Run `openagents <command> --help` for the reference installed with your CLI

version.

For one command without a global installation, replace the `openagents` prefix

with `npx --yes @openagentsinc/cli@latest`. Do not run `auth setup-git` through

`npx`; install the CLI globally before saving a persistent Git helper.

## Global flags

| Flag | Description |

This release does not provide `repo delete`, `repo mirror`, pull-request,

ruleset, SSH-key, generic API, or self-update commands. Use only commands shown

by the installed version's `--help` output.

`--wait-timeout 0` to return after the server accepts the durable request. The

repository continues provisioning on the server.

Run one create command without a global installation:

```sh

npx --yes @openagentsinc/cli@latest repo create my-project

```

## Attach an existing local project

Create the remote repository and attach it to an existing Git worktree:

## Push the first commit

For an existing local project:

Install the CLI globally before configuring persistent Git authentication. For

an existing local project:

```sh

openagents auth setup-git --local

git init my-project

cd my-project

git branch -M main

git remote add origin https://openagents.com/git/OWNER/my-project.git

git remote add origin https://openagents.com/OWNER/my-project.git

# Add files, then commit them.

openagents auth setup-git --local

git push -u origin main

- [Clone, push, and pull](git.md)

- [Import a GitHub repository](import-github.md)

- [CLI command reference](command-reference.md)

openagents repo clone OWNER/REPOSITORY ./local-directory

```

Run one clone without a global installation:

```sh

npx --yes @openagentsinc/cli@latest repo clone OWNER/REPOSITORY

```

The command uses the server-provided clone URL and invokes Git without putting

the token in the URL or process arguments. For the clone operation, it scopes

the OpenAgents credential helper to the selected API origin.

Copy the HTTPS URL from the repository page, then run:

```sh

git clone https://openagents.com/git/OWNER/REPOSITORY.git

git clone https://openagents.com/OWNER/REPOSITORY.git

```

Public repositories support anonymous clone and fetch. Private repositories

require an authorized credential.

Before you use standard Git with a private repository, configure the helper:

Before you use standard Git with a private repository, install the CLI globally

and configure the helper:

```sh

cd existing-worktree

openagents auth setup-git --local

```

Do not run `auth setup-git` through `npx`. The saved helper calls

`openagents`, and the temporary executable is unavailable after `npx` exits.

Use global setup only when you want every local repository to use the helper

for the selected OpenAgents origin:

openagents repo view

```

The CLI accepts only `/git/OWNER/REPOSITORY.git` on the selected API origin. It

The CLI accepts only `/OWNER/REPOSITORY.git` on the selected API origin. It

does not infer authority from an arbitrary URL that resembles a repository

path. Override inference explicitly when needed:

- [Install and authenticate the CLI](install.md)

- [CLI command reference](command-reference.md)

after the server accepts the durable import. A client timeout does not cancel

the server-side import.

Run one import without a global installation:

```sh

npx --yes @openagentsinc/cli@latest repo import OWNER/REPOSITORY

```

Pin the package version for a reproducible qualification run:

```sh

npx --yes @openagentsinc/cli@0.1.3 \

  --profile staging \

  repo import OWNER/REPOSITORY \

  --private \

  --wait-timeout 300

```

In a headless agent process, `auth login` prints the complete approval URL and

user code, then waits. The agent can surface both values while you approve the

request in any browser. Install the CLI globally before you run

`auth setup-git`; a saved Git helper cannot call the temporary executable after

`npx` exits.

## Import a large repository

OpenAgents keeps large Git bundles on disk and streams them to and from the

durable forge WAL in 1 MiB chunks. The application does not read the complete

bundle into the BEAM heap. The default server limits allow a bundle up to 20

GiB and an import to run for up to six hours.

The CLI's `--wait-timeout` controls only how long that client waits. It does

not change or cancel the server import. For a large repository, accept the

operation immediately and check it separately:

