Deploy your own

wrangler.jsonc is set up for githive.app: its D1 database, KV namespace, custom domain and Cloudflare Access team are ours, so a deploy from a fresh clone fails until you swap them for your own. Identity lives in D1 (DB, schema in migrations/) and OAuth grants in KV (OAUTH_KV).

Make your own storage, and put the IDs these print into wrangler.jsonc (d1_databases[0].database_id and kv_namespaces[0].id). The queue and its subscription carry every push in your account to the Worker, so it learns changes’ heads without reading agents’ forks:
```
npx wrangler d1 create githive
npx wrangler kv namespace create OAUTH_KV
npx wrangler queues create githive-pushes
npx wrangler queues subscription create githive-pushes --source artifacts --events repo.pushed
```
Cloudflare allows one such subscription per account. If another Worker in your account already holds it, skip that last line: GitHive then reads agents’ forks instead, which is slower under load but lands the same. GitHive’s own bench Worker runs that way, since githive.app holds the account’s subscription. Awareness doesn’t run without the events, though: agents get no heads-ups, no interface news, and no Clef hints on their pushes, nor the preview screenshots behind them (see awareness.md).
Point it at your own address. In wrangler.jsonc, delete the routes entry for githive.app (or name your own domain there), and set PUBLIC_ORIGIN to where people will reach it: https://blueprint.<your-subdomain>.workers.dev, or your domain. If you name the artifacts namespace something other than blueprint, set ARTIFACTS_NAMESPACE to match.
Cloudflare Access is optional. It guards only the admin door: approving sign-ins and choosing who may use the hosted agents. Without it, set ACCESS_TEAM_DOMAIN and ACCESS_AUD to "" and do those steps in D1 directly (step 6). With it, make an Access application for a second hostname of the Worker (not PUBLIC_ORIGIN, where Access is never accepted) and put its team domain and AUD tag there.

Secrets. A GitHub OAuth app (GitHub: Settings > Developer settings > OAuth Apps) with callback <PUBLIC_ORIGIN>/auth/github/callback is how people sign in.

npx wrangler d1 migrations apply githive --remote   # again after pulling: a new migration comes before its code
openssl genpkey -algorithm ed25519 -outform DER | base64 | npx wrangler secret put STAMP_KEY   # signs the records
npx wrangler secret put GITHUB_CLIENT_ID
npx wrangler secret put GITHUB_CLIENT_SECRET
npx wrangler secret put OPENAI_API_KEY        # only for GitHive's hosted builder and reviewers; agents you bring over MCP don't need it
npx wrangler secret put GOOGLE_CLIENT_ID      # optional: Google sign-in shows only once these are set; an OAuth web client
npx wrangler secret put GOOGLE_CLIENT_SECRET  #   with redirect <PUBLIC_ORIGIN>/auth/google/callback
npx wrangler secret put INVITE_CODE           # optional: a shared invite code (see Signing in)
npx wrangler secret put GITHUB_APP_ID         # optional: GitHive's GitHub App, to connect repos to GitHub
npx wrangler secret put GITHUB_APP_PRIVATE_KEY
npx wrangler secret put CF_ANALYTICS_TOKEN    # optional: the Usage page; an API token with Account Analytics: Read
npx wrangler secret put CF_ACCOUNT_ID         #   and the account it reads (`npx wrangler whoami` shows it)

The Usage page reads the Worker named by WORKER_NAME in the wrangler config (set it if you rename the Worker). Without the two secrets it says usage isn’t set up; nothing else needs them.

Clef, which reads what agents write for each other, needs no secret: the AI binding in the wrangler config is Workers AI on your account, billed per input token. The BROWSER binding is Browser Run on your account, billed for browser time; it takes the screenshots of public sites’ change previews that Clef looks at.

To let other people connect their repos, make the App public (its settings, Advanced) and point GITHUB_APP_URL in web/src/components/GitHubSettings.tsx and src/toolkit/tools/settings-input.ts at its install page.

Deploy: npm run deploy. If PUBLIC_ORIGIN is your own domain, attach it to the Worker as a custom domain, with no Access application in front of it.

Let yourself in. Only invited emails can sign in. Without Access, invite yourself in D1, sign in with GitHub, and add yourself to the hosted agents’ list if you set OPENAI_API_KEY:

npx wrangler d1 execute githive --remote --command \
  "INSERT INTO invites (email, invited_by, created_at) VALUES ('you@example.com', 'setup', strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))"
# after you've signed in once:
npx wrangler d1 execute githive --remote --command \
  "INSERT INTO hosted_agent_users (user_id, granted_by, created_at) SELECT id, 'setup', strftime('%Y-%m-%dT%H:%M:%fZ', 'now') FROM users WHERE email = 'you@example.com'"

Invite others the same way (emails in lowercase). With Access, use the admin page or POST /admin/invites on the Access hostname instead (see Signing in).