cowork-harness 1.0.4 → 1.0.5

package/.claude/skills/cowork-harness/SKILL.md

@@ -3,8 +3,8 @@ name: cowork-harness
 description: Test or debug a Claude Code skill/plugin under Claude Cowork's runtime — sandboxed agent, default-deny egress, the can_use_tool permission/question protocol — using the cowork-harness CLI. Use when validating or regression-testing a skill, authoring or debugging a scenario YAML (prompt + scripted answers + assert:), choosing a fidelity tier, scripting AskUserQuestion / tool-permission answers, or asserting artifacts, egress, or sub-agent dispatch. Especially when a harness run no-ops an assertion, fails on an unanswered gate, false-greens, a steered answer never reaches the model, or a web_fetch is unexpectedly denied or gated. NOT for generic unit testing (pytest/vitest of your own scripts) or non-Cowork CI. Covers the skill / run / chat / record / replay / trace / decide / assertions / scaffold commands and the session-vs-scenario split.
 metadata:
   author: cowork-harness
-  version: 1.0.4
-  tracks-harness: cowork-harness 1.0.4 (baseline desktop-1.20186.9)
+  version: 1.0.5
+  tracks-harness: cowork-harness 1.0.5 (baseline desktop-1.20186.9)
 ---
 
 # cowork-harness
@@ -22,7 +22,7 @@ flagged with a loud `::warning::`, not silent — auto-answer a gate, observe an
 allowlist). This skill exists mostly to keep you out of those traps — the Gotchas section below is
 the highest-value part. Read it.
 
-> **Version note:** the facts and `file:line` pointers here track `cowork-harness 1.0.4` (baseline
+> **Version note:** the facts and `file:line` pointers here track `cowork-harness 1.0.5` (baseline
 > `desktop-1.20186.9`). If your checkout is newer, prefer the live `--help` and — in a repo checkout —
 > `SPEC.md` / `docs/*.md` over this snapshot, and re-run the bundled linter.
 
@@ -39,9 +39,9 @@ Before the first command, confirm the CLI is reachable and **fail loud** (never
 
 - **One-shot check.** Run `cowork-harness doctor [--tier <tier>]` first — a read-only prerequisite check that inspects Docker, the staged agent, the token, and the baseline in one pass. The bullets below explain each thing it checks (and how to fix it).
 - **Replay-only? Skip `doctor`.** Replaying committed cassettes needs no Docker, no staged agent, and no token — and every tier's `doctor` validates the auth token (the live tiers also Docker + the staged agent), so a ✗ there is expected, not a blocker. Go straight to `cowork-harness replay <cassette>`.
-- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 1.0.4**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@>=1.0.4" <cmd>` (Node ≥ 20), or install once with `npm i -g "cowork-harness@>=1.0.4"`. **Pin `@>=1.0.4`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
+- **CLI on PATH, recent enough?** Run `cowork-harness --version` — this skill needs **≥ 1.0.5**. If it's missing or older, prefix every command with the version floor `npx "cowork-harness@>=1.0.5" <cmd>` (Node ≥ 20), or install once with `npm i -g "cowork-harness@>=1.0.5"`. **Pin `@>=1.0.5`, never `@latest`** — `@latest` can silently fetch an older CLI and the new commands fail as "unknown command", whereas the floor **fails loud** if no compatible version is published.
 
-  What the ≥ 1.0.4 floor gates, by release:
+  What the ≥ 1.0.5 floor gates, by release:
 
   - **core set (pre-0.21.0 vintage, or mixed):** `assertions --list`, `scaffold <run-id>`, `trace --view dispatches`, `artifact_json` incl. the `in:` operator (passes when the resolved value deep-equals one of the listed members — value ∈ your list, not the reverse), `verify-cassettes` incl. the `--allow-domain`/`--allow-email`/`--allow-patterns-file` allows (`--allow-patterns-file <path>` is a FILE of patterns, one regex per line — not a path to allow, unlike `--allow <regex>`), batch `record <dir>`/`--rerecord-stale`, `record --concurrency <N>`, record-time redaction, multiSelect/`answer:`, `verify-run` answer-coverage, `record --max-artifact-bytes`, live record-time deciders, scenario `skills:` staleness scoping with `COWORK_HARNESS_AGENT_SCOPE=skill`, `chat --plugin`, and `/help` in the REPL.
   - **0.21.0:** `verify-cassettes --allow-path` (`path` — local absolute filesystem paths — is the scanner's 4th class), and `hostloop`'s native host/VM process split with its `allow_host_writes:` consent field.

package/.claude/skills/cowork-harness/references/ci-recipe.md

@@ -1,6 +1,6 @@
 # CI recipe — replay vs live lanes
 
-Self-contained reference. Tracks `cowork-harness 1.0.4` (baseline `desktop-1.20186.1`).
+Self-contained reference. Tracks `cowork-harness 1.0.5` (baseline `desktop-1.20186.1`).
 
 **Fastest path: the packaged Action.** One step gets you `replay`/`lint`/`verify-cassettes` plus a PR
 job-summary reporter (verdict table, staleness findings, cost/turns when available):
@@ -13,7 +13,7 @@ job-summary reporter (verdict table, staleness findings, cost/turns when availab
 ```
 
 The Action's `version` input defaults to `latest` — intentional so a copy-pasted recipe tracks the current
-release; pin an exact version (e.g. `version: "1.0.4"`) for reproducible CI.
+release; pin an exact version (e.g. `version: "1.0.5"`) for reproducible CI.
 
 Reach for the manual multi-step form below only when you need per-step control the Action's inputs don't
 cover (a custom flag combination, a different runner matrix per step, or `lint`/`verify-cassettes` gated
@@ -57,7 +57,7 @@ sha256-*checked* but not hard-blocking on mismatch — it's advisory for an inte
 GitHub-hosted runners, no token/Docker/agent:
 
 ```yaml
-- run: npm i -g "cowork-harness@>=1.0.4"
+- run: npm i -g "cowork-harness@>=1.0.5"
 - run: cowork-harness lint scenarios/*.yaml          # no silent false-greens
 - run: cowork-harness verify-cassettes cassettes/    # privacy + staleness
 - run: cowork-harness replay cassettes/              # token-free content/structure
@@ -197,7 +197,7 @@ jobs:
         with: { node-version: '20' }
       - uses: actions/setup-python@v5
         with: { python-version: '3.x' }                                       # python3 only — PyYAML is bundled with the linter
-      - run: npm i -g "cowork-harness@>=1.0.4"
+      - run: npm i -g "cowork-harness@>=1.0.5"
       - run: cowork-harness lint scenarios/*.yaml                              # no-silent-false-green (needs python3; PyYAML bundled)
       - run: cowork-harness verify-cassettes cassettes/ --output-format json   # privacy + staleness gate
       - run: cowork-harness replay cassettes/ --output-format json             # token-free content/structure
@@ -226,7 +226,7 @@ jobs:
             echo "live=true" >> "$GITHUB_OUTPUT"
           fi
       - if: steps.guard.outputs.live == 'true'
-        run: npm i -g "cowork-harness@>=1.0.4"
+        run: npm i -g "cowork-harness@>=1.0.5"
       - if: steps.guard.outputs.live == 'true'
         run: cowork-harness run scenarios/ --output-format json
         env:

package/.claude/skills/cowork-harness/references/fidelity-and-answers.md

@@ -1,6 +1,6 @@
 # Fidelity tiers & answer paths
 
-Self-contained reference. Tracks `cowork-harness 1.0.4` (baseline `desktop-1.20186.1`).
+Self-contained reference. Tracks `cowork-harness 1.0.5` (baseline `desktop-1.20186.1`).
 
 ## Fidelity tiers (`fidelity:` in the scenario)
 

package/.claude/skills/cowork-harness/references/scenario-schema.md

@@ -1,6 +1,6 @@
 # Scenario & session schema, assertion catalog, web_fetch, full gotchas
 
-Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 1.0.4`
+Self-contained reference for authoring `cowork-harness` scenarios. Tracks `cowork-harness 1.0.5`
 (baseline `desktop-1.20186.1`). If your checkout is newer, prefer the live `docs/scenario.md`,
 `docs/session.md`, and `SPEC.md`.
 

