docs(README.md): actually remove example with authz issue this time - #1102
Merged
Conversation
📝 WalkthroughWalkthroughREADME.md updates the Claude Code project workflow to describe fine-grained PAT handling through the macOS keychain, credential isolation inside the sandbox, and dependency installation via ChangesCredential-free agent workflow
Estimated code review effort: 1 (Trivial) | ~3 minutes Possibly related PRs
Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
twitchyliquid64
approved these changes
Jul 30, 2026
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
README.md (1)
75-75: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winClarify what remains credential-free.
The workflow is not entirely credential-free because the PAT is later exposed to the sandbox. Consider saying “the agent process remains credential-free” to make the security boundary precise and avoid overstating the guarantee.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@README.md` at line 75, Update the README example’s security description to clarify that the agent process remains credential-free, rather than implying the entire workflow or sandbox never receives credentials; preserve the explanation that the PAT is exposed to the sandbox only after the agent exits.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@README.md`:
- Line 75: Update the README example’s PAT setup description to explicitly
require the fine-grained token’s repository permission “Contents: Read and
write,” in addition to repository-scoped access, so the later repository update
step is authorized.
---
Nitpick comments:
In `@README.md`:
- Line 75: Update the README example’s security description to clarify that the
agent process remains credential-free, rather than implying the entire workflow
or sandbox never receives credentials; preserve the explanation that the PAT is
exposed to the sandbox only after the agent exits.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| ``` | ||
|
|
||
| Prefer not to grant Claude Code access to your GitHub repos via the Claude GitHub App? This variant keeps the agent credential-free: it uses a fine-grained GitHub personal access token (PAT) stored in the macOS keychain, revealed to the sandbox only after the agent has exited. | ||
| In this example we'll create a new git repo from within a Minimal sandbox, using tools from the [Minimal Public Registry](https://github.com/gominimal/pkgs/). The workflow keeps the agent credential-free: it uses a fine-grained GitHub personal access token (PAT) stored in the macOS keychain, revealed to the sandbox only after the agent has exited. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Document the required repository write permission for the PAT.
The fine-grained PAT needs Contents: Read and write; repository-scoped access alone will make the later update step fail with authorization errors.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@README.md` at line 75, Update the README example’s PAT setup description to
explicitly require the fine-grained token’s repository permission “Contents:
Read and write,” in addition to repository-scoped access, so the later
repository update step is authorized.
jtnk
approved these changes
Jul 30, 2026
norrietaylor
approved these changes
Jul 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Removed first getting started example due to authz problems
Testing
Renders correctly in my editor's markdown mode
Checklist
BREAKING CHANGE:footer present if this is a breaking changeNote
Remove GitHub App example with authz issue from README
Replaces the GitHub App-based setup flow in README.md with a credential-free workflow that uses a fine-grained GitHub PAT stored in the macOS keychain, revealed only after the agent exits. Also updates a comment in the command block to note that agents can add build/runtime dependencies via
min add.Macroscope summarized dcb361b.
Summary by CodeRabbit
min add.