From 2c0a64122c1192b053c96306f65e346ac03134a3 Mon Sep 17 00:00:00 2001
From: "talieisin-org-automation[bot]"
 <317582940+talieisin-org-automation[bot]@users.noreply.github.com>
Date: Wed, 19 Aug 2026 03:14:24 +0000
Subject: [PATCH] chore: update .github/workflows/claude-command.yml (org
 automation sync)

---
 .github/workflows/claude-command.yml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/claude-command.yml b/.github/workflows/claude-command.yml
index 35a27b9..f724efa 100644
--- a/.github/workflows/claude-command.yml
+++ b/.github/workflows/claude-command.yml
@@ -10,9 +10,17 @@ on:
   pull_request_review_comment:
     types: [created]
 
+# Minimal explicit permissions: they CAP what the reusable workflow's
+# jobs may request from GITHUB_TOKEN (the answer round reads code and
+# threads; writes go through app tokens minted inside the reusable).
+permissions:
+  contents: read
+  issues: read
+  pull-requests: read
+
 jobs:
   command:
-    if: startsWith(github.event.comment.body, '@claude')
+    if: startsWith(github.event.comment.body, '@claude ') || github.event.comment.body == '@claude'
     uses: Talieisin/.github/.github/workflows/claude-command.yml@main
     with:
       model: sonnet