fix: carry workflows:write on the standing proxy token

Complete the half-ported upstream 216cf181 cascade. The port dropped
_run_with_workflow_token from the guard but missed the paired github_app
change, so an approved .github/workflows push ran with the base token
(no workflows:write) and GitHub 403'd it.

Add workflows:write to BASE_RUNTIME_PROXY_TOKEN_PERMISSIONS and delete the
now-orphaned WORKFLOW_RUNTIME_PROXY_TOKEN_PERMISSIONS constant; update the
github_app and proxy_auth tests to match. The HITL approval gate in
workflow_push_guard.py is unchanged — this only lets the standing token
push once a human approves.

agent/middleware/workflow_push_guard.py

@@ -653,9 +653,7 @@ def _workflow_change_for_push(backend: Any, parsed: ParsedGitPush) -> WorkflowPu
     fixed_command = _git_command(root, " ".join(shlex.quote(arg) for arg in fixed_args))
 
     # Fetch diff preview for the workflow approval card.
-    diff_range = (
-        f"{shlex.quote(base_ref)}...{shlex.quote(head)}" if base_ref else shlex.quote(head)
-    )
+    diff_range = f"{shlex.quote(base_ref)}...{shlex.quote(head)}" if base_ref else shlex.quote(head)
     diff = _run_git(backend, root, f"diff --binary --full-index {diff_range} -- .github/workflows")
     numstat = None
     diff_preview = ""
@@ -669,7 +667,8 @@ def _workflow_change_for_push(backend: Any, parsed: ParsedGitPush) -> WorkflowPu
             diff_stats_val = _diff_stats(files, numstat.output)
     elif base_ref and not diff.ok:
         diff_only_head = _run_git(
-            backend, root,
+            backend,
+            root,
             f"diff --binary --full-index --root {shlex.quote(head)} -- .github/workflows",
         )
         if diff_only_head.ok and diff_only_head.output:

agent/utils/github_app.py

@@ -31,15 +31,12 @@ BASE_RUNTIME_PROXY_TOKEN_PERMISSIONS: dict[str, str] = {
     "pull_requests": "write",
     "issues": "write",
     "checks": "write",
+    "workflows": "write",
 }
 RUNTIME_PROXY_TOKEN_PERMISSIONS: dict[str, str] = {
     **BASE_RUNTIME_PROXY_TOKEN_PERMISSIONS,
     "actions": "read",
 }
-WORKFLOW_RUNTIME_PROXY_TOKEN_PERMISSIONS: dict[str, str] = {
-    **BASE_RUNTIME_PROXY_TOKEN_PERMISSIONS,
-    "workflows": "write",
-}
 
 PermissionMap = Mapping[str, str]
 PermissionKey = tuple[tuple[str, str], ...]

docs/upstream-sync/triage.jsonl

@@ -67,7 +67,7 @@
 {"sha": "e5dbc788", "pr": 1696, "subject": "fix: Harden durable agent runs (#1696)", "disposition": "deferred", "reason": "large durable-run hardening; 3 new modules dev lacks; rewrites fork dispatch/completion", "branch": "durable-dispatch", "local_sha": null, "updated": "2026-07-08T20:14:42Z"}
 {"sha": "52fe2916", "pr": 1698, "subject": "feat: add PR review link route (#1698)", "disposition": "landed", "reason": "cherry-picked (-x) in #127 (PR review link route)", "branch": "reviewer-misc", "local_sha": null, "updated": "2026-07-08T22:58:21Z"}
 {"sha": "5f7f5fbd", "pr": 1697, "subject": "fix: Reduce graph import and loader startup latency (#1697)", "disposition": "deferred", "reason": "import-hygiene refactor; cross-cutting, references many deferred upstream-only modules", "branch": "durable-dispatch", "local_sha": null, "updated": "2026-07-08T20:14:42Z"}
-{"sha": "216cf181", "pr": 1699, "subject": "fix: keep workflow HITL without token downscoping (#1699)", "disposition": "landed", "reason": "FLAG-HUMAN: removes token downscoping — conflicts w/ fork PR#100 workflow-token elevation (auth surface)", "branch": "plan-approval", "local_sha": null, "updated": "2026-07-09T17:10:22Z"}
+{"sha": "216cf181", "pr": 1699, "subject": "fix: keep workflow HITL without token downscoping (#1699)", "disposition": "landed", "reason": "FLAG-HUMAN: broadens standing proxy token to workflows:write (auth surface, security-review pending) — cascade fully applied: github_app.py base perms + guard both ported; HITL approval gate preserved", "branch": "plan-approval", "local_sha": null, "updated": "2026-07-09T18:30:00Z"}
 {"sha": "67abf5b0", "pr": 1659, "subject": "fix: surface attributed PR creation failures (#1659)", "disposition": "deferred", "reason": "PR-attribution-failure guard (new mw, safe imports); heavy conflict on diverged open_pull_request.py", "branch": "pr-attribution", "local_sha": null, "updated": "2026-07-08T20:14:42Z"}
 {"sha": "3dbc0282", "pr": 1676, "subject": "fix: preserve plan redirects after login (#1676)", "disposition": "landed", "reason": "FLAG-HUMAN: follow-on to landed #1668 refining sanitize_redirect_to (open-redirect auth surface); not a dup", "branch": "plan-approval", "local_sha": null, "updated": "2026-07-09T17:10:22Z"}
 {"sha": "c75cbb1f", "pr": 1677, "subject": "feat: re-add Fable 5 with an admin toggle to disable it (#1677)", "disposition": "deferred", "reason": "FLAG-HUMAN: re-adds Fable 5 via anthropic: — contradicts dev's deliberate hide (#1483) + Bedrock migration (#62); wont-merge candidate", "branch": "fable-admin-toggle", "local_sha": null, "updated": "2026-07-08T20:14:42Z"}