package/CHANGELOG.md

@@ -6,6 +6,29 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+## [1.0.5] — 2026-07-15
+
+Patch: routine pushes to `main` no longer red CI on a repo without `ANTHROPIC_API_KEY` — the live
+scenario suite is best-effort now — plus a CodeQL cleanup in the release tooling. Internal tooling +
+CI only; no runtime or API change.
+
+### Changed
+
+- `scripts/release-preflight.ts`: `changelogHasVersionSection` now finds the CHANGELOG heading with a
+  literal line-prefix match instead of a regex assembled from the version string. Behavior is
+  unchanged — the version is already `isValidSemver`-gated to `X.Y.Z` before this runs — and it drops
+  a redundant, only-partially-escaped regex flagged by CodeQL (`js/incomplete-sanitization`). Internal
+  release tooling only; no runtime or API change.
+- **CI: the live scenario suite (`scenarios` job) is now best-effort, not a publish gate.** When
+  `ANTHROPIC_API_KEY` is absent it soft-skips green on every event — pushes to `main` included —
+  instead of hard-failing the run, so routine pushes to `main` (dependency bumps, docs, small fixes)
+  no longer turn CI red on a repo without the secret set. A loud `⚠️ NOT live-validated` marker still
+  flags any run that skipped live inference. The `SKIP_LIVE_SCENARIOS` admin-override variable is
+  removed (nothing hard-fails, so there is nothing to override). Trade-off: `release.yml` still gates
+  publish on `ci.yml` being green for the tagged commit, but a green `ci.yml` no longer proves the
+  scenarios were validated against a real model — set the `ANTHROPIC_API_KEY` repo secret to actually
+  run the live suite in CI. No runtime or API change.
+
 ## [1.0.4] — 2026-07-15
 
 Patch: release workflows no longer trigger on the floating Marketplace alias tags. No runtime/API change.

package/README.md

@@ -91,7 +91,7 @@ node dist/cli.js replay examples/replays/example-pdf-skill.cassette.json
 
 > **Installed globally instead?** Once linked/installed, the same command is `cowork-harness replay
 > <cassette>` — but the relative path above only resolves from a source checkout's `examples/replays/`.
-> From a global install (`npm i -g "cowork-harness@>=1.0.4"`), point at the package root instead:
+> From a global install (`npm i -g "cowork-harness@>=1.0.5"`), point at the package root instead:
 > `cowork-harness replay "$(npm root -g)/cowork-harness/examples/replays/example-pdf-skill.cassette.json"`
 > (or copy the cassette into your own project and pass that path).
 
@@ -101,7 +101,7 @@ Live `run`/`skill` need the prerequisites in the next section — note the `prot
 > - **Replay only (zero setup):** `cowork-harness replay <cassette>` — no token, no Docker, no agent. The command above.
 > - **`protocol` (real model, no Docker):** needs only the auth token (item 3 below).
 > - **Live `container` / `microvm` / `hostloop` / `cowork`:** needs Docker (or Lima for `microvm`), a staged agent, and the token — run `cowork-harness doctor` first.
-> - **Invocation:** from a source checkout, `node dist/cli.js <cmd>` (or `npm link` to get the `cowork-harness` command); from a global install, `cowork-harness <cmd>`; the companion skill falls back to `npx "cowork-harness@>=1.0.4"`.
+> - **Invocation:** from a source checkout, `node dist/cli.js <cmd>` (or `npm link` to get the `cowork-harness` command); from a global install, `cowork-harness <cmd>`; the companion skill falls back to `npx "cowork-harness@>=1.0.5"`.
 
