feat: Add comment-on-duplicates script for safer duplicate handling

Replace `gh issue comment:*` permission with a constrained script that:
- Only accepts validated issue numbers
- Enforces max 3 duplicates
- Uses a fixed comment format
- Prevents arbitrary comment content injection

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

.claude/commands/dedupe.md

@@ -1,5 +1,5 @@
 ---
-allowed-tools: Bash(gh issue view:*), Bash(gh search:*), Bash(gh issue list:*), Bash(gh api:*), Bash(gh issue comment:*)
+allowed-tools: Bash(gh issue view:*), Bash(gh search:*), Bash(gh issue list:*), Bash(./scripts/comment-on-duplicates.sh:*)
 description: Find duplicate GitHub issues
 ---
 
@@ -11,28 +11,13 @@ To do this, follow these steps precisely:
 2. Use an agent to view a Github issue, and ask the agent to return a summary of the issue
 3. Then, launch 5 parallel agents to search Github for duplicates of this issue, using diverse keywords and search approaches, using the summary from #1
 4. Next, feed the results from #1 and #2 into another agent, so that it can filter out false positives, that are likely not actually duplicates of the original issue. If there are no duplicates remaining, do not proceed.
-5. Finally, comment back on the issue with a list of up to three duplicate issues (or zero, if there are no likely duplicates)
+5. Finally, use the comment script to post duplicates:
+   ```
+   ./scripts/comment-on-duplicates.sh --base-issue <issue-number> --potential-duplicates <dup1> <dup2> <dup3>
+   ```
 
 Notes (be sure to tell this to your agents, too):
 
 - Use `gh` to interact with Github, rather than web fetch
-- Do not use other tools, beyond `gh` (eg. don't use other MCP servers, file edit, etc.)
+- Do not use other tools, beyond `gh` and the comment script (eg. don't use other MCP servers, file edit, etc.)
 - Make a todo list first
-- For your comment, follow the following format precisely (assuming for this example that you found 3 suspected duplicates):
-
----
-
-Found 3 possible duplicate issues:
-
-1. <link to issue>
-2. <link to issue>
-3. <link to issue>
-
-This issue will be automatically closed as a duplicate in 3 days.
-
-- If your issue is a duplicate, please close it and 👍 the existing issue instead
-- To prevent auto-closure, add a comment or 👎 this comment
-
-🤖 Generated with [Claude Code](https://claude.ai/code)
-
----

CHANGELOG.md

@@ -1,45 +1,5 @@
 # Changelog
 
-## 2.0.37
-
-- Fixed how idleness is computed for notifications
-- Hooks: Added matcher values for Notification hook events
-- Output Styles: Added `keep-coding-instructions` option to frontmatter
-
-## 2.0.36
-
-- Fixed: DISABLE_AUTOUPDATER environment variable now properly disables package manager update notifications
-- Fixed queued messages being incorrectly executed as bash commands
-- Fixed input being lost when typing while a queued message is processed
-
-## 2.0.35
-
-- Improve fuzzy search results when searching commands
-- Improved VS Code extension to respect `chat.fontSize` and `chat.fontFamily` settings throughout the entire UI, and apply font changes immediately without requiring reload
-- Added `CLAUDE_CODE_EXIT_AFTER_STOP_DELAY` environment variable to automatically exit SDK mode after a specified idle duration, useful for automated workflows and scripts
-- Migrated `ignorePatterns` from project config to deny permissions in the localSettings.
-- Fixed messages returning null `stop_reason` and `stop_sequence` values
-- Fixed menu navigation getting stuck on items with empty string or other falsy values (e.g., in the `/hooks` menu)
-
-## 2.0.34
-
-- VSCode Extension: Added setting to configure the initial permission mode for new conversations
-- Improved file path suggestion performance with native Rust-based fuzzy finder
-- Fixed infinite token refresh loop that caused MCP servers with OAuth (e.g., Slack) to hang during connection
-- Fixed memory crash when reading or writing large files (especially base64-encoded images)
-
-## 2.0.33
-
-- Native binary installs now launch quicker.
-- Fixed `claude doctor` incorrectly detecting Homebrew vs npm-global installations by properly resolving symlinks
-- Fixed `claude mcp serve` exposing tools with incompatible outputSchemas
-
-## 2.0.32
-
-- Un-deprecate output styles based on community feedback
-- Added `companyAnnouncements` setting for displaying announcements on startup
-- Fixed hook progress messages not updating correctly during PostToolUse hook execution
-
 ## 2.0.31
 
 - Windows: native installation uses shift+tab as shortcut for mode switching, instead of alt+m

