Compare commits

...

8 Commits

Author SHA1 Message Date
GitHub Actions
2bb8af55fa chore: Update CHANGELOG.md 2026-01-07 20:36:59 +00:00
Boris Cherny
a19dd76dcf Merge pull request #16686 from anthropics/bcherny-patch-7
Update CHANGELOG.md
2026-01-07 12:31:21 -08:00
Boris Cherny
63eefe157a Update CHANGELOG.md 2026-01-07 12:30:35 -08:00
GitHub Actions
870624fc15 chore: Update CHANGELOG.md 2026-01-07 20:03:52 +00:00
David Dworken
03129a27b0 Merge pull request #16635 from ddworken/dworken/validate-issue-exists
fix: validate that issues exist before commenting on duplicates
2026-01-07 11:03:50 -05:00
David Dworken
a3df424857 fix: validate that issues exist before commenting on duplicates
Add validation to comment-on-duplicates.sh that verifies the base issue
and all potential duplicate issues actually exist in the repo before
posting a comment.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2026-01-07 07:57:56 -08:00
Boris Cherny
0b86fdb0e0 fix(security): Remove overly broad gh api permission from dedupe command (#16549)
* fix(security): Remove overly broad gh api permission from dedupe command

Remove `Bash(gh api:*)` from dedupe.md allowed-tools to prevent potential
secret exfiltration via prompt injection. The dedupe workflow only needs
gh issue view/list/comment and gh search commands - it doesn't require
raw API access.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* feat: Add comment-on-duplicates script for safer duplicate handling

Replace `gh issue comment:*` permission with a constrained script that:
- Only accepts validated issue numbers
- Enforces max 3 duplicates
- Uses a fixed comment format
- Prevents arbitrary comment content injection

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-07 08:46:31 +05:30
Anthony Morris
c2022d3698 fix(ralph-wiggum): add :* to allowed-tools pattern to permit arguments (#16522)
The allowed-tools pattern was missing :* suffix, causing permission check
failures when arguments were passed to the setup script via ```! block.

Fixes #16398
2026-01-06 13:46:09 -08:00
4 changed files with 115 additions and 22 deletions

View File

@@ -1,5 +1,5 @@
---
allowed-tools: Bash(gh issue view:*), Bash(gh search:*), Bash(gh issue list:*), Bash(gh api:*), Bash(gh issue comment:*)
allowed-tools: Bash(gh issue view:*), Bash(gh search:*), Bash(gh issue list:*), Bash(./scripts/comment-on-duplicates.sh:*)
description: Find duplicate GitHub issues
---
@@ -11,28 +11,13 @@ To do this, follow these steps precisely:
2. Use an agent to view a Github issue, and ask the agent to return a summary of the issue
3. Then, launch 5 parallel agents to search Github for duplicates of this issue, using diverse keywords and search approaches, using the summary from #1
4. Next, feed the results from #1 and #2 into another agent, so that it can filter out false positives, that are likely not actually duplicates of the original issue. If there are no duplicates remaining, do not proceed.
5. Finally, comment back on the issue with a list of up to three duplicate issues (or zero, if there are no likely duplicates)
5. Finally, use the comment script to post duplicates:
```
./scripts/comment-on-duplicates.sh --base-issue <issue-number> --potential-duplicates <dup1> <dup2> <dup3>
```
Notes (be sure to tell this to your agents, too):
- Use `gh` to interact with Github, rather than web fetch
- Do not use other tools, beyond `gh` (eg. don't use other MCP servers, file edit, etc.)
- Do not use other tools, beyond `gh` and the comment script (eg. don't use other MCP servers, file edit, etc.)
- Make a todo list first
- For your comment, follow the following format precisely (assuming for this example that you found 3 suspected duplicates):
---
Found 3 possible duplicate issues:
1. <link to issue>
2. <link to issue>
3. <link to issue>
This issue will be automatically closed as a duplicate in 3 days.
- If your issue is a duplicate, please close it and 👍 the existing issue instead
- To prevent auto-closure, add a comment or 👎 this comment
🤖 Generated with [Claude Code](https://claude.ai/code)
---

