Repository navigation
feat(run): --github-token-secret for ephemeral runs on private repos - #59
Merged
sre-helmcode merged 1 commit intoOct 20, 2026
Merged
Conversation
nan run --ephemeral --repo OWNER/NAME --github-token-secret NAME names one of the member's secrets holding a GitHub token. The platform uses it only to clone the private repository and never gives it to the agent (helmcode/nan-cloud-api#382). - Usage error (64) without --ephemeral, without --repo, for an empty value or a value that is not a secret name; a pasted GitHub token is never echoed and the member is told to revoke it. - The platform's 404 not_found and 400 on github_token_secret map to clear usage errors instead of "runs are not enabled". - nan run --help and README no longer say an ephemeral run started from the CLI has to use a public repository. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds
--github-token-secret NAMEtonan run, for ad-hoc ephemeral runs on a private repository:nan run --ephemeral --repo acme/private --github-token-secret GITHUB_TOKEN --model glm5.3 "review it"NAMEis one of the member's own secrets holding a GitHub token. The platform uses it only to clone the repository and never gives it to the agent.github_token_secretinPOST /v1/runsonly when given (omitempty).--ephemeral, without--repo, with an empty value, or a value that is not a secret name (^[A-Z][A-Z0-9_]{0,63}$). A value that looks like a GitHub token (ghp_,github_pat_, ...) is never echoed back; the message says it is now in shell history and to revoke it. A lowercase name gets a "Did you mean" hint.param: "github_token_secret"map to usage errors:404 not_found-> "you have no secret named X" (+ where to save it,nan secrets ls);400(a provider key) -> the server's reason, sanitized. Previously an ephemeral 404 would read as "runs are not enabled".nan run --helpand README: dropped "a run started here gets no secrets, so the repository has to be public"; documented the flag and added an example.Base / dependencies
feat/ephemeral-e2-cli(the open ephemeral E2 CLI PR), notmain.Tests (spec-driven, written first)
cmd/ephemeral_ghtoken_test.go: body includes/omitsgithub_token_secret; usage errors (no--ephemeral, no--repo, empty, bad name, lowercase suggestion, pasted classic and fine-grained tokens never echoed); 404/400 refusal mapping with control chars stripped; help and flag text.internal/api/ephemeral_test.go: JSON body omits/includes the field.cmd/ephemeral_test.go: help assertion updated from "public"/"GITHUB_TOKEN" to the new wording.go build ./... && go vet ./... && go test ./...: all packages pass.🤖 Generated with Claude Code