Forgejo-patched claude-code-gitea-action (View-job URL uses per-repo run index)

Fork of markwylde/claude-code-gitea-action@b744372 (v1.0.21) with the 'View job' link fixed to use GITHUB_RUN_NUMBER (per-repo index) instead of GITHUB_RUN_ID (global id), because Forgejo routes run pages by per-repo index. See VENDOR.txt.
2026-07-01 06:42:55 +00:00 · 2026-07-01 06:42:55 +00:00 · 32685a740f
commit 32685a740f
151 changed files with 23555 additions and 0 deletions
--- a/.github/ISSUE_TEMPLATE/bug_report.md
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@ -0,0 +1,36 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ""
+labels: bug
+assignees: ""
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+
+1. Go to '...'
+2. Click on '....'
+3. Scroll down to '....'
+4. See error
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.
+
+**Workflow yml file**
+If it's not sensitive, consider including a paste of your full Claude workflow.yml file.
+
+**API Provider**
+
+[ ] Anthropic First-Party API (default)
+[ ] AWS Bedrock
+[ ] GCP Vertex
+
+**Additional context**
+Add any other context about the problem here.
--- a/.github/workflows/bump-claude-code-version.yml
+++ b/.github/workflows/bump-claude-code-version.yml
@ -0,0 +1,132 @@
+name: Bump Claude Code Version
+
+on:
+  repository_dispatch:
+    types: [bump_claude_code_version]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Claude Code version to bump to"
+        required: true
+        type: string
+
+permissions:
+  contents: write
+
+jobs:
+  bump-version:
+    name: Bump Claude Code Version
+    runs-on: ubuntu-latest
+    environment: release
+    timeout-minutes: 5
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4
+        with:
+          token: ${{ secrets.RELEASE_PAT }}
+          fetch-depth: 0
+
+      - name: Get version from event payload
+        id: get_version
+        run: |
+          # Get version from either repository_dispatch or workflow_dispatch
+          if [ "${{ github.event_name }}" = "repository_dispatch" ]; then
+            NEW_VERSION="${CLIENT_PAYLOAD_VERSION}"
+          else
+            NEW_VERSION="${INPUT_VERSION}"
+          fi
+
+          # Sanitize the version to avoid issues enabled by problematic characters
+          NEW_VERSION=$(echo "$NEW_VERSION" | tr -d '`;$(){}[]|&<>' | tr -s ' ' '-')
+
+          if [ -z "$NEW_VERSION" ]; then
+            echo "Error: version not provided"
+            exit 1
+          fi
+          echo "NEW_VERSION=$NEW_VERSION" >> $GITHUB_ENV
+          echo "new_version=$NEW_VERSION" >> $GITHUB_OUTPUT
+        env:
+          INPUT_VERSION: ${{ inputs.version }}
+          CLIENT_PAYLOAD_VERSION: ${{ github.event.client_payload.version }}
+
+      - name: Create branch and update base-action/action.yml
+        run: |
+          # Variables
+          TIMESTAMP=$(date +'%Y%m%d-%H%M%S')
+          BRANCH_NAME="bump-claude-code-${{ env.NEW_VERSION }}-$TIMESTAMP"
+
+          echo "BRANCH_NAME=$BRANCH_NAME" >> $GITHUB_ENV
+
+          # Get the default branch
+          DEFAULT_BRANCH=$(gh api repos/${GITHUB_REPOSITORY} --jq '.default_branch')
+          echo "DEFAULT_BRANCH=$DEFAULT_BRANCH" >> $GITHUB_ENV
+
+          # Get the latest commit SHA from the default branch
+          BASE_SHA=$(gh api repos/${GITHUB_REPOSITORY}/git/refs/heads/$DEFAULT_BRANCH --jq '.object.sha')
+
+          # Create a new branch
+          gh api \
+            --method POST \
+            repos/${GITHUB_REPOSITORY}/git/refs \
+            -f ref="refs/heads/$BRANCH_NAME" \
+            -f sha="$BASE_SHA"
+
+          # Get the current base-action/action.yml content
+          ACTION_CONTENT=$(gh api repos/${GITHUB_REPOSITORY}/contents/base-action/action.yml?ref=$DEFAULT_BRANCH --jq '.content' | base64 -d)
+
+          # Update the Claude Code version in the npm install command
+          UPDATED_CONTENT=$(echo "$ACTION_CONTENT" | sed -E "s/(npm install -g @anthropic-ai\/claude-code@)[0-9]+\.[0-9]+\.[0-9]+/\1${{ env.NEW_VERSION }}/")
+
+          # Verify the change would be made
+          if ! echo "$UPDATED_CONTENT" | grep -q "@anthropic-ai/claude-code@${{ env.NEW_VERSION }}"; then
+            echo "Error: Failed to update Claude Code version in content"
+            exit 1
+          fi
+
+          # Get the current SHA of base-action/action.yml for the update API call
+          FILE_SHA=$(gh api repos/${GITHUB_REPOSITORY}/contents/base-action/action.yml?ref=$DEFAULT_BRANCH --jq '.sha')
+
+          # Create the updated base-action/action.yml content in base64
+          echo "$UPDATED_CONTENT" | base64 > action.yml.b64
+
+          # Commit the updated base-action/action.yml via GitHub API
+          gh api \
+            --method PUT \
+            repos/${GITHUB_REPOSITORY}/contents/base-action/action.yml \
+            -f message="chore: bump Claude Code version to ${{ env.NEW_VERSION }}" \
+            -F content=@action.yml.b64 \
+            -f sha="$FILE_SHA" \
+            -f branch="$BRANCH_NAME"
+
+          echo "Successfully created branch and updated Claude Code version to ${{ env.NEW_VERSION }}"
+        env:
+          GH_TOKEN: ${{ secrets.RELEASE_PAT }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+
+      - name: Create Pull Request
+        run: |
+          # Determine trigger type for PR body
+          if [ "${{ github.event_name }}" = "repository_dispatch" ]; then
+            TRIGGER_INFO="repository dispatch event"
+          else
+            TRIGGER_INFO="manual workflow dispatch by @${GITHUB_ACTOR}"
+          fi
+
+          # Create PR body with proper YAML escape
+          printf -v PR_BODY "## Bump Claude Code to ${{ env.NEW_VERSION }}\n\nThis PR updates the Claude Code version in base-action/action.yml to ${{ env.NEW_VERSION }}.\n\n### Changes\n- Updated Claude Code version from current to \`${{ env.NEW_VERSION }}\`\n\n### Triggered by\n- $TRIGGER_INFO\n\n🤖 This PR was automatically created by the bump-claude-code-version workflow."
