[jferrl]

Summary

githubauth token --permissions narrows a token to less than the App was granted. It accepted only the permission names the library has a struct field for, so a permission GitHub added since, such as installation_repositories, could not be requested from the CLI. Every name now goes to GitHub through InstallationPermissions.Other, added in #88.

What this does

--permissions	Before	After
pull_requests:read	Token narrowed	Unchanged
installation_repositories:write	Exit 2: unknown permission	Sent to GitHub
pull_request:read (typo)	Exit 2: unknown permission	GitHub answers 422, exit 2 with its message

Changes

• --permissions sends every name through Other. The empty-list and name:level checks stay.
• AGENTS.md points exit code 5 at --owner as well as --installation.

Rationale

The name list guarded against GitHub ignoring a name it does not know and minting a token with every permission. Against a real App it does not: pull_request, nonsense_xyz, and nonsense_xyz beside the valid pull_requests all got a 422, and no token was minted.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.71%. Comparing base (b9b5c34) to head (e5e4403).

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #89      +/-   ##
==========================================
- Coverage   97.74%   97.71%   -0.03%     
==========================================
  Files           8        8              
  Lines         797      787      -10     
==========================================
- Hits          779      769      -10     
  Misses         18       18              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.