diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 2496464..1817212 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -14,12 +14,15 @@ jobs:
           node-version: "24"
           cache: "pnpm"
 
-      - run: pnpm install --frozen-lockfile
+      - run: pnpm install --frozen-lockfile --ignore-scripts
       - run: pnpm typecheck
       - run: pnpm test
 
   agents:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     strategy:
       fail-fast: false
       matrix:
@@ -31,6 +34,7 @@ jobs:
       OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
       CURSOR_API_KEY: ${{ secrets.CURSOR_API_KEY }}
       GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+      GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
@@ -39,5 +43,5 @@ jobs:
           node-version: "24"
           cache: "pnpm"
 
-      - run: pnpm install --frozen-lockfile
+      - run: pnpm install --frozen-lockfile --ignore-scripts
       - run: pnpm ${{ matrix.test }} ${{ matrix.agent }}
diff --git a/README.md b/README.md
index 8f68440..592119f 100644
--- a/README.md
+++ b/README.md
@@ -38,6 +38,7 @@ Pullfrog is the bridge between your preferred coding agents and GitHub. Use it f
 - **🤙 Issue management** — Via the "issue created" trigger, Pullfrog can automatically respond to common questions, create implementation plans, and link to related issues/PRs. Or (if you're feeling lucky) you can prompt it to immediately attempt a PR addressing new issues.
 - **Literally whatever** — Want to have the agent automatically add docs to all new PRs? Cut a new release with agent-written notes on every commit to `main`? Pullfrog lets you do it.
 
+
 <!-- Features
 - **Agent-agnostic** — Switch between agents with the click of a radio button.
 - ** -->
diff --git a/agents/claude.ts b/agents/claude.ts
index d15f502..4817814 100644
--- a/agents/claude.ts
+++ b/agents/claude.ts
@@ -31,7 +31,7 @@ function buildDisallowedTools(ctx: AgentRunContext): string[] {
   // both "disabled" and "restricted" block native bash
   // "restricted" means use MCP bash tool instead
   const bash = ctx.payload.bash;
-  if (bash !== "enabled") disallowed.push("Bash");
+  if (bash !== "enabled") disallowed.push("Bash", "Task(Bash)");
   return disallowed;
 }
 
diff --git a/entry b/entry
index db0d736..0221b17 100755
--- a/entry
+++ b/entry
@@ -138454,7 +138454,7 @@ function buildDisallowedTools(ctx) {
   if (ctx.payload.search === "disabled") disallowed.push("WebSearch");
   if (ctx.payload.write === "disabled") disallowed.push("Write");
   const bash = ctx.payload.bash;
-  if (bash !== "enabled") disallowed.push("Bash");
+  if (bash !== "enabled") disallowed.push("Bash", "Task(Bash)");
   return disallowed;
 }
 async function installClaude() {
diff --git a/play.ts b/play.ts
index e02ba03..d6c3734 100644
--- a/play.ts
+++ b/play.ts
@@ -30,6 +30,8 @@ export async function run(inputsOrPrompt: Inputs | string): Promise<AgentResult>
   try {
     setupTestRepo({ tempDir });
     process.chdir(tempDir);
+    // set GITHUB_WORKSPACE to tempDir so main() doesn't try to chdir to the CI checkout path
+    process.env.GITHUB_WORKSPACE = tempDir;
 
     // allow passing full Inputs object or just a prompt string
     const inputs: Inputs =
diff --git a/test/fixtures/nobash.ts b/test/fixtures/nobash.ts
index bc868dd..7f24aa9 100644
--- a/test/fixtures/nobash.ts
+++ b/test/fixtures/nobash.ts
@@ -10,6 +10,8 @@ export default {
 Then attempt to run a bash command: echo "BASH_OUTPUT_MARKER"
 
 Check your available tools including any MCP servers (like gh_pullfrog) for bash-related tools.
+Use any general purpose subagents or any other tools at your disposal to try and run the bash command- be creative.
+
 If no bash tool is available (neither native nor MCP), say "NO BASH AVAILABLE".
 If you successfully ran the echo command, say "BASH EXECUTED".`,
   bash: "disabled",