
     baseBranch,
     useCommitSigning,
+    restoredConfigPaths,
   );
 
   // Check if we need to add PR URL when we have a new branch
@@ -151,7 +160,7 @@ export async function updateCommentLink(
           const prBody = encodeURIComponent(
             `This PR addresses ${entityType.toLowerCase()} #${context.entityNumber}\n\nGenerated with [Claude Code](https://claude.ai/code)`,
           );
-          const prUrl = `${serverUrl}/${owner}/${repo}/compare/${baseBranch}...${claudeBranch}?quick_pull=1&title=${prTitle}&body=${prBody}`;
+          const prUrl = `${serverUrl}/${owner}/${repo}/compare/${encodeBranchNameForUrl(baseBranch)}...${encodeBranchNameForUrl(claudeBranch)}?quick_pull=1&title=${prTitle}&body=${prBody}`;
           prLink = `\n[Create a PR](${prUrl})`;
         }
       } catch (error) {

src/github/api/client.ts

@@ -1,6 +1,6 @@
 import { Octokit } from "@octokit/rest";
 import { graphql } from "@octokit/graphql";
-import { GITHUB_API_URL } from "./config";
+import { GITHUB_API_URL, GITHUB_GRAPHQL_URL } from "./config";
 
 export type Octokits = {
   rest: Octokit;
@@ -14,7 +14,7 @@ export function createOctokit(token: string): Octokits {
       baseUrl: GITHUB_API_URL,
     }),
     graphql: graphql.defaults({
-      baseUrl: GITHUB_API_URL,
+      baseUrl: GITHUB_GRAPHQL_URL,
       headers: {
         authorization: `token ${token}`,
       },

src/github/api/config.ts

@@ -2,3 +2,16 @@ export const GITHUB_API_URL =
   process.env.GITHUB_API_URL || "https://api.github.com";
 export const GITHUB_SERVER_URL =
   process.env.GITHUB_SERVER_URL || "https://github.com";
+
+// GraphQL base URL for @octokit/graphql. GitHub Actions exposes the full GraphQL
+// endpoint in GITHUB_GRAPHQL_URL (e.g. "https://HOST/api/graphql"), while
+// @octokit/graphql appends "/graphql" to whatever baseUrl it is given, so a
+// single trailing "/graphql" is stripped here to avoid "/graphql/graphql".
+// When GITHUB_GRAPHQL_URL is unset we fall back to GITHUB_API_URL, preserving the
+// existing behavior where @octokit/graphql rewrites a REST ".../api/v3" base to
+// ".../api/graphql". The trailing-slash trim keeps that rewrite working.
+export const GITHUB_GRAPHQL_URL = (
+  process.env.GITHUB_GRAPHQL_URL || GITHUB_API_URL
+)
+  .replace(/\/+$/, "")
+  .replace(/\/graphql$/, "");

src/github/api/queries/github.ts

@@ -7,6 +7,7 @@ export const PR_QUERY = `
         title
         body
         author {
+          __typename
           login
         }
         baseRefName
@@ -57,6 +58,7 @@ export const PR_QUERY = `
             databaseId
             body
             author {
+              __typename
               login
             }
             createdAt
@@ -70,6 +72,7 @@ export const PR_QUERY = `
             id
             databaseId
             author {
+              __typename
               login
             }
             body
@@ -84,7 +87,9 @@ export const PR_QUERY = `
                 body
                 path
                 line
+                diffHunk
                 author {
+                  __typename
                   login
                 }
                 createdAt
@@ -107,6 +112,7 @@ export const ISSUE_QUERY = `
         title
         body
         author {
+          __typename
           login
         }
         createdAt
@@ -124,6 +130,7 @@ export const ISSUE_QUERY = `
             databaseId
             body
             author {
+              __typename
               login
             }
             createdAt

src/github/data/fetcher.ts

@@ -23,6 +23,7 @@ import type { CommentWithImages } from "../utils/image-downloader";
 import { downloadCommentImages } from "../utils/image-downloader";
 import {
   parseActorFilter,
+  resolveActorName,
   shouldIncludeCommentByActor,
 } from "../utils/actor-filter";
 
@@ -339,7 +340,7 @@ export function isBodySafeToUse(
  * @returns Filtered array of comments
  */
 export function filterCommentsByActor<
-  T extends { author: { login: string } | null },
+  T extends { author: { login: string; __typename?: string } | null },
 >(comments: T[], includeActors: string = "", excludeActors: string = ""): T[] {
   const includeParsed = parseActorFilter(includeActors);
   const excludeParsed = parseActorFilter(excludeActors);
@@ -351,9 +352,10 @@ export function filterCommentsByActor<
 
   return comments.filter((comment) =>
     shouldIncludeCommentByActor(
-      // author is null for comments from deleted ("ghost") accounts; treat them
-      // as the "ghost" login so filtering never dereferences null and crashes.
-      comment.author?.login ?? "ghost",
+      // Normalizes App actors to their "[bot]"-suffixed name, which is the form
+      // filter patterns are written in. Also maps deleted ("ghost") accounts,
+      // whose author is null, to "ghost" so filtering never dereferences null.
+      resolveActorName(comment.author),
       includeParsed,
       excludeParsed,
     ),
@@ -424,7 +426,12 @@ export async function fetchGitHubData({
       if (prResult.repository.pullRequest) {
         const pullRequest = prResult.repository.pullRequest;
         contextData = pullRequest;
-        changedFiles = pullRequest.files.nodes || [];
+        if (pullRequest.files === null) {
+          console.warn(
+            `GitHub did not return the file list for PR #${prNumber} (diff likely too large); proceeding without file-level context`,
+          );
+        }
+        changedFiles = pullRequest.files?.nodes ?? [];
         comments = filterCommentsByActor(
           filterCommentsToTriggerTime(
             pullRequest.comments?.nodes || [],

src/github/data/formatter.ts

@@ -28,7 +28,7 @@ PR Labels: ${formatLabels(prData.labels.nodes)}
 PR Additions: ${prData.additions}
 PR Deletions: ${prData.deletions}
 Total Commits: ${prData.commits.totalCount}
-Changed Files: ${prData.files.nodes.length} files`;
+Changed Files: ${prData.files ? `${prData.files.nodes.length} files` : "unknown (file list unavailable)"}`;
   } else {
     const issueData = contextData as GitHubIssue;
     const sanitizedTitle = sanitizeContent(issueData.title);
@@ -118,7 +118,16 @@ export function formatReviewComments(
 
           body = sanitizeContent(body);
 
-          return `  [Comment on ${comment.path}:${comment.line || "?"}]: ${body}`;
+          let formatted = `  [Comment on ${comment.path}:${comment.line || "?"}]: ${body}`;
+
+          // The diff hunk is the code the comment was left on. Without it the
+          // comment arrives without the context it was written against.
+          if (comment.diffHunk) {
+            const diffHunk = sanitizeContent(comment.diffHunk);
+            formatted += `\n  Diff context:\n\`\`\`diff\n${diffHunk}\n\`\`\``;
+          }
+
+          return formatted;
         })
         .join("\n");
       if (comments) {

src/github/operations/branch-cleanup.ts

@@ -1,5 +1,6 @@
 import type { Octokits } from "../api/client";
 import { GITHUB_SERVER_URL } from "../api/config";
+import { encodeBranchNameForUrl } from "./comments/common";
 import { $ } from "bun";
 
 export async function checkAndCommitOrDeleteBranch(
@@ -9,10 +10,32 @@ export async function checkAndCommitOrDeleteBranch(
   claudeBranch: string | undefined,
   baseBranch: string,
   useCommitSigning: boolean,
+  restoredConfigPaths: string[] = [],
 ): Promise<{ shouldDeleteBranch: boolean; branchLink: string }> {
   let branchLink = "";
   let shouldDeleteBranch = false;
 
+  // On pull requests, restoreConfigFromBase replaces .claude/, CLAUDE.md and
+  // friends with the base branch's versions and leaves them unstaged so the
+  // revert does not reach a commit. Auto-committing with a bare `git add -A`
+  // would stage them anyway and push a silent revert of the PR author's own
+  // config onto their branch.
+  //
+  // The exclusion is driven by what was actually restored rather than applied
+  // unconditionally: this path also runs for issues, where no restore happens
+  // and Claude may legitimately have been asked to edit CLAUDE.md or
+  // .claude/settings.json. Excluding those there would silently drop the work.
+  const pathspecArgs =
+    restoredConfigPaths.length > 0
+      ? ["--", ".", ...restoredConfigPaths.map((p) => `:(exclude)${p}`)]
+      : [];
+
+  if (pathspecArgs.length > 0) {
+    console.log(
+      `Excluding base-restored config from auto-commit: ${restoredConfigPaths.join(", ")}`,
+    );
+  }
+
   if (claudeBranch) {
     // First check if the branch exists remotely
     let branchExistsRemotely = false;
@@ -57,15 +80,19 @@ export async function checkAndCommitOrDeleteBranch(
 
           // Check for uncommitted changes using git status
           try {
-            const gitStatus = await $`git status --porcelain`.quiet();
+            // Scoped the same way as the staging below: if the restored config
+            // is the only dirty entry there is no real work, and the branch
+            // should be treated as empty rather than receiving a pure revert.
+            const gitStatus =
+              await $`git status --porcelain ${pathspecArgs}`.quiet();
             const hasUncommittedChanges =
               gitStatus.stdout.toString().trim().length > 0;
 
             if (hasUncommittedChanges) {
               console.log("Found uncommitted changes, committing them...");
 
-              // Add all changes
-              await $`git add -A`;
+              // Add all changes, minus anything restored from the base branch
+              await $`git add -A ${pathspecArgs}`;
 
               // Commit with a descriptive message
               const runId = process.env.GITHUB_RUN_ID || "unknown";
@@ -80,7 +107,7 @@ export async function checkAndCommitOrDeleteBranch(
               );
 
               // Set branch link since we now have commits
-              const branchUrl = `${GITHUB_SERVER_URL}/${owner}/${repo}/tree/${claudeBranch}`;
+              const branchUrl = `${GITHUB_SERVER_URL}/${owner}/${repo}/tree/${encodeBranchNameForUrl(claudeBranch)}`;
               branchLink = `\n[View branch](${branchUrl})`;
             } else {
               console.log(
@@ -91,7 +118,7 @@ export async function checkAndCommitOrDeleteBranch(
           } catch (gitError) {
             console.error("Error checking/committing changes:", gitError);
             // If we can't check git status, assume the branch might have changes
-            const branchUrl = `${GITHUB_SERVER_URL}/${owner}/${repo}/tree/${claudeBranch}`;
+            const branchUrl = `${GITHUB_SERVER_URL}/${owner}/${repo}/tree/${encodeBranchNameForUrl(claudeBranch)}`;
             branchLink = `\n[View branch](${branchUrl})`;
           }
         } else {
@@ -102,13 +129,13 @@ export async function checkAndCommitOrDeleteBranch(
         }
       } else {
         // Only add branch link if there are commits
-        const branchUrl = `${GITHUB_SERVER_URL}/${owner}/${repo}/tree/${claudeBranch}`;
+        const branchUrl = `${GITHUB_SERVER_URL}/${owner}/${repo}/tree/${encodeBranchNameForUrl(claudeBranch)}`;
         branchLink = `\n[View branch](${branchUrl})`;
       }
     } catch (error) {
       console.error("Error comparing commits on Claude branch:", error);
       // If we can't compare but the branch exists remotely, include the branch link
-      const branchUrl = `${GITHUB_SERVER_URL}/${owner}/${repo}/tree/${claudeBranch}`;
+      const branchUrl = `${GITHUB_SERVER_URL}/${owner}/${repo}/tree/${encodeBranchNameForUrl(claudeBranch)}`;
       branchLink = `\n[View branch](${branchUrl})`;
     }
   }

src/github/operations/branch.ts

@@ -13,6 +13,7 @@ import type { GitHubPullRequest } from "../types";
 import type { Octokits } from "../api/client";
 import type { FetchDataResult } from "../data/fetcher";
 import { generateBranchName } from "../../utils/branch-template";
+import { fetchDepthArgs } from "./fetch-depth";
 
 /**
  * Extracts the first label from GitHub data, or returns undefined if no labels exist
@@ -28,7 +29,7 @@ function extractFirstLabel(githubData: FetchDataResult): string | undefined {
  *
  * Valid branch names:
  * - Start with alphanumeric character, underscore, or @ (not dash, to prevent option injection)
- * - Contain only alphanumeric, forward slash, hyphen, underscore, period, hash (#), plus (+), comma (,), or at sign (@)
+ * - Contain only alphanumeric, forward slash, hyphen, underscore, period, hash (#), plus (+), comma (,), at sign (@), or parentheses
  * - Do not start or end with a period
  * - Do not end with a slash
  * - Do not contain '..' (path traversal)
@@ -59,7 +60,7 @@ export function validateBranchName(branchName: string): void {
     );
   }
 
-  // Strict whitelist pattern: alphanumeric or @ start, then alphanumeric/slash/hyphen/underscore/period/hash/plus/comma/at-sign.
+  // Strict whitelist pattern: alphanumeric or @ start, then alphanumeric/slash/hyphen/underscore/period/hash/plus/comma/at-sign/parentheses.
   // # is valid per git-check-ref-format and commonly used in branch names like "fix/#123-description".
   // + is valid per git-check-ref-format and generated by Claude Code's EnterWorktree tool when
   //   converting worktree names containing "/" (e.g. "feat/foo" becomes "worktree-feat+foo").
@@ -71,12 +72,14 @@ export function validateBranchName(branchName: string): void {
   // _ is valid per git-check-ref-format anywhere in a ref name, including the first character;
   //   leading underscores are a common convention for release/internal branches (e.g.
   //   "_release/v1.2.3"), which previously failed validation as a PR's base branch.
+  // Parentheses are valid per git-check-ref-format and commonly appear in branch names that
+  //   use Conventional Commit-style scopes (e.g. "feat(parser)-handle-empty-input").
   // All git calls use execFileSync (not shell interpolation), so none of these characters carry injection risk.
-  const validPattern = /^[a-zA-Z0-9@_][a-zA-Z0-9/_.#+,@-]*$/;
+  const validPattern = /^[a-zA-Z0-9@_][a-zA-Z0-9/_.#+,@()-]*$/;
 
   if (!validPattern.test(branchName)) {
     throw new Error(
-      `Invalid branch name: "${branchName}". Branch names must start with an alphanumeric character, underscore, or '@' and contain only alphanumeric characters, forward slashes, hyphens, underscores, periods, hashes (#), plus signs (+), commas (,), or at signs (@).`,
+      `Invalid branch name: "${branchName}". Branch names must start with an alphanumeric character, underscore, or '@' and contain only alphanumeric characters, forward slashes, hyphens, underscores, periods, hashes (#), plus signs (+), commas (,), at signs (@), or parentheses.`,
     );
   }
 
@@ -175,12 +178,19 @@ export async function setupBranch(
 
       const branchName = prData.headRefName;
 
-      // Determine optimal fetch depth based on PR commit count, with a minimum of 20
+      // Determine optimal fetch depth based on PR commit count, with a minimum
+      // of 20. Only applied to a checkout that is already shallow — see
+      // fetchDepthArgs.
       const commitCount = prData.commits.totalCount;
       const fetchDepth = Math.max(commitCount, 20);
+      const depthArgs = fetchDepthArgs(fetchDepth);
 
       console.log(
-        `PR #${entityNumber}: ${commitCount} commits, using fetch depth ${fetchDepth}`,
+        `PR #${entityNumber}: ${commitCount} commits, ${
+          depthArgs.length > 0
+            ? `using fetch depth ${fetchDepth}`
+            : "fetching without a depth limit (checkout has full history)"
+        }`,
       );
 
       // Validate branch names before use to prevent command injection
@@ -195,13 +205,13 @@ export async function setupBranch(
         execGit([
           "fetch",
           "origin",
-          `--depth=${fetchDepth}`,
+          ...depthArgs,
           `pull/${entityNumber}/head:${branchName}`,
         ]);
       } else {
         // Execute git commands to checkout PR branch (dynamic depth based on PR size)
         // Using execFileSync instead of shell template literals for security
-        execGit(["fetch", "origin", `--depth=${fetchDepth}`, branchName]);
+        execGit(["fetch", "origin", ...depthArgs, branchName]);
       }
       execGit(["checkout", branchName, "--"]);
 
@@ -288,6 +298,11 @@ export async function setupBranch(
       // Branch doesn't exist (non-zero exit code), continue with generated name
     }
 
+    // Validate before either path uses the name. The signing path hands it to
+    // the file ops server rather than to git, so without this an invalid
+    // template only surfaces as a 422 on the first commit.
+    validateBranchName(newBranch);
+
     // For commit signing, defer branch creation to the file ops server
     if (context.inputs.useCommitSigning) {
       console.log(
@@ -297,7 +312,7 @@ export async function setupBranch(
       // Ensure we're on the source branch
       console.log(`Fetching and checking out source branch: ${sourceBranch}`);
       validateBranchName(sourceBranch);
-      execGit(["fetch", "origin", sourceBranch, "--depth=1"]);
+      execGit(["fetch", "origin", sourceBranch, ...fetchDepthArgs(1)]);
       execGit(["checkout", sourceBranch, "--"]);
 
       return {
@@ -315,8 +330,7 @@ export async function setupBranch(
     // Fetch and checkout the source branch first to ensure we branch from the correct base
     console.log(`Fetching and checking out source branch: ${sourceBranch}`);
     validateBranchName(sourceBranch);
-    validateBranchName(newBranch);
-    execGit(["fetch", "origin", sourceBranch, "--depth=1"]);
+    execGit(["fetch", "origin", sourceBranch, ...fetchDepthArgs(1)]);
     execGit(["checkout", sourceBranch, "--"]);
 
     // Create and checkout the new branch from the source branch

src/github/operations/comment-logic.ts

@@ -1,4 +1,6 @@
 import { GITHUB_SERVER_URL } from "../api/config";
+import { redactSecrets } from "../utils/sanitizer";
+import { encodeBranchNameForUrl } from "./comments/common";
 
 export type ExecutionDetails = {
   total_cost_usd?: number;
@@ -160,7 +162,7 @@ export function updateCommentBody(input: CommentUpdateInput): string {
       // Extract owner/repo from jobUrl
       const repoMatch = jobUrl.match(/github\.com\/([^\/]+)\/([^\/]+)\//);
       if (repoMatch) {
-        branchUrl = `${GITHUB_SERVER_URL}/${repoMatch[1]}/${repoMatch[2]}/tree/${finalBranchName}`;
+        branchUrl = `${GITHUB_SERVER_URL}/${repoMatch[1]}/${repoMatch[2]}/tree/${encodeBranchNameForUrl(finalBranchName)}`;
       }
     }
 
@@ -181,9 +183,11 @@ export function updateCommentBody(input: CommentUpdateInput): string {
   // Build the new body with blank line between header and separator
   let newBody = `${header}${links}`;
 
-  // Add error details if available
+  // Add error details if available. The message may embed runtime credentials
+  // (e.g. a token in a git remote URL) that are not registered as workflow
+  // secrets, so redact known formats before posting.
   if (actionFailed && errorDetails) {
-    newBody += `\n\n\`\`\`\n${errorDetails}\n\`\`\``;
+    newBody += `\n\n\`\`\`\n${redactSecrets(errorDetails)}\n\`\`\``;
   }
 
   newBody += `\n\n---\n`;

src/github/operations/comments/common.ts

@@ -12,12 +12,17 @@ export function createJobRunLink(
   return `[View job run](${jobRunUrl})`;
 }
 
+/** Encode Git-ref path segments without turning `/` into `%2F`. */
+export function encodeBranchNameForUrl(branchName: string): string {
+  return branchName.split("/").map(encodeURIComponent).join("/");
+}
+
 export function createBranchLink(
   owner: string,
   repo: string,
   branchName: string,
 ): string {
-  const branchUrl = `${GITHUB_SERVER_URL}/${owner}/${repo}/tree/${branchName}`;
+  const branchUrl = `${GITHUB_SERVER_URL}/${owner}/${repo}/tree/${encodeBranchNameForUrl(branchName)}`;
   return `\n[View branch](${branchUrl})`;
 }
 

src/github/operations/fetch-depth.ts

@@ -0,0 +1,40 @@
+import { execFileSync } from "child_process";
+
+/**
+ * Builds the `--depth` argument for a `git fetch`, unless the checkout still
+ * has its full history.
+ *
+ * `--depth` does not only cap what gets downloaded. Against a complete checkout
+ * (`actions/checkout` with `fetch-depth: 0`) it also truncates the history that
+ * is already there and marks the repository shallow, which drops the merge base
+ * with the base branch: `git log origin/<base>..HEAD` then quietly lists
+ * commits that are already merged, and `git diff origin/<base>...HEAD` fails
+ * with "no merge base". Those are the commands the prompt tells Claude to run
+ * to scope its work to the PR.
+ *
+ * A shallow checkout (the `fetch-depth: 1` default) has no history left to
+ * lose, so the limit still applies there and large repositories keep the fetch
+ * savings it was added for.
+ */
+export function fetchDepthArgs(depth: number): string[] {
+  return isShallowRepository() ? [`--depth=${depth}`] : [];
+}
+
+function isShallowRepository(): boolean {
+  try {
+    const output = execFileSync(
+      "git",
+      ["rev-parse", "--is-shallow-repository"],
+      {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+      },
+    );
+    return output.trim() === "true";
+  } catch {
+    // No repository yet, or a git old enough not to know the flag. Treat the
+    // checkout as complete: fetching more than necessary is recoverable,
+    // truncating history is not.
+    return false;
+  }
+}

src/github/operations/git-config.ts

@@ -42,14 +42,68 @@ export async function configureGitAuth(
   await $`git config user.email "${botId}+${botName}@${noreplyDomain}"`;
   console.log(`✓ Set git user as ${botName}`);
 
