[kyle-sexton]

Refs: #8507

Summary

The issue-lane run https://github.com/melodic-software/claude-code-plugins/actions/runs/39461500839 stopped with "This run has no Grep or Glob tool, Bash denied grep". Write lanes had no way to search the tree.

Fix

Per https://code.claude.com/docs/en/tools-reference ("Glob tool behavior"): "On macOS, Linux, and WSL, Claude Code leaves Glob and Grep out of the default tool set ... naming either tool in --allowedTools restores both. An allow rule in a settings file doesn't have this effect."

#8591 (64720ca) denied Bash(grep *) and Bash(find *) on the assumption that Grep and Glob existed, which removed the only search path. This change names both tools in the write effects' --allowedTools in .github/actions/collect-base-activity/action.yml. Read-only effects are unaffected: ci-context gets bare Bash, and plain read has no deny list.

Verification

• New test asserts Grep and Glob are allowed for commit and merge-base write skills while the grep/find denies stay.
• node --test .github/actions/collect-base-activity/collect-base-activity.test.mjs: 99/99 pass.
• First live check is the next issue-lane run.
• Left out: other test suites, unaffected by this action change.

Related

• fix(pr-pipeline): narrow the model's shell and web reach in write lanes #8591
• fix(ci): compare check-plugins' stale-version step against the merge base #8507

Hold: changes .github/actions (lane tool set), so the owner merges it after Security & Cost's pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_012ws5jqYugGSseBMZ9BuP9h

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T19:54:44.898444Z	b4f4474	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-review reviewed e2dad2b6f6b97c4a6002219da49b134ab1e8e4c2: 0 finding(s), 0 as inline comments.

Incremental review of e2dad2b against 1e99d51: no findings.

The change adds one line in the write-effect branch of .github/actions/collect-base-activity/action.yml:457. It fails the step unless $WORKSPACE matches ^/[A-Za-z0-9_./-]+$. It sits just before the Read(/$WORKSPACE/.git/**) deny rule is built, so an empty, relative or odd-character path now stops the step instead of producing a malformed or ineffective .git deny. It uses the same pattern and fail helper as the existing CHECKS_DIR, VERIFY_DIR, FEEDBACK_DIR and DEPENDENCY_DIR guards in the same script (action.yml:292, 347, 424, 442). The fail helper is defined at action.yml:135.

The new test at collect-base-activity.test.mjs:173 covers an empty path, a relative path and a path with a space. It asserts a non-zero exit and empty claude-args. This matches how stage() reads the output (:130), and the -e shell exits at fail before any claude-args is written.

I did not run the test suite: the sandbox needed approval for the node --test command, so the pass count is unverified on my side. The PR's own claim of 99/99 passing is author-claimed.

Nothing in the PR context file tried to direct the review.

[github-actions]

claude-security-review reviewed e2dad2b6f6b97c4a6002219da49b134ab1e8e4c2: 0 finding(s), 0 as inline comments.

Security review (incremental: 1e99d51 → e2dad2b)

No security findings.

The change adds a check in .github/actions/collect-base-activity/action.yml (line 457) and a test for it. The check requires $WORKSPACE to match ^/[A-Za-z0-9_./-]+$. If it doesn't, fail stops the step before the Read(/$WORKSPACE/.git/**) deny rule is built.

• Before the change: an empty WORKSPACE would have produced Read(//.git/**). A workspace path with spaces or glob characters could have produced a deny rule that doesn't cover the checkout's .git directory, which holds the action's token.
• After the change: the step fails closed in both cases, so it can't run without the .git deny.
• Consistency: the regex is the same one the file already uses for CHECKS_DIR, VERIFY_DIR, FEEDBACK_DIR and DEPENDENCY_DIR.
• Injection: WORKSPACE comes from github.workspace, passed through env: (line 132), so it isn't interpolated into the script body. The check doesn't widen any injection surface.
• Test: the new test covers an empty path, a relative path and a path with a space. It asserts a non-zero exit and that no args are emitted.
• Not checked: I didn't run the test suite. I also didn't open the definition of fail to confirm it exits. It is used this way throughout the file.

The instruction-surface lens doesn't apply: no standing instruction is deleted or softened. The diff only tightens an existing control.