ci: raise reply agent to 120 turns; allowlist benign read/print tools by allxsmith · Pull Request #262 · allxsmith/bestax

allxsmith · 2026-07-09T05:12:04Z

Summary

Two changes from the run-log audit in #261:

bestaxbot-reply.yml: --max-turns 60 → 120. A feature-sized request (run 28991564529) burned all 60 turns mid-implementation — 24 Edit/2 Write calls across a dozen files — and the runner died with everything uncommitted and no reply posted, so the PR just looked silent. The reply agent was the only write-capable agent still at 60 (loop fix step: 120, implement: 150).
Allowlist benign tools whose denials wasted turns (evidence in ci: reply agent turn-caps at 60 losing all work; benign tool denials waste turns #261):
- Bash(awk:*), Bash(echo:*), Bash(printf:*) for all three write-capable agents — read-only slicing / pure stdout; echo/printf denials were failing whole compound commands as the unapproved segment. Output redirection remains separately sandbox-blocked.
- Bash(gh issue view:*) for the loop's fix step — denied 4× in one run; it's already allowed in reply + implement.

Deliberately NOT added (per the #261 census): git apply and perl -i (Bash write paths that would bypass #260's Edit()/Write() protected-path deny rules), rm, the file-ops MCP commit tool (git-CLI steering stays), and the Bash static-analyzer refusals, which are safety behavior, not misconfiguration.

Fixes #261

Test plan

All three workflows parse as valid YAML (js-yaml)
Diff is 4 lines: one turn bump + three allowlist strings
Post-merge: re-request the remaining PR feat(bulma-ui): add Avatar, Avatars, and Badge components #257 review work from bestaxbot and confirm the run completes within budget, commits, and replies (or at minimum replies with what it deferred)

Summary by CodeRabbit

Chores
- Improved automated workflow reliability and flexibility for issue and pull request assistance.
- Extended the time available for one automation run, reducing the chance of premature stops.
- Broadened permitted command support in automation, including additional shell and GitHub issue-related actions.

A feature-sized request to bestaxbot-reply (run 28991564529) burned all 60 turns mid-implementation and the runner died with everything uncommitted and no reply posted - the only write-capable agent still at 60 turns (loop fix: 120, implement: 150). Raise it to 120. Log census across three runs also shows benign denials wasting turns: gh issue view (4x in one loop fix run - allowed everywhere but there), awk (read-only slicing, same family as grep/sed/head), and echo/printf failing whole compound commands as the unapproved segment. Allowlist those; write-path denials (git apply, perl -i, rm, file-ops MCP) and the static-analyzer refusals stay as-is by design. Fixes #261

coderabbitai · 2026-07-09T05:12:22Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 70e6e6ef-1377-4664-a560-88a50bcddec5

📥 Commits

Reviewing files that changed from the base of the PR and between 75f4566 and 743d49d.

📒 Files selected for processing (3)

.github/workflows/bestaxbot-reply.yml
.github/workflows/claude-implement.yml
.github/workflows/claude-pr-loop.yml

Walkthrough

Modifies three Claude GitHub Actions workflow files: increases --max-turns from 60 to 120 in bestaxbot-reply.yml, and adds new Bash tool permissions (awk, echo, printf, gh issue view) to the --allowedTools allowlists in claude-implement.yml and claude-pr-loop.yml.

Changes

Claude Workflow Configuration Tuning

Layer / File(s)	Summary
Reply agent turn-cap increase `.github/workflows/bestaxbot-reply.yml`	Increases --max-turns from 60 to 120 for the bestaxbot reply step, matching the fix step's turn cap.
Allowlist expansion for implement and fix agents `.github/workflows/claude-implement.yml`, `.github/workflows/claude-pr-loop.yml`	Adds Bash(awk:), Bash(echo:), Bash(printf:) to the implement agent's allowedTools, and adds Bash(gh issue view:) to the pr-loop fix step's allowedTools.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Possibly related issues

ci: AI agent workflows deny Edit/Write file tools (agents can only edit files via an incidental sed -i) #259: Both issues modify the same Claude workflow claude_args settings involving turn caps and shell tool allowlists.