+
+          echo "Creating PR with gh pr create command"
+          PR_URL=$(gh pr create \
+            --repo "${GITHUB_REPOSITORY}" \
+            --title "chore: bump Claude Code version to ${{ env.NEW_VERSION }}" \
+            --body "$PR_BODY" \
+            --base "${DEFAULT_BRANCH}" \
+            --head "${BRANCH_NAME}")
+
+          echo "PR created successfully: $PR_URL"
+        env:
+          GH_TOKEN: ${{ secrets.RELEASE_PAT }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          GITHUB_ACTOR: ${{ github.actor }}
+          DEFAULT_BRANCH: ${{ env.DEFAULT_BRANCH }}
+          BRANCH_NAME: ${{ env.BRANCH_NAME }}
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@ -0,0 +1,52 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.2.12
+
+      - name: Install dependencies
+        run: bun install
+
+      - name: Run tests
+        run: bun test
+
+  prettier:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v1
+        with:
+          bun-version: latest
+
+      - name: Install dependencies
+        run: bun install
+
+      - name: Run prettier check
+        run: bun run format:check
+
+  typecheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.2.12
+
+      - name: Install dependencies
+        run: bun install
+
+      - name: Run TypeScript type check
+        run: bun run typecheck
--- a/.github/workflows/claude-review.yml
+++ b/.github/workflows/claude-review.yml
@ -0,0 +1,34 @@
+name: Auto review PRs
+
+on:
+  pull_request:
+    types: [opened]
+
+jobs:
+  auto-review:
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Auto review PR
+        uses: anthropics/claude-code-action@main
+        with:
+          direct_prompt: |
+            Please review this PR. Look at the changes and provide thoughtful feedback on:
+            - Code quality and best practices
+            - Potential bugs or issues
+            - Suggestions for improvements
+            - Overall architecture and design decisions
+            - Documentation consistency: Verify that README.md and other documentation files are updated to reflect any code changes (especially new inputs, features, or configuration options)
+
+            Be constructive and specific in your feedback. Give inline comments where applicable.
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY && secrets.ANTHROPIC_API_KEY || secrets.CLAUDE_CREDENTIALS }}
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CREDENTIALS }}
+          allowed_tools: "mcp__github__create_pending_pull_request_review,mcp__github__add_pull_request_review_comment_to_pending_review,mcp__github__submit_pending_pull_request_review,mcp__github__get_pull_request_diff"
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@ -0,0 +1,40 @@
+name: Claude Code
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  issues:
+    types: [opened, assigned]
+  pull_request_review:
+    types: [submitted]
+
+jobs:
+  claude:
+    if: |
+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
+      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+      issues: read
+      id-token: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Run Claude Code
+        id: claude
+        uses: anthropics/claude-code-action@beta
+        with:
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY && secrets.ANTHROPIC_API_KEY || secrets.CLAUDE_CREDENTIALS }}
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CREDENTIALS }}
+          allowed_tools: "Bash(bun install),Bash(bun test:*),Bash(bun run format),Bash(bun typecheck)"
+          custom_instructions: "You have also been granted tools for editing files and running bun commands (install, run, test, typecheck) for testing your changes: bun install, bun test, bun run format, bun typecheck."
+          model: "claude-opus-4-20250514"
--- a/.github/workflows/issue-triage.yml
+++ b/.github/workflows/issue-triage.yml
@ -0,0 +1,107 @@
+name: Claude Issue Triage
+description: Run Claude Code for issue triage in GitHub Actions
+on:
+  issues:
+    types: [opened]
+
+jobs:
+  triage-issue:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      issues: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup GitHub MCP Server
+        run: |
+          mkdir -p /tmp/mcp-config
+          cat > /tmp/mcp-config/mcp-servers.json << 'EOF'
+          {
+            "mcpServers": {
+              "github": {
+                "command": "docker",
+                "args": [
+                  "run",
+                  "-i",
+                  "--rm",
+                  "-e",
+                  "GITHUB_PERSONAL_ACCESS_TOKEN",
+                  "ghcr.io/github/github-mcp-server:sha-721fd3e"
+                ],
+                "env": {
+                  "GITHUB_PERSONAL_ACCESS_TOKEN": "${{ secrets.GITHUB_TOKEN }}"
+                }
+              }
+            }
+          }
+          EOF
+
+      - name: Create triage prompt
+        run: |
+          mkdir -p /tmp/claude-prompts
+          cat > /tmp/claude-prompts/triage-prompt.txt << 'EOF'
+          You're an issue triage assistant for GitHub issues. Your task is to analyze the issue and select appropriate labels from the provided list.
