Skip to content

Use Write tool + --body-file for all skill gh commands to fix permission prompts#99

Merged
sebastientaggart merged 2 commits into
devfrom
fix/start-body-file-permission
Apr 11, 2026
Merged

Use Write tool + --body-file for all skill gh commands to fix permission prompts#99
sebastientaggart merged 2 commits into
devfrom
fix/start-body-file-permission

Conversation

@sebastientaggart

@sebastientaggart sebastientaggart commented Apr 11, 2026

Copy link
Copy Markdown
Member

Summary

  • Replace all heredoc-based body/notes passing in skill gh commands with a two-step pattern: write content to /tmp/cc_*.md via the file-writing tool, then pass --body-file /tmp/cc_*.md
  • This avoids all shell metacharacter issues ($, #, quoted delimiters, substitutions) that trigger Claude Code permission prompts
  • Updated all 3 affected source skills (start.md, submit-for-review.md, deploy.md) and regenerated all 12 adapter files
  • Works identically across Claude Code, Gemini CLI, Cursor, and Codex

Closes #82

Test plan

  • Run /start — verified gh issue create and gh issue comment execute without permission prompts
  • Run /submit-for-review — verify gh pr create, gh issue comment, and gh issue create (follow-ups) work without prompts
  • Run /deploy — verify gh pr create and gh release create work without prompts

@sebastientaggart sebastientaggart changed the title Fix start.md gh commands missed in #82 body-file conversion Use unquoted heredocs for all skill gh commands to fix permission prompts Apr 11, 2026
sebastientaggart and others added 2 commits April 11, 2026 10:40
Heredocs in Bash commands — quoted, unquoted, or via $(cat) — all trigger
Claude Code permission prompts due to shell metacharacter detection (#, $,
quotes). Moving body content to a temp file via the Write tool bypasses
shell parsing entirely. The gh command becomes a clean prefix match for
Bash(gh:*).

Testing in start.md first before applying to other skills.

Ref #82

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
Replace heredoc patterns (--body-file - <<EOF, --notes-file - <<EOF) with a
two-step approach: write body to /tmp/cc_*.md via the file-writing tool, then
pass --body-file /tmp/cc_*.md to gh. This avoids all shell metacharacter
issues that trigger Claude Code permission prompts ($, #, quoted delimiters).

Updated skills: start.md, submit-for-review.md, deploy.md
Regenerated all 12 adapter files via sync.sh.

Closes #82

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
@sebastientaggart
sebastientaggart force-pushed the fix/start-body-file-permission branch from ffc8a2a to e5e8b3e Compare April 11, 2026 19:35
@sebastientaggart sebastientaggart changed the title Use unquoted heredocs for all skill gh commands to fix permission prompts Use Write tool + --body-file for all skill gh commands to fix permission prompts Apr 11, 2026
@sebastientaggart

Copy link
Copy Markdown
Member Author

Review Summary

Verdict: APPROVE

Findings

  • [NOTE] The submit-for-review skill instructs the agent to write each follow-up issue body to the same file (/tmp/cc_followup_body.md), which is fine for sequential creation but worth noting — if an agent ever parallelizes the gh issue create calls, the file could be clobbered mid-flight. Current instructions imply sequential execution so this is not a practical issue today.

  • [NOTE] All 12 adapter files have updated hashes in their footer comments, consistent with being regenerated by sync.sh. The pattern applied across all three source skills (start.md, submit-for-review.md, deploy.md) is mechanically identical and correctly replaces every heredoc/stdin pattern with the two-step Write-then---body-file approach.

No correctness, security, or convention issues found. The change is a straightforward, well-scoped refactor of how multi-line body content is passed to gh CLI commands — replacing shell heredocs with temp-file writes to avoid permission prompt friction. Commit messages are in imperative mood and explain the "why" clearly.

@sebastientaggart
sebastientaggart merged commit 6b7b3dc into dev Apr 11, 2026
2 checks passed
@sebastientaggart
sebastientaggart deleted the fix/start-body-file-permission branch April 11, 2026 19:40
@sebastientaggart sebastientaggart mentioned this pull request Apr 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant