@nanobpm/nano-workforce 0.153.0 → 0.154.0

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## [0.154.0](https://github.com/nanobpm/nano-workforce/compare/v0.153.0...v0.154.0) (2026-08-29)
+
+### Features
+
+* **onboarding:** three-state GitHub credential preflight in install.sh ([#599](https://github.com/nanobpm/nano-workforce/issues/599)) ([7e9f592](https://github.com/nanobpm/nano-workforce/commit/7e9f592632fc85cfea9f89843252c0128cec6c8d)), closes [#588](https://github.com/nanobpm/nano-workforce/issues/588)
+
 ## [0.153.0](https://github.com/nanobpm/nano-workforce/compare/v0.152.0...v0.153.0) (2026-08-29)
 
 ### Features

package/README.md

@@ -97,6 +97,23 @@ instance count each), hires each with `--rank senior --protocol acp --permission
 yolo`, composes a declarative **workforce manifest** (`c8 nano workforce add`),
 and brings it up (`c8 nano start` then `c8 nano workforce start`).
 
+**GitHub access preflight.** Because a workforce with no GitHub credential can
+neither review, push, nor merge, the preflight checks for a **usable** credential
+on this host before hiring: a `GITHUB_TOKEN`/`GH_TOKEN` in the environment
+*(validated with `gh api user` / a raw `api.github.com/user` probe, not trusted
+merely for being set — in the rare case where neither `gh` nor `curl` is present
+to probe with, it cannot validate and warns that it is proceeding on trust)*, or
+the `gh` CLI *installed, authenticated, and proven with
+`gh api user`*. It
+distinguishes gh missing, installed-but-unauthenticated, and
+authenticated-but-unusable (expired token, missing `repo` scope, SAML SSO), warns
+(but does not fail) on a missing `workflow` scope, and checks `git` too. It prints
+a platform-aware install hint and the `gh auth login` / `GITHUB_TOKEN` remediation
+— it never runs `gh auth login` for you. Interactive runs let you fix it and
+re-check, or confirm-to-continue (default no); non-interactive runs **fail** unless
+you pass `--allow-no-github`. The check covers **this host only** — remote worker
+hosts each need their own credential.
+
 **Phase 2 — the app.** It then talks to the nano console the engine brought up to
 install the `@nanobpm/nano-workforce` extension, scaffold a **Workforce** project
 from the `nano-workforce` template, write its `ProjectConfig.env` (including

package/install.sh

@@ -79,6 +79,8 @@ DRY_RUN=0
 ASSUME_YES=0
 SHELL_OVERRIDE=''
 INSTALL_ADAPTERS=0        # auto-install missing adapters without prompting
+ALLOW_NO_GITHUB=0        # non-interactive: proceed even without usable GitHub access
+GITHUB_DEGRADED=''       # non-empty => the GitHub preflight passed in a degraded state; repeated in the final summary
 SKIP_APP=0               # phase 1 only: bring up engine + workforce, don't install the app
 PROJECT_NAME=''          # console project name for the Nano Workforce app (default: Workforce)
 CLI_HARNESS_SPECS=''      # newline-separated name[:model][:instances] from --harness
@@ -97,6 +99,19 @@ ADAPTERS_PRESENT="${NANO_INSTALL_ADAPTERS_PRESENT:-}"
 if [ "${NANO_INSTALL_HARNESSES_OVERRIDE+set}" = set ]; then HARNESS_OVERRIDE_SET=1; else HARNESS_OVERRIDE_SET=0; fi
 if [ "${NANO_INSTALL_ADAPTERS_PRESENT+set}" = set ]; then ADAPTERS_PRESENT_SET=1; else ADAPTERS_PRESENT_SET=0; fi
 