View File

@@ -1,5 +1,13 @@
# Changelog
## 2.0.76
- Fixed issue with macOS code-sign warning when using Claude in Chrome integration
## 2.0.75
- Minor bugfixes
## 2.0.74
- Added LSP (Language Server Protocol) tool for code intelligence features like go-to-definition, find references, and hover documentation

View File

@@ -1,7 +1,7 @@
---
description: "Start Ralph Wiggum loop in current session"
argument-hint: "PROMPT [--max-iterations N] [--completion-promise TEXT]"
allowed-tools: ["Bash(${CLAUDE_PLUGIN_ROOT}/scripts/setup-ralph-loop.sh)"]
allowed-tools: ["Bash(${CLAUDE_PLUGIN_ROOT}/scripts/setup-ralph-loop.sh:*)"]
hide-from-slash-command-tool: "true"
---

100
scripts/comment-on-duplicates.sh Executable file
View File

@@ -0,0 +1,100 @@
#!/usr/bin/env bash
#
# Comments on a GitHub issue with a list of potential duplicates.
# Usage: ./comment-on-duplicates.sh --base-issue 123 --potential-duplicates 456 789 101
#
set -euo pipefail
REPO="anthropics/claude-code"
BASE_ISSUE=""
DUPLICATES=()
# Parse arguments
while [[ $# -gt 0 ]]; do
case $1 in
--base-issue)
BASE_ISSUE="$2"
shift 2
;;
--potential-duplicates)
shift
while [[ $# -gt 0 && ! "$1" =~ ^-- ]]; do
DUPLICATES+=("$1")
shift
done
;;
*)
echo "Unknown option: $1" >&2
exit 1
;;
esac
done
# Validate base issue
if [[ -z "$BASE_ISSUE" ]]; then
echo "Error: --base-issue is required" >&2
exit 1
fi
if ! [[ "$BASE_ISSUE" =~ ^[0-9]+$ ]]; then
echo "Error: --base-issue must be a number, got: $BASE_ISSUE" >&2
exit 1
fi
# Validate duplicates
if [[ ${#DUPLICATES[@]} -eq 0 ]]; then
echo "Error: --potential-duplicates requires at least one issue number" >&2
exit 1
fi
if [[ ${#DUPLICATES[@]} -gt 3 ]]; then
echo "Error: --potential-duplicates accepts at most 3 issues" >&2
exit 1
fi
for dup in "${DUPLICATES[@]}"; do
if ! [[ "$dup" =~ ^[0-9]+$ ]]; then
echo "Error: duplicate issue must be a number, got: $dup" >&2
exit 1
fi
done
# Validate that base issue exists
if ! gh issue view "$BASE_ISSUE" --repo "$REPO" &>/dev/null; then
echo "Error: issue #$BASE_ISSUE does not exist in $REPO" >&2
exit 1
fi
# Validate that all duplicate issues exist
for dup in "${DUPLICATES[@]}"; do
if ! gh issue view "$dup" --repo "$REPO" &>/dev/null; then
echo "Error: issue #$dup does not exist in $REPO" >&2
exit 1
fi
done
# Build comment body
COUNT=${#DUPLICATES[@]}
if [[ $COUNT -eq 1 ]]; then
HEADER="Found 1 possible duplicate issue:"
else
HEADER="Found $COUNT possible duplicate issues:"
fi
BODY="$HEADER"$'\n\n'
INDEX=1
for dup in "${DUPLICATES[@]}"; do
BODY+="$INDEX. https://github.com/$REPO/issues/$dup"$'\n'
((INDEX++))
done
BODY+=$'\n'"This issue will be automatically closed as a duplicate in 3 days."$'\n\n'
BODY+="- If your issue is a duplicate, please close it and 👍 the existing issue instead"$'\n'
BODY+="- To prevent auto-closure, add a comment or 👎 this comment"$'\n\n'
BODY+="🤖 Generated with [Claude Code](https://claude.ai/code)"
# Post the comment
gh issue comment "$BASE_ISSUE" --repo "$REPO" --body "$BODY"
echo "Posted duplicate comment on issue #$BASE_ISSUE"