 Two more worked examples worth knowing about: `examples/scenarios/protocol-smoke.yaml` (zero-Docker smoke
 test) and `examples/scenarios/skill-loads.yaml` (container-tier acceptance check) — see
@@ -126,7 +126,7 @@ claude plugin marketplace add yaniv-golan/cowork-harness
 claude plugin install cowork-harness@cowork-harness
 ```
 
-The skill **self-bootstraps the CLI**: if `cowork-harness` isn't on your PATH it falls back to `npx "cowork-harness@>=1.0.4"` (a version floor that fails loud rather than silently fetching a too-old CLI; Node ≥ 20). Tiers above `protocol` still need Docker/Lima and a Claude Desktop agent binary — see the prerequisites below.
+The skill **self-bootstraps the CLI**: if `cowork-harness` isn't on your PATH it falls back to `npx "cowork-harness@>=1.0.5"` (a version floor that fails loud rather than silently fetching a too-old CLI; Node ≥ 20). Tiers above `protocol` still need Docker/Lima and a Claude Desktop agent binary — see the prerequisites below.
 
 It also follows the open [Agent Skills](https://agentskills.io) spec, so it installs cross-editor (Cursor, Codex, OpenCode, …) via [`npx skills`](https://github.com/vercel-labs/skills) (Vercel Labs' CLI implementation of that spec):
 
@@ -147,7 +147,7 @@ A global install is enough for CI `lint`, reading the teaching skill, and replay
 To `run` the worked examples live or copy them as a starting point, use a source checkout. (The marketplace
 skill install itself only pulls `.claude/skills/cowork-harness/` — SKILL.md + `references/` + `scenario.py`/
 assertion keys, per `.claude-plugin/marketplace.json`'s `source` — not the rest of this table; the full set
-above becomes available once the skill's first command self-bootstraps `npx "cowork-harness@>=1.0.4"` — see
+above becomes available once the skill's first command self-bootstraps `npx "cowork-harness@>=1.0.5"` — see
 [above](#drive-it-from-claude-code-companion-skill) — which pulls the same npm package as the global-install row.)
 
 ### Prerequisites for anything above `protocol` fidelity
@@ -665,7 +665,7 @@ jobs:
           anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
 ```
 
-Every run writes a Markdown verdict table (scenario, pass/fail, signals, cost/turns when available, staleness findings, and the replay-skipped-assertions honesty line) to the job summary. Inputs: `command`, `path` (required), `version` (npm dist-tag/version, default `latest` — intentional so recipes track the current release; pin an exact version for reproducible CI. The companion skill's `cowork-harness@>=1.0.4` floor guidance applies to ad-hoc CLI installs, not this input), `strict` (applies to `replay` (staleness findings), `lint`/`lint-skill` (WARN/INFO), and `analyze-skill` (any advisory finding); IGNORED — not forwarded — for `verify-cassettes`/`run`, which don't accept the flag), `fail-on-skill-drift` (**`replay`-only** — never forwarded to the analyzers), `extra-args`, `summary` (default `true`), `anthropic-api-key` (live lane only). See [`action.yml`](./action.yml) for the full input reference.
+Every run writes a Markdown verdict table (scenario, pass/fail, signals, cost/turns when available, staleness findings, and the replay-skipped-assertions honesty line) to the job summary. Inputs: `command`, `path` (required), `version` (npm dist-tag/version, default `latest` — intentional so recipes track the current release; pin an exact version for reproducible CI. The companion skill's `cowork-harness@>=1.0.5` floor guidance applies to ad-hoc CLI installs, not this input), `strict` (applies to `replay` (staleness findings), `lint`/`lint-skill` (WARN/INFO), and `analyze-skill` (any advisory finding); IGNORED — not forwarded — for `verify-cassettes`/`run`, which don't accept the flag), `fail-on-skill-drift` (**`replay`-only** — never forwarded to the analyzers), `extra-args`, `summary` (default `true`), `anthropic-api-key` (live lane only). See [`action.yml`](./action.yml) for the full input reference.
 
 The provided [GitHub Actions workflow](.github/workflows/ci.yml) runs a **six-stage pipeline**. The **unit** stage is the token-free gate you can copy into your skill repo; the `action-self-test`, `python`, `boundary`, `scenarios`, and `parity-drift` stages are this repo's own fidelity self-tests and are not directly portable (they build the harness's Docker image and run harness-specific e2e scenarios — see [`ci-recipe.md`](./.claude/skills/cowork-harness/references/ci-recipe.md) for the skill-repo template):
 

package/RELEASING.md

@@ -6,32 +6,18 @@ Pushing a `vX.Y.Z` tag triggers the `.github/workflows/release.yml` workflow, wh
 npm via **OIDC Trusted Publishing** (no stored token). Do **not** run `npm publish` manually — it
 requires an OTP and is not how this repo ships.
 