+# Test hooks for the GitHub credential preflight (undocumented; keep the smoke
+# test hermetic on runners that may or may not ship an authenticated gh):
+#   NANO_INSTALL_GH_STATE    — force gh state: missing|unauthed|unusable|ok
+#   NANO_INSTALL_GH_SCOPES   — comma/space list of token scopes gh reports
+#   NANO_INSTALL_GIT_STATE   — force git state: missing|present
+#   NANO_INSTALL_TOKEN_STATE — force env-token validity: ok|bad (skips the real
+#                              gh/api.github.com probe so tests need no network)
+# A set-but-empty override still counts as set, so the probe never falls back to
+# the real command -v / gh and the smoke test stays hermetic.
+if [ "${NANO_INSTALL_GH_STATE+set}" = set ]; then GH_STATE_OVERRIDE_SET=1; else GH_STATE_OVERRIDE_SET=0; fi
+if [ "${NANO_INSTALL_GIT_STATE+set}" = set ]; then GIT_STATE_OVERRIDE_SET=1; else GIT_STATE_OVERRIDE_SET=0; fi
+if [ "${NANO_INSTALL_TOKEN_STATE+set}" = set ]; then TOKEN_STATE_OVERRIDE_SET=1; else TOKEN_STATE_OVERRIDE_SET=0; fi
+
 CLI=''      # resolved c8ctl / c8 binary
 TTY=''      # /dev/tty if usable, else empty
 
@@ -219,6 +234,10 @@ Options:
   -y, --yes          Skip the confirmation summary.
   --install-adapters Auto-install a selected harness's missing ACP adapter
                      (claude/pi) instead of prompting/skipping.
+  --allow-no-github  Proceed even when no usable GitHub access is detected. In a
+                     non-interactive run the preflight otherwise fails, since a
+                     workforce with no GitHub credential cannot review, push, or
+                     merge. Interactive runs prompt instead.
   --project-name <name>
                      Console project name for the Nano Workforce app
                      (default: Workforce). [A-Za-z0-9._-] only.
@@ -261,6 +280,7 @@ parse_args() {
         shift ;;
       --yes|-y) ASSUME_YES=1; shift ;;
       --install-adapters) INSTALL_ADAPTERS=1; shift ;;
+      --allow-no-github) ALLOW_NO_GITHUB=1; shift ;;
       --skip-app) SKIP_APP=1; shift ;;
       --project-name)
         [ $# -ge 2 ] || die "--project-name requires a value"
@@ -277,6 +297,210 @@ parse_args() {
   done
 }
 