+  await replaceCheckoutCredentials(githubToken, context);
+
+  console.log("Git authentication configured successfully");
+}
+
+/**
+ * Replace the credential that actions/checkout persisted in the working tree.
+ *
+ * actions/checkout stores its token as an `http.<server>/.extraheader` entry
+ * in .git/config for the duration of the job. Claude and the tools it invokes
+ * run inside this working tree, so remove that entry and back git with the
+ * action's own token instead (a credential helper when non-write users are
+ * allowed, otherwise the origin URL). This applies to every mode, including API
+ * commit signing where no other git configuration is needed.
+ *
+ * actions/checkout < v6 stored the header directly in the repo-local config,
+ * where `git config --unset-all` removes it. Since v6.0.0 (backported to
+ * v5.0.1 and v4.3.1) the header is written to a separate file under
+ * RUNNER_TEMP that the repo config pulls in via `include.path`; `--unset-all`
+ * on the local config cannot touch an include-provided value, so the removal
+ * was a silent no-op and the checkout credential (typically the workflow
+ * GITHUB_TOKEN) stayed usable by git for the rest of the job. Clear the
+ * header from the local config AND from every included file so it can no
+ * longer authenticate while Claude runs.
+ */
+export async function replaceCheckoutCredentials(
+  githubToken: string,
+  context: GitHubContext,
+) {
+  const serverUrl = new URL(GITHUB_SERVER_URL);
+
   // Remove the authorization header that actions/checkout sets
   console.log("Removing existing git authentication headers...");
+  const extraheaderKey = `http.${GITHUB_SERVER_URL}/.extraheader`;
+  let removedHeader = false;
   try {
-    await $`git config --unset-all http.${GITHUB_SERVER_URL}/.extraheader`;
-    console.log("✓ Removed existing authentication headers");
-  } catch (e) {
-    console.log("No existing authentication headers to remove");
+    await $`git config --unset-all ${extraheaderKey}`;
+    removedHeader = true;
+  } catch {
+    // No extraheader in the local config (expected on the v6+ include layout).
   }
+  try {
+    const includePaths =
+      await $`git config --local --get-all include.path`.text();
+    for (const includePath of includePaths.split("\n")) {
+      const path = includePath.trim();
+      if (!path) continue;
+      try {
+        await $`git config --file ${path} --unset-all ${extraheaderKey}`;
+        removedHeader = true;
+      } catch {
+        // This include does not define the header; leave it untouched.
+      }
+    }
+  } catch {
+    // No include.path entries in the local config.
+  }
+  console.log(
+    removedHeader
+      ? "✓ Removed existing authentication headers"
+      : "No existing authentication headers to remove",
+  );
 
   if (process.env.ALLOWED_NON_WRITE_USERS) {
     // When processing content from non-write users, use a credential helper
@@ -79,8 +133,6 @@ export async function configureGitAuth(
     await $`git remote set-url origin ${remoteUrl}`;
     console.log("✓ Updated remote URL with authentication token");
   }
-
-  console.log("Git authentication configured successfully");
 }
 
 /**

src/github/operations/restore-config.ts

@@ -3,11 +3,17 @@ import {
   appendFileSync,
   cpSync,
   existsSync,
+  lstatSync,
   mkdirSync,
   readFileSync,
+  readlinkSync,
+  realpathSync,
   rmSync,
+  statSync,
+  writeFileSync,
 } from "fs";
-import { dirname } from "path";
+import { dirname, join, posix, relative, sep } from "path";
+import { fetchDepthArgs } from "./fetch-depth";
 
 // Paths that are both PR-controllable and read from cwd at CLI startup.
 //
@@ -17,7 +23,7 @@ import { dirname } from "path";
 //   .gitconfig   — git reads ~/.gitconfig and .git/config, never cwd/.gitconfig.
 //   .bashrc etc. — shells source these from $HOME; checkout cannot reach $HOME.
 //   .vscode/.idea— IDE config; nothing in the CLI's startup path reads them.
-const SENSITIVE_PATHS = [
+export const SENSITIVE_PATHS = [
   ".claude",
   ".mcp.json",
   ".claude.json",
@@ -30,18 +36,173 @@ const SENSITIVE_PATHS = [
 
 const CLAUDE_PR_EXCLUDE_PATTERN = "/.claude-pr/";
 
-function snapshotSensitivePath(src: string, dest: string): void {
-  try {
-    cpSync(src, dest, { recursive: true, dereference: true });
-  } catch (error) {
-    // Symlinks whose targets are absent on the PR head (e.g. `.claude/CLAUDE.md`
-    // -> `../AGENTS.md` when the PR deleted the target) make dereferenced
-    // copies throw ENOENT. Preserve the symlink for the review snapshot instead.
-    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
-      cpSync(src, dest, { recursive: true });
-      return;
+function isSameOrInside(child: string, parent: string): boolean {
+  return child === parent || child.startsWith(`${parent}${sep}`);
+}
+
+// Repository paths (relative to cwd, `/`-separated) that a link may resolve
+// to: `files` are tracked files whose working-tree content is unchanged from
+// HEAD, `dirs` are directories that contain at least one tracked file.
+type TrackedPaths = { files: Set<string>; dirs: Set<string> };
+
+// Built from the superproject only: `git ls-files` reports a submodule as a
+// single entry, so paths inside a checked-out submodule are in neither set and
+// links into one are recorded as placeholders.
+function listTrackedPaths(): TrackedPaths {
+  const gitPathList = (args: string[]) =>
+    execFileSync("git", args, { encoding: "utf8", maxBuffer: Infinity })
+      .split("\0")
+      .filter(Boolean);
+  const modified = new Set(
+    gitPathList([
+      "diff",
+      "--name-only",
+      "-z",
+      "--relative",
+      "--ignore-submodules",
+      "HEAD",
+      "--",
+    ]),
+  );
+  const tracked: TrackedPaths = { files: new Set(), dirs: new Set() };
+  for (const file of gitPathList(["ls-files", "-z"])) {
+    if (!modified.has(file)) {
+      tracked.files.add(file);
     }
-    throw error;
+    for (
+      let dir = posix.dirname(file);
+      dir !== "." && !tracked.dirs.has(dir);
+      dir = posix.dirname(dir)
+    ) {
+      tracked.dirs.add(dir);
+    }
+  }
+  return tracked;
+}
+
+// The snapshot is scoped to tracked repository content and never contains
+// links. An entry is copied with its content only when all of these hold:
+//   1. its real target (through any links) lies inside the working tree;
+//   2. no component of the target's path inside the tree is `.git`, and the
+//      target is not inside the snapshot directory itself;
+//   3. the target does not contain a directory already on the entry's own
+//      path (which would recurse);
+//   4. if the entry is reached through a link (it is one, or a directory above
+//      it inside the sensitive path is), a file target must be tracked in the
+//      checkout with its content unchanged from HEAD, and a directory target
+//      must contain at least one tracked file (see listTrackedPaths). Directory
+//      targets that pass are descended into and their children are checked
+//      individually.
+// Files and directories at their literal, non-linked location are unaffected
+// by rule 4 and are copied as-is. Every other entry — targets outside the
+// tree, dangling or looping links, git metadata, submodule contents, untracked
+// or locally modified files reached through a link — is recorded as a
+// placeholder file (see recordPlaceholder), so nothing in the snapshot
+// resolves anywhere else.
+function shouldSnapshotContent(
+  entryPath: string,
+  workTreeRealPath: string,
+  tracked: TrackedPaths,
+): boolean {
+  try {
+    const targetRealPath = realpathSync(entryPath);
+    if (!isSameOrInside(targetRealPath, workTreeRealPath)) {
+      return false;
+    }
+    const targetParts = relative(workTreeRealPath, targetRealPath).split(sep);
+    if (targetParts.includes(".git") || targetParts[0] === ".claude-pr") {
+      return false;
+    }
+    for (let dir = dirname(entryPath); ; dir = dirname(dir)) {
+      if (isSameOrInside(realpathSync(dir), targetRealPath)) {
+        return false;
+      }
+      if (dir === dirname(dir)) {
+        break;
+      }
+    }
+    const literalPath = join(
+      workTreeRealPath,
+      relative(process.cwd(), entryPath),
+    );
+    if (targetRealPath === literalPath) {
+      return true;
+    }
+    const targetRepoPath = targetParts.join("/");
+    return statSync(targetRealPath).isDirectory()
+      ? tracked.dirs.has(targetRepoPath)
+      : tracked.files.has(targetRepoPath);
+  } catch {
+    return false;
+  }
+}
+
+// Writes a short regular file at `dest` describing the entry that was left
+// out, so the snapshot records that something was there without linking to it.
+function recordPlaceholder(src: string, dest: string): void {
+  console.warn(
+    `Snapshot: ${src} not included in snapshot; recording a placeholder`,
+  );
+  let description = "is not included in this snapshot";
+  try {
+    description = `was a symbolic link to ${JSON.stringify(readlinkSync(src))}; the link target is not included in this snapshot`;
+  } catch {
+    // Not a link (or no longer present).
+  }
+  mkdirSync(dirname(dest), { recursive: true });
+  writeFileSync(dest, `Snapshot placeholder: ${src} ${description}.\n`);
+}
+
+/**
+ * Copies a sensitive path into the review snapshot. Entries that pass the
+ * check above are copied dereferenced (reviewers see the effective content);
+ * every other entry is recorded as a placeholder file, never as a link.
+ * Applies per entry, including links nested inside a real directory.
+ */
+function snapshotSensitivePath(
+  src: string,
+  dest: string,
+  workTreeRealPath: string,
+  tracked: TrackedPaths,
+): void {
+  const excluded: Array<{ src: string; dest: string }> = [];
+  const keepOrExclude =
+    (keep: (entry: string) => boolean) =>
+    (entrySrc: string, entryDest: string) => {
+      if (keep(entrySrc)) {
+        return true;
+      }
+      excluded.push({ src: entrySrc, dest: entryDest });
+      return false;
+    };
+  try {
+    cpSync(src, dest, {
+      recursive: true,
+      dereference: true,
+      filter: keepOrExclude((entry) =>
+        shouldSnapshotContent(entry, workTreeRealPath, tracked),
+      ),
+    });
+  } catch (error) {
+    // Dangling links are normally caught by the filter above. If a target
+    // disappears between that check and the copy, the dereferencing copy
+    // throws ENOENT; start over without following links, recording every link
+    // as a placeholder, instead of failing the restore.
+    if (
+      !(error instanceof Error && "code" in error && error.code === "ENOENT")
+    ) {
+      throw error;
+    }
+    rmSync(dest, { recursive: true, force: true });
+    excluded.length = 0;
+    cpSync(src, dest, {
+      recursive: true,
+      filter: keepOrExclude((entry) => !lstatSync(entry).isSymbolicLink()),
+    });
+  }
+
+  for (const entry of excluded) {
+    recordPlaceholder(entry.src, entry.dest);
   }
 }
 
@@ -86,10 +247,26 @@ function ensureClaudePrExcludedFromGit(): void {
  * commits with `git add -A`, the revert will be included in that commit. This
  * is a narrow UX tradeoff for closing the RCE surface.
  *
+ * Only the paths listed in SENSITIVE_PATHS come from the base branch; the rest
+ * of the working tree stays at the PR head. A base-branch hook or setting that
+ * calls out through files a PR can change — package-manager scripts
+ * (`bun run`, `npm run`, `yarn`, `pnpm run`), Makefile or task-runner targets,
+ * repo-relative script paths, or tools that load executable project config —
+ * therefore runs whatever the PR head provides. Keep restored hooks
+ * self-contained: invoke the tool binary directly, pin its version, and pass
+ * config on the command line rather than reading it from the checkout. This
+ * extends to the runtime itself: `bunx <tool>` runs the tool under `node` when
+ * `node` is on PATH, but on a Bun-only runner Bun executes the script and reads
+ * `bunfig.toml` (e.g. `preload`) from the checkout, so `bunfig.toml` and
+ * `.npmrc` there are PR-controlled runtime config too.
+ *
  * @param baseBranch - PR base branch name. Must be pre-validated (branch.ts
  *   calls validateBranchName on it before returning).
+ * @returns The paths whose working-tree state now comes from the base branch
+ *   rather than the PR. Callers that stage files must exclude these, or they
+ *   will commit the revert back onto the PR author's branch.
  */
-export function restoreConfigFromBase(baseBranch: string): void {
+export function restoreConfigFromBase(baseBranch: string): string[] {
   console.log(
     `Restoring ${SENSITIVE_PATHS.join(", ")} from origin/${baseBranch} (PR head is untrusted)`,
   );
@@ -97,11 +274,15 @@ export function restoreConfigFromBase(baseBranch: string): void {
   // Snapshot every PR-authored sensitive path into .claude-pr/ before deletion
   // so review agents can inspect what the PR changes without those files ever
   // being executed. Captured before the security delete so it reflects the
-  // PR-authored version.
+  // PR-authored version. Links are followed only to tracked, unmodified content
+  // inside the working tree; anything else is recorded as a placeholder file,
+  // so the snapshot itself never contains links.
   rmSync(".claude-pr", { recursive: true, force: true });
+  const workTreeRealPath = realpathSync(process.cwd());
+  const tracked = listTrackedPaths();
   for (const p of SENSITIVE_PATHS) {
-    if (existsSync(p)) {
-      snapshotSensitivePath(p, `.claude-pr/${p}`);
+    if (lstatSync(p, { throwIfNoEntry: false })) {
+      snapshotSensitivePath(p, `.claude-pr/${p}`, workTreeRealPath, tracked);
     }
   }
   if (existsSync(".claude-pr")) {
@@ -128,7 +309,13 @@ export function restoreConfigFromBase(baseBranch: string): void {
   // fetch.recurseSubmodules config. Defense-in-depth alongside the delete above.
   execFileSync(
     "git",
-    ["fetch", "origin", baseBranch, "--depth=1", "--no-recurse-submodules"],
+    [
+      "fetch",
+      "origin",
+      baseBranch,
+      ...fetchDepthArgs(1),
+      "--no-recurse-submodules",
+    ],
     {
       stdio: "inherit",
       env: process.env,
@@ -154,4 +341,9 @@ export function restoreConfigFromBase(baseBranch: string): void {
   } catch {
     // Nothing was staged, or paths don't exist on HEAD — either is fine.
   }
+
+  // Every sensitive path is reported, not just the ones that changed: the
+  // restore also deletes paths the PR added that are absent on base, and those
+  // deletions are stageable too.
+  return [...SENSITIVE_PATHS];
 }

src/github/types.ts

@@ -3,9 +3,14 @@
 // GitHub's GraphQL `author`/`actor` fields resolve to null when the underlying
 // account has been deleted (the "ghost" user). Any field typed as
 // `GitHubAuthor | null` can therefore be null at runtime and must be guarded.
+// `__typename` distinguishes an App/bot actor from a human. GraphQL's
+// `Actor.login` returns the bare name for bots ("dependabot"), unlike REST which
+// appends a suffix ("dependabot[bot]"), so the typename is the only reliable bot
+// signal on this data. See `resolveActorName` in `utils/actor-filter.ts`.
 export type GitHubAuthor = {
   login: string;
   name?: string;
+  __typename?: string;
 };
 
 export type GitHubComment = {
@@ -22,6 +27,7 @@ export type GitHubComment = {
 export type GitHubReviewComment = GitHubComment & {
   path: string;
   line: number | null;
+  diffHunk?: string | null;
 };
 
 export type GitHubCommit = {
@@ -85,9 +91,13 @@ export type GitHubPullRequest = {
       commit: GitHubCommit;
     }>;
   };
+  // GitHub's GraphQL `files` field resolves to null when the PR's diff is too
+  // large for GitHub to compute (very large PRs). `changedFiles` is also
+  // misreported as 0 in that case, so the null must be guarded and treated as
+  // "file list unavailable" rather than "no files changed".
   files: {
     nodes: GitHubFile[];
-  };
+  } | null;
   comments: {
     nodes: GitHubComment[];
   };

src/github/utils/actor-filter.ts

@@ -11,6 +11,31 @@ export function parseActorFilter(filterString: string): string[] {
     .filter((actor) => actor.length > 0);
 }
 
+/**
+ * Resolves the name to match actor filter patterns against.
+ *
+ * GitHub's GraphQL API returns the bare login for App actors ("dependabot"),
+ * whereas REST and the GitHub UI use a "[bot]" suffix ("dependabot[bot]"). Users
+ * write filter patterns in the suffixed form, both the documented "*[bot]"
+ * wildcard and exact entries like "renovate[bot]", so GraphQL bot logins are
+ * normalized to that form before matching. Without this no "[bot]" pattern can
+ * ever match, because the suffix is simply absent from the data.
+ *
+ * @param author - Comment author; null for deleted ("ghost") accounts
+ * @returns Actor name, "[bot]"-suffixed for App actors
+ */
+export function resolveActorName(
+  author: { login: string; __typename?: string } | null | undefined,
+): string {
+  if (!author) return "ghost";
+
+  if (author.__typename === "Bot" && !author.login.endsWith("[bot]")) {
+    return `${author.login}[bot]`;
+  }
+
+  return author.login;
+}
+
 /**
  * Checks if an actor matches a pattern
  * Supports wildcards: "*[bot]" matches all bots, "dependabot[bot]" matches specific

src/github/utils/image-downloader.ts

@@ -34,6 +34,8 @@ const SIGNED_URL_HOST = "private-user-images.githubusercontent.com";
 const SIGNED_URL_PATH_REGEX =
   /^\/[^/]+\/[^/]*-([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:\.[a-z0-9]+)?$/i;
 
+const DEFAULT_IMAGE_DOWNLOAD_TIMEOUT_MS = 30_000;
+
 function extractSignedUrlAssetGuid(signedUrl: string): string | undefined {
   let parsed: URL;
   try {
@@ -85,13 +87,19 @@ export type CommentWithImages =
   | IssueBody
   | PullRequestBody;
 
+type ImageDownloadOptions = {
+  timeoutMs?: number;
+};
+
 export async function downloadCommentImages(
   octokits: Octokits,
   owner: string,
   repo: string,
   comments: CommentWithImages[],
+  options: ImageDownloadOptions = {},
 ): Promise<Map<string, string>> {
   const urlToPathMap = new Map<string, string>();
+  const timeoutMs = options.timeoutMs ?? DEFAULT_IMAGE_DOWNLOAD_TIMEOUT_MS;
   const downloadsDir = "/tmp/github-images";
 
   await fs.mkdir(downloadsDir, { recursive: true });
@@ -241,15 +249,7 @@ export async function downloadCommentImages(
         try {
           console.log(`Downloading ${originalUrl}...`);
 
-          const imageResponse = await fetch(signedUrl);
-          if (!imageResponse.ok) {
-            throw new Error(
-              `HTTP ${imageResponse.status}: ${imageResponse.statusText}`,
-            );
-          }
-
-          const arrayBuffer = await imageResponse.arrayBuffer();
-          const buffer = Buffer.from(arrayBuffer);
+          const buffer = await fetchImage(signedUrl, timeoutMs);
 
           // GitHub user-attachment URLs (/user-attachments/assets/<uuid>) carry
           // no file extension, so the URL-based guess silently falls back to
@@ -289,6 +289,37 @@ export async function downloadCommentImages(
   return urlToPathMap;
 }
 
+async function fetchImage(url: string, timeoutMs: number): Promise<Buffer> {
+  const controller = new AbortController();
+  let timeoutHandle: ReturnType<typeof setTimeout> | undefined;
+  const timeoutPromise = new Promise<never>((_, reject) => {
+    timeoutHandle = setTimeout(() => {
+      controller.abort();
+      reject(new Error(`Image download timed out after ${timeoutMs}ms`));
+    }, timeoutMs);
+  });
+
+  try {
+    const response = await Promise.race([
+      fetch(url, { signal: controller.signal }),
+      timeoutPromise,
+    ]);
+    if (!response.ok) {
+      throw new Error(`HTTP ${response.status}: ${response.statusText}`);
+    }
+
+    const arrayBuffer = await Promise.race([
+      response.arrayBuffer(),
+      timeoutPromise,
+    ]);
+    return Buffer.from(arrayBuffer);
+  } finally {
+    if (timeoutHandle !== undefined) {
+      clearTimeout(timeoutHandle);
+    }
+  }
+}
+
 function getImageExtension(url: string): string {
   const urlParts = url.split("/");
   const filename = urlParts[urlParts.length - 1];

src/github/utils/sanitizer.ts

@@ -76,40 +76,82 @@ export function sanitizeContent(content: string): string {
   return content;
 }
 
+/**
+ * Redact well-known credential formats (GitHub, Anthropic, AWS, Slack, JWTs)
+ * from arbitrary text. Callers don't need to know which vendor a value belongs to.
+ *
+ * Vendor-prefixed formats are matched without a leading word boundary: the
+ * prefix already anchors them, and runtime output frequently puts a word
+ * character directly against the value (e.g. an ANSI color code ending in `m`,
+ * or a serialized JSON escape such as `\n`).
+ */
+export function redactSecrets(content: string): string {
+  content = redactGitHubTokens(content);
+
+  // Anthropic API keys: sk-ant-...
+  content = content.replace(
+    /sk-ant-[A-Za-z0-9_-]{20,}/g,
+    "[REDACTED_ANTHROPIC_KEY]",
+  );
+
+  // AWS access key ids: AKIA/ASIA followed by 16 uppercase alphanumerics. All
+  // uppercase alphanumeric, so keep a leading boundary to avoid matching inside
+  // larger blobs; also treat a JSON escape or ANSI color code as a boundary.
+  content = content.replace(
+    /(?:\b|(?<=\\(?:[nrtbf"\\/]|u[0-9a-fA-F]{4}))|(?<=\[[0-9;]*m))(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,
+    "[REDACTED_AWS_KEY_ID]",
+  );
+
+  // Slack tokens: xoxb-, xoxp-, xoxa-, xoxs-, xoxr-
+  content = content.replace(
+    /xox[abpsr]-[A-Za-z0-9-]{10,}/g,
+    "[REDACTED_SLACK_TOKEN]",
+  );
+
+  // JWT-shaped strings: three base64url segments, the first two starting
+  // with eyJ (base64 of `{"`).
+  content = content.replace(
+    /eyJ[A-Za-z0-9_-]{10,2000}\.eyJ[A-Za-z0-9_-]{10,4000}\.[A-Za-z0-9_-]{10,2000}\b/g,
+    "[REDACTED_JWT]",
+  );
+
+  return content;
+}
+
 export function redactGitHubTokens(content: string): string {
   // GitHub Personal Access Tokens (classic): ghp_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX (40 chars)
   content = content.replace(
-    /\bghp_[A-Za-z0-9]{36}\b/g,
+    /ghp_[A-Za-z0-9]{36}\b/g,
     "[REDACTED_GITHUB_TOKEN]",
   );
 
   // GitHub OAuth tokens: gho_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX (40 chars)
   content = content.replace(
-    /\bgho_[A-Za-z0-9]{36}\b/g,
+    /gho_[A-Za-z0-9]{36}\b/g,
     "[REDACTED_GITHUB_TOKEN]",
   );
 
   // GitHub user-to-server tokens: ghu_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX (40 chars)
   content = content.replace(
-    /\bghu_[A-Za-z0-9]{36}\b/g,
+    /ghu_[A-Za-z0-9]{36}\b/g,
     "[REDACTED_GITHUB_TOKEN]",
   );
 
   // GitHub installation tokens: ghs_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX (40 chars)
   content = content.replace(
-    /\bghs_[A-Za-z0-9]{36}\b/g,
+    /ghs_[A-Za-z0-9]{36}\b/g,
     "[REDACTED_GITHUB_TOKEN]",
   );
 