```sh

openagents repo import OWNER/REPOSITORY --wait-timeout 0

openagents repo view OWNER/REPOSITORY

```

The repository page reports queued, copying, storing, ready, and failed states.

Server logs record every stage and the bundle byte count. A bundle over the

server limit fails with `import_too_large`; an operation over the server time

limit fails with `import_timeout`.

Large imports still need enough temporary disk for the fetched Git objects and

the bundle. Git LFS objects remain outside the import. Start an environment's

first import with a small repository so you can qualify authentication,

lifecycle reporting, storage, and clone behavior before spending the time and

bandwidth of a large transfer.

## Verify the first production import

Use a small private GitHub repository for the first production import. Include

The CLI is available from npm. OpenAgents qualified repository imports on

staging before deploying the same server revision to the production fleet.

The same guides are published on the [OpenAgents documentation

site](https://openagents.com/docs/openagents-cli).

Install the CLI globally for regular use, or run a one-time command through

`npx`:

```sh

npm install --global @openagentsinc/cli

npx --yes @openagentsinc/cli@latest --version

```

Do not configure a persistent Git credential helper through `npx`. Install the

CLI globally before you run `openagents auth setup-git`.

## What you can do

The first release lets you:

# Install the OpenAgents CLI

The npm package is `@openagentsinc/cli`, and it installs the `openagents`

command. The package requires Node.js 24.15 or later.

command. The package requires Node.js 20 or later.

## Install with npm

The CLI does not include an `openagents update` command.

## Run one command with npx

Use `npx` when you want to run one command without a global installation:

```sh

npx --yes @openagentsinc/cli@latest --version

npx --yes @openagentsinc/cli@latest repo list

```

Pin a version for a reproducible run:

```sh

npx --yes @openagentsinc/cli@0.1.3 --version

```

Place all CLI arguments after the package name:

```sh

npx --yes @openagentsinc/cli@latest --profile staging auth status

npx --yes @openagentsinc/cli@latest repo import OWNER/REPOSITORY

```

Do not run `auth setup-git` through `npx`. The command writes a persistent Git

helper configuration that calls `openagents`, but the temporary executable is

unavailable after `npx` exits. Install the CLI globally before you configure a

local or global Git helper.

## Run the CLI from source

From the root of the `openagents` monorepo:

operating system supports it, and waits for approval. Complete the flow with

the GitHub account connected to OpenAgents.

In a headless or noninteractive agent process, the command prints the complete

authorization URL and user code to standard error and waits. Have the agent

surface both values to you. Open the URL in any browser, review the request,

and approve it. The waiting command then stores the OpenAgents token and

continues; the agent never receives your GitHub token.

The CLI stores the resulting `oa_pat_` token for the selected API origin:

- On macOS, it uses Keychain through the `security` command.

## Configure Git authentication

Configure only the current Git repository:

After you install the CLI globally, configure only the current Git repository:

```sh

openagents auth setup-git --local

| `GET /api/v3/user/repos` | Authenticated API | List repositories visible to the caller, including private repositories |

| `GET /api/v3/repos/{owner}/{repo}` | Optional API principal | Return a public repository or a repository visible to the principal |

| `GET /api/v3/repository-imports/{id}` | Authenticated API | Return bounded status for an import owned by the caller |

| Git smart HTTP under `/git/{owner}/{repo}.git` | Public read or authenticated Git principal | Clone, fetch, push, and pull |

| Git smart HTTP under `/{owner}/{repo}.git` | Public read or authenticated Git principal | Clone, fetch, push, and pull |

Do not add an endpoint that accepts an arbitrary owner string. The user route

derives the GitHub user namespace from the authenticated principal. The

  "description": "An optional description",

  "default_branch": "main",

  "lifecycle_state": "ready",

  "clone_url": "https://openagents.com/git/octavia/my-project.git",

  "clone_url": "https://openagents.com/octavia/my-project.git",

  "html_url": "https://openagents.com/octavia/my-project",

  "permissions": {

    "admin": true,

- A private, missing, suspended, failed, or unauthorized repository returns an

  indistinguishable refusal where the transport permits it.