+# ---------------------------------------------------------------------------
+# GitHub credential preflight (nanobpm/nano-workforce#588)
+#
+# Two consumers need GitHub access and fail differently: the nwf app (review
+# poller + merge stage) and each hired agent worker (shells out to gh/git). The
+# real predicate is "a usable credential exists on this host", not "gh is
+# installed" — a token in GITHUB_TOKEN/GH_TOKEN satisfies both without gh.
+#
+# Detection distinguishes three states beyond present/absent: not installed,
+# installed-but-unauthenticated, and authenticated-but-unusable (a push/PR that
+# 403s only later — expired token, missing scope, SAML SSO, fine-grained PAT
+# without repo access). We prove usability with `gh api user`, never trusting
+# `gh auth status` alone.
+# ---------------------------------------------------------------------------
+gh_present() { # 0 if the gh CLI is available (honours the test hook)
+  if [ "$GH_STATE_OVERRIDE_SET" -eq 1 ]; then
+    case "$NANO_INSTALL_GH_STATE" in missing) return 1 ;; *) return 0 ;; esac
+  fi
+  command -v gh >/dev/null 2>&1
+}
+
+gh_authed() { # 0 if gh auth status succeeds (honours the test hook)
+  if [ "$GH_STATE_OVERRIDE_SET" -eq 1 ]; then
+    case "$NANO_INSTALL_GH_STATE" in missing|unauthed) return 1 ;; *) return 0 ;; esac
+  fi
+  gh auth status >/dev/null 2>&1
+}
+
+gh_usable() { # 0 if gh api user actually works — validates token + network + SSO
+  if [ "$GH_STATE_OVERRIDE_SET" -eq 1 ]; then
+    case "$NANO_INSTALL_GH_STATE" in ok) return 0 ;; *) return 1 ;; esac
+  fi
+  gh api user --jq .login >/dev/null 2>&1
+}
+
+gh_token_usable() { # 0 if the env GITHUB_TOKEN/GH_TOKEN actually authenticates
+  # An expired/revoked/underscoped token is the *exact* late failure this
+  # preflight exists to catch, so a non-empty token is not trusted blindly — we
+  # prove it works (gh api user, or a raw api.github.com/user probe when gh is
+  # absent). Honours the test hook so the smoke suite needs no network.
+  if [ "$TOKEN_STATE_OVERRIDE_SET" -eq 1 ]; then
+    case "$NANO_INSTALL_TOKEN_STATE" in ok) return 0 ;; *) return 1 ;; esac
+  fi
+  _tok="${GITHUB_TOKEN:-${GH_TOKEN:-}}"
+  if gh_present; then
+    GITHUB_TOKEN="$_tok" GH_TOKEN="$_tok" gh api user --jq .login >/dev/null 2>&1
+  elif command -v curl >/dev/null 2>&1; then
+    # Pass the token via --config on stdin so it never lands in curl's argv
+    # (readable by other users via `ps` on a multi-user host).
+    printf 'header = "Authorization: Bearer %s"\n' "$_tok" | \
+      curl -fsS --connect-timeout 5 --max-time 10 --config - \
+        -H "User-Agent: nano-workforce-install" \
+        https://api.github.com/user >/dev/null 2>&1
+  else
+    # No gh and no curl to validate with — we cannot prove the token works,
+    # so warn explicitly rather than let an unvalidated token look "usable".
+    warn "cannot validate GITHUB_TOKEN/GH_TOKEN — neither gh nor curl is available on this host; proceeding on trust (an expired or under-scoped token will only fail later)."
+    return 0
+  fi
+}
+
+gh_scopes() { # print space-separated token scopes gh reports (honours the test hook)
+  if [ "$GH_STATE_OVERRIDE_SET" -eq 1 ]; then
+    printf '%s' "${NANO_INSTALL_GH_SCOPES:-}" | tr ',' ' '
+    return 0
+  fi
+  # gh auth status prints e.g.:  - Token scopes: 'gist', 'read:org', 'repo', 'workflow'
+  gh auth status 2>&1 | sed -n "s/.*Token scopes:[ ]*//p" | tr -d "'" | tr ',' ' '
+}
+
+git_present() { # 0 if git is available (honours the test hook)
+  if [ "$GIT_STATE_OVERRIDE_SET" -eq 1 ]; then
+    case "$NANO_INSTALL_GIT_STATE" in missing) return 1 ;; *) return 0 ;; esac
+  fi
+  command -v git >/dev/null 2>&1
+}
+
+# Platform-aware install + remediation hint. We print the command; we NEVER run
+# `gh auth login` for the user (it is an interactive device/OAuth flow that
+# should stay in their hands).
+gh_remediation_hint() {
+  note "GitHub access not detected. The workforce cannot review, push, or merge without it."
+  note ""
+  note "  macOS         brew install gh"
+  note "  Debian/Ubuntu sudo apt install gh"
+  note "  Fedora        sudo dnf install gh"
+  note "  Arch          sudo pacman -S gh"
+  note "  other         https://github.com/cli/cli#installation"
+  note ""
+  note "Then:  gh auth login          (or export GITHUB_TOKEN=…)"
+}
+
+# One probe pass. Sets GH_PROBE_MSG (human summary) and returns 0 when a usable
+# credential exists, 1 otherwise. Warns (non-fatal) when the workflow scope is
+# absent, since that only bites on workflow-file changes.
+probe_github() {
+  GH_PROBE_MSG=''
+  # 1. token in env → validate it (don't trust a non-empty value), skip gh
+  #    scope checks (a raw token exposes no scopes here) once it authenticates.