+
+          IMPORTANT: Don't post any comments or messages to the issue. Your only action should be to apply labels.
+
+          Issue Information:
+          - REPO: ${{ github.repository }}
+          - ISSUE_NUMBER: ${{ github.event.issue.number }}
+
+          TASK OVERVIEW:
+
+          1. First, fetch the list of labels available in this repository by running: `gh label list`. Run exactly this command with nothing else.
+
+          2. Next, use the GitHub tools to get context about the issue:
+             - You have access to these tools:
+               - mcp__github__get_issue: Use this to retrieve the current issue's details including title, description, and existing labels
+               - mcp__github__get_issue_comments: Use this to read any discussion or additional context provided in the comments
+               - mcp__github__update_issue: Use this to apply labels to the issue (do not use this for commenting)
+               - mcp__github__search_issues: Use this to find similar issues that might provide context for proper categorization and to identify potential duplicate issues
+               - mcp__github__list_issues: Use this to understand patterns in how other issues are labeled
+             - Start by using mcp__github__get_issue to get the issue details
+
+          3. Analyze the issue content, considering:
+             - The issue title and description
+             - The type of issue (bug report, feature request, question, etc.)
+             - Technical areas mentioned
+             - Severity or priority indicators
+             - User impact
+             - Components affected
+
+          4. Select appropriate labels from the available labels list provided above:
+             - Choose labels that accurately reflect the issue's nature
+             - Be specific but comprehensive
+             - Select priority labels if you can determine urgency (high-priority, med-priority, or low-priority)
+             - Consider platform labels (android, ios) if applicable
+             - If you find similar issues using mcp__github__search_issues, consider using a "duplicate" label if appropriate. Only do so if the issue is a duplicate of another OPEN issue.
+
+          5. Apply the selected labels:
+             - Use mcp__github__update_issue to apply your selected labels
+             - DO NOT post any comments explaining your decision
+             - DO NOT communicate directly with users
+             - If no labels are clearly applicable, do not apply any labels
+
+          IMPORTANT GUIDELINES:
+          - Be thorough in your analysis
+          - Only select labels from the provided list above
+          - DO NOT post any comments to the issue
+          - Your ONLY action should be to apply labels using mcp__github__update_issue
+          - It's okay to not add any labels if none are clearly applicable
+          EOF
+
+      - name: Run Claude Code for Issue Triage
+        uses: anthropics/claude-code-base-action@beta
+        with:
+          prompt_file: /tmp/claude-prompts/triage-prompt.txt
+          allowed_tools: "Bash(gh label list),mcp__github__get_issue,mcp__github__get_issue_comments,mcp__github__update_issue,mcp__github__search_issues,mcp__github__list_issues"
+          mcp_config: /tmp/mcp-config/mcp-servers.json
+          timeout_minutes: "5"
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY && secrets.ANTHROPIC_API_KEY || secrets.CLAUDE_CREDENTIALS }}
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CREDENTIALS }}
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@ -0,0 +1,187 @@
+name: Create Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: "Dry run (only show what would be created)"
+        required: false
+        type: boolean
+        default: false
+
+jobs:
+  create-release:
+    runs-on: ubuntu-latest
+    environment: production
+    permissions:
+      contents: write
+    outputs:
+      next_version: ${{ steps.next_version.outputs.next_version }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Get latest tag
+        id: get_latest_tag
+        run: |
+          # Get only version tags (v + number pattern)
+          latest_tag=$(git tag -l 'v[0-9]*' | sort -V | tail -1 || echo "v0.0.0")
+          if [ -z "$latest_tag" ]; then
+            latest_tag="v0.0.0"
+          fi
+          echo "latest_tag=$latest_tag" >> $GITHUB_OUTPUT
+          echo "Latest tag: $latest_tag"
+
+      - name: Calculate next version
+        id: next_version
+        run: |
+          latest_tag="${{ steps.get_latest_tag.outputs.latest_tag }}"
+          # Remove 'v' prefix and split by dots
+          version=${latest_tag#v}
+          IFS='.' read -ra VERSION_PARTS <<< "$version"
+
+          # Increment patch version
+          major=${VERSION_PARTS[0]:-0}
+          minor=${VERSION_PARTS[1]:-0}
+          patch=${VERSION_PARTS[2]:-0}
+          patch=$((patch + 1))
+
+          next_version="v${major}.${minor}.${patch}"
+          echo "next_version=$next_version" >> $GITHUB_OUTPUT
+          echo "Next version: $next_version"
+
+      - name: Display dry run info
+        if: ${{ inputs.dry_run }}
+        run: |
+          echo "🔍 DRY RUN MODE"
+          echo "Would create tag: ${{ steps.next_version.outputs.next_version }}"
+          echo "From commit: ${{ github.sha }}"
+          echo "Previous tag: ${{ steps.get_latest_tag.outputs.latest_tag }}"
