ci: raise claude-pr-loop fix agent budget to 80 turns, widen allowlist

[allxsmith]

Description

The fix agent in claude-pr-loop.yml hit error_max_turns on #225 (run): 41 turns against a 40-turn cap, with 14 permission denials (~⅓ of turns wasted). The gate perm-fix (#226) worked — the gate went green and launched the fixer — this is the next capped stage.

Root cause: the fix agent's job (evaluate every CodeRabbit thread, verify each against the code, refute or fix, run the gates, commit, push, reply in threads) doesn't fit in 40 turns, and the denials came from git inspection commands and REST gh api thread-replies that weren't on the allowlist (only gh api graphql was).

Fix:

• --max-turns 40 → 80
• allowlist: add read-only git (status/diff/log/show), and broaden gh api graphql → gh api so the agent can reply to / resolve review threads via REST as well as GraphQL.

Same class as #218 (implement cap), #223 (review cap), #226 (gate perms).

Affected package(s):

• bulma-ui (@allxsmith/bestax-bulma)
• create-bestax (create-bestax)
• docs (@allxsmith/bestax-docs)
• Other: CI / GitHub Actions (.github/workflows/claude-pr-loop.yml)

Related Issue(s)

Refs #188

Type of Change

• Build tooling

Note on the widened gh api

The fix agent processes untrusted review-comment content, so broadening gh api graphql → gh api grants more REST reach. Real capability is still bounded by the job's token scopes and the prompt's hard prohibitions (never merge/close/label/push-to-main/edit protected paths). Kept read-only git to inspection verbs only.

Checklist

• Self-reviewed
• YAML validated
• Turns + allowlist only; no change to fix-agent behavior/prompt

🤖 Generated with Claude Code

https://claude.ai/code/session_01NVR5yWevceZEFbTJmpviiM

---

Generated by Claude Code

Summary by CodeRabbit

• Chores
  • Improved the automated fix workflow to handle more complex updates and continue working longer when needed.
  • Expanded available command access so automated fixes can better review, comment on, and adjust changes during a run.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: b3c4a339-4f70-4b45-892f-357bcad5f9da

📥 Commits

Reviewing files that changed from the base of the PR and between f1cc7f0 and 6422f26.

📒 Files selected for processing (1)

• .github/workflows/claude-pr-loop.yml

---

Walkthrough

This PR modifies the Claude fix job configuration in the GitHub Actions workflow, raising --max-turns from 40 to 80 and expanding the --allowedTools Bash command allowlist to include additional gh, git, pnpm, and node operations.

Changes

Claude Fix Job Configuration

Layer / File(s)	Summary
Expanded tool allowlist and max-turns .github/workflows/claude-pr-loop.yml	Increases --max-turns to 80 and replaces the narrower Bash(gh api graphql:*)-centric allowlist with broader permitted Bash tools including gh pr comment, gh api, and expanded git/pnpm/node command patterns.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• allxsmith/bestax#218: Both PRs modify Claude GitHub Actions workflow arguments to increase --max-turns and broaden the --allowedTools allowlist.
• allxsmith/bestax#223: Both PRs adjust Claude workflow --max-turns limits, one in claude-pr-loop.yml and the other in claude-review.yml.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/bump-fix-agent-budget

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Preview Deployment

Preview URL: https://521353b9.bestax.pages.dev

[github-actions]

🎉 This PR is included in version 5.2.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[github-actions]

🎉 This PR is included in version 3.2.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[github-actions]

🎉 This PR is included in version 1.0.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