Comment by smcleod

Comment by smcleod 4 days ago

4 replies

Why does it require signing and granting you full access to act as me on Github to use?

cmux-agent requires access to your Github account:

    Verify your GitHub identity
    Know what resources you can access
    Act on your behalf
    View your email addresses
I would have logged an issue for this but I see you've disabled logging issues on the repo. Seems a bit sus to me.
lawrencechen 4 days ago

Public repos shouldn't require being signed in.

Just tested these example links in incognito and seemed to work?

https://0github.com/manaflow-ai/cmux/pull/666

https://0github.com/stack-auth/stack-auth/pull/988

https://0github.com/tinygrad/tinygrad/pull/12995

https://0github.com/simonw/datasette/pull/2548

> you've disabled logging issues on the repo

Sorry, wasn't aware. Turning it on right now. EDIT: https://github.com/manaflow-ai/cmux/issues seems to be fine?

csomar 3 days ago

It is GitHub mess. See the discussion: https://github.com/orgs/community/discussions/37117

To keep it short, GitHub has oauth App and "GitHub Apps". GitHub Apps are the new model and they can be installed to particular repos instead of having wide access to your account. GitHub recommends you use them. There is one catch however: GitHub did architecture these apps so that they can "act on the user behalf". Even if your app only asks for "an email address", they will still have that "permission" even though it is against nothing.

Thus, the scary popup. I've found the only solution to this is to "complicate" your flow. If you go to https://codeinput.com (my app), and click login with GitHub, you'll be taken to a less scarier popup that only asks for your email (it's an oauth app!). This, however, is at the expense of you having to do the "authenticate + install" dance again after you login! So I had to create an onboarding step, kind of to explain to the user the different steps he has to take.

smcleod 4 days ago

It's when you first start the app it asks you to login using GitHub before you see anything else.

  • lawrencechen 4 days ago

    cmux desktop app currently requires signing in to GitHub. We will build out better support for local repositories and remove sign in requirement soon.