Repository navigation
takeover mode: agents cannot auto-open PRs — GitHub App missing pull_requests / actions / secrets permissions #7
Description
Problem
When running wanman takeover against a GitHub-hosted repo, agents (dev, cto) follow the documented git workflow:
feature branch → write code → push → gh pr create → notify CTO
However, the gh pr create call fails (or silently skips) because the GitHub App / installation token that wanman provisions does not include the required scopes/permissions.
Observed in: takeover of nicgzlfly/-_the-crowd (2026-04-30)
Missing permissions
| Permission | Needed for | Observed state |
|---|---|---|
pull_requests: write |
gh pr create — agents opening PRs |
❌ missing |
actions: write (or read) |
Agents reading CI run status via gh run list / triggering re-runs |
❌ missing |
secrets: read |
Workflows that reference ${{ secrets.* }} (deploy pipeline uses SSH_PRIVATE_KEY, SERVER_HOST, etc.) |
❌ not accessible to App token |
Reproduction
- Install wanman and run
wanman takeover /path/to/repoagainst a private GitHub repo. - Assign a dev task with a feature branch target.
- Dev agent pushes branch and calls
gh pr create. - PR creation fails or is skipped because the GitHub App installation token lacks
pull_requests: write.
Expected behavior
wanman takeoversetup flow (or docs) should verify that the configured GitHub App installation has at minimum:pull_requests: writeactions: read(so agents can poll CI status)contents: write(branch push)
- If permissions are insufficient, wanman should surface a clear error at startup rather than silently failing mid-task.
Suggested fix / detection
Add a pre-flight check in takeover-local.ts (or takeover-project.ts) that calls:
gh api repos/{owner}/{repo}/actions/permissions
gh api repos/{owner}/{repo} --jq '.permissions'...and warns the user if pull_requests permission is absent before agents start working.
Alternatively, document the exact GitHub App permission set that must be granted before running wanman takeover.
Environment
- wanman CLI built from local source (
packages/cli/dist/index.js) - Runtime:
claude(Claude Code subprocess) - Repo type: GitHub public/private
- Auth: personal
ghtoken withrepo,workflowscopes (agents inherit this; App token is separate)
References
packages/cli/src/takeover-project.tslines 773–787 (CTO PR review workflow)packages/cli/src/takeover-local.tsdetectPullRequestUrl()(assumes PR already exists)- Skill doc:
wanman/<task-slug>branch →gh pr createdocumented as required dev step
cc @chekusu
Activity
guo-yu commentedon May 16, 2026
I checked the current takeover code and agree that this is still a real preflight/docs gap.
Code evidence:
packages/cli/src/takeover-project.tsexplicitly tells agents togit push -u origin wanman/<task-slug>and then rungh pr create.gh pr checks,gh pr review, andgh pr mergeto work.packages/cli/src/takeover-local.tshasdetectPullRequestUrl(), but it only runsgh pr list --head ...and returnsundefinedon any error. It does not distinguish “no PR yet” from “GitHub auth/token cannot read PRs”.One caveat:
gh api repos/{owner}/{repo} --jq '.permissions'verifies the activeghtoken’s repo role, but it does not necessarily prove that a separate GitHub App installation token haspull_requests: writeoractions: read. If takeover can run under either a user token or an app token, the check should be tied to the exact credential that agents will inherit.Suggested acceptance for a fix:
wanman takeoverstartup, detect the Git remote owner/repo.gh pr checks/gh run listSo I would keep this open. The fix is probably a preflight + docs change rather than only changing the prompt.