-## Admin override — deliberately skipping the live scenario suite for one release
-
-The live scenario suite is part of the publish gate: on a canonical-repo push to `main` (the SHA
-`release.yml` gates on), `ci.yml` **hard-fails** if `ANTHROPIC_API_KEY` is missing, so a release can
-never silently publish without it. When you must ship a release without running the live suite (e.g.
-the key is temporarily unavailable), override it **explicitly and per-commit** — never by weakening the
-gate:
-
-1. Set a repository **variable** (not a secret) named `SKIP_LIVE_SCENARIOS` to the **exact full commit
-   SHA** you are releasing:
-   ```
-   gh variable set SKIP_LIVE_SCENARIOS --repo yaniv-golan/cowork-harness --body "<full-40-char-SHA>"
-   ```
-   The `ci.yml` guard skips the live suite (loud `::warning::ADMIN OVERRIDE`) **only** when this
-   variable equals the running commit's SHA. Because it is pinned to one SHA, a later commit can never
-   inherit the skip — the override auto-expires. Setting a repo variable requires admin, so the bypass
-   is admin-gated and auditable in the run log.
-2. Push that commit / re-run `ci.yml`; the scenario job now passes, so `require-ci-success` (the publish
-   gate) is satisfied and the tag can publish.
-3. **Unset it afterward** so the next release runs the live suite normally:
-   ```
-   gh variable delete SKIP_LIVE_SCENARIOS --repo yaniv-golan/cowork-harness
-   ```
-
-This keeps the gate strict by default (a missing key still reds every un-overridden publish) while
-giving an admin a deliberate, one-release, logged escape hatch.
+## The live scenario suite is best-effort (not a publish gate)
+
+The live scenario suite (the `scenarios` job in `ci.yml`) runs live inference only when
+`ANTHROPIC_API_KEY` is available to the runner. Without the key it **soft-skips (green)** on every
+event — pushes to `main` included — emitting a loud `⚠️ NOT live-validated` marker in the run summary.
+It does **not** block the run and is **not** a publish gate: `release.yml`'s `require-ci-success` still
+requires the `ci.yml` run for the tagged commit to be green, but a green run does not by itself prove
+the scenarios were validated against a real model.
+
+To actually run the live suite in CI, set the `ANTHROPIC_API_KEY` repo secret. There is no
+`SKIP_LIVE_SCENARIOS` override — the suite never hard-fails on a missing key, so there is nothing to
+override.
 
 ## The preferred three-phase sequence (branch → PR → merge → tag)
 
@@ -142,7 +128,7 @@ tagging `1.0.0`, deliberately review and freeze the surfaces with no machine-rea
       add that bullet by hand.
 - [ ] `npm run preflight` — local pre-release gate (`check:versions`, CHANGELOG heading present + non-empty,
       tag `vX.Y.Z` not already used, clean tree; warns if the `ANTHROPIC_API_KEY` repo secret is missing so
-      the push-to-main live suite would need the `SKIP_LIVE_SCENARIOS` override — see §9).
+      the push-to-main live suite will soft-skip and this release won't be live-validated in CI).
 - [ ] `npm run format:check` — fix any issues (`npx prettier --write "src/**/*.ts" "test/**/*.ts"`).
       A format failure is the most common first-pass CI red.
 - [ ] `npx tsc -p tsconfig.test.json --noEmit` — typecheck including tests.

package/examples/replays/README.md

@@ -16,7 +16,7 @@ DOES exercise a real gate exchange, see `example-multiselect-gate.cassette.json`
 
 Run it with:
 