+
+      - name: Create and push tag
+        if: ${{ !inputs.dry_run }}
+        run: |
+          next_version="${{ steps.next_version.outputs.next_version }}"
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+          git tag -a "$next_version" -m "Release $next_version"
+          git push origin "$next_version"
+
+      - name: Create Release
+        if: ${{ !inputs.dry_run }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          next_version="${{ steps.next_version.outputs.next_version }}"
+
+          gh release create "$next_version" \
+            --title "$next_version" \
+            --generate-notes \
+            --latest=false # We want to keep beta as the latest
+
+  update-beta-tag:
+    needs: create-release
+    if: ${{ !inputs.dry_run }}
+    runs-on: ubuntu-latest
+    environment: production
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Update beta tag
+        run: |
+          # Get the latest version tag
+          VERSION=$(git tag -l 'v[0-9]*' | sort -V | tail -1)
+
+          # Update the beta tag to point to this release
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git tag -fa beta -m "Update beta tag to ${VERSION}"
+          git push origin beta --force
+
+      - name: Update beta release to be latest
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # Update beta release to be marked as latest
+          gh release edit beta --latest
+
+  update-major-tag:
+    needs: create-release
+    if: ${{ !inputs.dry_run }}
+    runs-on: ubuntu-latest
+    environment: production
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Update major version tag
+        run: |
+          next_version="${{ needs.create-release.outputs.next_version }}"
+          # Extract major version (e.g., v0 from v0.0.20)
+          major_version=$(echo "$next_version" | cut -d. -f1)
+
+          # Update the major version tag to point to this release
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git tag -fa "$major_version" -m "Update $major_version tag to $next_version"
+          git push origin "$major_version" --force
+
+          echo "Updated $major_version tag to point to $next_version"
+
+  release-base-action:
+    needs: create-release
+    if: ${{ !inputs.dry_run }}
+    runs-on: ubuntu-latest
+    environment: production
+    steps:
+      - name: Checkout base-action repo
+        uses: actions/checkout@v4
+        with:
+          repository: anthropics/claude-code-base-action
+          token: ${{ secrets.CLAUDE_CODE_BASE_ACTION_PAT }}
+          fetch-depth: 0
+
+      - name: Create and push tag
+        run: |
+          next_version="${{ needs.create-release.outputs.next_version }}"
+
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+          # Create the version tag
+          git tag -a "$next_version" -m "Release $next_version - synced from claude-code-action"
+          git push origin "$next_version"
+
+          # Update the beta tag
+          git tag -fa beta -m "Update beta tag to ${next_version}"
+          git push origin beta --force
+
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ secrets.CLAUDE_CODE_BASE_ACTION_PAT }}
+        run: |
+          next_version="${{ needs.create-release.outputs.next_version }}"
+
+          # Create the release
+          gh release create "$next_version" \
+            --repo anthropics/claude-code-base-action \
+            --title "$next_version" \
+            --notes "Release $next_version - synced from anthropics/claude-code-action" \
+            --latest=false
+
+          # Update beta release to be latest
+          gh release edit beta \
+            --repo anthropics/claude-code-base-action \
+            --latest
--- a/.github/workflows/sync-base-action.yml
+++ b/.github/workflows/sync-base-action.yml
@ -0,0 +1,98 @@
+name: Sync Base Action to claude-code-base-action
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "base-action/**"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  sync-base-action:
+    name: Sync base-action to claude-code-base-action repository
+    runs-on: ubuntu-latest
+    environment: production
+    timeout-minutes: 10
+    steps:
+      - name: Checkout source repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          fetch-depth: 1
+
+      - name: Setup SSH and clone target repository
+        run: |
+          # Configure SSH with deploy key
+          mkdir -p ~/.ssh
+          echo "${{ secrets.CLAUDE_CODE_BASE_ACTION_REPO_DEPLOY_KEY }}" > ~/.ssh/deploy_key_base
+          chmod 600 ~/.ssh/deploy_key_base
+
+          # Configure SSH host
+          cat > ~/.ssh/config <<EOL
+          Host base-action.github.com
+            HostName github.com
+            User git
+            IdentityFile ~/.ssh/deploy_key_base
+            StrictHostKeyChecking no
+          EOL
+
+          # Clone the target repository
+          git clone git@base-action.github.com:anthropics/claude-code-base-action.git target-repo
+
+      - name: Sync base-action contents
+        run: |
+          cd target-repo
+
+          # Configure git
+          git config user.name "GitHub Actions"
+          git config user.email "actions@github.com"
+
+          # Remove all existing files except .git directory
+          find . -mindepth 1 -maxdepth 1 -name '.git' -prune -o -exec rm -rf {} +
+
+          # Copy all contents from base-action
+          cp -r ../base-action/. .