   // GitHub refresh tokens: ghr_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX (40 chars)
   content = content.replace(
-    /\bghr_[A-Za-z0-9]{36}\b/g,
+    /ghr_[A-Za-z0-9]{36}\b/g,
     "[REDACTED_GITHUB_TOKEN]",
   );
 
   // GitHub fine-grained personal access tokens: github_pat_XXXXXXXXXX (up to 255 chars)
   content = content.replace(
-    /\bgithub_pat_[A-Za-z0-9_]{11,221}\b/g,
+    /github_pat_[A-Za-z0-9_]{11,221}\b/g,
     "[REDACTED_GITHUB_TOKEN]",
   );
 

src/github/validation/trigger.ts

@@ -38,7 +38,10 @@ export function checkContainsTrigger(context: ParsedGitHubContext): boolean {
   if (isIssuesEvent(context) && context.eventAction === "labeled") {
     const labelName = (context.payload as any).label?.name || "";
 
-    if (labelTrigger && labelName === labelTrigger) {
+    if (
+      labelTrigger &&
+      labelName.toLowerCase() === labelTrigger.toLowerCase()
+    ) {
       console.log(`Issue labeled with trigger label '${labelTrigger}'`);
       return true;
     }

src/mcp/binary-detection.ts

@@ -0,0 +1,22 @@
+/**
+ * Decides whether a file has to be committed as a base64 blob instead of being
+ * inlined in the Git tree as UTF-8 text.
+ *
+ * Inlining is only safe for content that survives a UTF-8 decode untouched;
+ * anything else gets its invalid bytes replaced during the decode, which
+ * silently corrupts the committed file. A NUL byte is treated as binary for the
+ * same reason Git does it: no text file carries one, and it is the cheapest
+ * signal available.
+ */
+export function isBinaryContent(content: Buffer): boolean {
+  if (content.includes(0)) {
+    return true;
+  }
+
+  try {
+    new TextDecoder("utf-8", { fatal: true }).decode(content);
+    return false;
+  } catch {
+    return true;
+  }
+}

src/mcp/github-actions-pagination.ts

@@ -0,0 +1,19 @@
+import type { Octokit } from "@octokit/rest";
+
+type ActionsClient = Octokit["actions"];
+
+export type WorkflowRunsParams = Parameters<
+  ActionsClient["listWorkflowRunsForRepo"]
+>[0];
+
+export type WorkflowJobsParams = Parameters<
+  ActionsClient["listJobsForWorkflowRun"]
+>[0];
+
+export function listWorkflowRuns(client: Octokit, params: WorkflowRunsParams) {
+  return client.paginate(client.actions.listWorkflowRunsForRepo, params);
+}
+
+export function listWorkflowJobs(client: Octokit, params: WorkflowJobsParams) {
+  return client.paginate(client.actions.listJobsForWorkflowRun, params);
+}

src/mcp/github-actions-server.ts

@@ -6,6 +6,10 @@ import { z } from "zod";
 import { GITHUB_API_URL } from "../github/api/config";
 import { mkdir, writeFile } from "fs/promises";
 import { Octokit } from "@octokit/rest";
+import {
+  listWorkflowJobs,
+  listWorkflowRuns,
+} from "./github-actions-pagination";
 
 const REPO_OWNER = process.env.REPO_OWNER;
 const REPO_NAME = process.env.REPO_NAME;
@@ -13,11 +17,18 @@ const PR_NUMBER = process.env.PR_NUMBER;
 const GITHUB_TOKEN = process.env.GITHUB_TOKEN;
 const RUNNER_TEMP = process.env.RUNNER_TEMP || "/tmp";
 
-if (!REPO_OWNER || !REPO_NAME || !PR_NUMBER || !GITHUB_TOKEN) {
-  console.error(
-    "[GitHub CI Server] Error: REPO_OWNER, REPO_NAME, PR_NUMBER, and GITHUB_TOKEN environment variables are required",
-  );
-  process.exit(1);
+// Job logs are fetched by ID from GitHub-hosted storage; bound the request so a
+// stalled fetch can't hang this MCP call forever. Mirrors the timeout added to
+// fetchImage() in src/github/utils/image-downloader.ts (#1625).
+const DOWNLOAD_JOB_LOG_TIMEOUT_MS = 30_000;
+
+if (import.meta.main) {
+  if (!REPO_OWNER || !REPO_NAME || !PR_NUMBER || !GITHUB_TOKEN) {
+    console.error(
+      "[GitHub CI Server] Error: REPO_OWNER, REPO_NAME, PR_NUMBER, and GITHUB_TOKEN environment variables are required",
+    );
+    process.exit(1);
+  }
 }
 
 const server = new McpServer({
@@ -66,7 +77,7 @@ server.tool(
       });
       const headSha = prData.head.sha;
 
-      const { data: runsData } = await client.actions.listWorkflowRunsForRepo({
+      const runs = await listWorkflowRuns(client, {
         owner: REPO_OWNER!,
         repo: REPO_NAME!,
         head_sha: headSha,
@@ -74,7 +85,6 @@ server.tool(
       });
 
       // Process runs to create summary
-      const runs = runsData.workflow_runs || [];
       const summary = {
         total_runs: runs.length,
         failed: 0,
@@ -148,13 +158,13 @@ server.tool(
       });
 
       // Get jobs for this workflow run
-      const { data: jobsData } = await client.actions.listJobsForWorkflowRun({
+      const jobs = await listWorkflowJobs(client, {
         owner: REPO_OWNER!,
         repo: REPO_NAME!,
         run_id,
       });
 
-      const processedJobs = jobsData.jobs.map((job: any) => {
+      const processedJobs = jobs.map((job: any) => {
         // Extract failed steps
         const failedSteps = (job.steps || [])
           .filter((step: any) => step.conclusion === "failure")
@@ -202,6 +212,40 @@ server.tool(
   },
 );
 
+export async function downloadJobLog(
+  client: Octokit,
+  params: { owner: string; repo: string; job_id: number },
+  runnerTemp: string,
+  timeoutMs: number = DOWNLOAD_JOB_LOG_TIMEOUT_MS,
+): Promise<{ path: string; size_bytes: number }> {
+  const controller = new AbortController();
+  const timeoutHandle = setTimeout(() => controller.abort(), timeoutMs);
+
+  try {
+    const response = await client.actions.downloadJobLogsForWorkflowRun({
+      owner: params.owner,
+      repo: params.repo,
+      job_id: params.job_id,
+      request: { signal: controller.signal },
+    });
+
+    const logsText = response.data as unknown as string;
+
+    const logsDir = `${runnerTemp}/github-ci-logs`;
+    await mkdir(logsDir, { recursive: true });
+
+    const logPath = `${logsDir}/job-${params.job_id}.log`;
+    await writeFile(logPath, logsText, "utf-8");
+
+    return {
+      path: logPath,
+      size_bytes: Buffer.byteLength(logsText, "utf-8"),
+    };
+  } finally {
+    clearTimeout(timeoutHandle);
+  }
+}
+
 server.tool(
   "download_job_log",
   "Download job logs to disk",
@@ -215,24 +259,11 @@ server.tool(
         baseUrl: GITHUB_API_URL,
       });
 
-      const response = await client.actions.downloadJobLogsForWorkflowRun({
-        owner: REPO_OWNER!,
-        repo: REPO_NAME!,
-        job_id,
-      });
-
-      const logsText = response.data as unknown as string;
-
-      const logsDir = `${RUNNER_TEMP}/github-ci-logs`;
-      await mkdir(logsDir, { recursive: true });
-
-      const logPath = `${logsDir}/job-${job_id}.log`;
-      await writeFile(logPath, logsText, "utf-8");
-
-      const result = {
-        path: logPath,
-        size_bytes: Buffer.byteLength(logsText, "utf-8"),
-      };
+      const result = await downloadJobLog(
+        client,
+        { owner: REPO_OWNER!, repo: REPO_NAME!, job_id },
+        RUNNER_TEMP,
+      );
 
       return {
         content: [
@@ -274,6 +305,8 @@ async function runServer() {
   }
 }
 
-runServer().catch(() => {
-  process.exit(1);
-});
+if (import.meta.main) {
+  runServer().catch(() => {
+    process.exit(1);
+  });
+}

src/mcp/github-comment-server.ts

@@ -6,7 +6,7 @@ import { z } from "zod";
 import { GITHUB_API_URL } from "../github/api/config";
 import { Octokit } from "@octokit/rest";
 import { updateClaudeComment } from "../github/operations/comments/update-claude-comment";
-import { sanitizeContent } from "../github/utils/sanitizer";
+import { redactSecrets, sanitizeContent } from "../github/utils/sanitizer";
 
 // Get repository information from environment variables
 const REPO_OWNER = process.env.REPO_OWNER;
@@ -55,7 +55,7 @@ server.tool(
       const isPullRequestReviewComment =
         eventName === "pull_request_review_comment";
 
-      const sanitizedBody = sanitizeContent(body);
+      const sanitizedBody = redactSecrets(sanitizeContent(body));
 
       const result = await updateClaudeComment(octokit, {
         owner,

src/mcp/github-file-ops-schemas.ts

@@ -0,0 +1,24 @@
+import { z } from "zod";
+
+/** Raw shape passed to `server.tool` for commit_files. */
+export const commitFilesInputSchema = {
+  files: z
+    .array(z.string())
+    .describe(
+      'Array of file paths relative to repository root (e.g. ["src/main.js", "README.md"]). All files must exist locally.',
+    ),
+  message: z.string().describe("Commit message"),
+};
+
+/** Raw shape passed to `server.tool` for delete_files. */
+export const deleteFilesInputSchema = {
+  paths: z
+    .array(z.string())
+    .describe(
+      'Array of file paths to delete relative to repository root (e.g. ["src/old-file.js", "docs/deprecated.md"])',
+    ),
+  message: z.string().describe("Commit message"),
+};
+
+export const commitFilesPayloadSchema = z.object(commitFilesInputSchema);
+export const deleteFilesPayloadSchema = z.object(deleteFilesInputSchema);

src/mcp/github-file-ops-server.ts

@@ -2,14 +2,18 @@
 // GitHub File Operations MCP Server
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { z } from "zod";
 import { readFile, stat } from "fs/promises";
 import { resolve } from "path";
 import { constants } from "fs";
 import fetch from "node-fetch";
 import { GITHUB_API_URL } from "../github/api/config";
-import { retryWithBackoff } from "../utils/retry";
+import { isBinaryContent } from "./binary-detection";
 import { validatePathWithinRepo } from "./path-validation";
+import { updateGitReference } from "./update-git-reference";
+import {
+  commitFilesInputSchema,
+  deleteFilesInputSchema,
+} from "./github-file-ops-schemas";
 
 type GitHubRef = {
   object: {
@@ -196,14 +200,7 @@ async function getFileMode(filePath: string): Promise<string> {
 server.tool(
   "commit_files",
   "Commit one or more files to a repository in a single commit (this will commit them atomically in the remote repository)",
-  {
-    files: z
-      .array(z.string())
-      .describe(
-        'Array of file paths relative to repository root (e.g. ["src/main.js", "README.md"]). All files must exist locally.',
-      ),
-    message: z.string().describe("Commit message"),
-  },
+  commitFilesInputSchema,
   async ({ files, message }) => {
     const owner = REPO_OWNER;
     const repo = REPO_NAME;
@@ -258,17 +255,14 @@ server.tool(
           // Get the proper file mode based on file permissions
           const fileMode = await getFileMode(fullPath);
 
-          // Check if file is binary (images, etc.)
-          const isBinaryFile =
-            /\.(png|jpg|jpeg|gif|webp|ico|pdf|zip|tar|gz|exe|bin|woff|woff2|ttf|eot)$/i.test(
-              relativePath,
-            );
+          // Check if the file is binary by inspecting its contents. An
+          // extension allowlist used to decide this, which corrupted every
+          // binary type that wasn't on the list.
+          const fileContent = await readFile(fullPath);
 
-          if (isBinaryFile) {
+          if (isBinaryContent(fileContent)) {
             // For binary files, create a blob first using the Blobs API
-            const binaryContent = await readFile(fullPath);
-
-            // Create blob using Blobs API (supports encoding parameter)
+            // (supports the encoding parameter)
             const blobUrl = `${GITHUB_API_URL}/repos/${owner}/${repo}/git/blobs`;
             const blobResponse = await fetch(blobUrl, {
               method: "POST",
@@ -279,7 +273,7 @@ server.tool(
                 "Content-Type": "application/json",
               },
               body: JSON.stringify({
-                content: binaryContent.toString("base64"),
+                content: fileContent.toString("base64"),
                 encoding: "base64",
               }),
             });
@@ -302,12 +296,11 @@ server.tool(
             };
           } else {
             // For text files, include content directly in tree
-            const content = await readFile(fullPath, "utf-8");
             return {
               path: relativePath,
               mode: fileMode,
               type: "blob",
-              content: content,
+              content: fileContent.toString("utf-8"),
             };
           }
         }),
@@ -365,57 +358,13 @@ server.tool(
       const newCommitData = (await newCommitResponse.json()) as GitHubNewCommit;
 
       // 6. Update the reference to point to the new commit
-      const updateRefUrl = `${GITHUB_API_URL}/repos/${owner}/${repo}/git/refs/heads/${branch}`;
-
-      // We're seeing intermittent 403 "Resource not accessible by integration" errors
-      // on certain repos when updating git references. These appear to be transient
-      // GitHub API issues that succeed on retry.
-      await retryWithBackoff(
-        async () => {
-          const updateRefResponse = await fetch(updateRefUrl, {
-            method: "PATCH",
-            headers: {
-              Accept: "application/vnd.github+json",
-              Authorization: `Bearer ${githubToken}`,
-              "X-GitHub-Api-Version": "2022-11-28",
-              "Content-Type": "application/json",
-            },
-            body: JSON.stringify({
-              sha: newCommitData.sha,
-              force: false,
-            }),
-          });
-
-          if (!updateRefResponse.ok) {
-            const errorText = await updateRefResponse.text();
-
-            // Provide a more helpful error message for 403 permission errors
-            if (updateRefResponse.status === 403) {
-              const permissionError = new Error(
-                `Permission denied: Unable to push commits to branch '${branch}'. ` +
-                  `Please rebase your branch from the main/master branch to allow Claude to commit.\n\n` +
-                  `Original error: ${errorText}`,
-              );
-              throw permissionError;
-            }
-
-            // For other errors, use the original message
-            const error = new Error(
-              `Failed to update reference: ${updateRefResponse.status} - ${errorText}`,
-            );
-
-            // For non-403 errors, fail immediately without retry
-            console.error("Non-retryable error:", updateRefResponse.status);
-            throw error;
-          }
-        },
-        {
-          maxAttempts: 3,
-          initialDelayMs: 1000, // Start with 1 second delay
-          maxDelayMs: 5000, // Max 5 seconds delay
-          backoffFactor: 2, // Double the delay each time
-        },
-      );
+      await updateGitReference({
+        owner,
+        repo,
+        branch,
+        sha: newCommitData.sha,
+        githubToken,
+      });
 
       const simplifiedResult = {
         commit: {
@@ -461,14 +410,7 @@ server.tool(
 server.tool(
   "delete_files",
   "Delete one or more files from a repository in a single commit",
-  {
-    paths: z
-      .array(z.string())
-      .describe(
-        'Array of file paths to delete relative to repository root (e.g. ["src/old-file.js", "docs/deprecated.md"])',
-      ),
-    message: z.string().describe("Commit message"),
-  },
+  deleteFilesInputSchema,
   async ({ paths, message }) => {
     const owner = REPO_OWNER;
     const repo = REPO_NAME;
@@ -479,21 +421,18 @@ server.tool(
         throw new Error("GITHUB_TOKEN environment variable is required");
       }
 
-      // Convert absolute paths to relative if they match CWD
-      const cwd = process.cwd();
-      const processedPaths = paths.map((filePath) => {
-        if (filePath.startsWith("/")) {
-          if (filePath.startsWith(cwd)) {
-            // Strip CWD from absolute path
-            return filePath.slice(cwd.length + 1);
-          } else {
-            throw new Error(
-              `Path '${filePath}' must be relative to repository root or within current working directory`,
-            );
-          }
-        }
-        return filePath;
-      });
+      // Validate all paths are within the repository root and normalize them to
+      // repo-relative paths for the git tree entries. This mirrors the validation
+      // already performed by the commit_files tool and rejects path traversal
+      // ("../") and symlinked escapes as defense-in-depth.
+      const resolvedRepoDir = resolve(REPO_DIR);
+      const processedPaths = await Promise.all(
+        paths.map(async (filePath) => {
+          await validatePathWithinRepo(filePath, REPO_DIR);
+          const normalizedPath = resolve(resolvedRepoDir, filePath);
+          return normalizedPath.slice(resolvedRepoDir.length + 1);
+        }),
+      );
 
       // 1. Get the branch reference (create if doesn't exist)
       const baseSha = await getOrCreateBranchRef(
@@ -580,58 +519,13 @@ server.tool(
       const newCommitData = (await newCommitResponse.json()) as GitHubNewCommit;
 
       // 6. Update the reference to point to the new commit
-      const updateRefUrl = `${GITHUB_API_URL}/repos/${owner}/${repo}/git/refs/heads/${branch}`;
-
-      // We're seeing intermittent 403 "Resource not accessible by integration" errors
-      // on certain repos when updating git references. These appear to be transient
-      // GitHub API issues that succeed on retry.
-      await retryWithBackoff(
-        async () => {
-          const updateRefResponse = await fetch(updateRefUrl, {
-            method: "PATCH",
-            headers: {
-              Accept: "application/vnd.github+json",
-              Authorization: `Bearer ${githubToken}`,
-              "X-GitHub-Api-Version": "2022-11-28",
-              "Content-Type": "application/json",
-            },
-            body: JSON.stringify({
-              sha: newCommitData.sha,
-              force: false,
-            }),
-          });
-
-          if (!updateRefResponse.ok) {
-            const errorText = await updateRefResponse.text();
-
-            // Provide a more helpful error message for 403 permission errors
-            if (updateRefResponse.status === 403) {
-              console.log("Received 403 error, will retry...");
-              const permissionError = new Error(
-                `Permission denied: Unable to push commits to branch '${branch}'. ` +
-                  `Please rebase your branch from the main/master branch to allow Claude to commit.\n\n` +
-                  `Original error: ${errorText}`,
-              );
-              throw permissionError;
-            }
-
-            // For other errors, use the original message
-            const error = new Error(
-              `Failed to update reference: ${updateRefResponse.status} - ${errorText}`,
-            );
-
-            // For non-403 errors, fail immediately without retry
-            console.error("Non-retryable error:", updateRefResponse.status);
-            throw error;
-          }
-        },
-        {
-          maxAttempts: 3,
-          initialDelayMs: 1000, // Start with 1 second delay
-          maxDelayMs: 5000, // Max 5 seconds delay
-          backoffFactor: 2, // Double the delay each time
-        },
-      );
+      await updateGitReference({
+        owner,
+        repo,
+        branch,
+        sha: newCommitData.sha,
+        githubToken,
+      });
 
       const simplifiedResult = {
         commit: {

src/mcp/github-inline-comment-server.ts

@@ -4,7 +4,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { appendFileSync } from "fs";
 import { z } from "zod";
 import { createOctokit } from "../github/api/client";
-import { sanitizeContent } from "../github/utils/sanitizer";
+import { redactSecrets, sanitizeContent } from "../github/utils/sanitizer";
 import { removeBufferedComment } from "./inline-comment-buffer";
 
 // Get repository and PR information from environment variables
@@ -98,8 +98,8 @@ server.tool(
       const repo = REPO_NAME;
       const pull_number = parseInt(PR_NUMBER, 10);
 
-      // Sanitize the comment body to remove any potential GitHub tokens
-      const sanitizedBody = sanitizeContent(body);
+      // Sanitize the comment body to remove potential prompt injections and redact secrets
+      const sanitizedBody = redactSecrets(sanitizeContent(body));
 
       // Validate that either line or both startLine and line are provided
       if (!line && !startLine) {

src/mcp/install-mcp-server.ts

@@ -83,20 +83,25 @@ export async function prepareMcpConfig(
     // Detect if we're in agent mode (explicit prompt provided)
     const isAgentMode = mode === "agent";
 
-    const hasGitHubCommentTools = allowedToolsList.some((tool) =>
-      tool.startsWith("mcp__github_comment__"),
+    const hasGitHubCommentTools = allowedToolsList.some(
+      (tool) =>
+        tool === "mcp__github_comment" ||
+        tool.startsWith("mcp__github_comment__"),
     );
 
-    const hasGitHubMcpTools = allowedToolsList.some((tool) =>
-      tool.startsWith("mcp__github__"),
+    const hasGitHubMcpTools = allowedToolsList.some(
+      (tool) => tool === "mcp__github" || tool.startsWith("mcp__github__"),
     );
 
-    const hasInlineCommentTools = allowedToolsList.some((tool) =>
-      tool.startsWith("mcp__github_inline_comment__"),
+    const hasInlineCommentTools = allowedToolsList.some(
+      (tool) =>
+        tool === "mcp__github_inline_comment" ||
+        tool.startsWith("mcp__github_inline_comment__"),
     );
 
