- Add show_full_output: true to both claude.yml and upstream-sync.yml - Add allowed_tools (Bash, Read, Write, etc.) to upstream-sync merge step - Upgrade kcl-ci to v1.37.0 (defaults show_full_output and full tools) Fixes: Claude was burning 38 turns hitting sandbox permission denials trying to run bun test and git push during upstream sync. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>