docs/upstream-sync/triage.md

@@ -40,7 +40,7 @@ Rows key on the **upstream SHA** (stable across local cherry-picks). Deferred ro
 | `20f63e8c` | #1646 | install missing deps before verification | Landed | already in dev via #81 (upstream-sync); ledger was stale | prompt-tweaks |
 | `2f237b53` | #1626 | fall back to vision model for image threads | Landed | ported (adapted to Bedrock/Fireworks vision) in #128 | gateway-routing |
 | `52fe2916` | #1698 | feat: add PR review link route (#1698) | Landed | cherry-picked (-x) in #127 (PR review link route) | reviewer-misc |
-| `216cf181` | #1699 | fix: keep workflow HITL without token downscoping (#1699) | Landed | FLAG-HUMAN: removes token downscoping — conflicts w/ fork PR#100 workflow-token elevation (auth surface) | plan-approval |
+| `216cf181` | #1699 | fix: keep workflow HITL without token downscoping (#1699) | Landed | FLAG-HUMAN: broadens standing proxy token to workflows:write (auth surface, security-review pending) — cascade fully applied: github_app.py base perms + guard both ported; HITL approval gate preserved | plan-approval |
 | `3dbc0282` | #1676 | fix: preserve plan redirects after login (#1676) | Landed | FLAG-HUMAN: follow-on to landed #1668 refining sanitize_redirect_to (open-redirect auth surface); not a dup | plan-approval |
 | `bb104d93` | #1679 | fix: submit plan comments with cmd enter (#1679) | Landed | applies clean but edits fork-diverged PlanReview.tsx (#130); needs UI/e2e validation — separate PR | plan-approval |
 | `7f7af715` | #1684 | feat: auto-load scoped AGENTS on reads (#1684) | Landed | ported in #129 (SubdirAgentsReadMiddleware) | subdir-agents |

tests/test_github_app.py

@@ -147,11 +147,12 @@ async def test_installation_token_can_be_scoped_to_repository_ids(
     assert _FakeAsyncClient.last_post["json"] == {"repository_ids": [123]}
 
 
-def test_runtime_proxy_token_permissions_include_optional_read_only_actions() -> None:
+def test_runtime_proxy_token_permissions_include_workflows_and_optional_actions() -> None:
+    assert github_app.BASE_RUNTIME_PROXY_TOKEN_PERMISSIONS["workflows"] == "write"
     assert "actions" not in github_app.BASE_RUNTIME_PROXY_TOKEN_PERMISSIONS
+    assert github_app.RUNTIME_PROXY_TOKEN_PERMISSIONS["workflows"] == "write"
     assert github_app.RUNTIME_PROXY_TOKEN_PERMISSIONS["actions"] == "read"
     assert github_app.RUNTIME_PROXY_TOKEN_PERMISSIONS.get("actions") != "write"
-    assert "actions" not in github_app.WORKFLOW_RUNTIME_PROXY_TOKEN_PERMISSIONS
 
 
 @pytest.mark.asyncio

tests/test_proxy_auth.py

@@ -210,7 +210,7 @@ class TestCreateSandboxWithProxy:
 
     @pytest.mark.asyncio
     async def test_falls_back_when_optional_actions_permission_is_unavailable(self) -> None:
-        """Sandbox creation should still work before an install grants Actions read."""
+        """Sandbox creation should still keep workflow scope without Actions read."""
         with (
             patch(
                 "agent.server.get_github_app_installation_token_with_expiry",
@@ -235,6 +235,7 @@ class TestCreateSandboxWithProxy:
             assert mock_get_token.await_args_list[1].kwargs["permissions"] == (
                 BASE_RUNTIME_PROXY_TOKEN_PERMISSIONS
             )
+            assert mock_get_token.await_args_list[1].kwargs["permissions"]["workflows"] == "write"
             mock_proxy.assert_called_once_with("sandbox-123", "ghs_install")
             mock_record.assert_called_once_with(
                 "thread-123",

tests/test_workflow_push_guard.py

@@ -1,7 +1,6 @@
 from __future__ import annotations
 
 import json
-import os
 from typing import Any
 
 import pytest

ui/src/routes/login.tsx

@@ -63,7 +63,7 @@ function Login() {
         </CardHeader>
         <CardContent>
           <a
-            href={loginUrl(authRedirectUrl(intendedPath))}
+            href={loginUrl(intendedPath)}
             className={cn(buttonVariants({ size: "lg" }), "w-full")}
           >
             Continue with GitHub