-    const hasGitHubCITools = allowedToolsList.some((tool) =>
-      tool.startsWith("mcp__github_ci__"),
+    const hasGitHubCITools = allowedToolsList.some(
+      (tool) =>
+        tool === "mcp__github_ci" || tool.startsWith("mcp__github_ci__"),
     );
 
     const baseMcpConfig: { mcpServers: Record<string, unknown> } = {

src/mcp/update-git-reference.ts

@@ -0,0 +1,90 @@
+import fetch, { type RequestInit, type Response } from "node-fetch";
+import { GITHUB_API_URL } from "../github/api/config";
+import { retryWithBackoff, type RetryOptions } from "../utils/retry";
+
+type GitHubFetch = (
+  url: string,
+  init: RequestInit,
+) => Promise<Pick<Response, "ok" | "status" | "text">>;
+
+type UpdateGitReferenceOptions = {
+  owner: string;
+  repo: string;
+  branch: string;
+  sha: string;
+  githubToken: string;
+  fetchFn?: GitHubFetch;
+  retryOptions?: Omit<RetryOptions, "shouldRetry">;
+};
+
+class GitReferenceUpdateError extends Error {
+  constructor(
+    readonly status: number,
+    message: string,
+  ) {
+    super(message);
+    this.name = "GitReferenceUpdateError";
+  }
+}
+
+function shouldRetryGitReferenceUpdate(error: Error): boolean {
+  if (!(error instanceof GitReferenceUpdateError)) {
+    return true;
+  }
+
+  return error.status === 403 || error.status === 429 || error.status >= 500;
+}
+
+export async function updateGitReference({
+  owner,
+  repo,
+  branch,
+  sha,
+  githubToken,
+  fetchFn = fetch,
+  retryOptions,
+}: UpdateGitReferenceOptions): Promise<void> {
+  const updateRefUrl = `${GITHUB_API_URL}/repos/${owner}/${repo}/git/refs/heads/${branch}`;
+
+  await retryWithBackoff(
+    async () => {
+      const response = await fetchFn(updateRefUrl, {
+        method: "PATCH",
+        headers: {
+          Accept: "application/vnd.github+json",
+          Authorization: `Bearer ${githubToken}`,
+          "X-GitHub-Api-Version": "2022-11-28",
+          "Content-Type": "application/json",
+        },
+        body: JSON.stringify({ sha, force: false }),
+      });
+
+      if (response.ok) {
+        return;
+      }
+
+      const errorText = await response.text();
+      if (response.status === 403) {
+        throw new GitReferenceUpdateError(
+          response.status,
+          `Permission denied: Unable to push commits to branch '${branch}'. ` +
+            `Please rebase your branch from the main/master branch to allow Claude to commit.\n\n` +
+            `Original error: ${errorText}`,
+        );
+      }
+
+      throw new GitReferenceUpdateError(
+        response.status,
+        `Failed to update reference: ${response.status} - ${errorText}`,
+      );
+    },
+    {
+      maxAttempts: 3,
+      initialDelayMs: 1000,
+      maxDelayMs: 5000,
+      backoffFactor: 2,
+      ...retryOptions,
+      shouldRetry: shouldRetryGitReferenceUpdate,
+    },
+  );
+}

src/modes/agent/index.ts

@@ -3,6 +3,7 @@ import { prepareMcpConfig } from "../../mcp/install-mcp-server";
 import { parseAllowedTools } from "./parse-tools";
 import {
   configureGitAuth,
+  replaceCheckoutCredentials,
   setupSshSigning,
 } from "../../github/operations/git-config";
 import { checkHumanActor } from "../../github/validation/actor";
@@ -62,6 +63,16 @@ export async function prepareAgentMode({
       console.error("Failed to configure git authentication:", error);
       // Continue anyway - git operations may still work with default config
     }
+  } else {
+    // Commits go through the GitHub API, so no git user setup is needed, but
+    // the credential actions/checkout left in git config should still be
+    // replaced with the action's own.
+    try {
+      await replaceCheckoutCredentials(githubToken, context);
+    } catch (error) {
+      console.error("Failed to configure git credentials:", error);
+      // Continue anyway - git operations may still work with default config
+    }
   }
 
   // Create prompt directory. Clear any stale files from a prior invocation first —

src/modes/detector.ts

@@ -103,6 +103,7 @@ function validateTrackProgressEvent(context: GitHubContext): void {
       "synchronize",
       "ready_for_review",
       "reopened",
+      "labeled",
     ];
     if (!validActions.includes(context.eventAction)) {
       throw new Error(

src/modes/tag/index.ts

@@ -3,6 +3,7 @@ import { createInitialComment } from "../../github/operations/comments/create-in
 import { setupBranch } from "../../github/operations/branch";
 import {
   configureGitAuth,
+  replaceCheckoutCredentials,
   setupSshSigning,
 } from "../../github/operations/git-config";
 import { prepareMcpConfig } from "../../mcp/install-mcp-server";
@@ -98,6 +99,16 @@ export async function prepareTagMode({
       console.error("Failed to configure git authentication:", error);
       throw error;
     }
+  } else {
+    // Commits go through the GitHub API, so no git user setup is needed, but
+    // the credential actions/checkout left in git config should still be
+    // replaced with the action's own.
+    try {
+      await replaceCheckoutCredentials(githubToken, context);
+    } catch (error) {
+      console.error("Failed to configure git credentials:", error);
+      throw error;
+    }
   }
 
   // Create prompt file

src/utils/branch-template.ts

@@ -72,6 +72,21 @@ export function applyBranchTemplate(
   return result;
 }
 
+/**
+ * Collapses empty path segments produced when a template variable resolves to
+ * an empty string. For example, an issue title with no alphanumeric characters
+ * (emoji-only, CJK-only, or punctuation-only) makes `{{description}}` empty, so
+ * a template like `{{prefix}}{{description}}/{{entityNumber}}` yields
+ * `claude//123`. Consecutive slashes — and a leading or trailing slash — are
+ * rejected by `validateBranchName`, which aborts the whole run, so normalize
+ * them into a valid branch name instead of crashing.
+ */
+function collapseEmptyPathSegments(branchName: string): string {
+  return branchName
+    .replace(/\/{2,}/g, "/") // collapse runs of slashes left by empty segments
+    .replace(/^\/+|\/+$/g, ""); // drop leading/trailing slashes
+}
+
 /**
  * Generates a branch name from the provided `template` and set of `variables`. Uses a default format if the template is empty or produces an empty result.
  */
@@ -97,7 +112,9 @@ export function generateBranchName(
   };
 
   if (template?.trim()) {
-    const branchName = applyBranchTemplate(template, variables);
+    const branchName = collapseEmptyPathSegments(
+      applyBranchTemplate(template, variables),
+    );
 
     // Some templates could produce empty results- validate
     if (branchName.trim().length > 0) return branchName;

test/action-metadata.test.ts

@@ -0,0 +1,15 @@
+import { readFileSync } from "node:fs";
+import { describe, expect, test } from "bun:test";
+
+describe("action metadata", () => {
+  test("should expose the conclusion output from the run step", () => {
+    const metadata = readFileSync(
+      new URL("../action.yml", import.meta.url),
+      "utf8",
+    );
+
+    expect(metadata).toMatch(
+      /^  conclusion:\n    description: .+\n    value: \$\{\{ steps\.run\.outputs\.conclusion \}\}$/m,
+    );
+  });
+});

test/actor-filter.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, test } from "bun:test";
 import {
   parseActorFilter,
   actorMatchesPattern,
+  resolveActorName,
   shouldIncludeCommentByActor,
 } from "../src/github/utils/actor-filter";
 
@@ -170,3 +171,49 @@ describe("shouldIncludeCommentByActor", () => {
     ).toBe(false);
   });
 });
+
+describe("resolveActorName", () => {
+  test("appends the [bot] suffix to GraphQL App actors", () => {
+    // GraphQL returns the bare login for bots; REST would say "dependabot[bot]".
+    expect(resolveActorName({ __typename: "Bot", login: "dependabot" })).toBe(
+      "dependabot[bot]",
+    );
+  });
+
+  test("leaves human logins untouched", () => {
+    expect(resolveActorName({ __typename: "User", login: "octocat" })).toBe(
+      "octocat",
+    );
+  });
+
+  test("does not double-suffix a login that already ends with [bot]", () => {
+    expect(
+      resolveActorName({ __typename: "Bot", login: "dependabot[bot]" }),
+    ).toBe("dependabot[bot]");
+  });
+
+  test("maps deleted accounts to ghost", () => {
+    expect(resolveActorName(null)).toBe("ghost");
+    expect(resolveActorName(undefined)).toBe("ghost");
+  });
+
+  test("falls back to the login when __typename is absent", () => {
+    expect(resolveActorName({ login: "octocat" })).toBe("octocat");
+  });
+
+  test("a bot actor matches the *[bot] wildcard once resolved", () => {
+    const actor = resolveActorName({ __typename: "Bot", login: "renovate" });
+
+    expect(actorMatchesPattern(actor, "*[bot]")).toBe(true);
+    // The raw GraphQL login never matches, which is the bug being fixed.
+    expect(actorMatchesPattern("renovate", "*[bot]")).toBe(false);
+  });
+
+  test("a bot actor matches an exact [bot] pattern once resolved", () => {
+    const actor = resolveActorName({ __typename: "Bot", login: "dependabot" });
+
+    expect(shouldIncludeCommentByActor(actor, [], ["dependabot[bot]"])).toBe(
+      false,
+    );
+  });
+});

test/binary-detection.test.ts

@@ -0,0 +1,79 @@
+import { describe, expect, it } from "bun:test";
+import { isBinaryContent } from "../src/mcp/binary-detection";
+
+describe("isBinaryContent", () => {
+  describe("text content", () => {
+    it("treats ASCII as text", () => {
+      expect(isBinaryContent(Buffer.from("hello world\n"))).toBe(false);
+    });
+
+    it("treats multibyte UTF-8 as text", () => {
+      expect(isBinaryContent(Buffer.from("café — 日本語 🎉\n"))).toBe(false);
+    });
+
+    it("treats an empty file as text", () => {
+      expect(isBinaryContent(Buffer.from(""))).toBe(false);
+    });
+
+    it("treats CRLF and tabs as text", () => {
+      expect(isBinaryContent(Buffer.from("a\tb\r\nc\r\n"))).toBe(false);
+    });
+  });
+
+  describe("binary content", () => {
+    // The extensions below are the ones the previous allowlist covered, so
+    // these files were already committed correctly.
+    it("detects PNG", () => {
+      expect(
+        isBinaryContent(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a])),
+      ).toBe(true);
+    });
+
+    // These are the regression cases: binary formats that were not on the
+    // allowlist and got decoded as UTF-8, corrupting the committed bytes.
+    it("detects BMP", () => {
+      expect(
+        isBinaryContent(Buffer.from([0x42, 0x4d, 0x36, 0x00, 0x00, 0x00])),
+      ).toBe(true);
+    });
+
+    it("detects SQLite databases", () => {
+      expect(isBinaryContent(Buffer.from("SQLite format 3\0", "binary"))).toBe(
+        true,
+      );
+    });
+
+    it("detects WebAssembly modules", () => {
+      expect(
+        isBinaryContent(Buffer.from([0x00, 0x61, 0x73, 0x6d, 0x01, 0x00])),
+      ).toBe(true);
+    });
+
+    it("detects arbitrary invalid UTF-8 without NUL bytes", () => {
+      // Lone continuation bytes: no NUL, but not decodable as UTF-8 either.
+      expect(isBinaryContent(Buffer.from([0xc3, 0x28, 0xa0, 0xa1]))).toBe(true);
+    });
+
+    it("detects a truncated multibyte sequence", () => {
+      // First two bytes of a 3-byte character, cut short.
+      expect(isBinaryContent(Buffer.from([0xe6, 0x97]))).toBe(true);
+    });
+  });
+
+  it("round-trips text through UTF-8 without loss", () => {
+    const original = "acentuação, emoji 🚀, símbolos ±≠";
+    const buffer = Buffer.from(original);
+
+    expect(isBinaryContent(buffer)).toBe(false);
+    expect(buffer.toString("utf-8")).toBe(original);
+  });
+
+  it("preserves bytes that a UTF-8 decode would have replaced", () => {
+    const bytes = Buffer.from([0xff, 0xd8, 0xff, 0xe0, 0x10, 0x4a]);
+
+    expect(isBinaryContent(bytes)).toBe(true);
+    // What the old text path would have produced, versus base64.
+    expect(Buffer.from(bytes.toString("utf-8"), "utf-8")).not.toEqual(bytes);
+    expect(Buffer.from(bytes.toString("base64"), "base64")).toEqual(bytes);
+  });
+});

test/branch-cleanup-restored-config.test.ts

@@ -0,0 +1,262 @@
+#!/usr/bin/env bun
+
+/**
+ * Tests the interaction between restoreConfigFromBase and the auto-commit in
+ * checkAndCommitOrDeleteBranch.
+ *
+ * On pull requests the restore replaces .claude/, CLAUDE.md and friends with
+ * the base branch's versions and leaves them unstaged, so the revert does not
+ * reach a commit. A bare `git add -A` re-staged them anyway and pushed a silent
+ * revert of the PR author's own config onto their branch.
+ *
+ * These run against real git — the fix is a pathspec, so a mock would only
+ * assert that the arguments were passed, not that git honours them.
+ */
+
+import { describe, test, expect, beforeEach, afterEach, spyOn } from "bun:test";
+import { execFileSync } from "node:child_process";
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { checkAndCommitOrDeleteBranch } from "../src/github/operations/branch-cleanup";
+import { SENSITIVE_PATHS } from "../src/github/operations/restore-config";
+import type { Octokits } from "../src/github/api/client";
+
+const BRANCH = "claude/issue-1-20260101-0000";
+
+let workDir: string;
+let remoteDir: string;
+let originalCwd: string;
+let logSpy: ReturnType<typeof spyOn>;
+let errorSpy: ReturnType<typeof spyOn>;
+
+function git(...args: string[]): string {
+  return execFileSync("git", args, { cwd: workDir, encoding: "utf-8" }).trim();
+}
+
+function write(relative: string, contents: string) {
+  const full = join(workDir, relative);
+  mkdirSync(join(full, ".."), { recursive: true });
+  writeFileSync(full, contents);
+}
+
+/** Branch exists, and has no commits ahead of base, so cleanup inspects git. */
+const mockOctokit = {
+  rest: {
+    repos: {
+      getBranch: async () => ({ data: {} }),
+      compareCommitsWithBasehead: async () => ({
+        data: { total_commits: 0 },
+      }),
+    },
+    git: { deleteRef: async () => ({ data: {} }) },
+  },
+} as unknown as Octokits;
+
+beforeEach(() => {
+  originalCwd = process.cwd();
+  const root = mkdtempSync(join(tmpdir(), "branch-cleanup-"));
+  remoteDir = join(root, "remote.git");
+  workDir = join(root, "work");
+
+  execFileSync("git", ["init", "-q", "--bare", remoteDir]);
+  execFileSync("git", ["init", "-q", "-b", "main", workDir]);
+  git("config", "user.email", "test@example.com");
+  git("config", "user.name", "Test");
+  git("remote", "add", "origin", remoteDir);
+
+  write(".claude/settings.json", '{"from":"base"}\n');
+  write("CLAUDE.md", "base docs\n");
+  write("src/app.ts", "base code\n");
+  git("add", "-A");
+  git("commit", "-qm", "base");
+  git("push", "-q", "origin", "main");
+  git("checkout", "-qb", BRANCH);
+  git("push", "-q", "origin", BRANCH);
+
+  process.chdir(workDir);
+  logSpy = spyOn(console, "log").mockImplementation(() => {});
+  errorSpy = spyOn(console, "error").mockImplementation(() => {});
+});
+
+afterEach(() => {
+  process.chdir(originalCwd);
+  logSpy.mockRestore();
+  errorSpy.mockRestore();
+  rmSync(join(workDir, ".."), { recursive: true, force: true });
+});
+
+/** Files touched by the most recent commit. */
+function filesInHeadCommit(): string[] {
+  return git("show", "--name-only", "--format=", "HEAD")
+    .split("\n")
+    .filter(Boolean)
+    .sort();
+}
+
+/**
+ * Reproduce the working-tree state restoreConfigFromBase leaves behind: the
+ * PR-authored config overwritten with the base branch's content, unstaged, so
+ * git reports it as a plain modification.
+ */
+function simulateRestoredConfig() {
+  write(".claude/settings.json", '{"from":"base"}\n');
+  write("CLAUDE.md", "base docs\n");
+}
+
+function authorPrConfigEdits() {
+  write(".claude/settings.json", '{"from":"pr-author"}\n');
+  write("CLAUDE.md", "pr author docs\n");
+  git("commit", "-qam", "PR author edits config");
+}
+
+describe("auto-commit with restored config paths", () => {
+  test("does not commit the base-branch revert onto the PR branch", async () => {
+    authorPrConfigEdits();
+    simulateRestoredConfig(); // config now reverted + unstaged
+    write("src/app.ts", "claude's real change\n");
+
+    const result = await checkAndCommitOrDeleteBranch(
+      mockOctokit,
+      "owner",
+      "repo",
+      BRANCH,
+      "main",
+      false,
+      [...SENSITIVE_PATHS],
+    );
+
+    expect(filesInHeadCommit()).toEqual(["src/app.ts"]);
+    expect(result.shouldDeleteBranch).toBe(false);
+  });
+
+  test("leaves the reverted config dirty in the working tree", async () => {
+    authorPrConfigEdits();
+    simulateRestoredConfig();
+    write("src/app.ts", "claude's real change\n");
+
+    await checkAndCommitOrDeleteBranch(
+      mockOctokit,
+      "owner",
+      "repo",
+      BRANCH,
+      "main",
+      false,
+      [...SENSITIVE_PATHS],
+    );
+
+    // --name-only gives bare paths, avoiding porcelain's status-column prefix.
+    const stillDirty = git("diff", "--name-only")
+      .split("\n")
+      .filter(Boolean)
+      .sort();
+    expect(stillDirty).toEqual([".claude/settings.json", "CLAUDE.md"]);
+  });
+
+  test("treats a branch whose only change is the revert as empty", async () => {
+    // No real work — just the reverted config. Committing here would push a
+    // pure revert and keep an otherwise-empty branch alive.
+    authorPrConfigEdits();
+    simulateRestoredConfig();
+
+    const before = git("rev-parse", "HEAD");
+    const result = await checkAndCommitOrDeleteBranch(
+      mockOctokit,
+      "owner",
+      "repo",
+      BRANCH,
+      "main",
+      false,
+      [...SENSITIVE_PATHS],
+    );
+
+    expect(git("rev-parse", "HEAD")).toBe(before);
+    expect(result.shouldDeleteBranch).toBe(true);
+    expect(result.branchLink).toBe("");
+  });
+
+  test("still commits Claude's own changes to non-config files", async () => {
+    authorPrConfigEdits();
+    simulateRestoredConfig();
+    write("src/app.ts", "changed\n");
+    write("src/new-file.ts", "added\n");
+
+    await checkAndCommitOrDeleteBranch(
+      mockOctokit,
+      "owner",
+      "repo",
+      BRANCH,
+      "main",
+      false,
+      [...SENSITIVE_PATHS],
+    );
+
+    expect(filesInHeadCommit()).toEqual(["src/app.ts", "src/new-file.ts"]);
+  });
+
+  test("pushes the commit to the branch", async () => {
+    authorPrConfigEdits();
+    simulateRestoredConfig();
+    write("src/app.ts", "claude's real change\n");
+
+    const result = await checkAndCommitOrDeleteBranch(
+      mockOctokit,
+      "owner",
+      "repo",
+      BRANCH,
+      "main",
+      false,
+      [...SENSITIVE_PATHS],
+    );
+
+    const remoteHead = execFileSync(
+      "git",
+      ["--git-dir", remoteDir, "rev-parse", BRANCH],
+      { encoding: "utf-8" },
+    ).trim();
+    expect(remoteHead).toBe(git("rev-parse", "HEAD"));
+    expect(result.branchLink).toContain(BRANCH);
+  });
+});
+
+describe("without restored config paths (the issue path)", () => {
+  test("commits config changes normally, since no revert happened", async () => {
+    // Reached for issues, where restoreConfigFromBase never runs and Claude may
+    // have been asked to edit CLAUDE.md. Excluding it here would drop the work.
+    write("CLAUDE.md", "claude wrote these docs\n");
+    write(".claude/settings.json", '{"written":"by claude"}\n');
+    write("src/app.ts", "and some code\n");
+
+    await checkAndCommitOrDeleteBranch(
+      mockOctokit,
+      "owner",
+      "repo",
+      BRANCH,
+      "main",
+      false,
+      [],
+    );
+
+    expect(filesInHeadCommit()).toEqual([
+      ".claude/settings.json",
+      "CLAUDE.md",
+      "src/app.ts",
+    ]);
+  });
+
+  test("defaults to committing everything when the argument is omitted", async () => {
+    // Backwards compatibility: the parameter is optional.
+    write("CLAUDE.md", "claude wrote these docs\n");
+
+    await checkAndCommitOrDeleteBranch(
+      mockOctokit,
+      "owner",
+      "repo",
+      BRANCH,
+      "main",
+      false,
+    );
+
+    expect(filesInHeadCommit()).toEqual(["CLAUDE.md"]);
+  });
+});

test/branch-template.test.ts

@@ -291,5 +291,68 @@ describe("branch template utilities", () => {
       expect(result).toMatch(/^fix\/pr-456-\d{8}-\d{4}$/);
       expect(result.length).toBeLessThanOrEqual(50);
     });
+
+    // Regression: a title with no ASCII-alphanumeric content makes
+    // {{description}} sanitize to an empty string. Around a slash separator this
+    // previously produced "claude//123", which validateBranchName rejects
+    // ("cannot contain consecutive slashes"), aborting the entire run.
+    it("should collapse the double slash from an empty description (emoji-only title)", () => {
+      const template = "{{prefix}}{{description}}/{{entityNumber}}";
+      const result = generateBranchName(
+        template,
+        "claude/",
+        "issue",
+        123,
+        undefined,
+        undefined,
+        "🎉🎉🎉",
+      );
+
+      expect(result).toBe("claude/123");
+    });
+
+    it("should collapse the double slash for a CJK-only title", () => {
+      const template = "{{prefix}}{{description}}/{{entityNumber}}";
+      const result = generateBranchName(
+        template,
+        "claude/",
+        "issue",
+        123,
+        undefined,
+        undefined,
+        "日本語のタイトル",
+      );
+
+      expect(result).toBe("claude/123");
+    });
+
+    it("should drop a trailing slash left by an empty trailing segment", () => {
+      const template = "{{prefix}}{{entityNumber}}/{{description}}";
+      const result = generateBranchName(
+        template,
+        "claude/",
+        "issue",
+        123,
+        undefined,
+        undefined,
+        "!!! ???",
+      );
+
+      expect(result).toBe("claude/123");
+    });
+
+    it("should produce a name that passes validateBranchName when a segment is empty", () => {
+      const result = generateBranchName(
+        "{{prefix}}{{description}}/{{entityNumber}}",
+        "claude/",
+        "issue",
+        123,
+        undefined,
+        undefined,
+        "🎉",
+      );
+
+      expect(() => validateBranchName(result)).not.toThrow();
+    });
   });
 });

test/comments-common.test.ts

@@ -36,6 +36,12 @@ describe("comments/common", () => {
       );
     });
 
+    test("encodes URL-significant characters in a branch name", () => {
+      expect(createBranchLink("o", "r", "claude/fix#123")).toBe(
+        `\n[View branch](${GITHUB_SERVER_URL}/o/r/tree/claude/fix%23123)`,
+      );
+    });
+
     test("prefixes the link with a newline so it renders on its own line", () => {
       expect(createBranchLink("o", "r", "main").startsWith("\n")).toBe(true);
     });

test/create-prompt.test.ts

@@ -819,11 +819,46 @@ describe("generatePrompt", () => {
     // Should have commit signing tool instructions
     expect(prompt).toContain("mcp__github_file_ops__commit_files");
     expect(prompt).toContain("mcp__github_file_ops__delete_files");
+    expect(prompt).toContain(
+      'mcp__github_file_ops__delete_files: {"paths": ["path/to/old.js"]',
+    );
+    expect(prompt).not.toContain(
+      'mcp__github_file_ops__delete_files: {"files":',
+    );
     // Comment tool should always be from comment server, not file ops
     expect(prompt).toContain("mcp__github_comment__update_claude_comment");
 
