Skip to content

The Agent: GitHub endpoints expose GitHub authentication (device flow and PAT), repository browsing (repos, branches, working-tree status), and repository mutations (clone, commit, sync, pull request). Authentication state is process-wide, while repo/cwd-scoped operations resolve against the per-request X-Hoody-Cwd header. The token is never returned over the wire.

Reports the process-wide GitHub authentication state. Returns the linked account info; the token itself is never returned.

Terminal window
curl -X GET https://api.hoody.com/api/v1/agent/github/auth/status
NameInTypeRequiredDescription
X-Hoody-CwdheaderstringNoPer-request working-directory scope (the .hoody project layer / record cwd / tool+workflow cwd).
X-Hoody-Config-DirheaderstringNoPer-request --config-dir override selecting which on-disk .hoody install a stateless read/write resolves.
X-Hoody-ContainerheaderstringNoPer-request bound remote container (omitted = local). Rejected (400) on routes with no container dimension.
X-Hoody-RealmheaderstringNoPer-request realm selector ("global" or a 24-hex id). Rejected (realm_scope_unsupported) on this route.
realmquerystringNoIn-query alias of the X-Hoody-Realm header (read only when the header is absent).
{
"authenticated": true,
"login": "octocat",
"host": "github.com",
"scopes": ["repo", "workflow"]
}

Begins a GitHub login. With no body token, starts the device flow and returns the non-secret verification fields. With a body token (a PAT), validates and persists the token directly without a device flow. For GitHub Enterprise, set body host (default github.com).

Terminal window
# Device flow (no body)
curl -X POST https://api.hoody.com/api/v1/agent/github/auth/login
# PAT
curl -X POST https://api.hoody.com/api/v1/agent/github/auth/login \
-H "Content-Type: application/json" \
-d '{"token": "ghp_xxxxxxxxxxxxxxxxxxxx"}'
# GitHub Enterprise
curl -X POST https://api.hoody.com/api/v1/agent/github/auth/login \
-H "Content-Type: application/json" \
-d '{"host": "github.acme.internal"}'
NameInTypeRequiredDescription
X-Hoody-CwdheaderstringNoPer-request working-directory scope.
X-Hoody-Config-DirheaderstringNoPer-request --config-dir override.
X-Hoody-ContainerheaderstringNoPer-request bound remote container (omitted = local).
X-Hoody-RealmheaderstringNoPer-request realm selector. Rejected (realm_scope_unsupported) on this route.
realmquerystringNoIn-query alias of the X-Hoody-Realm header.
NameTypeRequiredDescription
tokenstringNoOptional PAT. When present, the login validates and persists this token (no device flow). Kept in env, never returned.
hoststringNoGitHub host for GitHub Enterprise (GHES); defaults to github.com. Must match the host on the subsequent poll call.

Device flow started (non-secret verification fields) OR PAT linked.

{
"device_code": "3584d83530557fdd1f46af8289938c8ef79f9dc5",
"user_code": "WDJB-MJHT",
"verification_uri": "https://github.com/login/device",
"interval": 5,
"expires_in": 900
}

Polls an in-flight GitHub device-flow login to completion. Forward the {device_code, interval, expires_in} the start reply returned. Required to complete a device-flow login over HTTP — the start RPC only returns the verification URL and device code.

Terminal window
curl -X POST https://api.hoody.com/api/v1/agent/github/auth/login/poll \
-H "Content-Type: application/json" \
-d '{
"device_code": "3584d83530557fdd1f46af8289938c8ef79f9dc5",
"interval": 5,
"expires_in": 900
}'
NameInTypeRequiredDescription
X-Hoody-CwdheaderstringNoPer-request working-directory scope.
X-Hoody-Config-DirheaderstringNoPer-request --config-dir override.
X-Hoody-ContainerheaderstringNoPer-request bound remote container (omitted = local).
X-Hoody-RealmheaderstringNoPer-request realm selector. Rejected (realm_scope_unsupported) on this route.
realmquerystringNoIn-query alias of the X-Hoody-Realm header.
NameTypeRequiredDescription
device_codestringYesThe device_code returned by POST /github/auth/login.
hoststringNoThe GitHub host (default github.com); must match the start call.
intervalintegerNoThe poll interval (seconds) the start reply returned.
expires_inintegerNoThe device-code lifetime (seconds) the start reply returned.

