Integration resources

An integration gives an agent access to a whole service. An integration resource narrows that down to a specific object inside it, and pins it to a chat or a workflow.

Pinning does two things:

1. It disambiguates. When the prompt says "the repo", the agent knows exactly which repository that is. You don't have to spell out acme/api in every instruction.
2. It grants scoped, credential-free access. Helios mints a short-lived token scoped to just that resource and injects it into the agent's outbound requests at the network layer. The agent can clone and work in the repository; it never sees a credential it could leak.

What can be pinned

Today, GitHub repositories. You can pin more than one.

Other integrations are reachable from any chat or workflow through their full API — they just don't have a pinnable object type yet.

Pinning to a chat

Open the chat's resource picker, choose your GitHub integration, and select one or more repositories. The agent is told which repositories are attached and can git clone them immediately.

Pinning to a workflow

A workflow's pinned resources apply to every run of it. Set them once on the workflow; each run gets freshly minted access.

This is what makes a repo-scoped workflow prompt work:

When a pull request is opened, check out the branch, run the test suite, and
comment on the PR with any failures.

The agent has the repository, the checkout, and the ability to run code — because the repository is pinned and the sandbox is a real computer.

Related

• GitHub integration — connecting and authorizing.
• Sandboxes — how credential injection works.