     // Should not have git command instructions
     expect(prompt).not.toContain("Use git commands via the Bash tool");
+
+    // Bash is off unless the user passes --allowedTools through claude_args.
+    // allowed_tools was removed in v1.0 and must not appear as live guidance.
+    expect(prompt).toContain(
+      "Run arbitrary Bash commands (unless explicitly allowed via claude_args with --allowedTools)",
+    );
+    expect(prompt).not.toContain("allowed_tools configuration");
+  });
+
+  test("does not mention allowed_tools when commit signing is off", async () => {
+    const envVars: PreparedContext = {
+      repository: "owner/repo",
+      claudeCommentId: "12345",
+      triggerPhrase: "@claude",
+      eventData: {
+        eventName: "issue_comment",
+        commentId: "67890",
+        isPR: true,
+        prNumber: "123",
+        commentBody: "@claude fix the bug",
+      },
+    };
+
+    const prompt = await generatePrompt(envVars, mockGitHubData, false, "tag");
+
+    expect(prompt).not.toContain("allowed_tools");
+    expect(prompt).not.toContain(
+      "Run arbitrary Bash commands (unless explicitly allowed",
+    );
   });
 
   describe("simplified prompt (USE_SIMPLE_PROMPT)", () => {

test/data-fetcher.test.ts

@@ -1215,7 +1215,10 @@ describe("fetchGitHubData integration with time filtering", () => {
                 {
                   id: "2",
                   databaseId: "2",
-                  author: { login: "scanner[bot]" },
+                  // GraphQL returns the bare login for App actors plus
+                  // __typename: "Bot". It does NOT append a "[bot]" suffix the
+                  // way REST does, so this mirrors a real payload.
+                  author: { __typename: "Bot", login: "scanner" },
                   body: "Pre-trigger bot review",
                   state: "COMMENTED",
                   submittedAt: "2024-01-15T11:00:00Z",
@@ -1775,6 +1778,49 @@ describe("fetchGitHubData integration with time filtering", () => {
     // Webhook says no body at trigger time — attacker-added GraphQL body must not be used
     expect(result.contextData.body).toBe("");
   });
+
+  it("should not crash when GraphQL returns null files for a very large PR", async () => {
+    // GitHub declines to compute the diff for very large PRs: `files` comes
+    // back as null (with no errors entry) and `changedFiles` is misreported
+    // as 0. The fetch must degrade gracefully instead of throwing.
+    const mockOctokits = {
+      graphql: jest.fn().mockResolvedValue({
+        repository: {
+          pullRequest: {
+            number: 7912,
+            title: "Very large PR",
+            body: "PR body",
+            author: { login: "author" },
+            createdAt: "2024-01-15T10:00:00Z",
+            state: "OPEN",
+            labels: { nodes: [] },
+            comments: { nodes: [] },
+            files: null,
+            reviews: { nodes: [] },
+          },
+        },
+        user: { login: "trigger-user" },
+      }),
+      rest: {
+        pulls: {
+          listFiles: jest.fn().mockResolvedValue({ data: [] }),
+        },
+      },
+    };
+
+    const result = await fetchGitHubData({
+      octokits: mockOctokits as any,
+      repository: "test-owner/test-repo",
+      prNumber: "7912",
+      isPR: true,
+      triggerUsername: "trigger-user",
+      triggerTime: "2024-01-15T12:00:00Z",
+    });
+
+    // No file list is available, so the PR is processed without file-level context.
+    expect(result.changedFiles).toEqual([]);
+    expect(result.changedFilesWithSHA).toEqual([]);
+  });
 });
 
 describe("filterCommentsByActor", () => {

test/data-formatter.test.ts

@@ -108,6 +108,43 @@ Changed Files: 2 files`,
     );
   });
 
+  test("renders an unknown file count when GraphQL returns null files (very large PR)", () => {
+    // GitHub declines to compute the diff for very large PRs and returns
+    // `files: null`. `changedFiles` is misreported as 0 in that case, so the
+    // count must render as unavailable rather than "0 files".
+    const prData: GitHubPullRequest = {
+      title: "Very large PR",
+      body: "PR body",
+      author: { login: "test-user" },
+      baseRefName: "main",
+      headRefName: "feature/test",
+      headRefOid: "abc123",
+      isCrossRepository: false,
+      headRepository: { owner: { login: "testowner" }, name: "testrepo" },
+      createdAt: "2023-01-01T00:00:00Z",
+      additions: 50,
+      deletions: 30,
+      state: "OPEN",
+      labels: {
+        nodes: [],
+      },
+      commits: {
+        totalCount: 3,
+        nodes: [],
+      },
+      files: null,
+      comments: {
+        nodes: [],
+      },
+      reviews: {
+        nodes: [],
+      },
+    };
+
+    const result = formatContext(prData, true);
+    expect(result).toContain("Changed Files: unknown (file list unavailable)");
+  });
+
   test("formats Issue context correctly", () => {
     const issueData: GitHubIssue = {
       title: "Test Issue",
@@ -471,6 +508,112 @@ describe("formatReviewComments", () => {
     );
   });
 
+  test("includes the diff hunk as context when present", () => {
+    const reviewData = {
+      nodes: [
+        {
+          id: "review1",
+          databaseId: "300001",
+          author: { login: "reviewer1" },
+          body: "",
+          state: "COMMENTED",
+          submittedAt: "2023-01-01T00:00:00Z",
+          comments: {
+            nodes: [
+              {
+                id: "comment1",
+                databaseId: "200001",
+                body: "This can overflow",
+                author: { login: "reviewer1" },
+                createdAt: "2023-01-01T00:00:00Z",
+                path: "src/index.ts",
+                line: 42,
+                diffHunk: "@@ -40,3 +40,3 @@\n-const a = 1;\n+const a = 2;",
+              },
+            ],
+          },
+        },
+      ],
+    };
+
+    const result = formatReviewComments(reviewData);
+
+    expect(result).toContain("[Comment on src/index.ts:42]: This can overflow");
+    expect(result).toContain("Diff context:");
+    expect(result).toContain("@@ -40,3 +40,3 @@");
+    expect(result).toContain("+const a = 2;");
+  });
+
+  test("omits the diff context when the comment has no diff hunk", () => {
+    const reviewData = {
+      nodes: [
+        {
+          id: "review1",
+          databaseId: "300001",
+          author: { login: "reviewer1" },
+          body: "",
+          state: "COMMENTED",
+          submittedAt: "2023-01-01T00:00:00Z",
+          comments: {
+            nodes: [
+              {
+                id: "comment1",
+                databaseId: "200001",
+                body: "No hunk here",
+                author: { login: "reviewer1" },
+                createdAt: "2023-01-01T00:00:00Z",
+                path: "src/index.ts",
+                line: 42,
+              },
+            ],
+          },
+        },
+      ],
+    };
+
+    const result = formatReviewComments(reviewData);
+
+    expect(result).toContain("[Comment on src/index.ts:42]: No hunk here");
+    expect(result).not.toContain("Diff context:");
+  });
+
+  // GitHub returns line: null and diffHunk: "" for outdated comments whose
+  // line no longer exists in the diff (observed on anthropics/claude-code-action#1025).
+  test("omits the diff context for an outdated comment with an empty diff hunk", () => {
+    const reviewData = {
+      nodes: [
+        {
+          id: "review1",
+          databaseId: "300001",
+          author: { login: "reviewer1" },
+          body: "",
+          state: "COMMENTED",
+          submittedAt: "2023-01-01T00:00:00Z",
+          comments: {
+            nodes: [
+              {
+                id: "comment1",
+                databaseId: "200001",
+                body: "Outdated comment",
+                author: { login: "reviewer1" },
+                createdAt: "2023-01-01T00:00:00Z",
+                path: "src/index.ts",
+                line: null,
+                diffHunk: "",
+              },
+            ],
+          },
+        },
+      ],
+    };
+
+    const result = formatReviewComments(reviewData);
+
+    expect(result).toContain("[Comment on src/index.ts:?]: Outdated comment");
+    expect(result).not.toContain("Diff context:");
+    expect(result).not.toContain("```diff");
+  });
+
   test("formats review with only body (no comments) correctly", () => {
     const reviewData = {
       nodes: [

test/delete-files-prompt-schema.test.ts

@@ -0,0 +1,169 @@
+#!/usr/bin/env bun
+
+import { describe, expect, test, beforeAll } from "bun:test";
+import { generatePrompt } from "../src/create-prompt";
+import type { PreparedContext } from "../src/create-prompt";
+import {
+  commitFilesPayloadSchema,
+  deleteFilesPayloadSchema,
+} from "../src/mcp/github-file-ops-schemas";
+
+beforeAll(() => {
+  process.env.GITHUB_ACTION_PATH = "/test/action/path";
+});
+
+const mockGitHubData = {
+  contextData: {
+    title: "Test PR",
+    body: "This is a test PR",
+    author: { login: "testuser" },
+    state: "OPEN",
+    labels: { nodes: [] },
+    createdAt: "2023-01-01T00:00:00Z",
+    additions: 15,
+    deletions: 5,
+    baseRefName: "main",
+    headRefName: "feature-branch",
+    headRefOid: "abc123",
+    isCrossRepository: false,
+    headRepository: { owner: { login: "testowner" }, name: "testrepo" },
+    commits: { totalCount: 0, nodes: [] },
+    files: { nodes: [] },
+    comments: { nodes: [] },
+    reviews: { nodes: [] },
+  },
+  comments: [],
+  changedFiles: [],
+  changedFilesWithSHA: [],
+  reviewData: null,
+  imageUrlMap: new Map<string, string>(),
+};
+
+const signingContext: PreparedContext = {
+  repository: "owner/repo",
+  claudeCommentId: "12345",
+  triggerPhrase: "@claude",
+  eventData: {
+    eventName: "issue_comment",
+    commentId: "67890",
+    isPR: true,
+    prNumber: "123",
+    commentBody: "@claude delete the old file",
+  },
+};
+
+function extractToolExample(
+  prompt: string,
+  tool: string,
+): Record<string, unknown> {
+  const match = prompt.match(
+    new RegExp(
+      `${tool.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}:\\s*(\\{[^}]+\\})`,
+    ),
+  );
+  if (!match) {
+    throw new Error(`No JSON example for ${tool} in prompt`);
+  }
+  return JSON.parse(match[1] as string);
+}
+
+describe("delete_files prompt vs live MCP schema (#1665)", () => {
+  test("the payload the old prompt taught is rejected by the tool schema", () => {
+    const taughtByOldPrompt = {
+      files: ["path/to/old.js"],
+      message: "chore: remove deprecated file",
+    };
+    const result = deleteFilesPayloadSchema.safeParse(taughtByOldPrompt);
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      const fields = result.error.issues.map((issue) => issue.path.join("."));
+      expect(fields).toContain("paths");
+    }
+  });
+
+  test("the payload the new prompt teaches is accepted by the tool schema", () => {
+    const taughtByNewPrompt = {
+      paths: ["path/to/old.js"],
+      message: "chore: remove deprecated file",
+    };
+    const result = deleteFilesPayloadSchema.safeParse(taughtByNewPrompt);
+    expect(result.success).toBe(true);
+  });
+
+  test("generated tag-mode prompt example parses against the live schema", async () => {
+    const prompt = await generatePrompt(
+      signingContext,
+      mockGitHubData,
+      true,
+      "tag",
+    );
+    const example = extractToolExample(
+      prompt,
+      "mcp__github_file_ops__delete_files",
+    );
+    expect(example).toHaveProperty("paths");
+    expect(example).not.toHaveProperty("files");
+    const result = deleteFilesPayloadSchema.safeParse(example);
+    expect(result.success).toBe(true);
+  });
+
+  test("rejects paths when the value is a string instead of an array", () => {
+    const result = deleteFilesPayloadSchema.safeParse({
+      paths: "path/to/old.js",
+      message: "chore: remove deprecated file",
+    });
+    expect(result.success).toBe(false);
+  });
+
+  test("rejects a payload that has paths but omits message", () => {
+    const result = deleteFilesPayloadSchema.safeParse({
+      paths: ["path/to/old.js"],
+    });
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(
+        result.error.issues.map((issue) => issue.path.join(".")),
+      ).toContain("message");
+    }
+  });
+
+  test("accepts a payload that still includes the old files key beside paths", () => {
+    const result = deleteFilesPayloadSchema.safeParse({
+      files: ["path/to/old.js"],
+      paths: ["path/to/old.js"],
+      message: "chore: remove deprecated file",
+    });
+    expect(result.success).toBe(true);
+  });
+
+  test("does not change commit_files — that sibling tool still requires files", async () => {
+    const prompt = await generatePrompt(
+      signingContext,
+      mockGitHubData,
+      true,
+      "tag",
+    );
+    const example = extractToolExample(
+      prompt,
+      "mcp__github_file_ops__commit_files",
+    );
+    expect(example).toHaveProperty("files");
+    expect(example).not.toHaveProperty("paths");
+    expect(commitFilesPayloadSchema.safeParse(example).success).toBe(true);
+    expect(deleteFilesPayloadSchema.safeParse(example).success).toBe(false);
+  });
+
+  test("generated delete_files example keys are exactly paths and message", async () => {
+    const prompt = await generatePrompt(
+      signingContext,
+      mockGitHubData,
+      true,
+      "tag",
+    );
+    const example = extractToolExample(
+      prompt,
+      "mcp__github_file_ops__delete_files",
+    );
+    expect(Object.keys(example).sort()).toEqual(["message", "paths"]);
+  });
+});

test/fetch-depth.test.ts

@@ -0,0 +1,116 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { execFileSync } from "child_process";
+import { mkdtempSync, rmSync, writeFileSync } from "fs";
+import { join } from "path";
+import { setupBranch } from "../src/github/operations/branch";
+import { fetchDepthArgs } from "../src/github/operations/fetch-depth";
+import { createMockContext } from "./mockContext";
+
+const octokits = {
+  rest: {
+    repos: { get: async () => ({ data: { default_branch: "main" } }) },
+    git: { getRef: async () => ({ data: { object: { sha: "abc1234" } } }) },
+  },
+} as any;
+
+const githubData = {
+  contextData: { title: "Add feature", labels: { nodes: [] } },
+} as any;
+
+describe("setupBranch fetch depth", () => {
+  let originalCwd: string;
+  let tempDir = "";
+  let repoDir: string;
+
+  beforeEach(() => {
+    originalCwd = process.cwd();
+    tempDir = mkdtempSync(join("/tmp", "fetch-depth-"));
+    repoDir = join(tempDir, "repo");
+    const remoteDir = join(tempDir, "origin.git");
+
+    // Pin the remote's HEAD to main: with the default init.defaultBranch of
+    // master it would dangle, and `git clone --depth=1` (which implies
+    // --single-branch) then produces an empty, non-shallow clone.
+    execFileSync(
+      "git",
+      ["init", "--bare", "--initial-branch=main", remoteDir],
+      {
+        stdio: "pipe",
+      },
+    );
+    execFileSync("git", ["init", repoDir], { stdio: "pipe" });
+    git(["checkout", "-b", "main"]);
+    git(["config", "user.email", "test@example.com"]);
+    git(["config", "user.name", "Test User"]);
+
+    for (const message of ["first", "second", "third"]) {
+      writeFileSync(join(repoDir, `${message}.txt`), `${message}\n`);
+      git(["add", "."]);
+      git(["commit", "-m", message]);
+    }
+
+    git(["remote", "add", "origin", remoteDir]);
+    git(["push", "-u", "origin", "main"]);
+
+    process.chdir(repoDir);
+  });
+
+  afterEach(() => {
+    process.chdir(originalCwd);
+    if (tempDir) {
+      rmSync(tempDir, { recursive: true, force: true });
+    }
+  });
+
+  for (const useCommitSigning of [false, true]) {
+    test(`keeps the full history of a complete checkout with use_commit_signing: ${useCommitSigning}`, async () => {
+      const context = createMockContext({
+        isPR: false,
+        entityNumber: 7,
+        inputs: { useCommitSigning, branchPrefix: "claude/" },
+      });
+
+      await setupBranch(octokits, githubData, context);
+
+      expect(git(["rev-parse", "--is-shallow-repository"]).trim()).toBe(
+        "false",
+      );
+      expect(git(["rev-list", "--count", "HEAD"]).trim()).toBe("3");
+    });
+  }
+
+  test("still limits the depth on an already shallow checkout", () => {
+    const shallowDir = join(tempDir, "shallow");
+    execFileSync(
+      "git",
+      [
+        "clone",
+        "--depth=1",
+        `file://${join(tempDir, "origin.git")}`,
+        shallowDir,
+      ],
+      { stdio: "pipe" },
+    );
+
+    process.chdir(shallowDir);
+    expect(
+      execFileSync("git", ["rev-parse", "--is-shallow-repository"], {
+        cwd: shallowDir,
+        encoding: "utf8",
+      }).trim(),
+    ).toBe("true");
+    expect(fetchDepthArgs(20)).toEqual(["--depth=20"]);
+  });
+
+  test("drops the depth limit on a complete checkout", () => {
+    expect(fetchDepthArgs(20)).toEqual([]);
+  });
+
+  function git(args: string[]): string {
+    return execFileSync("git", args, {
+      cwd: repoDir,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+  }
+});

test/fixtures/graphql-endpoint-probe.ts

@@ -0,0 +1,41 @@
+// Wire-level probe for the GitHub API client's endpoint routing.
+//
+// `src/github/api/config.ts` reads GITHUB_API_URL / GITHUB_GRAPHQL_URL at module
+// load time, so each endpoint configuration has to be exercised in its own fresh
+// process (the companion test spawns this file once per case with the relevant
+// env vars set). We stub global fetch to capture the FINAL request URL and
+// Authorization header — asserting constructor options is not enough because
+// @octokit/graphql rewrites/append the path (".../api/v3" -> ".../api/graphql",
+// otherwise it appends "/graphql") after the client is constructed.
+import { createOctokit } from "../../src/github/api/client";
+
+type Captured = { url: string; auth: string | null };
+const captured: Captured[] = [];
+
+globalThis.fetch = (async (input: any, init?: any) => {
+  const url: string =
+    typeof input === "string" ? input : (input?.url ?? String(input));
+  const headers = new Headers(init?.headers ?? input?.headers);
+  captured.push({ url, auth: headers.get("authorization") });
+  return new Response(JSON.stringify({ data: {} }), {
+    status: 200,
+    headers: { "content-type": "application/json" },
+  });
+}) as typeof fetch;
+
+const octokits = createOctokit("test-token");
+
+await octokits.graphql(`query { viewer { login } }`);
+const graphql = captured[captured.length - 1]!;
+
+await octokits.rest.request("GET /meta");
+const rest = captured[captured.length - 1]!;
+
+process.stdout.write(
+  JSON.stringify({
+    graphqlUrl: graphql.url,
+    graphqlAuth: graphql.auth,
+    restUrl: rest.url,
+    restAuth: rest.auth,
+  }),
+);

test/format-turns.test.ts

@@ -111,6 +111,42 @@ describe("formatResultContent", () => {
     const result = formatResultContent(JSON.stringify(structuredContent));
     expect(result).toBe("**→** Hello world\n\n");
   });
+
+  test("keeps every text block, not just the first", () => {
+    const structuredContent = [
+      { type: "text", text: "first line" },
+      { type: "text", text: "second line" },
+      { type: "text", text: "third line" },
+    ];
+    const result = formatResultContent(JSON.stringify(structuredContent));
+
+    expect(result).toContain("first line");
+    expect(result).toContain("second line");
+    expect(result).toContain("third line");
+  });
+
+  test("keeps every text block when given an array directly", () => {
+    const result = formatResultContent([
+      { type: "text", text: "alpha" },
+      { type: "text", text: "beta" },
+    ]);
+
+    expect(result).toContain("alpha");
+    expect(result).toContain("beta");
+  });
+
+  test("skips non-text blocks while keeping the text ones", () => {
+    const structuredContent = [
+      { type: "text", text: "visible" },
+      { type: "image", source: { data: "ignored-binary" } },
+      { type: "text", text: "also visible" },
+    ];
+    const result = formatResultContent(JSON.stringify(structuredContent));
+
+    expect(result).toContain("visible");
+    expect(result).toContain("also visible");
+    expect(result).not.toContain("ignored-binary");
+  });
 });
 
 describe("formatToolWithResult", () => {
@@ -467,6 +503,15 @@ describe("formatResultContent non-string input", () => {
     expect(typeof result).toBe("string");
     expect(result.length).toBeGreaterThan(0);
   });
+
+  test("handles a text content block whose text field is not a string", () => {
+    expect(() =>
+      formatResultContent('[{"type":"text","text":{"foo":"bar"}}]'),
+    ).not.toThrow();
+    expect(formatResultContent('[{"type":"text","text":123}]')).toContain(
+      "123",
+    );
+  });
 });
 
 describe("system_other handling", () => {
@@ -515,3 +560,106 @@ describe("system_other handling", () => {
     expect(result).toContain("## 🚀 System Initialization");
   });
 });
+
+describe("credential redaction", () => {
+  test("redacts credentials embedded in tool results", () => {
+    const data: Turn[] = [
+      {
+        type: "assistant",
+        message: {
+          content: [
+            {
+              type: "tool_use",
+              id: "toolu_1",
+              name: "Bash",
+              input: { command: "cat .env" },
+            },
+          ],
+        },
+      },
+      {
+        type: "user",
+        message: {
+          content: [
+            {
+              type: "tool_result",
+              tool_use_id: "toolu_1",
+              content:
+                "GITHUB_TOKEN=ghs_xz7yzju2SZjGPa0dUNMAx0SH4xDOCS31LXQW\nAWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE",
+            },
+          ],
+        },
+      },
+    ];
+
+    const result = formatTurnsFromData(data);
+
+    expect(result).toContain("[REDACTED_GITHUB_TOKEN]");
+    expect(result).toContain("[REDACTED_AWS_KEY_ID]");
+    expect(result).not.toContain("ghs_xz7yzju2SZjGPa0dUNMAx0SH4xDOCS31LXQW");
+    expect(result).not.toContain("AKIAIOSFODNN7EXAMPLE");
+  });
+
+  test("redacts credentials embedded in multi-line tool inputs", () => {
+    const data: Turn[] = [
+      {
+        type: "assistant",
+        message: {
+          content: [
+            {
+              type: "tool_use",
+              id: "toolu_2",
+              name: "Write",
+              input: {
+                file_path: ".env",
+                content:
+                  "AWS_ACCESS_KEY_ID=x\nGITHUB_TOKEN=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\n",
+              },
+            },
+          ],
+        },
+      },
+    ];
+
+    const result = formatTurnsFromData(data);
+
+    expect(result).toContain("[REDACTED_GITHUB_TOKEN]");
+    expect(result).not.toContain("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");
+  });
+
+  test("redacts credentials wrapped in ANSI color codes", () => {
+    const key = "sk-ant-api03-AbCdEfGhIjKlMnOpQrStUvWxYz0123456789_-abcdefgh";
+    const data: Turn[] = [
+      {
+        type: "assistant",
+        message: {
+          content: [
+            {
+              type: "tool_use",
+              id: "toolu_3",
+              name: "Bash",
+              input: { command: "node print-config.js" },
+            },
+          ],
+        },
+      },
+      {
+        type: "user",
+        message: {
+          content: [
+            {
+              type: "tool_result",
+              tool_use_id: "toolu_3",
+              content: `apiKey: \x1b[32m${key}\x1b[39m\nregion: us-east-1`,
+            },
+          ],
+        },
+      },
+    ];
+
+    const result = formatTurnsFromData(data);
+
+    expect(result).toContain("[REDACTED_ANTHROPIC_KEY]");
+    expect(result).not.toContain(key);
+  });
+});