Possibly related PRs

allxsmith/bestax#218: Both PRs modify claude-implement.yml's claude_args allowedTools allowlist and max-turns parameter.
allxsmith/bestax#227: Both PRs modify claude-pr-loop.yml's fix agent allowedTools allowlist.
allxsmith/bestax#245: Both PRs adjust a Claude workflow's --max-turns from 60 to 120.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	Key details are present, but the template sections for affected packages, type of change, checklist, and other required fields are mostly missing.	Add the package selection, related-issue, type-of-change, checklist, screenshots/demos, and additional-context sections in the repo template format.
Linked Issues check	⚠️ Warning	The PR covers `#261`'s turn-cap bump and some allowlist updates, but it appears to miss the required benign-tool allowlist changes for the reply workflow.	Add `Bash(awk:)`, `Bash(echo:)`, and `Bash(printf:*)` to the reply agent allowlist, then verify all three write-capable agents match `#261`.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	Title is concise and matches the main CI changes: raise reply turn limit and expand benign tool allowlists.
Out of Scope Changes check	✅ Passed	All changes stay within the requested CI workflows and map to the issue objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch ci/reply-turns-and-benign-tools

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-07-09T05:14:11Z

Preview Deployment

Preview URL: https://e106a73d.bestax.pages.dev

allxsmith · 2026-07-09T05:23:04Z

Closing out the CodeRabbit review: the ⚠️ Linked Issues check warning ("appears to miss the required benign-tool allowlist changes for the reply workflow") is a false positive. The merged diff added Bash(awk:*),Bash(echo:*),Bash(printf:*) to all three write-capable agents, including .github/workflows/bestaxbot-reply.yml — see the first hunk of e738ddb. The walkthrough summary only credited two of the three files, which is likely where the warning came from. Verified on main: all three workflows contain the additions. No fix needed.

Generated by Claude Code

github-actions · 2026-07-11T12:10:12Z

🎉 This PR is included in version 3.2.0 🎉

The release is available on:

Your semantic-release bot 📦🚀

github-actions · 2026-07-20T23:54:43Z

🎉 This PR is included in version 1.0.0 🎉

The release is available on:

Your semantic-release bot 📦🚀

bestax-release-bot · 2026-08-12T03:45:40Z

🎉 This PR is included in version 1.0.0 🎉

The release is available on:

Your semantic-release bot 📦🚀

allxsmith merged commit e738ddb into main Jul 9, 2026
11 checks passed

allxsmith deleted the ci/reply-turns-and-benign-tools branch July 9, 2026 05:16

coderabbitai Bot mentioned this pull request Jul 11, 2026

ci: opt-in AI triage via ai-triage label (#274) #277

Merged

8 of 20 tasks

github-actions Bot added the released label Jul 11, 2026

coderabbitai Bot mentioned this pull request Jul 16, 2026

ci: surface silent Claude session failures (ai-triage + deep review); triage prompt fix #319

Merged

Navigation Menu

Repository navigation

ci: raise reply agent to 120 turns; allowlist benign read/print tools - #262

ci: raise reply agent to 120 turns; allowlist benign read/print tools#262
allxsmith merged 1 commit into
mainfrom
ci/reply-turns-and-benign-tools

allxsmith commented Jul 9, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 9, 2026 •

edited

Loading

❌ Failed checks (2 warnings)

Uh oh!

github-actions Bot commented Jul 9, 2026

Uh oh!

Uh oh!

allxsmith commented Jul 9, 2026

Uh oh!

github-actions Bot commented Jul 11, 2026

Uh oh!

github-actions Bot commented Jul 20, 2026

Uh oh!

bestax-release-bot Bot commented Aug 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

allxsmith commented Jul 9, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

❌ Failed checks (2 warnings)

Uh oh!

github-actions Bot commented Jul 9, 2026

Preview Deployment

Uh oh!

Uh oh!

allxsmith commented Jul 9, 2026

Uh oh!

github-actions Bot commented Jul 11, 2026

Uh oh!

github-actions Bot commented Jul 20, 2026

Uh oh!

bestax-release-bot Bot commented Aug 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

allxsmith commented Jul 9, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 9, 2026 •

edited

Loading