A per-run push credential for your own machines, and commits that say who made them
Runs on your own machines no longer push with the Git login stored there: each run gets a short-lived GitHub credential that can only write to that run's repositories. Their commits now name the Agent that did the work and the machine it ran on, so your Git history can answer both.
This release reached production on 7 September 2026. Release tagging was not running that week, so it has no version number and is listed by date.
It is one change, and it is for people who run agents on their own machines. A fleet node no longer pushes with the Git login stored on the machine: each run gets its own GitHub App token, limited to the repositories that run writes to, and every commit it makes says which Agent and which machine produced it.
Before your next fleet run, check that the Ever Works GitHub App is installed on the repositories those Tasks write to, and update the node app on each machine — older node builds stop being given agent runs.
On this page
Improvements(2)
- ImprovementSecurity
Your own machines push with a short-lived credential scoped to one run
Runs on your own machines no longer push with the Git login stored there. Each run gets a GitHub App token that can only write to that run's repositories, and it is revoked when the run ends.
A fleet run used to push with whatever Git login the machine had stored — often a long-lived token with write access to every repository that user can reach. Now the node asks Ever Works for a GitHub App token for that one run, right before it commits.
- Narrow. It covers only the repositories the run writes to, and only to write their contents.
- Short-lived. It is revoked at GitHub when the run ends, and expires within the hour anyway.
- Kept out of reach. It never touches disk, a log, the job record or a command line, it does not exist while the model is running, and it only ever goes to github.com.
Before your next fleet run: install the Ever Works GitHub App on every repository your fleet Tasks write to, with Contents read and write, under one installation owned by the account that owns the Tasks. After adding a repository, use Settings → GitHub App → Sync. Update the node app on each machine too: it needs Git 2.31 or newer, and older builds stop being given agent runs.
Limits: there is no fallback — if no token can be issued, the run is refused and says why. This covers pushing to GitHub repositories only, and fetching still uses the machine’s own Git login.
- ImprovementFleet & nodes
Commits from your own machines now name the Agent and the machine
Commits pushed by runs on your own machines used to share one generic author. Now the Agent is the author, the machine is the committer, and each commit records the node, Agent, job and run it came from.
Every commit a fleet run made used to carry the same generic Ever Works Agent identity, so your Git history could not tell you which Agent or which machine produced a change. Commits from runs on your own machines now say who did the work:
- Author: the Agent, by name, with an
@agents.ever.worksaddress unless the Agent has its own committer email. - Committer: the machine, as
Ever Works node <node name>. - Trailers: the commit message ends with
Ever-Works-Node,Ever-Works-Agent,Ever-Works-JobandEver-Works-Runlines, so you can trace a change back to its run.
These values come from Ever Works records rather than from the Task text, and a node refuses attribution that names a different machine.
Limits: this applies to runs on fleet nodes, not to runs in the cloud. The
Ever-Works-trailer namespace is reserved, so a run fails if its commit message already carries a line that looks like one of these trailers — a Task title can reach the message. Rename the Task if that happens. - Author: the Agent, by name, with an