Change the canonical Git path from a name-only route to

`/git/{owner}/{repo}.git`. Keep a tested compatibility alias for the existing

Use `/{owner}/{repo}.git` as the canonical Git path. Keep a tested compatibility alias for the existing

`/git/openagents.com.git` remote until the canonical repository cutover plan

retires it.

**Owner:** `openagents.com`.

1. Change the Git route to `/git/{owner}/{repo}.git` while keeping the temporary

1. Use the canonical `/{owner}/{repo}.git` route while keeping the temporary

   `/git/openagents.com.git` compatibility route required by the forge cutover

   contract.

2. Allow anonymous upload-pack only for a ready public repository.

  @moduledoc """

  Sarah's own git forge — the public API of the bounded context (audit A6).

  This app serves the forge at `openagents.com/git/<repo>.git` via stock git

  This app serves the forge at `openagents.com/<owner>/<repo>.git` via stock Git

  smart-HTTP (`OpenAgents.Forge.GitHTTP`), with the WAL in object storage as ref

  truth (`OpenAgents.Forge.WAL`, Continuity-shaped per audit A7), bare repos on

  the stateful partition as per-node cache (`OpenAgents.Forge.Repos` /

  @doc "The clone URL for a repo on this deployment."

  def clone_url(repo) do

    OpenAgentsWeb.Endpoint.url() <> "/git/#{repo}.git"

    OpenAgentsWeb.Endpoint.url() <> "/OpenAgentsInc/#{repo}.git"

  end

end

  Git smart-HTTP v0, wrapping the stock git binary ("Spokes got that exactly

  right" — standard packfiles, upstream clients, no custom object format).

  Serves, under the mount point (`/git` in the router):

  Serves under the canonical `/:owner/:repo.git` mount point:

      GET  /:repo.git/info/refs?service=git-upload-pack|git-receive-pack

      POST /:repo.git/git-upload-pack

  @impl true

  def call(conn, _opts) do

    case {conn.method, split_repo(conn.path_info)} do

    case {conn.method, split_repo(conn)} do

      {"GET", {:ok, owner, name, ["info", "refs"]}} ->

        advertise(conn, owner, name, first_query(conn, "service"))

  # ── helpers ─────────────────────────────────────────────────────────────

  defp split_repo([segment | rest]) do

  defp split_repo(%Plug.Conn{

         path_params: %{"owner" => owner, "repo" => segment},

         path_info: [_owner, _repo | rest]

       }) do

    case strip_git_suffix(segment) do

      {:ok, name} -> {:ok, owner, name, rest}

      :error -> :error

    end

  end

  defp split_repo(%Plug.Conn{path_info: path_info}), do: split_legacy_repo(path_info)

  defp split_legacy_repo([segment | rest]) do

    case strip_git_suffix(segment) do

      {:ok, "openagents.com"} -> {:ok, "OpenAgentsInc", "openagents.com", rest}

      {:ok, name} -> {:ok, nil, name, rest}

    end

  end

  defp split_repo(_), do: :error

  defp split_legacy_repo(_), do: :error

  defp split_namespaced_repo(owner, [segment | rest]) do

    case strip_git_suffix(segment) do

  end

  defp apply_entry!(repo, %{"seq" => seq, "object" => object} = entry) do

    {:ok, payload} = WAL.get_entry(repo, object)

    path = Repos.bare_path(repo)

    case entry["format"] || "receive_pack" do

      "receive_pack" ->

        {:ok, payload} = WAL.get_entry(repo, object)

        {_output, 0} = run_receive_pack(path, payload)

      "git_bundle" ->

        :ok = unbundle(path, payload)

        :ok = unbundle_entry(repo, path, object)

      "empty_import" ->

        :ok

    end

  end

  defp unbundle(path, payload) do

  defp unbundle_entry(repo, path, object) do

    temporary_path =

      Path.join(

        System.tmp_dir!(),

        Application.get_env(:openagents, :repository_import_temp_dir, System.tmp_dir!()),