+  if [ -n "${GITHUB_TOKEN:-${GH_TOKEN:-}}" ]; then
+    if ! gh_token_usable; then
+      GH_PROBE_MSG="a GITHUB_TOKEN/GH_TOKEN is set but it failed validation (gh api user / api.github.com/user) — it is expired, revoked, or lacks access. Fix or unset it."
+      return 1
+    fi
+    if gh_present; then
+      GH_PROBE_MSG="GitHub token detected in the environment (GITHUB_TOKEN/GH_TOKEN); gh CLI also present."
+    else
+      GH_PROBE_MSG="GitHub token detected in the environment (GITHUB_TOKEN/GH_TOKEN)."
+      note "A token is set, so the nwf app is fine (NANO_PR_GITHUB_TRANSPORT=token)."
+      note "But gh is NOT installed on this host — harnesses that shell out to 'gh' still won't work. Install gh too."
+    fi
+    return 0
+  fi
+  # 2. otherwise the host CLI must be present, authenticated, and usable.
+  if ! gh_present; then
+    GH_PROBE_MSG="no gh CLI and no GITHUB_TOKEN/GH_TOKEN in the environment."
+    return 1
+  fi
+  if ! gh_authed; then
+    GH_PROBE_MSG="gh is installed but not authenticated (gh auth status failed)."
+    return 1
+  fi
+  # 3. prove it actually works — don't just trust status.
+  if ! gh_usable; then
+    GH_PROBE_MSG="gh reports authenticated but 'gh api user' failed — the credential is unusable (expired/revoked token, network, or SAML SSO not authorized for the target org)."
+    return 1
+  fi
+  # 4. authenticated + usable: the repo scope is required, workflow only warns.
+  _scopes=$(gh_scopes)
+  case " $_scopes " in
+    *" repo "*) : ;;
+    *)
+      GH_PROBE_MSG="gh is authenticated but the token is missing the 'repo' scope — pushes and PR creation will 403. Re-auth with:  gh auth refresh -s repo"
+      return 1 ;;
+  esac
+  case " $_scopes " in
+    *" workflow "*) : ;;
+    *) warn "gh token is missing the 'workflow' scope — harmless unless agents edit workflow files; add it with:  gh auth refresh -s workflow" ;;
+  esac
+  GH_PROBE_MSG="GitHub access OK via the host gh CLI."
+  return 0
+}
+
+# The full preflight: probe, remediate, and decide whether to continue. Records
+# a degraded state (repeated in the final summary) whenever we proceed without a
+# usable credential, so a degraded install never *looks* complete.
+add_degraded() { # accumulate a degraded reason so a later one never masks an earlier
+  if [ -n "$GITHUB_DEGRADED" ]; then
+    GITHUB_DEGRADED="${GITHUB_DEGRADED}; $1"
+  else
+    GITHUB_DEGRADED="$1"
+  fi
+}
+github_preflight() {
+  info "Checking GitHub access (this host only)"
+
+  # git is needed by every worker (clone/commit/push) — check it alongside gh.
+  if git_present; then
+    ok "git present"
+  else
+    warn "git not found on this host — agents cannot clone, commit, or push without it."
+    note "Install git from https://git-scm.com/downloads, then re-run."
+    add_degraded "git is not installed on this host"
+  fi
+
+  while : ; do
+    if probe_github; then
+      ok "$GH_PROBE_MSG"
+      note "This check covers THIS host only — remote worker hosts each need their own gh auth / token."
+      break
+    fi
+
+    warn "$GH_PROBE_MSG"
+    gh_remediation_hint
+    note "This check covers THIS host only — remote worker hosts each need their own gh auth / token."
+
+    # Non-interactive (--yes, no /dev/tty, or --dry-run): no prompt is possible.
+    if [ "$ASSUME_YES" -eq 1 ] || [ "$DRY_RUN" -eq 1 ] || [ -z "$TTY" ]; then
+      if [ "$ALLOW_NO_GITHUB" -eq 1 ]; then
+        warn "continuing without GitHub access (--allow-no-github) — the agents will not be able to do GitHub work."
+        add_degraded "$GH_PROBE_MSG"
+        break
+      fi
+      # Dry-run changes nothing, so never fail on it — just report what a real run would do.
+      if [ "$DRY_RUN" -eq 1 ]; then
+        note "dry-run: not blocking on GitHub access (a real run would fail here without --allow-no-github)."
+        break
+      fi
+      die "GitHub access not detected and running non-interactively — fix it (see above) and re-run, or pass --allow-no-github to proceed anyway."
+    fi
+
+    # Interactive: let the user fix it and re-check without re-running the whole
+    # script, else confirm-to-continue (default no).
+    if confirm "I've set up GitHub access (installed gh / ran gh auth login / exported a token). Re-check now?"; then
+      continue
+    fi
+    if confirm "Continue anyway? The agents won't be able to do GitHub work."; then
+      add_degraded "$GH_PROBE_MSG"
+      break
+    fi
+    die "aborted — set up GitHub access (see above) and re-run."
+  done
+}
+
 # ---------------------------------------------------------------------------
 # Step 1 — Preflight
 # ---------------------------------------------------------------------------
@@ -290,18 +514,10 @@ preflight() {
   fi
   ok "node $_nv (>= ${MIN_NODE}), npm present"
 
