Permissions
Give each connection only the authority it needs.
RepoHop calculates effective access from four boundaries: the repository policy, the connection's OAuth grant, your plan limits, and the local freeze state. The most restrictive boundary wins.
| Permission | Allows | Default |
|---|---|---|
| Read | List, inspect, search, snapshot, status, and diff | On |
| Write | Create, patch, and delete files inside the approved repository | Off |
| Execute | Run argument-based commands as your local OS user; requires Write | Off |
| Commit | Create an exact Git commit after rechecking HEAD and the patch | Off |
| Push | Push fast-forward changes to the approved remote | Off |
Push always requires Commit. Execute always requires Write and is not a sandbox: a permitted command runs with the authority of the user account running RepoHop Local. It can modify files, read local environment/secrets, use the network, run scripts or invoke Git indirectly. Turning off Push only disables RepoHop's guarded project_push; it cannot stop an Execute-capable command from publishing by another route. Use a dedicated OS account or stronger isolation when a repository needs it.
Permission expansions require local approval. Permission reductions and revocations apply immediately.