        "openagents-import-#{System.unique_integer([:positive, :monotonic])}.bundle"

      )

    try do

      File.write!(temporary_path, payload, [:binary, :exclusive])

      File.chmod!(temporary_path, 0o600)

      case Repos.git(path, ["bundle", "unbundle", temporary_path]) do

        {_output, 0} -> :ok

        {_output, _status} -> raise "repository bundle could not be materialized"

      with :ok <- WAL.get_entry_file(repo, object, temporary_path),

           :ok <- File.chmod(temporary_path, 0o600) do

        case Repos.git(path, ["bundle", "unbundle", temporary_path]) do

          {_output, 0} -> :ok

          {_output, _status} -> raise "repository bundle could not be materialized"

        end

      end

    after

      File.rm(temporary_path)

              {:ok, generation} | {:error, :cas_conflict} | {:error, term}

  @callback put_entry(repo, seq :: non_neg_integer(), payload :: binary()) ::

              {:ok, object_key :: String.t()} | {:error, term}

  @callback put_entry_file(repo, seq :: non_neg_integer(), path :: String.t()) ::

              {:ok, object_key :: String.t()} | {:error, term}

  @callback get_entry(repo, object_key :: String.t()) :: {:ok, binary()} | {:error, term}

  @callback get_entry_file(repo, object_key :: String.t(), path :: String.t()) ::

              :ok | {:error, term}

  @callback put_object(repo, object_key :: String.t(), payload :: binary()) ::

              {:ok, String.t()} | {:error, term}

    with :ok <- validate_repo(repo), do: adapter().put_entry(repo, seq, payload)

  end

  @doc """

  Stream one immutable WAL entry from `path` through the configured adapter.

  The adapter derives the same content-addressed key as `put_entry/3` without

  loading the complete file into the BEAM heap.

  """

  @spec put_entry_file(repo, non_neg_integer(), String.t()) ::

          {:ok, String.t()} | {:error, term}

  def put_entry_file(repo, seq, path)

      when is_integer(seq) and seq >= 0 and is_binary(path) do

    with :ok <- validate_repo(repo),

         {:ok, %File.Stat{type: :regular}} <- File.stat(path) do

      adapter().put_entry_file(repo, seq, path)

    else

      {:ok, _not_regular} -> {:error, :invalid_entry_file}

      {:error, reason} -> {:error, reason}

    end

  end

  @doc """

  Fetch a previously stored WAL entry payload for `repo` by its object key.

  """

    end

  end

  @doc "Stream a WAL entry into `path` without retaining its complete body in memory."

  @spec get_entry_file(repo, String.t(), String.t()) :: :ok | {:error, term}

  def get_entry_file(repo, object_key, path)

      when is_binary(object_key) and is_binary(path) do

    with :ok <- validate_repo(repo),

         :ok <- validate_entry_key(object_key) do

      adapter().get_entry_file(repo, object_key, path)

    end

  end

  @doc """

  Store a named artifact blob alongside the WAL (P6, #123): built beam tars

  land here so a replaced node — whose local artifact cache is empty — can

    "entries/" <> String.pad_leading(Integer.to_string(seq), 8, "0") <> "-" <> digest

  end

  @doc "Derive the immutable entry key for a file without loading the file into memory."

  @spec entry_key_file(non_neg_integer(), String.t()) :: {:ok, String.t()} | {:error, term}

  def entry_key_file(seq, path) when is_integer(seq) and seq >= 0 and is_binary(path) do

    with {:ok, digest} <- file_digest(path) do

      {:ok, entry_key_from_digest(seq, digest)}

    end

  end

  defp file_digest(path) do

    try do

      digest =

        path

        |> File.stream!(1_048_576, [])

        |> Enum.reduce(:crypto.hash_init(:sha256), &:crypto.hash_update(&2, &1))

        |> :crypto.hash_final()

      {:ok, digest}

    rescue

      File.Error -> {:error, :entry_file_unavailable}

    end

  end

  defp entry_key_from_digest(seq, digest) do

    prefix =

      digest

      |> Base.encode16(case: :lower)

      |> binary_part(0, 12)

    "entries/" <> String.pad_leading(Integer.to_string(seq), 8, "0") <> "-" <> prefix

  end

  @doc """

  Validate a repository name (`[a-z0-9][a-z0-9_-]*`).