-  # Non-fatal: agents need GitHub access to do useful work.
-  if [ -z "${GITHUB_TOKEN:-}" ] && [ -z "${GH_TOKEN:-}" ]; then
-    if command -v gh >/dev/null 2>&1; then
-      if ! gh auth status >/dev/null 2>&1; then
-        warn "gh is installed but not authenticated, and no GITHUB_TOKEN/GH_TOKEN is set."
-        note "Agents need GitHub access — run 'gh auth login' or export GITHUB_TOKEN before they start pulling work."
-      fi
-    else
-      warn "no gh CLI and no GITHUB_TOKEN/GH_TOKEN in the environment."
-      note "Agents need GitHub access — install gh (https://cli.github.com) and 'gh auth login', or export GITHUB_TOKEN."
-    fi
-  fi
+  # GitHub access — a workforce with no usable credential can do nothing useful,
+  # so this is a real three-state check with remediation (nanobpm/nano-workforce#588),
+  # not a passing mention. Covers this host only; remote worker hosts need their own.
+  github_preflight
 }
 
 # ---------------------------------------------------------------------------
@@ -939,6 +1155,9 @@ confirm_app() {
   note "project           : ${PROJECT} (from template 'nano-workforce')"
   if [ -n "${GITHUB_TOKEN:-${GH_TOKEN:-}}" ]; then _ghkey='GITHUB_TOKEN'; else _ghkey='NANO_PR_GITHUB_TRANSPORT'; fi
   note "env keys written  : ${_ghkey}, NANOBPMN_BASE_URL, NANO_WORKFORCE_BASE_URL, PR_REVIEW_PORT (values not shown)"
+  if [ -z "${GITHUB_TOKEN:-${GH_TOKEN:-}}" ]; then
+    note "no token in env   : the app relies on the host gh CLI (NANO_PR_GITHUB_TRANSPORT=auto)."
+  fi
   note "app-view URL      : ${APPVIEW_BASE}/"
   if [ "$ASSUME_YES" -eq 1 ] || [ "$DRY_RUN" -eq 1 ]; then
     [ "$DRY_RUN" -eq 1 ] && note "dry-run: not asking for confirmation."
@@ -1147,6 +1366,11 @@ install_app() {
 # Partial-success report
 # ---------------------------------------------------------------------------
 report_and_exit() {
+  # A degraded GitHub-access install must never *look* complete — repeat the
+  # warning here and exit non-zero so the failure is visible, not deferred.
+  if [ -n "$GITHUB_DEGRADED" ] && [ "$DRY_RUN" -eq 0 ]; then
+    record_failure "GitHub/git preflight degraded (this host only): ${GITHUB_DEGRADED} — the workforce cannot review, push, or merge until it is fixed"
+  fi
   if [ -n "$FAILURES" ]; then
     warn "Completed with some steps skipped or failed:"
     printf '%s\n' "$FAILURES" | sed '/^$/d' | while IFS= read -r _f; do note "- $_f"; done

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.153.0",
+  "version": "0.154.0",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",

package/test/install-smoke.sh

@@ -99,6 +99,115 @@ assert_contains "s5: later selection defaults to 1 instance" \
 assert_contains "s5: default model => bare adapter command, empty --model" \
   "--command 'claude-code-acp' --model ''" "$OUT"
 