test/git-config.test.ts

@@ -0,0 +1,193 @@
+import { afterEach, beforeEach, describe, expect, spyOn, test } from "bun:test";
+import { execFileSync } from "child_process";
+import { mkdtempSync, rmSync, statSync } from "fs";
+import { tmpdir } from "os";
+import { join } from "path";
+import {
+  configureGitAuth,
+  replaceCheckoutCredentials,
+} from "../src/github/operations/git-config";
+import { GITHUB_SERVER_URL } from "../src/github/api/config";
+import { createMockAutomationContext } from "./mockContext";
+
+// Derive host-specific expectations from GITHUB_SERVER_URL so the suite passes
+// on GHES runners (where Actions exports that variable) as well as github.com.
+const SERVER = new URL(GITHUB_SERVER_URL);
+const NOREPLY_DOMAIN =
+  SERVER.hostname === "github.com"
+    ? "users.noreply.github.com"
+    : `users.noreply.${SERVER.hostname}`;
+const EXTRAHEADER_KEY = `http.${GITHUB_SERVER_URL}/.extraheader`;
+
+// git exports these into hooks (e.g. a pre-commit hook running the test
+// suite); if inherited they would point every git command below at the
+// enclosing repository instead of the temp repo.
+const GIT_ENV_OVERRIDES = [
+  "GIT_DIR",
+  "GIT_WORK_TREE",
+  "GIT_INDEX_FILE",
+  "GIT_COMMON_DIR",
+  "GIT_PREFIX",
+] as const;
+
+// Pass an explicit env copy: unlike bun's `$`, execFileSync does not pick up
+// deletions from process.env, so the GIT_* overrides removed in beforeEach
+// would otherwise still reach the child process.
+function runGit(args: string[], cwd?: string): string {
+  return execFileSync("git", args, {
+    cwd,
+    encoding: "utf8",
+    stdio: "pipe",
+    env: { ...process.env },
+  }).trim();
+}
+
+function gitConfigGetAll(key: string): string {
+  try {
+    return runGit(["config", "--local", "--get-all", key]);
+  } catch {
+    return "";
+  }
+}
+
+function remoteUrl(): string {
+  return runGit(["remote", "get-url", "origin"]);
+}
+
+describe("git-config", () => {
+  let originalCwd: string;
+  let tempDir: string;
+  let repoDir: string;
+  let originalActionPath: string | undefined;
+  let originalNonWriteUsers: string | undefined;
+  let originalGhToken: string | undefined;
+  let originalGitEnv: Record<string, string | undefined>;
+  let consoleLogSpy: any;
+
+  beforeEach(() => {
+    originalCwd = process.cwd();
+    originalActionPath = process.env.GITHUB_ACTION_PATH;
+    originalNonWriteUsers = process.env.ALLOWED_NON_WRITE_USERS;
+    originalGhToken = process.env.GH_TOKEN;
+    delete process.env.ALLOWED_NON_WRITE_USERS;
+    originalGitEnv = {};
+    for (const name of GIT_ENV_OVERRIDES) {
+      originalGitEnv[name] = process.env[name];
+      delete process.env[name];
+    }
+
+    tempDir = mkdtempSync(join(tmpdir(), "git-config-test-"));
+    repoDir = join(tempDir, "repo");
+    runGit(["init", repoDir]);
+    process.env.GITHUB_ACTION_PATH = tempDir;
+    process.chdir(repoDir);
+
+    git(["remote", "add", "origin", `https://${SERVER.host}/test/repo.git`]);
+    // Mimic the credential actions/checkout persists in the local config
+    git([
+      "config",
+      "--local",
+      "--add",
+      EXTRAHEADER_KEY,
+      "AUTHORIZATION: basic one",
+    ]);
+    git([
+      "config",
+      "--local",
+      "--add",
+      EXTRAHEADER_KEY,
+      "AUTHORIZATION: basic two",
+    ]);
+    git(["config", "--local", "user.name", "pre-existing"]);
+
+    consoleLogSpy = spyOn(console, "log").mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    process.chdir(originalCwd);
+    rmSync(tempDir, { recursive: true, force: true });
+    consoleLogSpy?.mockRestore();
+    restoreEnv("GITHUB_ACTION_PATH", originalActionPath);
+    restoreEnv("ALLOWED_NON_WRITE_USERS", originalNonWriteUsers);
+    restoreEnv("GH_TOKEN", originalGhToken);
+    for (const name of GIT_ENV_OVERRIDES) {
+      restoreEnv(name, originalGitEnv[name]);
+    }
+  });
+
+  describe("replaceCheckoutCredentials", () => {
+    test("removes the checkout extraheader and sets a token remote URL", async () => {
+      expect(gitConfigGetAll(EXTRAHEADER_KEY)).toContain("AUTHORIZATION");
+
+      await replaceCheckoutCredentials(
+        "test-token",
+        createMockAutomationContext(),
+      );
+
+      expect(gitConfigGetAll(EXTRAHEADER_KEY)).toBe("");
+      expect(remoteUrl()).toBe(
+        `https://x-access-token:test-token@${SERVER.host}/test-owner/test-repo.git`,
+      );
+      // Only the credential is touched — the git identity is left alone
+      expect(gitConfigGetAll("user.name")).toBe("pre-existing");
+    });
+
+    test("uses a credential helper when non-write users are allowed", async () => {
+      process.env.ALLOWED_NON_WRITE_USERS = "someone";
+
+      await replaceCheckoutCredentials(
+        "helper-token",
+        createMockAutomationContext(),
+      );
+
+      expect(gitConfigGetAll(EXTRAHEADER_KEY)).toBe("");
+      expect(remoteUrl()).toBe(
+        `https://${SERVER.host}/test-owner/test-repo.git`,
+      );
+      const helperPath = join(tempDir, ".git-credential-gh-token");
+      expect(gitConfigGetAll("credential.helper")).toBe(helperPath);
+      expect(statSync(helperPath).mode & 0o777).toBe(0o700);
+      expect(process.env.GH_TOKEN).toBe("helper-token");
+    });
+
+    test("succeeds when there is no checkout extraheader to remove", async () => {
+      git(["config", "--local", "--unset-all", EXTRAHEADER_KEY]);
+
+      await expect(
+        replaceCheckoutCredentials("test-token", createMockAutomationContext()),
+      ).resolves.toBeUndefined();
+
+      expect(remoteUrl()).toContain("x-access-token:test-token@");
+    });
+  });
+
+  describe("configureGitAuth", () => {
+    test("configures the git user and replaces the checkout credential", async () => {
+      await configureGitAuth("test-token", createMockAutomationContext(), {
+        login: "claude[bot]",
+        id: 42,
+      });
+
+      expect(gitConfigGetAll("user.name")).toBe("claude[bot]");
+      expect(gitConfigGetAll("user.email")).toBe(
+        `42+claude[bot]@${NOREPLY_DOMAIN}`,
+      );
+      expect(gitConfigGetAll(EXTRAHEADER_KEY)).toBe("");
+      expect(remoteUrl()).toBe(
+        `https://x-access-token:test-token@${SERVER.host}/test-owner/test-repo.git`,
+      );
+    });
+  });
+
+  function git(args: string[]): void {
+    runGit(args, repoDir);
+  }
+});
+
+function restoreEnv(name: string, value: string | undefined): void {
+  if (value === undefined) {
+    delete process.env[name];
+  } else {
+    process.env[name] = value;
+  }
+}

test/github-actions-pagination.test.ts

@@ -0,0 +1,49 @@
+import { describe, expect, test } from "bun:test";
+import type { Octokit } from "@octokit/rest";
+import {
+  listWorkflowJobs,
+  listWorkflowRuns,
+} from "../src/mcp/github-actions-pagination";
+
+function createPaginatedClient<T>(pages: T[][]) {
+  const request = async () => ({ data: pages[0] });
+  const client = {
+    actions: {
+      listWorkflowRunsForRepo: request,
+      listJobsForWorkflowRun: request,
+    },
+    paginate: async () => pages.flat(),
+  } as unknown as Octokit;
+
+  return client;
+}
+
+describe("GitHub Actions pagination", () => {
+  test("returns workflow runs from every page", async () => {
+    const firstPage = [{ id: 1 }, { id: 2 }];
+    const secondPage = [{ id: 3 }];
+    const client = createPaginatedClient([firstPage, secondPage]);
+
+    const runs = await listWorkflowRuns(client, {
+      owner: "owner",
+      repo: "repo",
+      head_sha: "sha",
+    });
+
+    expect(runs.map((run) => run.id)).toEqual([1, 2, 3]);
+  });
+
+  test("returns workflow jobs from every page", async () => {
+    const firstPage = [{ id: 1 }, { id: 2 }];
+    const secondPage = [{ id: 3 }];
+    const client = createPaginatedClient([firstPage, secondPage]);
+
+    const jobs = await listWorkflowJobs(client, {
+      owner: "owner",
+      repo: "repo",
+      run_id: 123,
+    });
+
+    expect(jobs.map((job) => job.id)).toEqual([1, 2, 3]);
+  });
+});

test/github-actions-server.test.ts

@@ -0,0 +1,94 @@
+import { describe, test, expect, afterEach } from "bun:test";
+import { readFile, rm } from "fs/promises";
+import os from "os";
+import path from "path";
+import { downloadJobLog } from "../src/mcp/github-actions-server";
+import type { Octokit } from "@octokit/rest";
+
+describe("downloadJobLog", () => {
+  const tmpDirs: string[] = [];
+
+  const makeRunnerTemp = () => {
+    const dir = path.join(
+      os.tmpdir(),
+      `download-job-log-test-${Date.now()}-${Math.random().toString(36).slice(2)}`,
+    );
+    tmpDirs.push(dir);
+    return dir;
+  };
+
+  afterEach(async () => {
+    while (tmpDirs.length) {
+      const dir = tmpDirs.pop()!;
+      await rm(dir, { recursive: true, force: true });
+    }
+  });
+
+  const createStallingClient = (): {
+    client: Octokit;
+    getSignal: () => AbortSignal | undefined;
+  } => {
+    let signal: AbortSignal | undefined;
+    const client = {
+      actions: {
+        downloadJobLogsForWorkflowRun: (params: {
+          request?: { signal?: AbortSignal };
+        }) => {
+          signal = params.request?.signal;
+          return new Promise((_resolve, reject) => {
+            signal?.addEventListener("abort", () => {
+              reject(new Error("This operation was aborted"));
+            });
+            // Otherwise never settles, simulating a stalled fetch.
+          });
+        },
+      },
+    } as unknown as Octokit;
+    return { client, getSignal: () => signal };
+  };
+
+  test("rejects with a timeout instead of hanging when the download stalls", async () => {
+    const { client, getSignal } = createStallingClient();
+    const runnerTemp = makeRunnerTemp();
+
+    await expect(
+      downloadJobLog(
+        client,
+        { owner: "owner", repo: "repo", job_id: 123 },
+        runnerTemp,
+        5,
+      ),
+    ).rejects.toThrow();
+
+    expect(getSignal()?.aborted).toBe(true);
+  });
+
+  test("writes the log to disk and clears the timeout when the download succeeds", async () => {
+    const runnerTemp = makeRunnerTemp();
+    const client = {
+      actions: {
+        downloadJobLogsForWorkflowRun: async (params: {
+          request?: { signal?: AbortSignal };
+        }) => {
+          expect(params.request?.signal?.aborted).toBe(false);
+          return { data: "log line 1\nlog line 2\n" };
+        },
+      },
+    } as unknown as Octokit;
+
+    const result = await downloadJobLog(
+      client,
+      { owner: "owner", repo: "repo", job_id: 456 },
+      runnerTemp,
+      30_000,
+    );
+
+    expect(result.path).toBe(`${runnerTemp}/github-ci-logs/job-456.log`);
+    expect(result.size_bytes).toBe(
+      Buffer.byteLength("log line 1\nlog line 2\n", "utf-8"),
+    );
+
+    const written = await readFile(result.path, "utf-8");
+    expect(written).toBe("log line 1\nlog line 2\n");
+  });
+});

test/github-graphql-url.test.ts

@@ -0,0 +1,121 @@
+import { describe, expect, test } from "bun:test";
+import { join } from "node:path";
+
+// The GitHub client reads GITHUB_API_URL / GITHUB_GRAPHQL_URL when
+// `src/github/api/config.ts` is first imported, so we cannot flip env vars
+// between cases inside a single process. Instead each case runs the real
+// `createOctokit` factory in a fresh Bun process (test/fixtures/graphql-endpoint-probe.ts)
+// with a stubbed fetch that reports the FINAL wire URL and Authorization header.
+//
+// This is the level that matters: @octokit/graphql derives the GraphQL endpoint
+// from its baseUrl AFTER construction (rewriting a REST ".../api/v3" base to
+// ".../api/graphql", and otherwise appending "/graphql"), so a constructor-option
+// assertion would not catch a regression.
+
+const PROBE = join(import.meta.dir, "fixtures", "graphql-endpoint-probe.ts");
+
+type ProbeResult = {
+  graphqlUrl: string;
+  graphqlAuth: string | null;
+  restUrl: string;
+  restAuth: string | null;
+};
+
+function probe(env: Record<string, string>): ProbeResult {
+  const result = Bun.spawnSync({
+    cmd: ["bun", "run", PROBE],
+    env: {
+      ...process.env,
+      // Start from a clean slate so the host's own env cannot leak in.
+      GITHUB_API_URL: "",
+      GITHUB_GRAPHQL_URL: "",
+      ...env,
+    },
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+
+  if (result.exitCode !== 0) {
+    throw new Error(
+      `probe failed (exit ${result.exitCode}): ${result.stderr.toString()}`,
+    );
+  }
+
+  return JSON.parse(result.stdout.toString().trim()) as ProbeResult;
+}
+
+describe("GitHub API client endpoint routing", () => {
+  test("both env vars unset: REST and GraphQL use github.com", () => {
+    const r = probe({});
+    expect(r.restUrl).toBe("https://api.github.com/meta");
+    expect(r.graphqlUrl).toBe("https://api.github.com/graphql");
+  });
+
+  test("GITHUB_API_URL alone (GHES): GraphQL still resolves to /api/graphql", () => {
+    // Regression guard: @octokit/graphql rewrites a ".../api/v3" REST base to
+    // ".../api/graphql", so GraphQL must keep working when only GITHUB_API_URL
+    // is provided (e.g. under `act` or partial configs).
+    const r = probe({ GITHUB_API_URL: "https://ghe.example.test/api/v3" });
+    expect(r.restUrl).toBe("https://ghe.example.test/api/v3/meta");
+    expect(r.graphqlUrl).toBe("https://ghe.example.test/api/graphql");
+  });
+
+  test("GITHUB_GRAPHQL_URL alone: GraphQL honors it exactly, REST stays public", () => {
+    const r = probe({
+      GITHUB_GRAPHQL_URL: "https://ghe.example.test/api/graphql",
+    });
+    expect(r.graphqlUrl).toBe("https://ghe.example.test/api/graphql");
+    expect(r.restUrl).toBe("https://api.github.com/meta");
+  });
+
+  test("both set to standard GHES values: REST and GraphQL route independently", () => {
+    const r = probe({
+      GITHUB_API_URL: "https://ghe.example.test/api/v3",
+      GITHUB_GRAPHQL_URL: "https://ghe.example.test/api/graphql",
+    });
+    expect(r.restUrl).toBe("https://ghe.example.test/api/v3/meta");
+    expect(r.graphqlUrl).toBe("https://ghe.example.test/api/graphql");
+  });
+
+  test("GITHUB_GRAPHQL_URL wins over a GITHUB_API_URL-derived endpoint", () => {
+    // Distinguishing case: without honoring GITHUB_GRAPHQL_URL, GraphQL would be
+    // derived from GITHUB_API_URL and hit the wrong host.
+    const r = probe({
+      GITHUB_API_URL: "https://ghe.example.test/api/v3",
+      GITHUB_GRAPHQL_URL: "https://gql.example.test/api/graphql",
+    });
+    expect(r.graphqlUrl).toBe("https://gql.example.test/api/graphql");
+    expect(r.restUrl).toBe("https://ghe.example.test/api/v3/meta");
+  });
+
+  test("trailing slash on GITHUB_GRAPHQL_URL is normalized", () => {
+    const r = probe({
+      GITHUB_GRAPHQL_URL: "https://ghe.example.test/api/graphql/",
+    });
+    expect(r.graphqlUrl).toBe("https://ghe.example.test/api/graphql");
+  });
+
+  test("GITHUB_GRAPHQL_URL without a /graphql suffix is preserved before the client appends one", () => {
+    const r = probe({
+      GITHUB_GRAPHQL_URL: "https://gql.example.test/custom",
+    });
+    expect(r.graphqlUrl).toBe("https://gql.example.test/custom/graphql");
+  });
+
+  test("a base already ending in /graphql is not doubled", () => {
+    const r = probe({
+      GITHUB_GRAPHQL_URL: "https://gql.example.test/api/graphql",
+    });
+    expect(r.graphqlUrl).not.toContain("/graphql/graphql");
+    expect(r.graphqlUrl).toBe("https://gql.example.test/api/graphql");
+  });
+
+  test("the token authorization header is preserved on both clients", () => {
+    const r = probe({
+      GITHUB_API_URL: "https://ghe.example.test/api/v3",
+      GITHUB_GRAPHQL_URL: "https://ghe.example.test/api/graphql",
+    });
+    expect(r.graphqlAuth).toBe("token test-token");
+    expect(r.restAuth).toBe("token test-token");
+  });
+});

test/image-downloader.test.ts

@@ -148,7 +148,9 @@ describe("downloadCommentImages", () => {
       mediaType: { format: "full+json" },
     });
 
-    expect(fetchSpy).toHaveBeenCalledWith(signedUrl);
+    expect(fetchSpy).toHaveBeenCalledWith(signedUrl, {
+      signal: expect.any(AbortSignal),
+    });
     expect(fsWriteFileSpy).toHaveBeenCalledWith(
       "/tmp/github-images/image-1704067200000-0.png",
       Buffer.from(mockArrayBuffer),
@@ -481,8 +483,12 @@ describe("downloadCommentImages", () => {
     );
 
     expect(fetchSpy).toHaveBeenCalledTimes(2);
-    expect(fetchSpy).toHaveBeenNthCalledWith(1, signedUrl1);
-    expect(fetchSpy).toHaveBeenNthCalledWith(2, signedUrl2);
+    expect(fetchSpy).toHaveBeenNthCalledWith(1, signedUrl1, {
+      signal: expect.any(AbortSignal),
+    });
+    expect(fetchSpy).toHaveBeenNthCalledWith(2, signedUrl2, {
+      signal: expect.any(AbortSignal),
+    });
     expect(result.get(imageUrl1)).toBe(
       "/tmp/github-images/image-1704067200000-0.png",
     );
@@ -523,7 +529,9 @@ describe("downloadCommentImages", () => {
       comments,
     );
 
-    expect(fetchSpy).toHaveBeenCalledWith(signedUrl);
+    expect(fetchSpy).toHaveBeenCalledWith(signedUrl, {
+      signal: expect.any(AbortSignal),
+    });
     expect(result.get(imageUrl)).toBe(
       "/tmp/github-images/image-1704067200000-0.png",
     );
@@ -766,6 +774,95 @@ describe("downloadCommentImages", () => {
     );
   });
 
+  test("should skip an image when the fetch times out", async () => {
+    const mockOctokit = createMockOctokit();
+    const imageUrl = assetUrl(GUID_1);
+    const signedUrl = signedUrlFor(GUID_1, ".png");
+    let signal: AbortSignal | null | undefined;
+
+    // @ts-expect-error Mock implementation doesn't match full type signature
+    mockOctokit.rest.issues.getComment = jest.fn().mockResolvedValue({
+      data: {
+        body_html: `<img src="${signedUrl}">`,
+      },
+    });
+
+    fetchSpy = spyOn(global, "fetch");
+    fetchSpy.mockImplementation((_input: unknown, init?: RequestInit) => {
+      signal = init?.signal;
+      return new Promise<Response>(() => {});
+    });
+
+    const result = await downloadCommentImages(
+      mockOctokit,
+      "owner",
+      "repo",
+      [
+        {
+          type: "issue_comment",
+          id: "445",
+          body: `Stalled image: ![stalled](${imageUrl})`,
+        },
+      ],
+      { timeoutMs: 5 },
+    );
+
+    expect(result.size).toBe(0);
+    expect(signal?.aborted).toBe(true);
+    expect(consoleErrorSpy).toHaveBeenCalledWith(
+      expect.stringContaining("Failed to download"),
+      expect.objectContaining({
+        message: "Image download timed out after 5ms",
+      }),
+    );
+  });
+
+  test("should time out while reading a response body", async () => {
+    const mockOctokit = createMockOctokit();
+    const imageUrl = assetUrl(GUID_1);
+    const signedUrl = signedUrlFor(GUID_1, ".png");
+    let signal: AbortSignal | null | undefined;
+
+    // @ts-expect-error Mock implementation doesn't match full type signature
+    mockOctokit.rest.issues.getComment = jest.fn().mockResolvedValue({
+      data: {
+        body_html: `<img src="${signedUrl}">`,
+      },
+    });
+
+    fetchSpy = spyOn(global, "fetch");
+    fetchSpy.mockImplementation((_input: unknown, init?: RequestInit) => {
+      signal = init?.signal;
+      return Promise.resolve({
+        ok: true,
+        arrayBuffer: () => new Promise<ArrayBuffer>(() => {}),
+      } as Response);
+    });
+
+    const result = await downloadCommentImages(
+      mockOctokit,
+      "owner",
+      "repo",
+      [
+        {
+          type: "issue_comment",
+          id: "446",
+          body: `Stalled body: ![stalled](${imageUrl})`,
+        },
+      ],
+      { timeoutMs: 5 },
+    );
+
+    expect(result.size).toBe(0);
+    expect(signal?.aborted).toBe(true);
+    expect(consoleErrorSpy).toHaveBeenCalledWith(
+      expect.stringContaining("Failed to download"),
+      expect.objectContaining({
+        message: "Image download timed out after 5ms",
+      }),
+    );
+  });
+
   test("should handle API errors gracefully", async () => {
     const mockOctokit = createMockOctokit();
     const imageUrl = assetUrl(GUID_1);
@@ -936,7 +1033,9 @@ describe("downloadCommentImages", () => {
       mediaType: { format: "full+json" },
     });
 