  """

  @metadata_token_url "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token"

  @token_cache_key {__MODULE__, :token}

  @token_expiry_margin_seconds 60

  @stream_chunk_bytes 1_048_576

  @default_stream_timeout_ms 6 * 60 * 60 * 1_000

  @impl WAL

  def read_index(repo) do

    end

  end

  @impl WAL

  def put_entry_file(repo, seq, path) when is_integer(seq) and seq >= 0 do

    with {:ok, bucket} <- bucket(),

         {:ok, key} <- WAL.entry_key_file(seq, path),

         {:ok, size} <- regular_file_size(path),

         {:ok, token} <- token(),

         :ok <- upload_file(bucket, object_name(repo, key), path, size, token) do

      {:ok, key}

    end

  end

  @impl WAL

  def put_object(repo, object_key, payload) when is_binary(payload) do

    with {:ok, bucket} <- bucket(),

    end

  end

  @impl WAL

  def get_entry_file(repo, object_key, path) when is_binary(object_key) and is_binary(path) do

    with {:ok, bucket} <- bucket(),

         {:ok, token} <- token() do

      download_file(bucket, object_name(repo, object_key), path, token)

    end

  end

  ## Object naming (public so it is testable without a live bucket)

  @doc """

    end

  end

  defp upload_file(bucket, name, path, size, token) do

    url =

      @storage_base <>

        "/upload/storage/v1/b/#{URI.encode_www_form(bucket)}/o?" <>

        URI.encode_query(uploadType: "media", name: name)

    case Req.post(url,

           body: File.stream!(path, @stream_chunk_bytes, []),

           headers:

             auth_headers(token) ++

               [

                 {"content-type", "application/octet-stream"},

                 {"content-length", Integer.to_string(size)}

               ],

           receive_timeout: stream_timeout_ms(),

           retry: false

         ) do

      {:ok, %Req.Response{status: 200}} -> :ok

      {:ok, %Req.Response{status: status, body: body}} -> {:error, {:gcs_error, status, body}}

      {:error, reason} -> {:error, reason}

    end

  end

  defp download_file(bucket, name, path, token) do

    temporary = path <> ".tmp." <> Integer.to_string(System.unique_integer([:positive]))

    result =

      with :ok <- File.mkdir_p(Path.dirname(path)) do

        case Req.get(object_url(bucket, name) <> "?alt=media",

               headers: auth_headers(token),

               into: File.stream!(temporary, @stream_chunk_bytes, [:write, :binary]),

               decode_body: false,

               receive_timeout: stream_timeout_ms(),

               retry: false

             ) do

          {:ok, %Req.Response{status: 200}} ->

            File.rename(temporary, path)

          {:ok, %Req.Response{status: 404}} ->

            {:error, :not_found}

          {:ok, %Req.Response{status: status, body: body}} ->

            {:error, {:gcs_error, status, body}}

          {:error, reason} ->

            {:error, reason}

        end

      end

    if result != :ok, do: File.rm(temporary)

    result

  end

  defp regular_file_size(path) do

    case File.stat(path) do

      {:ok, %File.Stat{type: :regular, size: size}} -> {:ok, size}

      {:ok, _not_regular} -> {:error, :invalid_entry_file}

      {:error, reason} -> {:error, reason}

    end

  end

  defp stream_timeout_ms do

    Application.get_env(

      :openagents,

      :forge_wal_stream_timeout_ms,

      @default_stream_timeout_ms

    )

  end

  defp object_url(bucket, name) do

    @storage_base <>

      "/storage/v1/b/#{URI.encode_www_form(bucket)}/o/#{URI.encode_www_form(name)}"

