Sign-in asks GitHub for the repo scope, which is broader than this needs — it is what GitHub offers for pushing a branch to a private repository. What it is used for: listing repositories you can push to, reading whether a .claude/settings.json already exists so yours is merged rather than overwritten, creating a new branch, and opening a pull request. It never pushes to your default branch. Signing out drops the token.

Teammates run git pull. That is their whole setup — the hooks and the room id travel with the repo. Node 18 or newer is the only requirement, and 20 or newer is what it is tested on.

This opens a pull request on a new branch. Nothing reaches your default branch until you merge it.

What the pull request adds

• .claude/agentmash/*.mjs Four hook scripts and one shared library. They report your edits and ask about teammates' edits. Every one of them exits 0 on any failure. Reporting happens in the background, and the one check that runs before an edit is capped at 1.5 seconds, so a server that is down or slow can never block your agent.
• .claude/agentmash/config.json This server's URL and a newly created room id.
• .claude/settings.json Four hook entries, merged into whatever is already there. If a file exists and is not valid JSON, the install stops rather than guessing.

The room id is the credential. Anyone who can read the repo can read and write that room's events, which is what makes a teammate's setup a git pull. A public repo publishes its room id, so prefer a private repo — or create the room with npx agentmash init and share it out of band with npx agentmash join.

What ever leaves a machine: file paths, branch names, the line counts and declarations of each change, and the first 200 characters of each prompt. Never the contents of a file.

Repository

Pull request

Dashboard

What happens next

1. Read the diff, then merge it — that is the whole installation.
2. Everyone runs git pull, which they would do anyway.
3. Their next agent session joins on its own. Node 18+ is the only requirement.
4. Keep the dashboard open while you work to watch it happen.

Nothing appears on the dashboard until someone's agent edits a file. That first event is your confirmation it works. If it does not arrive, npx agentmash doctor in the repo will say why — the hooks stay silent on failure by design, so it is the only thing that will tell you.

What you now have is advisory: your agents warn each other about recent edits to the same file. It does not lock anything, and it does not stop two agents editing one file.