shell

Write the body to a file in the session scratchpad using the Write tool, then post it with `gh pr comment --body-file <path>`. Inline `--body` strings lose backticks and `$` to shell interpolation, and `--body` is not an acceptable fallback.

The permission matcher reads a command prefix, so placing the flag before the subcommand (`gh -R owner/repo issue view`) changes the prefix to `gh -R` and matches no allowlist entry. Put the flag after the subcommand: `gh issue view --repo owner/repo`.

No. A redirect that creates a file (`command > path`) is denied by the permission guard regardless of destination. Use the Write tool for content you compose, or run the command without the redirect and Write its returned output if it must persist.

No. The matcher evaluates compositions element-wise: a chain of allowlisted commands executes without prompting, and a chain containing a denied element is caught by that element. One atomic command per call is still preferred for transcript legibility, not permission necessity.

An env-var prefix defeats the allowlist entry, including in post-statement position after `;`. Prefer the repo's own scripts (e.g., `npm --prefix <app> run <script>`) over inline env-prefixed commands. Note that `=` in argument position, like `make FOO=1 target`, is not an env prefix.

Do not use it for the loop's state machine logic (covered by agents-configuration) or for what a merge verdict must contain (covered by quality-gates). It only governs working-file placement and shell command composition.