PRs and push grants

ChatGPT can clone, inspect, edit, test, and commit before direct GitHub push is enabled. Choose a write path only when the work is ready to leave the Sprite.

Publish a PR

zodex-agent github publish-pr \
  --repo owner/repo \
  --title "Ship the change" \
  --base main \
  --body "Summary and validation"

Add --draft when appropriate.

publish-pr requires a clean committed checkout and a supported GitHub origin matching the requested repository. The writer App must cover that repository. Writer tokens remain inside zodex-prd.

Request direct push from the Agent

zodex-agent github request-push --repo owner/repo

The command uses the writer App’s Device Flow. Setup already receives and validates the writer Client ID, so there should be no manual runtime-config edit first.

Defaults:

• TTL: 30 minutes;
• scope: exact owner/repo;
• refresh-token caching: off unless explicitly requested.

After approval, normal Git works:

git push origin HEAD

Inspect grants

From the guest:

zodex-agent github list-grants

From the operator:

zodex sprite github list-grants --sprite dev

Expired grants are not usable by the credential helper.

Revoke a grant

Guest:

zodex-agent github revoke-push --repo owner/repo

Operator:

zodex sprite github revoke-push --sprite dev --repo owner/repo

Revocation is per repository.

When repeated approval becomes noise

Use repo-scoped YOLO instead of turning one grant into an accidental forever credential:

zodex sprite github yolo \
  --sprite dev \
  --repo owner/repo \
  --ttl 2h

Return to default policy:

zodex sprite github default --sprite dev

This does not remove unrelated explicit grants; revoke those separately.

Bundle size

PR and direct/YOLO bundle submission share the default 128 MiB ceiling. Oversized bundles are rejected before the publisher performs GitHub work.