Connecting GitHub
Clone repositories, create new ones, and open and merge pull requests without leaving Fletch. These features run on a built-in GitHub connection: you authorize Fletch once, and it calls the GitHub API directly and authenticates git pushes and fetches with the same token. There is no GitHub CLI to install and no separate tool to keep signed in.
Connect
Section titled “Connect”Connect from onboarding, or any time under Settings › Account › Connect GitHub.
Connecting runs GitHub’s device flow: a browser tab opens to GitHub’s verification page,
Fletch shows you a short code to enter there, and once you approve, the connection is
live. The token is granted the repo scope (what pushing and PR management need) and is
stored in your macOS Keychain — it never appears in logs or leaves your machine
except in calls to GitHub itself.
Disconnect (same place) removes the stored token.
What it powers
Section titled “What it powers”- Cloning a repository (
owner/repo, HTTPS, or SSH) and searching your repo list. - Creating a new repo — private or public — published with an
originremote. - Pushing branches over HTTPS, authenticated with your token.
- Opening pull requests, merging them, and reading PR state and CI checks.
- Reading PR review comments (bot comments, e.g. from code-review tools, are flagged).
Actions that don’t touch GitHub — opening a local folder, spawning agents, committing, running your project — work without connecting.
Agents never see the token
Section titled “Agents never see the token”Agents run in sandboxes with no credentials inside. When an agent needs a remote action — push, open a PR, fetch — it asks the Fletch host through a broker that accepts only that small fixed set of operations, and the host performs them with your token. The practical consequence cuts both ways: an agent can publish code and open PRs under your identity (these brokered actions currently run without a confirmation prompt), but it can never read or exfiltrate the credential itself.