Local Code Canvas — GitHub Integration
One GitHub icon in the canvas header, one click, it just works. Back up your code, collaborate, and keep working from any IDE — without touching git plumbing.
Connect once
Open any canvas and click the GitHub icon in the top-right of the header. The popover shows a single Connect GitHub button the very first time you click it.
We open GitHub OAuth in your default browser. Authorise OpenCharts, and the popover automatically picks up the connection — no code to paste, no second prompt. You'll only do this once: every canvas in Theo Desk inherits the same connection.
Already have a repo URL handy? Click the Already have a repo? Paste URLdisclosure in the popover — we'll authorise GitHub first and then immediately link the repo you pasted (works with owner/name, an https://github.com/... URL, or git@github.com:owner/name.git).
Link a canvas
Create new
Pick a name, choose private or public, click Create & Link. We make the repo on GitHub, push your initial commit, and link this canvas in under 10 seconds.
Connect existing
Paste an owner/name, HTTPS URL, or SSH URL. We wire up origin, fetch the remote, and persist the link on the project doc.
Import to a new canvas
In the canvas picker, click Import from GitHub and paste any github.com URL — we clone it into a brand-new canvas and drop you into the editor.
What you can do
Once a canvas is linked, the GitHub icon turns into your control surface:
- Push / Pull — quick actions in the popover, authenticated automatically.
- Open on GitHub — jump straight to the repo in your default browser.
- Pull requests — browse open PRs, check one out locally, or open a PR from your current branch ().
- Disconnect () — removes the local origin remote and clears the project metadata. The repo on GitHub stays untouched.
Need branch switching, commit logs, or per-file dirty status? The popover's Open advanced link reveals the full source control panel inside the History tab.
Under the hood
The canvas reuses the GitHub OAuth credential you connected via EVI. Tokens are cached per-canvas in the macOS Keychain (theodesk:canvas:<projectId>) and only handed to git's GIT_ASKPASS when push / pull / fetch / clone runs — never written to ~/.gitconfig.
Repo names are validated server-side against ^[a-zA-Z0-9](?:[a-zA-Z0-9_-]{0,38})/[a-zA-Z0-9](?:[a-zA-Z0-9._-]{0,99})$ before they reach git remote add, so option injection (CVE-2017-1000117 class) is impossible.
SSH-style URLs (git@github.com:owner/name.git) are normalised to HTTPS at the Rust layer and flow through the same OAuth askpass — we never spawn an ssh-agent or touch the user's SSH keys.
A 401/403 from GitHub clears the cached token automatically so the next attempt re-fetches from the bridge. The popover surfaces a Reconnect to GitHub CTA inline when this happens.
Related Articles
Theo Desk (macOS)
Native macOS desktop agent that lets Theo see your screen, drive any application, and run multi-step workflows on your Mac.
GitHub Integration
Connect GitHub to browse repos, issues, PRs, commits, and manage repositories from Theo chat.
Skills & Automation
Install skills to extend Theo, automate tasks with hooks and workflows, and manage credit guards.