Bug

anvil auth login’s device flow requests a hardcoded scope list (DEFAULT_SCOPES, src/commands/auth.rs:12-25) that OMITS repo:admin. Scopes are matched exactly on the server (no hierarchy — personal_access_token.ex / helpers.ex:254), and the CI-secret endpoints require repo:admin (secret_controller.ex:13/35/66).

Result: a token obtained via anvil auth login can never run anvil ci set-secret / delete-secret / list secrets — they 403 with Token requires scope: repo:admin, even though those are first-class CLI commands.

Repro

anvil auth login (device flow), then anvil ci set-secret --repo <org>/<repo> --name X --value Y → 403 insufficient_scope: repo:admin.

Root cause

The comment at auth.rs:9-11 (“no admin:*”) conflated the ORG-level admin:* scopes (correctly excluded) with the REPO-level repo:admin scope, and dropped repo:admin too. repo:admin is a normal repo scope backing a shipped CLI command, so it belongs in the default login set.

Fix

Add "repo:admin" to DEFAULT_SCOPES. (Optional follow-up: a --scope flag on auth login to override the default set.)

Diagnosed via a source audit of anvil (server) + anvil_cli.