Validate GitHub App token wrappers by token flow

[adampoit]

Summary

• resolve the checkout token expression to an action step and require every Patchlane command to use the same token
• accept wrapper actions with an informational static-permission boundary while retaining strict direct-provider validation
• skip standard App credential metadata checks for wrapper-only workflows and document the supported adaptation
• cover valid wrappers, direct providers, missing or invalid producers and outputs, built-in tokens, and mismatched wiring

Testing

• npm test
• npm run format:check

Closes #55

[not-adam]

Mira PR Walkthrough

This PR enhances Patchlane's doctor command to support GitHub App token wrappers (composite actions that internally create tokens and expose them via outputs.token). It resolves the checkout token expression to a producer step, requires all Patchlane commands in a job to use the same token, accepts wrapper actions with an informational notice (since their permissions can't be statically verified), and skips standard App credential metadata checks when only wrapper providers are present in the workflow set.

graph LR
    runner["runDoctor()"]
    inspectJob["inspectAuthenticatedJob()"]
    inspectWorkflows["inspectWorkflows()"]
    inspectGH["inspectGitHubAutomation()"]
    tests["tests/doctor.test.ts"]
    docs["docs/configuration.md"]

    runner --> inspectWorkflows
    inspectWorkflows --> inspectJob
    inspectJob --> runner
    runner --> inspectGH
    tests --> inspectJob
    tests --> inspectGH
    docs --> inspectJob

Loading

Confidence: 4/5   ◉◉◉◉○   Safe with minor fixes

• Logic is well-structured with comprehensive tests covering valid wrappers, direct providers, missing producers, invalid expressions, built-in tokens, and mismatched wiring. Minor: the new test at line 267 references inspectGitHubAutomation with an extra boolean parameter whose signature isn't fully visible in the truncated output, but the logic is sound.

Blast Radius — 2 dependent repositories, 3 total references

adampoit/mira — 1 reference
adampoit/wezterm — 2 references

3 files reviewed

---

Comment @not-adam help to get the list of available commands and usage tips.