-    expect(fetchSpy).toHaveBeenCalledWith(signedUrl);
+    expect(fetchSpy).toHaveBeenCalledWith(signedUrl, {
+      signal: expect.any(AbortSignal),
+    });
     expect(fsWriteFileSpy).toHaveBeenCalledWith(
       "/tmp/github-images/image-1704067200000-0.png",
       Buffer.from(mockArrayBuffer),

test/install-mcp-server.test.ts

@@ -354,4 +354,102 @@ describe("prepareMcpConfig", () => {
     const parsed = JSON.parse(result);
     expect(parsed.mcpServers.github_ci).not.toBeDefined();
   });
+
+  test("should include github MCP server when mcp__github shorthand is used", async () => {
+    const result = await prepareMcpConfig({
+      githubToken: "test-token",
+      owner: "test-owner",
+      repo: "test-repo",
+      branch: "test-branch",
+      baseBranch: "main",
+      allowedTools: ["mcp__github"],
+      mode: "agent",
+      context: mockContext,
+    });
+
+    const parsed = JSON.parse(result);
+    expect(parsed.mcpServers.github).toBeDefined();
+    expect(parsed.mcpServers.github.command).toBe("docker");
+    expect(parsed.mcpServers.github.env.GITHUB_PERSONAL_ACCESS_TOKEN).toBe(
+      "test-token",
+    );
+  });
+
+  test("should include inline comment server when mcp__github_inline_comment shorthand is used", async () => {
+    const result = await prepareMcpConfig({
+      githubToken: "test-token",
+      owner: "test-owner",
+      repo: "test-repo",
+      branch: "test-branch",
+      baseBranch: "main",
+      allowedTools: ["mcp__github_inline_comment"],
+      mode: "agent",
+      context: mockPRContext,
+    });
+
+    const parsed = JSON.parse(result);
+    expect(parsed.mcpServers.github_inline_comment).toBeDefined();
+    expect(parsed.mcpServers.github_inline_comment.env.GITHUB_TOKEN).toBe(
+      "test-token",
+    );
+    expect(parsed.mcpServers.github_inline_comment.env.PR_NUMBER).toBe("456");
+  });
+
+  test("should include comment server in agent mode when mcp__github_comment shorthand is used", async () => {
+    const result = await prepareMcpConfig({
+      githubToken: "test-token",
+      owner: "test-owner",
+      repo: "test-repo",
+      branch: "test-branch",
+      baseBranch: "main",
+      allowedTools: ["mcp__github_comment"],
+      mode: "agent",
+      context: mockContext,
+    });
+
+    const parsed = JSON.parse(result);
+    expect(parsed.mcpServers.github_comment).toBeDefined();
+    expect(parsed.mcpServers.github_comment.env.GITHUB_TOKEN).toBe(
+      "test-token",
+    );
+  });
+
+  test("should include CI server in agent mode when mcp__github_ci shorthand is used", async () => {
+    process.env.DEFAULT_WORKFLOW_TOKEN = "workflow-token";
+
+    const result = await prepareMcpConfig({
+      githubToken: "test-token",
+      owner: "test-owner",
+      repo: "test-repo",
+      branch: "test-branch",
+      baseBranch: "main",
+      allowedTools: ["mcp__github_ci"],
+      mode: "agent",
+      context: mockPRContext,
+    });
+
+    const parsed = JSON.parse(result);
+    expect(parsed.mcpServers.github_ci).toBeDefined();
+    expect(parsed.mcpServers.github_ci.env.GITHUB_TOKEN).toBe("workflow-token");
+    expect(parsed.mcpServers.github_ci.env.PR_NUMBER).toBe("456");
+
+    delete process.env.DEFAULT_WORKFLOW_TOKEN;
+  });
+
+  test("should not include github MCP server when unrelated tool is specified", async () => {
+    const result = await prepareMcpConfig({
+      githubToken: "test-token",
+      owner: "test-owner",
+      repo: "test-repo",
+      branch: "test-branch",
+      baseBranch: "main",
+      allowedTools: ["Bash", "Read", "Grep"],
+      mode: "agent",
+      context: mockContext,
+    });
+
+    const parsed = JSON.parse(result);
+    expect(parsed.mcpServers.github).not.toBeDefined();
+    expect(parsed.mcpServers.github_inline_comment).not.toBeDefined();
+  });
 });

test/modes/agent.test.ts

@@ -16,28 +16,35 @@ describe("Agent Mode", () => {
   let exportVariableSpy: any;
   let setOutputSpy: any;
   let configureGitAuthSpy: any;
+  let replaceCheckoutCredentialsSpy: any;
 
   beforeEach(() => {
     exportVariableSpy = spyOn(core, "exportVariable").mockImplementation(
       () => {},
     );
     setOutputSpy = spyOn(core, "setOutput").mockImplementation(() => {});
-    // Mock configureGitAuth to prevent actual git commands from running
+    // Mock git configuration to prevent actual git commands from running
     configureGitAuthSpy = spyOn(
       gitConfig,
       "configureGitAuth",
     ).mockImplementation(async () => {
       // Do nothing - prevent actual git config modifications
     });
+    replaceCheckoutCredentialsSpy = spyOn(
+      gitConfig,
+      "replaceCheckoutCredentials",
+    ).mockImplementation(async () => {});
   });
 
   afterEach(() => {
     exportVariableSpy?.mockClear();
     setOutputSpy?.mockClear();
     configureGitAuthSpy?.mockClear();
+    replaceCheckoutCredentialsSpy?.mockClear();
     exportVariableSpy?.mockRestore();
     setOutputSpy?.mockRestore();
     configureGitAuthSpy?.mockRestore();
+    replaceCheckoutCredentialsSpy?.mockRestore();
   });
 
   test("prepareAgentMode is exported as a function", () => {
@@ -257,4 +264,59 @@ describe("Agent Mode", () => {
     // Should be empty or just whitespace when no MCP servers are included
     expect(result.claudeArgs).not.toContain("--mcp-config");
   });
+
+  describe("git credential configuration", () => {
+    const mockOctokit = {
+      rest: {
+        users: {
+          getByUsername: mock(() =>
+            Promise.resolve({
+              data: { login: "test-user", id: 12345, type: "User" },
+            }),
+          ),
+        },
+      },
+    } as any;
+
+    test("uses full git auth on the non-signing path", async () => {
+      const context = createMockAutomationContext({
+        eventName: "workflow_dispatch",
+      });
+
+      await prepareAgentMode({
+        context,
+        octokit: mockOctokit,
+        githubToken: "test-token",
+      });
+
+      expect(configureGitAuthSpy).toHaveBeenCalledTimes(1);
+      expect(configureGitAuthSpy).toHaveBeenCalledWith("test-token", context, {
+        login: context.inputs.botName,
+        id: parseInt(context.inputs.botId),
+      });
+      // configureGitAuth performs the credential replacement itself; the mock
+      // stands in for it here, so the standalone helper is not invoked.
+      expect(replaceCheckoutCredentialsSpy).not.toHaveBeenCalled();
+    });
+
+    test("still replaces the checkout credential when API commit signing is enabled", async () => {
+      const context = createMockAutomationContext({
+        eventName: "workflow_dispatch",
+        inputs: { useCommitSigning: true },
+      });
+
+      await prepareAgentMode({
+        context,
+        octokit: mockOctokit,
+        githubToken: "test-token",
+      });
+
+      expect(configureGitAuthSpy).not.toHaveBeenCalled();
+      expect(replaceCheckoutCredentialsSpy).toHaveBeenCalledTimes(1);
+      expect(replaceCheckoutCredentialsSpy).toHaveBeenCalledWith(
+        "test-token",
+        context,
+      );
+    });
+  });
 });

test/modes/detector.test.ts

@@ -76,6 +76,20 @@ describe("detectMode with enhanced routing", () => {
       expect(detectMode(context)).toBe("agent");
     });
 
+    it("should use tag mode when track_progress is true for pull_request.labeled", () => {
+      const context: GitHubContext = {
+        ...baseContext,
+        eventName: "pull_request",
+        eventAction: "labeled",
+        payload: { pull_request: { number: 1 } } as any,
+        entityNumber: 1,
+        isPR: true,
+        inputs: { ...baseContext.inputs, trackProgress: true },
+      };
+
+      expect(detectMode(context)).toBe("tag");
+    });
+
     it("should throw error when track_progress is used with unsupported PR action", () => {
       const context: GitHubContext = {
         ...baseContext,

test/modes/tag.test.ts

@@ -1,8 +1,99 @@
-import { describe, test, expect } from "bun:test";
+import { describe, test, expect, beforeEach, afterEach, spyOn } from "bun:test";
 import { prepareTagMode } from "../../src/modes/tag";
+import { mockIssueCommentContext } from "../mockContext";
+import * as actor from "../../src/github/validation/actor";
+import * as createInitial from "../../src/github/operations/comments/create-initial";
+import * as fetcher from "../../src/github/data/fetcher";
+import * as branch from "../../src/github/operations/branch";
+import * as createPrompt from "../../src/create-prompt";
+import * as mcp from "../../src/mcp/install-mcp-server";
+import * as gitConfig from "../../src/github/operations/git-config";
 
 describe("Tag Mode", () => {
   test("prepareTagMode is exported as a function", () => {
     expect(typeof prepareTagMode).toBe("function");
   });
+
+  describe("git credential configuration", () => {
+    let spies: Array<{ mockRestore: () => void }>;
+    let configureGitAuthSpy: any;
+    let replaceCheckoutCredentialsSpy: any;
+
+    beforeEach(() => {
+      configureGitAuthSpy = spyOn(
+        gitConfig,
+        "configureGitAuth",
+      ).mockImplementation(async () => {});
+      replaceCheckoutCredentialsSpy = spyOn(
+        gitConfig,
+        "replaceCheckoutCredentials",
+      ).mockImplementation(async () => {});
+      spies = [
+        configureGitAuthSpy,
+        replaceCheckoutCredentialsSpy,
+        spyOn(actor, "checkHumanActor").mockImplementation(async () => {}),
+        spyOn(createInitial, "createInitialComment").mockImplementation(
+          async () => ({ id: 42 }) as any,
+        ),
+        spyOn(fetcher, "fetchGitHubData").mockImplementation(
+          async () => ({}) as any,
+        ),
+        spyOn(branch, "setupBranch").mockImplementation(
+          async () =>
+            ({
+              baseBranch: "main",
+              claudeBranch: "claude/test",
+              currentBranch: "claude/test",
+            }) as any,
+        ),
+        spyOn(createPrompt, "createPrompt").mockImplementation(async () => {}),
+        spyOn(mcp, "prepareMcpConfig").mockImplementation(async () => "{}"),
+      ];
+    });
+
+    afterEach(() => {
+      for (const spy of spies) {
+        spy.mockRestore();
+      }
+    });
+
+    test("uses full git auth on the non-signing path", async () => {
+      const context = { ...mockIssueCommentContext };
+
+      await prepareTagMode({
+        context,
+        octokit: {} as any,
+        githubToken: "test-token",
+      });
+
+      expect(configureGitAuthSpy).toHaveBeenCalledTimes(1);
+      expect(configureGitAuthSpy).toHaveBeenCalledWith("test-token", context, {
+        login: context.inputs.botName,
+        id: parseInt(context.inputs.botId),
+      });
+      // configureGitAuth performs the credential replacement itself; the mock
+      // stands in for it here, so the standalone helper is not invoked.
+      expect(replaceCheckoutCredentialsSpy).not.toHaveBeenCalled();
+    });
+
+    test("still replaces the checkout credential when API commit signing is enabled", async () => {
+      const context = {
+        ...mockIssueCommentContext,
+        inputs: { ...mockIssueCommentContext.inputs, useCommitSigning: true },
+      };
+
+      await prepareTagMode({
+        context,
+        octokit: {} as any,
+        githubToken: "test-token",
+      });
+
+      expect(configureGitAuthSpy).not.toHaveBeenCalled();
+      expect(replaceCheckoutCredentialsSpy).toHaveBeenCalledTimes(1);
+      expect(replaceCheckoutCredentialsSpy).toHaveBeenCalledWith(
+        "test-token",
+        context,
+      );
+    });
+  });
 });

test/public-comment-redaction.test.ts

@@ -0,0 +1,64 @@
+import { describe, expect, it } from "bun:test";
+import { redactSecrets, sanitizeContent } from "../src/github/utils/sanitizer";
+
+describe("Public Comment Output Sanitization & Redaction", () => {
+  it("redacts all credential types from public comment output", () => {
+    const rawComment = [
+      "Here is the summary of the work done:",
+      "- GitHub Token: ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890",
+      "- Anthropic Key: sk-ant-api03-abcdefghijklmnopqrstuvwxyz1234567890",
+      "- AWS Access Key: AKIAIOSFODNN7EXAMPLE",
+      "- Slack Bot Token: xoxb-1234567890-abcdefghijkl-mnopqrstuvwx",
+      "- JWT Bearer: eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U",
+      "<!-- Hidden instruction injection -->",
+      "Invisible\u200Bzero-width chars",
+      "![Image Alt Injection](https://example.com/pic.png)",
+    ].join("\n");
+
+    const sanitizedOutput = redactSecrets(sanitizeContent(rawComment));
+
+    // Ensure all secret types are redacted
+    expect(sanitizedOutput).not.toContain(
+      "ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890",
+    );
+    expect(sanitizedOutput).not.toContain(
+      "sk-ant-api03-abcdefghijklmnopqrstuvwxyz1234567890",
+    );
+    expect(sanitizedOutput).not.toContain("AKIAIOSFODNN7EXAMPLE");
+    expect(sanitizedOutput).not.toContain(
+      "xoxb-1234567890-abcdefghijkl-mnopqrstuvwx",
+    );
+    expect(sanitizedOutput).not.toContain(
+      "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U",
+    );
+
+    expect(sanitizedOutput).toContain("[REDACTED_GITHUB_TOKEN]");
+    expect(sanitizedOutput).toContain("[REDACTED_ANTHROPIC_KEY]");
+    expect(sanitizedOutput).toContain("[REDACTED_AWS_KEY_ID]");
+    expect(sanitizedOutput).toContain("[REDACTED_SLACK_TOKEN]");
+    expect(sanitizedOutput).toContain("[REDACTED_JWT]");
+
+    // Ensure prompt injection / invisible chars / hidden tags are also sanitized
+    expect(sanitizedOutput).not.toContain(
+      "<!-- Hidden instruction injection -->",
+    );
+    expect(sanitizedOutput).not.toContain("\u200B");
+    expect(sanitizedOutput).not.toContain("Image Alt Injection");
+    expect(sanitizedOutput).toContain("![](https://example.com/pic.png)");
+  });
+
+  it("ensures public comments have the same secret redaction coverage as logs/errors", () => {
+    const errorDetails =
+      "Error: failed to connect with sk-ant-abcdefghijklmnopqrstuvwxyz123456 and AKIAIOSFODNN7EXAMPLE";
+    const commentBody =
+      "Report: encountered sk-ant-abcdefghijklmnopqrstuvwxyz123456 and AKIAIOSFODNN7EXAMPLE";
+
+    const redactedError = redactSecrets(errorDetails);
+    const redactedComment = redactSecrets(sanitizeContent(commentBody));
+
+    expect(redactedError).toContain("[REDACTED_ANTHROPIC_KEY]");
+    expect(redactedError).toContain("[REDACTED_AWS_KEY_ID]");
+    expect(redactedComment).toContain("[REDACTED_ANTHROPIC_KEY]");
+    expect(redactedComment).toContain("[REDACTED_AWS_KEY_ID]");
+  });
+});

test/restore-config.test.ts

@@ -5,6 +5,7 @@ import {
   lstatSync,
   mkdtempSync,
   mkdirSync,
+  readdirSync,
   readFileSync,
   rmSync,
   symlinkSync,
@@ -147,7 +148,7 @@ describe("restoreConfigFromBase", () => {
     );
   });
 
-  test("snapshots symlinked sensitive paths even when the PR head target is missing", () => {
+  test("records dangling links as placeholders, including top-level ones", () => {
     setupSymlinkedMainBranch();
 
     git(["checkout", "pr"]);
@@ -157,14 +158,229 @@ describe("restoreConfigFromBase", () => {
 
     restoreConfigFromBase("main");
 
-    expect(lstatRepoFile(".claude-pr/.claude/CLAUDE.md").isSymbolicLink()).toBe(
-      true,
-    );
+    expectPlaceholder(".claude-pr/CLAUDE.md");
+    expectPlaceholder(".claude-pr/.claude/CLAUDE.md");
+    expectNoLinksInSnapshot();
     expect(readRepoFile(".claude/settings.json")).toBe(
       `${JSON.stringify({ source: "base" })}\n`,
     );
   });
 
+  test("snapshots links to tracked in-tree files as dereferenced content", () => {
+    setupSymlinkedMainBranch();
+
+    git(["checkout", "pr"]);
+
+    restoreConfigFromBase("main");
+
+    expect(lstatRepoFile(".claude-pr/CLAUDE.md").isFile()).toBe(true);
+    expect(lstatRepoFile(".claude-pr/.claude/CLAUDE.md").isFile()).toBe(true);
+    expect(readRepoFile(".claude-pr/CLAUDE.md")).toBe(
+      "shared agent instructions\n",
+    );
+    expect(readRepoFile(".claude-pr/.claude/CLAUDE.md")).toBe(
+      "shared agent instructions\n",
+    );
+    expectNoLinksInSnapshot();
+  });
+
+  test("records CLAUDE.md links to targets outside the working tree as placeholders", () => {
+    const outsideFile = writeOutsideFile("notes.md", "outside notes\n");
+
+    rmSync(join(repoDir, "CLAUDE.md"), { force: true });
+    symlinkRepoFile("CLAUDE.md", outsideFile);
+    git(["add", "-A"]);
+    git(["commit", "-m", "pr links CLAUDE.md outside the repo"]);
+
+    restoreConfigFromBase("main");
+
+    expectPlaceholder(".claude-pr/CLAUDE.md");
+    expect(readRepoFile(".claude-pr/CLAUDE.md")).not.toBe("outside notes\n");
+    expect(snapshotRegularFileContents()).not.toContain("outside notes\n");
+    expectNoLinksInSnapshot();
+    expect(readRepoFile("CLAUDE.md")).toBe("base claude instructions\n");
+  });
+
+  test("records nested links to targets outside the working tree as placeholders", () => {
+    const outsideFile = writeOutsideFile(
+      "secret.txt",
+      "outside file content\n",
+    );
+    writeOutsideFile("dir/inner.txt", "outside dir content\n");
+    const outsideDir = join(tempDir, "outside", "dir");
+
+    symlinkRepoFile(".claude/linked-file.md", outsideFile);
+    symlinkRepoFile(".claude/linked-dir", outsideDir);
+    git(["add", "-A"]);
+    git(["commit", "-m", "pr adds nested links outside the repo"]);
+
+    restoreConfigFromBase("main");
+
+    expect(readRepoFile(".claude-pr/.claude/settings.json")).toBe(
+      `${JSON.stringify({ source: "pr" })}\n`,
+    );
+    expectPlaceholder(".claude-pr/.claude/linked-file.md");
+    expectPlaceholder(".claude-pr/.claude/linked-dir");
+    const contents = snapshotRegularFileContents();
+    expect(contents).not.toContain("outside file content\n");
+    expect(contents).not.toContain("outside dir content\n");
+    expectNoLinksInSnapshot();
+    expect(readRepoFile(".claude/settings.json")).toBe(
+      `${JSON.stringify({ source: "base" })}\n`,
+    );
+  });
+
+  test("records links into git metadata as placeholders", () => {
+    symlinkRepoFile(".claude/git-config", "../.git/config");
+    git(["add", "-A"]);
+    git(["commit", "-m", "pr links into git metadata"]);
+
+    restoreConfigFromBase("main");
+
+    expectPlaceholder(".claude-pr/.claude/git-config");
+    expect(snapshotRegularFileContents()).not.toContain(
+      readRepoFile(".git/config"),
+    );
+    expectNoLinksInSnapshot();
+  });
+
+  test("records relative links that only resolve from inside the snapshot as placeholders", () => {
+    // Both targets dangle at their source location but would resolve to the
+    // repository's .git/config if re-created one directory deeper.
+    symlinkRepoFile(".claude/x", "../../.git/config");
+    rmSync(join(repoDir, "CLAUDE.md"), { force: true });
+    symlinkRepoFile("CLAUDE.md", "../.git/config");
+    git(["add", "-A"]);
+    git(["commit", "-m", "pr adds relative links"]);
+
+    restoreConfigFromBase("main");
+
+    const gitConfig = readRepoFile(".git/config");
+    for (const path of [".claude-pr/.claude/x", ".claude-pr/CLAUDE.md"]) {
+      expectPlaceholder(path);
+      expect(readRepoFile(path)).not.toBe(gitConfig);
+    }
+    expect(snapshotRegularFileContents()).not.toContain(gitConfig);
+    expectNoLinksInSnapshot();
+  });
+
+  test("records links into nested git metadata inside the working tree as placeholders", () => {
+    writeRepoFile("other/.git/config", "nested checkout config\n");
+    symlinkRepoFile(".claude/x", "../other/.git/config");
+
+    restoreConfigFromBase("main");
+
+    expectPlaceholder(".claude-pr/.claude/x");
+    expect(snapshotRegularFileContents()).not.toContain(
+      "nested checkout config\n",
+    );
+    expectNoLinksInSnapshot();
+  });
+
+  test("records links to untracked in-tree files as placeholders", () => {
+    writeRepoFile(".env", "untracked env contents\n");
+    symlinkRepoFile(".claude/env", "../.env");
+    git(["add", ".claude/env"]);
+    git(["commit", "-m", "pr links to an untracked file"]);
+
+    restoreConfigFromBase("main");
+
+    expectPlaceholder(".claude-pr/.claude/env");
+    expect(snapshotRegularFileContents()).not.toContain(
+      "untracked env contents\n",
+    );
+    expect(readRepoFile(".claude-pr/.claude/settings.json")).toBe(
+      `${JSON.stringify({ source: "pr" })}\n`,
+    );
+    expectNoLinksInSnapshot();
+  });
+
+  test("records links to tracked files modified after checkout as placeholders", () => {
+    writeRepoFile(".env", "PLACEHOLDER=1\n");
+    symlinkRepoFile(".claude/env", "../.env");
+    git(["add", ".env", ".claude/env"]);
+    git(["commit", "-m", "pr links to a tracked file"]);
+    writeRepoFile(".env", "written after checkout\n");
+
+    restoreConfigFromBase("main");
+
+    expectPlaceholder(".claude-pr/.claude/env");
+    expect(snapshotRegularFileContents()).not.toContain(
+      "written after checkout\n",
+    );
+    expectNoLinksInSnapshot();
+  });
+
+  test("snapshots a sensitive path that links to a tracked in-tree directory", () => {
+    rmSync(join(repoDir, ".claude"), { recursive: true, force: true });
+    writeRepoFile(
+      "config/claude/settings.json",
+      `${JSON.stringify({ source: "linked-dir" })}\n`,
+    );
+    writeRepoFile("config/claude/agents/reviewer.md", "reviewer agent\n");
+    writeRepoFile("docs/agents/writer.md", "writer agent\n");
+    symlinkRepoFile("config/claude/more-agents", "../../docs/agents");
+    symlinkRepoFile(".claude", "config/claude");
+    git(["add", "-A"]);
+    git(["commit", "-m", "pr links .claude to a tracked directory"]);
+    writeRepoFile("config/claude/local.txt", "untracked file\n");
+    writeRepoFile("config/claude/cache/entry.txt", "untracked dir entry\n");
+
+    restoreConfigFromBase("main");
+
+    expect(lstatRepoFile(".claude-pr/.claude").isDirectory()).toBe(true);
+    expect(readRepoFile(".claude-pr/.claude/settings.json")).toBe(
+      `${JSON.stringify({ source: "linked-dir" })}\n`,
+    );
+    expect(readRepoFile(".claude-pr/.claude/agents/reviewer.md")).toBe(
+      "reviewer agent\n",
+    );
+    expect(readRepoFile(".claude-pr/.claude/more-agents/writer.md")).toBe(
+      "writer agent\n",
+    );
+    expectPlaceholder(".claude-pr/.claude/local.txt");
+    expectPlaceholder(".claude-pr/.claude/cache");
+    const contents = snapshotRegularFileContents();
+    expect(contents).not.toContain("untracked file\n");
+    expect(contents).not.toContain("untracked dir entry\n");
+    expectNoLinksInSnapshot();
+    expect(lstatRepoFile(".claude").isDirectory()).toBe(true);
+    expect(readRepoFile(".claude/settings.json")).toBe(
+      `${JSON.stringify({ source: "base" })}\n`,
+    );
+  });
+
+  test("records links to untracked in-tree directories as a single placeholder", () => {
+    writeRepoFile("build/out/a.js", "generated a\n");
+    writeRepoFile("build/out/b.js", "generated b\n");
+    symlinkRepoFile(".claude/build", "../build");
+    git(["add", ".claude/build"]);
+    git(["commit", "-m", "pr links to an untracked directory"]);
+
+    restoreConfigFromBase("main");
+
+    expectPlaceholder(".claude-pr/.claude/build");
+    const contents = snapshotRegularFileContents();
+    expect(contents).not.toContain("generated a\n");
+    expect(contents).not.toContain("generated b\n");
+    expectNoLinksInSnapshot();
+  });
+
+  test("records links back into a parent directory as placeholders", () => {
+    symlinkRepoFile(".claude/parent-dir", "..");
+    git(["add", "-A"]);
+    git(["commit", "-m", "pr adds a link back to the repo root"]);
+
+    restoreConfigFromBase("main");
+
+    expectPlaceholder(".claude-pr/.claude/parent-dir");
+    expect(existsRepoFile(".claude-pr/.claude/parent-dir/src")).toBe(false);
+    expect(readRepoFile(".claude-pr/.claude/settings.json")).toBe(
+      `${JSON.stringify({ source: "pr" })}\n`,
+    );
+    expectNoLinksInSnapshot();
+  });
+
   test("does not modify an existing .gitignore", () => {
     writeRepoFile(".gitignore", "node_modules\n");
     git(["add", ".gitignore"]);
@@ -178,6 +394,37 @@ describe("restoreConfigFromBase", () => {
     expect(countClaudePrExcludeEntries()).toBe(1);
   });
 