+
+          # Prepend mirror disclaimer to README if both files exist
+          if [ -f "README.md" ] && [ -f "MIRROR_DISCLAIMER.md" ]; then
+            cat MIRROR_DISCLAIMER.md README.md > README.tmp
+            mv README.tmp README.md
+          fi
+
+          # Check if there are any changes
+          if git diff --quiet && git diff --staged --quiet; then
+            echo "No changes to sync"
+            exit 0
+          fi
+
+          # Stage all changes
+          git add -A
+
+          # Get source commit info for the commit message
+          SOURCE_COMMIT="${GITHUB_SHA:0:7}"
+          SOURCE_COMMIT_MESSAGE=$(git -C .. log -1 --pretty=format:"%s" || echo "Update from base-action")
+
+          # Commit with descriptive message
+          git commit -m "Sync from claude-code-action base-action@${SOURCE_COMMIT}" \
+                     -m "" \
+                     -m "Source: anthropics/claude-code-action@${GITHUB_SHA}" \
+                     -m "Original message: ${SOURCE_COMMIT_MESSAGE}"
+
+          # Push to main branch
+          git push origin main
+
+          echo "Successfully synced base-action to claude-code-base-action"
+
+      - name: Create sync summary
+        if: success()
+        run: |
+          echo "## Sync Summary" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "✅ Successfully synced \`base-action\` directory to [anthropics/claude-code-base-action](https://github.com/anthropics/claude-code-base-action)" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "- **Source commit**: [\`${GITHUB_SHA:0:7}\`](https://github.com/anthropics/claude-code-action/commit/${GITHUB_SHA})" >> $GITHUB_STEP_SUMMARY
+          echo "- **Triggered by**: ${{ github.event_name }}" >> $GITHUB_STEP_SUMMARY
+          echo "- **Actor**: @${{ github.actor }}" >> $GITHUB_STEP_SUMMARY
--- a/.github/workflows/test-base-action.yml
+++ b/.github/workflows/test-base-action.yml
@ -0,0 +1,124 @@
+name: Test Claude Code Action
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  workflow_dispatch:
+    inputs:
+      test_prompt:
+        description: "Test prompt for Claude"
+        required: false
+        default: "List the files in the current directory starting with 'package'"
+
+jobs:
+  test-inline-prompt:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+      - name: Test with inline prompt
+        id: inline-test
+        uses: ./base-action
+        with:
+          prompt: ${{ github.event.inputs.test_prompt || 'List the files in the current directory starting with "package"' }}
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY && secrets.ANTHROPIC_API_KEY || secrets.CLAUDE_CREDENTIALS }}
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CREDENTIALS }}
+          allowed_tools: "LS,Read"
+          timeout_minutes: "3"
+
+      - name: Verify inline prompt output
+        run: |
+          OUTPUT_FILE="${{ steps.inline-test.outputs.execution_file }}"
+          CONCLUSION="${{ steps.inline-test.outputs.conclusion }}"
+
+          echo "Conclusion: $CONCLUSION"
+          echo "Output file: $OUTPUT_FILE"
+
+          if [ "$CONCLUSION" = "success" ]; then
+            echo "✅ Action completed successfully"
+          else
+            echo "❌ Action failed"
+            exit 1
+          fi
+
+          if [ -f "$OUTPUT_FILE" ]; then
+            if [ -s "$OUTPUT_FILE" ]; then
+              echo "✅ Execution log file created successfully with content"
+              echo "Validating JSON format:"
+              if jq . "$OUTPUT_FILE" > /dev/null 2>&1; then
+                echo "✅ Output is valid JSON"
+                echo "Content preview:"
+                head -c 200 "$OUTPUT_FILE"
+              else
+                echo "❌ Output is not valid JSON"
+                exit 1
+              fi
+            else
+              echo "❌ Execution log file is empty"
+              exit 1
+            fi
+          else
+            echo "❌ Execution log file not found"
+            exit 1
+          fi
+
+  test-prompt-file:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+      - name: Create test prompt file
+        run: |
+          cat > test-prompt.txt << EOF
+          ${PROMPT}
+          EOF
+        env:
+          PROMPT: ${{ github.event.inputs.test_prompt || 'List the files in the current directory starting with "package"' }}
+
+      - name: Test with prompt file and allowed tools
+        id: prompt-file-test
+        uses: ./base-action
+        with:
+          prompt_file: "test-prompt.txt"
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY && secrets.ANTHROPIC_API_KEY || secrets.CLAUDE_CREDENTIALS }}
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CREDENTIALS }}
+          allowed_tools: "LS,Read"
+          timeout_minutes: "3"
+
+      - name: Verify prompt file output
+        run: |
+          OUTPUT_FILE="${{ steps.prompt-file-test.outputs.execution_file }}"
+          CONCLUSION="${{ steps.prompt-file-test.outputs.conclusion }}"
+
+          echo "Conclusion: $CONCLUSION"
+          echo "Output file: $OUTPUT_FILE"
+
+          if [ "$CONCLUSION" = "success" ]; then
+            echo "✅ Action completed successfully"
+          else
+            echo "❌ Action failed"
+            exit 1
+          fi
+
+          if [ -f "$OUTPUT_FILE" ]; then
+            if [ -s "$OUTPUT_FILE" ]; then
+              echo "✅ Execution log file created successfully with content"
+              echo "Validating JSON format:"
+              if jq . "$OUTPUT_FILE" > /dev/null 2>&1; then
+                echo "✅ Output is valid JSON"
+                echo "Content preview:"
+                head -c 200 "$OUTPUT_FILE"
+              else
+                echo "❌ Output is not valid JSON"
+                exit 1
+              fi
+            else
+              echo "❌ Execution log file is empty"
+              exit 1
+            fi
+          else
+            echo "❌ Execution log file not found"
+            exit 1
+          fi
--- a/.github/workflows/test-claude-env.yml
+++ b/.github/workflows/test-claude-env.yml
@ -0,0 +1,48 @@
+name: Test Claude Env Feature
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  test-claude-env-with-comments:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+      - name: Test with comments in env
+        id: comment-test
+        uses: ./base-action
+        with:
+          prompt: |
+            Use the Bash tool to run: echo "VAR1: $VAR1" && echo "VAR2: $VAR2"
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY && secrets.ANTHROPIC_API_KEY || secrets.CLAUDE_CREDENTIALS }}
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CREDENTIALS }}
+          claude_env: |
+            # This is a comment
+            VAR1: value1
+            # Another comment
+            VAR2: value2
+
+            # Empty lines above should be ignored
+          allowed_tools: "Bash(echo:*)"
+          timeout_minutes: "2"
+
+      - name: Verify comment handling
+        run: |
+          OUTPUT_FILE="${{ steps.comment-test.outputs.execution_file }}"
+          if [ "${{ steps.comment-test.outputs.conclusion }}" = "success" ]; then
+            echo "✅ Comments in claude_env handled correctly"
+            if grep -q "value1" "$OUTPUT_FILE" && grep -q "value2" "$OUTPUT_FILE"; then
+              echo "✅ Environment variables set correctly despite comments"
+            else
+              echo "❌ Environment variables not found"
+              exit 1
+            fi
+          else
+            echo "❌ Failed with comments in claude_env"
+            exit 1
+          fi
--- a/.github/workflows/test-custom-executables.yml
+++ b/.github/workflows/test-custom-executables.yml
@ -0,0 +1,90 @@
+name: Test Custom Executables
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  test-custom-executables:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+      - name: Install Bun manually
+        run: |
+          echo "Installing Bun..."