-> Assumes the `cowork-harness` CLI is available — from a source checkout run `npm ci && npm run build && npm link` first, or `npm i -g "cowork-harness@>=1.0.4"`. (`replay` itself needs nothing else — no token, no Docker.)
+> Assumes the `cowork-harness` CLI is available — from a source checkout run `npm ci && npm run build && npm link` first, or `npm i -g "cowork-harness@>=1.0.5"`. (`replay` itself needs nothing else — no token, no Docker.)
 
 ```sh
 cowork-harness replay examples/replays/example-pdf-skill.cassette.json

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cowork-harness",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "description": "Scriptable, CI-friendly harness for Claude Cowork's runtime contract for testing skills across scenarios — same agent, mounts, egress allowlist, permission protocol, and sandbox limitations.",
   "license": "MIT",
   "type": "module",
@@ -106,7 +106,7 @@
   "devDependencies": {
     "@types/node": "^26.0.0",
     "ajv": "^8.17.1",
-    "prettier": "3.9.4",
+    "prettier": "3.9.5",
     "tsx": "^4.19.0",
     "typescript": "^6.0.3",
     "vitest": "^4.1.9"

package/scripts/release-preflight.ts

@@ -10,7 +10,7 @@
 //      stricter than release.yml — the section body is non-empty.
 //   3. The tag `v<version>` does not already exist, locally or on origin.
 //   4. The working tree is clean (`git status --porcelain` empty).
-//   5. Best-effort, WARN-only: nudge about the ANTHROPIC_API_KEY repo secret (live-suite gate).
+//   5. Best-effort, WARN-only: nudge about the ANTHROPIC_API_KEY repo secret (the live suite runs only with it).
 //   6. --for-tag only, HARD fail: HEAD == origin/main HEAD, and a successful push-event ci.yml run
 //      exists for HEAD — the exact check that would have caught the 0.33.0 mis-tag (tagging a
 //      release-branch head instead of the merge commit).
@@ -35,17 +35,15 @@ export function isValidSemver(v: string): boolean {
 }
 
 /**
- * Mirrors release.yml's "Verify CHANGELOG has a heading for this version" step (a literal
- * `^## \[<version>\]` match, dots escaped) — plus a stricter, preflight-only requirement that the
- * section body (everything between this heading and the next `## [`) is non-empty. release.yml itself
- * does NOT require a non-empty body (its release-notes extraction step has its own fallback for that);
- * this function is intentionally stricter so an accidentally-empty section is caught before the tag.
+ * Mirrors release.yml's "Verify CHANGELOG has a heading for this version" step (an anchored
+ * `^## \[<version>\]` heading match) — implemented here as a literal line-prefix test on
+ * `## [<version>]`, so the version is matched verbatim (dots stay literal; no regex built from the
+ * version) — plus a stricter, preflight-only requirement that the section body (everything between
+ * this heading and the next `## [`) is non-empty. release.yml itself does NOT require a non-empty body
+ * (its release-notes extraction step has its own fallback for that); this function is intentionally
+ * stricter so an accidentally-empty section is caught before the tag.
  */
 export function changelogHasVersionSection(changelogText: string, version: string): boolean {
-  const escaped = version.replace(/\./g, "\\.");
-  const headingRe = new RegExp(`^## \\[${escaped}\\]`, "m");
-  if (!headingRe.test(changelogText)) return false;
-
   const headingPrefix = `## [${version}]`;
   const lines = changelogText.split("\n");
   let inSection = false;
@@ -139,14 +137,15 @@ function checkWorkingTreeClean(): CheckResult {
  * Best-effort, WARN-only. `gh secret list` sees ONLY repo-level Actions secrets — an org- or
  * environment-level ANTHROPIC_API_KEY would false-warn here, and the call itself needs admin scope on
  * the repo. If `gh` is unavailable or unauthenticated, print the reminder unconditionally rather than
- * silently skipping — RELEASING.md §9 documents the SKIP_LIVE_SCENARIOS override.
+ * silently skipping. Without the key the live suite soft-skips in CI (it is not a publish gate) — see
+ * RELEASING.md.
  */
 function checkLiveSuiteKeyReminder(): CheckResult {
   const REMINDER =
-    "if ANTHROPIC_API_KEY is not set as a repo secret, push-to-main ci will hard-fail the live scenario " +
-    "suite — set the secret or plan the SKIP_LIVE_SCENARIOS override (RELEASING.md §9). Note: `gh secret " +
-    "list` only sees repo-level Actions secrets — an org/environment secret would false-warn here, and the " +
-    "call needs admin scope.";
+    "if ANTHROPIC_API_KEY is not set as a repo secret, the push-to-main live scenario suite soft-skips — " +
+    "this release won't be live-validated in CI (set the secret to run it; see RELEASING.md). Note: `gh " +
+    "secret list` only sees repo-level Actions secrets — an org/environment secret would false-warn here, " +
+    "and the call needs admin scope.";
 
   const ghVersion = run("gh", ["--version"]);
   if (!ghVersion.ok) {