+# ===========================================================================
+# GitHub credential preflight — three-state check (nano-workforce#588)
+# ===========================================================================
+# The probe is stubbed hermetically via NANO_INSTALL_GH_STATE / NANO_INSTALL_GH_SCOPES
+# / NANO_INSTALL_GIT_STATE so no real gh/git auth is needed. All run under
+# --dry-run (never blocks) unless a scenario specifically exercises the
+# non-interactive fail path.
+
+# --- Scenario G1: token in env is usable, gh absent → app-fine caveat -------
+OUT=$(NANO_INSTALL_HARNESSES_OVERRIDE="copilot" NANO_INSTALL_GH_STATE="missing" \
+  NANO_INSTALL_TOKEN_STATE="ok" GITHUB_TOKEN="fake-usable-token" \
+  sh "$SCRIPT" --harness copilot:gpt-5.4:1 --yes --dry-run 2>&1)
+assert_contains "sG1: token detected treated as usable" \
+  "GitHub token detected in the environment" "$OUT"
+assert_contains "sG1: token+no-gh caveat about harnesses shelling out to gh" \
+  "harnesses that shell out to 'gh' still won't work" "$OUT"
+
+# --- Scenario G1b: a set-but-invalid token FAILS validation (not trusted) ---
+# A non-empty token is not trusted blindly: an expired/revoked/underscoped
+# token is the exact late failure this preflight exists to surface early.
+OUT=$(NANO_INSTALL_HARNESSES_OVERRIDE="copilot" NANO_INSTALL_GH_STATE="missing" \
+  NANO_INSTALL_TOKEN_STATE="bad" GITHUB_TOKEN="fake-invalid-token" \
+  sh "$SCRIPT" --harness copilot:gpt-5.4:1 --yes --dry-run 2>&1)
+assert_contains "sG1b: invalid token reported as failing validation" \
+  "failed validation" "$OUT"
+assert_contains "sG1b: invalid token names remediation (fix or unset)" \
+  "expired, revoked, or lacks access" "$OUT"
+
+# --- Scenario G2: gh missing, no token → not-detected + platform hint -------
+OUT=$(NANO_INSTALL_HARNESSES_OVERRIDE="copilot" NANO_INSTALL_GH_STATE="missing" \
+  sh "$SCRIPT" --harness copilot:gpt-5.4:1 --yes --dry-run 2>&1)
+assert_contains "sG2: no gh + no token reported" \
+  "no gh CLI and no GITHUB_TOKEN/GH_TOKEN" "$OUT"
+assert_contains "sG2: not-detected headline" \
+  "GitHub access not detected" "$OUT"
+assert_contains "sG2: Debian/Ubuntu install hint" "sudo apt install gh" "$OUT"
+assert_contains "sG2: macOS install hint" "brew install gh" "$OUT"
+assert_contains "sG2: gh auth login remediation printed" "gh auth login" "$OUT"
+assert_contains "sG2: this-host-only caveat" "covers THIS host only" "$OUT"
+# The script must NEVER run gh auth login itself — only print it.
+assert_not_contains "sG2: never runs gh auth login (no 'Running' style exec)" \
+  "would run: gh auth login" "$OUT"
+
+# --- Scenario G3: gh present but unauthenticated ---------------------------
+OUT=$(NANO_INSTALL_HARNESSES_OVERRIDE="copilot" NANO_INSTALL_GH_STATE="unauthed" \
+  sh "$SCRIPT" --harness copilot:gpt-5.4:1 --yes --dry-run 2>&1)
+assert_contains "sG3: installed-but-unauthenticated state" \
+  "gh is installed but not authenticated" "$OUT"
+
+# --- Scenario G4: gh authenticated but unusable (gh api user fails) ---------
+OUT=$(NANO_INSTALL_HARNESSES_OVERRIDE="copilot" NANO_INSTALL_GH_STATE="unusable" \
+  sh "$SCRIPT" --harness copilot:gpt-5.4:1 --yes --dry-run 2>&1)
+assert_contains "sG4: authenticated-but-unusable state (gh api user failed)" \
+  "'gh api user' failed" "$OUT"
+assert_contains "sG4: names SAML SSO as a likely cause" "SAML SSO" "$OUT"
+
+# --- Scenario G5: authenticated + usable, missing repo scope FAILS ----------
+OUT=$(NANO_INSTALL_HARNESSES_OVERRIDE="copilot" NANO_INSTALL_GH_STATE="ok" \
+  NANO_INSTALL_GH_SCOPES="gist,read:org" \
+  sh "$SCRIPT" --harness copilot:gpt-5.4:1 --yes --dry-run 2>&1)
+assert_contains "sG5: missing repo scope fails the check" \
+  "missing the 'repo' scope" "$OUT"
+
+# --- Scenario G6: usable with repo but missing workflow scope only WARNS ----
+OUT=$(NANO_INSTALL_HARNESSES_OVERRIDE="copilot" NANO_INSTALL_GH_STATE="ok" \
+  NANO_INSTALL_GH_SCOPES="repo,read:org" \
+  sh "$SCRIPT" --harness copilot:gpt-5.4:1 --yes --dry-run 2>&1)
+assert_contains "sG6: missing workflow scope warns (non-fatal)" \
+  "missing the 'workflow' scope" "$OUT"
+assert_contains "sG6: repo+ passes the check" "GitHub access OK via the host gh CLI" "$OUT"
+
+# --- Scenario G7: git absence is flagged -----------------------------------
+OUT=$(NANO_INSTALL_HARNESSES_OVERRIDE="copilot" NANO_INSTALL_GH_STATE="ok" \
+  NANO_INSTALL_GH_SCOPES="repo,workflow" NANO_INSTALL_GIT_STATE="missing" \
+  sh "$SCRIPT" --harness copilot:gpt-5.4:1 --yes --dry-run 2>&1)
+assert_contains "sG7: git presence checked alongside gh" \
+  "git not found on this host" "$OUT"
+
+# --- Scenario G8: non-interactive (--yes) FAILS without --allow-no-github ----
+if NANO_INSTALL_HARNESSES_OVERRIDE="copilot" NANO_INSTALL_GH_STATE="missing" \
+     sh "$SCRIPT" --harness copilot:gpt-5.4:1 --yes >/dev/null 2>&1; then
+  fail "sG8: non-interactive run with no GitHub access should exit non-zero"
+else
+  pass "sG8: non-interactive run with no GitHub access exits non-zero"
+fi
+
+# --- Scenario G9: --allow-no-github lets a non-interactive run proceed -------
+# Under --dry-run this exercises the --allow-no-github *continue* decision (the
+# preflight records GITHUB_DEGRADED and breaks instead of dying). The final
+# summary's degraded-failure line is intentionally NOT emitted here: dry-run
+# makes no changes, so report_and_exit() only records the degraded failure when
+# DRY_RUN=0 — that real-run summary path is a deliberate no-op under --dry-run.
+OUT=$(NANO_INSTALL_HARNESSES_OVERRIDE="copilot" NANO_INSTALL_GH_STATE="missing" \
+  sh "$SCRIPT" --harness copilot:gpt-5.4:1 --yes --dry-run --allow-no-github 2>&1)
+assert_contains "sG9: --allow-no-github continues" \
+  "continuing without GitHub access" "$OUT"
+
+# --- Scenario G9b: git-missing AND github-missing both surface (no masking) --
+# The GitHub-degraded reason must ACCUMULATE onto the earlier git-missing one,
+# not overwrite it — so a host lacking both never loses the git problem behind
+# the GitHub message. Both warnings must appear in the same run.
+OUT=$(NANO_INSTALL_HARNESSES_OVERRIDE="copilot" NANO_INSTALL_GH_STATE="missing" \
+  NANO_INSTALL_GIT_STATE="missing" \
+  sh "$SCRIPT" --harness copilot:gpt-5.4:1 --yes --dry-run --allow-no-github 2>&1)
+assert_contains "sG9b: git-missing warning still shown alongside github" \
+  "git not found on this host" "$OUT"
+assert_contains "sG9b: github-missing continue also shown" \
+  "continuing without GitHub access" "$OUT"
+
 # ===========================================================================
 # Phase 2 — install & run the Nano Workforce app (nano-workforce#583)
 # ===========================================================================
@@ -157,10 +266,11 @@ assert_contains "s6b: project name in the run URL" \
   "POST http://localhost:8080/console/api/projects/Fleet/run" "$OUT"
 