+          curl -fsSL https://bun.sh/install | bash
+          echo "Bun installed at: $HOME/.bun/bin/bun"
+
+          # Verify Bun installation
+          if [ -f "$HOME/.bun/bin/bun" ]; then
+            echo "✅ Bun executable found"
+            $HOME/.bun/bin/bun --version
+          else
+            echo "❌ Bun executable not found"
+            exit 1
+          fi
+
+      - name: Install Claude Code manually
+        run: |
+          echo "Installing Claude Code..."
+          curl -fsSL https://claude.ai/install.sh | bash -s latest
+          echo "Claude Code installed at: $HOME/.local/bin/claude"
+
+          # Verify Claude installation
+          if [ -f "$HOME/.local/bin/claude" ]; then
+            echo "✅ Claude executable found"
+            ls -la "$HOME/.local/bin/claude"
+          else
+            echo "❌ Claude executable not found"
+            exit 1
+          fi
+
+      - name: Test with both custom executables
+        id: custom-test
+        uses: ./base-action
+        with:
+          prompt: |
+            List the files in the current directory starting with "package"
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY && secrets.ANTHROPIC_API_KEY || secrets.CLAUDE_CREDENTIALS }}
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CREDENTIALS }}
+          path_to_claude_code_executable: /home/runner/.local/bin/claude
+          path_to_bun_executable: /home/runner/.bun/bin/bun
+          allowed_tools: "LS,Read"
+
+      - name: Verify custom executables worked
+        run: |
+          OUTPUT_FILE="${{ steps.custom-test.outputs.execution_file }}"
+          CONCLUSION="${{ steps.custom-test.outputs.conclusion }}"
+
+          echo "Conclusion: $CONCLUSION"
+          echo "Output file: $OUTPUT_FILE"
+
+          if [ "$CONCLUSION" = "success" ]; then
+            echo "✅ Action completed successfully with both custom executables"
+          else
+            echo "❌ Action failed with custom executables"
+            exit 1
+          fi
+
+          if [ -f "$OUTPUT_FILE" ] && [ -s "$OUTPUT_FILE" ]; then
+            echo "✅ Execution log file created successfully"
+            if jq . "$OUTPUT_FILE" > /dev/null 2>&1; then
+              echo "✅ Output is valid JSON"
+              # Verify the task was completed
+              if grep -q "package" "$OUTPUT_FILE"; then
+                echo "✅ Claude successfully listed package files"
+              else
+                echo "⚠️ Could not verify if package files were listed"
+              fi
+            else
+              echo "❌ Output is not valid JSON"
+              exit 1
+            fi
+          else
+            echo "❌ Execution log file not found or empty"
+            exit 1
+          fi
--- a/.github/workflows/test-mcp-servers.yml
+++ b/.github/workflows/test-mcp-servers.yml
@ -0,0 +1,162 @@
+name: Test MCP Servers
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  test-mcp-integration:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 #v2
+
+      - name: Install dependencies
+        run: |
+          bun install
+          cd base-action/test/mcp-test
+          bun install
+
+      - name: Run Claude Code with MCP test
+        uses: ./base-action
+        id: claude-test
+        with:
+          prompt: "List all available tools"
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY && secrets.ANTHROPIC_API_KEY || secrets.CLAUDE_CREDENTIALS }}
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CREDENTIALS }}
+        env:
+          # Change to test directory so it finds .mcp.json
+          CLAUDE_WORKING_DIR: ${{ github.workspace }}/base-action/test/mcp-test
+
+      - name: Check MCP server output
+        run: |
+          echo "Checking Claude output for MCP servers..."
+
+          # Parse the JSON output
+          OUTPUT_FILE="${RUNNER_TEMP}/claude-execution-output.json"
+
+          if [ ! -f "$OUTPUT_FILE" ]; then
+            echo "Error: Output file not found!"