README.md

@@ -22,18 +22,7 @@ npm install -g @anthropic-ai/claude-code
 
 ## Plugins
 
-This repository includes 8 official Claude Code plugins that extend functionality with custom commands and agents:
-
-- **[agent-sdk-dev](./plugins/agent-sdk-dev/)** - Development tools for Claude Agent SDK applications
-- **[code-review](./plugins/code-review/)** - Automated pull request code review
-- **[commit-commands](./plugins/commit-commands/)** - Git workflow automation
-- **[explanatory-output-style](./plugins/explanatory-output-style/)** - Enhanced explanatory communication style
-- **[feature-dev](./plugins/feature-dev/)** - Comprehensive feature development workflow
-- **[learning-output-style](./plugins/learning-output-style/)** - Educational and learning-focused output
-- **[pr-review-toolkit](./plugins/pr-review-toolkit/)** - Advanced PR review tools
-- **[security-guidance](./plugins/security-guidance/)** - Security-focused development guidance
-
-See the [plugins directory](./plugins/README.md) for detailed documentation on available plugins.
+This repository includes several Claude Code plugins that extend functionality with custom commands and agents. See the [plugins directory](./plugins/README.md) for detailed documentation on available plugins.
 
 ## Reporting Bugs
 

plugins/code-review/commands/code-review.md

@@ -31,7 +31,7 @@ Examples of false positives, for steps 4 and 5:
 - Pre-existing issues
 - Something that looks like a bug but is not actually a bug
 - Pedantic nitpicks that a senior engineer wouldn't call out
-- Issues that a linter, typechecker, or test runner will catch (eg. failing tests, lint errors, type errors). Do not run these to verify; assume that they will be run as part of CI.
+- Issues that a linter will catch (no need to run the linter to verify)
 - General code quality issues (eg. lack of test coverage, general security issues), unless explicitly required in CLAUDE.md
 - Issues that are called out in CLAUDE.md, but explicitly silenced in the code (eg. due to a lint ignore comment)
 

scripts/comment-on-duplicates.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+#
+# Comments on a GitHub issue with a list of potential duplicates.
+# Usage: ./comment-on-duplicates.sh --base-issue 123 --potential-duplicates 456 789 101
+#
+
+set -euo pipefail
+
+REPO="anthropics/claude-code"
+BASE_ISSUE=""
+DUPLICATES=()
+
+# Parse arguments
+while [[ $# -gt 0 ]]; do
+  case $1 in
+    --base-issue)
+      BASE_ISSUE="$2"
+      shift 2
+      ;;
+    --potential-duplicates)
+      shift
+      while [[ $# -gt 0 && ! "$1" =~ ^-- ]]; do
+        DUPLICATES+=("$1")
+        shift
+      done
+      ;;
+    *)
+      echo "Unknown option: $1" >&2
+      exit 1
+      ;;
+  esac
+done
+
+# Validate base issue
+if [[ -z "$BASE_ISSUE" ]]; then
+  echo "Error: --base-issue is required" >&2
+  exit 1
+fi
+
+if ! [[ "$BASE_ISSUE" =~ ^[0-9]+$ ]]; then
+  echo "Error: --base-issue must be a number, got: $BASE_ISSUE" >&2
+  exit 1
+fi
+
+# Validate duplicates
+if [[ ${#DUPLICATES[@]} -eq 0 ]]; then
+  echo "Error: --potential-duplicates requires at least one issue number" >&2
+  exit 1
+fi
+
+if [[ ${#DUPLICATES[@]} -gt 3 ]]; then
+  echo "Error: --potential-duplicates accepts at most 3 issues" >&2
+  exit 1
+fi
+
+for dup in "${DUPLICATES[@]}"; do
+  if ! [[ "$dup" =~ ^[0-9]+$ ]]; then
+    echo "Error: duplicate issue must be a number, got: $dup" >&2
+    exit 1
+  fi
+done
+
+# Build comment body
+COUNT=${#DUPLICATES[@]}
+if [[ $COUNT -eq 1 ]]; then
+  HEADER="Found 1 possible duplicate issue:"
+else
+  HEADER="Found $COUNT possible duplicate issues:"
+fi
+
+BODY="$HEADER"$'\n\n'
+INDEX=1
+for dup in "${DUPLICATES[@]}"; do
+  BODY+="$INDEX. https://github.com/$REPO/issues/$dup"$'\n'
+  ((INDEX++))
+done
+
+BODY+=$'\n'"This issue will be automatically closed as a duplicate in 3 days."$'\n\n'
+BODY+="- If your issue is a duplicate, please close it and 👍 the existing issue instead"$'\n'
+BODY+="- To prevent auto-closure, add a comment or 👎 this comment"$'\n\n'
+BODY+="🤖 Generated with [Claude Code](https://claude.ai/code)"
+
+# Post the comment
+gh issue comment "$BASE_ISSUE" --repo "$REPO" --body "$BODY"
+
+echo "Posted duplicate comment on issue #$BASE_ISSUE"