Login completed; the token is persisted (never returned).

{
"key": "github:default",
"login": "octocat",
"host": "github.com"
}

Lists known/configured repositories (github.repo.list).

Terminal window
curl -X GET "https://api.hoody.com/api/v1/agent/github/repos?page=1&limit=20"
NameInTypeRequiredDescription
pagequeryintegerNo1-based page number for pagination.
limitqueryintegerNoMaximum items per page (0 = no pagination).
X-Hoody-CwdheaderstringNoPer-request working-directory scope.
X-Hoody-Config-DirheaderstringNoPer-request --config-dir override.
X-Hoody-ContainerheaderstringNoPer-request bound remote container (omitted = local).
X-Hoody-RealmheaderstringNoPer-request realm selector. Rejected (realm_scope_unsupported) on this route.
realmquerystringNoIn-query alias of the X-Hoody-Realm header.
{
"items": [
{
"full_name": "octocat/Hello-World",
"clone_url": "https://github.com/octocat/Hello-World.git",
"default_branch": "main",
"private": false
}
],
"meta": {
"total": 42,
"page": 1,
"limit": 20
}
}

Lists branches for the requesting cwd’s repository (github.branch.list). Cwd-scoped, not realm-scoped.

Terminal window
curl -X GET "https://api.hoody.com/api/v1/agent/github/branches?page=1&limit=20"
NameInTypeRequiredDescription
pagequeryintegerNo1-based page number for pagination.
limitqueryintegerNoMaximum items per page (0 = no pagination).
X-Hoody-CwdheaderstringNoPer-request working-directory scope.
X-Hoody-Config-DirheaderstringNoPer-request --config-dir override.
X-Hoody-ContainerheaderstringNoPer-request bound remote container (omitted = local).
X-Hoody-RealmheaderstringNoPer-request realm selector. Rejected (realm_scope_unsupported) on this route.
realmquerystringNoIn-query alias of the X-Hoody-Realm header.
{
"items": [
{
"name": "main",
"sha": "c3d0be41ecbe669545ee3e94d31ed9a4bc91ee3c",
"protected": true
},
{
"name": "feature/login",
"sha": "a1b2c3d4e5f6789012345678901234567890abcd",
"protected": false
}
],
"meta": {
"total": 14,
"page": 1,
"limit": 20
}
}

Returns the git working-tree status (github.status) for the requesting cwd. Cwd-scoped (git is repo/cwd-relative), not realm-scoped.

Terminal window
curl -X GET https://api.hoody.com/api/v1/agent/github/status
NameInTypeRequiredDescription
X-Hoody-CwdheaderstringNoPer-request working-directory scope.
X-Hoody-Config-DirheaderstringNoPer-request --config-dir override.
X-Hoody-ContainerheaderstringNoPer-request bound remote container (omitted = local).
X-Hoody-RealmheaderstringNoPer-request realm selector. Rejected (realm_scope_unsupported) on this route.
realmquerystringNoIn-query alias of the X-Hoody-Realm header.
{
"branch": "main",
"clean": false,
"staged": [
{ "path": "src/api.ts", "status": "modified" }
],
"unstaged": [
{ "path": "README.md", "status": "modified" }
],
"untracked": [
{ "path": "src/new-feature.ts" }
],
"ahead": 1,
"behind": 0
}

Clones a GitHub repository through the hardened argv builder (token only in env, cwd-scoped). Supply either repo (owner/name or an https GitHub URL) or the canonical full_name + clone_url pair. The clone runs against the active account host — a URL whose host does not match is rejected. Destructive.