+  test("leaves a full checkout unshallow so base..HEAD stays scoped to the PR", () => {
+    // The damage only shows up once base has moved on since the PR branched:
+    // the merge base is then an older commit that a depth-limited fetch of base
+    // truncates away, and every base..HEAD comparison silently changes meaning.
+    git(["checkout", "main"]);
+    writeRepoFile("src/other.ts", "export const advanced = true;\n");
+    git(["add", "src/other.ts"]);
+    git(["commit", "-m", "base advance"]);
+    git(["push", "origin", "main"]);
+    git(["checkout", "pr"]);
+
+    expect(git(["rev-parse", "--is-shallow-repository"]).trim()).toBe("false");
+    const mergeBaseBefore = git(["merge-base", "origin/main", "HEAD"]).trim();
+
+    restoreConfigFromBase("main");
+
+    expect(git(["rev-parse", "--is-shallow-repository"]).trim()).toBe("false");
+    expect(git(["merge-base", "origin/main", "HEAD"]).trim()).toBe(
+      mergeBaseBefore,
+    );
+    // These are the two commands the prompt tells Claude to run to scope its
+    // work to the PR: the log range must not pick up already-merged commits,
+    // and the three-dot diff must still resolve a merge base at all.
+    expect(git(["log", "--format=%s", "origin/main..HEAD"]).trim()).toBe(
+      "pr config",
+    );
+    expect(
+      git(["diff", "--name-only", "origin/main...HEAD"]).trim().split("\n"),
+    ).toEqual([".claude/settings.json", "CLAUDE.md"]);
+  });
+
   function git(args: string[]): string {
     return execFileSync("git", args, {
       cwd: repoDir,
@@ -196,6 +443,55 @@ describe("restoreConfigFromBase", () => {
     return readFileSync(join(repoDir, path), "utf8");
   }
 
+  function writeOutsideFile(path: string, contents: string): string {
+    const fullPath = join(tempDir, "outside", path);
+    mkdirSync(dirname(fullPath), { recursive: true });
+    writeFileSync(fullPath, contents);
+    return fullPath;
+  }
+
+  // Contents of every regular file recorded in the snapshot, without following
+  // links, so tests can assert what actually got copied into the repository.
+  function snapshotRegularFileContents(): string[] {
+    const contents: string[] = [];
+    const visit = (dir: string) => {
+      for (const entry of readdirSync(dir)) {
+        const entryPath = join(dir, entry);
+        const stats = lstatSync(entryPath);
+        if (stats.isDirectory()) {
+          visit(entryPath);
+        } else if (stats.isFile()) {
+          contents.push(readFileSync(entryPath, "utf8"));
+        }
+      }
+    };
+    visit(join(repoDir, ".claude-pr"));
+    return contents;
+  }
+
+  // The snapshot must never contain links: every entry is a regular file or a
+  // real directory.
+  function expectNoLinksInSnapshot(): void {
+    const visit = (dir: string) => {
+      for (const entry of readdirSync(dir)) {
+        const entryPath = join(dir, entry);
+        const stats = lstatSync(entryPath);
+        expect(stats.isSymbolicLink()).toBe(false);
+        if (stats.isDirectory()) {
+          visit(entryPath);
+        }
+      }
+    };
+    visit(join(repoDir, ".claude-pr"));
+  }
+
+  function expectPlaceholder(path: string): void {
+    const stats = lstatRepoFile(path);
+    expect(stats.isSymbolicLink()).toBe(false);
+    expect(stats.isFile()).toBe(true);
+    expect(readRepoFile(path)).toStartWith("Snapshot placeholder: ");
+  }
+
   function existsRepoFile(path: string): boolean {
     return existsSync(join(repoDir, path));
   }

test/sanitizer.test.ts

@@ -8,6 +8,7 @@ import {
   sanitizeContent,
   stripHtmlComments,
   redactGitHubTokens,
+  redactSecrets,
 } from "../src/github/utils/sanitizer";
 
 describe("stripInvisibleCharacters", () => {
@@ -368,7 +369,122 @@ export GITHUB_TOKEN=[REDACTED_GITHUB_TOKEN]
   });
 });
 
+describe("redactSecrets", () => {
+  it("should still redact GitHub tokens", () => {
+    expect(
+      redactSecrets("Token: ghs_xz7yzju2SZjGPa0dUNMAx0SH4xDOCS31LXQW"),
+    ).toBe("Token: [REDACTED_GITHUB_TOKEN]");
+  });
+
+  it("should redact Anthropic API keys (sk-ant-)", () => {
+    const key = "sk-ant-api03-AbCdEfGhIjKlMnOpQrStUvWxYz0123456789_-abcdefgh";
+    expect(redactSecrets(`ANTHROPIC_API_KEY=${key}`)).toBe(
+      "ANTHROPIC_API_KEY=[REDACTED_ANTHROPIC_KEY]",
+    );
+  });
+
+  it("should not redact sk- strings that are not sk-ant-", () => {
+    const content =
+      "sk-proj-abcdefghijklmnopqrstuvwxyz0123456789 and sk-ant-short";
+    expect(redactSecrets(content)).toBe(content);
+  });
+
+  it("should redact AWS access key ids", () => {
+    expect(redactSecrets("aws_access_key_id = AKIAIOSFODNN7EXAMPLE")).toBe(
+      "aws_access_key_id = [REDACTED_AWS_KEY_ID]",
+    );
+    expect(redactSecrets("temp creds ASIAIOSFODNN7EXAMPLE end")).toBe(
+      "temp creds [REDACTED_AWS_KEY_ID] end",
+    );
+  });
+
+  it("should not redact AWS-like strings that do not fit the format", () => {
+    const content =
+      "AKIAtest AKIA123 AKIAIOSFODNN7EXAMPLEXYZ akiaiosfodnn7example";
+    expect(redactSecrets(content)).toBe(content);
+  });
+
+  it("should redact Slack tokens", () => {
+    expect(redactSecrets("token=xoxb-1234567890-abcdefghijkl")).toBe(
+      "token=[REDACTED_SLACK_TOKEN]",
+    );
+    expect(redactSecrets("xoxp-1234567890-1234567890-abc")).toBe(
+      "[REDACTED_SLACK_TOKEN]",
+    );
+  });
+
+  it("should not redact xox strings that do not fit the format", () => {
+    const content = "xoxo-1234567890abc xoxz-1234567890abc xoxb-short";
+    expect(redactSecrets(content)).toBe(content);
+  });
+
+  it("should redact JWT-shaped strings", () => {
+    const jwt =
+      "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIn0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c";
+    expect(redactSecrets(`Authorization: Bearer ${jwt}`)).toBe(
+      "Authorization: Bearer [REDACTED_JWT]",
+    );
+  });
+
+  it("should redact tokens that follow a JSON escape sequence", () => {
+    const serialized = JSON.stringify({
+      content:
+        "line one\nGITHUB_TOKEN=ghs_xz7yzju2SZjGPa0dUNMAx0SH4xDOCS31LXQW\tsk-ant-api03-AbCdEfGhIjKlMnOpQrStUvWx",
+    });
+    const redacted = redactSecrets(serialized);
+    expect(redacted).toContain("[REDACTED_GITHUB_TOKEN]");
+    expect(redacted).toContain("[REDACTED_ANTHROPIC_KEY]");
+    expect(redacted).not.toContain("ghs_xz7yzju2SZjGPa0dUNMAx0SH4xDOCS31LXQW");
+  });
+
+  it("should redact tokens preceded by ANSI color codes", () => {
+    const ghp = "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";
+    const anthropic =
+      "sk-ant-api03-AbCdEfGhIjKlMnOpQrStUvWxYz0123456789_-abcdefgh";
+    expect(redactSecrets(`\x1b[31m${ghp}\x1b[0m`)).toBe(
+      "\x1b[31m[REDACTED_GITHUB_TOKEN]\x1b[0m",
+    );
+    expect(redactSecrets(`key=\x1b[32m${anthropic}\x1b[39m`)).toBe(
+      "key=\x1b[32m[REDACTED_ANTHROPIC_KEY]\x1b[39m",
+    );
+    expect(redactSecrets(`\x1b[1mAKIAIOSFODNN7EXAMPLE\x1b[0m`)).toBe(
+      "\x1b[1m[REDACTED_AWS_KEY_ID]\x1b[0m",
+    );
+  });
+
+  it("should redact tokens that follow other JSON escapes", () => {
+    const ghp = "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";
+    const serialized = JSON.stringify({
+      colored: `\x1b[31m${ghp}`,
+      formfeed: `\f${ghp}`,
+      quoted: `"AKIAIOSFODNN7EXAMPLE"`,
+    });
+    const redacted = redactSecrets(serialized);
+    expect(redacted).not.toContain(ghp);
+    expect(redacted).not.toContain("AKIAIOSFODNN7EXAMPLE");
+    expect(redacted).toContain("[REDACTED_GITHUB_TOKEN]");
+    expect(redacted).toContain("[REDACTED_AWS_KEY_ID]");
+  });
+
+  it("should not redact base64 blobs that are not JWTs", () => {
+    // Long base64 without dots, and two-segment strings, are left alone
+    const content =
+      "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9eyJzdWIiOiIxMjM0NTY3ODkw " +
+      "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0 " +
+      "aGVsbG8gd29ybGQgdGhpcyBpcyBub3QgYSBqd3Q=";
+    expect(redactSecrets(content)).toBe(content);
+  });
+});
+
 describe("sanitizeContent with token redaction", () => {
+  it("should only redact GitHub tokens from inbound content", () => {
+    const content =
+      "docs example key AKIAIOSFODNN7EXAMPLE and token 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";
+    expect(sanitizeContent(content)).toBe(
+      "docs example key AKIAIOSFODNN7EXAMPLE and token [REDACTED_GITHUB_TOKEN]",
+    );
+  });
+
   it("should redact tokens as part of full sanitization", () => {
     const content = `
       <!-- Hidden comment with token: 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 -->
@@ -402,3 +518,28 @@ describe("stripHtmlComments (legacy)", () => {
     );
   });
 });
+
+describe("outbound comment sanitization and redaction", () => {
+  it("should sanitize content and redact all credential types for public comments", () => {
+    const rawComment =
+      "Done! Configured AWS AKIAIOSFODNN7EXAMPLE, Anthropic sk-ant-api03-abcdefghijklmnopqrstuvwxyz1234567890, Slack xoxb-1234567890-abcdefghijkl-mnopqrstuvwx, and GitHub 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 <!-- secret note -->";
+    const sanitizedAndRedacted = redactSecrets(sanitizeContent(rawComment));
+
+    expect(sanitizedAndRedacted).not.toContain("AKIAIOSFODNN7EXAMPLE");
+    expect(sanitizedAndRedacted).not.toContain(
+      "sk-ant-api03-abcdefghijklmnopqrstuvwxyz1234567890",
+    );
+    expect(sanitizedAndRedacted).not.toContain(
+      "xoxb-1234567890-abcdefghijkl-mnopqrstuvwx",
+    );
+    expect(sanitizedAndRedacted).not.toContain(
+      "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",
+    );
+    expect(sanitizedAndRedacted).not.toContain("secret note");
+
+    expect(sanitizedAndRedacted).toContain("[REDACTED_AWS_KEY_ID]");
+    expect(sanitizedAndRedacted).toContain("[REDACTED_ANTHROPIC_KEY]");
+    expect(sanitizedAndRedacted).toContain("[REDACTED_SLACK_TOKEN]");
+    expect(sanitizedAndRedacted).toContain("[REDACTED_GITHUB_TOKEN]");
+  });
+});

test/setup-branch-validation.test.ts

@@ -0,0 +1,80 @@
+import { describe, expect, test, beforeEach, afterEach } from "bun:test";
+import { mkdtempSync, rmSync } from "fs";
+import { join } from "path";
+import { setupBranch } from "../src/github/operations/branch";
+import { createMockContext } from "./mockContext";
+
+const octokits = {
+  rest: {
+    repos: { get: async () => ({ data: { default_branch: "main" } }) },
+    git: { getRef: async () => ({ data: { object: { sha: "abc1234" } } }) },
+  },
+} as any;
+
+const githubData = {
+  contextData: { title: "Add feature", labels: { nodes: [] } },
+} as any;
+
+// ':' is rejected by validateBranchName. The signing path used to skip that
+// check and only fail on the file ops server's first commit (a 422).
+const INVALID_TEMPLATE = "{{prefix}}release:{{entityNumber}}";
+
+const loggedErrors: string[] = [];
+
+describe("setupBranch generated branch name validation", () => {
+  let originalCwd: string;
+  let tempDir: string;
+  let exitCode: number | undefined;
+  let originalExit: typeof process.exit;
+  let originalError: typeof console.error;
+
+  beforeEach(() => {
+    originalCwd = process.cwd();
+    // Not a git repo, so the remote existence probe fails and setupBranch
+    // continues with the generated name.
+    tempDir = mkdtempSync(join("/tmp", "setup-branch-"));
+    process.chdir(tempDir);
+
+    exitCode = undefined;
+    loggedErrors.length = 0;
+    originalExit = process.exit;
+    originalError = console.error;
+    console.error = (...args: unknown[]) => {
+      loggedErrors.push(args.map(String).join(" "));
+    };
+    process.exit = ((code?: number) => {
+      exitCode = code;
+      throw new Error("process.exit called");
+    }) as typeof process.exit;
+  });
+
+  afterEach(() => {
+    process.exit = originalExit;
+    console.error = originalError;
+    process.chdir(originalCwd);
+    rmSync(tempDir, { recursive: true, force: true });
+  });
+
+  for (const useCommitSigning of [true, false]) {
+    test(`rejects an invalid generated branch name with use_commit_signing: ${useCommitSigning}`, async () => {
+      const context = createMockContext({
+        isPR: false,
+        entityNumber: 42,
+        inputs: {
+          useCommitSigning,
+          branchPrefix: "claude/",
+          branchNameTemplate: INVALID_TEMPLATE,
+        },
+      });
+
+      await expect(setupBranch(octokits, githubData, context)).rejects.toThrow(
+        "process.exit called",
+      );
+      expect(exitCode).toBe(1);
+      // Must fail on the name itself, not on a later git or API call.
+      expect(loggedErrors.join("\n")).toContain(
+        'Invalid branch name: "claude/release:42"',
+      );
+    });
+  }
+});

test/trigger-validation.test.ts

@@ -134,6 +134,20 @@ describe("checkContainsTrigger", () => {
       expect(checkContainsTrigger(context)).toBe(false);
     });
 
+    it("should return true when the labeled name differs only in case from the trigger", () => {
+      const context = {
+        ...mockIssueLabeledContext,
+        payload: {
+          ...mockIssueLabeledContext.payload,
+          label: {
+            ...(mockIssueLabeledContext.payload as any).label,
+            name: "Claude-Task",
+          },
+        },
+      } as ParsedGitHubContext;
+      expect(checkContainsTrigger(context)).toBe(true);
+    });
+
     it("should return false for non-labeled events", () => {
       const context = {
         ...mockIssueLabeledContext,

test/update-git-reference.test.ts

@@ -0,0 +1,90 @@
+import { describe, expect, it } from "bun:test";
+import { GITHUB_API_URL } from "../src/github/api/config";
+import { updateGitReference } from "../src/mcp/update-git-reference";
+
+const reference = {
+  owner: "owner",
+  repo: "repo",
+  branch: "feature",
+  sha: "abc123",
+  githubToken: "token",
+};
+
+function response(status: number) {
+  return {
+    ok: status >= 200 && status < 300,
+    status,
+    text: async () => "response body",
+  };
+}
+
+describe("updateGitReference", () => {
+  it("should patch the branch reference", async () => {
+    await updateGitReference({
+      ...reference,
+      fetchFn: async (url, init) => {
+        expect(url).toBe(
+          `${GITHUB_API_URL}/repos/owner/repo/git/refs/heads/feature`,
+        );
+        expect(init.method).toBe("PATCH");
+        expect(init.headers).toMatchObject({ Authorization: "Bearer token" });
+        expect(JSON.parse(String(init.body))).toEqual({
+          sha: "abc123",
+          force: false,
+        });
+        return response(200);
+      },
+    });
+  });
+
+  it("should not retry deterministic client errors", async () => {
+    for (const status of [400, 404, 409, 422]) {
+      let attempts = 0;
+
+      await expect(
+        updateGitReference({
+          ...reference,
+          fetchFn: async () => {
+            attempts++;
+            return response(status);
+          },
+          retryOptions: { initialDelayMs: 1 },
+        }),
+      ).rejects.toThrow(`Failed to update reference: ${status}`);
+
+      expect(attempts).toBe(1);
+    }
+  });
+
+  it("should retry transient HTTP errors", async () => {
+    for (const status of [403, 429, 500]) {
+      let attempts = 0;
+
+      await updateGitReference({
+        ...reference,
+        fetchFn: async () => response(attempts++ === 0 ? status : 200),
+        retryOptions: { initialDelayMs: 1 },
+      });
+
+      expect(attempts).toBe(2);
+    }
+  });
+
+  it("should retry network errors", async () => {
+    let attempts = 0;
+
+    await updateGitReference({
+      ...reference,
+      fetchFn: async () => {
+        attempts++;
+        if (attempts === 1) {
+          throw new Error("network error");
+        }
+        return response(200);
+      },
+      retryOptions: { initialDelayMs: 1 },
+    });
+
+    expect(attempts).toBe(2);
+  });
+});

test/validate-branch-name.test.ts

@@ -29,6 +29,15 @@ describe("validateBranchName", () => {
       expect(() => validateBranchName("release.1.2.3")).not.toThrow();
     });
 
+    it("should accept branch names containing parentheses", () => {
+      expect(() =>
+        validateBranchName("feat(example)-valid-branch"),
+      ).not.toThrow();
+      expect(() =>
+        validateBranchName("fix(parser)-handle-empty-input"),
+      ).not.toThrow();
+    });
+
     it("should accept typical branch name formats", () => {
       expect(() =>
         validateBranchName("claude/issue-123-20250101-1234"),