Skip to content

Work on a private repo

This page connects GitHub so agents can work on your private repos with the same commands as public ones. Usually that takes one browser approval, the first time.

  1. Run Claude from your private repo.

    Terminal window
    cd ~/src/private-repo
    droneship run claude

    The first time, the CLI can’t reach the repo, so it starts the GitHub authorization:

    'https://github.com/you/private-repo' was not found, or it is private and you have not connected GitHub yet.
    Authorizing GitHub… a browser window will open.

  2. Approve in your browser.

    Authorize the Highflame Forge GitHub app. The terminal confirms it and the launch carries on:

    GitHub connected.

  3. Install the app on the repo’s owner, if the CLI asks.

    Authorizing alone gives no access to repositories. The app also has to be installed on the account or organization that owns the repo. If it isn’t yet, the CLI says so:

    GitHub authorized — but the Highflame Forge app is not installed on any account yet.
      Authorizing alone grants no repository access; the app has to be installed on the account that owns the repo.
      Install it here: https://github.com/apps/highflame-forge/installations/new
      Then re-run the same command.

    Install it, then run droneship run claude again.

Connect up front, or again

Section titled “Connect up front, or again”

droneship connect runs the same flow without launching a sandbox. Use it to connect before your first run, or to repair a connection.

Terminal window
droneship connect           # connect GitHub
droneship connect --force   # replace the stored connection
GitHub is already connected.

If a connection lapses, the next launch reconnects:

Your GitHub connection has lapsed (or no longer reaches you/private-repo); reconnecting…

How it works

Section titled “How it works”

With Claude Code, by default, the GitHub token isn’t in the sandbox. A sidecar outside it holds the token and adds it to the sandbox’s git traffic, and it works only for that one repo. The agent can clone, fetch and push without the token in its environment. Private repos get the same isolation as public ones, except with --subscription or --direct.

The same connection lets a task push its branch and open its own pull request, on private and public repos alike.

More: droneship connect, Isolation and identity.

Next

Section titled “Next”