docs/capabilities-and-limitations.md presents the removed allowed_tools input as current configuration

Summary

docs/capabilities-and-limitations.md#L22 tells users to configure tool access with the allowed_tools input, which was removed in v1.0. Every other page in docs/ lists that input as deprecated; this is the one place it still reads as current guidance.

The line

• Run Arbitrary Bash Commands: By default, Claude cannot execute Bash commands unless explicitly allowed using the allowed_tools configuration

allowed_tools is not a declared input in action.yml. The replacement is claude_args with --allowedTools.

Why this one is different from the other mentions

allowed_tools appears in several other docs, but always correctly marked as removed:

• docs/configuration.md:342 — migration table: `allowed_tools` | Use `claude_args: "--allowedTools Tool1,Tool2"`
• docs/usage.md:106 — `allowed_tools` | **DEPRECATED**: Use `claude_args` with `--allowedTools` instead

Those are intentional and should stay. capabilities-and-limitations.md is the only occurrence phrased as a live instruction, in a document a new user is likely to read early — it is linked from the README as "What Claude can and cannot do".

Suggested fix

Reword to reference the current input:

• Run Arbitrary Bash Commands: By default, Claude cannot execute Bash commands unless explicitly allowed via claude_args with --allowedTools

Related trivial cleanup in the same area

Unrelated to the docs, but too small to merit its own issue — src/github/validation/trigger.ts#L128-L130 has a ternary whose branches are identical:

const commentBody = isIssueCommentEvent(context)
  ? context.payload.comment.body
  : context.payload.comment.body;

Both IssueCommentEvent and PullRequestReviewCommentEvent expose payload.comment.body, so this reduces to const commentBody = context.payload.comment.body;. No behaviour change — the discriminated-union narrowing is already satisfied by the enclosing if.

Happy to fold both into one small PR, or to drop the second if you'd rather keep docs changes separate from source changes.

Environment

• Repository at d721746d683d812e669ce117cebe55a85fbd9c3e (main)