+            exit 1
+          fi
+
+          echo "Output file contents:"
+          cat $OUTPUT_FILE
+
+          # Check if mcp_servers field exists in the init event
+          if jq -e '.[] | select(.type == "system" and .subtype == "init") | .mcp_servers' "$OUTPUT_FILE" > /dev/null; then
+            echo "✓ Found mcp_servers in output"
+            
+            # Check if test-server is connected
+            if jq -e '.[] | select(.type == "system" and .subtype == "init") | .mcp_servers[] | select(.name == "test-server" and .status == "connected")' "$OUTPUT_FILE" > /dev/null; then
+              echo "✓ test-server is connected"
+            else
+              echo "✗ test-server not found or not connected"
+              jq '.[] | select(.type == "system" and .subtype == "init") | .mcp_servers' "$OUTPUT_FILE"
+              exit 1
+            fi
+            
+            # Check if mcp tools are available
+            if jq -e '.[] | select(.type == "system" and .subtype == "init") | .tools[] | select(. == "mcp__test-server__test_tool")' "$OUTPUT_FILE" > /dev/null; then
+              echo "✓ MCP test tool found"
+            else
+              echo "✗ MCP test tool not found"
+              jq '.[] | select(.type == "system" and .subtype == "init") | .tools' "$OUTPUT_FILE"
+              exit 1
+            fi
+          else
+            echo "✗ No mcp_servers field found in init event"
+            jq '.[] | select(.type == "system" and .subtype == "init")' "$OUTPUT_FILE"
+            exit 1
+          fi
+
+          echo "✓ All MCP server checks passed!"
+
+  test-mcp-config-flag:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 #v2
+
+      - name: Install dependencies
+        run: |
+          bun install
+          cd base-action/test/mcp-test
+          bun install
+
+      - name: Debug environment paths (--mcp-config test)
+        run: |
+          echo "=== Environment Variables (--mcp-config test) ==="
+          echo "HOME: $HOME"
+          echo ""
+          echo "=== Expected Config Paths ==="
+          echo "GitHub action writes to: $HOME/.claude/settings.json"
+          echo "Claude should read from: $HOME/.claude/settings.json"
+          echo ""
+          echo "=== Actual File System ==="
+          ls -la $HOME/.claude/ || echo "No $HOME/.claude directory"
+
+      - name: Run Claude Code with --mcp-config flag
+        uses: ./base-action
+        id: claude-config-test
+        with:
+          prompt: "List all available tools"
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY && secrets.ANTHROPIC_API_KEY || secrets.CLAUDE_CREDENTIALS }}
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CREDENTIALS }}
+          mcp_config: '{"mcpServers":{"test-server":{"type":"stdio","command":"bun","args":["simple-mcp-server.ts"],"env":{}}}}'
+        env:
+          # Change to test directory so bun can find the MCP server script
+          CLAUDE_WORKING_DIR: ${{ github.workspace }}/base-action/test/mcp-test
+
+      - name: Check MCP server output with --mcp-config
+        run: |
+          echo "Checking Claude output for MCP servers with --mcp-config flag..."
+
+          # Parse the JSON output
+          OUTPUT_FILE="${RUNNER_TEMP}/claude-execution-output.json"
+
+          if [ ! -f "$OUTPUT_FILE" ]; then
+            echo "Error: Output file not found!"
+            exit 1
+          fi
+
+          echo "Output file contents:"
+          cat $OUTPUT_FILE
+
+          # Check if mcp_servers field exists in the init event
+          if jq -e '.[] | select(.type == "system" and .subtype == "init") | .mcp_servers' "$OUTPUT_FILE" > /dev/null; then
+            echo "✓ Found mcp_servers in output"
+            
+            # Check if test-server is connected
+            if jq -e '.[] | select(.type == "system" and .subtype == "init") | .mcp_servers[] | select(.name == "test-server" and .status == "connected")' "$OUTPUT_FILE" > /dev/null; then
+              echo "✓ test-server is connected"
+            else
+              echo "✗ test-server not found or not connected"
+              jq '.[] | select(.type == "system" and .subtype == "init") | .mcp_servers' "$OUTPUT_FILE"
+              exit 1
+            fi
+            
+            # Check if mcp tools are available
+            if jq -e '.[] | select(.type == "system" and .subtype == "init") | .tools[] | select(. == "mcp__test-server__test_tool")' "$OUTPUT_FILE" > /dev/null; then
+              echo "✓ MCP test tool found"
+            else
+              echo "✗ MCP test tool not found"
+              jq '.[] | select(.type == "system" and .subtype == "init") | .tools' "$OUTPUT_FILE"
+              exit 1
+            fi
+          else
+            echo "✗ No mcp_servers field found in init event"
+            jq '.[] | select(.type == "system" and .subtype == "init")' "$OUTPUT_FILE"
+            exit 1
+          fi
+
+          echo "✓ All MCP server checks passed with --mcp-config flag!"