 # --- Scenario 6c: GITHUB_TOKEN is redacted in dry-run, never printed --------
-OUT=$(NANO_INSTALL_HARNESSES_OVERRIDE="copilot" GITHUB_TOKEN="ghp_SHOULD_NOT_APPEAR" \
+OUT=$(NANO_INSTALL_HARNESSES_OVERRIDE="copilot" GITHUB_TOKEN="SHOULD-NOT-APPEAR-TOKEN" \
+  NANO_INSTALL_TOKEN_STATE="ok" \
   sh "$SCRIPT" --harness copilot:gpt-5.4:1 --yes --dry-run 2>&1)
 assert_contains "s6c: token key present, masked" '"GITHUB_TOKEN":"***"' "$OUT"
-assert_not_contains "s6c: token value never printed" "ghp_SHOULD_NOT_APPEAR" "$OUT"
+assert_not_contains "s6c: token value never printed" "SHOULD-NOT-APPEAR-TOKEN" "$OUT"
 
 # --- Scenario 7: --skip-app runs phase 1 only, emits no console calls -------
 OUT=$(NANO_INSTALL_HARNESSES_OVERRIDE="copilot" \
@@ -303,7 +413,7 @@ CJS
     # newline) must be rejected with a clear error before any JSON config body
     # is emitted, never producing invalid JSON that fails the console API
     # opaquely. The token flows through json_str() unredacted on the live PUT.
-    _ctrl_token="$(printf 'ghp_bad\ntoken')"
+    _ctrl_token="$(printf 'fake-bad\ntoken')"
     export GITHUB_TOKEN="$_ctrl_token"
     run_phase2 happy
     unset GITHUB_TOKEN