Terminal window
curl -X POST https://api.hoody.com/api/v1/agent/github/clone \
-H "Content-Type: application/json" \
-d '{
"repo": "octocat/Hello-World",
"shallow": true
}'
NameInTypeRequiredDescription
X-Hoody-CwdheaderstringNoPer-request working-directory scope.
X-Hoody-Config-DirheaderstringNoPer-request --config-dir override.
X-Hoody-ContainerheaderstringNoPer-request bound remote container (omitted = local).
X-Hoody-RealmheaderstringNoPer-request realm selector. Rejected (realm_scope_unsupported) on this route.
realmquerystringNoIn-query alias of the X-Hoody-Realm header.
NameTypeRequiredDescription
repostringNoThe repository to clone: "owner/name" or an https GitHub URL. Translated to full_name + clone_url against the active account host.
dirstringNoOptional managed clone root override (clone_root); the traversal-safe parent/dest are derived under it.
full_namestringNoCanonical "owner/name" (alternative to repo; used as-is when supplied). Requires clone_url.
clone_urlstringNoCanonical https clone URL (alternative to repo; re-validated against the active account host). Requires full_name.
shallowbooleanNoShallow clone (default true).
{
"full_name": "octocat/Hello-World",
"path": "/var/lib/hoody/repos/octocat/Hello-World",
"shallow": true
}

Stages all changes and commits in the requesting cwd’s repository (github.commit) through the hardened argv builder, cwd-scoped. Destructive.

Terminal window
curl -X POST https://api.hoody.com/api/v1/agent/github/commit \
-H "Content-Type: application/json" \
-d '{"message": "feat: add new API endpoint"}'
NameInTypeRequiredDescription
X-Hoody-CwdheaderstringNoPer-request working-directory scope.
X-Hoody-Config-DirheaderstringNoPer-request --config-dir override.
X-Hoody-ContainerheaderstringNoPer-request bound remote container (omitted = local).
X-Hoody-RealmheaderstringNoPer-request realm selector. Rejected (realm_scope_unsupported) on this route.
realmquerystringNoIn-query alias of the X-Hoody-Realm header.
NameTypeRequiredDescription
messagestringYesThe commit message.
{
"sha": "a1b2c3d4e5f6789012345678901234567890abcd",
"branch": "main",
"message": "feat: add new API endpoint",
"files_changed": 3
}

Runs fetch → pull → push as one logical sync (github.gw.sync), stopping at the first non-ok step so a later push never runs against a half-synced tree. Use the body direction field to pull-only (fetch+pull) or push-only. Each step runs through the hardened argv builder with a fresh request copy. Destructive.

Terminal window
# Full sync
curl -X POST https://api.hoody.com/api/v1/agent/github/sync \
-H "Content-Type: application/json" \
-d '{}'
# Pull-only
curl -X POST https://api.hoody.com/api/v1/agent/github/sync \
-H "Content-Type: application/json" \
-d '{"direction": "pull"}'
NameInTypeRequiredDescription
X-Hoody-CwdheaderstringNoPer-request working-directory scope.
X-Hoody-Config-DirheaderstringNoPer-request --config-dir override.
X-Hoody-ContainerheaderstringNoPer-request bound remote container (omitted = local).
X-Hoody-RealmheaderstringNoPer-request realm selector. Rejected (realm_scope_unsupported) on this route.
realmquerystringNoIn-query alias of the X-Hoody-Realm header.
NameTypeRequiredDescription
directionstringNoOptional: "pull" (fetch+pull) or "push" (push only). Default is the full fetch→pull→push.
{
"steps": [
{ "step": "fetch", "result": { "status": "ok" } },
{ "step": "pull", "result": { "status": "ok" } },
{ "step": "push", "result": { "status": "ok" } }
]
}

Opens a pull request for the requesting cwd’s repository (github.pr.create) through the hardened argv builder (token only in env, cwd-scoped). Destructive.

Terminal window
curl -X POST https://api.hoody.com/api/v1/agent/github/pr \
-H "Content-Type: application/json" \
-d '{
"title": "Add new API endpoint",
"body": "Implements the new endpoint described in the spec.",
"base": "main"
}'
NameInTypeRequiredDescription
X-Hoody-CwdheaderstringNoPer-request working-directory scope.
X-Hoody-Config-DirheaderstringNoPer-request --config-dir override.
X-Hoody-ContainerheaderstringNoPer-request bound remote container (omitted = local).
X-Hoody-RealmheaderstringNoPer-request realm selector. Rejected (realm_scope_unsupported) on this route.
realmquerystringNoIn-query alias of the X-Hoody-Realm header.
NameTypeRequiredDescription
titlestringNoThe PR title.
bodystringNoThe PR description.
basestringNoOptional base branch (default the repo default).
{
"url": "https://github.com/octocat/Hello-World/pull/42",
"number": 42,
"base": "main",
"head": "feature/login"
}