--- a/.github/workflows/test-settings.yml
+++ b/.github/workflows/test-settings.yml
@ -0,0 +1,189 @@
+name: Test Settings Feature
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  test-settings-inline-allow:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+      - name: Test with inline settings JSON (echo allowed)
+        id: inline-settings-test
+        uses: ./base-action
+        with:
+          prompt: |
+            Use Bash to echo "Hello from settings test"
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY && secrets.ANTHROPIC_API_KEY || secrets.CLAUDE_CREDENTIALS }}
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CREDENTIALS }}
+          settings: |
+            {
+              "permissions": {
+                "allow": ["Bash(echo:*)"]
+              }
+            }
+          timeout_minutes: "2"
+
+      - name: Verify echo worked
+        run: |
+          OUTPUT_FILE="${{ steps.inline-settings-test.outputs.execution_file }}"
+          CONCLUSION="${{ steps.inline-settings-test.outputs.conclusion }}"
+
+          echo "Conclusion: $CONCLUSION"
+
+          if [ "$CONCLUSION" = "success" ]; then
+            echo "✅ Action completed successfully"
+          else
+            echo "❌ Action failed"
+            exit 1
+          fi
+
+          # Check that permission was NOT denied
+          if grep -q "Permission to use Bash with command echo.*has been denied" "$OUTPUT_FILE"; then
+            echo "❌ Echo command was denied when it should have been allowed"
+            cat "$OUTPUT_FILE"
+            exit 1
+          fi
+
+          # Check if the echo command worked
+          if grep -q "Hello from settings test" "$OUTPUT_FILE"; then
+            echo "✅ Bash echo command worked (allowed by permissions)"
+          else
+            echo "❌ Bash echo command didn't work"
+            cat "$OUTPUT_FILE"
+            exit 1
+          fi
+
+  test-settings-inline-deny:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+      - name: Test with inline settings JSON (echo denied)
+        id: inline-settings-test
+        uses: ./base-action
+        with:
+          prompt: |
+            Use Bash to echo "This should not work"
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY && secrets.ANTHROPIC_API_KEY || secrets.CLAUDE_CREDENTIALS }}
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CREDENTIALS }}
+          settings: |
+            {
+              "permissions": {
+                "deny": ["Bash(echo:*)"]
+              }
+            }
+          timeout_minutes: "2"
+
+      - name: Verify echo was denied
+        run: |
+          OUTPUT_FILE="${{ steps.inline-settings-test.outputs.execution_file }}"
+
+          # Check that permission was denied in the tool_result
+          if grep -q "Permission to use Bash with command echo.*has been denied" "$OUTPUT_FILE"; then
+            echo "✅ Echo command was correctly denied by permissions"
+          else
+            echo "❌ Expected permission denied message not found"
+            cat "$OUTPUT_FILE"
+            exit 1
+          fi
+
+  test-settings-file-allow:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+      - name: Create settings file (echo allowed)
+        run: |
+          cat > test-settings.json << EOF
+          {
+            "permissions": {
+              "allow": ["Bash(echo:*)"]
+            }
+          }
+          EOF
+
+      - name: Test with settings file
+        id: file-settings-test
+        uses: ./base-action
+        with:
+          prompt: |
+            Use Bash to echo "Hello from settings file test"
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY && secrets.ANTHROPIC_API_KEY || secrets.CLAUDE_CREDENTIALS }}
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CREDENTIALS }}
+          settings: "test-settings.json"
+          timeout_minutes: "2"
+
+      - name: Verify echo worked
+        run: |
+          OUTPUT_FILE="${{ steps.file-settings-test.outputs.execution_file }}"
+          CONCLUSION="${{ steps.file-settings-test.outputs.conclusion }}"
+
+          echo "Conclusion: $CONCLUSION"
+
+          if [ "$CONCLUSION" = "success" ]; then
+            echo "✅ Action completed successfully"
+          else
+            echo "❌ Action failed"
+            exit 1
+          fi
+
+          # Check that permission was NOT denied
+          if grep -q "Permission to use Bash with command echo.*has been denied" "$OUTPUT_FILE"; then
+            echo "❌ Echo command was denied when it should have been allowed"
+            cat "$OUTPUT_FILE"
+            exit 1
+          fi
+
+          # Check if the echo command worked
+          if grep -q "Hello from settings file test" "$OUTPUT_FILE"; then
+            echo "✅ Bash echo command worked (allowed by permissions)"
+          else
+            echo "❌ Bash echo command didn't work"
+            cat "$OUTPUT_FILE"
+            exit 1
+          fi
+
+  test-settings-file-deny:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+      - name: Create settings file (echo denied)
+        run: |
+          cat > test-settings.json << EOF
+          {
+            "permissions": {
+              "deny": ["Bash(echo:*)"]
+            }
+          }
+          EOF
+
+      - name: Test with settings file
+        id: file-settings-test
+        uses: ./base-action
+        with:
+          prompt: |
+            Use Bash to echo "This should not work from file"
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY && secrets.ANTHROPIC_API_KEY || secrets.CLAUDE_CREDENTIALS }}
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CREDENTIALS }}
+          settings: "test-settings.json"
+          timeout_minutes: "2"
+
+      - name: Verify echo was denied
+        run: |
+          OUTPUT_FILE="${{ steps.file-settings-test.outputs.execution_file }}"
+
+          # Check that permission was denied in the tool_result
+          if grep -q "Permission to use Bash with command echo.*has been denied" "$OUTPUT_FILE"; then
+            echo "✅ Echo command was correctly denied by permissions"
+          else
+            echo "❌ Expected permission denied message not found"
+            cat "$OUTPUT_FILE"
+            exit 1
+          fi
--- a/.github/workflows/update-major-tag.yml
+++ b/.github/workflows/update-major-tag.yml
@ -0,0 +1,24 @@
+name: Update Beta Tag
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  update-beta-tag:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Update beta tag
+        run: |
+          # Get the current release version
+          VERSION=${GITHUB_REF#refs/tags/}
+
+          # Update the beta tag to point to this release
+          git config user.name github-actions[bot]
+          git config user.email github-actions[bot]@users.noreply.github.com
+          git tag -fa beta -m "Update beta tag to ${VERSION}"
+          git push origin beta --force