    end

  end

  @impl WAL

  def put_entry_file(repo, seq, source_path) when is_integer(seq) and seq >= 0 do

    with {:ok, key} <- WAL.entry_key_file(seq, source_path) do

      destination = Path.join(repo_dir(repo), key)

      copy_file_atomically(source_path, destination, key)

    end

  end

  @impl WAL

  def put_object(repo, object_key, payload) when is_binary(payload) do

    path = Path.join(repo_dir(repo), object_key)

    end

  end

  @impl WAL

  def get_entry_file(repo, object_key, destination_path) do

    source_path = Path.join(repo_dir(repo), object_key)

    case File.stat(source_path) do

      {:ok, %File.Stat{type: :regular}} ->

        case copy_file_atomically(source_path, destination_path, destination_path) do

          {:ok, _destination} -> :ok

          {:error, reason} -> {:error, reason}

        end

      {:error, :enoent} ->

        {:error, :not_found}

      {:ok, _not_regular} ->

        {:error, :not_found}

      {:error, reason} ->

        {:error, reason}

    end

  end

  ## Internal

  defp do_cas(repo, :none, index) do

    end

  end

  defp copy_file_atomically(source, destination, result) do

    temporary = destination <> ".tmp." <> Integer.to_string(System.unique_integer([:positive]))

    with :ok <- File.mkdir_p(Path.dirname(destination)),

         {:ok, _bytes} <- File.copy(source, temporary),

         :ok <- File.rename(temporary, destination) do

      {:ok, result}

    else

      {:error, reason} ->

        File.rm(temporary)

        {:error, reason}

    end

  end

  defp decode_index(raw) do

    case Jason.decode(raw) do

      {:ok, %{"generation" => generation} = index} when is_integer(generation) ->

  alias OpenAgents.Repositories.{Repository, RepositoryImport}

  @maximum_append_attempts 3

  @default_import_timeout_ms 10 * 60 * 1_000

  @default_import_timeout_ms 6 * 60 * 60 * 1_000

  @default_maximum_bundle_bytes 20 * 1_024 * 1_024 * 1_024

  def import(%Repository{} = repository, options \\ []) do

    repository = Repo.preload(repository, [:created_by_user, :repository_import])

           import_stage(repository, repository_import, "verify_snapshot", fn ->

             verify_snapshot(source_repository, repository_import)

           end),

         {:ok, payload, format} <-

         {:ok, payload, format, payload_bytes} <-

           import_stage(repository, repository_import, "create_payload", fn ->

             create_payload(source_repository, refs, temporary_directory)

           end),

         :ok <- log_payload_ready(repository, repository_import, payload_bytes),

         :ok <-

           import_stage(repository, repository_import, "append_wal", fn ->

             append_import(repository, repository_import, payload, format, refs, 0)

  end

  defp create_payload(_source_repository, refs, _temporary_directory) when map_size(refs) == 0,

    do: {:ok, "", "empty_import"}

    do: {:ok, "", "empty_import", 0}

  defp create_payload(source_repository, _refs, temporary_directory) do

    bundle_path = Path.join(temporary_directory, "snapshot.bundle")

    case Repos.git(source_repository, ["bundle", "create", bundle_path, "--all"]) do

      {_output, 0} ->

        case File.read(bundle_path) do

          {:ok, payload} -> {:ok, payload, "git_bundle"}

          {:error, _reason} -> {:error, :bundle_unavailable}

        case File.stat(bundle_path) do

          {:ok, %File.Stat{type: :regular, size: size}} ->

            if size <= maximum_bundle_bytes() do

              {:ok, {:file, bundle_path}, "git_bundle", size}

            else

              {:error, :import_too_large}

            end

          {:ok, _not_regular} ->

            {:error, :bundle_unavailable}

          {:error, _reason} ->

            {:error, :bundle_unavailable}

        end

      {_output, _status} ->

         :missing <- import_entry(index, repository_import.id),

         true <- WAL.refs(index) == %{} or {:error, :destination_not_empty},

         seq = WAL.next_seq(index),

         {:ok, object} <- WAL.put_entry(repository.storage_key, seq, payload),

         {:ok, object} <- put_payload(repository.storage_key, seq, payload),

         entry = %{

           "seq" => seq,

           "object" => object,

  defp error_code(:github_scope_required), do: "github_scope_required"

  defp error_code(:github_token_missing), do: "github_connection_required"

  defp error_code(:import_timeout), do: "import_timeout"

  defp error_code(:import_too_large), do: "import_too_large"

  defp error_code(_reason), do: "import_failed"

  defp import_stage(repository, repository_import, stage, operation) do

        log_stage(repository, repository_import, stage, "completed")

        result

      {:ok, _value, _metadata, _measurement} = result ->

        log_stage(repository, repository_import, stage, "completed")

        result

      {:error, reason} = result ->

        log_stage(repository, repository_import, stage, "failed", reason)

        result

  defp diagnostic_error(_reason), do: " error_code=unexpected_error"

  defp put_payload(storage_key, seq, {:file, path}),

    do: WAL.put_entry_file(storage_key, seq, path)

  defp put_payload(storage_key, seq, payload) when is_binary(payload),

    do: WAL.put_entry(storage_key, seq, payload)

  defp log_payload_ready(repository, repository_import, bytes) do

    Logger.info(

      "repository_import_payload" <>

        " repository_id=#{repository.id}" <>

        " repository_import_id=#{repository_import.id}" <>

        " bytes=#{bytes}" <>

        " storage=streamed"

    )

    :ok

  end

  defp maximum_bundle_bytes do

    case Application.get_env(

           :openagents,

           :repository_import_max_bundle_bytes,

           @default_maximum_bundle_bytes

         ) do

      value when is_integer(value) and value > 0 -> value

      _invalid -> @default_maximum_bundle_bytes

    end

  end

  defp temporary_directory(import_id) do

    root = Application.get_env(:openagents, :repository_import_temp_dir, System.tmp_dir!())

    Path.join(root, "openagents-import-#{import_id}-#{System.unique_integer([:positive])}")

      "default_branch" => repository.default_branch,

      "lifecycle_state" => repository.lifecycle_state,

      "provision_error_code" => repository.provision_error_code,

      "clone_url" => base_url <> "/git/#{owner}/#{repository.name}.git",

      "clone_url" => base_url <> "/#{owner}/#{repository.name}.git",

      "html_url" => base_url <> "/#{owner}/#{repository.name}",

      "permissions" => permissions,

      "created_at" => DateTime.to_iso8601(repository.inserted_at),

        %{slug: "api-tokens", title: "API tokens", icon: "key", route: "/settings/api-tokens"}

      ]

    },

    %{

      title: "Repositories and CLI",

      items: [

        %{

          slug: "openagents-cli",

          title: "Repositories and CLI",

          icon: "terminal",

          route: "/repositories"

        },

        %{

          slug: "install-cli",

          title: "Install the CLI",

          icon: "download",

          route: "/repositories"

        },

        %{

          slug: "create-repository",

          title: "Create a repository",

          icon: "square-plus",

          route: "/repositories/new"

        },

        %{

          slug: "import-github",

          title: "Import from GitHub",

          icon: "download",

          route: "/repositories/import/github"

        },

        %{

          slug: "clone-push-pull",

          title: "Clone, push, and pull",

          icon: "code",

          route: "/repositories"

        },

        %{

          slug: "cli-command-reference",

          title: "CLI command reference",

          icon: "square-code",

          route: "/repositories"

        }

      ]

    },

    %{

      title: "Issues",

      items: [

  # they are interpolated rather than written into the template, where the HEEx

  # parser would read them as tags.

  @cli_steps [

    %{command: "npx --yes @openagentsinc/cli@latest --version", note: "try without installing"},

    %{command: "npm i -g @openagentsinc/cli", note: "install"},

    %{command: "openagents auth login", note: "sign in"},

    %{command: "openagents repo create <name>", note: "create"},

     |> assign(:repositories_more?, more?)

     |> assign(:watching, MapSet.new())

     |> assign(:cli_steps, @cli_steps)

     |> assign(:clone_url_shape, OpenAgentsWeb.Endpoint.url() <> "/git/<owner>/<name>.git")

     |> assign(:clone_url_shape, OpenAgentsWeb.Endpoint.url() <> "/<owner>/<name>.git")

     |> stream(:repositories, repositories)

     |> watch(repositories)}

  end

          The <code class="text-foreground">openagents</code>

          command creates, clones, and imports these repositories from a terminal.

          Clone URLs are <code class="text-foreground">{@clone_url_shape}</code>.

          <.link navigate={~p"/docs/openagents-cli"} class="text-foreground underline">

            Read the CLI guide.

          </.link>

        </p>

        <ul class="space-y-2">

  def clone_url(%Repository{} = repository) do

    OpenAgentsWeb.Endpoint.url() <>

      "/git/#{repository.namespace.slug}/#{repository.name}.git"

      "/#{repository.namespace.slug}/#{repository.name}.git"

  end

  defp ordinary_public?(%Repository{visibility: "public", storage_key: storage_key}),

  defp policy(%{path: "/admin"}),

    do: declaration(:operator, "configured operator GitHub ID", "voice:metadata:read", false)

  defp policy(%{path: "/git"}),

    do:

      declaration(

        :git_transport,

        "operator or active paired-machine HTTP credential",

        "git:repository",

        true

      )

  defp policy(%{path: path})

       when path in [

              "/:owner/:repo/info/refs",

              "/:owner/:repo/git-upload-pack",

              "/:owner/:repo/git-receive-pack",

              "/git"

            ],

       do:

         declaration(

           :git_transport,

           "anonymous read or authorized user, operator, or paired-machine HTTP credential",

           "git:repository",

           true

         )

  defp policy(%{path: "/api/status", verb: verb}) when verb in [:get, :head],

    do: declaration(:public_read, "anonymous", "published:status", false)

    get "/recordings/:id/audio", AdminRecordingController, :show

  end

  scope "/" do

    pipe_through :forge_git

    get "/:owner/:repo/info/refs", OpenAgents.Forge.GitHTTP, []

    post "/:owner/:repo/git-upload-pack", OpenAgents.Forge.GitHTTP, []

    post "/:owner/:repo/git-receive-pack", OpenAgents.Forge.GitHTTP, []

  end

  # Keep existing remotes operational while every newly issued clone URL uses

  # the canonical GitHub-shaped /:owner/:repo.git path.

  scope "/git" do

    pipe_through :forge_git

    forward "/", OpenAgents.Forge.GitHTTP

Tokens authenticate programmatic access to the REST API. Manage them at

[API tokens](/settings/api-tokens).

The OpenAgents CLI normally obtains an API token through browser-assisted

device authorization and stores it in the operating-system credential store.

See [Install the CLI](/docs/install-cli) when you do not need to create a token

manually.

## Creating a token

Create a token and copy it immediately. Only a hash is stored, so the value

  https://openagents.com/api/v3/repos/OpenAgentsInc/openagents.com/issues

```

## Revoking

## Revoke a token

Revoking takes effect immediately. Any request in flight with that token fails

on its next call.

## Scope

## Understand the scope

A token acts as you. It reaches what your account reaches and nothing more.

# Browsing code

Any repository the forge hosts can be read in the browser at `/:repo`.

Open a repository that you can access at `/:owner/:repo`. Start from

[Repositories](/repositories) when you do not know the exact path.

## Files

`/:repo/blob/:ref/*path` renders one file at one ref. The ref is part of the

URL, so a link to a file is a link to that file *at that revision* and does not

drift as the branch moves.

`/:owner/:repo/blob/:ref/*path` renders one file at one ref. The ref is part of

the URL, so a file link stays at that revision when the branch moves.

The repository page also lists branches, tags, recent commits, and the clone